1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* Kernel module help for PPC. 3 Copyright (C) 2001 Rusty Russell. 4 5 */ 6 7 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 8 9 #include <linux/module.h> 10 #include <linux/moduleloader.h> 11 #include <linux/elf.h> 12 #include <linux/vmalloc.h> 13 #include <linux/fs.h> 14 #include <linux/string.h> 15 #include <linux/kernel.h> 16 #include <linux/ftrace.h> 17 #include <linux/cache.h> 18 #include <linux/bug.h> 19 #include <linux/sort.h> 20 #include <asm/setup.h> 21 #include <asm/code-patching.h> 22 23 /* Count how many different relocations (different symbol, different 24 addend) */ 25 static unsigned int count_relocs(const Elf32_Rela *rela, unsigned int num) 26 { 27 unsigned int i, r_info, r_addend, _count_relocs; 28 29 _count_relocs = 0; 30 r_info = 0; 31 r_addend = 0; 32 for (i = 0; i < num; i++) 33 /* Only count 24-bit relocs, others don't need stubs */ 34 if (ELF32_R_TYPE(rela[i].r_info) == R_PPC_REL24 && 35 (r_info != ELF32_R_SYM(rela[i].r_info) || 36 r_addend != rela[i].r_addend)) { 37 _count_relocs++; 38 r_info = ELF32_R_SYM(rela[i].r_info); 39 r_addend = rela[i].r_addend; 40 } 41 42 #ifdef CONFIG_DYNAMIC_FTRACE 43 _count_relocs++; /* add one for ftrace_caller */ 44 #endif 45 return _count_relocs; 46 } 47 48 static int relacmp(const void *_x, const void *_y) 49 { 50 const Elf32_Rela *x, *y; 51 52 y = (Elf32_Rela *)_x; 53 x = (Elf32_Rela *)_y; 54 55 /* Compare the entire r_info (as opposed to ELF32_R_SYM(r_info) only) to 56 * make the comparison cheaper/faster. It won't affect the sorting or 57 * the counting algorithms' performance 58 */ 59 if (x->r_info < y->r_info) 60 return -1; 61 else if (x->r_info > y->r_info) 62 return 1; 63 else if (x->r_addend < y->r_addend) 64 return -1; 65 else if (x->r_addend > y->r_addend) 66 return 1; 67 else 68 return 0; 69 } 70 71 /* Get the potential trampolines size required of the init and 72 non-init sections */ 73 static unsigned long get_plt_size(const Elf32_Ehdr *hdr, 74 const Elf32_Shdr *sechdrs, 75 const char *secstrings, 76 int is_init) 77 { 78 unsigned long ret = 0; 79 unsigned i; 80 81 /* Everything marked ALLOC (this includes the exported 82 symbols) */ 83 for (i = 1; i < hdr->e_shnum; i++) { 84 /* If it's called *.init*, and we're not init, we're 85 not interested */ 86 if ((strstr(secstrings + sechdrs[i].sh_name, ".init") != NULL) 87 != is_init) 88 continue; 89 90 /* We don't want to look at debug sections. */ 91 if (strstr(secstrings + sechdrs[i].sh_name, ".debug")) 92 continue; 93 94 if (sechdrs[i].sh_type == SHT_RELA) { 95 pr_debug("Found relocations in section %u\n", i); 96 pr_debug("Ptr: %p. Number: %u\n", 97 (void *)hdr + sechdrs[i].sh_offset, 98 sechdrs[i].sh_size / sizeof(Elf32_Rela)); 99 100 /* Sort the relocation information based on a symbol and 101 * addend key. This is a stable O(n*log n) complexity 102 * algorithm but it will reduce the complexity of 103 * count_relocs() to linear complexity O(n) 104 */ 105 sort((void *)hdr + sechdrs[i].sh_offset, 106 sechdrs[i].sh_size / sizeof(Elf32_Rela), 107 sizeof(Elf32_Rela), relacmp, NULL); 108 109 ret += count_relocs((void *)hdr 110 + sechdrs[i].sh_offset, 111 sechdrs[i].sh_size 112 / sizeof(Elf32_Rela)) 113 * sizeof(struct ppc_plt_entry); 114 } 115 } 116 117 return ret; 118 } 119 120 int module_frob_arch_sections(Elf32_Ehdr *hdr, 121 Elf32_Shdr *sechdrs, 122 char *secstrings, 123 struct module *me) 124 { 125 unsigned int i; 126 127 /* Find .plt and .init.plt sections */ 128 for (i = 0; i < hdr->e_shnum; i++) { 129 if (strcmp(secstrings + sechdrs[i].sh_name, ".init.plt") == 0) 130 me->arch.init_plt_section = i; 131 else if (strcmp(secstrings + sechdrs[i].sh_name, ".plt") == 0) 132 me->arch.core_plt_section = i; 133 } 134 if (!me->arch.core_plt_section || !me->arch.init_plt_section) { 135 pr_err("Module doesn't contain .plt or .init.plt sections.\n"); 136 return -ENOEXEC; 137 } 138 139 /* Override their sizes */ 140 sechdrs[me->arch.core_plt_section].sh_size 141 = get_plt_size(hdr, sechdrs, secstrings, 0); 142 sechdrs[me->arch.init_plt_section].sh_size 143 = get_plt_size(hdr, sechdrs, secstrings, 1); 144 return 0; 145 } 146 147 static inline int entry_matches(struct ppc_plt_entry *entry, Elf32_Addr val) 148 { 149 if (entry->jump[0] != PPC_RAW_LIS(_R12, PPC_HA(val))) 150 return 0; 151 if (entry->jump[1] != PPC_RAW_ADDI(_R12, _R12, PPC_LO(val))) 152 return 0; 153 return 1; 154 } 155 156 /* Set up a trampoline in the PLT to bounce us to the distant function */ 157 static uint32_t do_plt_call(void *location, 158 Elf32_Addr val, 159 const Elf32_Shdr *sechdrs, 160 struct module *mod) 161 { 162 struct ppc_plt_entry *entry; 163 164 pr_debug("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location); 165 /* Init, or core PLT? */ 166 if (location >= mod->core_layout.base 167 && location < mod->core_layout.base + mod->core_layout.size) 168 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr; 169 else 170 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr; 171 172 /* Find this entry, or if that fails, the next avail. entry */ 173 while (entry->jump[0]) { 174 if (entry_matches(entry, val)) return (uint32_t)entry; 175 entry++; 176 } 177 178 if (patch_instruction(&entry->jump[0], ppc_inst(PPC_RAW_LIS(_R12, PPC_HA(val))))) 179 return 0; 180 if (patch_instruction(&entry->jump[1], ppc_inst(PPC_RAW_ADDI(_R12, _R12, PPC_LO(val))))) 181 return 0; 182 if (patch_instruction(&entry->jump[2], ppc_inst(PPC_RAW_MTCTR(_R12)))) 183 return 0; 184 if (patch_instruction(&entry->jump[3], ppc_inst(PPC_RAW_BCTR()))) 185 return 0; 186 187 pr_debug("Initialized plt for 0x%x at %p\n", val, entry); 188 return (uint32_t)entry; 189 } 190 191 static int patch_location_16(uint32_t *loc, u16 value) 192 { 193 loc = PTR_ALIGN_DOWN(loc, sizeof(u32)); 194 return patch_instruction(loc, ppc_inst((*loc & 0xffff0000) | value)); 195 } 196 197 int apply_relocate_add(Elf32_Shdr *sechdrs, 198 const char *strtab, 199 unsigned int symindex, 200 unsigned int relsec, 201 struct module *module) 202 { 203 unsigned int i; 204 Elf32_Rela *rela = (void *)sechdrs[relsec].sh_addr; 205 Elf32_Sym *sym; 206 uint32_t *location; 207 uint32_t value; 208 209 pr_debug("Applying ADD relocate section %u to %u\n", relsec, 210 sechdrs[relsec].sh_info); 211 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rela); i++) { 212 /* This is where to make the change */ 213 location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr 214 + rela[i].r_offset; 215 /* This is the symbol it is referring to. Note that all 216 undefined symbols have been resolved. */ 217 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr 218 + ELF32_R_SYM(rela[i].r_info); 219 /* `Everything is relative'. */ 220 value = sym->st_value + rela[i].r_addend; 221 222 switch (ELF32_R_TYPE(rela[i].r_info)) { 223 case R_PPC_ADDR32: 224 /* Simply set it */ 225 *(uint32_t *)location = value; 226 break; 227 228 case R_PPC_ADDR16_LO: 229 /* Low half of the symbol */ 230 if (patch_location_16(location, PPC_LO(value))) 231 return -EFAULT; 232 break; 233 234 case R_PPC_ADDR16_HI: 235 /* Higher half of the symbol */ 236 if (patch_location_16(location, PPC_HI(value))) 237 return -EFAULT; 238 break; 239 240 case R_PPC_ADDR16_HA: 241 if (patch_location_16(location, PPC_HA(value))) 242 return -EFAULT; 243 break; 244 245 case R_PPC_REL24: 246 if ((int)(value - (uint32_t)location) < -0x02000000 247 || (int)(value - (uint32_t)location) >= 0x02000000) { 248 value = do_plt_call(location, value, 249 sechdrs, module); 250 if (!value) 251 return -EFAULT; 252 } 253 254 /* Only replace bits 2 through 26 */ 255 pr_debug("REL24 value = %08X. location = %08X\n", 256 value, (uint32_t)location); 257 pr_debug("Location before: %08X.\n", 258 *(uint32_t *)location); 259 value = (*(uint32_t *)location & ~0x03fffffc) 260 | ((value - (uint32_t)location) 261 & 0x03fffffc); 262 263 if (patch_instruction(location, ppc_inst(value))) 264 return -EFAULT; 265 266 pr_debug("Location after: %08X.\n", 267 *(uint32_t *)location); 268 pr_debug("ie. jump to %08X+%08X = %08X\n", 269 *(uint32_t *)location & 0x03fffffc, 270 (uint32_t)location, 271 (*(uint32_t *)location & 0x03fffffc) 272 + (uint32_t)location); 273 break; 274 275 case R_PPC_REL32: 276 /* 32-bit relative jump. */ 277 *(uint32_t *)location = value - (uint32_t)location; 278 break; 279 280 default: 281 pr_err("%s: unknown ADD relocation: %u\n", 282 module->name, 283 ELF32_R_TYPE(rela[i].r_info)); 284 return -ENOEXEC; 285 } 286 } 287 288 return 0; 289 } 290 291 #ifdef CONFIG_DYNAMIC_FTRACE 292 int module_trampoline_target(struct module *mod, unsigned long addr, 293 unsigned long *target) 294 { 295 unsigned int jmp[4]; 296 297 /* Find where the trampoline jumps to */ 298 if (copy_from_kernel_nofault(jmp, (void *)addr, sizeof(jmp))) 299 return -EFAULT; 300 301 /* verify that this is what we expect it to be */ 302 if ((jmp[0] & 0xffff0000) != PPC_RAW_LIS(_R12, 0) || 303 (jmp[1] & 0xffff0000) != PPC_RAW_ADDI(_R12, _R12, 0) || 304 jmp[2] != PPC_RAW_MTCTR(_R12) || 305 jmp[3] != PPC_RAW_BCTR()) 306 return -EINVAL; 307 308 addr = (jmp[1] & 0xffff) | ((jmp[0] & 0xffff) << 16); 309 if (addr & 0x8000) 310 addr -= 0x10000; 311 312 *target = addr; 313 314 return 0; 315 } 316 317 int module_finalize_ftrace(struct module *module, const Elf_Shdr *sechdrs) 318 { 319 module->arch.tramp = do_plt_call(module->core_layout.base, 320 (unsigned long)ftrace_caller, 321 sechdrs, module); 322 if (!module->arch.tramp) 323 return -ENOENT; 324 325 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS 326 module->arch.tramp_regs = do_plt_call(module->core_layout.base, 327 (unsigned long)ftrace_regs_caller, 328 sechdrs, module); 329 if (!module->arch.tramp_regs) 330 return -ENOENT; 331 #endif 332 333 return 0; 334 } 335 #endif 336