kernel: fix a relative addressing bug in the mips module relocation code change
[openwrt.git] / target / linux / generic-2.6 / patches-2.6.28 / 026-mips_module_reloc.patch
1 --- a/arch/mips/Makefile
2 +++ b/arch/mips/Makefile
3 @@ -82,7 +82,7 @@ all-$(CONFIG_BOOT_ELF64)      := $(vmlinux-64
4  cflags-y                       += -G 0 -mno-abicalls -fno-pic -pipe
5  cflags-y                       += -msoft-float
6  LDFLAGS_vmlinux                        += -G 0 -static -n -nostdlib
7 -MODFLAGS                       += -mlong-calls
8 +MODFLAGS                       += -mno-long-calls
9  
10  cflags-y += -ffreestanding
11  
12 --- a/arch/mips/include/asm/module.h
13 +++ b/arch/mips/include/asm/module.h
14 @@ -9,6 +9,11 @@ struct mod_arch_specific {
15         struct list_head dbe_list;
16         const struct exception_table_entry *dbe_start;
17         const struct exception_table_entry *dbe_end;
18 +
19 +       void *plt_tbl;
20 +       unsigned int core_plt_offset;
21 +       unsigned int core_plt_size;
22 +       unsigned int init_plt_offset;
23  };
24  
25  typedef uint8_t Elf64_Byte;            /* Type for a 8-bit quantity.  */
26 --- a/arch/mips/kernel/module.c
27 +++ b/arch/mips/kernel/module.c
28 @@ -43,6 +43,114 @@ static struct mips_hi16 *mips_hi16_list;
29  static LIST_HEAD(dbe_list);
30  static DEFINE_SPINLOCK(dbe_lock);
31  
32 +/*
33 + * Get the potential max trampolines size required of the init and
34 + * non-init sections. Only used if we cannot find enough contiguous
35 + * physically mapped memory to put the module into.
36 + */
37 +static unsigned int
38 +get_plt_size(const Elf32_Ehdr *hdr, const Elf32_Shdr *sechdrs,
39 +             const char *secstrings, unsigned int symindex, bool is_init)
40 +{
41 +       unsigned long ret = 0;
42 +       unsigned int i, j;
43 +       Elf_Sym *syms;
44 +
45 +       /* Everything marked ALLOC (this includes the exported symbols) */
46 +       for (i = 1; i < hdr->e_shnum; ++i) {
47 +               unsigned int info = sechdrs[i].sh_info;
48 +
49 +               if (sechdrs[i].sh_type != SHT_REL
50 +                   && sechdrs[i].sh_type != SHT_RELA)
51 +                       continue;
52 +
53 +               /* Not a valid relocation section? */
54 +               if (info >= hdr->e_shnum)
55 +                       continue;
56 +
57 +               /* Don't bother with non-allocated sections */
58 +               if (!(sechdrs[info].sh_flags & SHF_ALLOC))
59 +                       continue;
60 +
61 +               /* If it's called *.init*, and we're not init, we're
62 +                   not interested */
63 +               if ((strstr(secstrings + sechdrs[i].sh_name, ".init") != 0)
64 +                   != is_init)
65 +                       continue;
66 +
67 +               syms = (Elf_Sym *) sechdrs[symindex].sh_addr;
68 +               if (sechdrs[i].sh_type == SHT_REL) {
69 +                       Elf_Mips_Rel *rel = (void *) sechdrs[i].sh_addr;
70 +                       unsigned int size = sechdrs[i].sh_size / sizeof(*rel);
71 +
72 +                       for (j = 0; j < size; ++j) {
73 +                               Elf_Sym *sym;
74 +
75 +                               if (ELF_MIPS_R_TYPE(rel[j]) != R_MIPS_26)
76 +                                       continue;
77 +
78 +                               sym = syms + ELF_MIPS_R_SYM(rel[j]);
79 +                               if (!is_init && sym->st_shndx != SHN_UNDEF)
80 +                                       continue;
81 +
82 +                               ret += 4 * sizeof(int);
83 +                       }
84 +               } else {
85 +                       Elf_Mips_Rela *rela = (void *) sechdrs[i].sh_addr;
86 +                       unsigned int size = sechdrs[i].sh_size / sizeof(*rela);
87 +
88 +                       for (j = 0; j < size; ++j) {
89 +                               Elf_Sym *sym;
90 +
91 +                               if (ELF_MIPS_R_TYPE(rela[j]) != R_MIPS_26)
92 +                                       continue;
93 +
94 +                               sym = syms + ELF_MIPS_R_SYM(rela[j]);
95 +                               if (!is_init && sym->st_shndx != SHN_UNDEF)
96 +                                       continue;
97 +
98 +                               ret += 4 * sizeof(int);
99 +                       }
100 +               }
101 +       }
102 +
103 +       return ret;
104 +}
105 +
106 +static void *alloc_phys(unsigned long size)
107 +{
108 +       unsigned order;
109 +       struct page *page;
110 +       struct page *p;
111 +
112 +       size = PAGE_ALIGN(size);
113 +       order = get_order(size);
114 +
115 +       page = alloc_pages(GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN |
116 +                       __GFP_THISNODE, order);
117 +       if (!page)
118 +               return NULL;
119 +
120 +       split_page(page, order);
121 +
122 +       for (p = page + (size >> PAGE_SHIFT); p < page + (1 << order); ++p)
123 +               __free_page(p);
124 +
125 +       return page_address(page);
126 +}
127 +
128 +static void free_phys(void *ptr, unsigned long size)
129 +{
130 +       struct page *page;
131 +       struct page *end;
132 +
133 +       page = virt_to_page(ptr);
134 +       end = page + (PAGE_ALIGN(size) >> PAGE_SHIFT);
135 +
136 +       for (; page < end; ++page)
137 +               __free_page(page);
138 +}
139 +
140  void *module_alloc(unsigned long size)
141  {
142  #ifdef MODULE_START
143 @@ -58,16 +166,41 @@ void *module_alloc(unsigned long size)
144  
145         return __vmalloc_area(area, GFP_KERNEL, PAGE_KERNEL);
146  #else
147 +       void *ptr;
148 +
149         if (size == 0)
150                 return NULL;
151 -       return vmalloc(size);
152 +
153 +       ptr = alloc_phys(size);
154 +
155 +       /* If we failed to allocate physically contiguous memory,
156 +        * fall back to regular vmalloc. The module loader code will
157 +        * create jump tables to handle long jumps */
158 +       if (!ptr)
159 +               return vmalloc(size);
160 +
161 +       return ptr;
162  #endif
163  }
164  
165 +static inline bool is_phys_addr(void *ptr)
166 +{
167 +       return (KSEGX(ptr) == KSEG0);
168 +}
169 +
170  /* Free memory returned from module_alloc */
171  void module_free(struct module *mod, void *module_region)
172  {
173 -       vfree(module_region);
174 +       if (is_phys_addr(module_region)) {
175 +               if (mod->module_init == module_region)
176 +                       free_phys(module_region, mod->init_size);
177 +               else if (mod->module_core == module_region)
178 +                       free_phys(module_region, mod->core_size);
179 +               else
180 +                       BUG();
181 +       } else {
182 +               vfree(module_region);
183 +       }
184         /* FIXME: If module_region == mod->init_region, trim exception
185             table entries. */
186  }
187 @@ -75,6 +208,24 @@ void module_free(struct module *mod, voi
188  int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
189                               char *secstrings, struct module *mod)
190  {
191 +       unsigned int symindex = 0;
192 +       unsigned int core_size, init_size;
193 +       int i;
194 +
195 +       for (i = 1; i < hdr->e_shnum; i++)
196 +               if (sechdrs[i].sh_type == SHT_SYMTAB)
197 +                       symindex = i;
198 +
199 +       core_size = get_plt_size(hdr, sechdrs, secstrings, symindex, false);
200 +       init_size = get_plt_size(hdr, sechdrs, secstrings, symindex, true);
201 +
202 +       mod->arch.core_plt_offset = 0;
203 +       mod->arch.core_plt_size = core_size;
204 +       mod->arch.init_plt_offset = core_size;
205 +       mod->arch.plt_tbl = kmalloc(core_size + init_size, GFP_KERNEL);
206 +       if (!mod->arch.plt_tbl)
207 +               return -ENOMEM;
208 +
209         return 0;
210  }
211  
212 @@ -97,27 +248,44 @@ static int apply_r_mips_32_rela(struct m
213         return 0;
214  }
215  
216 -static int apply_r_mips_26_rel(struct module *me, u32 *location, Elf_Addr v)
217 +static Elf_Addr add_plt_entry_to(unsigned *plt_offset,
218 +                                void *start, unsigned size, Elf_Addr v)
219  {
220 -       if (v % 4) {
221 -               printk(KERN_ERR "module %s: dangerous relocation\n", me->name);
222 -               return -ENOEXEC;
223 -       }
224 +       unsigned *tramp = start + *plt_offset;
225  
226 -       if ((v & 0xf0000000) != (((unsigned long)location + 4) & 0xf0000000)) {
227 -               printk(KERN_ERR
228 -                      "module %s: relocation overflow\n",
229 -                      me->name);
230 -               return -ENOEXEC;
231 -       }
232 +       if (*plt_offset == size)
233 +               return 0;
234  
235 -       *location = (*location & ~0x03ffffff) |
236 -                   ((*location + (v >> 2)) & 0x03ffffff);
237 +       *plt_offset += 4 * sizeof(int);
238 +
239 +       /* adjust carry for addiu */
240 +       if (v & 0x00008000)
241 +               v += 0x10000;
242 +
243 +       tramp[0] = 0x3c190000 | (v >> 16);      /* lui t9, hi16 */
244 +       tramp[1] = 0x27390000 | (v & 0xffff);   /* addiu t9, t9, lo16 */
245 +       tramp[2] = 0x03200008;                  /* jr t9 */
246 +       tramp[3] = 0x00000000;                  /* nop */
247 +
248 +       return (Elf_Addr) tramp;
249 +}
250 +
251 +static Elf_Addr add_plt_entry(struct module *me, void *location, Elf_Addr v)
252 +{
253 +       if (location >= me->module_core &&
254 +           location < me->module_core + me->core_size)
255 +               return add_plt_entry_to(&me->arch.core_plt_offset,
256 +                               me->module_core, me->core_size, v);
257 +
258 +       if (location >= me->module_init &&
259 +           location < me->module_init + me->init_size)
260 +               return add_plt_entry_to(&me->arch.init_plt_offset,
261 +                               me->module_init, me->init_size, v);
262  
263         return 0;
264  }
265  
266 -static int apply_r_mips_26_rela(struct module *me, u32 *location, Elf_Addr v)
267 +static int set_r_mips_26(struct module *me, u32 *location, u32 ofs, Elf_Addr v)
268  {
269         if (v % 4) {
270                 printk(KERN_ERR "module %s: dangerous relocation\n", me->name);
271 @@ -125,17 +293,31 @@ static int apply_r_mips_26_rela(struct m
272         }
273  
274         if ((v & 0xf0000000) != (((unsigned long)location + 4) & 0xf0000000)) {
275 -               printk(KERN_ERR
276 +           v = add_plt_entry(me, location, v + (ofs << 2));
277 +               if (!v) {
278 +                       printk(KERN_ERR
279                        "module %s: relocation overflow\n",
280                        me->name);
281 -               return -ENOEXEC;
282 +                       return -ENOEXEC;
283 +               }
284 +               ofs = 0;
285         }
286  
287 -       *location = (*location & ~0x03ffffff) | ((v >> 2) & 0x03ffffff);
288 +       *location = (*location & ~0x03ffffff) | ((ofs + (v >> 2)) & 0x03ffffff);
289  
290         return 0;
291  }
292  
293 +static int apply_r_mips_26_rel(struct module *me, u32 *location, Elf_Addr v)
294 +{
295 +       return set_r_mips_26(me, location, *location & 0x03ffffff, v);
296 +}
297 +
298 +static int apply_r_mips_26_rela(struct module *me, u32 *location, Elf_Addr v)
299 +{
300 +       return set_r_mips_26(me, location, 0, v);
301 +}
302 +
303  static int apply_r_mips_hi16_rel(struct module *me, u32 *location, Elf_Addr v)
304  {
305         struct mips_hi16 *n;
306 @@ -400,11 +582,23 @@ int module_finalize(const Elf_Ehdr *hdr,
307                 list_add(&me->arch.dbe_list, &dbe_list);
308                 spin_unlock_irq(&dbe_lock);
309         }
310 +
311 +       /* Get rid of the fixup trampoline if we're running the module
312 +        * from physically mapped address space */
313 +       if (me->arch.core_plt_offset == 0 &&
314 +           me->arch.init_plt_offset == me->arch.core_plt_size &&
315 +           is_phys_addr(me->module_core)) {
316 +               kfree(me->arch.plt_tbl);
317 +               me->arch.plt_tbl = NULL;
318 +       }
319 +
320         return 0;
321  }
322  
323  void module_arch_cleanup(struct module *mod)
324  {
325 +       if (mod->arch.plt_tbl)
326 +               kfree(mod->arch.plt_tbl);
327         spin_lock_irq(&dbe_lock);
328         list_del(&mod->arch.dbe_list);
329         spin_unlock_irq(&dbe_lock);