1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* Kernel module help for PPC64.
3 Copyright (C) 2001, 2003 Rusty Russell IBM Corporation.
7 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 #include <linux/module.h>
10 #include <linux/elf.h>
11 #include <linux/moduleloader.h>
12 #include <linux/err.h>
13 #include <linux/vmalloc.h>
14 #include <linux/ftrace.h>
15 #include <linux/bug.h>
16 #include <linux/uaccess.h>
17 #include <linux/kernel.h>
18 #include <asm/module.h>
19 #include <asm/firmware.h>
20 #include <asm/code-patching.h>
21 #include <linux/sort.h>
22 #include <asm/setup.h>
23 #include <asm/sections.h>
26 /* FIXME: We don't do .init separately. To do this, we'd need to have
27 a separate r2 value in the init and core section, and stub between
30 Using a magic allocator which places modules within 32MB solves
31 this, and makes other things simpler. Anton?
34 bool module_elf_check_arch(Elf_Ehdr *hdr)
36 unsigned long abi_level = hdr->e_flags & 0x3;
38 if (IS_ENABLED(CONFIG_PPC64_ELF_ABI_V2))
39 return abi_level == 2;
44 #ifdef CONFIG_PPC64_ELF_ABI_V2
46 static func_desc_t func_desc(unsigned long addr)
55 /* PowerPC64 specific values for the Elf64_Sym st_other field. */
56 #define STO_PPC64_LOCAL_BIT 5
57 #define STO_PPC64_LOCAL_MASK (7 << STO_PPC64_LOCAL_BIT)
58 #define PPC64_LOCAL_ENTRY_OFFSET(other) \
59 (((1 << (((other) & STO_PPC64_LOCAL_MASK) >> STO_PPC64_LOCAL_BIT)) >> 2) << 2)
61 static unsigned int local_entry_offset(const Elf64_Sym *sym)
63 /* sym->st_other indicates offset to local entry point
64 * (otherwise it will assume r12 is the address of the start
65 * of function and try to derive r2 from it). */
66 return PPC64_LOCAL_ENTRY_OFFSET(sym->st_other);
70 static func_desc_t func_desc(unsigned long addr)
72 return *(struct func_desc *)addr;
74 static unsigned int local_entry_offset(const Elf64_Sym *sym)
79 void *dereference_module_function_descriptor(struct module *mod, void *ptr)
81 if (ptr < (void *)mod->arch.start_opd ||
82 ptr >= (void *)mod->arch.end_opd)
85 return dereference_function_descriptor(ptr);
89 static unsigned long func_addr(unsigned long addr)
91 return func_desc(addr).addr;
94 static unsigned long stub_func_addr(func_desc_t func)
99 #define STUB_MAGIC 0x73747562 /* stub */
101 /* Like PPC32, we need little trampolines to do > 24-bit jumps (into
102 the kernel itself). But on PPC64, these need to be used for every
103 jump, actually, to reset r2 (TOC+0x8000). */
104 struct ppc64_stub_entry
106 /* 28 byte jump instruction sequence (7 instructions). We only
107 * need 6 instructions on ABIv2 but we always allocate 7 so
108 * so we don't have to modify the trampoline load instruction. */
110 /* Used by ftrace to identify stubs */
112 /* Data for the above code */
113 func_desc_t funcdata;
117 * PPC64 uses 24 bit jumps, but we need to jump into other modules or
118 * the kernel which may be further. So we jump to a stub.
120 * For ELFv1 we need to use this to set up the new r2 value (aka TOC
121 * pointer). For ELFv2 it's the callee's responsibility to set up the
122 * new r2, but for both we need to save the old r2.
124 * We could simply patch the new r2 value and function pointer into
125 * the stub, but it's significantly shorter to put these values at the
126 * end of the stub code, and patch the stub address (32-bits relative
127 * to the TOC ptr, r2) into the stub.
129 static u32 ppc64_stub_insns[] = {
130 PPC_RAW_ADDIS(_R11, _R2, 0),
131 PPC_RAW_ADDI(_R11, _R11, 0),
132 /* Save current r2 value in magic place on the stack. */
133 PPC_RAW_STD(_R2, _R1, R2_STACK_OFFSET),
134 PPC_RAW_LD(_R12, _R11, 32),
135 #ifdef CONFIG_PPC64_ELF_ABI_V1
136 /* Set up new r2 from function descriptor */
137 PPC_RAW_LD(_R2, _R11, 40),
143 /* Count how many different 24-bit relocations (different symbol,
145 static unsigned int count_relocs(const Elf64_Rela *rela, unsigned int num)
147 unsigned int i, r_info, r_addend, _count_relocs;
149 /* FIXME: Only count external ones --RR */
153 for (i = 0; i < num; i++)
154 /* Only count 24-bit relocs, others don't need stubs */
155 if (ELF64_R_TYPE(rela[i].r_info) == R_PPC_REL24 &&
156 (r_info != ELF64_R_SYM(rela[i].r_info) ||
157 r_addend != rela[i].r_addend)) {
159 r_info = ELF64_R_SYM(rela[i].r_info);
160 r_addend = rela[i].r_addend;
163 return _count_relocs;
166 static int relacmp(const void *_x, const void *_y)
168 const Elf64_Rela *x, *y;
170 y = (Elf64_Rela *)_x;
171 x = (Elf64_Rela *)_y;
173 /* Compare the entire r_info (as opposed to ELF64_R_SYM(r_info) only) to
174 * make the comparison cheaper/faster. It won't affect the sorting or
175 * the counting algorithms' performance
177 if (x->r_info < y->r_info)
179 else if (x->r_info > y->r_info)
181 else if (x->r_addend < y->r_addend)
183 else if (x->r_addend > y->r_addend)
189 /* Get size of potential trampolines required. */
190 static unsigned long get_stubs_size(const Elf64_Ehdr *hdr,
191 const Elf64_Shdr *sechdrs)
193 /* One extra reloc so it's always 0-addr terminated */
194 unsigned long relocs = 1;
197 /* Every relocated section... */
198 for (i = 1; i < hdr->e_shnum; i++) {
199 if (sechdrs[i].sh_type == SHT_RELA) {
200 pr_debug("Found relocations in section %u\n", i);
201 pr_debug("Ptr: %p. Number: %Lu\n",
202 (void *)sechdrs[i].sh_addr,
203 sechdrs[i].sh_size / sizeof(Elf64_Rela));
205 /* Sort the relocation information based on a symbol and
206 * addend key. This is a stable O(n*log n) complexity
207 * algorithm but it will reduce the complexity of
208 * count_relocs() to linear complexity O(n)
210 sort((void *)sechdrs[i].sh_addr,
211 sechdrs[i].sh_size / sizeof(Elf64_Rela),
212 sizeof(Elf64_Rela), relacmp, NULL);
214 relocs += count_relocs((void *)sechdrs[i].sh_addr,
216 / sizeof(Elf64_Rela));
220 #ifdef CONFIG_DYNAMIC_FTRACE
221 /* make the trampoline to the ftrace_caller */
223 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
224 /* an additional one for ftrace_regs_caller */
229 pr_debug("Looks like a total of %lu stubs, max\n", relocs);
230 return relocs * sizeof(struct ppc64_stub_entry);
233 /* Still needed for ELFv2, for .TOC. */
234 static void dedotify_versions(struct modversion_info *vers,
237 struct modversion_info *end;
239 for (end = (void *)vers + size; vers < end; vers++)
240 if (vers->name[0] == '.') {
241 memmove(vers->name, vers->name+1, strlen(vers->name));
246 * Undefined symbols which refer to .funcname, hack to funcname. Make .TOC.
247 * seem to be defined (value set later).
249 static void dedotify(Elf64_Sym *syms, unsigned int numsyms, char *strtab)
253 for (i = 1; i < numsyms; i++) {
254 if (syms[i].st_shndx == SHN_UNDEF) {
255 char *name = strtab + syms[i].st_name;
256 if (name[0] == '.') {
257 if (strcmp(name+1, "TOC.") == 0)
258 syms[i].st_shndx = SHN_ABS;
265 static Elf64_Sym *find_dot_toc(Elf64_Shdr *sechdrs,
267 unsigned int symindex)
269 unsigned int i, numsyms;
272 syms = (Elf64_Sym *)sechdrs[symindex].sh_addr;
273 numsyms = sechdrs[symindex].sh_size / sizeof(Elf64_Sym);
275 for (i = 1; i < numsyms; i++) {
276 if (syms[i].st_shndx == SHN_ABS
277 && strcmp(strtab + syms[i].st_name, "TOC.") == 0)
283 bool module_init_section(const char *name)
285 /* We don't handle .init for the moment: always return false. */
289 int module_frob_arch_sections(Elf64_Ehdr *hdr,
296 /* Find .toc and .stubs sections, symtab and strtab */
297 for (i = 1; i < hdr->e_shnum; i++) {
298 if (strcmp(secstrings + sechdrs[i].sh_name, ".stubs") == 0)
299 me->arch.stubs_section = i;
300 else if (strcmp(secstrings + sechdrs[i].sh_name, ".toc") == 0) {
301 me->arch.toc_section = i;
302 if (sechdrs[i].sh_addralign < 8)
303 sechdrs[i].sh_addralign = 8;
305 else if (strcmp(secstrings+sechdrs[i].sh_name,"__versions")==0)
306 dedotify_versions((void *)hdr + sechdrs[i].sh_offset,
309 if (sechdrs[i].sh_type == SHT_SYMTAB)
310 dedotify((void *)hdr + sechdrs[i].sh_offset,
311 sechdrs[i].sh_size / sizeof(Elf64_Sym),
313 + sechdrs[sechdrs[i].sh_link].sh_offset);
316 if (!me->arch.stubs_section) {
317 pr_err("%s: doesn't contain .stubs.\n", me->name);
321 /* If we don't have a .toc, just use .stubs. We need to set r2
322 to some reasonable value in case the module calls out to
323 other functions via a stub, or if a function pointer escapes
324 the module by some means. */
325 if (!me->arch.toc_section)
326 me->arch.toc_section = me->arch.stubs_section;
328 /* Override the stubs size */
329 sechdrs[me->arch.stubs_section].sh_size = get_stubs_size(hdr, sechdrs);
333 #ifdef CONFIG_MPROFILE_KERNEL
335 static u32 stub_insns[] = {
336 PPC_RAW_LD(_R12, _R13, offsetof(struct paca_struct, kernel_toc)),
337 PPC_RAW_ADDIS(_R12, _R12, 0),
338 PPC_RAW_ADDI(_R12, _R12, 0),
344 * For mprofile-kernel we use a special stub for ftrace_caller() because we
345 * can't rely on r2 containing this module's TOC when we enter the stub.
347 * That can happen if the function calling us didn't need to use the toc. In
348 * that case it won't have setup r2, and the r2 value will be either the
349 * kernel's toc, or possibly another modules toc.
351 * To deal with that this stub uses the kernel toc, which is always accessible
352 * via the paca (in r13). The target (ftrace_caller()) is responsible for
353 * saving and restoring the toc before returning.
355 static inline int create_ftrace_stub(struct ppc64_stub_entry *entry,
361 memcpy(entry->jump, stub_insns, sizeof(stub_insns));
363 /* Stub uses address relative to kernel toc (from the paca) */
364 reladdr = addr - kernel_toc_addr();
365 if (reladdr > 0x7FFFFFFF || reladdr < -(0x80000000L)) {
366 pr_err("%s: Address of %ps out of range of kernel_toc.\n",
367 me->name, (void *)addr);
371 entry->jump[1] |= PPC_HA(reladdr);
372 entry->jump[2] |= PPC_LO(reladdr);
374 /* Even though we don't use funcdata in the stub, it's needed elsewhere. */
375 entry->funcdata = func_desc(addr);
376 entry->magic = STUB_MAGIC;
381 static bool is_mprofile_ftrace_call(const char *name)
383 if (!strcmp("_mcount", name))
385 #ifdef CONFIG_DYNAMIC_FTRACE
386 if (!strcmp("ftrace_caller", name))
388 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
389 if (!strcmp("ftrace_regs_caller", name))
397 static inline int create_ftrace_stub(struct ppc64_stub_entry *entry,
404 static bool is_mprofile_ftrace_call(const char *name)
411 * r2 is the TOC pointer: it actually points 0x8000 into the TOC (this gives the
412 * value maximum span in an instruction which uses a signed offset). Round down
413 * to a 256 byte boundary for the odd case where we are setting up r2 without a
416 static inline unsigned long my_r2(const Elf64_Shdr *sechdrs, struct module *me)
418 return (sechdrs[me->arch.toc_section].sh_addr & ~0xfful) + 0x8000;
421 /* Patch stub to reference function and correct r2 value. */
422 static inline int create_stub(const Elf64_Shdr *sechdrs,
423 struct ppc64_stub_entry *entry,
432 if (is_mprofile_ftrace_call(name))
433 return create_ftrace_stub(entry, addr, me);
435 for (i = 0; i < ARRAY_SIZE(ppc64_stub_insns); i++) {
436 if (patch_instruction(&entry->jump[i],
437 ppc_inst(ppc64_stub_insns[i])))
441 /* Stub uses address relative to r2. */
442 reladdr = (unsigned long)entry - my_r2(sechdrs, me);
443 if (reladdr > 0x7FFFFFFF || reladdr < -(0x80000000L)) {
444 pr_err("%s: Address %p of stub out of range of %p.\n",
445 me->name, (void *)reladdr, (void *)my_r2);
448 pr_debug("Stub %p get data from reladdr %li\n", entry, reladdr);
450 if (patch_instruction(&entry->jump[0],
451 ppc_inst(entry->jump[0] | PPC_HA(reladdr))))
454 if (patch_instruction(&entry->jump[1],
455 ppc_inst(entry->jump[1] | PPC_LO(reladdr))))
458 // func_desc_t is 8 bytes if ABIv2, else 16 bytes
459 desc = func_desc(addr);
460 for (i = 0; i < sizeof(func_desc_t) / sizeof(u32); i++) {
461 if (patch_instruction(((u32 *)&entry->funcdata) + i,
462 ppc_inst(((u32 *)(&desc))[i])))
466 if (patch_instruction(&entry->magic, ppc_inst(STUB_MAGIC)))
472 /* Create stub to jump to function described in this OPD/ptr: we need the
473 stub to set up the TOC ptr (r2) for the function. */
474 static unsigned long stub_for_addr(const Elf64_Shdr *sechdrs,
479 struct ppc64_stub_entry *stubs;
480 unsigned int i, num_stubs;
482 num_stubs = sechdrs[me->arch.stubs_section].sh_size / sizeof(*stubs);
484 /* Find this stub, or if that fails, the next avail. entry */
485 stubs = (void *)sechdrs[me->arch.stubs_section].sh_addr;
486 for (i = 0; stub_func_addr(stubs[i].funcdata); i++) {
487 if (WARN_ON(i >= num_stubs))
490 if (stub_func_addr(stubs[i].funcdata) == func_addr(addr))
491 return (unsigned long)&stubs[i];
494 if (!create_stub(sechdrs, &stubs[i], addr, me, name))
497 return (unsigned long)&stubs[i];
500 /* We expect a noop next: if it is, replace it with instruction to
502 static int restore_r2(const char *name, u32 *instruction, struct module *me)
504 u32 *prev_insn = instruction - 1;
505 u32 insn_val = *instruction;
507 if (is_mprofile_ftrace_call(name))
511 * Make sure the branch isn't a sibling call. Sibling calls aren't
512 * "link" branches and they don't return, so they don't need the r2
513 * restore afterwards.
515 if (!instr_is_relative_link_branch(ppc_inst(*prev_insn)))
519 * For livepatch, the restore r2 instruction might have already been
520 * written previously, if the referenced symbol is in a previously
521 * unloaded module which is now being loaded again. In that case, skip
522 * the warning and the instruction write.
524 if (insn_val == PPC_INST_LD_TOC)
527 if (insn_val != PPC_RAW_NOP()) {
528 pr_err("%s: Expected nop after call, got %08x at %pS\n",
529 me->name, insn_val, instruction);
533 /* ld r2,R2_STACK_OFFSET(r1) */
534 return patch_instruction(instruction, ppc_inst(PPC_INST_LD_TOC));
537 int apply_relocate_add(Elf64_Shdr *sechdrs,
539 unsigned int symindex,
544 Elf64_Rela *rela = (void *)sechdrs[relsec].sh_addr;
546 unsigned long *location;
549 pr_debug("Applying ADD relocate section %u to %u\n", relsec,
550 sechdrs[relsec].sh_info);
552 /* First time we're called, we can fix up .TOC. */
553 if (!me->arch.toc_fixed) {
554 sym = find_dot_toc(sechdrs, strtab, symindex);
555 /* It's theoretically possible that a module doesn't want a
556 * .TOC. so don't fail it just for that. */
558 sym->st_value = my_r2(sechdrs, me);
559 me->arch.toc_fixed = true;
562 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rela); i++) {
563 /* This is where to make the change */
564 location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
566 /* This is the symbol it is referring to */
567 sym = (Elf64_Sym *)sechdrs[symindex].sh_addr
568 + ELF64_R_SYM(rela[i].r_info);
570 pr_debug("RELOC at %p: %li-type as %s (0x%lx) + %li\n",
571 location, (long)ELF64_R_TYPE(rela[i].r_info),
572 strtab + sym->st_name, (unsigned long)sym->st_value,
573 (long)rela[i].r_addend);
575 /* `Everything is relative'. */
576 value = sym->st_value + rela[i].r_addend;
578 switch (ELF64_R_TYPE(rela[i].r_info)) {
581 *(u32 *)location = value;
586 *(unsigned long *)location = value;
590 *(unsigned long *)location = my_r2(sechdrs, me);
594 /* Subtract TOC pointer */
595 value -= my_r2(sechdrs, me);
596 if (value + 0x8000 > 0xffff) {
597 pr_err("%s: bad TOC16 relocation (0x%lx)\n",
601 *((uint16_t *) location)
602 = (*((uint16_t *) location) & ~0xffff)
606 case R_PPC64_TOC16_LO:
607 /* Subtract TOC pointer */
608 value -= my_r2(sechdrs, me);
609 *((uint16_t *) location)
610 = (*((uint16_t *) location) & ~0xffff)
614 case R_PPC64_TOC16_DS:
615 /* Subtract TOC pointer */
616 value -= my_r2(sechdrs, me);
617 if ((value & 3) != 0 || value + 0x8000 > 0xffff) {
618 pr_err("%s: bad TOC16_DS relocation (0x%lx)\n",
622 *((uint16_t *) location)
623 = (*((uint16_t *) location) & ~0xfffc)
627 case R_PPC64_TOC16_LO_DS:
628 /* Subtract TOC pointer */
629 value -= my_r2(sechdrs, me);
630 if ((value & 3) != 0) {
631 pr_err("%s: bad TOC16_LO_DS relocation (0x%lx)\n",
635 *((uint16_t *) location)
636 = (*((uint16_t *) location) & ~0xfffc)
640 case R_PPC64_TOC16_HA:
641 /* Subtract TOC pointer */
642 value -= my_r2(sechdrs, me);
643 value = ((value + 0x8000) >> 16);
644 *((uint16_t *) location)
645 = (*((uint16_t *) location) & ~0xffff)
650 /* FIXME: Handle weak symbols here --RR */
651 if (sym->st_shndx == SHN_UNDEF ||
652 sym->st_shndx == SHN_LIVEPATCH) {
653 /* External: go via stub */
654 value = stub_for_addr(sechdrs, value, me,
655 strtab + sym->st_name);
658 if (restore_r2(strtab + sym->st_name,
659 (u32 *)location + 1, me))
662 value += local_entry_offset(sym);
664 /* Convert value to relative */
665 value -= (unsigned long)location;
666 if (value + 0x2000000 > 0x3ffffff || (value & 3) != 0){
667 pr_err("%s: REL24 %li out of range!\n",
668 me->name, (long int)value);
672 /* Only replace bits 2 through 26 */
673 value = (*(uint32_t *)location & ~PPC_LI_MASK) | PPC_LI(value);
675 if (patch_instruction((u32 *)location, ppc_inst(value)))
681 /* 64 bits relative (used by features fixups) */
682 *location = value - (unsigned long)location;
686 /* 32 bits relative (used by relative exception tables) */
687 /* Convert value to relative */
688 value -= (unsigned long)location;
689 if (value + 0x80000000 > 0xffffffff) {
690 pr_err("%s: REL32 %li out of range!\n",
691 me->name, (long int)value);
694 *(u32 *)location = value;
697 case R_PPC64_TOCSAVE:
699 * Marker reloc indicates we don't have to save r2.
700 * That would only save us one instruction, so ignore
707 * Optimize ELFv2 large code model entry point if
708 * the TOC is within 2GB range of current location.
710 value = my_r2(sechdrs, me) - (unsigned long)location;
711 if (value + 0x80008000 > 0xffffffff)
714 * Check for the large code model prolog sequence:
718 if ((((uint32_t *)location)[0] & ~0xfffc) != PPC_RAW_LD(_R2, _R12, 0))
720 if (((uint32_t *)location)[1] != PPC_RAW_ADD(_R2, _R2, _R12))
723 * If found, replace it with:
724 * addis r2, r12, (.TOC.-func)@ha
725 * addi r2, r2, (.TOC.-func)@l
727 ((uint32_t *)location)[0] = PPC_RAW_ADDIS(_R2, _R12, PPC_HA(value));
728 ((uint32_t *)location)[1] = PPC_RAW_ADDI(_R2, _R2, PPC_LO(value));
731 case R_PPC64_REL16_HA:
732 /* Subtract location pointer */
733 value -= (unsigned long)location;
734 value = ((value + 0x8000) >> 16);
735 *((uint16_t *) location)
736 = (*((uint16_t *) location) & ~0xffff)
740 case R_PPC64_REL16_LO:
741 /* Subtract location pointer */
742 value -= (unsigned long)location;
743 *((uint16_t *) location)
744 = (*((uint16_t *) location) & ~0xffff)
749 pr_err("%s: Unknown ADD relocation: %lu\n",
751 (unsigned long)ELF64_R_TYPE(rela[i].r_info));
759 #ifdef CONFIG_DYNAMIC_FTRACE
760 int module_trampoline_target(struct module *mod, unsigned long addr,
761 unsigned long *target)
763 struct ppc64_stub_entry *stub;
764 func_desc_t funcdata;
767 if (!within_module_core(addr, mod)) {
768 pr_err("%s: stub %lx not in module %s\n", __func__, addr, mod->name);
772 stub = (struct ppc64_stub_entry *)addr;
774 if (copy_from_kernel_nofault(&magic, &stub->magic,
776 pr_err("%s: fault reading magic for stub %lx for %s\n", __func__, addr, mod->name);
780 if (magic != STUB_MAGIC) {
781 pr_err("%s: bad magic for stub %lx for %s\n", __func__, addr, mod->name);
785 if (copy_from_kernel_nofault(&funcdata, &stub->funcdata,
787 pr_err("%s: fault reading funcdata for stub %lx for %s\n", __func__, addr, mod->name);
791 *target = stub_func_addr(funcdata);
796 int module_finalize_ftrace(struct module *mod, const Elf_Shdr *sechdrs)
798 mod->arch.tramp = stub_for_addr(sechdrs,
799 (unsigned long)ftrace_caller,
802 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
803 mod->arch.tramp_regs = stub_for_addr(sechdrs,
804 (unsigned long)ftrace_regs_caller,
806 "ftrace_regs_caller");
807 if (!mod->arch.tramp_regs)
811 if (!mod->arch.tramp)