kernel: fix crashes on MIPS when loading kernel modules under memory pressure
[openwrt/openwrt.git] / target / linux / generic / patches-4.4 / 305-mips_module_reloc.patch
1 --- a/arch/mips/Makefile
2 +++ b/arch/mips/Makefile
3 @@ -90,8 +90,13 @@ all-$(CONFIG_SYS_SUPPORTS_ZBOOT)+= vmlin
4 cflags-y += -G 0 -mno-abicalls -fno-pic -pipe -mno-branch-likely
5 cflags-y += -msoft-float
6 LDFLAGS_vmlinux += -G 0 -static -n -nostdlib --gc-sections
7 +ifdef CONFIG_64BIT
8 KBUILD_AFLAGS_MODULE += -mlong-calls
9 KBUILD_CFLAGS_MODULE += -mlong-calls
10 +else
11 +KBUILD_AFLAGS_MODULE += -mno-long-calls
12 +KBUILD_CFLAGS_MODULE += -mno-long-calls
13 +endif
14
15 ifndef CONFIG_FUNCTION_TRACER
16 KBUILD_CFLAGS_KERNEL += -ffunction-sections -fdata-sections
17 --- a/arch/mips/include/asm/module.h
18 +++ b/arch/mips/include/asm/module.h
19 @@ -11,6 +11,11 @@ struct mod_arch_specific {
20 const struct exception_table_entry *dbe_start;
21 const struct exception_table_entry *dbe_end;
22 struct mips_hi16 *r_mips_hi16_list;
23 +
24 + void *phys_plt_tbl;
25 + void *virt_plt_tbl;
26 + unsigned int phys_plt_offset;
27 + unsigned int virt_plt_offset;
28 };
29
30 typedef uint8_t Elf64_Byte; /* Type for a 8-bit quantity. */
31 --- a/arch/mips/kernel/module.c
32 +++ b/arch/mips/kernel/module.c
33 @@ -43,14 +43,221 @@ struct mips_hi16 {
34 static LIST_HEAD(dbe_list);
35 static DEFINE_SPINLOCK(dbe_lock);
36
37 -#ifdef MODULE_START
38 +/*
39 + * Get the potential max trampolines size required of the init and
40 + * non-init sections. Only used if we cannot find enough contiguous
41 + * physically mapped memory to put the module into.
42 + */
43 +static unsigned int
44 +get_plt_size(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
45 + const char *secstrings, unsigned int symindex, bool is_init)
46 +{
47 + unsigned long ret = 0;
48 + unsigned int i, j;
49 + Elf_Sym *syms;
50 +
51 + /* Everything marked ALLOC (this includes the exported symbols) */
52 + for (i = 1; i < hdr->e_shnum; ++i) {
53 + unsigned int info = sechdrs[i].sh_info;
54 +
55 + if (sechdrs[i].sh_type != SHT_REL
56 + && sechdrs[i].sh_type != SHT_RELA)
57 + continue;
58 +
59 + /* Not a valid relocation section? */
60 + if (info >= hdr->e_shnum)
61 + continue;
62 +
63 + /* Don't bother with non-allocated sections */
64 + if (!(sechdrs[info].sh_flags & SHF_ALLOC))
65 + continue;
66 +
67 + /* If it's called *.init*, and we're not init, we're
68 + not interested */
69 + if ((strstr(secstrings + sechdrs[i].sh_name, ".init") != 0)
70 + != is_init)
71 + continue;
72 +
73 + syms = (Elf_Sym *) sechdrs[symindex].sh_addr;
74 + if (sechdrs[i].sh_type == SHT_REL) {
75 + Elf_Mips_Rel *rel = (void *) sechdrs[i].sh_addr;
76 + unsigned int size = sechdrs[i].sh_size / sizeof(*rel);
77 +
78 + for (j = 0; j < size; ++j) {
79 + Elf_Sym *sym;
80 +
81 + if (ELF_MIPS_R_TYPE(rel[j]) != R_MIPS_26)
82 + continue;
83 +
84 + sym = syms + ELF_MIPS_R_SYM(rel[j]);
85 + if (!is_init && sym->st_shndx != SHN_UNDEF)
86 + continue;
87 +
88 + ret += 4 * sizeof(int);
89 + }
90 + } else {
91 + Elf_Mips_Rela *rela = (void *) sechdrs[i].sh_addr;
92 + unsigned int size = sechdrs[i].sh_size / sizeof(*rela);
93 +
94 + for (j = 0; j < size; ++j) {
95 + Elf_Sym *sym;
96 +
97 + if (ELF_MIPS_R_TYPE(rela[j]) != R_MIPS_26)
98 + continue;
99 +
100 + sym = syms + ELF_MIPS_R_SYM(rela[j]);
101 + if (!is_init && sym->st_shndx != SHN_UNDEF)
102 + continue;
103 +
104 + ret += 4 * sizeof(int);
105 + }
106 + }
107 + }
108 +
109 + return ret;
110 +}
111 +
112 +#ifndef MODULE_START
113 +static void *alloc_phys(unsigned long size)
114 +{
115 + unsigned order;
116 + struct page *page;
117 + struct page *p;
118 +
119 + size = PAGE_ALIGN(size);
120 + order = get_order(size);
121 +
122 + page = alloc_pages(GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN |
123 + __GFP_THISNODE, order);
124 + if (!page)
125 + return NULL;
126 +
127 + split_page(page, order);
128 +
129 + /* mark all pages except for the last one */
130 + for (p = page; p + 1 < page + (size >> PAGE_SHIFT); ++p)
131 + set_bit(PG_owner_priv_1, &p->flags);
132 +
133 + for (p = page + (size >> PAGE_SHIFT); p < page + (1 << order); ++p)
134 + __free_page(p);
135 +
136 + return page_address(page);
137 +}
138 +#endif
139 +
140 +static void free_phys(void *ptr)
141 +{
142 + struct page *page;
143 + bool free;
144 +
145 + page = virt_to_page(ptr);
146 + do {
147 + free = test_and_clear_bit(PG_owner_priv_1, &page->flags);
148 + __free_page(page);
149 + page++;
150 + } while (free);
151 +}
152 +
153 +
154 void *module_alloc(unsigned long size)
155 {
156 +#ifdef MODULE_START
157 return __vmalloc_node_range(size, 1, MODULE_START, MODULE_END,
158 GFP_KERNEL, PAGE_KERNEL, 0, NUMA_NO_NODE,
159 __builtin_return_address(0));
160 +#else
161 + void *ptr;
162 +
163 + if (size == 0)
164 + return NULL;
165 +
166 + ptr = alloc_phys(size);
167 +
168 + /* If we failed to allocate physically contiguous memory,
169 + * fall back to regular vmalloc. The module loader code will
170 + * create jump tables to handle long jumps */
171 + if (!ptr)
172 + return vmalloc(size);
173 +
174 + return ptr;
175 +#endif
176 }
177 +
178 +static inline bool is_phys_addr(void *ptr)
179 +{
180 +#ifdef CONFIG_64BIT
181 + return (KSEGX((unsigned long)ptr) == CKSEG0);
182 +#else
183 + return (KSEGX(ptr) == KSEG0);
184 #endif
185 +}
186 +
187 +/* Free memory returned from module_alloc */
188 +void module_memfree(void *module_region)
189 +{
190 + if (is_phys_addr(module_region))
191 + free_phys(module_region);
192 + else
193 + vfree(module_region);
194 +}
195 +
196 +static void *__module_alloc(int size, bool phys)
197 +{
198 + void *ptr;
199 +
200 + if (phys)
201 + ptr = kmalloc(size, GFP_KERNEL);
202 + else
203 + ptr = vmalloc(size);
204 + return ptr;
205 +}
206 +
207 +static void __module_free(void *ptr)
208 +{
209 + if (is_phys_addr(ptr))
210 + kfree(ptr);
211 + else
212 + vfree(ptr);
213 +}
214 +
215 +int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
216 + char *secstrings, struct module *mod)
217 +{
218 + unsigned int symindex = 0;
219 + unsigned int core_size, init_size;
220 + int i;
221 +
222 + mod->arch.phys_plt_offset = 0;
223 + mod->arch.virt_plt_offset = 0;
224 + mod->arch.phys_plt_tbl = NULL;
225 + mod->arch.virt_plt_tbl = NULL;
226 +
227 + if (IS_ENABLED(CONFIG_64BIT))
228 + return 0;
229 +
230 + for (i = 1; i < hdr->e_shnum; i++)
231 + if (sechdrs[i].sh_type == SHT_SYMTAB)
232 + symindex = i;
233 +
234 + core_size = get_plt_size(hdr, sechdrs, secstrings, symindex, false);
235 + init_size = get_plt_size(hdr, sechdrs, secstrings, symindex, true);
236 +
237 + if ((core_size + init_size) == 0)
238 + return 0;
239 +
240 + mod->arch.phys_plt_tbl = __module_alloc(core_size + init_size, 1);
241 + if (!mod->arch.phys_plt_tbl)
242 + return -ENOMEM;
243 +
244 + mod->arch.virt_plt_tbl = __module_alloc(core_size + init_size, 0);
245 + if (!mod->arch.virt_plt_tbl) {
246 + __module_free(mod->arch.phys_plt_tbl);
247 + mod->arch.phys_plt_tbl = NULL;
248 + return -ENOMEM;
249 + }
250 +
251 + return 0;
252 +}
253
254 int apply_r_mips_none(struct module *me, u32 *location, Elf_Addr v)
255 {
256 @@ -64,8 +271,39 @@ static int apply_r_mips_32_rel(struct mo
257 return 0;
258 }
259
260 +static Elf_Addr add_plt_entry_to(unsigned *plt_offset,
261 + void *start, Elf_Addr v)
262 +{
263 + unsigned *tramp = start + *plt_offset;
264 + *plt_offset += 4 * sizeof(int);
265 +
266 + /* adjust carry for addiu */
267 + if (v & 0x00008000)
268 + v += 0x10000;
269 +
270 + tramp[0] = 0x3c190000 | (v >> 16); /* lui t9, hi16 */
271 + tramp[1] = 0x27390000 | (v & 0xffff); /* addiu t9, t9, lo16 */
272 + tramp[2] = 0x03200008; /* jr t9 */
273 + tramp[3] = 0x00000000; /* nop */
274 +
275 + return (Elf_Addr) tramp;
276 +}
277 +
278 +static Elf_Addr add_plt_entry(struct module *me, void *location, Elf_Addr v)
279 +{
280 + if (is_phys_addr(location))
281 + return add_plt_entry_to(&me->arch.phys_plt_offset,
282 + me->arch.phys_plt_tbl, v);
283 + else
284 + return add_plt_entry_to(&me->arch.virt_plt_offset,
285 + me->arch.virt_plt_tbl, v);
286 +
287 +}
288 +
289 static int apply_r_mips_26_rel(struct module *me, u32 *location, Elf_Addr v)
290 {
291 + u32 ofs = *location & 0x03ffffff;
292 +
293 if (v % 4) {
294 pr_err("module %s: dangerous R_MIPS_26 REL relocation\n",
295 me->name);
296 @@ -73,14 +311,17 @@ static int apply_r_mips_26_rel(struct mo
297 }
298
299 if ((v & 0xf0000000) != (((unsigned long)location + 4) & 0xf0000000)) {
300 - printk(KERN_ERR
301 - "module %s: relocation overflow\n",
302 - me->name);
303 - return -ENOEXEC;
304 + v = add_plt_entry(me, location, v + (ofs << 2));
305 + if (!v) {
306 + printk(KERN_ERR
307 + "module %s: relocation overflow\n", me->name);
308 + return -ENOEXEC;
309 + }
310 + ofs = 0;
311 }
312
313 *location = (*location & ~0x03ffffff) |
314 - ((*location + (v >> 2)) & 0x03ffffff);
315 + ((ofs + (v >> 2)) & 0x03ffffff);
316
317 return 0;
318 }
319 @@ -287,9 +528,36 @@ int module_finalize(const Elf_Ehdr *hdr,
320 list_add(&me->arch.dbe_list, &dbe_list);
321 spin_unlock_irq(&dbe_lock);
322 }
323 +
324 + /* Get rid of the fixup trampoline if we're running the module
325 + * from physically mapped address space */
326 + if (me->arch.phys_plt_offset == 0) {
327 + __module_free(me->arch.phys_plt_tbl);
328 + me->arch.phys_plt_tbl = NULL;
329 + }
330 + if (me->arch.virt_plt_offset == 0) {
331 + __module_free(me->arch.virt_plt_tbl);
332 + me->arch.virt_plt_tbl = NULL;
333 + }
334 +
335 return 0;
336 }
337
338 +void module_arch_freeing_init(struct module *mod)
339 +{
340 + if (mod->state == MODULE_STATE_LIVE)
341 + return;
342 +
343 + if (mod->arch.phys_plt_tbl) {
344 + __module_free(mod->arch.phys_plt_tbl);
345 + mod->arch.phys_plt_tbl = NULL;
346 + }
347 + if (mod->arch.virt_plt_tbl) {
348 + __module_free(mod->arch.virt_plt_tbl);
349 + mod->arch.virt_plt_tbl = NULL;
350 + }
351 +}
352 +
353 void module_arch_cleanup(struct module *mod)
354 {
355 spin_lock_irq(&dbe_lock);