module-plts.c 8.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Copyright (C) 2014-2017 Linaro Ltd. <ard.biesheuvel@linaro.org>
  4. */
  5. #include <linux/elf.h>
  6. #include <linux/ftrace.h>
  7. #include <linux/kernel.h>
  8. #include <linux/module.h>
  9. #include <linux/sort.h>
  10. #include <linux/moduleloader.h>
  11. #include <asm/cache.h>
  12. #include <asm/opcodes.h>
  13. #ifdef CONFIG_THUMB2_KERNEL
  14. #define PLT_ENT_LDR __opcode_to_mem_thumb32(0xf8dff000 | \
  15. (PLT_ENT_STRIDE - 4))
  16. #else
  17. #define PLT_ENT_LDR __opcode_to_mem_arm(0xe59ff000 | \
  18. (PLT_ENT_STRIDE - 8))
  19. #endif
  20. static const u32 fixed_plts[] = {
  21. #ifdef CONFIG_DYNAMIC_FTRACE
  22. FTRACE_ADDR,
  23. MCOUNT_ADDR,
  24. #endif
  25. };
  26. static bool in_init(const struct module *mod, unsigned long loc)
  27. {
  28. return loc - (u32)mod->init_layout.base < mod->init_layout.size;
  29. }
  30. static void prealloc_fixed(struct mod_plt_sec *pltsec, struct plt_entries *plt)
  31. {
  32. int i;
  33. if (!ARRAY_SIZE(fixed_plts) || pltsec->plt_count)
  34. return;
  35. pltsec->plt_count = ARRAY_SIZE(fixed_plts);
  36. for (i = 0; i < ARRAY_SIZE(plt->ldr); ++i)
  37. plt->ldr[i] = PLT_ENT_LDR;
  38. BUILD_BUG_ON(sizeof(fixed_plts) > sizeof(plt->lit));
  39. memcpy(plt->lit, fixed_plts, sizeof(fixed_plts));
  40. }
  41. u32 get_module_plt(struct module *mod, unsigned long loc, Elf32_Addr val)
  42. {
  43. struct mod_plt_sec *pltsec = !in_init(mod, loc) ? &mod->arch.core :
  44. &mod->arch.init;
  45. struct plt_entries *plt;
  46. int idx;
  47. /* cache the address, ELF header is available only during module load */
  48. if (!pltsec->plt_ent)
  49. pltsec->plt_ent = (struct plt_entries *)pltsec->plt->sh_addr;
  50. plt = pltsec->plt_ent;
  51. prealloc_fixed(pltsec, plt);
  52. for (idx = 0; idx < ARRAY_SIZE(fixed_plts); ++idx)
  53. if (plt->lit[idx] == val)
  54. return (u32)&plt->ldr[idx];
  55. idx = 0;
  56. /*
  57. * Look for an existing entry pointing to 'val'. Given that the
  58. * relocations are sorted, this will be the last entry we allocated.
  59. * (if one exists).
  60. */
  61. if (pltsec->plt_count > 0) {
  62. plt += (pltsec->plt_count - 1) / PLT_ENT_COUNT;
  63. idx = (pltsec->plt_count - 1) % PLT_ENT_COUNT;
  64. if (plt->lit[idx] == val)
  65. return (u32)&plt->ldr[idx];
  66. idx = (idx + 1) % PLT_ENT_COUNT;
  67. if (!idx)
  68. plt++;
  69. }
  70. pltsec->plt_count++;
  71. BUG_ON(pltsec->plt_count * PLT_ENT_SIZE > pltsec->plt->sh_size);
  72. if (!idx)
  73. /* Populate a new set of entries */
  74. *plt = (struct plt_entries){
  75. { [0 ... PLT_ENT_COUNT - 1] = PLT_ENT_LDR, },
  76. { val, }
  77. };
  78. else
  79. plt->lit[idx] = val;
  80. return (u32)&plt->ldr[idx];
  81. }
  82. #define cmp_3way(a,b) ((a) < (b) ? -1 : (a) > (b))
  83. static int cmp_rel(const void *a, const void *b)
  84. {
  85. const Elf32_Rel *x = a, *y = b;
  86. int i;
  87. /* sort by type and symbol index */
  88. i = cmp_3way(ELF32_R_TYPE(x->r_info), ELF32_R_TYPE(y->r_info));
  89. if (i == 0)
  90. i = cmp_3way(ELF32_R_SYM(x->r_info), ELF32_R_SYM(y->r_info));
  91. return i;
  92. }
  93. static bool is_zero_addend_relocation(Elf32_Addr base, const Elf32_Rel *rel)
  94. {
  95. u32 *tval = (u32 *)(base + rel->r_offset);
  96. /*
  97. * Do a bitwise compare on the raw addend rather than fully decoding
  98. * the offset and doing an arithmetic comparison.
  99. * Note that a zero-addend jump/call relocation is encoded taking the
  100. * PC bias into account, i.e., -8 for ARM and -4 for Thumb2.
  101. */
  102. switch (ELF32_R_TYPE(rel->r_info)) {
  103. u16 upper, lower;
  104. case R_ARM_THM_CALL:
  105. case R_ARM_THM_JUMP24:
  106. upper = __mem_to_opcode_thumb16(((u16 *)tval)[0]);
  107. lower = __mem_to_opcode_thumb16(((u16 *)tval)[1]);
  108. return (upper & 0x7ff) == 0x7ff && (lower & 0x2fff) == 0x2ffe;
  109. case R_ARM_CALL:
  110. case R_ARM_PC24:
  111. case R_ARM_JUMP24:
  112. return (__mem_to_opcode_arm(*tval) & 0xffffff) == 0xfffffe;
  113. }
  114. BUG();
  115. }
  116. static bool duplicate_rel(Elf32_Addr base, const Elf32_Rel *rel, int num)
  117. {
  118. const Elf32_Rel *prev;
  119. /*
  120. * Entries are sorted by type and symbol index. That means that,
  121. * if a duplicate entry exists, it must be in the preceding
  122. * slot.
  123. */
  124. if (!num)
  125. return false;
  126. prev = rel + num - 1;
  127. return cmp_rel(rel + num, prev) == 0 &&
  128. is_zero_addend_relocation(base, prev);
  129. }
  130. /* Count how many PLT entries we may need */
  131. static unsigned int count_plts(const Elf32_Sym *syms, Elf32_Addr base,
  132. const Elf32_Rel *rel, int num, Elf32_Word dstidx)
  133. {
  134. unsigned int ret = 0;
  135. const Elf32_Sym *s;
  136. int i;
  137. for (i = 0; i < num; i++) {
  138. switch (ELF32_R_TYPE(rel[i].r_info)) {
  139. case R_ARM_CALL:
  140. case R_ARM_PC24:
  141. case R_ARM_JUMP24:
  142. case R_ARM_THM_CALL:
  143. case R_ARM_THM_JUMP24:
  144. /*
  145. * We only have to consider branch targets that resolve
  146. * to symbols that are defined in a different section.
  147. * This is not simply a heuristic, it is a fundamental
  148. * limitation, since there is no guaranteed way to emit
  149. * PLT entries sufficiently close to the branch if the
  150. * section size exceeds the range of a branch
  151. * instruction. So ignore relocations against defined
  152. * symbols if they live in the same section as the
  153. * relocation target.
  154. */
  155. s = syms + ELF32_R_SYM(rel[i].r_info);
  156. if (s->st_shndx == dstidx)
  157. break;
  158. /*
  159. * Jump relocations with non-zero addends against
  160. * undefined symbols are supported by the ELF spec, but
  161. * do not occur in practice (e.g., 'jump n bytes past
  162. * the entry point of undefined function symbol f').
  163. * So we need to support them, but there is no need to
  164. * take them into consideration when trying to optimize
  165. * this code. So let's only check for duplicates when
  166. * the addend is zero. (Note that calls into the core
  167. * module via init PLT entries could involve section
  168. * relative symbol references with non-zero addends, for
  169. * which we may end up emitting duplicates, but the init
  170. * PLT is released along with the rest of the .init
  171. * region as soon as module loading completes.)
  172. */
  173. if (!is_zero_addend_relocation(base, rel + i) ||
  174. !duplicate_rel(base, rel, i))
  175. ret++;
  176. }
  177. }
  178. return ret;
  179. }
  180. int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
  181. char *secstrings, struct module *mod)
  182. {
  183. unsigned long core_plts = ARRAY_SIZE(fixed_plts);
  184. unsigned long init_plts = ARRAY_SIZE(fixed_plts);
  185. Elf32_Shdr *s, *sechdrs_end = sechdrs + ehdr->e_shnum;
  186. Elf32_Sym *syms = NULL;
  187. /*
  188. * To store the PLTs, we expand the .text section for core module code
  189. * and for initialization code.
  190. */
  191. for (s = sechdrs; s < sechdrs_end; ++s) {
  192. if (strcmp(".plt", secstrings + s->sh_name) == 0)
  193. mod->arch.core.plt = s;
  194. else if (strcmp(".init.plt", secstrings + s->sh_name) == 0)
  195. mod->arch.init.plt = s;
  196. else if (s->sh_type == SHT_SYMTAB)
  197. syms = (Elf32_Sym *)s->sh_addr;
  198. }
  199. if (!mod->arch.core.plt || !mod->arch.init.plt) {
  200. pr_err("%s: module PLT section(s) missing\n", mod->name);
  201. return -ENOEXEC;
  202. }
  203. if (!syms) {
  204. pr_err("%s: module symtab section missing\n", mod->name);
  205. return -ENOEXEC;
  206. }
  207. for (s = sechdrs + 1; s < sechdrs_end; ++s) {
  208. Elf32_Rel *rels = (void *)ehdr + s->sh_offset;
  209. int numrels = s->sh_size / sizeof(Elf32_Rel);
  210. Elf32_Shdr *dstsec = sechdrs + s->sh_info;
  211. if (s->sh_type != SHT_REL)
  212. continue;
  213. /* ignore relocations that operate on non-exec sections */
  214. if (!(dstsec->sh_flags & SHF_EXECINSTR))
  215. continue;
  216. /* sort by type and symbol index */
  217. sort(rels, numrels, sizeof(Elf32_Rel), cmp_rel, NULL);
  218. if (strncmp(secstrings + dstsec->sh_name, ".init", 5) != 0)
  219. core_plts += count_plts(syms, dstsec->sh_addr, rels,
  220. numrels, s->sh_info);
  221. else
  222. init_plts += count_plts(syms, dstsec->sh_addr, rels,
  223. numrels, s->sh_info);
  224. }
  225. mod->arch.core.plt->sh_type = SHT_NOBITS;
  226. mod->arch.core.plt->sh_flags = SHF_EXECINSTR | SHF_ALLOC;
  227. mod->arch.core.plt->sh_addralign = L1_CACHE_BYTES;
  228. mod->arch.core.plt->sh_size = round_up(core_plts * PLT_ENT_SIZE,
  229. sizeof(struct plt_entries));
  230. mod->arch.core.plt_count = 0;
  231. mod->arch.core.plt_ent = NULL;
  232. mod->arch.init.plt->sh_type = SHT_NOBITS;
  233. mod->arch.init.plt->sh_flags = SHF_EXECINSTR | SHF_ALLOC;
  234. mod->arch.init.plt->sh_addralign = L1_CACHE_BYTES;
  235. mod->arch.init.plt->sh_size = round_up(init_plts * PLT_ENT_SIZE,
  236. sizeof(struct plt_entries));
  237. mod->arch.init.plt_count = 0;
  238. mod->arch.init.plt_ent = NULL;
  239. pr_debug("%s: plt=%x, init.plt=%x\n", __func__,
  240. mod->arch.core.plt->sh_size, mod->arch.init.plt->sh_size);
  241. return 0;
  242. }