1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* |
3 | * |
4 | * Copyright (C) 2001 Rusty Russell. |
5 | * Copyright (C) 2003, 2004 Ralf Baechle (ralf@linux-mips.org) |
6 | * Copyright (C) 2005 Thiemo Seufer |
7 | */ |
8 | |
9 | #undef DEBUG |
10 | |
11 | #include <linux/extable.h> |
12 | #include <linux/moduleloader.h> |
13 | #include <linux/elf.h> |
14 | #include <linux/mm.h> |
15 | #include <linux/numa.h> |
16 | #include <linux/vmalloc.h> |
17 | #include <linux/slab.h> |
18 | #include <linux/fs.h> |
19 | #include <linux/string.h> |
20 | #include <linux/kernel.h> |
21 | #include <linux/spinlock.h> |
22 | #include <linux/jump_label.h> |
23 | |
24 | extern void jump_label_apply_nops(struct module *mod); |
25 | |
26 | struct mips_hi16 { |
27 | struct mips_hi16 *next; |
28 | Elf_Addr *addr; |
29 | Elf_Addr value; |
30 | }; |
31 | |
32 | static LIST_HEAD(dbe_list); |
33 | static DEFINE_SPINLOCK(dbe_lock); |
34 | |
35 | #ifdef MODULE_START |
36 | void *module_alloc(unsigned long size) |
37 | { |
38 | return __vmalloc_node_range(size, 1, MODULE_START, MODULE_END, |
39 | GFP_KERNEL, PAGE_KERNEL, 0, NUMA_NO_NODE, |
40 | __builtin_return_address(0)); |
41 | } |
42 | #endif |
43 | |
44 | static void apply_r_mips_32(u32 *location, u32 base, Elf_Addr v) |
45 | { |
46 | *location = base + v; |
47 | } |
48 | |
49 | static int apply_r_mips_26(struct module *me, u32 *location, u32 base, |
50 | Elf_Addr v) |
51 | { |
52 | if (v % 4) { |
53 | pr_err("module %s: dangerous R_MIPS_26 relocation\n" , |
54 | me->name); |
55 | return -ENOEXEC; |
56 | } |
57 | |
58 | if ((v & 0xf0000000) != (((unsigned long)location + 4) & 0xf0000000)) { |
59 | pr_err("module %s: relocation overflow\n" , |
60 | me->name); |
61 | return -ENOEXEC; |
62 | } |
63 | |
64 | *location = (*location & ~0x03ffffff) | |
65 | ((base + (v >> 2)) & 0x03ffffff); |
66 | |
67 | return 0; |
68 | } |
69 | |
70 | static int apply_r_mips_hi16(struct module *me, u32 *location, Elf_Addr v, |
71 | bool rela) |
72 | { |
73 | struct mips_hi16 *n; |
74 | |
75 | if (rela) { |
76 | *location = (*location & 0xffff0000) | |
77 | ((((long long) v + 0x8000LL) >> 16) & 0xffff); |
78 | return 0; |
79 | } |
80 | |
81 | /* |
82 | * We cannot relocate this one now because we don't know the value of |
83 | * the carry we need to add. Save the information, and let LO16 do the |
84 | * actual relocation. |
85 | */ |
86 | n = kmalloc(size: sizeof *n, GFP_KERNEL); |
87 | if (!n) |
88 | return -ENOMEM; |
89 | |
90 | n->addr = (Elf_Addr *)location; |
91 | n->value = v; |
92 | n->next = me->arch.r_mips_hi16_list; |
93 | me->arch.r_mips_hi16_list = n; |
94 | |
95 | return 0; |
96 | } |
97 | |
98 | static void free_relocation_chain(struct mips_hi16 *l) |
99 | { |
100 | struct mips_hi16 *next; |
101 | |
102 | while (l) { |
103 | next = l->next; |
104 | kfree(objp: l); |
105 | l = next; |
106 | } |
107 | } |
108 | |
109 | static int apply_r_mips_lo16(struct module *me, u32 *location, |
110 | u32 base, Elf_Addr v, bool rela) |
111 | { |
112 | unsigned long insnlo = base; |
113 | struct mips_hi16 *l; |
114 | Elf_Addr val, vallo; |
115 | |
116 | if (rela) { |
117 | *location = (*location & 0xffff0000) | (v & 0xffff); |
118 | return 0; |
119 | } |
120 | |
121 | /* Sign extend the addend we extract from the lo insn. */ |
122 | vallo = ((insnlo & 0xffff) ^ 0x8000) - 0x8000; |
123 | |
124 | if (me->arch.r_mips_hi16_list != NULL) { |
125 | l = me->arch.r_mips_hi16_list; |
126 | while (l != NULL) { |
127 | struct mips_hi16 *next; |
128 | unsigned long insn; |
129 | |
130 | /* |
131 | * The value for the HI16 had best be the same. |
132 | */ |
133 | if (v != l->value) |
134 | goto out_danger; |
135 | |
136 | /* |
137 | * Do the HI16 relocation. Note that we actually don't |
138 | * need to know anything about the LO16 itself, except |
139 | * where to find the low 16 bits of the addend needed |
140 | * by the LO16. |
141 | */ |
142 | insn = *l->addr; |
143 | val = ((insn & 0xffff) << 16) + vallo; |
144 | val += v; |
145 | |
146 | /* |
147 | * Account for the sign extension that will happen in |
148 | * the low bits. |
149 | */ |
150 | val = ((val >> 16) + ((val & 0x8000) != 0)) & 0xffff; |
151 | |
152 | insn = (insn & ~0xffff) | val; |
153 | *l->addr = insn; |
154 | |
155 | next = l->next; |
156 | kfree(objp: l); |
157 | l = next; |
158 | } |
159 | |
160 | me->arch.r_mips_hi16_list = NULL; |
161 | } |
162 | |
163 | /* |
164 | * Ok, we're done with the HI16 relocs. Now deal with the LO16. |
165 | */ |
166 | val = v + vallo; |
167 | insnlo = (insnlo & ~0xffff) | (val & 0xffff); |
168 | *location = insnlo; |
169 | |
170 | return 0; |
171 | |
172 | out_danger: |
173 | free_relocation_chain(l); |
174 | me->arch.r_mips_hi16_list = NULL; |
175 | |
176 | pr_err("module %s: dangerous R_MIPS_LO16 relocation\n" , me->name); |
177 | |
178 | return -ENOEXEC; |
179 | } |
180 | |
181 | static int apply_r_mips_pc(struct module *me, u32 *location, u32 base, |
182 | Elf_Addr v, unsigned int bits) |
183 | { |
184 | unsigned long mask = GENMASK(bits - 1, 0); |
185 | unsigned long se_bits; |
186 | long offset; |
187 | |
188 | if (v % 4) { |
189 | pr_err("module %s: dangerous R_MIPS_PC%u relocation\n" , |
190 | me->name, bits); |
191 | return -ENOEXEC; |
192 | } |
193 | |
194 | /* retrieve & sign extend implicit addend if any */ |
195 | offset = base & mask; |
196 | offset |= (offset & BIT(bits - 1)) ? ~mask : 0; |
197 | |
198 | offset += ((long)v - (long)location) >> 2; |
199 | |
200 | /* check the sign bit onwards are identical - ie. we didn't overflow */ |
201 | se_bits = (offset & BIT(bits - 1)) ? ~0ul : 0; |
202 | if ((offset & ~mask) != (se_bits & ~mask)) { |
203 | pr_err("module %s: relocation overflow\n" , me->name); |
204 | return -ENOEXEC; |
205 | } |
206 | |
207 | *location = (*location & ~mask) | (offset & mask); |
208 | |
209 | return 0; |
210 | } |
211 | |
212 | static int apply_r_mips_pc16(struct module *me, u32 *location, u32 base, |
213 | Elf_Addr v) |
214 | { |
215 | return apply_r_mips_pc(me, location, base, v, bits: 16); |
216 | } |
217 | |
218 | static int apply_r_mips_pc21(struct module *me, u32 *location, u32 base, |
219 | Elf_Addr v) |
220 | { |
221 | return apply_r_mips_pc(me, location, base, v, bits: 21); |
222 | } |
223 | |
224 | static int apply_r_mips_pc26(struct module *me, u32 *location, u32 base, |
225 | Elf_Addr v) |
226 | { |
227 | return apply_r_mips_pc(me, location, base, v, bits: 26); |
228 | } |
229 | |
230 | static int apply_r_mips_64(u32 *location, Elf_Addr v, bool rela) |
231 | { |
232 | if (WARN_ON(!rela)) |
233 | return -EINVAL; |
234 | |
235 | *(Elf_Addr *)location = v; |
236 | |
237 | return 0; |
238 | } |
239 | |
240 | static int apply_r_mips_higher(u32 *location, Elf_Addr v, bool rela) |
241 | { |
242 | if (WARN_ON(!rela)) |
243 | return -EINVAL; |
244 | |
245 | *location = (*location & 0xffff0000) | |
246 | ((((long long)v + 0x80008000LL) >> 32) & 0xffff); |
247 | |
248 | return 0; |
249 | } |
250 | |
251 | static int apply_r_mips_highest(u32 *location, Elf_Addr v, bool rela) |
252 | { |
253 | if (WARN_ON(!rela)) |
254 | return -EINVAL; |
255 | |
256 | *location = (*location & 0xffff0000) | |
257 | ((((long long)v + 0x800080008000LL) >> 48) & 0xffff); |
258 | |
259 | return 0; |
260 | } |
261 | |
262 | /** |
263 | * reloc_handler() - Apply a particular relocation to a module |
264 | * @type: type of the relocation to apply |
265 | * @me: the module to apply the reloc to |
266 | * @location: the address at which the reloc is to be applied |
267 | * @base: the existing value at location for REL-style; 0 for RELA-style |
268 | * @v: the value of the reloc, with addend for RELA-style |
269 | * @rela: indication of is this a RELA (true) or REL (false) relocation |
270 | * |
271 | * Each implemented relocation function applies a particular type of |
272 | * relocation to the module @me. Relocs that may be found in either REL or RELA |
273 | * variants can be handled by making use of the @base & @v parameters which are |
274 | * set to values which abstract the difference away from the particular reloc |
275 | * implementations. |
276 | * |
277 | * Return: 0 upon success, else -ERRNO |
278 | */ |
279 | static int reloc_handler(u32 type, struct module *me, u32 *location, u32 base, |
280 | Elf_Addr v, bool rela) |
281 | { |
282 | switch (type) { |
283 | case R_MIPS_NONE: |
284 | break; |
285 | case R_MIPS_32: |
286 | apply_r_mips_32(location, base, v); |
287 | break; |
288 | case R_MIPS_26: |
289 | return apply_r_mips_26(me, location, base, v); |
290 | case R_MIPS_HI16: |
291 | return apply_r_mips_hi16(me, location, v, rela); |
292 | case R_MIPS_LO16: |
293 | return apply_r_mips_lo16(me, location, base, v, rela); |
294 | case R_MIPS_PC16: |
295 | return apply_r_mips_pc16(me, location, base, v); |
296 | case R_MIPS_PC21_S2: |
297 | return apply_r_mips_pc21(me, location, base, v); |
298 | case R_MIPS_PC26_S2: |
299 | return apply_r_mips_pc26(me, location, base, v); |
300 | case R_MIPS_64: |
301 | return apply_r_mips_64(location, v, rela); |
302 | case R_MIPS_HIGHER: |
303 | return apply_r_mips_higher(location, v, rela); |
304 | case R_MIPS_HIGHEST: |
305 | return apply_r_mips_highest(location, v, rela); |
306 | default: |
307 | pr_err("%s: Unknown relocation type %u\n" , me->name, type); |
308 | return -EINVAL; |
309 | } |
310 | |
311 | return 0; |
312 | } |
313 | |
314 | static int __apply_relocate(Elf_Shdr *sechdrs, const char *strtab, |
315 | unsigned int symindex, unsigned int relsec, |
316 | struct module *me, bool rela) |
317 | { |
318 | union { |
319 | Elf_Mips_Rel *rel; |
320 | Elf_Mips_Rela *rela; |
321 | } r; |
322 | Elf_Sym *sym; |
323 | u32 *location, base; |
324 | unsigned int i, type; |
325 | Elf_Addr v; |
326 | int err = 0; |
327 | size_t reloc_sz; |
328 | |
329 | pr_debug("Applying relocate section %u to %u\n" , relsec, |
330 | sechdrs[relsec].sh_info); |
331 | |
332 | r.rel = (void *)sechdrs[relsec].sh_addr; |
333 | reloc_sz = rela ? sizeof(*r.rela) : sizeof(*r.rel); |
334 | me->arch.r_mips_hi16_list = NULL; |
335 | for (i = 0; i < sechdrs[relsec].sh_size / reloc_sz; i++) { |
336 | /* This is where to make the change */ |
337 | location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr |
338 | + r.rel->r_offset; |
339 | /* This is the symbol it is referring to */ |
340 | sym = (Elf_Sym *)sechdrs[symindex].sh_addr |
341 | + ELF_MIPS_R_SYM(*r.rel); |
342 | if (sym->st_value >= -MAX_ERRNO) { |
343 | /* Ignore unresolved weak symbol */ |
344 | if (ELF_ST_BIND(sym->st_info) == STB_WEAK) |
345 | continue; |
346 | pr_warn("%s: Unknown symbol %s\n" , |
347 | me->name, strtab + sym->st_name); |
348 | err = -ENOENT; |
349 | goto out; |
350 | } |
351 | |
352 | type = ELF_MIPS_R_TYPE(*r.rel); |
353 | |
354 | if (rela) { |
355 | v = sym->st_value + r.rela->r_addend; |
356 | base = 0; |
357 | r.rela = &r.rela[1]; |
358 | } else { |
359 | v = sym->st_value; |
360 | base = *location; |
361 | r.rel = &r.rel[1]; |
362 | } |
363 | |
364 | err = reloc_handler(type, me, location, base, v, rela); |
365 | if (err) |
366 | goto out; |
367 | } |
368 | |
369 | out: |
370 | /* |
371 | * Normally the hi16 list should be deallocated at this point. A |
372 | * malformed binary however could contain a series of R_MIPS_HI16 |
373 | * relocations not followed by a R_MIPS_LO16 relocation, or if we hit |
374 | * an error processing a reloc we might have gotten here before |
375 | * reaching the R_MIPS_LO16. In either case, free up the list and |
376 | * return an error. |
377 | */ |
378 | if (me->arch.r_mips_hi16_list) { |
379 | free_relocation_chain(l: me->arch.r_mips_hi16_list); |
380 | me->arch.r_mips_hi16_list = NULL; |
381 | err = err ?: -ENOEXEC; |
382 | } |
383 | |
384 | return err; |
385 | } |
386 | |
387 | int apply_relocate(Elf_Shdr *sechdrs, const char *strtab, |
388 | unsigned int symindex, unsigned int relsec, |
389 | struct module *me) |
390 | { |
391 | return __apply_relocate(sechdrs, strtab, symindex, relsec, me, rela: false); |
392 | } |
393 | |
394 | #ifdef CONFIG_MODULES_USE_ELF_RELA |
395 | int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, |
396 | unsigned int symindex, unsigned int relsec, |
397 | struct module *me) |
398 | { |
399 | return __apply_relocate(sechdrs, strtab, symindex, relsec, me, rela: true); |
400 | } |
401 | #endif /* CONFIG_MODULES_USE_ELF_RELA */ |
402 | |
403 | /* Given an address, look for it in the module exception tables. */ |
404 | const struct exception_table_entry *search_module_dbetables(unsigned long addr) |
405 | { |
406 | unsigned long flags; |
407 | const struct exception_table_entry *e = NULL; |
408 | struct mod_arch_specific *dbe; |
409 | |
410 | spin_lock_irqsave(&dbe_lock, flags); |
411 | list_for_each_entry(dbe, &dbe_list, dbe_list) { |
412 | e = search_extable(base: dbe->dbe_start, |
413 | num: dbe->dbe_end - dbe->dbe_start, value: addr); |
414 | if (e) |
415 | break; |
416 | } |
417 | spin_unlock_irqrestore(lock: &dbe_lock, flags); |
418 | |
419 | /* Now, if we found one, we are running inside it now, hence |
420 | we cannot unload the module, hence no refcnt needed. */ |
421 | return e; |
422 | } |
423 | |
424 | /* Put in dbe list if necessary. */ |
425 | int module_finalize(const Elf_Ehdr *hdr, |
426 | const Elf_Shdr *sechdrs, |
427 | struct module *me) |
428 | { |
429 | const Elf_Shdr *s; |
430 | char *secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; |
431 | |
432 | if (IS_ENABLED(CONFIG_JUMP_LABEL)) |
433 | jump_label_apply_nops(mod: me); |
434 | |
435 | INIT_LIST_HEAD(list: &me->arch.dbe_list); |
436 | for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) { |
437 | if (strcmp("__dbe_table" , secstrings + s->sh_name) != 0) |
438 | continue; |
439 | me->arch.dbe_start = (void *)s->sh_addr; |
440 | me->arch.dbe_end = (void *)s->sh_addr + s->sh_size; |
441 | spin_lock_irq(lock: &dbe_lock); |
442 | list_add(new: &me->arch.dbe_list, head: &dbe_list); |
443 | spin_unlock_irq(lock: &dbe_lock); |
444 | } |
445 | return 0; |
446 | } |
447 | |
448 | void module_arch_cleanup(struct module *mod) |
449 | { |
450 | spin_lock_irq(lock: &dbe_lock); |
451 | list_del(entry: &mod->arch.dbe_list); |
452 | spin_unlock_irq(lock: &dbe_lock); |
453 | } |
454 | |