1 /* Kernel module help for PPC64. 2 Copyright (C) 2001, 2003 Rusty Russell IBM Corporation. 3 4 This program is free software; you can redistribute it and/or modify 5 it under the terms of the GNU General Public License as published by 6 the Free Software Foundation; either version 2 of the License, or 7 (at your option) any later version. 8 9 This program is distributed in the hope that it will be useful, 10 but WITHOUT ANY WARRANTY; without even the implied warranty of 11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 GNU General Public License for more details. 13 14 You should have received a copy of the GNU General Public License 15 along with this program; if not, write to the Free Software 16 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 17 */ 18 #include <linux/module.h> 19 #include <linux/elf.h> 20 #include <linux/moduleloader.h> 21 #include <linux/err.h> 22 #include <linux/vmalloc.h> 23 #include <linux/ftrace.h> 24 #include <linux/bug.h> 25 #include <linux/uaccess.h> 26 #include <asm/module.h> 27 #include <asm/firmware.h> 28 #include <asm/code-patching.h> 29 #include <linux/sort.h> 30 #include <asm/setup.h> 31 32 /* FIXME: We don't do .init separately. To do this, we'd need to have 33 a separate r2 value in the init and core section, and stub between 34 them, too. 35 36 Using a magic allocator which places modules within 32MB solves 37 this, and makes other things simpler. Anton? 38 --RR. */ 39 #if 0 40 #define DEBUGP printk 41 #else 42 #define DEBUGP(fmt , ...) 43 #endif 44 45 #if defined(_CALL_ELF) && _CALL_ELF == 2 46 #define R2_STACK_OFFSET 24 47 48 /* An address is simply the address of the function. */ 49 typedef unsigned long func_desc_t; 50 51 static func_desc_t func_desc(unsigned long addr) 52 { 53 return addr; 54 } 55 static unsigned long func_addr(unsigned long addr) 56 { 57 return addr; 58 } 59 static unsigned long stub_func_addr(func_desc_t func) 60 { 61 return func; 62 } 63 64 /* PowerPC64 specific values for the Elf64_Sym st_other field. */ 65 #define STO_PPC64_LOCAL_BIT 5 66 #define STO_PPC64_LOCAL_MASK (7 << STO_PPC64_LOCAL_BIT) 67 #define PPC64_LOCAL_ENTRY_OFFSET(other) \ 68 (((1 << (((other) & STO_PPC64_LOCAL_MASK) >> STO_PPC64_LOCAL_BIT)) >> 2) << 2) 69 70 static unsigned int local_entry_offset(const Elf64_Sym *sym) 71 { 72 /* sym->st_other indicates offset to local entry point 73 * (otherwise it will assume r12 is the address of the start 74 * of function and try to derive r2 from it). */ 75 return PPC64_LOCAL_ENTRY_OFFSET(sym->st_other); 76 } 77 #else 78 #define R2_STACK_OFFSET 40 79 80 /* An address is address of the OPD entry, which contains address of fn. */ 81 typedef struct ppc64_opd_entry func_desc_t; 82 83 static func_desc_t func_desc(unsigned long addr) 84 { 85 return *(struct ppc64_opd_entry *)addr; 86 } 87 static unsigned long func_addr(unsigned long addr) 88 { 89 return func_desc(addr).funcaddr; 90 } 91 static unsigned long stub_func_addr(func_desc_t func) 92 { 93 return func.funcaddr; 94 } 95 static unsigned int local_entry_offset(const Elf64_Sym *sym) 96 { 97 return 0; 98 } 99 #endif 100 101 /* Like PPC32, we need little trampolines to do > 24-bit jumps (into 102 the kernel itself). But on PPC64, these need to be used for every 103 jump, actually, to reset r2 (TOC+0x8000). */ 104 struct ppc64_stub_entry 105 { 106 /* 28 byte jump instruction sequence (7 instructions). We only 107 * need 6 instructions on ABIv2 but we always allocate 7 so 108 * so we don't have to modify the trampoline load instruction. */ 109 u32 jump[7]; 110 u32 unused; 111 /* Data for the above code */ 112 func_desc_t funcdata; 113 }; 114 115 /* 116 * PPC64 uses 24 bit jumps, but we need to jump into other modules or 117 * the kernel which may be further. So we jump to a stub. 118 * 119 * For ELFv1 we need to use this to set up the new r2 value (aka TOC 120 * pointer). For ELFv2 it's the callee's responsibility to set up the 121 * new r2, but for both we need to save the old r2. 122 * 123 * We could simply patch the new r2 value and function pointer into 124 * the stub, but it's significantly shorter to put these values at the 125 * end of the stub code, and patch the stub address (32-bits relative 126 * to the TOC ptr, r2) into the stub. 127 */ 128 129 static u32 ppc64_stub_insns[] = { 130 0x3d620000, /* addis r11,r2, <high> */ 131 0x396b0000, /* addi r11,r11, <low> */ 132 /* Save current r2 value in magic place on the stack. */ 133 0xf8410000|R2_STACK_OFFSET, /* std r2,R2_STACK_OFFSET(r1) */ 134 0xe98b0020, /* ld r12,32(r11) */ 135 #if !defined(_CALL_ELF) || _CALL_ELF != 2 136 /* Set up new r2 from function descriptor */ 137 0xe84b0028, /* ld r2,40(r11) */ 138 #endif 139 0x7d8903a6, /* mtctr r12 */ 140 0x4e800420 /* bctr */ 141 }; 142 143 #ifdef CONFIG_DYNAMIC_FTRACE 144 145 static u32 ppc64_stub_mask[] = { 146 0xffff0000, 147 0xffff0000, 148 0xffffffff, 149 0xffffffff, 150 #if !defined(_CALL_ELF) || _CALL_ELF != 2 151 0xffffffff, 152 #endif 153 0xffffffff, 154 0xffffffff 155 }; 156 157 bool is_module_trampoline(u32 *p) 158 { 159 unsigned int i; 160 u32 insns[ARRAY_SIZE(ppc64_stub_insns)]; 161 162 BUILD_BUG_ON(sizeof(ppc64_stub_insns) != sizeof(ppc64_stub_mask)); 163 164 if (probe_kernel_read(insns, p, sizeof(insns))) 165 return -EFAULT; 166 167 for (i = 0; i < ARRAY_SIZE(ppc64_stub_insns); i++) { 168 u32 insna = insns[i]; 169 u32 insnb = ppc64_stub_insns[i]; 170 u32 mask = ppc64_stub_mask[i]; 171 172 if ((insna & mask) != (insnb & mask)) 173 return false; 174 } 175 176 return true; 177 } 178 179 int module_trampoline_target(struct module *mod, u32 *trampoline, 180 unsigned long *target) 181 { 182 u32 buf[2]; 183 u16 upper, lower; 184 long offset; 185 void *toc_entry; 186 187 if (probe_kernel_read(buf, trampoline, sizeof(buf))) 188 return -EFAULT; 189 190 upper = buf[0] & 0xffff; 191 lower = buf[1] & 0xffff; 192 193 /* perform the addis/addi, both signed */ 194 offset = ((short)upper << 16) + (short)lower; 195 196 /* 197 * Now get the address this trampoline jumps to. This 198 * is always 32 bytes into our trampoline stub. 199 */ 200 toc_entry = (void *)mod->arch.toc + offset + 32; 201 202 if (probe_kernel_read(target, toc_entry, sizeof(*target))) 203 return -EFAULT; 204 205 return 0; 206 } 207 208 #endif 209 210 /* Count how many different 24-bit relocations (different symbol, 211 different addend) */ 212 static unsigned int count_relocs(const Elf64_Rela *rela, unsigned int num) 213 { 214 unsigned int i, r_info, r_addend, _count_relocs; 215 216 /* FIXME: Only count external ones --RR */ 217 _count_relocs = 0; 218 r_info = 0; 219 r_addend = 0; 220 for (i = 0; i < num; i++) 221 /* Only count 24-bit relocs, others don't need stubs */ 222 if (ELF64_R_TYPE(rela[i].r_info) == R_PPC_REL24 && 223 (r_info != ELF64_R_SYM(rela[i].r_info) || 224 r_addend != rela[i].r_addend)) { 225 _count_relocs++; 226 r_info = ELF64_R_SYM(rela[i].r_info); 227 r_addend = rela[i].r_addend; 228 } 229 230 return _count_relocs; 231 } 232 233 static int relacmp(const void *_x, const void *_y) 234 { 235 const Elf64_Rela *x, *y; 236 237 y = (Elf64_Rela *)_x; 238 x = (Elf64_Rela *)_y; 239 240 /* Compare the entire r_info (as opposed to ELF64_R_SYM(r_info) only) to 241 * make the comparison cheaper/faster. It won't affect the sorting or 242 * the counting algorithms' performance 243 */ 244 if (x->r_info < y->r_info) 245 return -1; 246 else if (x->r_info > y->r_info) 247 return 1; 248 else if (x->r_addend < y->r_addend) 249 return -1; 250 else if (x->r_addend > y->r_addend) 251 return 1; 252 else 253 return 0; 254 } 255 256 static void relaswap(void *_x, void *_y, int size) 257 { 258 uint64_t *x, *y, tmp; 259 int i; 260 261 y = (uint64_t *)_x; 262 x = (uint64_t *)_y; 263 264 for (i = 0; i < sizeof(Elf64_Rela) / sizeof(uint64_t); i++) { 265 tmp = x[i]; 266 x[i] = y[i]; 267 y[i] = tmp; 268 } 269 } 270 271 /* Get size of potential trampolines required. */ 272 static unsigned long get_stubs_size(const Elf64_Ehdr *hdr, 273 const Elf64_Shdr *sechdrs) 274 { 275 /* One extra reloc so it's always 0-funcaddr terminated */ 276 unsigned long relocs = 1; 277 unsigned i; 278 279 /* Every relocated section... */ 280 for (i = 1; i < hdr->e_shnum; i++) { 281 if (sechdrs[i].sh_type == SHT_RELA) { 282 DEBUGP("Found relocations in section %u\n", i); 283 DEBUGP("Ptr: %p. Number: %lu\n", 284 (void *)sechdrs[i].sh_addr, 285 sechdrs[i].sh_size / sizeof(Elf64_Rela)); 286 287 /* Sort the relocation information based on a symbol and 288 * addend key. This is a stable O(n*log n) complexity 289 * alogrithm but it will reduce the complexity of 290 * count_relocs() to linear complexity O(n) 291 */ 292 sort((void *)sechdrs[i].sh_addr, 293 sechdrs[i].sh_size / sizeof(Elf64_Rela), 294 sizeof(Elf64_Rela), relacmp, relaswap); 295 296 relocs += count_relocs((void *)sechdrs[i].sh_addr, 297 sechdrs[i].sh_size 298 / sizeof(Elf64_Rela)); 299 } 300 } 301 302 #ifdef CONFIG_DYNAMIC_FTRACE 303 /* make the trampoline to the ftrace_caller */ 304 relocs++; 305 #endif 306 307 DEBUGP("Looks like a total of %lu stubs, max\n", relocs); 308 return relocs * sizeof(struct ppc64_stub_entry); 309 } 310 311 /* Still needed for ELFv2, for .TOC. */ 312 static void dedotify_versions(struct modversion_info *vers, 313 unsigned long size) 314 { 315 struct modversion_info *end; 316 317 for (end = (void *)vers + size; vers < end; vers++) 318 if (vers->name[0] == '.') { 319 memmove(vers->name, vers->name+1, strlen(vers->name)); 320 #ifdef ARCH_RELOCATES_KCRCTAB 321 /* The TOC symbol has no CRC computed. To avoid CRC 322 * check failing, we must force it to the expected 323 * value (see CRC check in module.c). 324 */ 325 if (!strcmp(vers->name, "TOC.")) 326 vers->crc = -(unsigned long)reloc_start; 327 #endif 328 } 329 } 330 331 /* Undefined symbols which refer to .funcname, hack to funcname (or .TOC.) */ 332 static void dedotify(Elf64_Sym *syms, unsigned int numsyms, char *strtab) 333 { 334 unsigned int i; 335 336 for (i = 1; i < numsyms; i++) { 337 if (syms[i].st_shndx == SHN_UNDEF) { 338 char *name = strtab + syms[i].st_name; 339 if (name[0] == '.') 340 memmove(name, name+1, strlen(name)); 341 } 342 } 343 } 344 345 static Elf64_Sym *find_dot_toc(Elf64_Shdr *sechdrs, 346 const char *strtab, 347 unsigned int symindex) 348 { 349 unsigned int i, numsyms; 350 Elf64_Sym *syms; 351 352 syms = (Elf64_Sym *)sechdrs[symindex].sh_addr; 353 numsyms = sechdrs[symindex].sh_size / sizeof(Elf64_Sym); 354 355 for (i = 1; i < numsyms; i++) { 356 if (syms[i].st_shndx == SHN_UNDEF 357 && strcmp(strtab + syms[i].st_name, "TOC.") == 0) 358 return &syms[i]; 359 } 360 return NULL; 361 } 362 363 int module_frob_arch_sections(Elf64_Ehdr *hdr, 364 Elf64_Shdr *sechdrs, 365 char *secstrings, 366 struct module *me) 367 { 368 unsigned int i; 369 370 /* Find .toc and .stubs sections, symtab and strtab */ 371 for (i = 1; i < hdr->e_shnum; i++) { 372 char *p; 373 if (strcmp(secstrings + sechdrs[i].sh_name, ".stubs") == 0) 374 me->arch.stubs_section = i; 375 else if (strcmp(secstrings + sechdrs[i].sh_name, ".toc") == 0) 376 me->arch.toc_section = i; 377 else if (strcmp(secstrings+sechdrs[i].sh_name,"__versions")==0) 378 dedotify_versions((void *)hdr + sechdrs[i].sh_offset, 379 sechdrs[i].sh_size); 380 381 /* We don't handle .init for the moment: rename to _init */ 382 while ((p = strstr(secstrings + sechdrs[i].sh_name, ".init"))) 383 p[0] = '_'; 384 385 if (sechdrs[i].sh_type == SHT_SYMTAB) 386 dedotify((void *)hdr + sechdrs[i].sh_offset, 387 sechdrs[i].sh_size / sizeof(Elf64_Sym), 388 (void *)hdr 389 + sechdrs[sechdrs[i].sh_link].sh_offset); 390 } 391 392 if (!me->arch.stubs_section) { 393 printk("%s: doesn't contain .stubs.\n", me->name); 394 return -ENOEXEC; 395 } 396 397 /* If we don't have a .toc, just use .stubs. We need to set r2 398 to some reasonable value in case the module calls out to 399 other functions via a stub, or if a function pointer escapes 400 the module by some means. */ 401 if (!me->arch.toc_section) 402 me->arch.toc_section = me->arch.stubs_section; 403 404 /* Override the stubs size */ 405 sechdrs[me->arch.stubs_section].sh_size = get_stubs_size(hdr, sechdrs); 406 return 0; 407 } 408 409 /* r2 is the TOC pointer: it actually points 0x8000 into the TOC (this 410 gives the value maximum span in an instruction which uses a signed 411 offset) */ 412 static inline unsigned long my_r2(Elf64_Shdr *sechdrs, struct module *me) 413 { 414 return sechdrs[me->arch.toc_section].sh_addr + 0x8000; 415 } 416 417 /* Both low and high 16 bits are added as SIGNED additions, so if low 418 16 bits has high bit set, high 16 bits must be adjusted. These 419 macros do that (stolen from binutils). */ 420 #define PPC_LO(v) ((v) & 0xffff) 421 #define PPC_HI(v) (((v) >> 16) & 0xffff) 422 #define PPC_HA(v) PPC_HI ((v) + 0x8000) 423 424 /* Patch stub to reference function and correct r2 value. */ 425 static inline int create_stub(Elf64_Shdr *sechdrs, 426 struct ppc64_stub_entry *entry, 427 unsigned long addr, 428 struct module *me) 429 { 430 long reladdr; 431 432 memcpy(entry->jump, ppc64_stub_insns, sizeof(ppc64_stub_insns)); 433 434 /* Stub uses address relative to r2. */ 435 reladdr = (unsigned long)entry - my_r2(sechdrs, me); 436 if (reladdr > 0x7FFFFFFF || reladdr < -(0x80000000L)) { 437 printk("%s: Address %p of stub out of range of %p.\n", 438 me->name, (void *)reladdr, (void *)my_r2); 439 return 0; 440 } 441 DEBUGP("Stub %p get data from reladdr %li\n", entry, reladdr); 442 443 entry->jump[0] |= PPC_HA(reladdr); 444 entry->jump[1] |= PPC_LO(reladdr); 445 entry->funcdata = func_desc(addr); 446 return 1; 447 } 448 449 /* Create stub to jump to function described in this OPD/ptr: we need the 450 stub to set up the TOC ptr (r2) for the function. */ 451 static unsigned long stub_for_addr(Elf64_Shdr *sechdrs, 452 unsigned long addr, 453 struct module *me) 454 { 455 struct ppc64_stub_entry *stubs; 456 unsigned int i, num_stubs; 457 458 num_stubs = sechdrs[me->arch.stubs_section].sh_size / sizeof(*stubs); 459 460 /* Find this stub, or if that fails, the next avail. entry */ 461 stubs = (void *)sechdrs[me->arch.stubs_section].sh_addr; 462 for (i = 0; stub_func_addr(stubs[i].funcdata); i++) { 463 BUG_ON(i >= num_stubs); 464 465 if (stub_func_addr(stubs[i].funcdata) == func_addr(addr)) 466 return (unsigned long)&stubs[i]; 467 } 468 469 if (!create_stub(sechdrs, &stubs[i], addr, me)) 470 return 0; 471 472 return (unsigned long)&stubs[i]; 473 } 474 475 /* We expect a noop next: if it is, replace it with instruction to 476 restore r2. */ 477 static int restore_r2(u32 *instruction, struct module *me) 478 { 479 if (*instruction != PPC_INST_NOP) { 480 printk("%s: Expect noop after relocate, got %08x\n", 481 me->name, *instruction); 482 return 0; 483 } 484 /* ld r2,R2_STACK_OFFSET(r1) */ 485 *instruction = 0xe8410000 | R2_STACK_OFFSET; 486 return 1; 487 } 488 489 int apply_relocate_add(Elf64_Shdr *sechdrs, 490 const char *strtab, 491 unsigned int symindex, 492 unsigned int relsec, 493 struct module *me) 494 { 495 unsigned int i; 496 Elf64_Rela *rela = (void *)sechdrs[relsec].sh_addr; 497 Elf64_Sym *sym; 498 unsigned long *location; 499 unsigned long value; 500 501 DEBUGP("Applying ADD relocate section %u to %u\n", relsec, 502 sechdrs[relsec].sh_info); 503 504 /* First time we're called, we can fix up .TOC. */ 505 if (!me->arch.toc_fixed) { 506 sym = find_dot_toc(sechdrs, strtab, symindex); 507 /* It's theoretically possible that a module doesn't want a 508 * .TOC. so don't fail it just for that. */ 509 if (sym) 510 sym->st_value = my_r2(sechdrs, me); 511 me->arch.toc_fixed = true; 512 } 513 514 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rela); i++) { 515 /* This is where to make the change */ 516 location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr 517 + rela[i].r_offset; 518 /* This is the symbol it is referring to */ 519 sym = (Elf64_Sym *)sechdrs[symindex].sh_addr 520 + ELF64_R_SYM(rela[i].r_info); 521 522 DEBUGP("RELOC at %p: %li-type as %s (%lu) + %li\n", 523 location, (long)ELF64_R_TYPE(rela[i].r_info), 524 strtab + sym->st_name, (unsigned long)sym->st_value, 525 (long)rela[i].r_addend); 526 527 /* `Everything is relative'. */ 528 value = sym->st_value + rela[i].r_addend; 529 530 switch (ELF64_R_TYPE(rela[i].r_info)) { 531 case R_PPC64_ADDR32: 532 /* Simply set it */ 533 *(u32 *)location = value; 534 break; 535 536 case R_PPC64_ADDR64: 537 /* Simply set it */ 538 *(unsigned long *)location = value; 539 break; 540 541 case R_PPC64_TOC: 542 *(unsigned long *)location = my_r2(sechdrs, me); 543 break; 544 545 case R_PPC64_TOC16: 546 /* Subtract TOC pointer */ 547 value -= my_r2(sechdrs, me); 548 if (value + 0x8000 > 0xffff) { 549 printk("%s: bad TOC16 relocation (%lu)\n", 550 me->name, value); 551 return -ENOEXEC; 552 } 553 *((uint16_t *) location) 554 = (*((uint16_t *) location) & ~0xffff) 555 | (value & 0xffff); 556 break; 557 558 case R_PPC64_TOC16_LO: 559 /* Subtract TOC pointer */ 560 value -= my_r2(sechdrs, me); 561 *((uint16_t *) location) 562 = (*((uint16_t *) location) & ~0xffff) 563 | (value & 0xffff); 564 break; 565 566 case R_PPC64_TOC16_DS: 567 /* Subtract TOC pointer */ 568 value -= my_r2(sechdrs, me); 569 if ((value & 3) != 0 || value + 0x8000 > 0xffff) { 570 printk("%s: bad TOC16_DS relocation (%lu)\n", 571 me->name, value); 572 return -ENOEXEC; 573 } 574 *((uint16_t *) location) 575 = (*((uint16_t *) location) & ~0xfffc) 576 | (value & 0xfffc); 577 break; 578 579 case R_PPC64_TOC16_LO_DS: 580 /* Subtract TOC pointer */ 581 value -= my_r2(sechdrs, me); 582 if ((value & 3) != 0) { 583 printk("%s: bad TOC16_LO_DS relocation (%lu)\n", 584 me->name, value); 585 return -ENOEXEC; 586 } 587 *((uint16_t *) location) 588 = (*((uint16_t *) location) & ~0xfffc) 589 | (value & 0xfffc); 590 break; 591 592 case R_PPC64_TOC16_HA: 593 /* Subtract TOC pointer */ 594 value -= my_r2(sechdrs, me); 595 value = ((value + 0x8000) >> 16); 596 *((uint16_t *) location) 597 = (*((uint16_t *) location) & ~0xffff) 598 | (value & 0xffff); 599 break; 600 601 case R_PPC_REL24: 602 /* FIXME: Handle weak symbols here --RR */ 603 if (sym->st_shndx == SHN_UNDEF) { 604 /* External: go via stub */ 605 value = stub_for_addr(sechdrs, value, me); 606 if (!value) 607 return -ENOENT; 608 if (!restore_r2((u32 *)location + 1, me)) 609 return -ENOEXEC; 610 } else 611 value += local_entry_offset(sym); 612 613 /* Convert value to relative */ 614 value -= (unsigned long)location; 615 if (value + 0x2000000 > 0x3ffffff || (value & 3) != 0){ 616 printk("%s: REL24 %li out of range!\n", 617 me->name, (long int)value); 618 return -ENOEXEC; 619 } 620 621 /* Only replace bits 2 through 26 */ 622 *(uint32_t *)location 623 = (*(uint32_t *)location & ~0x03fffffc) 624 | (value & 0x03fffffc); 625 break; 626 627 case R_PPC64_REL64: 628 /* 64 bits relative (used by features fixups) */ 629 *location = value - (unsigned long)location; 630 break; 631 632 case R_PPC64_TOCSAVE: 633 /* 634 * Marker reloc indicates we don't have to save r2. 635 * That would only save us one instruction, so ignore 636 * it. 637 */ 638 break; 639 640 case R_PPC64_REL16_HA: 641 /* Subtract location pointer */ 642 value -= (unsigned long)location; 643 value = ((value + 0x8000) >> 16); 644 *((uint16_t *) location) 645 = (*((uint16_t *) location) & ~0xffff) 646 | (value & 0xffff); 647 break; 648 649 case R_PPC64_REL16_LO: 650 /* Subtract location pointer */ 651 value -= (unsigned long)location; 652 *((uint16_t *) location) 653 = (*((uint16_t *) location) & ~0xffff) 654 | (value & 0xffff); 655 break; 656 657 default: 658 printk("%s: Unknown ADD relocation: %lu\n", 659 me->name, 660 (unsigned long)ELF64_R_TYPE(rela[i].r_info)); 661 return -ENOEXEC; 662 } 663 } 664 665 #ifdef CONFIG_DYNAMIC_FTRACE 666 me->arch.toc = my_r2(sechdrs, me); 667 me->arch.tramp = stub_for_addr(sechdrs, 668 (unsigned long)ftrace_caller, 669 me); 670 #endif 671 672 return 0; 673 } 674