1 // SPDX-License-Identifier: GPL-2.0+
3 * Kernel module help for s390.
6 * Copyright IBM Corp. 2002, 2003
7 * Author(s): Arnd Bergmann (arndb@de.ibm.com)
8 * Martin Schwidefsky (schwidefsky@de.ibm.com)
10 * based on i386 version
11 * Copyright (C) 2001 Rusty Russell.
13 #include <linux/module.h>
14 #include <linux/elf.h>
15 #include <linux/vmalloc.h>
17 #include <linux/ftrace.h>
18 #include <linux/string.h>
19 #include <linux/kernel.h>
20 #include <linux/kasan.h>
21 #include <linux/moduleloader.h>
22 #include <linux/bug.h>
23 #include <linux/memory.h>
24 #include <asm/alternative.h>
25 #include <asm/nospec-branch.h>
26 #include <asm/facility.h>
27 #include <asm/ftrace.lds.h>
28 #include <asm/set_memory.h>
29 #include <asm/setup.h>
34 #define DEBUGP(fmt , ...)
37 #define PLT_ENTRY_SIZE 22
39 static unsigned long get_module_load_offset(void)
41 static DEFINE_MUTEX(module_kaslr_mutex);
42 static unsigned long module_load_offset;
47 * Calculate the module_load_offset the first time this code
48 * is called. Once calculated it stays the same until reboot.
50 mutex_lock(&module_kaslr_mutex);
51 if (!module_load_offset)
52 module_load_offset = get_random_u32_inclusive(1, 1024) * PAGE_SIZE;
53 mutex_unlock(&module_kaslr_mutex);
54 return module_load_offset;
57 void *module_alloc(unsigned long size)
59 gfp_t gfp_mask = GFP_KERNEL;
62 if (PAGE_ALIGN(size) > MODULES_LEN)
64 p = __vmalloc_node_range(size, MODULE_ALIGN,
65 MODULES_VADDR + get_module_load_offset(),
66 MODULES_END, gfp_mask, PAGE_KERNEL,
67 VM_FLUSH_RESET_PERMS | VM_DEFER_KMEMLEAK,
68 NUMA_NO_NODE, __builtin_return_address(0));
69 if (p && (kasan_alloc_module_shadow(p, size, gfp_mask) < 0)) {
76 #ifdef CONFIG_FUNCTION_TRACER
77 void module_arch_cleanup(struct module *mod)
79 module_memfree(mod->arch.trampolines_start);
83 void module_arch_freeing_init(struct module *mod)
85 if (is_livepatch_module(mod) &&
86 mod->state == MODULE_STATE_LIVE)
89 vfree(mod->arch.syminfo);
90 mod->arch.syminfo = NULL;
93 static void check_rela(Elf_Rela *rela, struct module *me)
95 struct mod_arch_syminfo *info;
97 info = me->arch.syminfo + ELF_R_SYM (rela->r_info);
98 switch (ELF_R_TYPE (rela->r_info)) {
99 case R_390_GOT12: /* 12 bit GOT offset. */
100 case R_390_GOT16: /* 16 bit GOT offset. */
101 case R_390_GOT20: /* 20 bit GOT offset. */
102 case R_390_GOT32: /* 32 bit GOT offset. */
103 case R_390_GOT64: /* 64 bit GOT offset. */
104 case R_390_GOTENT: /* 32 bit PC rel. to GOT entry shifted by 1. */
105 case R_390_GOTPLT12: /* 12 bit offset to jump slot. */
106 case R_390_GOTPLT16: /* 16 bit offset to jump slot. */
107 case R_390_GOTPLT20: /* 20 bit offset to jump slot. */
108 case R_390_GOTPLT32: /* 32 bit offset to jump slot. */
109 case R_390_GOTPLT64: /* 64 bit offset to jump slot. */
110 case R_390_GOTPLTENT: /* 32 bit rel. offset to jump slot >> 1. */
111 if (info->got_offset == -1UL) {
112 info->got_offset = me->arch.got_size;
113 me->arch.got_size += sizeof(void*);
116 case R_390_PLT16DBL: /* 16 bit PC rel. PLT shifted by 1. */
117 case R_390_PLT32DBL: /* 32 bit PC rel. PLT shifted by 1. */
118 case R_390_PLT32: /* 32 bit PC relative PLT address. */
119 case R_390_PLT64: /* 64 bit PC relative PLT address. */
120 case R_390_PLTOFF16: /* 16 bit offset from GOT to PLT. */
121 case R_390_PLTOFF32: /* 32 bit offset from GOT to PLT. */
122 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
123 if (info->plt_offset == -1UL) {
124 info->plt_offset = me->arch.plt_size;
125 me->arch.plt_size += PLT_ENTRY_SIZE;
132 /* Only needed if we want to support loading of
133 modules linked with -shared. */
139 * Account for GOT and PLT relocations. We can't add sections for
140 * got and plt but we can increase the core module size.
142 int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
143 char *secstrings, struct module *me)
151 /* Find symbol table and string table. */
153 for (i = 0; i < hdr->e_shnum; i++)
154 switch (sechdrs[i].sh_type) {
156 symtab = sechdrs + i;
160 printk(KERN_ERR "module %s: no symbol table\n", me->name);
164 /* Allocate one syminfo structure per symbol. */
165 me->arch.nsyms = symtab->sh_size / sizeof(Elf_Sym);
166 me->arch.syminfo = vmalloc(array_size(sizeof(struct mod_arch_syminfo),
168 if (!me->arch.syminfo)
170 symbols = (void *) hdr + symtab->sh_offset;
171 strings = (void *) hdr + sechdrs[symtab->sh_link].sh_offset;
172 for (i = 0; i < me->arch.nsyms; i++) {
173 if (symbols[i].st_shndx == SHN_UNDEF &&
174 strcmp(strings + symbols[i].st_name,
175 "_GLOBAL_OFFSET_TABLE_") == 0)
176 /* "Define" it as absolute. */
177 symbols[i].st_shndx = SHN_ABS;
178 me->arch.syminfo[i].got_offset = -1UL;
179 me->arch.syminfo[i].plt_offset = -1UL;
180 me->arch.syminfo[i].got_initialized = 0;
181 me->arch.syminfo[i].plt_initialized = 0;
184 /* Search for got/plt relocations. */
185 me->arch.got_size = me->arch.plt_size = 0;
186 for (i = 0; i < hdr->e_shnum; i++) {
187 if (sechdrs[i].sh_type != SHT_RELA)
189 nrela = sechdrs[i].sh_size / sizeof(Elf_Rela);
190 rela = (void *) hdr + sechdrs[i].sh_offset;
191 for (j = 0; j < nrela; j++)
192 check_rela(rela + j, me);
195 /* Increase core size by size of got & plt and set start
196 offsets for got and plt. */
197 me->core_layout.size = ALIGN(me->core_layout.size, 4);
198 me->arch.got_offset = me->core_layout.size;
199 me->core_layout.size += me->arch.got_size;
200 me->arch.plt_offset = me->core_layout.size;
201 if (me->arch.plt_size) {
202 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable)
203 me->arch.plt_size += PLT_ENTRY_SIZE;
204 me->core_layout.size += me->arch.plt_size;
209 static int apply_rela_bits(Elf_Addr loc, Elf_Addr val,
210 int sign, int bits, int shift,
211 void *(*write)(void *dest, const void *src, size_t len))
215 void *dest = (void *)loc;
217 if (val & ((1UL << shift) - 1))
220 val = (Elf_Addr)(((long) val) >> shift);
221 min = -(1L << (bits - 1));
222 max = (1L << (bits - 1)) - 1;
223 if ((long) val < min || (long) val > max)
227 umax = ((1UL << (bits - 1)) << 1) - 1;
228 if ((unsigned long) val > umax)
233 unsigned char tmp = val;
234 write(dest, &tmp, 1);
235 } else if (bits == 12) {
236 unsigned short tmp = (val & 0xfff) |
237 (*(unsigned short *) loc & 0xf000);
238 write(dest, &tmp, 2);
239 } else if (bits == 16) {
240 unsigned short tmp = val;
241 write(dest, &tmp, 2);
242 } else if (bits == 20) {
243 unsigned int tmp = (val & 0xfff) << 16 |
244 (val & 0xff000) >> 4 | (*(unsigned int *) loc & 0xf00000ff);
245 write(dest, &tmp, 4);
246 } else if (bits == 32) {
247 unsigned int tmp = val;
248 write(dest, &tmp, 4);
249 } else if (bits == 64) {
250 unsigned long tmp = val;
251 write(dest, &tmp, 8);
256 static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
257 const char *strtab, struct module *me,
258 void *(*write)(void *dest, const void *src, size_t len))
260 struct mod_arch_syminfo *info;
265 /* This is where to make the change */
266 loc = base + rela->r_offset;
267 /* This is the symbol it is referring to. Note that all
268 undefined symbols have been resolved. */
269 r_sym = ELF_R_SYM(rela->r_info);
270 r_type = ELF_R_TYPE(rela->r_info);
271 info = me->arch.syminfo + r_sym;
272 val = symtab[r_sym].st_value;
275 case R_390_NONE: /* No relocation. */
278 case R_390_8: /* Direct 8 bit. */
279 case R_390_12: /* Direct 12 bit. */
280 case R_390_16: /* Direct 16 bit. */
281 case R_390_20: /* Direct 20 bit. */
282 case R_390_32: /* Direct 32 bit. */
283 case R_390_64: /* Direct 64 bit. */
284 val += rela->r_addend;
285 if (r_type == R_390_8)
286 rc = apply_rela_bits(loc, val, 0, 8, 0, write);
287 else if (r_type == R_390_12)
288 rc = apply_rela_bits(loc, val, 0, 12, 0, write);
289 else if (r_type == R_390_16)
290 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
291 else if (r_type == R_390_20)
292 rc = apply_rela_bits(loc, val, 1, 20, 0, write);
293 else if (r_type == R_390_32)
294 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
295 else if (r_type == R_390_64)
296 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
298 case R_390_PC16: /* PC relative 16 bit. */
299 case R_390_PC16DBL: /* PC relative 16 bit shifted by 1. */
300 case R_390_PC32DBL: /* PC relative 32 bit shifted by 1. */
301 case R_390_PC32: /* PC relative 32 bit. */
302 case R_390_PC64: /* PC relative 64 bit. */
303 val += rela->r_addend - loc;
304 if (r_type == R_390_PC16)
305 rc = apply_rela_bits(loc, val, 1, 16, 0, write);
306 else if (r_type == R_390_PC16DBL)
307 rc = apply_rela_bits(loc, val, 1, 16, 1, write);
308 else if (r_type == R_390_PC32DBL)
309 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
310 else if (r_type == R_390_PC32)
311 rc = apply_rela_bits(loc, val, 1, 32, 0, write);
312 else if (r_type == R_390_PC64)
313 rc = apply_rela_bits(loc, val, 1, 64, 0, write);
315 case R_390_GOT12: /* 12 bit GOT offset. */
316 case R_390_GOT16: /* 16 bit GOT offset. */
317 case R_390_GOT20: /* 20 bit GOT offset. */
318 case R_390_GOT32: /* 32 bit GOT offset. */
319 case R_390_GOT64: /* 64 bit GOT offset. */
320 case R_390_GOTENT: /* 32 bit PC rel. to GOT entry shifted by 1. */
321 case R_390_GOTPLT12: /* 12 bit offset to jump slot. */
322 case R_390_GOTPLT20: /* 20 bit offset to jump slot. */
323 case R_390_GOTPLT16: /* 16 bit offset to jump slot. */
324 case R_390_GOTPLT32: /* 32 bit offset to jump slot. */
325 case R_390_GOTPLT64: /* 64 bit offset to jump slot. */
326 case R_390_GOTPLTENT: /* 32 bit rel. offset to jump slot >> 1. */
327 if (info->got_initialized == 0) {
328 Elf_Addr *gotent = me->core_layout.base +
329 me->arch.got_offset +
332 write(gotent, &val, sizeof(*gotent));
333 info->got_initialized = 1;
335 val = info->got_offset + rela->r_addend;
336 if (r_type == R_390_GOT12 ||
337 r_type == R_390_GOTPLT12)
338 rc = apply_rela_bits(loc, val, 0, 12, 0, write);
339 else if (r_type == R_390_GOT16 ||
340 r_type == R_390_GOTPLT16)
341 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
342 else if (r_type == R_390_GOT20 ||
343 r_type == R_390_GOTPLT20)
344 rc = apply_rela_bits(loc, val, 1, 20, 0, write);
345 else if (r_type == R_390_GOT32 ||
346 r_type == R_390_GOTPLT32)
347 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
348 else if (r_type == R_390_GOT64 ||
349 r_type == R_390_GOTPLT64)
350 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
351 else if (r_type == R_390_GOTENT ||
352 r_type == R_390_GOTPLTENT) {
353 val += (Elf_Addr) me->core_layout.base - loc;
354 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
357 case R_390_PLT16DBL: /* 16 bit PC rel. PLT shifted by 1. */
358 case R_390_PLT32DBL: /* 32 bit PC rel. PLT shifted by 1. */
359 case R_390_PLT32: /* 32 bit PC relative PLT address. */
360 case R_390_PLT64: /* 64 bit PC relative PLT address. */
361 case R_390_PLTOFF16: /* 16 bit offset from GOT to PLT. */
362 case R_390_PLTOFF32: /* 32 bit offset from GOT to PLT. */
363 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
364 if (info->plt_initialized == 0) {
365 unsigned char insn[PLT_ENTRY_SIZE];
369 plt_base = me->core_layout.base + me->arch.plt_offset;
370 ip = plt_base + info->plt_offset;
371 *(int *)insn = 0x0d10e310; /* basr 1,0 */
372 *(int *)&insn[4] = 0x100c0004; /* lg 1,12(1) */
373 if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) {
376 jump_r1 = plt_base + me->arch.plt_size -
378 /* brcl 0xf,__jump_r1 */
379 *(short *)&insn[8] = 0xc0f4;
380 *(int *)&insn[10] = (jump_r1 - (ip + 8)) / 2;
382 *(int *)&insn[8] = 0x07f10000; /* br %r1 */
384 *(long *)&insn[14] = val;
386 write(ip, insn, sizeof(insn));
387 info->plt_initialized = 1;
389 if (r_type == R_390_PLTOFF16 ||
390 r_type == R_390_PLTOFF32 ||
391 r_type == R_390_PLTOFF64)
392 val = me->arch.plt_offset - me->arch.got_offset +
393 info->plt_offset + rela->r_addend;
395 if (!((r_type == R_390_PLT16DBL &&
396 val - loc + 0xffffUL < 0x1ffffeUL) ||
397 (r_type == R_390_PLT32DBL &&
398 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
399 val = (Elf_Addr) me->core_layout.base +
400 me->arch.plt_offset +
402 val += rela->r_addend - loc;
404 if (r_type == R_390_PLT16DBL)
405 rc = apply_rela_bits(loc, val, 1, 16, 1, write);
406 else if (r_type == R_390_PLTOFF16)
407 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
408 else if (r_type == R_390_PLT32DBL)
409 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
410 else if (r_type == R_390_PLT32 ||
411 r_type == R_390_PLTOFF32)
412 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
413 else if (r_type == R_390_PLT64 ||
414 r_type == R_390_PLTOFF64)
415 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
417 case R_390_GOTOFF16: /* 16 bit offset to GOT. */
418 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
419 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
420 val = val + rela->r_addend -
421 ((Elf_Addr) me->core_layout.base + me->arch.got_offset);
422 if (r_type == R_390_GOTOFF16)
423 rc = apply_rela_bits(loc, val, 0, 16, 0, write);
424 else if (r_type == R_390_GOTOFF32)
425 rc = apply_rela_bits(loc, val, 0, 32, 0, write);
426 else if (r_type == R_390_GOTOFF64)
427 rc = apply_rela_bits(loc, val, 0, 64, 0, write);
429 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
430 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
431 val = (Elf_Addr) me->core_layout.base + me->arch.got_offset +
432 rela->r_addend - loc;
433 if (r_type == R_390_GOTPC)
434 rc = apply_rela_bits(loc, val, 1, 32, 0, write);
435 else if (r_type == R_390_GOTPCDBL)
436 rc = apply_rela_bits(loc, val, 1, 32, 1, write);
439 case R_390_GLOB_DAT: /* Create GOT entry. */
440 case R_390_JMP_SLOT: /* Create PLT entry. */
441 case R_390_RELATIVE: /* Adjust by program base. */
442 /* Only needed if we want to support loading of
443 modules linked with -shared. */
446 printk(KERN_ERR "module %s: unknown relocation: %u\n",
451 printk(KERN_ERR "module %s: relocation error for symbol %s "
452 "(r_type %i, value 0x%lx)\n",
453 me->name, strtab + symtab[r_sym].st_name,
454 r_type, (unsigned long) val);
460 static int __apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
461 unsigned int symindex, unsigned int relsec,
463 void *(*write)(void *dest, const void *src, size_t len))
471 DEBUGP("Applying relocate section %u to %u\n",
472 relsec, sechdrs[relsec].sh_info);
473 base = sechdrs[sechdrs[relsec].sh_info].sh_addr;
474 symtab = (Elf_Sym *) sechdrs[symindex].sh_addr;
475 rela = (Elf_Rela *) sechdrs[relsec].sh_addr;
476 n = sechdrs[relsec].sh_size / sizeof(Elf_Rela);
478 for (i = 0; i < n; i++, rela++) {
479 rc = apply_rela(rela, base, symtab, strtab, me, write);
486 int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
487 unsigned int symindex, unsigned int relsec,
490 bool early = me->state == MODULE_STATE_UNFORMED;
491 void *(*write)(void *, const void *, size_t) = memcpy;
494 write = s390_kernel_write;
496 return __apply_relocate_add(sechdrs, strtab, symindex, relsec, me,
500 #ifdef CONFIG_FUNCTION_TRACER
501 static int module_alloc_ftrace_hotpatch_trampolines(struct module *me,
508 size = FTRACE_HOTPATCH_TRAMPOLINES_SIZE(s->sh_size);
509 numpages = DIV_ROUND_UP(size, PAGE_SIZE);
510 start = module_alloc(numpages * PAGE_SIZE);
513 set_memory_rox((unsigned long)start, numpages);
516 me->arch.trampolines_start = (struct ftrace_hotpatch_trampoline *)start;
517 me->arch.trampolines_end = (struct ftrace_hotpatch_trampoline *)end;
518 me->arch.next_trampoline = me->arch.trampolines_start;
522 #endif /* CONFIG_FUNCTION_TRACER */
524 int module_finalize(const Elf_Ehdr *hdr,
525 const Elf_Shdr *sechdrs,
529 char *secstrings, *secname;
531 #ifdef CONFIG_FUNCTION_TRACER
535 if (IS_ENABLED(CONFIG_EXPOLINE) &&
536 !nospec_disable && me->arch.plt_size) {
539 ij = me->core_layout.base + me->arch.plt_offset +
540 me->arch.plt_size - PLT_ENTRY_SIZE;
541 ij[0] = 0xc6000000; /* exrl %r0,.+10 */
542 ij[1] = 0x0005a7f4; /* j . */
543 ij[2] = 0x000007f1; /* br %r1 */
546 secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
547 for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) {
548 aseg = (void *) s->sh_addr;
549 secname = secstrings + s->sh_name;
551 if (!strcmp(".altinstructions", secname))
552 /* patch .altinstructions */
553 apply_alternatives(aseg, aseg + s->sh_size);
555 if (IS_ENABLED(CONFIG_EXPOLINE) &&
556 (str_has_prefix(secname, ".s390_indirect")))
557 nospec_revert(aseg, aseg + s->sh_size);
559 if (IS_ENABLED(CONFIG_EXPOLINE) &&
560 (str_has_prefix(secname, ".s390_return")))
561 nospec_revert(aseg, aseg + s->sh_size);
563 #ifdef CONFIG_FUNCTION_TRACER
564 if (!strcmp(FTRACE_CALLSITE_SECTION, secname)) {
565 ret = module_alloc_ftrace_hotpatch_trampolines(me, s);
569 #endif /* CONFIG_FUNCTION_TRACER */