1 /*- 2 * Copyright 1996-1998 John D. Polstra. 3 * Copyright (c) 2015 Ruslan Bukin <br@bsdpad.com> 4 * Copyright (c) 2016 Yukishige Shibata <y-shibat@mtd.biglobe.ne.jp> 5 * All rights reserved. 6 * 7 * Portions of this software were developed by SRI International and the 8 * University of Cambridge Computer Laboratory under DARPA/AFRL contract 9 * FA8750-10-C-0237 ("CTSRD"), as part of the DARPA CRASH research programme. 10 * 11 * Portions of this software were developed by the University of Cambridge 12 * Computer Laboratory as part of the CTSRD Project, with support from the 13 * UK Higher Education Innovation Fund (HEIF). 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions 17 * are met: 18 * 1. Redistributions of source code must retain the above copyright 19 * notice, this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright 21 * notice, this list of conditions and the following disclaimer in the 22 * documentation and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 */ 36 37 #include <sys/cdefs.h> 38 #include <sys/param.h> 39 #include <sys/kernel.h> 40 #include <sys/systm.h> 41 #include <sys/exec.h> 42 #include <sys/imgact.h> 43 #include <sys/linker.h> 44 #include <sys/proc.h> 45 #include <sys/reg.h> 46 #include <sys/sysctl.h> 47 #include <sys/sysent.h> 48 #include <sys/imgact_elf.h> 49 #include <sys/syscall.h> 50 #include <sys/signalvar.h> 51 #include <sys/vnode.h> 52 53 #include <vm/vm.h> 54 #include <vm/pmap.h> 55 #include <vm/vm_param.h> 56 57 #include <machine/elf.h> 58 #include <machine/md_var.h> 59 60 u_long elf_hwcap; 61 62 static struct sysentvec elf64_freebsd_sysvec = { 63 .sv_size = SYS_MAXSYSCALL, 64 .sv_table = sysent, 65 .sv_fixup = __elfN(freebsd_fixup), 66 .sv_sendsig = sendsig, 67 .sv_sigcode = sigcode, 68 .sv_szsigcode = &szsigcode, 69 .sv_name = "FreeBSD ELF64", 70 .sv_coredump = __elfN(coredump), 71 .sv_elf_core_osabi = ELFOSABI_FREEBSD, 72 .sv_elf_core_abi_vendor = FREEBSD_ABI_VENDOR, 73 .sv_elf_core_prepare_notes = __elfN(prepare_notes), 74 .sv_minsigstksz = MINSIGSTKSZ, 75 .sv_minuser = VM_MIN_ADDRESS, 76 .sv_maxuser = 0, /* Filled in during boot. */ 77 .sv_usrstack = 0, /* Filled in during boot. */ 78 .sv_psstrings = 0, /* Filled in during boot. */ 79 .sv_psstringssz = sizeof(struct ps_strings), 80 .sv_stackprot = VM_PROT_READ | VM_PROT_WRITE, 81 .sv_copyout_auxargs = __elfN(freebsd_copyout_auxargs), 82 .sv_copyout_strings = exec_copyout_strings, 83 .sv_setregs = exec_setregs, 84 .sv_fixlimit = NULL, 85 .sv_maxssiz = NULL, 86 .sv_flags = SV_ABI_FREEBSD | SV_LP64 | SV_SHP | SV_TIMEKEEP | 87 SV_ASLR | SV_RNG_SEED_VER, 88 .sv_set_syscall_retval = cpu_set_syscall_retval, 89 .sv_fetch_syscall_args = cpu_fetch_syscall_args, 90 .sv_syscallnames = syscallnames, 91 .sv_shared_page_base = 0, /* Filled in during boot. */ 92 .sv_shared_page_len = PAGE_SIZE, 93 .sv_schedtail = NULL, 94 .sv_thread_detach = NULL, 95 .sv_trap = NULL, 96 .sv_hwcap = &elf_hwcap, 97 .sv_onexec_old = exec_onexec_old, 98 .sv_onexit = exit_onexit, 99 .sv_regset_begin = SET_BEGIN(__elfN(regset)), 100 .sv_regset_end = SET_LIMIT(__elfN(regset)), 101 }; 102 INIT_SYSENTVEC(elf64_sysvec, &elf64_freebsd_sysvec); 103 104 static Elf64_Brandinfo freebsd_brand_info = { 105 .brand = ELFOSABI_FREEBSD, 106 .machine = EM_RISCV, 107 .compat_3_brand = "FreeBSD", 108 .interp_path = "/libexec/ld-elf.so.1", 109 .sysvec = &elf64_freebsd_sysvec, 110 .interp_newpath = NULL, 111 .brand_note = &elf64_freebsd_brandnote, 112 .flags = BI_CAN_EXEC_DYN | BI_BRAND_NOTE 113 }; 114 SYSINIT(elf64, SI_SUB_EXEC, SI_ORDER_FIRST, 115 (sysinit_cfunc_t)elf64_insert_brand_entry, &freebsd_brand_info); 116 117 static void 118 elf64_register_sysvec(void *arg) 119 { 120 struct sysentvec *sv; 121 122 sv = arg; 123 switch (pmap_mode) { 124 case PMAP_MODE_SV48: 125 sv->sv_maxuser = VM_MAX_USER_ADDRESS_SV48; 126 sv->sv_usrstack = USRSTACK_SV48; 127 sv->sv_psstrings = PS_STRINGS_SV48; 128 sv->sv_shared_page_base = SHAREDPAGE_SV48; 129 break; 130 case PMAP_MODE_SV39: 131 sv->sv_maxuser = VM_MAX_USER_ADDRESS_SV39; 132 sv->sv_usrstack = USRSTACK_SV39; 133 sv->sv_psstrings = PS_STRINGS_SV39; 134 sv->sv_shared_page_base = SHAREDPAGE_SV39; 135 break; 136 } 137 } 138 SYSINIT(elf64_register_sysvec, SI_SUB_VM, SI_ORDER_ANY, elf64_register_sysvec, 139 &elf64_freebsd_sysvec); 140 141 static bool debug_kld; 142 SYSCTL_BOOL(_debug, OID_AUTO, kld_reloc, CTLFLAG_RW, &debug_kld, 0, 143 "Activate debug prints in elf_reloc_internal()"); 144 145 struct type2str_ent { 146 int type; 147 const char *str; 148 }; 149 150 void 151 elf64_dump_thread(struct thread *td, void *dst, size_t *off) 152 { 153 154 } 155 156 /* 157 * Following 4 functions are used to manipulate bits on 32bit integer value. 158 * FIXME: I implemetend for ease-to-understand rather than for well-optimized. 159 */ 160 static uint32_t 161 gen_bitmask(int msb, int lsb) 162 { 163 uint32_t mask; 164 165 if (msb == sizeof(mask) * 8 - 1) 166 mask = ~0; 167 else 168 mask = (1U << (msb + 1)) - 1; 169 170 if (lsb > 0) 171 mask &= ~((1U << lsb) - 1); 172 173 return (mask); 174 } 175 176 static uint32_t 177 extract_bits(uint32_t x, int msb, int lsb) 178 { 179 uint32_t mask; 180 181 mask = gen_bitmask(msb, lsb); 182 183 x &= mask; 184 x >>= lsb; 185 186 return (x); 187 } 188 189 static uint32_t 190 insert_bits(uint32_t d, uint32_t s, int msb, int lsb) 191 { 192 uint32_t mask; 193 194 mask = gen_bitmask(msb, lsb); 195 196 d &= ~mask; 197 198 s <<= lsb; 199 s &= mask; 200 201 return (d | s); 202 } 203 204 static uint32_t 205 insert_imm(uint32_t insn, uint32_t imm, int imm_msb, int imm_lsb, 206 int insn_lsb) 207 { 208 int insn_msb; 209 uint32_t v; 210 211 v = extract_bits(imm, imm_msb, imm_lsb); 212 insn_msb = (imm_msb - imm_lsb) + insn_lsb; 213 214 return (insert_bits(insn, v, insn_msb, insn_lsb)); 215 } 216 217 /* 218 * The RISC-V ISA is designed so that all of immediate values are 219 * sign-extended. 220 * An immediate value is sometimes generated at runtime by adding 221 * 12bit sign integer and 20bit signed integer. This requests 20bit 222 * immediate value to be ajusted if the MSB of the 12bit immediate 223 * value is asserted (sign-extended value is treated as negative value). 224 * 225 * For example, 0x123800 can be calculated by adding upper 20 bit of 226 * 0x124000 and sign-extended 12bit immediate whose bit pattern is 227 * 0x800 as follows: 228 * 0x123800 229 * = 0x123000 + 0x800 230 * = (0x123000 + 0x1000) + (-0x1000 + 0x800) 231 * = (0x123000 + 0x1000) + (0xff...ff800) 232 * = 0x124000 + sign-extention(0x800) 233 */ 234 static uint32_t 235 calc_hi20_imm(uint32_t value) 236 { 237 /* 238 * There is the arithmetical hack that can remove conditional 239 * statement. But I implement it in straightforward way. 240 */ 241 if ((value & 0x800) != 0) 242 value += 0x1000; 243 return (value & ~0xfff); 244 } 245 246 static const struct type2str_ent t2s[] = { 247 { R_RISCV_NONE, "R_RISCV_NONE" }, 248 { R_RISCV_64, "R_RISCV_64" }, 249 { R_RISCV_JUMP_SLOT, "R_RISCV_JUMP_SLOT" }, 250 { R_RISCV_RELATIVE, "R_RISCV_RELATIVE" }, 251 { R_RISCV_JAL, "R_RISCV_JAL" }, 252 { R_RISCV_CALL, "R_RISCV_CALL" }, 253 { R_RISCV_PCREL_HI20, "R_RISCV_PCREL_HI20" }, 254 { R_RISCV_PCREL_LO12_I, "R_RISCV_PCREL_LO12_I" }, 255 { R_RISCV_PCREL_LO12_S, "R_RISCV_PCREL_LO12_S" }, 256 { R_RISCV_HI20, "R_RISCV_HI20" }, 257 { R_RISCV_LO12_I, "R_RISCV_LO12_I" }, 258 { R_RISCV_LO12_S, "R_RISCV_LO12_S" }, 259 }; 260 261 static const char * 262 reloctype_to_str(int type) 263 { 264 int i; 265 266 for (i = 0; i < sizeof(t2s) / sizeof(t2s[0]); ++i) { 267 if (type == t2s[i].type) 268 return t2s[i].str; 269 } 270 271 return "*unknown*"; 272 } 273 274 bool 275 elf_is_ifunc_reloc(Elf_Size r_info __unused) 276 { 277 278 return (false); 279 } 280 281 /* 282 * Currently kernel loadable module for RISCV is compiled with -fPIC option. 283 * (see also additional CFLAGS definition for RISCV in sys/conf/kmod.mk) 284 * Only R_RISCV_64, R_RISCV_JUMP_SLOT and RISCV_RELATIVE are emitted in 285 * the module. Other relocations will be processed when kernel loadable 286 * modules are built in non-PIC. 287 * 288 * FIXME: only RISCV64 is supported. 289 */ 290 static int 291 elf_reloc_internal(linker_file_t lf, Elf_Addr relocbase, const void *data, 292 int type, int local, elf_lookup_fn lookup) 293 { 294 Elf_Size rtype, symidx; 295 const Elf_Rela *rela; 296 Elf_Addr val, addr; 297 Elf64_Addr *where; 298 Elf_Addr addend; 299 uint32_t before32_1; 300 uint32_t before32; 301 uint64_t before64; 302 uint32_t *insn32p; 303 uint32_t imm20; 304 int error; 305 306 switch (type) { 307 case ELF_RELOC_RELA: 308 rela = (const Elf_Rela *)data; 309 where = (Elf_Addr *)(relocbase + rela->r_offset); 310 insn32p = (uint32_t *)where; 311 addend = rela->r_addend; 312 rtype = ELF_R_TYPE(rela->r_info); 313 symidx = ELF_R_SYM(rela->r_info); 314 break; 315 default: 316 printf("%s:%d unknown reloc type %d\n", 317 __FUNCTION__, __LINE__, type); 318 return (-1); 319 } 320 321 switch (rtype) { 322 case R_RISCV_NONE: 323 break; 324 325 case R_RISCV_64: 326 error = lookup(lf, symidx, 1, &addr); 327 if (error != 0) 328 return (-1); 329 330 before64 = *where; 331 *where = addr + addend; 332 if (debug_kld) 333 printf("%p %c %-24s %016lx -> %016lx\n", where, 334 (local ? 'l' : 'g'), reloctype_to_str(rtype), 335 before64, *where); 336 break; 337 338 case R_RISCV_JUMP_SLOT: 339 error = lookup(lf, symidx, 1, &addr); 340 if (error != 0) 341 return (-1); 342 343 before64 = *where; 344 *where = addr; 345 if (debug_kld) 346 printf("%p %c %-24s %016lx -> %016lx\n", where, 347 (local ? 'l' : 'g'), reloctype_to_str(rtype), 348 before64, *where); 349 break; 350 351 case R_RISCV_RELATIVE: 352 before64 = *where; 353 *where = elf_relocaddr(lf, relocbase + addend); 354 if (debug_kld) 355 printf("%p %c %-24s %016lx -> %016lx\n", where, 356 (local ? 'l' : 'g'), reloctype_to_str(rtype), 357 before64, *where); 358 break; 359 360 case R_RISCV_JAL: 361 error = lookup(lf, symidx, 1, &addr); 362 if (error != 0) 363 return (-1); 364 365 val = addr - (Elf_Addr)where; 366 if (val <= -(1UL << 20) || (1UL << 20) <= val) { 367 printf("kldload: huge offset against R_RISCV_JAL\n"); 368 return (-1); 369 } 370 371 before32 = *insn32p; 372 *insn32p = insert_imm(*insn32p, val, 20, 20, 31); 373 *insn32p = insert_imm(*insn32p, val, 10, 1, 21); 374 *insn32p = insert_imm(*insn32p, val, 11, 11, 20); 375 *insn32p = insert_imm(*insn32p, val, 19, 12, 12); 376 if (debug_kld) 377 printf("%p %c %-24s %08x -> %08x\n", where, 378 (local ? 'l' : 'g'), reloctype_to_str(rtype), 379 before32, *insn32p); 380 break; 381 382 case R_RISCV_CALL: 383 /* 384 * R_RISCV_CALL relocates 8-byte region that consists 385 * of the sequence of AUIPC and JALR. 386 */ 387 /* Calculate and check the pc relative offset. */ 388 error = lookup(lf, symidx, 1, &addr); 389 if (error != 0) 390 return (-1); 391 392 val = addr - (Elf_Addr)where; 393 if (val <= -(1UL << 32) || (1UL << 32) <= val) { 394 printf("kldload: huge offset against R_RISCV_CALL\n"); 395 return (-1); 396 } 397 398 /* Relocate AUIPC. */ 399 before32 = insn32p[0]; 400 imm20 = calc_hi20_imm(val); 401 insn32p[0] = insert_imm(insn32p[0], imm20, 31, 12, 12); 402 403 /* Relocate JALR. */ 404 before32_1 = insn32p[1]; 405 insn32p[1] = insert_imm(insn32p[1], val, 11, 0, 20); 406 if (debug_kld) 407 printf("%p %c %-24s %08x %08x -> %08x %08x\n", where, 408 (local ? 'l' : 'g'), reloctype_to_str(rtype), 409 before32, insn32p[0], before32_1, insn32p[1]); 410 break; 411 412 case R_RISCV_PCREL_HI20: 413 error = lookup(lf, symidx, 1, &addr); 414 if (error != 0) 415 return (-1); 416 417 val = addr - (Elf_Addr)where; 418 insn32p = (uint32_t *)where; 419 before32 = *insn32p; 420 imm20 = calc_hi20_imm(val); 421 *insn32p = insert_imm(*insn32p, imm20, 31, 12, 12); 422 if (debug_kld) 423 printf("%p %c %-24s %08x -> %08x\n", where, 424 (local ? 'l' : 'g'), reloctype_to_str(rtype), 425 before32, *insn32p); 426 break; 427 428 case R_RISCV_PCREL_LO12_I: 429 error = lookup(lf, symidx, 1, &addr); 430 if (error != 0) 431 return (-1); 432 433 val = addr - (Elf_Addr)where; 434 insn32p = (uint32_t *)where; 435 before32 = *insn32p; 436 *insn32p = insert_imm(*insn32p, addr, 11, 0, 20); 437 if (debug_kld) 438 printf("%p %c %-24s %08x -> %08x\n", where, 439 (local ? 'l' : 'g'), reloctype_to_str(rtype), 440 before32, *insn32p); 441 break; 442 443 case R_RISCV_PCREL_LO12_S: 444 error = lookup(lf, symidx, 1, &addr); 445 if (error != 0) 446 return (-1); 447 448 val = addr - (Elf_Addr)where; 449 insn32p = (uint32_t *)where; 450 before32 = *insn32p; 451 *insn32p = insert_imm(*insn32p, addr, 11, 5, 25); 452 *insn32p = insert_imm(*insn32p, addr, 4, 0, 7); 453 if (debug_kld) 454 printf("%p %c %-24s %08x -> %08x\n", where, 455 (local ? 'l' : 'g'), reloctype_to_str(rtype), 456 before32, *insn32p); 457 break; 458 459 case R_RISCV_HI20: 460 error = lookup(lf, symidx, 1, &addr); 461 if (error != 0) 462 return (-1); 463 464 val = addr; 465 insn32p = (uint32_t *)where; 466 before32 = *insn32p; 467 imm20 = calc_hi20_imm(val); 468 *insn32p = insert_imm(*insn32p, imm20, 31, 12, 12); 469 if (debug_kld) 470 printf("%p %c %-24s %08x -> %08x\n", where, 471 (local ? 'l' : 'g'), reloctype_to_str(rtype), 472 before32, *insn32p); 473 break; 474 475 case R_RISCV_LO12_I: 476 error = lookup(lf, symidx, 1, &addr); 477 if (error != 0) 478 return (-1); 479 480 val = addr; 481 insn32p = (uint32_t *)where; 482 before32 = *insn32p; 483 *insn32p = insert_imm(*insn32p, addr, 11, 0, 20); 484 if (debug_kld) 485 printf("%p %c %-24s %08x -> %08x\n", where, 486 (local ? 'l' : 'g'), reloctype_to_str(rtype), 487 before32, *insn32p); 488 break; 489 490 case R_RISCV_LO12_S: 491 error = lookup(lf, symidx, 1, &addr); 492 if (error != 0) 493 return (-1); 494 495 val = addr; 496 insn32p = (uint32_t *)where; 497 before32 = *insn32p; 498 *insn32p = insert_imm(*insn32p, addr, 11, 5, 25); 499 *insn32p = insert_imm(*insn32p, addr, 4, 0, 7); 500 if (debug_kld) 501 printf("%p %c %-24s %08x -> %08x\n", where, 502 (local ? 'l' : 'g'), reloctype_to_str(rtype), 503 before32, *insn32p); 504 break; 505 506 default: 507 printf("kldload: unexpected relocation type %ld, " 508 "symbol index %ld\n", rtype, symidx); 509 return (-1); 510 } 511 512 return (0); 513 } 514 515 int 516 elf_reloc(linker_file_t lf, Elf_Addr relocbase, const void *data, int type, 517 elf_lookup_fn lookup) 518 { 519 520 return (elf_reloc_internal(lf, relocbase, data, type, 0, lookup)); 521 } 522 523 int 524 elf_reloc_local(linker_file_t lf, Elf_Addr relocbase, const void *data, 525 int type, elf_lookup_fn lookup) 526 { 527 528 return (elf_reloc_internal(lf, relocbase, data, type, 1, lookup)); 529 } 530 531 int 532 elf_cpu_load_file(linker_file_t lf __unused) 533 { 534 535 return (0); 536 } 537 538 int 539 elf_cpu_unload_file(linker_file_t lf __unused) 540 { 541 542 return (0); 543 } 544 545 int 546 elf_cpu_parse_dynamic(caddr_t loadbase __unused, Elf_Dyn *dynamic __unused) 547 { 548 549 return (0); 550 } 551