1 /*-
2 * Copyright 1996-1998 John D. Polstra.
3 * Copyright (c) 2015 Ruslan Bukin <[email protected]>
4 * Copyright (c) 2016 Yukishige Shibata <[email protected]>
5 * All rights reserved.
6 *
7 * Portions of this software were developed by SRI International and the
8 * University of Cambridge Computer Laboratory under DARPA/AFRL contract
9 * FA8750-10-C-0237 ("CTSRD"), as part of the DARPA CRASH research programme.
10 *
11 * Portions of this software were developed by the University of Cambridge
12 * Computer Laboratory as part of the CTSRD Project, with support from the
13 * UK Higher Education Innovation Fund (HEIF).
14 *
15 * Redistribution and use in source and binary forms, with or without
16 * modification, are permitted provided that the following conditions
17 * are met:
18 * 1. Redistributions of source code must retain the above copyright
19 * notice, this list of conditions and the following disclaimer.
20 * 2. Redistributions in binary form must reproduce the above copyright
21 * notice, this list of conditions and the following disclaimer in the
22 * documentation and/or other materials provided with the distribution.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 */
36
37 #include <sys/cdefs.h>
38 #include <sys/param.h>
39 #include <sys/kernel.h>
40 #include <sys/systm.h>
41 #include <sys/exec.h>
42 #include <sys/imgact.h>
43 #include <sys/linker.h>
44 #include <sys/proc.h>
45 #include <sys/reg.h>
46 #include <sys/sysctl.h>
47 #include <sys/sysent.h>
48 #include <sys/imgact_elf.h>
49 #include <sys/syscall.h>
50 #include <sys/signalvar.h>
51 #include <sys/vnode.h>
52
53 #include <vm/vm.h>
54 #include <vm/pmap.h>
55 #include <vm/vm_param.h>
56
57 #include <machine/elf.h>
58 #include <machine/md_var.h>
59
60 u_long elf_hwcap;
61
62 static struct sysentvec elf64_freebsd_sysvec = {
63 .sv_size = SYS_MAXSYSCALL,
64 .sv_table = sysent,
65 .sv_fixup = __elfN(freebsd_fixup),
66 .sv_sendsig = sendsig,
67 .sv_sigcode = sigcode,
68 .sv_szsigcode = &szsigcode,
69 .sv_name = "FreeBSD ELF64",
70 .sv_coredump = __elfN(coredump),
71 .sv_elf_core_osabi = ELFOSABI_FREEBSD,
72 .sv_elf_core_abi_vendor = FREEBSD_ABI_VENDOR,
73 .sv_elf_core_prepare_notes = __elfN(prepare_notes),
74 .sv_minsigstksz = MINSIGSTKSZ,
75 .sv_minuser = VM_MIN_ADDRESS,
76 .sv_maxuser = 0, /* Filled in during boot. */
77 .sv_usrstack = 0, /* Filled in during boot. */
78 .sv_psstrings = 0, /* Filled in during boot. */
79 .sv_psstringssz = sizeof(struct ps_strings),
80 .sv_stackprot = VM_PROT_READ | VM_PROT_WRITE,
81 .sv_copyout_auxargs = __elfN(freebsd_copyout_auxargs),
82 .sv_copyout_strings = exec_copyout_strings,
83 .sv_setregs = exec_setregs,
84 .sv_fixlimit = NULL,
85 .sv_maxssiz = NULL,
86 .sv_flags = SV_ABI_FREEBSD | SV_LP64 | SV_SHP | SV_TIMEKEEP |
87 SV_ASLR | SV_RNG_SEED_VER | SV_SIGSYS,
88 .sv_set_syscall_retval = cpu_set_syscall_retval,
89 .sv_fetch_syscall_args = cpu_fetch_syscall_args,
90 .sv_syscallnames = syscallnames,
91 .sv_shared_page_base = 0, /* Filled in during boot. */
92 .sv_shared_page_len = PAGE_SIZE,
93 .sv_schedtail = NULL,
94 .sv_thread_detach = NULL,
95 .sv_trap = NULL,
96 .sv_hwcap = &elf_hwcap,
97 .sv_onexec_old = exec_onexec_old,
98 .sv_onexit = exit_onexit,
99 .sv_regset_begin = SET_BEGIN(__elfN(regset)),
100 .sv_regset_end = SET_LIMIT(__elfN(regset)),
101 };
102 INIT_SYSENTVEC(elf64_sysvec, &elf64_freebsd_sysvec);
103
104 static Elf64_Brandinfo freebsd_brand_info = {
105 .brand = ELFOSABI_FREEBSD,
106 .machine = EM_RISCV,
107 .compat_3_brand = "FreeBSD",
108 .interp_path = "/libexec/ld-elf.so.1",
109 .sysvec = &elf64_freebsd_sysvec,
110 .interp_newpath = NULL,
111 .brand_note = &elf64_freebsd_brandnote,
112 .flags = BI_CAN_EXEC_DYN | BI_BRAND_NOTE
113 };
114 SYSINIT(elf64, SI_SUB_EXEC, SI_ORDER_FIRST,
115 (sysinit_cfunc_t)elf64_insert_brand_entry, &freebsd_brand_info);
116
117 static void
elf64_register_sysvec(void * arg)118 elf64_register_sysvec(void *arg)
119 {
120 struct sysentvec *sv;
121
122 sv = arg;
123 switch (pmap_mode) {
124 case PMAP_MODE_SV48:
125 sv->sv_maxuser = VM_MAX_USER_ADDRESS_SV48;
126 sv->sv_usrstack = USRSTACK_SV48;
127 sv->sv_psstrings = PS_STRINGS_SV48;
128 sv->sv_shared_page_base = SHAREDPAGE_SV48;
129 break;
130 case PMAP_MODE_SV39:
131 sv->sv_maxuser = VM_MAX_USER_ADDRESS_SV39;
132 sv->sv_usrstack = USRSTACK_SV39;
133 sv->sv_psstrings = PS_STRINGS_SV39;
134 sv->sv_shared_page_base = SHAREDPAGE_SV39;
135 break;
136 }
137 }
138 SYSINIT(elf64_register_sysvec, SI_SUB_VM, SI_ORDER_ANY, elf64_register_sysvec,
139 &elf64_freebsd_sysvec);
140
141 static bool debug_kld;
142 SYSCTL_BOOL(_debug, OID_AUTO, kld_reloc, CTLFLAG_RW, &debug_kld, 0,
143 "Activate debug prints in elf_reloc_internal()");
144
145 struct type2str_ent {
146 int type;
147 const char *str;
148 };
149
150 void
elf64_dump_thread(struct thread * td,void * dst,size_t * off)151 elf64_dump_thread(struct thread *td, void *dst, size_t *off)
152 {
153
154 }
155
156 /*
157 * Following 4 functions are used to manipulate bits on 32bit integer value.
158 * FIXME: I implemetend for ease-to-understand rather than for well-optimized.
159 */
160 static uint32_t
gen_bitmask(int msb,int lsb)161 gen_bitmask(int msb, int lsb)
162 {
163 uint32_t mask;
164
165 if (msb == sizeof(mask) * 8 - 1)
166 mask = ~0;
167 else
168 mask = (1U << (msb + 1)) - 1;
169
170 if (lsb > 0)
171 mask &= ~((1U << lsb) - 1);
172
173 return (mask);
174 }
175
176 static uint32_t
extract_bits(uint32_t x,int msb,int lsb)177 extract_bits(uint32_t x, int msb, int lsb)
178 {
179 uint32_t mask;
180
181 mask = gen_bitmask(msb, lsb);
182
183 x &= mask;
184 x >>= lsb;
185
186 return (x);
187 }
188
189 static uint32_t
insert_bits(uint32_t d,uint32_t s,int msb,int lsb)190 insert_bits(uint32_t d, uint32_t s, int msb, int lsb)
191 {
192 uint32_t mask;
193
194 mask = gen_bitmask(msb, lsb);
195
196 d &= ~mask;
197
198 s <<= lsb;
199 s &= mask;
200
201 return (d | s);
202 }
203
204 static uint32_t
insert_imm(uint32_t insn,uint32_t imm,int imm_msb,int imm_lsb,int insn_lsb)205 insert_imm(uint32_t insn, uint32_t imm, int imm_msb, int imm_lsb,
206 int insn_lsb)
207 {
208 int insn_msb;
209 uint32_t v;
210
211 v = extract_bits(imm, imm_msb, imm_lsb);
212 insn_msb = (imm_msb - imm_lsb) + insn_lsb;
213
214 return (insert_bits(insn, v, insn_msb, insn_lsb));
215 }
216
217 /*
218 * The RISC-V ISA is designed so that all of immediate values are
219 * sign-extended.
220 * An immediate value is sometimes generated at runtime by adding
221 * 12bit sign integer and 20bit signed integer. This requests 20bit
222 * immediate value to be ajusted if the MSB of the 12bit immediate
223 * value is asserted (sign-extended value is treated as negative value).
224 *
225 * For example, 0x123800 can be calculated by adding upper 20 bit of
226 * 0x124000 and sign-extended 12bit immediate whose bit pattern is
227 * 0x800 as follows:
228 * 0x123800
229 * = 0x123000 + 0x800
230 * = (0x123000 + 0x1000) + (-0x1000 + 0x800)
231 * = (0x123000 + 0x1000) + (0xff...ff800)
232 * = 0x124000 + sign-extention(0x800)
233 */
234 static uint32_t
calc_hi20_imm(uint32_t value)235 calc_hi20_imm(uint32_t value)
236 {
237 /*
238 * There is the arithmetical hack that can remove conditional
239 * statement. But I implement it in straightforward way.
240 */
241 if ((value & 0x800) != 0)
242 value += 0x1000;
243 return (value & ~0xfff);
244 }
245
246 static const struct type2str_ent t2s[] = {
247 { R_RISCV_NONE, "R_RISCV_NONE" },
248 { R_RISCV_64, "R_RISCV_64" },
249 { R_RISCV_JUMP_SLOT, "R_RISCV_JUMP_SLOT" },
250 { R_RISCV_RELATIVE, "R_RISCV_RELATIVE" },
251 { R_RISCV_JAL, "R_RISCV_JAL" },
252 { R_RISCV_CALL, "R_RISCV_CALL" },
253 { R_RISCV_PCREL_HI20, "R_RISCV_PCREL_HI20" },
254 { R_RISCV_PCREL_LO12_I, "R_RISCV_PCREL_LO12_I" },
255 { R_RISCV_PCREL_LO12_S, "R_RISCV_PCREL_LO12_S" },
256 { R_RISCV_HI20, "R_RISCV_HI20" },
257 { R_RISCV_LO12_I, "R_RISCV_LO12_I" },
258 { R_RISCV_LO12_S, "R_RISCV_LO12_S" },
259 };
260
261 static const char *
reloctype_to_str(int type)262 reloctype_to_str(int type)
263 {
264 int i;
265
266 for (i = 0; i < sizeof(t2s) / sizeof(t2s[0]); ++i) {
267 if (type == t2s[i].type)
268 return t2s[i].str;
269 }
270
271 return "*unknown*";
272 }
273
274 bool
elf_is_ifunc_reloc(Elf_Size r_info __unused)275 elf_is_ifunc_reloc(Elf_Size r_info __unused)
276 {
277
278 return (false);
279 }
280
281 /*
282 * Currently kernel loadable module for RISCV is compiled with -fPIC option.
283 * (see also additional CFLAGS definition for RISCV in sys/conf/kmod.mk)
284 * Only R_RISCV_64, R_RISCV_JUMP_SLOT and RISCV_RELATIVE are emitted in
285 * the module. Other relocations will be processed when kernel loadable
286 * modules are built in non-PIC.
287 *
288 * FIXME: only RISCV64 is supported.
289 */
290 static int
elf_reloc_internal(linker_file_t lf,Elf_Addr relocbase,const void * data,int type,int local,elf_lookup_fn lookup)291 elf_reloc_internal(linker_file_t lf, Elf_Addr relocbase, const void *data,
292 int type, int local, elf_lookup_fn lookup)
293 {
294 Elf_Size rtype, symidx;
295 const Elf_Rela *rela;
296 Elf_Addr val, addr;
297 Elf64_Addr *where;
298 Elf_Addr addend;
299 uint32_t before32_1;
300 uint32_t before32;
301 uint64_t before64;
302 uint32_t *insn32p;
303 uint32_t imm20;
304 int error;
305
306 switch (type) {
307 case ELF_RELOC_RELA:
308 rela = (const Elf_Rela *)data;
309 where = (Elf_Addr *)(relocbase + rela->r_offset);
310 insn32p = (uint32_t *)where;
311 addend = rela->r_addend;
312 rtype = ELF_R_TYPE(rela->r_info);
313 symidx = ELF_R_SYM(rela->r_info);
314 break;
315 default:
316 printf("%s:%d unknown reloc type %d\n",
317 __FUNCTION__, __LINE__, type);
318 return (-1);
319 }
320
321 switch (rtype) {
322 case R_RISCV_NONE:
323 break;
324
325 case R_RISCV_64:
326 error = lookup(lf, symidx, 1, &addr);
327 if (error != 0)
328 return (-1);
329
330 before64 = *where;
331 *where = addr + addend;
332 if (debug_kld)
333 printf("%p %c %-24s %016lx -> %016lx\n", where,
334 (local ? 'l' : 'g'), reloctype_to_str(rtype),
335 before64, *where);
336 break;
337
338 case R_RISCV_JUMP_SLOT:
339 error = lookup(lf, symidx, 1, &addr);
340 if (error != 0)
341 return (-1);
342
343 before64 = *where;
344 *where = addr;
345 if (debug_kld)
346 printf("%p %c %-24s %016lx -> %016lx\n", where,
347 (local ? 'l' : 'g'), reloctype_to_str(rtype),
348 before64, *where);
349 break;
350
351 case R_RISCV_RELATIVE:
352 before64 = *where;
353 *where = elf_relocaddr(lf, relocbase + addend);
354 if (debug_kld)
355 printf("%p %c %-24s %016lx -> %016lx\n", where,
356 (local ? 'l' : 'g'), reloctype_to_str(rtype),
357 before64, *where);
358 break;
359
360 case R_RISCV_JAL:
361 error = lookup(lf, symidx, 1, &addr);
362 if (error != 0)
363 return (-1);
364
365 val = addr - (Elf_Addr)where;
366 if (val <= -(1UL << 20) || (1UL << 20) <= val) {
367 printf("kldload: huge offset against R_RISCV_JAL\n");
368 return (-1);
369 }
370
371 before32 = *insn32p;
372 *insn32p = insert_imm(*insn32p, val, 20, 20, 31);
373 *insn32p = insert_imm(*insn32p, val, 10, 1, 21);
374 *insn32p = insert_imm(*insn32p, val, 11, 11, 20);
375 *insn32p = insert_imm(*insn32p, val, 19, 12, 12);
376 if (debug_kld)
377 printf("%p %c %-24s %08x -> %08x\n", where,
378 (local ? 'l' : 'g'), reloctype_to_str(rtype),
379 before32, *insn32p);
380 break;
381
382 case R_RISCV_CALL:
383 /*
384 * R_RISCV_CALL relocates 8-byte region that consists
385 * of the sequence of AUIPC and JALR.
386 */
387 /* Calculate and check the pc relative offset. */
388 error = lookup(lf, symidx, 1, &addr);
389 if (error != 0)
390 return (-1);
391
392 val = addr - (Elf_Addr)where;
393 if (val <= -(1UL << 32) || (1UL << 32) <= val) {
394 printf("kldload: huge offset against R_RISCV_CALL\n");
395 return (-1);
396 }
397
398 /* Relocate AUIPC. */
399 before32 = insn32p[0];
400 imm20 = calc_hi20_imm(val);
401 insn32p[0] = insert_imm(insn32p[0], imm20, 31, 12, 12);
402
403 /* Relocate JALR. */
404 before32_1 = insn32p[1];
405 insn32p[1] = insert_imm(insn32p[1], val, 11, 0, 20);
406 if (debug_kld)
407 printf("%p %c %-24s %08x %08x -> %08x %08x\n", where,
408 (local ? 'l' : 'g'), reloctype_to_str(rtype),
409 before32, insn32p[0], before32_1, insn32p[1]);
410 break;
411
412 case R_RISCV_PCREL_HI20:
413 error = lookup(lf, symidx, 1, &addr);
414 if (error != 0)
415 return (-1);
416
417 val = addr - (Elf_Addr)where;
418 insn32p = (uint32_t *)where;
419 before32 = *insn32p;
420 imm20 = calc_hi20_imm(val);
421 *insn32p = insert_imm(*insn32p, imm20, 31, 12, 12);
422 if (debug_kld)
423 printf("%p %c %-24s %08x -> %08x\n", where,
424 (local ? 'l' : 'g'), reloctype_to_str(rtype),
425 before32, *insn32p);
426 break;
427
428 case R_RISCV_PCREL_LO12_I:
429 error = lookup(lf, symidx, 1, &addr);
430 if (error != 0)
431 return (-1);
432
433 val = addr - (Elf_Addr)where;
434 insn32p = (uint32_t *)where;
435 before32 = *insn32p;
436 *insn32p = insert_imm(*insn32p, addr, 11, 0, 20);
437 if (debug_kld)
438 printf("%p %c %-24s %08x -> %08x\n", where,
439 (local ? 'l' : 'g'), reloctype_to_str(rtype),
440 before32, *insn32p);
441 break;
442
443 case R_RISCV_PCREL_LO12_S:
444 error = lookup(lf, symidx, 1, &addr);
445 if (error != 0)
446 return (-1);
447
448 val = addr - (Elf_Addr)where;
449 insn32p = (uint32_t *)where;
450 before32 = *insn32p;
451 *insn32p = insert_imm(*insn32p, addr, 11, 5, 25);
452 *insn32p = insert_imm(*insn32p, addr, 4, 0, 7);
453 if (debug_kld)
454 printf("%p %c %-24s %08x -> %08x\n", where,
455 (local ? 'l' : 'g'), reloctype_to_str(rtype),
456 before32, *insn32p);
457 break;
458
459 case R_RISCV_HI20:
460 error = lookup(lf, symidx, 1, &addr);
461 if (error != 0)
462 return (-1);
463
464 val = addr;
465 insn32p = (uint32_t *)where;
466 before32 = *insn32p;
467 imm20 = calc_hi20_imm(val);
468 *insn32p = insert_imm(*insn32p, imm20, 31, 12, 12);
469 if (debug_kld)
470 printf("%p %c %-24s %08x -> %08x\n", where,
471 (local ? 'l' : 'g'), reloctype_to_str(rtype),
472 before32, *insn32p);
473 break;
474
475 case R_RISCV_LO12_I:
476 error = lookup(lf, symidx, 1, &addr);
477 if (error != 0)
478 return (-1);
479
480 val = addr;
481 insn32p = (uint32_t *)where;
482 before32 = *insn32p;
483 *insn32p = insert_imm(*insn32p, addr, 11, 0, 20);
484 if (debug_kld)
485 printf("%p %c %-24s %08x -> %08x\n", where,
486 (local ? 'l' : 'g'), reloctype_to_str(rtype),
487 before32, *insn32p);
488 break;
489
490 case R_RISCV_LO12_S:
491 error = lookup(lf, symidx, 1, &addr);
492 if (error != 0)
493 return (-1);
494
495 val = addr;
496 insn32p = (uint32_t *)where;
497 before32 = *insn32p;
498 *insn32p = insert_imm(*insn32p, addr, 11, 5, 25);
499 *insn32p = insert_imm(*insn32p, addr, 4, 0, 7);
500 if (debug_kld)
501 printf("%p %c %-24s %08x -> %08x\n", where,
502 (local ? 'l' : 'g'), reloctype_to_str(rtype),
503 before32, *insn32p);
504 break;
505
506 default:
507 printf("kldload: unexpected relocation type %ld, "
508 "symbol index %ld\n", rtype, symidx);
509 return (-1);
510 }
511
512 return (0);
513 }
514
515 int
elf_reloc(linker_file_t lf,Elf_Addr relocbase,const void * data,int type,elf_lookup_fn lookup)516 elf_reloc(linker_file_t lf, Elf_Addr relocbase, const void *data, int type,
517 elf_lookup_fn lookup)
518 {
519
520 return (elf_reloc_internal(lf, relocbase, data, type, 0, lookup));
521 }
522
523 int
elf_reloc_local(linker_file_t lf,Elf_Addr relocbase,const void * data,int type,elf_lookup_fn lookup)524 elf_reloc_local(linker_file_t lf, Elf_Addr relocbase, const void *data,
525 int type, elf_lookup_fn lookup)
526 {
527
528 return (elf_reloc_internal(lf, relocbase, data, type, 1, lookup));
529 }
530
531 int
elf_cpu_load_file(linker_file_t lf __unused)532 elf_cpu_load_file(linker_file_t lf __unused)
533 {
534
535 return (0);
536 }
537
538 int
elf_cpu_unload_file(linker_file_t lf __unused)539 elf_cpu_unload_file(linker_file_t lf __unused)
540 {
541
542 return (0);
543 }
544
545 int
elf_cpu_parse_dynamic(caddr_t loadbase __unused,Elf_Dyn * dynamic __unused)546 elf_cpu_parse_dynamic(caddr_t loadbase __unused, Elf_Dyn *dynamic __unused)
547 {
548
549 return (0);
550 }
551