1 /** @file
2 * @brief Architecture-specific relocations for RISC-V instruction sets.
3 */
4 /*
5 * Copyright (c) 2024 CISPA Helmholtz Center for Information Security gGmbH
6 *
7 * SPDX-License-Identifier: Apache-2.0
8 */
9 #include <zephyr/llext/elf.h>
10 #include <zephyr/llext/llext.h>
11 #include <zephyr/logging/log.h>
12 #include <zephyr/sys/util.h>
13
14 #include <zephyr/arch/riscv/elf.h>
15
16 #include <stdlib.h>
17
18 LOG_MODULE_REGISTER(elf, CONFIG_LLEXT_LOG_LEVEL);
19
20 /*
21 * RISC-V relocations commonly use pairs of U-type and I-type instructions.
22 * U-type instructions have 20-bit immediates, I-type instructions have 12-bit immediates.
23 * Immediates in RISC-V are always sign-extended.
24 * Thereby, this type of relocation can reach any address within a 2^31-1 byte range.
25 */
26 #define RISCV_MAX_JUMP_DISTANCE_U_PLUS_I_TYPE INT32_MAX
27
28 /* S-type has 12-bit signed immediate */
29 #define RISCV_MAX_JUMP_DISTANCE_S_TYPE ((1 << 11) - 1)
30
31 /* I-type has 12-bit signed immediate also */
32 #define RISCV_MAX_JUMP_DISTANCE_I_TYPE ((1 << 11) - 1)
33
34 /* B-type has 13-bit signed immediate */
35 #define RISCV_MAX_JUMP_DISTANCE_B_TYPE ((1 << 12) - 1)
36
37 /* CB-type has 9-bit signed immediate */
38 #define RISCV_MAX_JUMP_DISTANCE_CB_TYPE ((1 << 8) - 1)
39
40 /* CJ-type has 12-bit signed immediate (last bit implicit 0) */
41 #define RISCV_MAX_JUMP_DISTANCE_CJ_TYPE ((1 << 11) - 1)
42
riscv_relocation_fits(long long jump_target,long long max_distance,elf_word reloc_type)43 static inline int riscv_relocation_fits(long long jump_target, long long max_distance,
44 elf_word reloc_type)
45 {
46 if (llabs(jump_target) > max_distance) {
47 LOG_ERR("%lld byte relocation is not possible for type %" PRIu64 " (max %lld)!",
48 jump_target, (uint64_t)reloc_type, max_distance);
49 return -ENOEXEC; /* jump too far */
50 }
51
52 return 0;
53 }
54
55 static long long last_u_type_jump_target;
56
57 /**
58 * @brief RISC-V specific function for relocating partially linked ELF binaries
59 *
60 * This implementation follows the official RISC-V specification:
61 * https://github.com/riscv-non-isa/riscv-elf-psabi-doc/blob/master/riscv-elf.adoc
62 *
63 */
arch_elf_relocate(elf_rela_t * rel,uintptr_t loc_unsigned,uintptr_t sym_base_addr_unsigned,const char * sym_name,uintptr_t load_bias)64 int arch_elf_relocate(elf_rela_t *rel, uintptr_t loc_unsigned, uintptr_t sym_base_addr_unsigned,
65 const char *sym_name, uintptr_t load_bias)
66 {
67 /* FIXME currently, RISC-V relocations all fit in ELF_32_R_TYPE */
68 elf_word reloc_type = ELF32_R_TYPE(rel->r_info);
69 /*
70 * The RISC-V specification uses the following symbolic names for the relocations:
71 *
72 * A - addend (rel->r_addend)
73 * B - base address (load_bias)
74 * G - global offset table (not supported yet)
75 * P - position of the relocation (loc)
76 * S - symbol value (sym_base_addr)
77 * V - value at the relocation position (*loc)
78 * GP - value of __global_pointer$ (not supported yet)
79 * TLSMODULE - TLS module for the object (not supported yet)
80 * TLSOFFSET - TLS static block for the object (not supported yet)
81 */
82 intptr_t loc = (intptr_t)loc_unsigned;
83 uint8_t *loc8 = (uint8_t *)loc, tmp8;
84 uint16_t *loc16 = (uint16_t *)loc, tmp16;
85 uint32_t *loc32 = (uint32_t *)loc, tmp32;
86 uint64_t *loc64 = (uint64_t *)loc, tmp64;
87 /* uint32_t or uint64_t */
88 r_riscv_wordclass_t *loc_word = (r_riscv_wordclass_t *)loc;
89 uint32_t modified_operand;
90 uint16_t modified_compressed_operand;
91 int32_t imm8;
92 long long original_imm8, jump_target;
93 int16_t compressed_imm8;
94 __typeof__(rel->r_addend) target_alignment = 1;
95 const intptr_t sym_base_addr = (intptr_t)sym_base_addr_unsigned;
96
97 LOG_DBG("Relocating symbol %s at %p with base address %p load address %p type %" PRIu64,
98 sym_name, (void *)loc, (void *)sym_base_addr, (void *)load_bias,
99 (uint64_t)reloc_type);
100
101 /* FIXME not all types of relocations currently supported, especially TLS */
102
103 switch (reloc_type) {
104 case R_RISCV_NONE:
105 break;
106 case R_RISCV_32:
107 jump_target = sym_base_addr + rel->r_addend; /* S + A */
108 UNALIGNED_PUT((uint32_t)jump_target, loc32);
109 return riscv_relocation_fits(jump_target, INT32_MAX, reloc_type);
110 case R_RISCV_64:
111 /* full 64-bit range, need no range check */
112 UNALIGNED_PUT(sym_base_addr + rel->r_addend, loc64); /* S + A */
113 break;
114 case R_RISCV_RELATIVE:
115 /* either full 32-bit or 64-bit range, need no range check */
116 UNALIGNED_PUT(load_bias + rel->r_addend, loc_word); /* B + A */
117 break;
118 case R_RISCV_JUMP_SLOT:
119 /* either full 32-bit or 64-bit range, need no range check */
120 UNALIGNED_PUT(sym_base_addr, loc_word); /* S */
121 break;
122 case R_RISCV_BRANCH:
123 jump_target = sym_base_addr + rel->r_addend - loc; /* S + A - P */
124 modified_operand = UNALIGNED_GET(loc32);
125 imm8 = jump_target;
126 modified_operand = R_RISCV_CLEAR_BTYPE_IMM8(modified_operand);
127 modified_operand = R_RISCV_SET_BTYPE_IMM8(modified_operand, imm8);
128 UNALIGNED_PUT(modified_operand, loc32);
129 return riscv_relocation_fits(jump_target, RISCV_MAX_JUMP_DISTANCE_B_TYPE,
130 reloc_type);
131 case R_RISCV_JAL:
132 jump_target = sym_base_addr + rel->r_addend - loc; /* S + A - P */
133 modified_operand = UNALIGNED_GET(loc32);
134 imm8 = jump_target;
135 modified_operand = R_RISCV_CLEAR_JTYPE_IMM8(modified_operand);
136 modified_operand = R_RISCV_SET_JTYPE_IMM8(modified_operand, imm8);
137 UNALIGNED_PUT(modified_operand, loc32);
138 return riscv_relocation_fits(jump_target, RISCV_MAX_JUMP_DISTANCE_U_PLUS_I_TYPE,
139 reloc_type);
140 case R_RISCV_CALL:
141 case R_RISCV_CALL_PLT:
142 case R_RISCV_PCREL_HI20:
143 modified_operand = UNALIGNED_GET(loc32);
144 jump_target = sym_base_addr + rel->r_addend - loc; /* S + A - P */
145 imm8 = jump_target;
146 /* bit 12 of the immediate goes to I-type instruction and might
147 * change the sign of the number
148 */
149 /* in order to avoid that, we add 1 to the upper immediate if bit 12 is one */
150 /* see RISC-V la pseudo instruction */
151 imm8 += imm8 & 0x800;
152
153 original_imm8 = imm8;
154
155 modified_operand = R_RISCV_CLEAR_UTYPE_IMM8(modified_operand);
156 modified_operand = R_RISCV_SET_UTYPE_IMM8(modified_operand, imm8);
157 UNALIGNED_PUT(modified_operand, loc32);
158
159 if (reloc_type != R_RISCV_PCREL_HI20) {
160 /* PCREL_HI20 is only U-type, not truly U+I-type */
161 /* for the others, need to also modify following I-type */
162 loc32++;
163
164 imm8 = jump_target;
165
166 modified_operand = UNALIGNED_GET(loc32);
167 modified_operand = R_RISCV_CLEAR_ITYPE_IMM8(modified_operand);
168 modified_operand = R_RISCV_SET_ITYPE_IMM8(modified_operand, imm8);
169 UNALIGNED_PUT(modified_operand, loc32);
170 }
171
172 last_u_type_jump_target = jump_target;
173
174 return riscv_relocation_fits(jump_target, RISCV_MAX_JUMP_DISTANCE_U_PLUS_I_TYPE,
175 reloc_type);
176 case R_RISCV_PCREL_LO12_I:
177 /* need the same jump target as preceding U-type relocation */
178 if (last_u_type_jump_target == 0) {
179 LOG_ERR("R_RISCV_PCREL_LO12_I relocation without preceding U-type "
180 "relocation!");
181 return -ENOEXEC;
182 }
183 modified_operand = UNALIGNED_GET(loc32);
184 jump_target = last_u_type_jump_target; /* S - P */
185 last_u_type_jump_target = 0;
186 imm8 = jump_target;
187 modified_operand = R_RISCV_CLEAR_ITYPE_IMM8(modified_operand);
188 modified_operand = R_RISCV_SET_ITYPE_IMM8(modified_operand, imm8);
189 UNALIGNED_PUT(modified_operand, loc32);
190 return riscv_relocation_fits(jump_target, RISCV_MAX_JUMP_DISTANCE_U_PLUS_I_TYPE,
191 reloc_type);
192 break;
193 case R_RISCV_PCREL_LO12_S:
194 /* need the same jump target as preceding U-type relocation */
195 if (last_u_type_jump_target == 0) {
196 LOG_ERR("R_RISCV_PCREL_LO12_I relocation without preceding U-type "
197 "relocation!");
198 return -ENOEXEC;
199 }
200 modified_operand = UNALIGNED_GET(loc32);
201 jump_target = last_u_type_jump_target; /* S - P */
202 last_u_type_jump_target = 0;
203 imm8 = jump_target;
204 modified_operand = R_RISCV_CLEAR_STYPE_IMM8(modified_operand);
205 modified_operand = R_RISCV_SET_STYPE_IMM8(modified_operand, imm8);
206 UNALIGNED_PUT(modified_operand, loc32);
207 return riscv_relocation_fits(jump_target, RISCV_MAX_JUMP_DISTANCE_U_PLUS_I_TYPE,
208 reloc_type);
209 case R_RISCV_HI20:
210 jump_target = sym_base_addr + rel->r_addend; /* S + A */
211 modified_operand = UNALIGNED_GET(loc32);
212 imm8 = jump_target;
213 /* bit 12 of the immediate goes to I-type instruction and might
214 * change the sign of the number
215 */
216 /* in order to avoid that, we add 1 to the upper immediate if bit 12 is one*/
217 /* see RISC-V la pseudo instruction */
218 original_imm8 = imm8;
219 imm8 += imm8 & 0x800;
220 modified_operand = R_RISCV_CLEAR_UTYPE_IMM8(modified_operand);
221 modified_operand = R_RISCV_SET_UTYPE_IMM8(modified_operand, imm8);
222 UNALIGNED_PUT(modified_operand, loc32);
223 return riscv_relocation_fits(jump_target, RISCV_MAX_JUMP_DISTANCE_U_PLUS_I_TYPE,
224 reloc_type);
225 case R_RISCV_LO12_I:
226 modified_operand = UNALIGNED_GET(loc32);
227 jump_target = sym_base_addr + rel->r_addend; /* S + A */
228 imm8 = jump_target;
229 /* this is always used with R_RISCV_HI20 */
230 modified_operand = R_RISCV_CLEAR_ITYPE_IMM8(modified_operand);
231 modified_operand = R_RISCV_SET_ITYPE_IMM8(modified_operand, imm8);
232 UNALIGNED_PUT(modified_operand, loc32);
233 return riscv_relocation_fits(jump_target, RISCV_MAX_JUMP_DISTANCE_U_PLUS_I_TYPE,
234 reloc_type);
235 case R_RISCV_LO12_S:
236 modified_operand = UNALIGNED_GET(loc32);
237 imm8 = sym_base_addr + rel->r_addend; /* S + A */
238 /*
239 * S-type is used for stores/loads etc.
240 * size check is done at compile time, as it depends on the size of
241 * the structure we are trying to load/store
242 */
243 modified_operand = R_RISCV_CLEAR_STYPE_IMM8(modified_operand);
244 modified_operand = R_RISCV_SET_STYPE_IMM8(modified_operand, imm8);
245 UNALIGNED_PUT(modified_operand, loc32);
246 break;
247 /* for add/sub/set, compiler needs to ensure that the ELF sections are close enough */
248 case R_RISCV_ADD8:
249 tmp8 = UNALIGNED_GET(loc8);
250 tmp8 += sym_base_addr + rel->r_addend; /* V + S + A */
251 UNALIGNED_PUT(tmp8, loc8);
252 break;
253 case R_RISCV_ADD16:
254 tmp16 = UNALIGNED_GET(loc16);
255 tmp16 += sym_base_addr + rel->r_addend; /* V + S + A */
256 UNALIGNED_PUT(tmp16, loc16);
257 break;
258 case R_RISCV_ADD32:
259 tmp32 = UNALIGNED_GET(loc32);
260 tmp32 += sym_base_addr + rel->r_addend; /* V + S + A */
261 UNALIGNED_PUT(tmp32, loc32);
262 break;
263 case R_RISCV_ADD64:
264 tmp64 = UNALIGNED_GET(loc64);
265 tmp64 += sym_base_addr + rel->r_addend; /* V + S + A */
266 UNALIGNED_PUT(tmp64, loc64);
267 break;
268 case R_RISCV_SUB8:
269 tmp8 = UNALIGNED_GET(loc8);
270 tmp8 -= sym_base_addr + rel->r_addend; /* V - S - A */
271 UNALIGNED_PUT(tmp8, loc8);
272 break;
273 case R_RISCV_SUB16:
274 tmp16 = UNALIGNED_GET(loc16);
275 tmp16 -= sym_base_addr + rel->r_addend; /* V - S - A */
276 UNALIGNED_PUT(tmp16, loc16);
277 break;
278 case R_RISCV_SUB32:
279 tmp32 = UNALIGNED_GET(loc32);
280 tmp32 -= sym_base_addr + rel->r_addend; /* V - S - A */
281 UNALIGNED_PUT(tmp32, loc32);
282 break;
283 case R_RISCV_SUB64:
284 tmp64 = UNALIGNED_GET(loc64);
285 tmp64 -= sym_base_addr + rel->r_addend; /* V - S - A */
286 UNALIGNED_PUT(tmp64, loc64);
287 break;
288 case R_RISCV_SUB6:
289 tmp8 = UNALIGNED_GET(loc8) & (0x1F);
290 UNALIGNED_PUT(tmp8, loc8);
291 tmp8 = tmp8 - sym_base_addr - rel->r_addend; /* V - S - A */
292 tmp8 = tmp8 & (0x1F);
293 tmp8 = tmp8 | UNALIGNED_GET(loc8);
294 UNALIGNED_PUT(tmp8, loc8);
295 break;
296 case R_RISCV_SET6:
297 tmp8 = UNALIGNED_GET(loc8) & (0x1F);
298 UNALIGNED_PUT(tmp8, loc8);
299 tmp8 = sym_base_addr + rel->r_addend; /* S + A */
300 tmp8 = tmp8 | UNALIGNED_GET(loc8);
301 UNALIGNED_PUT(tmp8, loc8);
302 break;
303 case R_RISCV_SET8:
304 tmp8 = sym_base_addr + rel->r_addend; /* S + A */
305 UNALIGNED_PUT(tmp8, loc8);
306 break;
307 case R_RISCV_SET16:
308 tmp16 = sym_base_addr + rel->r_addend; /* S + A */
309 UNALIGNED_PUT(tmp16, loc16);
310 break;
311 case R_RISCV_SET32:
312 tmp32 = sym_base_addr + rel->r_addend; /* S + A */
313 UNALIGNED_PUT(tmp32, loc32);
314 break;
315 case R_RISCV_32_PCREL:
316 jump_target = sym_base_addr + rel->r_addend - loc; /* S + A - P */
317 tmp32 = jump_target;
318 UNALIGNED_PUT(tmp32, loc32);
319 return riscv_relocation_fits(jump_target, RISCV_MAX_JUMP_DISTANCE_U_PLUS_I_TYPE,
320 reloc_type);
321 case R_RISCV_PLT32:
322 jump_target = sym_base_addr + rel->r_addend - loc; /* S + A - P */
323 tmp32 = jump_target;
324 UNALIGNED_PUT(tmp32, loc32);
325 return riscv_relocation_fits(jump_target, RISCV_MAX_JUMP_DISTANCE_U_PLUS_I_TYPE,
326 reloc_type);
327 case R_RISCV_RVC_BRANCH:
328 jump_target = sym_base_addr + rel->r_addend - loc; /* S + A - P */
329 modified_compressed_operand = UNALIGNED_GET(loc16);
330 compressed_imm8 = jump_target;
331 modified_compressed_operand =
332 R_RISCV_CLEAR_CBTYPE_IMM8(modified_compressed_operand);
333 modified_compressed_operand =
334 R_RISCV_SET_CBTYPE_IMM8(modified_compressed_operand, compressed_imm8);
335 UNALIGNED_PUT(modified_compressed_operand, loc16);
336 return riscv_relocation_fits(jump_target, RISCV_MAX_JUMP_DISTANCE_CB_TYPE,
337 reloc_type);
338 case R_RISCV_RVC_JUMP:
339 jump_target = sym_base_addr + rel->r_addend - loc; /* S + A - P */
340 modified_compressed_operand = UNALIGNED_GET(loc16);
341 compressed_imm8 = jump_target;
342 modified_compressed_operand =
343 R_RISCV_CLEAR_CJTYPE_IMM8(modified_compressed_operand);
344 modified_compressed_operand =
345 R_RISCV_SET_CJTYPE_IMM8(modified_compressed_operand, compressed_imm8);
346 UNALIGNED_PUT(modified_compressed_operand, loc16);
347 return riscv_relocation_fits(jump_target, RISCV_MAX_JUMP_DISTANCE_CJ_TYPE,
348 reloc_type);
349 case R_RISCV_ALIGN:
350 /* we are supposed to move the symbol such that it is aligned to the next power of
351 * two >= addend
352 */
353 /* this involves moving the symbol */
354 while (target_alignment < rel->r_addend) {
355 target_alignment *= 2;
356 }
357 LOG_ERR("Symbol %s with location %p requires alignment to %" PRIu64 " bytes!",
358 sym_name, (void *)loc, (uint64_t)target_alignment);
359 LOG_ERR("Alignment relocation is currently not supported!");
360 return -ENOEXEC;
361 /* ignored, this is primarily intended for removing instructions during link-time
362 * optimization
363 */
364 case R_RISCV_RELAX:
365 break;
366 default:
367 LOG_ERR("Unsupported relocation type: %" PRIu64 " for symbol: %s",
368 (uint64_t)reloc_type, sym_name);
369 return -ENOEXEC;
370 }
371
372 return 0;
373 }
374
