xref: /qemu/linux-user/elfload.c (revision f9a3def17b2a57679902c33064cf7853263db0ef)
1 /* This is the Linux kernel elf-loading code, ported into user space */
2 #include "qemu/osdep.h"
3 #include <sys/param.h>
4 
5 #include <sys/prctl.h>
6 #include <sys/resource.h>
7 #include <sys/shm.h>
8 
9 #include "qemu.h"
10 #include "user/tswap-target.h"
11 #include "user/page-protection.h"
12 #include "exec/page-protection.h"
13 #include "exec/mmap-lock.h"
14 #include "exec/translation-block.h"
15 #include "exec/tswap.h"
16 #include "user/guest-base.h"
17 #include "user-internals.h"
18 #include "signal-common.h"
19 #include "loader.h"
20 #include "user-mmap.h"
21 #include "disas/disas.h"
22 #include "qemu/bitops.h"
23 #include "qemu/path.h"
24 #include "qemu/queue.h"
25 #include "qemu/guest-random.h"
26 #include "qemu/units.h"
27 #include "qemu/selfmap.h"
28 #include "qemu/lockable.h"
29 #include "qapi/error.h"
30 #include "qemu/error-report.h"
31 #include "target_signal.h"
32 #include "tcg/debuginfo.h"
33 
34 #ifdef TARGET_ARM
35 #include "target/arm/cpu-features.h"
36 #endif
37 
38 #ifdef _ARCH_PPC64
39 #undef ARCH_DLINFO
40 #undef ELF_PLATFORM
41 #undef ELF_HWCAP
42 #undef ELF_HWCAP2
43 #undef ELF_CLASS
44 #undef ELF_DATA
45 #undef ELF_ARCH
46 #endif
47 
48 #ifndef TARGET_ARCH_HAS_SIGTRAMP_PAGE
49 #define TARGET_ARCH_HAS_SIGTRAMP_PAGE 0
50 #endif
51 
52 typedef struct {
53     const uint8_t *image;
54     const uint32_t *relocs;
55     unsigned image_size;
56     unsigned reloc_count;
57     unsigned sigreturn_ofs;
58     unsigned rt_sigreturn_ofs;
59 } VdsoImageInfo;
60 
61 #define ELF_OSABI   ELFOSABI_SYSV
62 
63 /* from personality.h */
64 
65 /*
66  * Flags for bug emulation.
67  *
68  * These occupy the top three bytes.
69  */
70 enum {
71     ADDR_NO_RANDOMIZE = 0x0040000,      /* disable randomization of VA space */
72     FDPIC_FUNCPTRS =    0x0080000,      /* userspace function ptrs point to
73                                            descriptors (signal handling) */
74     MMAP_PAGE_ZERO =    0x0100000,
75     ADDR_COMPAT_LAYOUT = 0x0200000,
76     READ_IMPLIES_EXEC = 0x0400000,
77     ADDR_LIMIT_32BIT =  0x0800000,
78     SHORT_INODE =       0x1000000,
79     WHOLE_SECONDS =     0x2000000,
80     STICKY_TIMEOUTS =   0x4000000,
81     ADDR_LIMIT_3GB =    0x8000000,
82 };
83 
84 /*
85  * Personality types.
86  *
87  * These go in the low byte.  Avoid using the top bit, it will
88  * conflict with error returns.
89  */
90 enum {
91     PER_LINUX =         0x0000,
92     PER_LINUX_32BIT =   0x0000 | ADDR_LIMIT_32BIT,
93     PER_LINUX_FDPIC =   0x0000 | FDPIC_FUNCPTRS,
94     PER_SVR4 =          0x0001 | STICKY_TIMEOUTS | MMAP_PAGE_ZERO,
95     PER_SVR3 =          0x0002 | STICKY_TIMEOUTS | SHORT_INODE,
96     PER_SCOSVR3 =       0x0003 | STICKY_TIMEOUTS | WHOLE_SECONDS | SHORT_INODE,
97     PER_OSR5 =          0x0003 | STICKY_TIMEOUTS | WHOLE_SECONDS,
98     PER_WYSEV386 =      0x0004 | STICKY_TIMEOUTS | SHORT_INODE,
99     PER_ISCR4 =         0x0005 | STICKY_TIMEOUTS,
100     PER_BSD =           0x0006,
101     PER_SUNOS =         0x0006 | STICKY_TIMEOUTS,
102     PER_XENIX =         0x0007 | STICKY_TIMEOUTS | SHORT_INODE,
103     PER_LINUX32 =       0x0008,
104     PER_LINUX32_3GB =   0x0008 | ADDR_LIMIT_3GB,
105     PER_IRIX32 =        0x0009 | STICKY_TIMEOUTS,/* IRIX5 32-bit */
106     PER_IRIXN32 =       0x000a | STICKY_TIMEOUTS,/* IRIX6 new 32-bit */
107     PER_IRIX64 =        0x000b | STICKY_TIMEOUTS,/* IRIX6 64-bit */
108     PER_RISCOS =        0x000c,
109     PER_SOLARIS =       0x000d | STICKY_TIMEOUTS,
110     PER_UW7 =           0x000e | STICKY_TIMEOUTS | MMAP_PAGE_ZERO,
111     PER_OSF4 =          0x000f,                  /* OSF/1 v4 */
112     PER_HPUX =          0x0010,
113     PER_MASK =          0x00ff,
114 };
115 
116 /*
117  * Return the base personality without flags.
118  */
119 #define personality(pers)       (pers & PER_MASK)
120 
info_is_fdpic(struct image_info * info)121 int info_is_fdpic(struct image_info *info)
122 {
123     return info->personality == PER_LINUX_FDPIC;
124 }
125 
126 /* this flag is uneffective under linux too, should be deleted */
127 #ifndef MAP_DENYWRITE
128 #define MAP_DENYWRITE 0
129 #endif
130 
131 /* should probably go in elf.h */
132 #ifndef ELIBBAD
133 #define ELIBBAD 80
134 #endif
135 
136 #if TARGET_BIG_ENDIAN
137 #define ELF_DATA        ELFDATA2MSB
138 #else
139 #define ELF_DATA        ELFDATA2LSB
140 #endif
141 
142 #ifdef TARGET_ABI_MIPSN32
143 typedef abi_ullong      target_elf_greg_t;
144 #define tswapreg(ptr)   tswap64(ptr)
145 #else
146 typedef abi_ulong       target_elf_greg_t;
147 #define tswapreg(ptr)   tswapal(ptr)
148 #endif
149 
150 #ifdef USE_UID16
151 typedef abi_ushort      target_uid_t;
152 typedef abi_ushort      target_gid_t;
153 #else
154 typedef abi_uint        target_uid_t;
155 typedef abi_uint        target_gid_t;
156 #endif
157 typedef abi_int         target_pid_t;
158 
159 #ifdef TARGET_I386
160 
161 #define ELF_HWCAP get_elf_hwcap()
162 
get_elf_hwcap(void)163 static uint32_t get_elf_hwcap(void)
164 {
165     X86CPU *cpu = X86_CPU(thread_cpu);
166 
167     return cpu->env.features[FEAT_1_EDX];
168 }
169 
170 #ifdef TARGET_X86_64
171 #define ELF_CLASS      ELFCLASS64
172 #define ELF_ARCH       EM_X86_64
173 
174 #define ELF_PLATFORM   "x86_64"
175 
init_thread(struct target_pt_regs * regs,struct image_info * infop)176 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
177 {
178     regs->rax = 0;
179     regs->rsp = infop->start_stack;
180     regs->rip = infop->entry;
181 }
182 
183 #define ELF_NREG    27
184 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
185 
186 /*
187  * Note that ELF_NREG should be 29 as there should be place for
188  * TRAPNO and ERR "registers" as well but linux doesn't dump
189  * those.
190  *
191  * See linux kernel: arch/x86/include/asm/elf.h
192  */
elf_core_copy_regs(target_elf_gregset_t * regs,const CPUX86State * env)193 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *env)
194 {
195     (*regs)[0] = tswapreg(env->regs[15]);
196     (*regs)[1] = tswapreg(env->regs[14]);
197     (*regs)[2] = tswapreg(env->regs[13]);
198     (*regs)[3] = tswapreg(env->regs[12]);
199     (*regs)[4] = tswapreg(env->regs[R_EBP]);
200     (*regs)[5] = tswapreg(env->regs[R_EBX]);
201     (*regs)[6] = tswapreg(env->regs[11]);
202     (*regs)[7] = tswapreg(env->regs[10]);
203     (*regs)[8] = tswapreg(env->regs[9]);
204     (*regs)[9] = tswapreg(env->regs[8]);
205     (*regs)[10] = tswapreg(env->regs[R_EAX]);
206     (*regs)[11] = tswapreg(env->regs[R_ECX]);
207     (*regs)[12] = tswapreg(env->regs[R_EDX]);
208     (*regs)[13] = tswapreg(env->regs[R_ESI]);
209     (*regs)[14] = tswapreg(env->regs[R_EDI]);
210     (*regs)[15] = tswapreg(get_task_state(env_cpu_const(env))->orig_ax);
211     (*regs)[16] = tswapreg(env->eip);
212     (*regs)[17] = tswapreg(env->segs[R_CS].selector & 0xffff);
213     (*regs)[18] = tswapreg(env->eflags);
214     (*regs)[19] = tswapreg(env->regs[R_ESP]);
215     (*regs)[20] = tswapreg(env->segs[R_SS].selector & 0xffff);
216     (*regs)[21] = tswapreg(env->segs[R_FS].selector & 0xffff);
217     (*regs)[22] = tswapreg(env->segs[R_GS].selector & 0xffff);
218     (*regs)[23] = tswapreg(env->segs[R_DS].selector & 0xffff);
219     (*regs)[24] = tswapreg(env->segs[R_ES].selector & 0xffff);
220     (*regs)[25] = tswapreg(env->segs[R_FS].selector & 0xffff);
221     (*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
222 }
223 
224 #if ULONG_MAX > UINT32_MAX
225 #define INIT_GUEST_COMMPAGE
init_guest_commpage(void)226 static bool init_guest_commpage(void)
227 {
228     /*
229      * The vsyscall page is at a high negative address aka kernel space,
230      * which means that we cannot actually allocate it with target_mmap.
231      * We still should be able to use page_set_flags, unless the user
232      * has specified -R reserved_va, which would trigger an assert().
233      */
234     if (reserved_va != 0 &&
235         TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE - 1 > reserved_va) {
236         error_report("Cannot allocate vsyscall page");
237         exit(EXIT_FAILURE);
238     }
239     page_set_flags(TARGET_VSYSCALL_PAGE,
240                    TARGET_VSYSCALL_PAGE | ~TARGET_PAGE_MASK,
241                    PAGE_EXEC | PAGE_VALID);
242     return true;
243 }
244 #endif
245 #else
246 
247 /*
248  * This is used to ensure we don't load something for the wrong architecture.
249  */
250 #define elf_check_arch(x) ( ((x) == EM_386) || ((x) == EM_486) )
251 
252 /*
253  * These are used to set parameters in the core dumps.
254  */
255 #define ELF_CLASS       ELFCLASS32
256 #define ELF_ARCH        EM_386
257 
258 #define ELF_PLATFORM get_elf_platform()
259 #define EXSTACK_DEFAULT true
260 
get_elf_platform(void)261 static const char *get_elf_platform(void)
262 {
263     static char elf_platform[] = "i386";
264     int family = object_property_get_int(OBJECT(thread_cpu), "family", NULL);
265     if (family > 6) {
266         family = 6;
267     }
268     if (family >= 3) {
269         elf_platform[1] = '0' + family;
270     }
271     return elf_platform;
272 }
273 
init_thread(struct target_pt_regs * regs,struct image_info * infop)274 static inline void init_thread(struct target_pt_regs *regs,
275                                struct image_info *infop)
276 {
277     regs->esp = infop->start_stack;
278     regs->eip = infop->entry;
279 
280     /* SVR4/i386 ABI (pages 3-31, 3-32) says that when the program
281        starts %edx contains a pointer to a function which might be
282        registered using `atexit'.  This provides a mean for the
283        dynamic linker to call DT_FINI functions for shared libraries
284        that have been loaded before the code runs.
285 
286        A value of 0 tells we have no such handler.  */
287     regs->edx = 0;
288 }
289 
290 #define ELF_NREG    17
291 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
292 
293 /*
294  * Note that ELF_NREG should be 19 as there should be place for
295  * TRAPNO and ERR "registers" as well but linux doesn't dump
296  * those.
297  *
298  * See linux kernel: arch/x86/include/asm/elf.h
299  */
elf_core_copy_regs(target_elf_gregset_t * regs,const CPUX86State * env)300 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *env)
301 {
302     (*regs)[0] = tswapreg(env->regs[R_EBX]);
303     (*regs)[1] = tswapreg(env->regs[R_ECX]);
304     (*regs)[2] = tswapreg(env->regs[R_EDX]);
305     (*regs)[3] = tswapreg(env->regs[R_ESI]);
306     (*regs)[4] = tswapreg(env->regs[R_EDI]);
307     (*regs)[5] = tswapreg(env->regs[R_EBP]);
308     (*regs)[6] = tswapreg(env->regs[R_EAX]);
309     (*regs)[7] = tswapreg(env->segs[R_DS].selector & 0xffff);
310     (*regs)[8] = tswapreg(env->segs[R_ES].selector & 0xffff);
311     (*regs)[9] = tswapreg(env->segs[R_FS].selector & 0xffff);
312     (*regs)[10] = tswapreg(env->segs[R_GS].selector & 0xffff);
313     (*regs)[11] = tswapreg(get_task_state(env_cpu_const(env))->orig_ax);
314     (*regs)[12] = tswapreg(env->eip);
315     (*regs)[13] = tswapreg(env->segs[R_CS].selector & 0xffff);
316     (*regs)[14] = tswapreg(env->eflags);
317     (*regs)[15] = tswapreg(env->regs[R_ESP]);
318     (*regs)[16] = tswapreg(env->segs[R_SS].selector & 0xffff);
319 }
320 
321 /*
322  * i386 is the only target which supplies AT_SYSINFO for the vdso.
323  * All others only supply AT_SYSINFO_EHDR.
324  */
325 #define DLINFO_ARCH_ITEMS (vdso_info != NULL)
326 #define ARCH_DLINFO                                     \
327     do {                                                \
328         if (vdso_info) {                                \
329             NEW_AUX_ENT(AT_SYSINFO, vdso_info->entry);  \
330         }                                               \
331     } while (0)
332 
333 #endif /* TARGET_X86_64 */
334 
335 #define VDSO_HEADER "vdso.c.inc"
336 
337 #define USE_ELF_CORE_DUMP
338 #define ELF_EXEC_PAGESIZE       4096
339 
340 #endif /* TARGET_I386 */
341 
342 #ifdef TARGET_ARM
343 
344 #ifndef TARGET_AARCH64
345 /* 32 bit ARM definitions */
346 
347 #define ELF_ARCH        EM_ARM
348 #define ELF_CLASS       ELFCLASS32
349 #define EXSTACK_DEFAULT true
350 
init_thread(struct target_pt_regs * regs,struct image_info * infop)351 static inline void init_thread(struct target_pt_regs *regs,
352                                struct image_info *infop)
353 {
354     abi_long stack = infop->start_stack;
355     memset(regs, 0, sizeof(*regs));
356 
357     regs->uregs[16] = ARM_CPU_MODE_USR;
358     if (infop->entry & 1) {
359         regs->uregs[16] |= CPSR_T;
360     }
361     regs->uregs[15] = infop->entry & 0xfffffffe;
362     regs->uregs[13] = infop->start_stack;
363     /* FIXME - what to for failure of get_user()? */
364     get_user_ual(regs->uregs[2], stack + 8); /* envp */
365     get_user_ual(regs->uregs[1], stack + 4); /* envp */
366     /* XXX: it seems that r0 is zeroed after ! */
367     regs->uregs[0] = 0;
368     /* For uClinux PIC binaries.  */
369     /* XXX: Linux does this only on ARM with no MMU (do we care ?) */
370     regs->uregs[10] = infop->start_data;
371 
372     /* Support ARM FDPIC.  */
373     if (info_is_fdpic(infop)) {
374         /* As described in the ABI document, r7 points to the loadmap info
375          * prepared by the kernel. If an interpreter is needed, r8 points
376          * to the interpreter loadmap and r9 points to the interpreter
377          * PT_DYNAMIC info. If no interpreter is needed, r8 is zero, and
378          * r9 points to the main program PT_DYNAMIC info.
379          */
380         regs->uregs[7] = infop->loadmap_addr;
381         if (infop->interpreter_loadmap_addr) {
382             /* Executable is dynamically loaded.  */
383             regs->uregs[8] = infop->interpreter_loadmap_addr;
384             regs->uregs[9] = infop->interpreter_pt_dynamic_addr;
385         } else {
386             regs->uregs[8] = 0;
387             regs->uregs[9] = infop->pt_dynamic_addr;
388         }
389     }
390 }
391 
392 #define ELF_NREG    18
393 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
394 
elf_core_copy_regs(target_elf_gregset_t * regs,const CPUARMState * env)395 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUARMState *env)
396 {
397     (*regs)[0] = tswapreg(env->regs[0]);
398     (*regs)[1] = tswapreg(env->regs[1]);
399     (*regs)[2] = tswapreg(env->regs[2]);
400     (*regs)[3] = tswapreg(env->regs[3]);
401     (*regs)[4] = tswapreg(env->regs[4]);
402     (*regs)[5] = tswapreg(env->regs[5]);
403     (*regs)[6] = tswapreg(env->regs[6]);
404     (*regs)[7] = tswapreg(env->regs[7]);
405     (*regs)[8] = tswapreg(env->regs[8]);
406     (*regs)[9] = tswapreg(env->regs[9]);
407     (*regs)[10] = tswapreg(env->regs[10]);
408     (*regs)[11] = tswapreg(env->regs[11]);
409     (*regs)[12] = tswapreg(env->regs[12]);
410     (*regs)[13] = tswapreg(env->regs[13]);
411     (*regs)[14] = tswapreg(env->regs[14]);
412     (*regs)[15] = tswapreg(env->regs[15]);
413 
414     (*regs)[16] = tswapreg(cpsr_read((CPUARMState *)env));
415     (*regs)[17] = tswapreg(env->regs[0]); /* XXX */
416 }
417 
418 #define USE_ELF_CORE_DUMP
419 #define ELF_EXEC_PAGESIZE       4096
420 
421 enum
422 {
423     ARM_HWCAP_ARM_SWP       = 1 << 0,
424     ARM_HWCAP_ARM_HALF      = 1 << 1,
425     ARM_HWCAP_ARM_THUMB     = 1 << 2,
426     ARM_HWCAP_ARM_26BIT     = 1 << 3,
427     ARM_HWCAP_ARM_FAST_MULT = 1 << 4,
428     ARM_HWCAP_ARM_FPA       = 1 << 5,
429     ARM_HWCAP_ARM_VFP       = 1 << 6,
430     ARM_HWCAP_ARM_EDSP      = 1 << 7,
431     ARM_HWCAP_ARM_JAVA      = 1 << 8,
432     ARM_HWCAP_ARM_IWMMXT    = 1 << 9,
433     ARM_HWCAP_ARM_CRUNCH    = 1 << 10,
434     ARM_HWCAP_ARM_THUMBEE   = 1 << 11,
435     ARM_HWCAP_ARM_NEON      = 1 << 12,
436     ARM_HWCAP_ARM_VFPv3     = 1 << 13,
437     ARM_HWCAP_ARM_VFPv3D16  = 1 << 14,
438     ARM_HWCAP_ARM_TLS       = 1 << 15,
439     ARM_HWCAP_ARM_VFPv4     = 1 << 16,
440     ARM_HWCAP_ARM_IDIVA     = 1 << 17,
441     ARM_HWCAP_ARM_IDIVT     = 1 << 18,
442     ARM_HWCAP_ARM_VFPD32    = 1 << 19,
443     ARM_HWCAP_ARM_LPAE      = 1 << 20,
444     ARM_HWCAP_ARM_EVTSTRM   = 1 << 21,
445     ARM_HWCAP_ARM_FPHP      = 1 << 22,
446     ARM_HWCAP_ARM_ASIMDHP   = 1 << 23,
447     ARM_HWCAP_ARM_ASIMDDP   = 1 << 24,
448     ARM_HWCAP_ARM_ASIMDFHM  = 1 << 25,
449     ARM_HWCAP_ARM_ASIMDBF16 = 1 << 26,
450     ARM_HWCAP_ARM_I8MM      = 1 << 27,
451 };
452 
453 enum {
454     ARM_HWCAP2_ARM_AES      = 1 << 0,
455     ARM_HWCAP2_ARM_PMULL    = 1 << 1,
456     ARM_HWCAP2_ARM_SHA1     = 1 << 2,
457     ARM_HWCAP2_ARM_SHA2     = 1 << 3,
458     ARM_HWCAP2_ARM_CRC32    = 1 << 4,
459     ARM_HWCAP2_ARM_SB       = 1 << 5,
460     ARM_HWCAP2_ARM_SSBS     = 1 << 6,
461 };
462 
463 /* The commpage only exists for 32 bit kernels */
464 
465 #define HI_COMMPAGE (intptr_t)0xffff0f00u
466 
init_guest_commpage(void)467 static bool init_guest_commpage(void)
468 {
469     ARMCPU *cpu = ARM_CPU(thread_cpu);
470     int host_page_size = qemu_real_host_page_size();
471     abi_ptr commpage;
472     void *want;
473     void *addr;
474 
475     /*
476      * M-profile allocates maximum of 2GB address space, so can never
477      * allocate the commpage.  Skip it.
478      */
479     if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
480         return true;
481     }
482 
483     commpage = HI_COMMPAGE & -host_page_size;
484     want = g2h_untagged(commpage);
485     addr = mmap(want, host_page_size, PROT_READ | PROT_WRITE,
486                 MAP_ANONYMOUS | MAP_PRIVATE |
487                 (commpage < reserved_va ? MAP_FIXED : MAP_FIXED_NOREPLACE),
488                 -1, 0);
489 
490     if (addr == MAP_FAILED) {
491         perror("Allocating guest commpage");
492         exit(EXIT_FAILURE);
493     }
494     if (addr != want) {
495         return false;
496     }
497 
498     /* Set kernel helper versions; rest of page is 0.  */
499     __put_user(5, (uint32_t *)g2h_untagged(0xffff0ffcu));
500 
501     if (mprotect(addr, host_page_size, PROT_READ)) {
502         perror("Protecting guest commpage");
503         exit(EXIT_FAILURE);
504     }
505 
506     page_set_flags(commpage, commpage | (host_page_size - 1),
507                    PAGE_READ | PAGE_EXEC | PAGE_VALID);
508     return true;
509 }
510 
511 #define ELF_HWCAP get_elf_hwcap()
512 #define ELF_HWCAP2 get_elf_hwcap2()
513 
get_elf_hwcap(void)514 uint32_t get_elf_hwcap(void)
515 {
516     ARMCPU *cpu = ARM_CPU(thread_cpu);
517     uint32_t hwcaps = 0;
518 
519     hwcaps |= ARM_HWCAP_ARM_SWP;
520     hwcaps |= ARM_HWCAP_ARM_HALF;
521     hwcaps |= ARM_HWCAP_ARM_THUMB;
522     hwcaps |= ARM_HWCAP_ARM_FAST_MULT;
523 
524     /* probe for the extra features */
525 #define GET_FEATURE(feat, hwcap) \
526     do { if (arm_feature(&cpu->env, feat)) { hwcaps |= hwcap; } } while (0)
527 
528 #define GET_FEATURE_ID(feat, hwcap) \
529     do { if (cpu_isar_feature(feat, cpu)) { hwcaps |= hwcap; } } while (0)
530 
531     /* EDSP is in v5TE and above, but all our v5 CPUs are v5TE */
532     GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);
533     GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
534     GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
535     GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);
536     GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
537     GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
538     GET_FEATURE_ID(aa32_arm_div, ARM_HWCAP_ARM_IDIVA);
539     GET_FEATURE_ID(aa32_thumb_div, ARM_HWCAP_ARM_IDIVT);
540     GET_FEATURE_ID(aa32_vfp, ARM_HWCAP_ARM_VFP);
541 
542     if (cpu_isar_feature(aa32_fpsp_v3, cpu) ||
543         cpu_isar_feature(aa32_fpdp_v3, cpu)) {
544         hwcaps |= ARM_HWCAP_ARM_VFPv3;
545         if (cpu_isar_feature(aa32_simd_r32, cpu)) {
546             hwcaps |= ARM_HWCAP_ARM_VFPD32;
547         } else {
548             hwcaps |= ARM_HWCAP_ARM_VFPv3D16;
549         }
550     }
551     GET_FEATURE_ID(aa32_simdfmac, ARM_HWCAP_ARM_VFPv4);
552     /*
553      * MVFR1.FPHP and .SIMDHP must be in sync, and QEMU uses the same
554      * isar_feature function for both. The kernel reports them as two hwcaps.
555      */
556     GET_FEATURE_ID(aa32_fp16_arith, ARM_HWCAP_ARM_FPHP);
557     GET_FEATURE_ID(aa32_fp16_arith, ARM_HWCAP_ARM_ASIMDHP);
558     GET_FEATURE_ID(aa32_dp, ARM_HWCAP_ARM_ASIMDDP);
559     GET_FEATURE_ID(aa32_fhm, ARM_HWCAP_ARM_ASIMDFHM);
560     GET_FEATURE_ID(aa32_bf16, ARM_HWCAP_ARM_ASIMDBF16);
561     GET_FEATURE_ID(aa32_i8mm, ARM_HWCAP_ARM_I8MM);
562 
563     return hwcaps;
564 }
565 
get_elf_hwcap2(void)566 uint64_t get_elf_hwcap2(void)
567 {
568     ARMCPU *cpu = ARM_CPU(thread_cpu);
569     uint64_t hwcaps = 0;
570 
571     GET_FEATURE_ID(aa32_aes, ARM_HWCAP2_ARM_AES);
572     GET_FEATURE_ID(aa32_pmull, ARM_HWCAP2_ARM_PMULL);
573     GET_FEATURE_ID(aa32_sha1, ARM_HWCAP2_ARM_SHA1);
574     GET_FEATURE_ID(aa32_sha2, ARM_HWCAP2_ARM_SHA2);
575     GET_FEATURE_ID(aa32_crc32, ARM_HWCAP2_ARM_CRC32);
576     GET_FEATURE_ID(aa32_sb, ARM_HWCAP2_ARM_SB);
577     GET_FEATURE_ID(aa32_ssbs, ARM_HWCAP2_ARM_SSBS);
578     return hwcaps;
579 }
580 
elf_hwcap_str(uint32_t bit)581 const char *elf_hwcap_str(uint32_t bit)
582 {
583     static const char *hwcap_str[] = {
584     [__builtin_ctz(ARM_HWCAP_ARM_SWP      )] = "swp",
585     [__builtin_ctz(ARM_HWCAP_ARM_HALF     )] = "half",
586     [__builtin_ctz(ARM_HWCAP_ARM_THUMB    )] = "thumb",
587     [__builtin_ctz(ARM_HWCAP_ARM_26BIT    )] = "26bit",
588     [__builtin_ctz(ARM_HWCAP_ARM_FAST_MULT)] = "fast_mult",
589     [__builtin_ctz(ARM_HWCAP_ARM_FPA      )] = "fpa",
590     [__builtin_ctz(ARM_HWCAP_ARM_VFP      )] = "vfp",
591     [__builtin_ctz(ARM_HWCAP_ARM_EDSP     )] = "edsp",
592     [__builtin_ctz(ARM_HWCAP_ARM_JAVA     )] = "java",
593     [__builtin_ctz(ARM_HWCAP_ARM_IWMMXT   )] = "iwmmxt",
594     [__builtin_ctz(ARM_HWCAP_ARM_CRUNCH   )] = "crunch",
595     [__builtin_ctz(ARM_HWCAP_ARM_THUMBEE  )] = "thumbee",
596     [__builtin_ctz(ARM_HWCAP_ARM_NEON     )] = "neon",
597     [__builtin_ctz(ARM_HWCAP_ARM_VFPv3    )] = "vfpv3",
598     [__builtin_ctz(ARM_HWCAP_ARM_VFPv3D16 )] = "vfpv3d16",
599     [__builtin_ctz(ARM_HWCAP_ARM_TLS      )] = "tls",
600     [__builtin_ctz(ARM_HWCAP_ARM_VFPv4    )] = "vfpv4",
601     [__builtin_ctz(ARM_HWCAP_ARM_IDIVA    )] = "idiva",
602     [__builtin_ctz(ARM_HWCAP_ARM_IDIVT    )] = "idivt",
603     [__builtin_ctz(ARM_HWCAP_ARM_VFPD32   )] = "vfpd32",
604     [__builtin_ctz(ARM_HWCAP_ARM_LPAE     )] = "lpae",
605     [__builtin_ctz(ARM_HWCAP_ARM_EVTSTRM  )] = "evtstrm",
606     [__builtin_ctz(ARM_HWCAP_ARM_FPHP     )] = "fphp",
607     [__builtin_ctz(ARM_HWCAP_ARM_ASIMDHP  )] = "asimdhp",
608     [__builtin_ctz(ARM_HWCAP_ARM_ASIMDDP  )] = "asimddp",
609     [__builtin_ctz(ARM_HWCAP_ARM_ASIMDFHM )] = "asimdfhm",
610     [__builtin_ctz(ARM_HWCAP_ARM_ASIMDBF16)] = "asimdbf16",
611     [__builtin_ctz(ARM_HWCAP_ARM_I8MM     )] = "i8mm",
612     };
613 
614     return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
615 }
616 
elf_hwcap2_str(uint32_t bit)617 const char *elf_hwcap2_str(uint32_t bit)
618 {
619     static const char *hwcap_str[] = {
620     [__builtin_ctz(ARM_HWCAP2_ARM_AES  )] = "aes",
621     [__builtin_ctz(ARM_HWCAP2_ARM_PMULL)] = "pmull",
622     [__builtin_ctz(ARM_HWCAP2_ARM_SHA1 )] = "sha1",
623     [__builtin_ctz(ARM_HWCAP2_ARM_SHA2 )] = "sha2",
624     [__builtin_ctz(ARM_HWCAP2_ARM_CRC32)] = "crc32",
625     [__builtin_ctz(ARM_HWCAP2_ARM_SB   )] = "sb",
626     [__builtin_ctz(ARM_HWCAP2_ARM_SSBS )] = "ssbs",
627     };
628 
629     return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
630 }
631 
632 #undef GET_FEATURE
633 #undef GET_FEATURE_ID
634 
635 #define ELF_PLATFORM get_elf_platform()
636 
get_elf_platform(void)637 static const char *get_elf_platform(void)
638 {
639     CPUARMState *env = cpu_env(thread_cpu);
640 
641 #if TARGET_BIG_ENDIAN
642 # define END  "b"
643 #else
644 # define END  "l"
645 #endif
646 
647     if (arm_feature(env, ARM_FEATURE_V8)) {
648         return "v8" END;
649     } else if (arm_feature(env, ARM_FEATURE_V7)) {
650         if (arm_feature(env, ARM_FEATURE_M)) {
651             return "v7m" END;
652         } else {
653             return "v7" END;
654         }
655     } else if (arm_feature(env, ARM_FEATURE_V6)) {
656         return "v6" END;
657     } else if (arm_feature(env, ARM_FEATURE_V5)) {
658         return "v5" END;
659     } else {
660         return "v4" END;
661     }
662 
663 #undef END
664 }
665 
666 #if TARGET_BIG_ENDIAN
667 #include "elf.h"
668 #include "vdso-be8.c.inc"
669 #include "vdso-be32.c.inc"
670 
vdso_image_info(uint32_t elf_flags)671 static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
672 {
673     return (EF_ARM_EABI_VERSION(elf_flags) >= EF_ARM_EABI_VER4
674             && (elf_flags & EF_ARM_BE8)
675             ? &vdso_be8_image_info
676             : &vdso_be32_image_info);
677 }
678 #define vdso_image_info vdso_image_info
679 #else
680 # define VDSO_HEADER  "vdso-le.c.inc"
681 #endif
682 
683 #else
684 /* 64 bit ARM definitions */
685 
686 #define ELF_ARCH        EM_AARCH64
687 #define ELF_CLASS       ELFCLASS64
688 #if TARGET_BIG_ENDIAN
689 # define ELF_PLATFORM    "aarch64_be"
690 #else
691 # define ELF_PLATFORM    "aarch64"
692 #endif
693 
init_thread(struct target_pt_regs * regs,struct image_info * infop)694 static inline void init_thread(struct target_pt_regs *regs,
695                                struct image_info *infop)
696 {
697     abi_long stack = infop->start_stack;
698     memset(regs, 0, sizeof(*regs));
699 
700     regs->pc = infop->entry & ~0x3ULL;
701     regs->sp = stack;
702 }
703 
704 #define ELF_NREG    34
705 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
706 
elf_core_copy_regs(target_elf_gregset_t * regs,const CPUARMState * env)707 static void elf_core_copy_regs(target_elf_gregset_t *regs,
708                                const CPUARMState *env)
709 {
710     int i;
711 
712     for (i = 0; i < 32; i++) {
713         (*regs)[i] = tswapreg(env->xregs[i]);
714     }
715     (*regs)[32] = tswapreg(env->pc);
716     (*regs)[33] = tswapreg(pstate_read((CPUARMState *)env));
717 }
718 
719 #define USE_ELF_CORE_DUMP
720 #define ELF_EXEC_PAGESIZE       4096
721 
722 enum {
723     ARM_HWCAP_A64_FP            = 1 << 0,
724     ARM_HWCAP_A64_ASIMD         = 1 << 1,
725     ARM_HWCAP_A64_EVTSTRM       = 1 << 2,
726     ARM_HWCAP_A64_AES           = 1 << 3,
727     ARM_HWCAP_A64_PMULL         = 1 << 4,
728     ARM_HWCAP_A64_SHA1          = 1 << 5,
729     ARM_HWCAP_A64_SHA2          = 1 << 6,
730     ARM_HWCAP_A64_CRC32         = 1 << 7,
731     ARM_HWCAP_A64_ATOMICS       = 1 << 8,
732     ARM_HWCAP_A64_FPHP          = 1 << 9,
733     ARM_HWCAP_A64_ASIMDHP       = 1 << 10,
734     ARM_HWCAP_A64_CPUID         = 1 << 11,
735     ARM_HWCAP_A64_ASIMDRDM      = 1 << 12,
736     ARM_HWCAP_A64_JSCVT         = 1 << 13,
737     ARM_HWCAP_A64_FCMA          = 1 << 14,
738     ARM_HWCAP_A64_LRCPC         = 1 << 15,
739     ARM_HWCAP_A64_DCPOP         = 1 << 16,
740     ARM_HWCAP_A64_SHA3          = 1 << 17,
741     ARM_HWCAP_A64_SM3           = 1 << 18,
742     ARM_HWCAP_A64_SM4           = 1 << 19,
743     ARM_HWCAP_A64_ASIMDDP       = 1 << 20,
744     ARM_HWCAP_A64_SHA512        = 1 << 21,
745     ARM_HWCAP_A64_SVE           = 1 << 22,
746     ARM_HWCAP_A64_ASIMDFHM      = 1 << 23,
747     ARM_HWCAP_A64_DIT           = 1 << 24,
748     ARM_HWCAP_A64_USCAT         = 1 << 25,
749     ARM_HWCAP_A64_ILRCPC        = 1 << 26,
750     ARM_HWCAP_A64_FLAGM         = 1 << 27,
751     ARM_HWCAP_A64_SSBS          = 1 << 28,
752     ARM_HWCAP_A64_SB            = 1 << 29,
753     ARM_HWCAP_A64_PACA          = 1 << 30,
754     ARM_HWCAP_A64_PACG          = 1ULL << 31,
755     ARM_HWCAP_A64_GCS           = 1ULL << 32,
756     ARM_HWCAP_A64_CMPBR         = 1ULL << 33,
757     ARM_HWCAP_A64_FPRCVT        = 1ULL << 34,
758     ARM_HWCAP_A64_F8MM8         = 1ULL << 35,
759     ARM_HWCAP_A64_F8MM4         = 1ULL << 36,
760     ARM_HWCAP_A64_SVE_F16MM     = 1ULL << 37,
761     ARM_HWCAP_A64_SVE_ELTPERM   = 1ULL << 38,
762     ARM_HWCAP_A64_SVE_AES2      = 1ULL << 39,
763     ARM_HWCAP_A64_SVE_BFSCALE   = 1ULL << 40,
764     ARM_HWCAP_A64_SVE2P2        = 1ULL << 41,
765     ARM_HWCAP_A64_SME2P2        = 1ULL << 42,
766     ARM_HWCAP_A64_SME_SBITPERM  = 1ULL << 43,
767     ARM_HWCAP_A64_SME_AES       = 1ULL << 44,
768     ARM_HWCAP_A64_SME_SFEXPA    = 1ULL << 45,
769     ARM_HWCAP_A64_SME_STMOP     = 1ULL << 46,
770     ARM_HWCAP_A64_SME_SMOP4     = 1ULL << 47,
771 
772     ARM_HWCAP2_A64_DCPODP       = 1 << 0,
773     ARM_HWCAP2_A64_SVE2         = 1 << 1,
774     ARM_HWCAP2_A64_SVEAES       = 1 << 2,
775     ARM_HWCAP2_A64_SVEPMULL     = 1 << 3,
776     ARM_HWCAP2_A64_SVEBITPERM   = 1 << 4,
777     ARM_HWCAP2_A64_SVESHA3      = 1 << 5,
778     ARM_HWCAP2_A64_SVESM4       = 1 << 6,
779     ARM_HWCAP2_A64_FLAGM2       = 1 << 7,
780     ARM_HWCAP2_A64_FRINT        = 1 << 8,
781     ARM_HWCAP2_A64_SVEI8MM      = 1 << 9,
782     ARM_HWCAP2_A64_SVEF32MM     = 1 << 10,
783     ARM_HWCAP2_A64_SVEF64MM     = 1 << 11,
784     ARM_HWCAP2_A64_SVEBF16      = 1 << 12,
785     ARM_HWCAP2_A64_I8MM         = 1 << 13,
786     ARM_HWCAP2_A64_BF16         = 1 << 14,
787     ARM_HWCAP2_A64_DGH          = 1 << 15,
788     ARM_HWCAP2_A64_RNG          = 1 << 16,
789     ARM_HWCAP2_A64_BTI          = 1 << 17,
790     ARM_HWCAP2_A64_MTE          = 1 << 18,
791     ARM_HWCAP2_A64_ECV          = 1 << 19,
792     ARM_HWCAP2_A64_AFP          = 1 << 20,
793     ARM_HWCAP2_A64_RPRES        = 1 << 21,
794     ARM_HWCAP2_A64_MTE3         = 1 << 22,
795     ARM_HWCAP2_A64_SME          = 1 << 23,
796     ARM_HWCAP2_A64_SME_I16I64   = 1 << 24,
797     ARM_HWCAP2_A64_SME_F64F64   = 1 << 25,
798     ARM_HWCAP2_A64_SME_I8I32    = 1 << 26,
799     ARM_HWCAP2_A64_SME_F16F32   = 1 << 27,
800     ARM_HWCAP2_A64_SME_B16F32   = 1 << 28,
801     ARM_HWCAP2_A64_SME_F32F32   = 1 << 29,
802     ARM_HWCAP2_A64_SME_FA64     = 1 << 30,
803     ARM_HWCAP2_A64_WFXT         = 1ULL << 31,
804     ARM_HWCAP2_A64_EBF16        = 1ULL << 32,
805     ARM_HWCAP2_A64_SVE_EBF16    = 1ULL << 33,
806     ARM_HWCAP2_A64_CSSC         = 1ULL << 34,
807     ARM_HWCAP2_A64_RPRFM        = 1ULL << 35,
808     ARM_HWCAP2_A64_SVE2P1       = 1ULL << 36,
809     ARM_HWCAP2_A64_SME2         = 1ULL << 37,
810     ARM_HWCAP2_A64_SME2P1       = 1ULL << 38,
811     ARM_HWCAP2_A64_SME_I16I32   = 1ULL << 39,
812     ARM_HWCAP2_A64_SME_BI32I32  = 1ULL << 40,
813     ARM_HWCAP2_A64_SME_B16B16   = 1ULL << 41,
814     ARM_HWCAP2_A64_SME_F16F16   = 1ULL << 42,
815     ARM_HWCAP2_A64_MOPS         = 1ULL << 43,
816     ARM_HWCAP2_A64_HBC          = 1ULL << 44,
817     ARM_HWCAP2_A64_SVE_B16B16   = 1ULL << 45,
818     ARM_HWCAP2_A64_LRCPC3       = 1ULL << 46,
819     ARM_HWCAP2_A64_LSE128       = 1ULL << 47,
820     ARM_HWCAP2_A64_FPMR         = 1ULL << 48,
821     ARM_HWCAP2_A64_LUT          = 1ULL << 49,
822     ARM_HWCAP2_A64_FAMINMAX     = 1ULL << 50,
823     ARM_HWCAP2_A64_F8CVT        = 1ULL << 51,
824     ARM_HWCAP2_A64_F8FMA        = 1ULL << 52,
825     ARM_HWCAP2_A64_F8DP4        = 1ULL << 53,
826     ARM_HWCAP2_A64_F8DP2        = 1ULL << 54,
827     ARM_HWCAP2_A64_F8E4M3       = 1ULL << 55,
828     ARM_HWCAP2_A64_F8E5M2       = 1ULL << 56,
829     ARM_HWCAP2_A64_SME_LUTV2    = 1ULL << 57,
830     ARM_HWCAP2_A64_SME_F8F16    = 1ULL << 58,
831     ARM_HWCAP2_A64_SME_F8F32    = 1ULL << 59,
832     ARM_HWCAP2_A64_SME_SF8FMA   = 1ULL << 60,
833     ARM_HWCAP2_A64_SME_SF8DP4   = 1ULL << 61,
834     ARM_HWCAP2_A64_SME_SF8DP2   = 1ULL << 62,
835     ARM_HWCAP2_A64_POE          = 1ULL << 63,
836 };
837 
838 #define ELF_HWCAP   get_elf_hwcap()
839 #define ELF_HWCAP2  get_elf_hwcap2()
840 
841 #define GET_FEATURE_ID(feat, hwcap) \
842     do { if (cpu_isar_feature(feat, cpu)) { hwcaps |= hwcap; } } while (0)
843 
get_elf_hwcap(void)844 uint32_t get_elf_hwcap(void)
845 {
846     ARMCPU *cpu = ARM_CPU(thread_cpu);
847     uint32_t hwcaps = 0;
848 
849     hwcaps |= ARM_HWCAP_A64_FP;
850     hwcaps |= ARM_HWCAP_A64_ASIMD;
851     hwcaps |= ARM_HWCAP_A64_CPUID;
852 
853     /* probe for the extra features */
854 
855     GET_FEATURE_ID(aa64_aes, ARM_HWCAP_A64_AES);
856     GET_FEATURE_ID(aa64_pmull, ARM_HWCAP_A64_PMULL);
857     GET_FEATURE_ID(aa64_sha1, ARM_HWCAP_A64_SHA1);
858     GET_FEATURE_ID(aa64_sha256, ARM_HWCAP_A64_SHA2);
859     GET_FEATURE_ID(aa64_sha512, ARM_HWCAP_A64_SHA512);
860     GET_FEATURE_ID(aa64_crc32, ARM_HWCAP_A64_CRC32);
861     GET_FEATURE_ID(aa64_sha3, ARM_HWCAP_A64_SHA3);
862     GET_FEATURE_ID(aa64_sm3, ARM_HWCAP_A64_SM3);
863     GET_FEATURE_ID(aa64_sm4, ARM_HWCAP_A64_SM4);
864     GET_FEATURE_ID(aa64_fp16, ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
865     GET_FEATURE_ID(aa64_atomics, ARM_HWCAP_A64_ATOMICS);
866     GET_FEATURE_ID(aa64_lse2, ARM_HWCAP_A64_USCAT);
867     GET_FEATURE_ID(aa64_rdm, ARM_HWCAP_A64_ASIMDRDM);
868     GET_FEATURE_ID(aa64_dp, ARM_HWCAP_A64_ASIMDDP);
869     GET_FEATURE_ID(aa64_fcma, ARM_HWCAP_A64_FCMA);
870     GET_FEATURE_ID(aa64_sve, ARM_HWCAP_A64_SVE);
871     GET_FEATURE_ID(aa64_pauth, ARM_HWCAP_A64_PACA | ARM_HWCAP_A64_PACG);
872     GET_FEATURE_ID(aa64_fhm, ARM_HWCAP_A64_ASIMDFHM);
873     GET_FEATURE_ID(aa64_dit, ARM_HWCAP_A64_DIT);
874     GET_FEATURE_ID(aa64_jscvt, ARM_HWCAP_A64_JSCVT);
875     GET_FEATURE_ID(aa64_sb, ARM_HWCAP_A64_SB);
876     GET_FEATURE_ID(aa64_condm_4, ARM_HWCAP_A64_FLAGM);
877     GET_FEATURE_ID(aa64_dcpop, ARM_HWCAP_A64_DCPOP);
878     GET_FEATURE_ID(aa64_rcpc_8_3, ARM_HWCAP_A64_LRCPC);
879     GET_FEATURE_ID(aa64_rcpc_8_4, ARM_HWCAP_A64_ILRCPC);
880 
881     return hwcaps;
882 }
883 
get_elf_hwcap2(void)884 uint64_t get_elf_hwcap2(void)
885 {
886     ARMCPU *cpu = ARM_CPU(thread_cpu);
887     uint64_t hwcaps = 0;
888 
889     GET_FEATURE_ID(aa64_dcpodp, ARM_HWCAP2_A64_DCPODP);
890     GET_FEATURE_ID(aa64_sve2, ARM_HWCAP2_A64_SVE2);
891     GET_FEATURE_ID(aa64_sve2_aes, ARM_HWCAP2_A64_SVEAES);
892     GET_FEATURE_ID(aa64_sve2_pmull128, ARM_HWCAP2_A64_SVEPMULL);
893     GET_FEATURE_ID(aa64_sve2_bitperm, ARM_HWCAP2_A64_SVEBITPERM);
894     GET_FEATURE_ID(aa64_sve2_sha3, ARM_HWCAP2_A64_SVESHA3);
895     GET_FEATURE_ID(aa64_sve2_sm4, ARM_HWCAP2_A64_SVESM4);
896     GET_FEATURE_ID(aa64_condm_5, ARM_HWCAP2_A64_FLAGM2);
897     GET_FEATURE_ID(aa64_frint, ARM_HWCAP2_A64_FRINT);
898     GET_FEATURE_ID(aa64_sve_i8mm, ARM_HWCAP2_A64_SVEI8MM);
899     GET_FEATURE_ID(aa64_sve_f32mm, ARM_HWCAP2_A64_SVEF32MM);
900     GET_FEATURE_ID(aa64_sve_f64mm, ARM_HWCAP2_A64_SVEF64MM);
901     GET_FEATURE_ID(aa64_sve_bf16, ARM_HWCAP2_A64_SVEBF16);
902     GET_FEATURE_ID(aa64_i8mm, ARM_HWCAP2_A64_I8MM);
903     GET_FEATURE_ID(aa64_bf16, ARM_HWCAP2_A64_BF16);
904     GET_FEATURE_ID(aa64_rndr, ARM_HWCAP2_A64_RNG);
905     GET_FEATURE_ID(aa64_bti, ARM_HWCAP2_A64_BTI);
906     GET_FEATURE_ID(aa64_mte, ARM_HWCAP2_A64_MTE);
907     GET_FEATURE_ID(aa64_mte3, ARM_HWCAP2_A64_MTE3);
908     GET_FEATURE_ID(aa64_sme, (ARM_HWCAP2_A64_SME |
909                               ARM_HWCAP2_A64_SME_F32F32 |
910                               ARM_HWCAP2_A64_SME_B16F32 |
911                               ARM_HWCAP2_A64_SME_F16F32 |
912                               ARM_HWCAP2_A64_SME_I8I32));
913     GET_FEATURE_ID(aa64_sme_f64f64, ARM_HWCAP2_A64_SME_F64F64);
914     GET_FEATURE_ID(aa64_sme_i16i64, ARM_HWCAP2_A64_SME_I16I64);
915     GET_FEATURE_ID(aa64_sme_fa64, ARM_HWCAP2_A64_SME_FA64);
916     GET_FEATURE_ID(aa64_hbc, ARM_HWCAP2_A64_HBC);
917     GET_FEATURE_ID(aa64_mops, ARM_HWCAP2_A64_MOPS);
918 
919     return hwcaps;
920 }
921 
elf_hwcap_str(uint32_t bit)922 const char *elf_hwcap_str(uint32_t bit)
923 {
924     static const char * const hwcap_str[] = {
925     [__builtin_ctz(ARM_HWCAP_A64_FP      )] = "fp",
926     [__builtin_ctz(ARM_HWCAP_A64_ASIMD   )] = "asimd",
927     [__builtin_ctz(ARM_HWCAP_A64_EVTSTRM )] = "evtstrm",
928     [__builtin_ctz(ARM_HWCAP_A64_AES     )] = "aes",
929     [__builtin_ctz(ARM_HWCAP_A64_PMULL   )] = "pmull",
930     [__builtin_ctz(ARM_HWCAP_A64_SHA1    )] = "sha1",
931     [__builtin_ctz(ARM_HWCAP_A64_SHA2    )] = "sha2",
932     [__builtin_ctz(ARM_HWCAP_A64_CRC32   )] = "crc32",
933     [__builtin_ctz(ARM_HWCAP_A64_ATOMICS )] = "atomics",
934     [__builtin_ctz(ARM_HWCAP_A64_FPHP    )] = "fphp",
935     [__builtin_ctz(ARM_HWCAP_A64_ASIMDHP )] = "asimdhp",
936     [__builtin_ctz(ARM_HWCAP_A64_CPUID   )] = "cpuid",
937     [__builtin_ctz(ARM_HWCAP_A64_ASIMDRDM)] = "asimdrdm",
938     [__builtin_ctz(ARM_HWCAP_A64_JSCVT   )] = "jscvt",
939     [__builtin_ctz(ARM_HWCAP_A64_FCMA    )] = "fcma",
940     [__builtin_ctz(ARM_HWCAP_A64_LRCPC   )] = "lrcpc",
941     [__builtin_ctz(ARM_HWCAP_A64_DCPOP   )] = "dcpop",
942     [__builtin_ctz(ARM_HWCAP_A64_SHA3    )] = "sha3",
943     [__builtin_ctz(ARM_HWCAP_A64_SM3     )] = "sm3",
944     [__builtin_ctz(ARM_HWCAP_A64_SM4     )] = "sm4",
945     [__builtin_ctz(ARM_HWCAP_A64_ASIMDDP )] = "asimddp",
946     [__builtin_ctz(ARM_HWCAP_A64_SHA512  )] = "sha512",
947     [__builtin_ctz(ARM_HWCAP_A64_SVE     )] = "sve",
948     [__builtin_ctz(ARM_HWCAP_A64_ASIMDFHM)] = "asimdfhm",
949     [__builtin_ctz(ARM_HWCAP_A64_DIT     )] = "dit",
950     [__builtin_ctz(ARM_HWCAP_A64_USCAT   )] = "uscat",
951     [__builtin_ctz(ARM_HWCAP_A64_ILRCPC  )] = "ilrcpc",
952     [__builtin_ctz(ARM_HWCAP_A64_FLAGM   )] = "flagm",
953     [__builtin_ctz(ARM_HWCAP_A64_SSBS    )] = "ssbs",
954     [__builtin_ctz(ARM_HWCAP_A64_SB      )] = "sb",
955     [__builtin_ctz(ARM_HWCAP_A64_PACA    )] = "paca",
956     [__builtin_ctz(ARM_HWCAP_A64_PACG    )] = "pacg",
957     [__builtin_ctzll(ARM_HWCAP_A64_GCS   )] = "gcs",
958     [__builtin_ctzll(ARM_HWCAP_A64_CMPBR )] = "cmpbr",
959     [__builtin_ctzll(ARM_HWCAP_A64_FPRCVT)] = "fprcvt",
960     [__builtin_ctzll(ARM_HWCAP_A64_F8MM8 )] = "f8mm8",
961     [__builtin_ctzll(ARM_HWCAP_A64_F8MM4 )] = "f8mm4",
962     [__builtin_ctzll(ARM_HWCAP_A64_SVE_F16MM)] = "svef16mm",
963     [__builtin_ctzll(ARM_HWCAP_A64_SVE_ELTPERM)] = "sveeltperm",
964     [__builtin_ctzll(ARM_HWCAP_A64_SVE_AES2)] = "sveaes2",
965     [__builtin_ctzll(ARM_HWCAP_A64_SVE_BFSCALE)] = "svebfscale",
966     [__builtin_ctzll(ARM_HWCAP_A64_SVE2P2)] = "sve2p2",
967     [__builtin_ctzll(ARM_HWCAP_A64_SME2P2)] = "sme2p2",
968     [__builtin_ctzll(ARM_HWCAP_A64_SME_SBITPERM)] = "smesbitperm",
969     [__builtin_ctzll(ARM_HWCAP_A64_SME_AES)] = "smeaes",
970     [__builtin_ctzll(ARM_HWCAP_A64_SME_SFEXPA)] = "smesfexpa",
971     [__builtin_ctzll(ARM_HWCAP_A64_SME_STMOP)] = "smestmop",
972     [__builtin_ctzll(ARM_HWCAP_A64_SME_SMOP4)] = "smesmop4",
973     };
974 
975     return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
976 }
977 
elf_hwcap2_str(uint32_t bit)978 const char *elf_hwcap2_str(uint32_t bit)
979 {
980     static const char * const hwcap_str[] = {
981     [__builtin_ctz(ARM_HWCAP2_A64_DCPODP       )] = "dcpodp",
982     [__builtin_ctz(ARM_HWCAP2_A64_SVE2         )] = "sve2",
983     [__builtin_ctz(ARM_HWCAP2_A64_SVEAES       )] = "sveaes",
984     [__builtin_ctz(ARM_HWCAP2_A64_SVEPMULL     )] = "svepmull",
985     [__builtin_ctz(ARM_HWCAP2_A64_SVEBITPERM   )] = "svebitperm",
986     [__builtin_ctz(ARM_HWCAP2_A64_SVESHA3      )] = "svesha3",
987     [__builtin_ctz(ARM_HWCAP2_A64_SVESM4       )] = "svesm4",
988     [__builtin_ctz(ARM_HWCAP2_A64_FLAGM2       )] = "flagm2",
989     [__builtin_ctz(ARM_HWCAP2_A64_FRINT        )] = "frint",
990     [__builtin_ctz(ARM_HWCAP2_A64_SVEI8MM      )] = "svei8mm",
991     [__builtin_ctz(ARM_HWCAP2_A64_SVEF32MM     )] = "svef32mm",
992     [__builtin_ctz(ARM_HWCAP2_A64_SVEF64MM     )] = "svef64mm",
993     [__builtin_ctz(ARM_HWCAP2_A64_SVEBF16      )] = "svebf16",
994     [__builtin_ctz(ARM_HWCAP2_A64_I8MM         )] = "i8mm",
995     [__builtin_ctz(ARM_HWCAP2_A64_BF16         )] = "bf16",
996     [__builtin_ctz(ARM_HWCAP2_A64_DGH          )] = "dgh",
997     [__builtin_ctz(ARM_HWCAP2_A64_RNG          )] = "rng",
998     [__builtin_ctz(ARM_HWCAP2_A64_BTI          )] = "bti",
999     [__builtin_ctz(ARM_HWCAP2_A64_MTE          )] = "mte",
1000     [__builtin_ctz(ARM_HWCAP2_A64_ECV          )] = "ecv",
1001     [__builtin_ctz(ARM_HWCAP2_A64_AFP          )] = "afp",
1002     [__builtin_ctz(ARM_HWCAP2_A64_RPRES        )] = "rpres",
1003     [__builtin_ctz(ARM_HWCAP2_A64_MTE3         )] = "mte3",
1004     [__builtin_ctz(ARM_HWCAP2_A64_SME          )] = "sme",
1005     [__builtin_ctz(ARM_HWCAP2_A64_SME_I16I64   )] = "smei16i64",
1006     [__builtin_ctz(ARM_HWCAP2_A64_SME_F64F64   )] = "smef64f64",
1007     [__builtin_ctz(ARM_HWCAP2_A64_SME_I8I32    )] = "smei8i32",
1008     [__builtin_ctz(ARM_HWCAP2_A64_SME_F16F32   )] = "smef16f32",
1009     [__builtin_ctz(ARM_HWCAP2_A64_SME_B16F32   )] = "smeb16f32",
1010     [__builtin_ctz(ARM_HWCAP2_A64_SME_F32F32   )] = "smef32f32",
1011     [__builtin_ctz(ARM_HWCAP2_A64_SME_FA64     )] = "smefa64",
1012     [__builtin_ctz(ARM_HWCAP2_A64_WFXT         )] = "wfxt",
1013     [__builtin_ctzll(ARM_HWCAP2_A64_EBF16      )] = "ebf16",
1014     [__builtin_ctzll(ARM_HWCAP2_A64_SVE_EBF16  )] = "sveebf16",
1015     [__builtin_ctzll(ARM_HWCAP2_A64_CSSC       )] = "cssc",
1016     [__builtin_ctzll(ARM_HWCAP2_A64_RPRFM      )] = "rprfm",
1017     [__builtin_ctzll(ARM_HWCAP2_A64_SVE2P1     )] = "sve2p1",
1018     [__builtin_ctzll(ARM_HWCAP2_A64_SME2       )] = "sme2",
1019     [__builtin_ctzll(ARM_HWCAP2_A64_SME2P1     )] = "sme2p1",
1020     [__builtin_ctzll(ARM_HWCAP2_A64_SME_I16I32 )] = "smei16i32",
1021     [__builtin_ctzll(ARM_HWCAP2_A64_SME_BI32I32)] = "smebi32i32",
1022     [__builtin_ctzll(ARM_HWCAP2_A64_SME_B16B16 )] = "smeb16b16",
1023     [__builtin_ctzll(ARM_HWCAP2_A64_SME_F16F16 )] = "smef16f16",
1024     [__builtin_ctzll(ARM_HWCAP2_A64_MOPS       )] = "mops",
1025     [__builtin_ctzll(ARM_HWCAP2_A64_HBC        )] = "hbc",
1026     [__builtin_ctzll(ARM_HWCAP2_A64_SVE_B16B16 )] = "sveb16b16",
1027     [__builtin_ctzll(ARM_HWCAP2_A64_LRCPC3     )] = "lrcpc3",
1028     [__builtin_ctzll(ARM_HWCAP2_A64_LSE128     )] = "lse128",
1029     [__builtin_ctzll(ARM_HWCAP2_A64_FPMR       )] = "fpmr",
1030     [__builtin_ctzll(ARM_HWCAP2_A64_LUT        )] = "lut",
1031     [__builtin_ctzll(ARM_HWCAP2_A64_FAMINMAX   )] = "faminmax",
1032     [__builtin_ctzll(ARM_HWCAP2_A64_F8CVT      )] = "f8cvt",
1033     [__builtin_ctzll(ARM_HWCAP2_A64_F8FMA      )] = "f8fma",
1034     [__builtin_ctzll(ARM_HWCAP2_A64_F8DP4      )] = "f8dp4",
1035     [__builtin_ctzll(ARM_HWCAP2_A64_F8DP2      )] = "f8dp2",
1036     [__builtin_ctzll(ARM_HWCAP2_A64_F8E4M3     )] = "f8e4m3",
1037     [__builtin_ctzll(ARM_HWCAP2_A64_F8E5M2     )] = "f8e5m2",
1038     [__builtin_ctzll(ARM_HWCAP2_A64_SME_LUTV2  )] = "smelutv2",
1039     [__builtin_ctzll(ARM_HWCAP2_A64_SME_F8F16  )] = "smef8f16",
1040     [__builtin_ctzll(ARM_HWCAP2_A64_SME_F8F32  )] = "smef8f32",
1041     [__builtin_ctzll(ARM_HWCAP2_A64_SME_SF8DP4 )] = "smesf8dp4",
1042     [__builtin_ctzll(ARM_HWCAP2_A64_SME_SF8DP2 )] = "smesf8dp2",
1043     [__builtin_ctzll(ARM_HWCAP2_A64_POE        )] = "poe",
1044     };
1045 
1046     return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
1047 }
1048 
1049 #undef GET_FEATURE_ID
1050 
1051 #if TARGET_BIG_ENDIAN
1052 # define VDSO_HEADER  "vdso-be.c.inc"
1053 #else
1054 # define VDSO_HEADER  "vdso-le.c.inc"
1055 #endif
1056 
1057 #endif /* not TARGET_AARCH64 */
1058 
1059 #endif /* TARGET_ARM */
1060 
1061 #ifdef TARGET_SPARC
1062 
1063 #ifndef TARGET_SPARC64
1064 # define ELF_CLASS  ELFCLASS32
1065 # define ELF_ARCH   EM_SPARC
1066 #elif defined(TARGET_ABI32)
1067 # define ELF_CLASS  ELFCLASS32
1068 # define elf_check_arch(x) ((x) == EM_SPARC32PLUS || (x) == EM_SPARC)
1069 #else
1070 # define ELF_CLASS  ELFCLASS64
1071 # define ELF_ARCH   EM_SPARCV9
1072 #endif
1073 
1074 #include "elf.h"
1075 
1076 #define ELF_HWCAP get_elf_hwcap()
1077 
get_elf_hwcap(void)1078 static uint32_t get_elf_hwcap(void)
1079 {
1080     /* There are not many sparc32 hwcap bits -- we have all of them. */
1081     uint32_t r = HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR |
1082                  HWCAP_SPARC_SWAP | HWCAP_SPARC_MULDIV;
1083 
1084 #ifdef TARGET_SPARC64
1085     CPUSPARCState *env = cpu_env(thread_cpu);
1086     uint32_t features = env->def.features;
1087 
1088     r |= HWCAP_SPARC_V9 | HWCAP_SPARC_V8PLUS;
1089     /* 32x32 multiply and divide are efficient. */
1090     r |= HWCAP_SPARC_MUL32 | HWCAP_SPARC_DIV32;
1091     /* We don't have an internal feature bit for this. */
1092     r |= HWCAP_SPARC_POPC;
1093     r |= features & CPU_FEATURE_FSMULD ? HWCAP_SPARC_FSMULD : 0;
1094     r |= features & CPU_FEATURE_VIS1 ? HWCAP_SPARC_VIS : 0;
1095     r |= features & CPU_FEATURE_VIS2 ? HWCAP_SPARC_VIS2 : 0;
1096     r |= features & CPU_FEATURE_FMAF ? HWCAP_SPARC_FMAF : 0;
1097     r |= features & CPU_FEATURE_VIS3 ? HWCAP_SPARC_VIS3 : 0;
1098     r |= features & CPU_FEATURE_IMA ? HWCAP_SPARC_IMA : 0;
1099 #endif
1100 
1101     return r;
1102 }
1103 
init_thread(struct target_pt_regs * regs,struct image_info * infop)1104 static inline void init_thread(struct target_pt_regs *regs,
1105                                struct image_info *infop)
1106 {
1107     /* Note that target_cpu_copy_regs does not read psr/tstate. */
1108     regs->pc = infop->entry;
1109     regs->npc = regs->pc + 4;
1110     regs->y = 0;
1111     regs->u_regs[14] = (infop->start_stack - 16 * sizeof(abi_ulong)
1112                         - TARGET_STACK_BIAS);
1113 }
1114 #endif /* TARGET_SPARC */
1115 
1116 #ifdef TARGET_PPC
1117 
1118 #define ELF_MACHINE    PPC_ELF_MACHINE
1119 
1120 #if defined(TARGET_PPC64)
1121 
1122 #define elf_check_arch(x) ( (x) == EM_PPC64 )
1123 
1124 #define ELF_CLASS       ELFCLASS64
1125 
1126 #else
1127 
1128 #define ELF_CLASS       ELFCLASS32
1129 #define EXSTACK_DEFAULT true
1130 
1131 #endif
1132 
1133 #define ELF_ARCH        EM_PPC
1134 
1135 /* Feature masks for the Aux Vector Hardware Capabilities (AT_HWCAP).
1136    See arch/powerpc/include/asm/cputable.h.  */
1137 enum {
1138     QEMU_PPC_FEATURE_32 = 0x80000000,
1139     QEMU_PPC_FEATURE_64 = 0x40000000,
1140     QEMU_PPC_FEATURE_601_INSTR = 0x20000000,
1141     QEMU_PPC_FEATURE_HAS_ALTIVEC = 0x10000000,
1142     QEMU_PPC_FEATURE_HAS_FPU = 0x08000000,
1143     QEMU_PPC_FEATURE_HAS_MMU = 0x04000000,
1144     QEMU_PPC_FEATURE_HAS_4xxMAC = 0x02000000,
1145     QEMU_PPC_FEATURE_UNIFIED_CACHE = 0x01000000,
1146     QEMU_PPC_FEATURE_HAS_SPE = 0x00800000,
1147     QEMU_PPC_FEATURE_HAS_EFP_SINGLE = 0x00400000,
1148     QEMU_PPC_FEATURE_HAS_EFP_DOUBLE = 0x00200000,
1149     QEMU_PPC_FEATURE_NO_TB = 0x00100000,
1150     QEMU_PPC_FEATURE_POWER4 = 0x00080000,
1151     QEMU_PPC_FEATURE_POWER5 = 0x00040000,
1152     QEMU_PPC_FEATURE_POWER5_PLUS = 0x00020000,
1153     QEMU_PPC_FEATURE_CELL = 0x00010000,
1154     QEMU_PPC_FEATURE_BOOKE = 0x00008000,
1155     QEMU_PPC_FEATURE_SMT = 0x00004000,
1156     QEMU_PPC_FEATURE_ICACHE_SNOOP = 0x00002000,
1157     QEMU_PPC_FEATURE_ARCH_2_05 = 0x00001000,
1158     QEMU_PPC_FEATURE_PA6T = 0x00000800,
1159     QEMU_PPC_FEATURE_HAS_DFP = 0x00000400,
1160     QEMU_PPC_FEATURE_POWER6_EXT = 0x00000200,
1161     QEMU_PPC_FEATURE_ARCH_2_06 = 0x00000100,
1162     QEMU_PPC_FEATURE_HAS_VSX = 0x00000080,
1163     QEMU_PPC_FEATURE_PSERIES_PERFMON_COMPAT = 0x00000040,
1164 
1165     QEMU_PPC_FEATURE_TRUE_LE = 0x00000002,
1166     QEMU_PPC_FEATURE_PPC_LE = 0x00000001,
1167 
1168     /* Feature definitions in AT_HWCAP2.  */
1169     QEMU_PPC_FEATURE2_ARCH_2_07 = 0x80000000, /* ISA 2.07 */
1170     QEMU_PPC_FEATURE2_HAS_HTM = 0x40000000, /* Hardware Transactional Memory */
1171     QEMU_PPC_FEATURE2_HAS_DSCR = 0x20000000, /* Data Stream Control Register */
1172     QEMU_PPC_FEATURE2_HAS_EBB = 0x10000000, /* Event Base Branching */
1173     QEMU_PPC_FEATURE2_HAS_ISEL = 0x08000000, /* Integer Select */
1174     QEMU_PPC_FEATURE2_HAS_TAR = 0x04000000, /* Target Address Register */
1175     QEMU_PPC_FEATURE2_VEC_CRYPTO = 0x02000000,
1176     QEMU_PPC_FEATURE2_HTM_NOSC = 0x01000000,
1177     QEMU_PPC_FEATURE2_ARCH_3_00 = 0x00800000, /* ISA 3.00 */
1178     QEMU_PPC_FEATURE2_HAS_IEEE128 = 0x00400000, /* VSX IEEE Bin Float 128-bit */
1179     QEMU_PPC_FEATURE2_DARN = 0x00200000, /* darn random number insn */
1180     QEMU_PPC_FEATURE2_SCV = 0x00100000, /* scv syscall */
1181     QEMU_PPC_FEATURE2_HTM_NO_SUSPEND = 0x00080000, /* TM w/o suspended state */
1182     QEMU_PPC_FEATURE2_ARCH_3_1 = 0x00040000, /* ISA 3.1 */
1183     QEMU_PPC_FEATURE2_MMA = 0x00020000, /* Matrix-Multiply Assist */
1184 };
1185 
1186 #define ELF_HWCAP get_elf_hwcap()
1187 
get_elf_hwcap(void)1188 static uint32_t get_elf_hwcap(void)
1189 {
1190     PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);
1191     uint32_t features = 0;
1192 
1193     /* We don't have to be terribly complete here; the high points are
1194        Altivec/FP/SPE support.  Anything else is just a bonus.  */
1195 #define GET_FEATURE(flag, feature)                                      \
1196     do { if (cpu->env.insns_flags & flag) { features |= feature; } } while (0)
1197 #define GET_FEATURE2(flags, feature) \
1198     do { \
1199         if ((cpu->env.insns_flags2 & flags) == flags) { \
1200             features |= feature; \
1201         } \
1202     } while (0)
1203     GET_FEATURE(PPC_64B, QEMU_PPC_FEATURE_64);
1204     GET_FEATURE(PPC_FLOAT, QEMU_PPC_FEATURE_HAS_FPU);
1205     GET_FEATURE(PPC_ALTIVEC, QEMU_PPC_FEATURE_HAS_ALTIVEC);
1206     GET_FEATURE(PPC_SPE, QEMU_PPC_FEATURE_HAS_SPE);
1207     GET_FEATURE(PPC_SPE_SINGLE, QEMU_PPC_FEATURE_HAS_EFP_SINGLE);
1208     GET_FEATURE(PPC_SPE_DOUBLE, QEMU_PPC_FEATURE_HAS_EFP_DOUBLE);
1209     GET_FEATURE(PPC_BOOKE, QEMU_PPC_FEATURE_BOOKE);
1210     GET_FEATURE(PPC_405_MAC, QEMU_PPC_FEATURE_HAS_4xxMAC);
1211     GET_FEATURE2(PPC2_DFP, QEMU_PPC_FEATURE_HAS_DFP);
1212     GET_FEATURE2(PPC2_VSX, QEMU_PPC_FEATURE_HAS_VSX);
1213     GET_FEATURE2((PPC2_PERM_ISA206 | PPC2_DIVE_ISA206 | PPC2_ATOMIC_ISA206 |
1214                   PPC2_FP_CVT_ISA206 | PPC2_FP_TST_ISA206),
1215                   QEMU_PPC_FEATURE_ARCH_2_06);
1216 #undef GET_FEATURE
1217 #undef GET_FEATURE2
1218 
1219     return features;
1220 }
1221 
1222 #define ELF_HWCAP2 get_elf_hwcap2()
1223 
get_elf_hwcap2(void)1224 static uint32_t get_elf_hwcap2(void)
1225 {
1226     PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);
1227     uint32_t features = 0;
1228 
1229 #define GET_FEATURE(flag, feature)                                      \
1230     do { if (cpu->env.insns_flags & flag) { features |= feature; } } while (0)
1231 #define GET_FEATURE2(flag, feature)                                      \
1232     do { if (cpu->env.insns_flags2 & flag) { features |= feature; } } while (0)
1233 
1234     GET_FEATURE(PPC_ISEL, QEMU_PPC_FEATURE2_HAS_ISEL);
1235     GET_FEATURE2(PPC2_BCTAR_ISA207, QEMU_PPC_FEATURE2_HAS_TAR);
1236     GET_FEATURE2((PPC2_BCTAR_ISA207 | PPC2_LSQ_ISA207 | PPC2_ALTIVEC_207 |
1237                   PPC2_ISA207S), QEMU_PPC_FEATURE2_ARCH_2_07 |
1238                   QEMU_PPC_FEATURE2_VEC_CRYPTO);
1239     GET_FEATURE2(PPC2_ISA300, QEMU_PPC_FEATURE2_ARCH_3_00 |
1240                  QEMU_PPC_FEATURE2_DARN | QEMU_PPC_FEATURE2_HAS_IEEE128);
1241     GET_FEATURE2(PPC2_ISA310, QEMU_PPC_FEATURE2_ARCH_3_1 |
1242                  QEMU_PPC_FEATURE2_MMA);
1243 
1244 #undef GET_FEATURE
1245 #undef GET_FEATURE2
1246 
1247     return features;
1248 }
1249 
1250 /*
1251  * The requirements here are:
1252  * - keep the final alignment of sp (sp & 0xf)
1253  * - make sure the 32-bit value at the first 16 byte aligned position of
1254  *   AUXV is greater than 16 for glibc compatibility.
1255  *   AT_IGNOREPPC is used for that.
1256  * - for compatibility with glibc ARCH_DLINFO must always be defined on PPC,
1257  *   even if DLINFO_ARCH_ITEMS goes to zero or is undefined.
1258  */
1259 #define DLINFO_ARCH_ITEMS       5
1260 #define ARCH_DLINFO                                     \
1261     do {                                                \
1262         PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);              \
1263         /*                                              \
1264          * Handle glibc compatibility: these magic entries must \
1265          * be at the lowest addresses in the final auxv.        \
1266          */                                             \
1267         NEW_AUX_ENT(AT_IGNOREPPC, AT_IGNOREPPC);        \
1268         NEW_AUX_ENT(AT_IGNOREPPC, AT_IGNOREPPC);        \
1269         NEW_AUX_ENT(AT_DCACHEBSIZE, cpu->env.dcache_line_size); \
1270         NEW_AUX_ENT(AT_ICACHEBSIZE, cpu->env.icache_line_size); \
1271         NEW_AUX_ENT(AT_UCACHEBSIZE, 0);                 \
1272     } while (0)
1273 
init_thread(struct target_pt_regs * _regs,struct image_info * infop)1274 static inline void init_thread(struct target_pt_regs *_regs, struct image_info *infop)
1275 {
1276     _regs->gpr[1] = infop->start_stack;
1277 #if defined(TARGET_PPC64)
1278     if (get_ppc64_abi(infop) < 2) {
1279         uint64_t val;
1280         get_user_u64(val, infop->entry + 8);
1281         _regs->gpr[2] = val + infop->load_bias;
1282         get_user_u64(val, infop->entry);
1283         infop->entry = val + infop->load_bias;
1284     } else {
1285         _regs->gpr[12] = infop->entry;  /* r12 set to global entry address */
1286     }
1287 #endif
1288     _regs->nip = infop->entry;
1289 }
1290 
1291 /* See linux kernel: arch/powerpc/include/asm/elf.h.  */
1292 #define ELF_NREG 48
1293 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1294 
elf_core_copy_regs(target_elf_gregset_t * regs,const CPUPPCState * env)1295 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *env)
1296 {
1297     int i;
1298     target_ulong ccr = 0;
1299 
1300     for (i = 0; i < ARRAY_SIZE(env->gpr); i++) {
1301         (*regs)[i] = tswapreg(env->gpr[i]);
1302     }
1303 
1304     (*regs)[32] = tswapreg(env->nip);
1305     (*regs)[33] = tswapreg(env->msr);
1306     (*regs)[35] = tswapreg(env->ctr);
1307     (*regs)[36] = tswapreg(env->lr);
1308     (*regs)[37] = tswapreg(cpu_read_xer(env));
1309 
1310     ccr = ppc_get_cr(env);
1311     (*regs)[38] = tswapreg(ccr);
1312 }
1313 
1314 #define USE_ELF_CORE_DUMP
1315 #define ELF_EXEC_PAGESIZE       4096
1316 
1317 #ifndef TARGET_PPC64
1318 # define VDSO_HEADER  "vdso-32.c.inc"
1319 #elif TARGET_BIG_ENDIAN
1320 # define VDSO_HEADER  "vdso-64.c.inc"
1321 #else
1322 # define VDSO_HEADER  "vdso-64le.c.inc"
1323 #endif
1324 
1325 #endif
1326 
1327 #ifdef TARGET_LOONGARCH64
1328 
1329 #define ELF_CLASS   ELFCLASS64
1330 #define ELF_ARCH    EM_LOONGARCH
1331 #define EXSTACK_DEFAULT true
1332 
1333 #define elf_check_arch(x) ((x) == EM_LOONGARCH)
1334 
1335 #define VDSO_HEADER "vdso.c.inc"
1336 
init_thread(struct target_pt_regs * regs,struct image_info * infop)1337 static inline void init_thread(struct target_pt_regs *regs,
1338                                struct image_info *infop)
1339 {
1340     /*Set crmd PG,DA = 1,0 */
1341     regs->csr.crmd = 2 << 3;
1342     regs->csr.era = infop->entry;
1343     regs->regs[3] = infop->start_stack;
1344 }
1345 
1346 /* See linux kernel: arch/loongarch/include/asm/elf.h */
1347 #define ELF_NREG 45
1348 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1349 
1350 enum {
1351     TARGET_EF_R0 = 0,
1352     TARGET_EF_CSR_ERA = TARGET_EF_R0 + 33,
1353     TARGET_EF_CSR_BADV = TARGET_EF_R0 + 34,
1354 };
1355 
elf_core_copy_regs(target_elf_gregset_t * regs,const CPULoongArchState * env)1356 static void elf_core_copy_regs(target_elf_gregset_t *regs,
1357                                const CPULoongArchState *env)
1358 {
1359     int i;
1360 
1361     (*regs)[TARGET_EF_R0] = 0;
1362 
1363     for (i = 1; i < ARRAY_SIZE(env->gpr); i++) {
1364         (*regs)[TARGET_EF_R0 + i] = tswapreg(env->gpr[i]);
1365     }
1366 
1367     (*regs)[TARGET_EF_CSR_ERA] = tswapreg(env->pc);
1368     (*regs)[TARGET_EF_CSR_BADV] = tswapreg(env->CSR_BADV);
1369 }
1370 
1371 #define USE_ELF_CORE_DUMP
1372 #define ELF_EXEC_PAGESIZE        4096
1373 
1374 #define ELF_HWCAP get_elf_hwcap()
1375 
1376 /* See arch/loongarch/include/uapi/asm/hwcap.h */
1377 enum {
1378     HWCAP_LOONGARCH_CPUCFG   = (1 << 0),
1379     HWCAP_LOONGARCH_LAM      = (1 << 1),
1380     HWCAP_LOONGARCH_UAL      = (1 << 2),
1381     HWCAP_LOONGARCH_FPU      = (1 << 3),
1382     HWCAP_LOONGARCH_LSX      = (1 << 4),
1383     HWCAP_LOONGARCH_LASX     = (1 << 5),
1384     HWCAP_LOONGARCH_CRC32    = (1 << 6),
1385     HWCAP_LOONGARCH_COMPLEX  = (1 << 7),
1386     HWCAP_LOONGARCH_CRYPTO   = (1 << 8),
1387     HWCAP_LOONGARCH_LVZ      = (1 << 9),
1388     HWCAP_LOONGARCH_LBT_X86  = (1 << 10),
1389     HWCAP_LOONGARCH_LBT_ARM  = (1 << 11),
1390     HWCAP_LOONGARCH_LBT_MIPS = (1 << 12),
1391 };
1392 
get_elf_hwcap(void)1393 static uint32_t get_elf_hwcap(void)
1394 {
1395     LoongArchCPU *cpu = LOONGARCH_CPU(thread_cpu);
1396     uint32_t hwcaps = 0;
1397 
1398     hwcaps |= HWCAP_LOONGARCH_CRC32;
1399 
1400     if (FIELD_EX32(cpu->env.cpucfg[1], CPUCFG1, UAL)) {
1401         hwcaps |= HWCAP_LOONGARCH_UAL;
1402     }
1403 
1404     if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, FP)) {
1405         hwcaps |= HWCAP_LOONGARCH_FPU;
1406     }
1407 
1408     if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LAM)) {
1409         hwcaps |= HWCAP_LOONGARCH_LAM;
1410     }
1411 
1412     if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LSX)) {
1413         hwcaps |= HWCAP_LOONGARCH_LSX;
1414     }
1415 
1416     if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LASX)) {
1417         hwcaps |= HWCAP_LOONGARCH_LASX;
1418     }
1419 
1420     return hwcaps;
1421 }
1422 
1423 #define ELF_PLATFORM "loongarch"
1424 
1425 #endif /* TARGET_LOONGARCH64 */
1426 
1427 #ifdef TARGET_MIPS
1428 
1429 #ifdef TARGET_MIPS64
1430 #define ELF_CLASS   ELFCLASS64
1431 #else
1432 #define ELF_CLASS   ELFCLASS32
1433 #endif
1434 #define ELF_ARCH    EM_MIPS
1435 #define EXSTACK_DEFAULT true
1436 
1437 #ifdef TARGET_ABI_MIPSN32
1438 #define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
1439 #else
1440 #define elf_check_abi(x) (!((x) & EF_MIPS_ABI2))
1441 #endif
1442 
1443 #define ELF_BASE_PLATFORM get_elf_base_platform()
1444 
1445 #define MATCH_PLATFORM_INSN(_flags, _base_platform)      \
1446     do { if ((cpu->env.insn_flags & (_flags)) == _flags) \
1447     { return _base_platform; } } while (0)
1448 
get_elf_base_platform(void)1449 static const char *get_elf_base_platform(void)
1450 {
1451     MIPSCPU *cpu = MIPS_CPU(thread_cpu);
1452 
1453     /* 64 bit ISAs goes first */
1454     MATCH_PLATFORM_INSN(CPU_MIPS64R6, "mips64r6");
1455     MATCH_PLATFORM_INSN(CPU_MIPS64R5, "mips64r5");
1456     MATCH_PLATFORM_INSN(CPU_MIPS64R2, "mips64r2");
1457     MATCH_PLATFORM_INSN(CPU_MIPS64R1, "mips64");
1458     MATCH_PLATFORM_INSN(CPU_MIPS5, "mips5");
1459     MATCH_PLATFORM_INSN(CPU_MIPS4, "mips4");
1460     MATCH_PLATFORM_INSN(CPU_MIPS3, "mips3");
1461 
1462     /* 32 bit ISAs */
1463     MATCH_PLATFORM_INSN(CPU_MIPS32R6, "mips32r6");
1464     MATCH_PLATFORM_INSN(CPU_MIPS32R5, "mips32r5");
1465     MATCH_PLATFORM_INSN(CPU_MIPS32R2, "mips32r2");
1466     MATCH_PLATFORM_INSN(CPU_MIPS32R1, "mips32");
1467     MATCH_PLATFORM_INSN(CPU_MIPS2, "mips2");
1468 
1469     /* Fallback */
1470     return "mips";
1471 }
1472 #undef MATCH_PLATFORM_INSN
1473 
init_thread(struct target_pt_regs * regs,struct image_info * infop)1474 static inline void init_thread(struct target_pt_regs *regs,
1475                                struct image_info *infop)
1476 {
1477     regs->cp0_status = 2 << CP0St_KSU;
1478     regs->cp0_epc = infop->entry;
1479     regs->regs[29] = infop->start_stack;
1480 }
1481 
1482 /* See linux kernel: arch/mips/include/asm/elf.h.  */
1483 #define ELF_NREG 45
1484 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1485 
1486 /* See linux kernel: arch/mips/include/asm/reg.h.  */
1487 enum {
1488 #ifdef TARGET_MIPS64
1489     TARGET_EF_R0 = 0,
1490 #else
1491     TARGET_EF_R0 = 6,
1492 #endif
1493     TARGET_EF_R26 = TARGET_EF_R0 + 26,
1494     TARGET_EF_R27 = TARGET_EF_R0 + 27,
1495     TARGET_EF_LO = TARGET_EF_R0 + 32,
1496     TARGET_EF_HI = TARGET_EF_R0 + 33,
1497     TARGET_EF_CP0_EPC = TARGET_EF_R0 + 34,
1498     TARGET_EF_CP0_BADVADDR = TARGET_EF_R0 + 35,
1499     TARGET_EF_CP0_STATUS = TARGET_EF_R0 + 36,
1500     TARGET_EF_CP0_CAUSE = TARGET_EF_R0 + 37
1501 };
1502 
1503 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
elf_core_copy_regs(target_elf_gregset_t * regs,const CPUMIPSState * env)1504 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMIPSState *env)
1505 {
1506     int i;
1507 
1508     for (i = 0; i < TARGET_EF_R0; i++) {
1509         (*regs)[i] = 0;
1510     }
1511     (*regs)[TARGET_EF_R0] = 0;
1512 
1513     for (i = 1; i < ARRAY_SIZE(env->active_tc.gpr); i++) {
1514         (*regs)[TARGET_EF_R0 + i] = tswapreg(env->active_tc.gpr[i]);
1515     }
1516 
1517     (*regs)[TARGET_EF_R26] = 0;
1518     (*regs)[TARGET_EF_R27] = 0;
1519     (*regs)[TARGET_EF_LO] = tswapreg(env->active_tc.LO[0]);
1520     (*regs)[TARGET_EF_HI] = tswapreg(env->active_tc.HI[0]);
1521     (*regs)[TARGET_EF_CP0_EPC] = tswapreg(env->active_tc.PC);
1522     (*regs)[TARGET_EF_CP0_BADVADDR] = tswapreg(env->CP0_BadVAddr);
1523     (*regs)[TARGET_EF_CP0_STATUS] = tswapreg(env->CP0_Status);
1524     (*regs)[TARGET_EF_CP0_CAUSE] = tswapreg(env->CP0_Cause);
1525 }
1526 
1527 #define USE_ELF_CORE_DUMP
1528 #define ELF_EXEC_PAGESIZE        4096
1529 
1530 /* See arch/mips/include/uapi/asm/hwcap.h.  */
1531 enum {
1532     HWCAP_MIPS_R6           = (1 << 0),
1533     HWCAP_MIPS_MSA          = (1 << 1),
1534     HWCAP_MIPS_CRC32        = (1 << 2),
1535     HWCAP_MIPS_MIPS16       = (1 << 3),
1536     HWCAP_MIPS_MDMX         = (1 << 4),
1537     HWCAP_MIPS_MIPS3D       = (1 << 5),
1538     HWCAP_MIPS_SMARTMIPS    = (1 << 6),
1539     HWCAP_MIPS_DSP          = (1 << 7),
1540     HWCAP_MIPS_DSP2         = (1 << 8),
1541     HWCAP_MIPS_DSP3         = (1 << 9),
1542     HWCAP_MIPS_MIPS16E2     = (1 << 10),
1543     HWCAP_LOONGSON_MMI      = (1 << 11),
1544     HWCAP_LOONGSON_EXT      = (1 << 12),
1545     HWCAP_LOONGSON_EXT2     = (1 << 13),
1546     HWCAP_LOONGSON_CPUCFG   = (1 << 14),
1547 };
1548 
1549 #define ELF_HWCAP get_elf_hwcap()
1550 
1551 #define GET_FEATURE_INSN(_flag, _hwcap) \
1552     do { if (cpu->env.insn_flags & (_flag)) { hwcaps |= _hwcap; } } while (0)
1553 
1554 #define GET_FEATURE_REG_SET(_reg, _mask, _hwcap) \
1555     do { if (cpu->env._reg & (_mask)) { hwcaps |= _hwcap; } } while (0)
1556 
1557 #define GET_FEATURE_REG_EQU(_reg, _start, _length, _val, _hwcap) \
1558     do { \
1559         if (extract32(cpu->env._reg, (_start), (_length)) == (_val)) { \
1560             hwcaps |= _hwcap; \
1561         } \
1562     } while (0)
1563 
get_elf_hwcap(void)1564 static uint32_t get_elf_hwcap(void)
1565 {
1566     MIPSCPU *cpu = MIPS_CPU(thread_cpu);
1567     uint32_t hwcaps = 0;
1568 
1569     GET_FEATURE_REG_EQU(CP0_Config0, CP0C0_AR, CP0C0_AR_LENGTH,
1570                         2, HWCAP_MIPS_R6);
1571     GET_FEATURE_REG_SET(CP0_Config3, 1 << CP0C3_MSAP, HWCAP_MIPS_MSA);
1572     GET_FEATURE_INSN(ASE_LMMI, HWCAP_LOONGSON_MMI);
1573     GET_FEATURE_INSN(ASE_LEXT, HWCAP_LOONGSON_EXT);
1574 
1575     return hwcaps;
1576 }
1577 
1578 #undef GET_FEATURE_REG_EQU
1579 #undef GET_FEATURE_REG_SET
1580 #undef GET_FEATURE_INSN
1581 
1582 #endif /* TARGET_MIPS */
1583 
1584 #ifdef TARGET_MICROBLAZE
1585 
1586 #define elf_check_arch(x) ( (x) == EM_MICROBLAZE || (x) == EM_MICROBLAZE_OLD)
1587 
1588 #define ELF_CLASS   ELFCLASS32
1589 #define ELF_ARCH    EM_MICROBLAZE
1590 
init_thread(struct target_pt_regs * regs,struct image_info * infop)1591 static inline void init_thread(struct target_pt_regs *regs,
1592                                struct image_info *infop)
1593 {
1594     regs->pc = infop->entry;
1595     regs->r1 = infop->start_stack;
1596 
1597 }
1598 
1599 #define ELF_EXEC_PAGESIZE        4096
1600 
1601 #define USE_ELF_CORE_DUMP
1602 #define ELF_NREG 38
1603 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1604 
1605 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
elf_core_copy_regs(target_elf_gregset_t * regs,const CPUMBState * env)1606 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMBState *env)
1607 {
1608     int i, pos = 0;
1609 
1610     for (i = 0; i < 32; i++) {
1611         (*regs)[pos++] = tswapreg(env->regs[i]);
1612     }
1613 
1614     (*regs)[pos++] = tswapreg(env->pc);
1615     (*regs)[pos++] = tswapreg(mb_cpu_read_msr(env));
1616     (*regs)[pos++] = 0;
1617     (*regs)[pos++] = tswapreg(env->ear);
1618     (*regs)[pos++] = 0;
1619     (*regs)[pos++] = tswapreg(env->esr);
1620 }
1621 
1622 #endif /* TARGET_MICROBLAZE */
1623 
1624 #ifdef TARGET_OPENRISC
1625 
1626 #define ELF_ARCH EM_OPENRISC
1627 #define ELF_CLASS ELFCLASS32
1628 #define ELF_DATA  ELFDATA2MSB
1629 
init_thread(struct target_pt_regs * regs,struct image_info * infop)1630 static inline void init_thread(struct target_pt_regs *regs,
1631                                struct image_info *infop)
1632 {
1633     regs->pc = infop->entry;
1634     regs->gpr[1] = infop->start_stack;
1635 }
1636 
1637 #define USE_ELF_CORE_DUMP
1638 #define ELF_EXEC_PAGESIZE 8192
1639 
1640 /* See linux kernel arch/openrisc/include/asm/elf.h.  */
1641 #define ELF_NREG 34 /* gprs and pc, sr */
1642 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1643 
elf_core_copy_regs(target_elf_gregset_t * regs,const CPUOpenRISCState * env)1644 static void elf_core_copy_regs(target_elf_gregset_t *regs,
1645                                const CPUOpenRISCState *env)
1646 {
1647     int i;
1648 
1649     for (i = 0; i < 32; i++) {
1650         (*regs)[i] = tswapreg(cpu_get_gpr(env, i));
1651     }
1652     (*regs)[32] = tswapreg(env->pc);
1653     (*regs)[33] = tswapreg(cpu_get_sr(env));
1654 }
1655 #define ELF_HWCAP 0
1656 #define ELF_PLATFORM NULL
1657 
1658 #endif /* TARGET_OPENRISC */
1659 
1660 #ifdef TARGET_SH4
1661 
1662 #define ELF_CLASS ELFCLASS32
1663 #define ELF_ARCH  EM_SH
1664 
init_thread(struct target_pt_regs * regs,struct image_info * infop)1665 static inline void init_thread(struct target_pt_regs *regs,
1666                                struct image_info *infop)
1667 {
1668     /* Check other registers XXXXX */
1669     regs->pc = infop->entry;
1670     regs->regs[15] = infop->start_stack;
1671 }
1672 
1673 /* See linux kernel: arch/sh/include/asm/elf.h.  */
1674 #define ELF_NREG 23
1675 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1676 
1677 /* See linux kernel: arch/sh/include/asm/ptrace.h.  */
1678 enum {
1679     TARGET_REG_PC = 16,
1680     TARGET_REG_PR = 17,
1681     TARGET_REG_SR = 18,
1682     TARGET_REG_GBR = 19,
1683     TARGET_REG_MACH = 20,
1684     TARGET_REG_MACL = 21,
1685     TARGET_REG_SYSCALL = 22
1686 };
1687 
elf_core_copy_regs(target_elf_gregset_t * regs,const CPUSH4State * env)1688 static inline void elf_core_copy_regs(target_elf_gregset_t *regs,
1689                                       const CPUSH4State *env)
1690 {
1691     int i;
1692 
1693     for (i = 0; i < 16; i++) {
1694         (*regs)[i] = tswapreg(env->gregs[i]);
1695     }
1696 
1697     (*regs)[TARGET_REG_PC] = tswapreg(env->pc);
1698     (*regs)[TARGET_REG_PR] = tswapreg(env->pr);
1699     (*regs)[TARGET_REG_SR] = tswapreg(env->sr);
1700     (*regs)[TARGET_REG_GBR] = tswapreg(env->gbr);
1701     (*regs)[TARGET_REG_MACH] = tswapreg(env->mach);
1702     (*regs)[TARGET_REG_MACL] = tswapreg(env->macl);
1703     (*regs)[TARGET_REG_SYSCALL] = 0; /* FIXME */
1704 }
1705 
1706 #define USE_ELF_CORE_DUMP
1707 #define ELF_EXEC_PAGESIZE        4096
1708 
1709 enum {
1710     SH_CPU_HAS_FPU            = 0x0001, /* Hardware FPU support */
1711     SH_CPU_HAS_P2_FLUSH_BUG   = 0x0002, /* Need to flush the cache in P2 area */
1712     SH_CPU_HAS_MMU_PAGE_ASSOC = 0x0004, /* SH3: TLB way selection bit support */
1713     SH_CPU_HAS_DSP            = 0x0008, /* SH-DSP: DSP support */
1714     SH_CPU_HAS_PERF_COUNTER   = 0x0010, /* Hardware performance counters */
1715     SH_CPU_HAS_PTEA           = 0x0020, /* PTEA register */
1716     SH_CPU_HAS_LLSC           = 0x0040, /* movli.l/movco.l */
1717     SH_CPU_HAS_L2_CACHE       = 0x0080, /* Secondary cache / URAM */
1718     SH_CPU_HAS_OP32           = 0x0100, /* 32-bit instruction support */
1719     SH_CPU_HAS_PTEAEX         = 0x0200, /* PTE ASID Extension support */
1720 };
1721 
1722 #define ELF_HWCAP get_elf_hwcap()
1723 
get_elf_hwcap(void)1724 static uint32_t get_elf_hwcap(void)
1725 {
1726     SuperHCPU *cpu = SUPERH_CPU(thread_cpu);
1727     uint32_t hwcap = 0;
1728 
1729     hwcap |= SH_CPU_HAS_FPU;
1730 
1731     if (cpu->env.features & SH_FEATURE_SH4A) {
1732         hwcap |= SH_CPU_HAS_LLSC;
1733     }
1734 
1735     return hwcap;
1736 }
1737 
1738 #endif
1739 
1740 #ifdef TARGET_M68K
1741 
1742 #define ELF_CLASS       ELFCLASS32
1743 #define ELF_ARCH        EM_68K
1744 
1745 /* ??? Does this need to do anything?
1746    #define ELF_PLAT_INIT(_r) */
1747 
init_thread(struct target_pt_regs * regs,struct image_info * infop)1748 static inline void init_thread(struct target_pt_regs *regs,
1749                                struct image_info *infop)
1750 {
1751     regs->usp = infop->start_stack;
1752     regs->sr = 0;
1753     regs->pc = infop->entry;
1754 }
1755 
1756 /* See linux kernel: arch/m68k/include/asm/elf.h.  */
1757 #define ELF_NREG 20
1758 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1759 
elf_core_copy_regs(target_elf_gregset_t * regs,const CPUM68KState * env)1760 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUM68KState *env)
1761 {
1762     (*regs)[0] = tswapreg(env->dregs[1]);
1763     (*regs)[1] = tswapreg(env->dregs[2]);
1764     (*regs)[2] = tswapreg(env->dregs[3]);
1765     (*regs)[3] = tswapreg(env->dregs[4]);
1766     (*regs)[4] = tswapreg(env->dregs[5]);
1767     (*regs)[5] = tswapreg(env->dregs[6]);
1768     (*regs)[6] = tswapreg(env->dregs[7]);
1769     (*regs)[7] = tswapreg(env->aregs[0]);
1770     (*regs)[8] = tswapreg(env->aregs[1]);
1771     (*regs)[9] = tswapreg(env->aregs[2]);
1772     (*regs)[10] = tswapreg(env->aregs[3]);
1773     (*regs)[11] = tswapreg(env->aregs[4]);
1774     (*regs)[12] = tswapreg(env->aregs[5]);
1775     (*regs)[13] = tswapreg(env->aregs[6]);
1776     (*regs)[14] = tswapreg(env->dregs[0]);
1777     (*regs)[15] = tswapreg(env->aregs[7]);
1778     (*regs)[16] = tswapreg(env->dregs[0]); /* FIXME: orig_d0 */
1779     (*regs)[17] = tswapreg(env->sr);
1780     (*regs)[18] = tswapreg(env->pc);
1781     (*regs)[19] = 0;  /* FIXME: regs->format | regs->vector */
1782 }
1783 
1784 #define USE_ELF_CORE_DUMP
1785 #define ELF_EXEC_PAGESIZE       8192
1786 
1787 #endif
1788 
1789 #ifdef TARGET_ALPHA
1790 
1791 #define ELF_CLASS      ELFCLASS64
1792 #define ELF_ARCH       EM_ALPHA
1793 
init_thread(struct target_pt_regs * regs,struct image_info * infop)1794 static inline void init_thread(struct target_pt_regs *regs,
1795                                struct image_info *infop)
1796 {
1797     regs->pc = infop->entry;
1798     regs->ps = 8;
1799     regs->usp = infop->start_stack;
1800 }
1801 
1802 #define ELF_EXEC_PAGESIZE        8192
1803 
1804 #endif /* TARGET_ALPHA */
1805 
1806 #ifdef TARGET_S390X
1807 
1808 #define ELF_CLASS	ELFCLASS64
1809 #define ELF_DATA	ELFDATA2MSB
1810 #define ELF_ARCH	EM_S390
1811 
1812 #include "elf.h"
1813 
1814 #define ELF_HWCAP get_elf_hwcap()
1815 
1816 #define GET_FEATURE(_feat, _hwcap) \
1817     do { if (s390_has_feat(_feat)) { hwcap |= _hwcap; } } while (0)
1818 
get_elf_hwcap(void)1819 uint32_t get_elf_hwcap(void)
1820 {
1821     /*
1822      * Let's assume we always have esan3 and zarch.
1823      * 31-bit processes can use 64-bit registers (high gprs).
1824      */
1825     uint32_t hwcap = HWCAP_S390_ESAN3 | HWCAP_S390_ZARCH | HWCAP_S390_HIGH_GPRS;
1826 
1827     GET_FEATURE(S390_FEAT_STFLE, HWCAP_S390_STFLE);
1828     GET_FEATURE(S390_FEAT_MSA, HWCAP_S390_MSA);
1829     GET_FEATURE(S390_FEAT_LONG_DISPLACEMENT, HWCAP_S390_LDISP);
1830     GET_FEATURE(S390_FEAT_EXTENDED_IMMEDIATE, HWCAP_S390_EIMM);
1831     if (s390_has_feat(S390_FEAT_EXTENDED_TRANSLATION_3) &&
1832         s390_has_feat(S390_FEAT_ETF3_ENH)) {
1833         hwcap |= HWCAP_S390_ETF3EH;
1834     }
1835     GET_FEATURE(S390_FEAT_VECTOR, HWCAP_S390_VXRS);
1836     GET_FEATURE(S390_FEAT_VECTOR_ENH, HWCAP_S390_VXRS_EXT);
1837     GET_FEATURE(S390_FEAT_VECTOR_ENH2, HWCAP_S390_VXRS_EXT2);
1838 
1839     return hwcap;
1840 }
1841 
elf_hwcap_str(uint32_t bit)1842 const char *elf_hwcap_str(uint32_t bit)
1843 {
1844     static const char *hwcap_str[] = {
1845         [HWCAP_S390_NR_ESAN3]     = "esan3",
1846         [HWCAP_S390_NR_ZARCH]     = "zarch",
1847         [HWCAP_S390_NR_STFLE]     = "stfle",
1848         [HWCAP_S390_NR_MSA]       = "msa",
1849         [HWCAP_S390_NR_LDISP]     = "ldisp",
1850         [HWCAP_S390_NR_EIMM]      = "eimm",
1851         [HWCAP_S390_NR_DFP]       = "dfp",
1852         [HWCAP_S390_NR_HPAGE]     = "edat",
1853         [HWCAP_S390_NR_ETF3EH]    = "etf3eh",
1854         [HWCAP_S390_NR_HIGH_GPRS] = "highgprs",
1855         [HWCAP_S390_NR_TE]        = "te",
1856         [HWCAP_S390_NR_VXRS]      = "vx",
1857         [HWCAP_S390_NR_VXRS_BCD]  = "vxd",
1858         [HWCAP_S390_NR_VXRS_EXT]  = "vxe",
1859         [HWCAP_S390_NR_GS]        = "gs",
1860         [HWCAP_S390_NR_VXRS_EXT2] = "vxe2",
1861         [HWCAP_S390_NR_VXRS_PDE]  = "vxp",
1862         [HWCAP_S390_NR_SORT]      = "sort",
1863         [HWCAP_S390_NR_DFLT]      = "dflt",
1864         [HWCAP_S390_NR_NNPA]      = "nnpa",
1865         [HWCAP_S390_NR_PCI_MIO]   = "pcimio",
1866         [HWCAP_S390_NR_SIE]       = "sie",
1867     };
1868 
1869     return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
1870 }
1871 
init_thread(struct target_pt_regs * regs,struct image_info * infop)1872 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
1873 {
1874     regs->psw.addr = infop->entry;
1875     regs->psw.mask = PSW_MASK_DAT | PSW_MASK_IO | PSW_MASK_EXT | \
1876                      PSW_MASK_MCHECK | PSW_MASK_PSTATE | PSW_MASK_64 | \
1877                      PSW_MASK_32;
1878     regs->gprs[15] = infop->start_stack;
1879 }
1880 
1881 /* See linux kernel: arch/s390/include/uapi/asm/ptrace.h (s390_regs).  */
1882 #define ELF_NREG 27
1883 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1884 
1885 enum {
1886     TARGET_REG_PSWM = 0,
1887     TARGET_REG_PSWA = 1,
1888     TARGET_REG_GPRS = 2,
1889     TARGET_REG_ARS = 18,
1890     TARGET_REG_ORIG_R2 = 26,
1891 };
1892 
elf_core_copy_regs(target_elf_gregset_t * regs,const CPUS390XState * env)1893 static void elf_core_copy_regs(target_elf_gregset_t *regs,
1894                                const CPUS390XState *env)
1895 {
1896     int i;
1897     uint32_t *aregs;
1898 
1899     (*regs)[TARGET_REG_PSWM] = tswapreg(env->psw.mask);
1900     (*regs)[TARGET_REG_PSWA] = tswapreg(env->psw.addr);
1901     for (i = 0; i < 16; i++) {
1902         (*regs)[TARGET_REG_GPRS + i] = tswapreg(env->regs[i]);
1903     }
1904     aregs = (uint32_t *)&((*regs)[TARGET_REG_ARS]);
1905     for (i = 0; i < 16; i++) {
1906         aregs[i] = tswap32(env->aregs[i]);
1907     }
1908     (*regs)[TARGET_REG_ORIG_R2] = 0;
1909 }
1910 
1911 #define USE_ELF_CORE_DUMP
1912 #define ELF_EXEC_PAGESIZE 4096
1913 
1914 #define VDSO_HEADER "vdso.c.inc"
1915 
1916 #endif /* TARGET_S390X */
1917 
1918 #ifdef TARGET_RISCV
1919 
1920 #define ELF_ARCH  EM_RISCV
1921 
1922 #ifdef TARGET_RISCV32
1923 #define ELF_CLASS ELFCLASS32
1924 #define VDSO_HEADER "vdso-32.c.inc"
1925 #else
1926 #define ELF_CLASS ELFCLASS64
1927 #define VDSO_HEADER "vdso-64.c.inc"
1928 #endif
1929 
1930 #define ELF_HWCAP get_elf_hwcap()
1931 
get_elf_hwcap(void)1932 static uint32_t get_elf_hwcap(void)
1933 {
1934 #define MISA_BIT(EXT) (1 << (EXT - 'A'))
1935     RISCVCPU *cpu = RISCV_CPU(thread_cpu);
1936     uint32_t mask = MISA_BIT('I') | MISA_BIT('M') | MISA_BIT('A')
1937                     | MISA_BIT('F') | MISA_BIT('D') | MISA_BIT('C')
1938                     | MISA_BIT('V');
1939 
1940     return cpu->env.misa_ext & mask;
1941 #undef MISA_BIT
1942 }
1943 
init_thread(struct target_pt_regs * regs,struct image_info * infop)1944 static inline void init_thread(struct target_pt_regs *regs,
1945                                struct image_info *infop)
1946 {
1947     regs->sepc = infop->entry;
1948     regs->sp = infop->start_stack;
1949 }
1950 
1951 #define ELF_EXEC_PAGESIZE 4096
1952 
1953 #endif /* TARGET_RISCV */
1954 
1955 #ifdef TARGET_HPPA
1956 
1957 #define ELF_CLASS       ELFCLASS32
1958 #define ELF_ARCH        EM_PARISC
1959 #define ELF_PLATFORM    "PARISC"
1960 #define STACK_GROWS_DOWN 0
1961 #define STACK_ALIGNMENT  64
1962 
1963 #define VDSO_HEADER "vdso.c.inc"
1964 
init_thread(struct target_pt_regs * regs,struct image_info * infop)1965 static inline void init_thread(struct target_pt_regs *regs,
1966                                struct image_info *infop)
1967 {
1968     regs->iaoq[0] = infop->entry | PRIV_USER;
1969     regs->iaoq[1] = regs->iaoq[0] + 4;
1970     regs->gr[23] = 0;
1971     regs->gr[24] = infop->argv;
1972     regs->gr[25] = infop->argc;
1973     /* The top-of-stack contains a linkage buffer.  */
1974     regs->gr[30] = infop->start_stack + 64;
1975     regs->gr[31] = infop->entry;
1976 }
1977 
1978 #define LO_COMMPAGE  0
1979 
init_guest_commpage(void)1980 static bool init_guest_commpage(void)
1981 {
1982     /* If reserved_va, then we have already mapped 0 page on the host. */
1983     if (!reserved_va) {
1984         void *want, *addr;
1985 
1986         want = g2h_untagged(LO_COMMPAGE);
1987         addr = mmap(want, TARGET_PAGE_SIZE, PROT_NONE,
1988                     MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED_NOREPLACE, -1, 0);
1989         if (addr == MAP_FAILED) {
1990             perror("Allocating guest commpage");
1991             exit(EXIT_FAILURE);
1992         }
1993         if (addr != want) {
1994             return false;
1995         }
1996     }
1997 
1998     /*
1999      * On Linux, page zero is normally marked execute only + gateway.
2000      * Normal read or write is supposed to fail (thus PROT_NONE above),
2001      * but specific offsets have kernel code mapped to raise permissions
2002      * and implement syscalls.  Here, simply mark the page executable.
2003      * Special case the entry points during translation (see do_page_zero).
2004      */
2005     page_set_flags(LO_COMMPAGE, LO_COMMPAGE | ~TARGET_PAGE_MASK,
2006                    PAGE_EXEC | PAGE_VALID);
2007     return true;
2008 }
2009 
2010 #endif /* TARGET_HPPA */
2011 
2012 #ifdef TARGET_XTENSA
2013 
2014 #define ELF_CLASS       ELFCLASS32
2015 #define ELF_ARCH        EM_XTENSA
2016 
init_thread(struct target_pt_regs * regs,struct image_info * infop)2017 static inline void init_thread(struct target_pt_regs *regs,
2018                                struct image_info *infop)
2019 {
2020     regs->windowbase = 0;
2021     regs->windowstart = 1;
2022     regs->areg[1] = infop->start_stack;
2023     regs->pc = infop->entry;
2024     if (info_is_fdpic(infop)) {
2025         regs->areg[4] = infop->loadmap_addr;
2026         regs->areg[5] = infop->interpreter_loadmap_addr;
2027         if (infop->interpreter_loadmap_addr) {
2028             regs->areg[6] = infop->interpreter_pt_dynamic_addr;
2029         } else {
2030             regs->areg[6] = infop->pt_dynamic_addr;
2031         }
2032     }
2033 }
2034 
2035 /* See linux kernel: arch/xtensa/include/asm/elf.h.  */
2036 #define ELF_NREG 128
2037 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
2038 
2039 enum {
2040     TARGET_REG_PC,
2041     TARGET_REG_PS,
2042     TARGET_REG_LBEG,
2043     TARGET_REG_LEND,
2044     TARGET_REG_LCOUNT,
2045     TARGET_REG_SAR,
2046     TARGET_REG_WINDOWSTART,
2047     TARGET_REG_WINDOWBASE,
2048     TARGET_REG_THREADPTR,
2049     TARGET_REG_AR0 = 64,
2050 };
2051 
elf_core_copy_regs(target_elf_gregset_t * regs,const CPUXtensaState * env)2052 static void elf_core_copy_regs(target_elf_gregset_t *regs,
2053                                const CPUXtensaState *env)
2054 {
2055     unsigned i;
2056 
2057     (*regs)[TARGET_REG_PC] = tswapreg(env->pc);
2058     (*regs)[TARGET_REG_PS] = tswapreg(env->sregs[PS] & ~PS_EXCM);
2059     (*regs)[TARGET_REG_LBEG] = tswapreg(env->sregs[LBEG]);
2060     (*regs)[TARGET_REG_LEND] = tswapreg(env->sregs[LEND]);
2061     (*regs)[TARGET_REG_LCOUNT] = tswapreg(env->sregs[LCOUNT]);
2062     (*regs)[TARGET_REG_SAR] = tswapreg(env->sregs[SAR]);
2063     (*regs)[TARGET_REG_WINDOWSTART] = tswapreg(env->sregs[WINDOW_START]);
2064     (*regs)[TARGET_REG_WINDOWBASE] = tswapreg(env->sregs[WINDOW_BASE]);
2065     (*regs)[TARGET_REG_THREADPTR] = tswapreg(env->uregs[THREADPTR]);
2066     xtensa_sync_phys_from_window((CPUXtensaState *)env);
2067     for (i = 0; i < env->config->nareg; ++i) {
2068         (*regs)[TARGET_REG_AR0 + i] = tswapreg(env->phys_regs[i]);
2069     }
2070 }
2071 
2072 #define USE_ELF_CORE_DUMP
2073 #define ELF_EXEC_PAGESIZE       4096
2074 
2075 #endif /* TARGET_XTENSA */
2076 
2077 #ifdef TARGET_HEXAGON
2078 
2079 #define ELF_CLASS       ELFCLASS32
2080 #define ELF_ARCH        EM_HEXAGON
2081 
init_thread(struct target_pt_regs * regs,struct image_info * infop)2082 static inline void init_thread(struct target_pt_regs *regs,
2083                                struct image_info *infop)
2084 {
2085     regs->sepc = infop->entry;
2086     regs->sp = infop->start_stack;
2087 }
2088 
2089 #endif /* TARGET_HEXAGON */
2090 
2091 #ifndef ELF_BASE_PLATFORM
2092 #define ELF_BASE_PLATFORM (NULL)
2093 #endif
2094 
2095 #ifndef ELF_PLATFORM
2096 #define ELF_PLATFORM (NULL)
2097 #endif
2098 
2099 #ifndef ELF_MACHINE
2100 #define ELF_MACHINE ELF_ARCH
2101 #endif
2102 
2103 #ifndef elf_check_arch
2104 #define elf_check_arch(x) ((x) == ELF_ARCH)
2105 #endif
2106 
2107 #ifndef elf_check_abi
2108 #define elf_check_abi(x) (1)
2109 #endif
2110 
2111 #ifndef ELF_HWCAP
2112 #define ELF_HWCAP 0
2113 #endif
2114 
2115 #ifndef STACK_GROWS_DOWN
2116 #define STACK_GROWS_DOWN 1
2117 #endif
2118 
2119 #ifndef STACK_ALIGNMENT
2120 #define STACK_ALIGNMENT 16
2121 #endif
2122 
2123 #ifdef TARGET_ABI32
2124 #undef ELF_CLASS
2125 #define ELF_CLASS ELFCLASS32
2126 #undef bswaptls
2127 #define bswaptls(ptr) bswap32s(ptr)
2128 #endif
2129 
2130 #ifndef EXSTACK_DEFAULT
2131 #define EXSTACK_DEFAULT false
2132 #endif
2133 
2134 #include "elf.h"
2135 
2136 /* We must delay the following stanzas until after "elf.h". */
2137 #if defined(TARGET_AARCH64)
2138 
arch_parse_elf_property(uint32_t pr_type,uint32_t pr_datasz,const uint32_t * data,struct image_info * info,Error ** errp)2139 static bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,
2140                                     const uint32_t *data,
2141                                     struct image_info *info,
2142                                     Error **errp)
2143 {
2144     if (pr_type == GNU_PROPERTY_AARCH64_FEATURE_1_AND) {
2145         if (pr_datasz != sizeof(uint32_t)) {
2146             error_setg(errp, "Ill-formed GNU_PROPERTY_AARCH64_FEATURE_1_AND");
2147             return false;
2148         }
2149         /* We will extract GNU_PROPERTY_AARCH64_FEATURE_1_BTI later. */
2150         info->note_flags = *data;
2151     }
2152     return true;
2153 }
2154 #define ARCH_USE_GNU_PROPERTY 1
2155 
2156 #else
2157 
arch_parse_elf_property(uint32_t pr_type,uint32_t pr_datasz,const uint32_t * data,struct image_info * info,Error ** errp)2158 static bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,
2159                                     const uint32_t *data,
2160                                     struct image_info *info,
2161                                     Error **errp)
2162 {
2163     g_assert_not_reached();
2164 }
2165 #define ARCH_USE_GNU_PROPERTY 0
2166 
2167 #endif
2168 
2169 struct exec
2170 {
2171     unsigned int a_info;   /* Use macros N_MAGIC, etc for access */
2172     unsigned int a_text;   /* length of text, in bytes */
2173     unsigned int a_data;   /* length of data, in bytes */
2174     unsigned int a_bss;    /* length of uninitialized data area, in bytes */
2175     unsigned int a_syms;   /* length of symbol table data in file, in bytes */
2176     unsigned int a_entry;  /* start address */
2177     unsigned int a_trsize; /* length of relocation info for text, in bytes */
2178     unsigned int a_drsize; /* length of relocation info for data, in bytes */
2179 };
2180 
2181 
2182 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
2183 #define OMAGIC 0407
2184 #define NMAGIC 0410
2185 #define ZMAGIC 0413
2186 #define QMAGIC 0314
2187 
2188 #define DLINFO_ITEMS 16
2189 
memcpy_fromfs(void * to,const void * from,unsigned long n)2190 static inline void memcpy_fromfs(void * to, const void * from, unsigned long n)
2191 {
2192     memcpy(to, from, n);
2193 }
2194 
bswap_ehdr(struct elfhdr * ehdr)2195 static void bswap_ehdr(struct elfhdr *ehdr)
2196 {
2197     if (!target_needs_bswap()) {
2198         return;
2199     }
2200 
2201     bswap16s(&ehdr->e_type);            /* Object file type */
2202     bswap16s(&ehdr->e_machine);         /* Architecture */
2203     bswap32s(&ehdr->e_version);         /* Object file version */
2204     bswaptls(&ehdr->e_entry);           /* Entry point virtual address */
2205     bswaptls(&ehdr->e_phoff);           /* Program header table file offset */
2206     bswaptls(&ehdr->e_shoff);           /* Section header table file offset */
2207     bswap32s(&ehdr->e_flags);           /* Processor-specific flags */
2208     bswap16s(&ehdr->e_ehsize);          /* ELF header size in bytes */
2209     bswap16s(&ehdr->e_phentsize);       /* Program header table entry size */
2210     bswap16s(&ehdr->e_phnum);           /* Program header table entry count */
2211     bswap16s(&ehdr->e_shentsize);       /* Section header table entry size */
2212     bswap16s(&ehdr->e_shnum);           /* Section header table entry count */
2213     bswap16s(&ehdr->e_shstrndx);        /* Section header string table index */
2214 }
2215 
bswap_phdr(struct elf_phdr * phdr,int phnum)2216 static void bswap_phdr(struct elf_phdr *phdr, int phnum)
2217 {
2218     if (!target_needs_bswap()) {
2219         return;
2220     }
2221 
2222     for (int i = 0; i < phnum; ++i, ++phdr) {
2223         bswap32s(&phdr->p_type);        /* Segment type */
2224         bswap32s(&phdr->p_flags);       /* Segment flags */
2225         bswaptls(&phdr->p_offset);      /* Segment file offset */
2226         bswaptls(&phdr->p_vaddr);       /* Segment virtual address */
2227         bswaptls(&phdr->p_paddr);       /* Segment physical address */
2228         bswaptls(&phdr->p_filesz);      /* Segment size in file */
2229         bswaptls(&phdr->p_memsz);       /* Segment size in memory */
2230         bswaptls(&phdr->p_align);       /* Segment alignment */
2231     }
2232 }
2233 
bswap_shdr(struct elf_shdr * shdr,int shnum)2234 static void bswap_shdr(struct elf_shdr *shdr, int shnum)
2235 {
2236     if (!target_needs_bswap()) {
2237         return;
2238     }
2239 
2240     for (int i = 0; i < shnum; ++i, ++shdr) {
2241         bswap32s(&shdr->sh_name);
2242         bswap32s(&shdr->sh_type);
2243         bswaptls(&shdr->sh_flags);
2244         bswaptls(&shdr->sh_addr);
2245         bswaptls(&shdr->sh_offset);
2246         bswaptls(&shdr->sh_size);
2247         bswap32s(&shdr->sh_link);
2248         bswap32s(&shdr->sh_info);
2249         bswaptls(&shdr->sh_addralign);
2250         bswaptls(&shdr->sh_entsize);
2251     }
2252 }
2253 
bswap_sym(struct elf_sym * sym)2254 static void bswap_sym(struct elf_sym *sym)
2255 {
2256     if (!target_needs_bswap()) {
2257         return;
2258     }
2259 
2260     bswap32s(&sym->st_name);
2261     bswaptls(&sym->st_value);
2262     bswaptls(&sym->st_size);
2263     bswap16s(&sym->st_shndx);
2264 }
2265 
2266 #ifdef TARGET_MIPS
bswap_mips_abiflags(Mips_elf_abiflags_v0 * abiflags)2267 static void bswap_mips_abiflags(Mips_elf_abiflags_v0 *abiflags)
2268 {
2269     if (!target_needs_bswap()) {
2270         return;
2271     }
2272 
2273     bswap16s(&abiflags->version);
2274     bswap32s(&abiflags->ases);
2275     bswap32s(&abiflags->isa_ext);
2276     bswap32s(&abiflags->flags1);
2277     bswap32s(&abiflags->flags2);
2278 }
2279 #endif
2280 
2281 #ifdef USE_ELF_CORE_DUMP
2282 static int elf_core_dump(int, const CPUArchState *);
2283 #endif /* USE_ELF_CORE_DUMP */
2284 static void load_symbols(struct elfhdr *hdr, const ImageSource *src,
2285                          abi_ulong load_bias);
2286 
2287 /* Verify the portions of EHDR within E_IDENT for the target.
2288    This can be performed before bswapping the entire header.  */
elf_check_ident(struct elfhdr * ehdr)2289 static bool elf_check_ident(struct elfhdr *ehdr)
2290 {
2291     return (ehdr->e_ident[EI_MAG0] == ELFMAG0
2292             && ehdr->e_ident[EI_MAG1] == ELFMAG1
2293             && ehdr->e_ident[EI_MAG2] == ELFMAG2
2294             && ehdr->e_ident[EI_MAG3] == ELFMAG3
2295             && ehdr->e_ident[EI_CLASS] == ELF_CLASS
2296             && ehdr->e_ident[EI_DATA] == ELF_DATA
2297             && ehdr->e_ident[EI_VERSION] == EV_CURRENT);
2298 }
2299 
2300 /* Verify the portions of EHDR outside of E_IDENT for the target.
2301    This has to wait until after bswapping the header.  */
elf_check_ehdr(struct elfhdr * ehdr)2302 static bool elf_check_ehdr(struct elfhdr *ehdr)
2303 {
2304     return (elf_check_arch(ehdr->e_machine)
2305             && elf_check_abi(ehdr->e_flags)
2306             && ehdr->e_ehsize == sizeof(struct elfhdr)
2307             && ehdr->e_phentsize == sizeof(struct elf_phdr)
2308             && (ehdr->e_type == ET_EXEC || ehdr->e_type == ET_DYN));
2309 }
2310 
2311 /*
2312  * 'copy_elf_strings()' copies argument/envelope strings from user
2313  * memory to free pages in kernel mem. These are in a format ready
2314  * to be put directly into the top of new user memory.
2315  *
2316  */
copy_elf_strings(int argc,char ** argv,char * scratch,abi_ulong p,abi_ulong stack_limit)2317 static abi_ulong copy_elf_strings(int argc, char **argv, char *scratch,
2318                                   abi_ulong p, abi_ulong stack_limit)
2319 {
2320     char *tmp;
2321     int len, i;
2322     abi_ulong top = p;
2323 
2324     if (!p) {
2325         return 0;       /* bullet-proofing */
2326     }
2327 
2328     if (STACK_GROWS_DOWN) {
2329         int offset = ((p - 1) % TARGET_PAGE_SIZE) + 1;
2330         for (i = argc - 1; i >= 0; --i) {
2331             tmp = argv[i];
2332             if (!tmp) {
2333                 fprintf(stderr, "VFS: argc is wrong");
2334                 exit(-1);
2335             }
2336             len = strlen(tmp) + 1;
2337             tmp += len;
2338 
2339             if (len > (p - stack_limit)) {
2340                 return 0;
2341             }
2342             while (len) {
2343                 int bytes_to_copy = (len > offset) ? offset : len;
2344                 tmp -= bytes_to_copy;
2345                 p -= bytes_to_copy;
2346                 offset -= bytes_to_copy;
2347                 len -= bytes_to_copy;
2348 
2349                 memcpy_fromfs(scratch + offset, tmp, bytes_to_copy);
2350 
2351                 if (offset == 0) {
2352                     memcpy_to_target(p, scratch, top - p);
2353                     top = p;
2354                     offset = TARGET_PAGE_SIZE;
2355                 }
2356             }
2357         }
2358         if (p != top) {
2359             memcpy_to_target(p, scratch + offset, top - p);
2360         }
2361     } else {
2362         int remaining = TARGET_PAGE_SIZE - (p % TARGET_PAGE_SIZE);
2363         for (i = 0; i < argc; ++i) {
2364             tmp = argv[i];
2365             if (!tmp) {
2366                 fprintf(stderr, "VFS: argc is wrong");
2367                 exit(-1);
2368             }
2369             len = strlen(tmp) + 1;
2370             if (len > (stack_limit - p)) {
2371                 return 0;
2372             }
2373             while (len) {
2374                 int bytes_to_copy = (len > remaining) ? remaining : len;
2375 
2376                 memcpy_fromfs(scratch + (p - top), tmp, bytes_to_copy);
2377 
2378                 tmp += bytes_to_copy;
2379                 remaining -= bytes_to_copy;
2380                 p += bytes_to_copy;
2381                 len -= bytes_to_copy;
2382 
2383                 if (remaining == 0) {
2384                     memcpy_to_target(top, scratch, p - top);
2385                     top = p;
2386                     remaining = TARGET_PAGE_SIZE;
2387                 }
2388             }
2389         }
2390         if (p != top) {
2391             memcpy_to_target(top, scratch, p - top);
2392         }
2393     }
2394 
2395     return p;
2396 }
2397 
2398 /* Older linux kernels provide up to MAX_ARG_PAGES (default: 32) of
2399  * argument/environment space. Newer kernels (>2.6.33) allow more,
2400  * dependent on stack size, but guarantee at least 32 pages for
2401  * backwards compatibility.
2402  */
2403 #define STACK_LOWER_LIMIT (32 * TARGET_PAGE_SIZE)
2404 
setup_arg_pages(struct linux_binprm * bprm,struct image_info * info)2405 static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
2406                                  struct image_info *info)
2407 {
2408     abi_ulong size, error, guard;
2409     int prot;
2410 
2411     size = guest_stack_size;
2412     if (size < STACK_LOWER_LIMIT) {
2413         size = STACK_LOWER_LIMIT;
2414     }
2415 
2416     if (STACK_GROWS_DOWN) {
2417         guard = TARGET_PAGE_SIZE;
2418         if (guard < qemu_real_host_page_size()) {
2419             guard = qemu_real_host_page_size();
2420         }
2421     } else {
2422         /* no guard page for hppa target where stack grows upwards. */
2423         guard = 0;
2424     }
2425 
2426     prot = PROT_READ | PROT_WRITE;
2427     if (info->exec_stack) {
2428         prot |= PROT_EXEC;
2429     }
2430     error = target_mmap(0, size + guard, prot,
2431                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
2432     if (error == -1) {
2433         perror("mmap stack");
2434         exit(-1);
2435     }
2436 
2437     /* We reserve one extra page at the top of the stack as guard.  */
2438     if (STACK_GROWS_DOWN) {
2439         target_mprotect(error, guard, PROT_NONE);
2440         info->stack_limit = error + guard;
2441         return info->stack_limit + size - sizeof(void *);
2442     } else {
2443         info->stack_limit = error + size;
2444         return error;
2445     }
2446 }
2447 
2448 /**
2449  * zero_bss:
2450  *
2451  * Map and zero the bss.  We need to explicitly zero any fractional pages
2452  * after the data section (i.e. bss).  Return false on mapping failure.
2453  */
zero_bss(abi_ulong start_bss,abi_ulong end_bss,int prot,Error ** errp)2454 static bool zero_bss(abi_ulong start_bss, abi_ulong end_bss,
2455                      int prot, Error **errp)
2456 {
2457     abi_ulong align_bss;
2458 
2459     /* We only expect writable bss; the code segment shouldn't need this. */
2460     if (!(prot & PROT_WRITE)) {
2461         error_setg(errp, "PT_LOAD with non-writable bss");
2462         return false;
2463     }
2464 
2465     align_bss = TARGET_PAGE_ALIGN(start_bss);
2466     end_bss = TARGET_PAGE_ALIGN(end_bss);
2467 
2468     if (start_bss < align_bss) {
2469         int flags = page_get_flags(start_bss);
2470 
2471         if (!(flags & PAGE_RWX)) {
2472             /*
2473              * The whole address space of the executable was reserved
2474              * at the start, therefore all pages will be VALID.
2475              * But assuming there are no PROT_NONE PT_LOAD segments,
2476              * a PROT_NONE page means no data all bss, and we can
2477              * simply extend the new anon mapping back to the start
2478              * of the page of bss.
2479              */
2480             align_bss -= TARGET_PAGE_SIZE;
2481         } else {
2482             /*
2483              * The start of the bss shares a page with something.
2484              * The only thing that we expect is the data section,
2485              * which would already be marked writable.
2486              * Overlapping the RX code segment seems malformed.
2487              */
2488             if (!(flags & PAGE_WRITE)) {
2489                 error_setg(errp, "PT_LOAD with bss overlapping "
2490                            "non-writable page");
2491                 return false;
2492             }
2493 
2494             /* The page is already mapped and writable. */
2495             memset(g2h_untagged(start_bss), 0, align_bss - start_bss);
2496         }
2497     }
2498 
2499     if (align_bss < end_bss &&
2500         target_mmap(align_bss, end_bss - align_bss, prot,
2501                     MAP_FIXED | MAP_PRIVATE | MAP_ANON, -1, 0) == -1) {
2502         error_setg_errno(errp, errno, "Error mapping bss");
2503         return false;
2504     }
2505     return true;
2506 }
2507 
2508 #if defined(TARGET_ARM)
elf_is_fdpic(struct elfhdr * exec)2509 static int elf_is_fdpic(struct elfhdr *exec)
2510 {
2511     return exec->e_ident[EI_OSABI] == ELFOSABI_ARM_FDPIC;
2512 }
2513 #elif defined(TARGET_XTENSA)
elf_is_fdpic(struct elfhdr * exec)2514 static int elf_is_fdpic(struct elfhdr *exec)
2515 {
2516     return exec->e_ident[EI_OSABI] == ELFOSABI_XTENSA_FDPIC;
2517 }
2518 #else
2519 /* Default implementation, always false.  */
elf_is_fdpic(struct elfhdr * exec)2520 static int elf_is_fdpic(struct elfhdr *exec)
2521 {
2522     return 0;
2523 }
2524 #endif
2525 
loader_build_fdpic_loadmap(struct image_info * info,abi_ulong sp)2526 static abi_ulong loader_build_fdpic_loadmap(struct image_info *info, abi_ulong sp)
2527 {
2528     uint16_t n;
2529     struct elf32_fdpic_loadseg *loadsegs = info->loadsegs;
2530 
2531     /* elf32_fdpic_loadseg */
2532     n = info->nsegs;
2533     while (n--) {
2534         sp -= 12;
2535         put_user_u32(loadsegs[n].addr, sp+0);
2536         put_user_u32(loadsegs[n].p_vaddr, sp+4);
2537         put_user_u32(loadsegs[n].p_memsz, sp+8);
2538     }
2539 
2540     /* elf32_fdpic_loadmap */
2541     sp -= 4;
2542     put_user_u16(0, sp+0); /* version */
2543     put_user_u16(info->nsegs, sp+2); /* nsegs */
2544 
2545     info->personality = PER_LINUX_FDPIC;
2546     info->loadmap_addr = sp;
2547 
2548     return sp;
2549 }
2550 
create_elf_tables(abi_ulong p,int argc,int envc,struct elfhdr * exec,struct image_info * info,struct image_info * interp_info,struct image_info * vdso_info)2551 static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
2552                                    struct elfhdr *exec,
2553                                    struct image_info *info,
2554                                    struct image_info *interp_info,
2555                                    struct image_info *vdso_info)
2556 {
2557     abi_ulong sp;
2558     abi_ulong u_argc, u_argv, u_envp, u_auxv;
2559     int size;
2560     int i;
2561     abi_ulong u_rand_bytes;
2562     uint8_t k_rand_bytes[16];
2563     abi_ulong u_platform, u_base_platform;
2564     const char *k_platform, *k_base_platform;
2565     const int n = sizeof(elf_addr_t);
2566 
2567     sp = p;
2568 
2569     /* Needs to be before we load the env/argc/... */
2570     if (elf_is_fdpic(exec)) {
2571         /* Need 4 byte alignment for these structs */
2572         sp &= ~3;
2573         sp = loader_build_fdpic_loadmap(info, sp);
2574         info->other_info = interp_info;
2575         if (interp_info) {
2576             interp_info->other_info = info;
2577             sp = loader_build_fdpic_loadmap(interp_info, sp);
2578             info->interpreter_loadmap_addr = interp_info->loadmap_addr;
2579             info->interpreter_pt_dynamic_addr = interp_info->pt_dynamic_addr;
2580         } else {
2581             info->interpreter_loadmap_addr = 0;
2582             info->interpreter_pt_dynamic_addr = 0;
2583         }
2584     }
2585 
2586     u_base_platform = 0;
2587     k_base_platform = ELF_BASE_PLATFORM;
2588     if (k_base_platform) {
2589         size_t len = strlen(k_base_platform) + 1;
2590         if (STACK_GROWS_DOWN) {
2591             sp -= (len + n - 1) & ~(n - 1);
2592             u_base_platform = sp;
2593             /* FIXME - check return value of memcpy_to_target() for failure */
2594             memcpy_to_target(sp, k_base_platform, len);
2595         } else {
2596             memcpy_to_target(sp, k_base_platform, len);
2597             u_base_platform = sp;
2598             sp += len + 1;
2599         }
2600     }
2601 
2602     u_platform = 0;
2603     k_platform = ELF_PLATFORM;
2604     if (k_platform) {
2605         size_t len = strlen(k_platform) + 1;
2606         if (STACK_GROWS_DOWN) {
2607             sp -= (len + n - 1) & ~(n - 1);
2608             u_platform = sp;
2609             /* FIXME - check return value of memcpy_to_target() for failure */
2610             memcpy_to_target(sp, k_platform, len);
2611         } else {
2612             memcpy_to_target(sp, k_platform, len);
2613             u_platform = sp;
2614             sp += len + 1;
2615         }
2616     }
2617 
2618     /* Provide 16 byte alignment for the PRNG, and basic alignment for
2619      * the argv and envp pointers.
2620      */
2621     if (STACK_GROWS_DOWN) {
2622         sp = QEMU_ALIGN_DOWN(sp, 16);
2623     } else {
2624         sp = QEMU_ALIGN_UP(sp, 16);
2625     }
2626 
2627     /*
2628      * Generate 16 random bytes for userspace PRNG seeding.
2629      */
2630     qemu_guest_getrandom_nofail(k_rand_bytes, sizeof(k_rand_bytes));
2631     if (STACK_GROWS_DOWN) {
2632         sp -= 16;
2633         u_rand_bytes = sp;
2634         /* FIXME - check return value of memcpy_to_target() for failure */
2635         memcpy_to_target(sp, k_rand_bytes, 16);
2636     } else {
2637         memcpy_to_target(sp, k_rand_bytes, 16);
2638         u_rand_bytes = sp;
2639         sp += 16;
2640     }
2641 
2642     size = (DLINFO_ITEMS + 1) * 2;
2643     if (k_base_platform) {
2644         size += 2;
2645     }
2646     if (k_platform) {
2647         size += 2;
2648     }
2649     if (vdso_info) {
2650         size += 2;
2651     }
2652 #ifdef DLINFO_ARCH_ITEMS
2653     size += DLINFO_ARCH_ITEMS * 2;
2654 #endif
2655 #ifdef ELF_HWCAP2
2656     size += 2;
2657 #endif
2658     info->auxv_len = size * n;
2659 
2660     size += envc + argc + 2;
2661     size += 1;  /* argc itself */
2662     size *= n;
2663 
2664     /* Allocate space and finalize stack alignment for entry now.  */
2665     if (STACK_GROWS_DOWN) {
2666         u_argc = QEMU_ALIGN_DOWN(sp - size, STACK_ALIGNMENT);
2667         sp = u_argc;
2668     } else {
2669         u_argc = sp;
2670         sp = QEMU_ALIGN_UP(sp + size, STACK_ALIGNMENT);
2671     }
2672 
2673     u_argv = u_argc + n;
2674     u_envp = u_argv + (argc + 1) * n;
2675     u_auxv = u_envp + (envc + 1) * n;
2676     info->saved_auxv = u_auxv;
2677     info->argc = argc;
2678     info->envc = envc;
2679     info->argv = u_argv;
2680     info->envp = u_envp;
2681 
2682     /* This is correct because Linux defines
2683      * elf_addr_t as Elf32_Off / Elf64_Off
2684      */
2685 #define NEW_AUX_ENT(id, val) do {               \
2686         put_user_ual(id, u_auxv);  u_auxv += n; \
2687         put_user_ual(val, u_auxv); u_auxv += n; \
2688     } while(0)
2689 
2690 #ifdef ARCH_DLINFO
2691     /*
2692      * ARCH_DLINFO must come first so platform specific code can enforce
2693      * special alignment requirements on the AUXV if necessary (eg. PPC).
2694      */
2695     ARCH_DLINFO;
2696 #endif
2697     /* There must be exactly DLINFO_ITEMS entries here, or the assert
2698      * on info->auxv_len will trigger.
2699      */
2700     NEW_AUX_ENT(AT_PHDR, (abi_ulong)(info->load_addr + exec->e_phoff));
2701     NEW_AUX_ENT(AT_PHENT, (abi_ulong)(sizeof (struct elf_phdr)));
2702     NEW_AUX_ENT(AT_PHNUM, (abi_ulong)(exec->e_phnum));
2703     NEW_AUX_ENT(AT_PAGESZ, (abi_ulong)(TARGET_PAGE_SIZE));
2704     NEW_AUX_ENT(AT_BASE, (abi_ulong)(interp_info ? interp_info->load_addr : 0));
2705     NEW_AUX_ENT(AT_FLAGS, (abi_ulong)0);
2706     NEW_AUX_ENT(AT_ENTRY, info->entry);
2707     NEW_AUX_ENT(AT_UID, (abi_ulong) getuid());
2708     NEW_AUX_ENT(AT_EUID, (abi_ulong) geteuid());
2709     NEW_AUX_ENT(AT_GID, (abi_ulong) getgid());
2710     NEW_AUX_ENT(AT_EGID, (abi_ulong) getegid());
2711     NEW_AUX_ENT(AT_HWCAP, (abi_ulong) ELF_HWCAP);
2712     NEW_AUX_ENT(AT_CLKTCK, (abi_ulong) sysconf(_SC_CLK_TCK));
2713     NEW_AUX_ENT(AT_RANDOM, (abi_ulong) u_rand_bytes);
2714     NEW_AUX_ENT(AT_SECURE, (abi_ulong) qemu_getauxval(AT_SECURE));
2715     NEW_AUX_ENT(AT_EXECFN, info->file_string);
2716 
2717 #ifdef ELF_HWCAP2
2718     NEW_AUX_ENT(AT_HWCAP2, (abi_ulong) ELF_HWCAP2);
2719 #endif
2720 
2721     if (u_base_platform) {
2722         NEW_AUX_ENT(AT_BASE_PLATFORM, u_base_platform);
2723     }
2724     if (u_platform) {
2725         NEW_AUX_ENT(AT_PLATFORM, u_platform);
2726     }
2727     if (vdso_info) {
2728         NEW_AUX_ENT(AT_SYSINFO_EHDR, vdso_info->load_addr);
2729     }
2730     NEW_AUX_ENT (AT_NULL, 0);
2731 #undef NEW_AUX_ENT
2732 
2733     /* Check that our initial calculation of the auxv length matches how much
2734      * we actually put into it.
2735      */
2736     assert(info->auxv_len == u_auxv - info->saved_auxv);
2737 
2738     put_user_ual(argc, u_argc);
2739 
2740     p = info->arg_strings;
2741     for (i = 0; i < argc; ++i) {
2742         put_user_ual(p, u_argv);
2743         u_argv += n;
2744         p += target_strlen(p) + 1;
2745     }
2746     put_user_ual(0, u_argv);
2747 
2748     p = info->env_strings;
2749     for (i = 0; i < envc; ++i) {
2750         put_user_ual(p, u_envp);
2751         u_envp += n;
2752         p += target_strlen(p) + 1;
2753     }
2754     put_user_ual(0, u_envp);
2755 
2756     return sp;
2757 }
2758 
2759 #if defined(HI_COMMPAGE)
2760 #define LO_COMMPAGE -1
2761 #elif defined(LO_COMMPAGE)
2762 #define HI_COMMPAGE 0
2763 #else
2764 #define HI_COMMPAGE 0
2765 #define LO_COMMPAGE -1
2766 #ifndef INIT_GUEST_COMMPAGE
2767 #define init_guest_commpage() true
2768 #endif
2769 #endif
2770 
2771 /**
2772  * pgb_try_mmap:
2773  * @addr: host start address
2774  * @addr_last: host last address
2775  * @keep: do not unmap the probe region
2776  *
2777  * Return 1 if [@addr, @addr_last] is not mapped in the host,
2778  * return 0 if it is not available to map, and -1 on mmap error.
2779  * If @keep, the region is left mapped on success, otherwise unmapped.
2780  */
pgb_try_mmap(uintptr_t addr,uintptr_t addr_last,bool keep)2781 static int pgb_try_mmap(uintptr_t addr, uintptr_t addr_last, bool keep)
2782 {
2783     size_t size = addr_last - addr + 1;
2784     void *p = mmap((void *)addr, size, PROT_NONE,
2785                    MAP_ANONYMOUS | MAP_PRIVATE |
2786                    MAP_NORESERVE | MAP_FIXED_NOREPLACE, -1, 0);
2787     int ret;
2788 
2789     if (p == MAP_FAILED) {
2790         return errno == EEXIST ? 0 : -1;
2791     }
2792     ret = p == (void *)addr;
2793     if (!keep || !ret) {
2794         munmap(p, size);
2795     }
2796     return ret;
2797 }
2798 
2799 /**
2800  * pgb_try_mmap_skip_brk(uintptr_t addr, uintptr_t size, uintptr_t brk)
2801  * @addr: host address
2802  * @addr_last: host last address
2803  * @brk: host brk
2804  *
2805  * Like pgb_try_mmap, but additionally reserve some memory following brk.
2806  */
pgb_try_mmap_skip_brk(uintptr_t addr,uintptr_t addr_last,uintptr_t brk,bool keep)2807 static int pgb_try_mmap_skip_brk(uintptr_t addr, uintptr_t addr_last,
2808                                  uintptr_t brk, bool keep)
2809 {
2810     uintptr_t brk_last = brk + 16 * MiB - 1;
2811 
2812     /* Do not map anything close to the host brk. */
2813     if (addr <= brk_last && brk <= addr_last) {
2814         return 0;
2815     }
2816     return pgb_try_mmap(addr, addr_last, keep);
2817 }
2818 
2819 /**
2820  * pgb_try_mmap_set:
2821  * @ga: set of guest addrs
2822  * @base: guest_base
2823  * @brk: host brk
2824  *
2825  * Return true if all @ga can be mapped by the host at @base.
2826  * On success, retain the mapping at index 0 for reserved_va.
2827  */
2828 
2829 typedef struct PGBAddrs {
2830     uintptr_t bounds[3][2]; /* start/last pairs */
2831     int nbounds;
2832 } PGBAddrs;
2833 
pgb_try_mmap_set(const PGBAddrs * ga,uintptr_t base,uintptr_t brk)2834 static bool pgb_try_mmap_set(const PGBAddrs *ga, uintptr_t base, uintptr_t brk)
2835 {
2836     for (int i = ga->nbounds - 1; i >= 0; --i) {
2837         if (pgb_try_mmap_skip_brk(ga->bounds[i][0] + base,
2838                                   ga->bounds[i][1] + base,
2839                                   brk, i == 0 && reserved_va) <= 0) {
2840             return false;
2841         }
2842     }
2843     return true;
2844 }
2845 
2846 /**
2847  * pgb_addr_set:
2848  * @ga: output set of guest addrs
2849  * @guest_loaddr: guest image low address
2850  * @guest_loaddr: guest image high address
2851  * @identity: create for identity mapping
2852  *
2853  * Fill in @ga with the image, COMMPAGE and NULL page.
2854  */
pgb_addr_set(PGBAddrs * ga,abi_ulong guest_loaddr,abi_ulong guest_hiaddr,bool try_identity)2855 static bool pgb_addr_set(PGBAddrs *ga, abi_ulong guest_loaddr,
2856                          abi_ulong guest_hiaddr, bool try_identity)
2857 {
2858     int n;
2859 
2860     /*
2861      * With a low commpage, or a guest mapped very low,
2862      * we may not be able to use the identity map.
2863      */
2864     if (try_identity) {
2865         if (LO_COMMPAGE != -1 && LO_COMMPAGE < mmap_min_addr) {
2866             return false;
2867         }
2868         if (guest_loaddr != 0 && guest_loaddr < mmap_min_addr) {
2869             return false;
2870         }
2871     }
2872 
2873     memset(ga, 0, sizeof(*ga));
2874     n = 0;
2875 
2876     if (reserved_va) {
2877         ga->bounds[n][0] = try_identity ? mmap_min_addr : 0;
2878         ga->bounds[n][1] = reserved_va;
2879         n++;
2880         /* LO_COMMPAGE and NULL handled by reserving from 0. */
2881     } else {
2882         /* Add any LO_COMMPAGE or NULL page. */
2883         if (LO_COMMPAGE != -1) {
2884             ga->bounds[n][0] = 0;
2885             ga->bounds[n][1] = LO_COMMPAGE + TARGET_PAGE_SIZE - 1;
2886             n++;
2887         } else if (!try_identity) {
2888             ga->bounds[n][0] = 0;
2889             ga->bounds[n][1] = TARGET_PAGE_SIZE - 1;
2890             n++;
2891         }
2892 
2893         /* Add the guest image for ET_EXEC. */
2894         if (guest_loaddr) {
2895             ga->bounds[n][0] = guest_loaddr;
2896             ga->bounds[n][1] = guest_hiaddr;
2897             n++;
2898         }
2899     }
2900 
2901     /*
2902      * Temporarily disable
2903      *   "comparison is always false due to limited range of data type"
2904      * due to comparison between unsigned and (possible) 0.
2905      */
2906 #pragma GCC diagnostic push
2907 #pragma GCC diagnostic ignored "-Wtype-limits"
2908 
2909     /* Add any HI_COMMPAGE not covered by reserved_va. */
2910     if (reserved_va < HI_COMMPAGE) {
2911         ga->bounds[n][0] = HI_COMMPAGE & qemu_real_host_page_mask();
2912         ga->bounds[n][1] = HI_COMMPAGE + TARGET_PAGE_SIZE - 1;
2913         n++;
2914     }
2915 
2916 #pragma GCC diagnostic pop
2917 
2918     ga->nbounds = n;
2919     return true;
2920 }
2921 
pgb_fail_in_use(const char * image_name)2922 static void pgb_fail_in_use(const char *image_name)
2923 {
2924     error_report("%s: requires virtual address space that is in use "
2925                  "(omit the -B option or choose a different value)",
2926                  image_name);
2927     exit(EXIT_FAILURE);
2928 }
2929 
pgb_fixed(const char * image_name,uintptr_t guest_loaddr,uintptr_t guest_hiaddr,uintptr_t align)2930 static void pgb_fixed(const char *image_name, uintptr_t guest_loaddr,
2931                       uintptr_t guest_hiaddr, uintptr_t align)
2932 {
2933     PGBAddrs ga;
2934     uintptr_t brk = (uintptr_t)sbrk(0);
2935 
2936     if (!QEMU_IS_ALIGNED(guest_base, align)) {
2937         fprintf(stderr, "Requested guest base %p does not satisfy "
2938                 "host minimum alignment (0x%" PRIxPTR ")\n",
2939                 (void *)guest_base, align);
2940         exit(EXIT_FAILURE);
2941     }
2942 
2943     if (!pgb_addr_set(&ga, guest_loaddr, guest_hiaddr, !guest_base)
2944         || !pgb_try_mmap_set(&ga, guest_base, brk)) {
2945         pgb_fail_in_use(image_name);
2946     }
2947 }
2948 
2949 /**
2950  * pgb_find_fallback:
2951  *
2952  * This is a fallback method for finding holes in the host address space
2953  * if we don't have the benefit of being able to access /proc/self/map.
2954  * It can potentially take a very long time as we can only dumbly iterate
2955  * up the host address space seeing if the allocation would work.
2956  */
pgb_find_fallback(const PGBAddrs * ga,uintptr_t align,uintptr_t brk)2957 static uintptr_t pgb_find_fallback(const PGBAddrs *ga, uintptr_t align,
2958                                    uintptr_t brk)
2959 {
2960     /* TODO: come up with a better estimate of how much to skip. */
2961     uintptr_t skip = sizeof(uintptr_t) == 4 ? MiB : GiB;
2962 
2963     for (uintptr_t base = skip; ; base += skip) {
2964         base = ROUND_UP(base, align);
2965         if (pgb_try_mmap_set(ga, base, brk)) {
2966             return base;
2967         }
2968         if (base >= -skip) {
2969             return -1;
2970         }
2971     }
2972 }
2973 
pgb_try_itree(const PGBAddrs * ga,uintptr_t base,IntervalTreeRoot * root)2974 static uintptr_t pgb_try_itree(const PGBAddrs *ga, uintptr_t base,
2975                                IntervalTreeRoot *root)
2976 {
2977     for (int i = ga->nbounds - 1; i >= 0; --i) {
2978         uintptr_t s = base + ga->bounds[i][0];
2979         uintptr_t l = base + ga->bounds[i][1];
2980         IntervalTreeNode *n;
2981 
2982         if (l < s) {
2983             /* Wraparound. Skip to advance S to mmap_min_addr. */
2984             return mmap_min_addr - s;
2985         }
2986 
2987         n = interval_tree_iter_first(root, s, l);
2988         if (n != NULL) {
2989             /* Conflict.  Skip to advance S to LAST + 1. */
2990             return n->last - s + 1;
2991         }
2992     }
2993     return 0;  /* success */
2994 }
2995 
pgb_find_itree(const PGBAddrs * ga,IntervalTreeRoot * root,uintptr_t align,uintptr_t brk)2996 static uintptr_t pgb_find_itree(const PGBAddrs *ga, IntervalTreeRoot *root,
2997                                 uintptr_t align, uintptr_t brk)
2998 {
2999     uintptr_t last = sizeof(uintptr_t) == 4 ? MiB : GiB;
3000     uintptr_t base, skip;
3001 
3002     while (true) {
3003         base = ROUND_UP(last, align);
3004         if (base < last) {
3005             return -1;
3006         }
3007 
3008         skip = pgb_try_itree(ga, base, root);
3009         if (skip == 0) {
3010             break;
3011         }
3012 
3013         last = base + skip;
3014         if (last < base) {
3015             return -1;
3016         }
3017     }
3018 
3019     /*
3020      * We've chosen 'base' based on holes in the interval tree,
3021      * but we don't yet know if it is a valid host address.
3022      * Because it is the first matching hole, if the host addresses
3023      * are invalid we know there are no further matches.
3024      */
3025     return pgb_try_mmap_set(ga, base, brk) ? base : -1;
3026 }
3027 
pgb_dynamic(const char * image_name,uintptr_t guest_loaddr,uintptr_t guest_hiaddr,uintptr_t align)3028 static void pgb_dynamic(const char *image_name, uintptr_t guest_loaddr,
3029                         uintptr_t guest_hiaddr, uintptr_t align)
3030 {
3031     IntervalTreeRoot *root;
3032     uintptr_t brk, ret;
3033     PGBAddrs ga;
3034 
3035     /* Try the identity map first. */
3036     if (pgb_addr_set(&ga, guest_loaddr, guest_hiaddr, true)) {
3037         brk = (uintptr_t)sbrk(0);
3038         if (pgb_try_mmap_set(&ga, 0, brk)) {
3039             guest_base = 0;
3040             return;
3041         }
3042     }
3043 
3044     /*
3045      * Rebuild the address set for non-identity map.
3046      * This differs in the mapping of the guest NULL page.
3047      */
3048     pgb_addr_set(&ga, guest_loaddr, guest_hiaddr, false);
3049 
3050     root = read_self_maps();
3051 
3052     /* Read brk after we've read the maps, which will malloc. */
3053     brk = (uintptr_t)sbrk(0);
3054 
3055     if (!root) {
3056         ret = pgb_find_fallback(&ga, align, brk);
3057     } else {
3058         /*
3059          * Reserve the area close to the host brk.
3060          * This will be freed with the rest of the tree.
3061          */
3062         IntervalTreeNode *b = g_new0(IntervalTreeNode, 1);
3063         b->start = brk;
3064         b->last = brk + 16 * MiB - 1;
3065         interval_tree_insert(b, root);
3066 
3067         ret = pgb_find_itree(&ga, root, align, brk);
3068         free_self_maps(root);
3069     }
3070 
3071     if (ret == -1) {
3072         int w = TARGET_LONG_BITS / 4;
3073 
3074         error_report("%s: Unable to find a guest_base to satisfy all "
3075                      "guest address mapping requirements", image_name);
3076 
3077         for (int i = 0; i < ga.nbounds; ++i) {
3078             error_printf("  %0*" PRIx64 "-%0*" PRIx64 "\n",
3079                          w, (uint64_t)ga.bounds[i][0],
3080                          w, (uint64_t)ga.bounds[i][1]);
3081         }
3082         exit(EXIT_FAILURE);
3083     }
3084     guest_base = ret;
3085 }
3086 
probe_guest_base(const char * image_name,abi_ulong guest_loaddr,abi_ulong guest_hiaddr)3087 void probe_guest_base(const char *image_name, abi_ulong guest_loaddr,
3088                       abi_ulong guest_hiaddr)
3089 {
3090     /* In order to use host shmat, we must be able to honor SHMLBA.  */
3091     uintptr_t align = MAX(SHMLBA, TARGET_PAGE_SIZE);
3092 
3093     /* Sanity check the guest binary. */
3094     if (reserved_va) {
3095         if (guest_hiaddr > reserved_va) {
3096             error_report("%s: requires more than reserved virtual "
3097                          "address space (0x%" PRIx64 " > 0x%lx)",
3098                          image_name, (uint64_t)guest_hiaddr, reserved_va);
3099             exit(EXIT_FAILURE);
3100         }
3101     } else {
3102         if (guest_hiaddr != (uintptr_t)guest_hiaddr) {
3103             error_report("%s: requires more virtual address space "
3104                          "than the host can provide (0x%" PRIx64 ")",
3105                          image_name, (uint64_t)guest_hiaddr + 1);
3106             exit(EXIT_FAILURE);
3107         }
3108     }
3109 
3110     if (have_guest_base) {
3111         pgb_fixed(image_name, guest_loaddr, guest_hiaddr, align);
3112     } else {
3113         pgb_dynamic(image_name, guest_loaddr, guest_hiaddr, align);
3114     }
3115 
3116     /* Reserve and initialize the commpage. */
3117     if (!init_guest_commpage()) {
3118         /* We have already probed for the commpage being free. */
3119         g_assert_not_reached();
3120     }
3121 
3122     assert(QEMU_IS_ALIGNED(guest_base, align));
3123     qemu_log_mask(CPU_LOG_PAGE, "Locating guest address space "
3124                   "@ 0x%" PRIx64 "\n", (uint64_t)guest_base);
3125 }
3126 
3127 enum {
3128     /* The string "GNU\0" as a magic number. */
3129     GNU0_MAGIC = const_le32('G' | 'N' << 8 | 'U' << 16),
3130     NOTE_DATA_SZ = 1 * KiB,
3131     NOTE_NAME_SZ = 4,
3132     ELF_GNU_PROPERTY_ALIGN = ELF_CLASS == ELFCLASS32 ? 4 : 8,
3133 };
3134 
3135 /*
3136  * Process a single gnu_property entry.
3137  * Return false for error.
3138  */
parse_elf_property(const uint32_t * data,int * off,int datasz,struct image_info * info,bool have_prev_type,uint32_t * prev_type,Error ** errp)3139 static bool parse_elf_property(const uint32_t *data, int *off, int datasz,
3140                                struct image_info *info, bool have_prev_type,
3141                                uint32_t *prev_type, Error **errp)
3142 {
3143     uint32_t pr_type, pr_datasz, step;
3144 
3145     if (*off > datasz || !QEMU_IS_ALIGNED(*off, ELF_GNU_PROPERTY_ALIGN)) {
3146         goto error_data;
3147     }
3148     datasz -= *off;
3149     data += *off / sizeof(uint32_t);
3150 
3151     if (datasz < 2 * sizeof(uint32_t)) {
3152         goto error_data;
3153     }
3154     pr_type = data[0];
3155     pr_datasz = data[1];
3156     data += 2;
3157     datasz -= 2 * sizeof(uint32_t);
3158     step = ROUND_UP(pr_datasz, ELF_GNU_PROPERTY_ALIGN);
3159     if (step > datasz) {
3160         goto error_data;
3161     }
3162 
3163     /* Properties are supposed to be unique and sorted on pr_type. */
3164     if (have_prev_type && pr_type <= *prev_type) {
3165         if (pr_type == *prev_type) {
3166             error_setg(errp, "Duplicate property in PT_GNU_PROPERTY");
3167         } else {
3168             error_setg(errp, "Unsorted property in PT_GNU_PROPERTY");
3169         }
3170         return false;
3171     }
3172     *prev_type = pr_type;
3173 
3174     if (!arch_parse_elf_property(pr_type, pr_datasz, data, info, errp)) {
3175         return false;
3176     }
3177 
3178     *off += 2 * sizeof(uint32_t) + step;
3179     return true;
3180 
3181  error_data:
3182     error_setg(errp, "Ill-formed property in PT_GNU_PROPERTY");
3183     return false;
3184 }
3185 
3186 /* Process NT_GNU_PROPERTY_TYPE_0. */
parse_elf_properties(const ImageSource * src,struct image_info * info,const struct elf_phdr * phdr,Error ** errp)3187 static bool parse_elf_properties(const ImageSource *src,
3188                                  struct image_info *info,
3189                                  const struct elf_phdr *phdr,
3190                                  Error **errp)
3191 {
3192     union {
3193         struct elf_note nhdr;
3194         uint32_t data[NOTE_DATA_SZ / sizeof(uint32_t)];
3195     } note;
3196 
3197     int n, off, datasz;
3198     bool have_prev_type;
3199     uint32_t prev_type;
3200 
3201     /* Unless the arch requires properties, ignore them. */
3202     if (!ARCH_USE_GNU_PROPERTY) {
3203         return true;
3204     }
3205 
3206     /* If the properties are crazy large, that's too bad. */
3207     n = phdr->p_filesz;
3208     if (n > sizeof(note)) {
3209         error_setg(errp, "PT_GNU_PROPERTY too large");
3210         return false;
3211     }
3212     if (n < sizeof(note.nhdr)) {
3213         error_setg(errp, "PT_GNU_PROPERTY too small");
3214         return false;
3215     }
3216 
3217     if (!imgsrc_read(&note, phdr->p_offset, n, src, errp)) {
3218         return false;
3219     }
3220 
3221     /*
3222      * The contents of a valid PT_GNU_PROPERTY is a sequence of uint32_t.
3223      * Swap most of them now, beyond the header and namesz.
3224      */
3225     if (target_needs_bswap()) {
3226         for (int i = 4; i < n / 4; i++) {
3227             bswap32s(note.data + i);
3228         }
3229     }
3230 
3231     /*
3232      * Note that nhdr is 3 words, and that the "name" described by namesz
3233      * immediately follows nhdr and is thus at the 4th word.  Further, all
3234      * of the inputs to the kernel's round_up are multiples of 4.
3235      */
3236     if (tswap32(note.nhdr.n_type) != NT_GNU_PROPERTY_TYPE_0 ||
3237         tswap32(note.nhdr.n_namesz) != NOTE_NAME_SZ ||
3238         note.data[3] != GNU0_MAGIC) {
3239         error_setg(errp, "Invalid note in PT_GNU_PROPERTY");
3240         return false;
3241     }
3242     off = sizeof(note.nhdr) + NOTE_NAME_SZ;
3243 
3244     datasz = tswap32(note.nhdr.n_descsz) + off;
3245     if (datasz > n) {
3246         error_setg(errp, "Invalid note size in PT_GNU_PROPERTY");
3247         return false;
3248     }
3249 
3250     have_prev_type = false;
3251     prev_type = 0;
3252     while (1) {
3253         if (off == datasz) {
3254             return true;  /* end, exit ok */
3255         }
3256         if (!parse_elf_property(note.data, &off, datasz, info,
3257                                 have_prev_type, &prev_type, errp)) {
3258             return false;
3259         }
3260         have_prev_type = true;
3261     }
3262 }
3263 
3264 /**
3265  * load_elf_image: Load an ELF image into the address space.
3266  * @image_name: the filename of the image, to use in error messages.
3267  * @src: the ImageSource from which to read.
3268  * @info: info collected from the loaded image.
3269  * @ehdr: the ELF header, not yet bswapped.
3270  * @pinterp_name: record any PT_INTERP string found.
3271  *
3272  * On return: @info values will be filled in, as necessary or available.
3273  */
3274 
load_elf_image(const char * image_name,const ImageSource * src,struct image_info * info,struct elfhdr * ehdr,char ** pinterp_name)3275 static void load_elf_image(const char *image_name, const ImageSource *src,
3276                            struct image_info *info, struct elfhdr *ehdr,
3277                            char **pinterp_name)
3278 {
3279     g_autofree struct elf_phdr *phdr = NULL;
3280     abi_ulong load_addr, load_bias, loaddr, hiaddr, error, align;
3281     size_t reserve_size, align_size;
3282     int i, prot_exec;
3283     Error *err = NULL;
3284 
3285     /*
3286      * First of all, some simple consistency checks.
3287      * Note that we rely on the bswapped ehdr staying in bprm_buf,
3288      * for later use by load_elf_binary and create_elf_tables.
3289      */
3290     if (!imgsrc_read(ehdr, 0, sizeof(*ehdr), src, &err)) {
3291         goto exit_errmsg;
3292     }
3293     if (!elf_check_ident(ehdr)) {
3294         error_setg(&err, "Invalid ELF image for this architecture");
3295         goto exit_errmsg;
3296     }
3297     bswap_ehdr(ehdr);
3298     if (!elf_check_ehdr(ehdr)) {
3299         error_setg(&err, "Invalid ELF image for this architecture");
3300         goto exit_errmsg;
3301     }
3302 
3303     phdr = imgsrc_read_alloc(ehdr->e_phoff,
3304                              ehdr->e_phnum * sizeof(struct elf_phdr),
3305                              src, &err);
3306     if (phdr == NULL) {
3307         goto exit_errmsg;
3308     }
3309     bswap_phdr(phdr, ehdr->e_phnum);
3310 
3311     info->nsegs = 0;
3312     info->pt_dynamic_addr = 0;
3313 
3314     mmap_lock();
3315 
3316     /*
3317      * Find the maximum size of the image and allocate an appropriate
3318      * amount of memory to handle that.  Locate the interpreter, if any.
3319      */
3320     loaddr = -1, hiaddr = 0;
3321     align = 0;
3322     info->exec_stack = EXSTACK_DEFAULT;
3323     for (i = 0; i < ehdr->e_phnum; ++i) {
3324         struct elf_phdr *eppnt = phdr + i;
3325         if (eppnt->p_type == PT_LOAD) {
3326             abi_ulong a = eppnt->p_vaddr & TARGET_PAGE_MASK;
3327             if (a < loaddr) {
3328                 loaddr = a;
3329             }
3330             a = eppnt->p_vaddr + eppnt->p_memsz - 1;
3331             if (a > hiaddr) {
3332                 hiaddr = a;
3333             }
3334             ++info->nsegs;
3335             align |= eppnt->p_align;
3336         } else if (eppnt->p_type == PT_INTERP && pinterp_name) {
3337             g_autofree char *interp_name = NULL;
3338 
3339             if (*pinterp_name) {
3340                 error_setg(&err, "Multiple PT_INTERP entries");
3341                 goto exit_errmsg;
3342             }
3343 
3344             interp_name = imgsrc_read_alloc(eppnt->p_offset, eppnt->p_filesz,
3345                                             src, &err);
3346             if (interp_name == NULL) {
3347                 goto exit_errmsg;
3348             }
3349             if (interp_name[eppnt->p_filesz - 1] != 0) {
3350                 error_setg(&err, "Invalid PT_INTERP entry");
3351                 goto exit_errmsg;
3352             }
3353             *pinterp_name = g_steal_pointer(&interp_name);
3354         } else if (eppnt->p_type == PT_GNU_PROPERTY) {
3355             if (!parse_elf_properties(src, info, eppnt, &err)) {
3356                 goto exit_errmsg;
3357             }
3358         } else if (eppnt->p_type == PT_GNU_STACK) {
3359             info->exec_stack = eppnt->p_flags & PF_X;
3360         }
3361     }
3362 
3363     load_addr = loaddr;
3364 
3365     align = pow2ceil(align);
3366 
3367     if (pinterp_name != NULL) {
3368         if (ehdr->e_type == ET_EXEC) {
3369             /*
3370              * Make sure that the low address does not conflict with
3371              * MMAP_MIN_ADDR or the QEMU application itself.
3372              */
3373             probe_guest_base(image_name, loaddr, hiaddr);
3374         } else {
3375             /*
3376              * The binary is dynamic, but we still need to
3377              * select guest_base.  In this case we pass a size.
3378              */
3379             probe_guest_base(image_name, 0, hiaddr - loaddr);
3380 
3381             /*
3382              * Avoid collision with the loader by providing a different
3383              * default load address.
3384              */
3385             load_addr += elf_et_dyn_base;
3386 
3387             /*
3388              * TODO: Better support for mmap alignment is desirable.
3389              * Since we do not have complete control over the guest
3390              * address space, we prefer the kernel to choose some address
3391              * rather than force the use of LOAD_ADDR via MAP_FIXED.
3392              */
3393             if (align) {
3394                 load_addr &= -align;
3395             }
3396         }
3397     }
3398 
3399     /*
3400      * Reserve address space for all of this.
3401      *
3402      * In the case of ET_EXEC, we supply MAP_FIXED_NOREPLACE so that we get
3403      * exactly the address range that is required.  Without reserved_va,
3404      * the guest address space is not isolated.  We have attempted to avoid
3405      * conflict with the host program itself via probe_guest_base, but using
3406      * MAP_FIXED_NOREPLACE instead of MAP_FIXED provides an extra check.
3407      *
3408      * Otherwise this is ET_DYN, and we are searching for a location
3409      * that can hold the memory space required.  If the image is
3410      * pre-linked, LOAD_ADDR will be non-zero, and the kernel should
3411      * honor that address if it happens to be free.
3412      *
3413      * In both cases, we will overwrite pages in this range with mappings
3414      * from the executable.
3415      */
3416     reserve_size = (size_t)hiaddr - loaddr + 1;
3417     align_size = reserve_size;
3418 
3419     if (ehdr->e_type != ET_EXEC && align > qemu_real_host_page_size()) {
3420         align_size += align - 1;
3421     }
3422 
3423     load_addr = target_mmap(load_addr, align_size, PROT_NONE,
3424                             MAP_PRIVATE | MAP_ANON | MAP_NORESERVE |
3425                             (ehdr->e_type == ET_EXEC ? MAP_FIXED_NOREPLACE : 0),
3426                             -1, 0);
3427     if (load_addr == -1) {
3428         goto exit_mmap;
3429     }
3430 
3431     if (align_size != reserve_size) {
3432         abi_ulong align_addr = ROUND_UP(load_addr, align);
3433         abi_ulong align_end = TARGET_PAGE_ALIGN(align_addr + reserve_size);
3434         abi_ulong load_end = TARGET_PAGE_ALIGN(load_addr + align_size);
3435 
3436         if (align_addr != load_addr) {
3437             target_munmap(load_addr, align_addr - load_addr);
3438         }
3439         if (align_end != load_end) {
3440             target_munmap(align_end, load_end - align_end);
3441         }
3442         load_addr = align_addr;
3443     }
3444 
3445     load_bias = load_addr - loaddr;
3446 
3447     if (elf_is_fdpic(ehdr)) {
3448         struct elf32_fdpic_loadseg *loadsegs = info->loadsegs =
3449             g_malloc(sizeof(*loadsegs) * info->nsegs);
3450 
3451         for (i = 0; i < ehdr->e_phnum; ++i) {
3452             switch (phdr[i].p_type) {
3453             case PT_DYNAMIC:
3454                 info->pt_dynamic_addr = phdr[i].p_vaddr + load_bias;
3455                 break;
3456             case PT_LOAD:
3457                 loadsegs->addr = phdr[i].p_vaddr + load_bias;
3458                 loadsegs->p_vaddr = phdr[i].p_vaddr;
3459                 loadsegs->p_memsz = phdr[i].p_memsz;
3460                 ++loadsegs;
3461                 break;
3462             }
3463         }
3464     }
3465 
3466     info->load_bias = load_bias;
3467     info->code_offset = load_bias;
3468     info->data_offset = load_bias;
3469     info->load_addr = load_addr;
3470     info->entry = ehdr->e_entry + load_bias;
3471     info->start_code = -1;
3472     info->end_code = 0;
3473     info->start_data = -1;
3474     info->end_data = 0;
3475     /* Usual start for brk is after all sections of the main executable. */
3476     info->brk = TARGET_PAGE_ALIGN(hiaddr + load_bias);
3477     info->elf_flags = ehdr->e_flags;
3478 
3479     prot_exec = PROT_EXEC;
3480 #ifdef TARGET_AARCH64
3481     /*
3482      * If the BTI feature is present, this indicates that the executable
3483      * pages of the startup binary should be mapped with PROT_BTI, so that
3484      * branch targets are enforced.
3485      *
3486      * The startup binary is either the interpreter or the static executable.
3487      * The interpreter is responsible for all pages of a dynamic executable.
3488      *
3489      * Elf notes are backward compatible to older cpus.
3490      * Do not enable BTI unless it is supported.
3491      */
3492     if ((info->note_flags & GNU_PROPERTY_AARCH64_FEATURE_1_BTI)
3493         && (pinterp_name == NULL || *pinterp_name == 0)
3494         && cpu_isar_feature(aa64_bti, ARM_CPU(thread_cpu))) {
3495         prot_exec |= TARGET_PROT_BTI;
3496     }
3497 #endif
3498 
3499     for (i = 0; i < ehdr->e_phnum; i++) {
3500         struct elf_phdr *eppnt = phdr + i;
3501         if (eppnt->p_type == PT_LOAD) {
3502             abi_ulong vaddr, vaddr_po, vaddr_ps, vaddr_ef, vaddr_em;
3503             int elf_prot = 0;
3504 
3505             if (eppnt->p_flags & PF_R) {
3506                 elf_prot |= PROT_READ;
3507             }
3508             if (eppnt->p_flags & PF_W) {
3509                 elf_prot |= PROT_WRITE;
3510             }
3511             if (eppnt->p_flags & PF_X) {
3512                 elf_prot |= prot_exec;
3513             }
3514 
3515             vaddr = load_bias + eppnt->p_vaddr;
3516             vaddr_po = vaddr & ~TARGET_PAGE_MASK;
3517             vaddr_ps = vaddr & TARGET_PAGE_MASK;
3518 
3519             vaddr_ef = vaddr + eppnt->p_filesz;
3520             vaddr_em = vaddr + eppnt->p_memsz;
3521 
3522             /*
3523              * Some segments may be completely empty, with a non-zero p_memsz
3524              * but no backing file segment.
3525              */
3526             if (eppnt->p_filesz != 0) {
3527                 error = imgsrc_mmap(vaddr_ps, eppnt->p_filesz + vaddr_po,
3528                                     elf_prot, MAP_PRIVATE | MAP_FIXED,
3529                                     src, eppnt->p_offset - vaddr_po);
3530                 if (error == -1) {
3531                     goto exit_mmap;
3532                 }
3533             }
3534 
3535             /* If the load segment requests extra zeros (e.g. bss), map it. */
3536             if (vaddr_ef < vaddr_em &&
3537                 !zero_bss(vaddr_ef, vaddr_em, elf_prot, &err)) {
3538                 goto exit_errmsg;
3539             }
3540 
3541             /* Find the full program boundaries.  */
3542             if (elf_prot & PROT_EXEC) {
3543                 if (vaddr < info->start_code) {
3544                     info->start_code = vaddr;
3545                 }
3546                 if (vaddr_ef > info->end_code) {
3547                     info->end_code = vaddr_ef;
3548                 }
3549             }
3550             if (elf_prot & PROT_WRITE) {
3551                 if (vaddr < info->start_data) {
3552                     info->start_data = vaddr;
3553                 }
3554                 if (vaddr_ef > info->end_data) {
3555                     info->end_data = vaddr_ef;
3556                 }
3557             }
3558 #ifdef TARGET_MIPS
3559         } else if (eppnt->p_type == PT_MIPS_ABIFLAGS) {
3560             Mips_elf_abiflags_v0 abiflags;
3561 
3562             if (!imgsrc_read(&abiflags, eppnt->p_offset, sizeof(abiflags),
3563                              src, &err)) {
3564                 goto exit_errmsg;
3565             }
3566             bswap_mips_abiflags(&abiflags);
3567             info->fp_abi = abiflags.fp_abi;
3568 #endif
3569         }
3570     }
3571 
3572     if (info->end_data == 0) {
3573         info->start_data = info->end_code;
3574         info->end_data = info->end_code;
3575     }
3576 
3577     if (qemu_log_enabled()) {
3578         load_symbols(ehdr, src, load_bias);
3579     }
3580 
3581     debuginfo_report_elf(image_name, src->fd, load_bias);
3582 
3583     mmap_unlock();
3584 
3585     close(src->fd);
3586     return;
3587 
3588  exit_mmap:
3589     error_setg_errno(&err, errno, "Error mapping file");
3590     goto exit_errmsg;
3591  exit_errmsg:
3592     error_reportf_err(err, "%s: ", image_name);
3593     exit(-1);
3594 }
3595 
load_elf_interp(const char * filename,struct image_info * info,char bprm_buf[BPRM_BUF_SIZE])3596 static void load_elf_interp(const char *filename, struct image_info *info,
3597                             char bprm_buf[BPRM_BUF_SIZE])
3598 {
3599     struct elfhdr ehdr;
3600     ImageSource src;
3601     int fd, retval;
3602     Error *err = NULL;
3603 
3604     fd = open(path(filename), O_RDONLY);
3605     if (fd < 0) {
3606         error_setg_file_open(&err, errno, filename);
3607         error_report_err(err);
3608         exit(-1);
3609     }
3610 
3611     retval = read(fd, bprm_buf, BPRM_BUF_SIZE);
3612     if (retval < 0) {
3613         error_setg_errno(&err, errno, "Error reading file header");
3614         error_reportf_err(err, "%s: ", filename);
3615         exit(-1);
3616     }
3617 
3618     src.fd = fd;
3619     src.cache = bprm_buf;
3620     src.cache_size = retval;
3621 
3622     load_elf_image(filename, &src, info, &ehdr, NULL);
3623 }
3624 
3625 #ifndef vdso_image_info
3626 #ifdef VDSO_HEADER
3627 #include VDSO_HEADER
3628 #define  vdso_image_info(flags)  &vdso_image_info
3629 #else
3630 #define  vdso_image_info(flags)  NULL
3631 #endif /* VDSO_HEADER */
3632 #endif /* vdso_image_info */
3633 
load_elf_vdso(struct image_info * info,const VdsoImageInfo * vdso)3634 static void load_elf_vdso(struct image_info *info, const VdsoImageInfo *vdso)
3635 {
3636     ImageSource src;
3637     struct elfhdr ehdr;
3638     abi_ulong load_bias, load_addr;
3639 
3640     src.fd = -1;
3641     src.cache = vdso->image;
3642     src.cache_size = vdso->image_size;
3643 
3644     load_elf_image("<internal-vdso>", &src, info, &ehdr, NULL);
3645     load_addr = info->load_addr;
3646     load_bias = info->load_bias;
3647 
3648     /*
3649      * We need to relocate the VDSO image.  The one built into the kernel
3650      * is built for a fixed address.  The one built for QEMU is not, since
3651      * that requires close control of the guest address space.
3652      * We pre-processed the image to locate all of the addresses that need
3653      * to be updated.
3654      */
3655     for (unsigned i = 0, n = vdso->reloc_count; i < n; i++) {
3656         abi_ulong *addr = g2h_untagged(load_addr + vdso->relocs[i]);
3657         *addr = tswapal(tswapal(*addr) + load_bias);
3658     }
3659 
3660     /* Install signal trampolines, if present. */
3661     if (vdso->sigreturn_ofs) {
3662         default_sigreturn = load_addr + vdso->sigreturn_ofs;
3663     }
3664     if (vdso->rt_sigreturn_ofs) {
3665         default_rt_sigreturn = load_addr + vdso->rt_sigreturn_ofs;
3666     }
3667 
3668     /* Remove write from VDSO segment. */
3669     target_mprotect(info->start_data, info->end_data - info->start_data,
3670                     PROT_READ | PROT_EXEC);
3671 }
3672 
symfind(const void * s0,const void * s1)3673 static int symfind(const void *s0, const void *s1)
3674 {
3675     struct elf_sym *sym = (struct elf_sym *)s1;
3676     __typeof(sym->st_value) addr = *(uint64_t *)s0;
3677     int result = 0;
3678 
3679     if (addr < sym->st_value) {
3680         result = -1;
3681     } else if (addr >= sym->st_value + sym->st_size) {
3682         result = 1;
3683     }
3684     return result;
3685 }
3686 
lookup_symbolxx(struct syminfo * s,uint64_t orig_addr)3687 static const char *lookup_symbolxx(struct syminfo *s, uint64_t orig_addr)
3688 {
3689 #if ELF_CLASS == ELFCLASS32
3690     struct elf_sym *syms = s->disas_symtab.elf32;
3691 #else
3692     struct elf_sym *syms = s->disas_symtab.elf64;
3693 #endif
3694 
3695     // binary search
3696     struct elf_sym *sym;
3697 
3698     sym = bsearch(&orig_addr, syms, s->disas_num_syms, sizeof(*syms), symfind);
3699     if (sym != NULL) {
3700         return s->disas_strtab + sym->st_name;
3701     }
3702 
3703     return "";
3704 }
3705 
3706 /* FIXME: This should use elf_ops.h.inc  */
symcmp(const void * s0,const void * s1)3707 static int symcmp(const void *s0, const void *s1)
3708 {
3709     struct elf_sym *sym0 = (struct elf_sym *)s0;
3710     struct elf_sym *sym1 = (struct elf_sym *)s1;
3711     return (sym0->st_value < sym1->st_value)
3712         ? -1
3713         : ((sym0->st_value > sym1->st_value) ? 1 : 0);
3714 }
3715 
3716 /* Best attempt to load symbols from this ELF object. */
load_symbols(struct elfhdr * hdr,const ImageSource * src,abi_ulong load_bias)3717 static void load_symbols(struct elfhdr *hdr, const ImageSource *src,
3718                          abi_ulong load_bias)
3719 {
3720     int i, shnum, nsyms, sym_idx = 0, str_idx = 0;
3721     g_autofree struct elf_shdr *shdr = NULL;
3722     char *strings = NULL;
3723     struct elf_sym *syms = NULL;
3724     struct elf_sym *new_syms;
3725     uint64_t segsz;
3726 
3727     shnum = hdr->e_shnum;
3728     shdr = imgsrc_read_alloc(hdr->e_shoff, shnum * sizeof(struct elf_shdr),
3729                              src, NULL);
3730     if (shdr == NULL) {
3731         return;
3732     }
3733 
3734     bswap_shdr(shdr, shnum);
3735     for (i = 0; i < shnum; ++i) {
3736         if (shdr[i].sh_type == SHT_SYMTAB) {
3737             sym_idx = i;
3738             str_idx = shdr[i].sh_link;
3739             goto found;
3740         }
3741     }
3742 
3743     /* There will be no symbol table if the file was stripped.  */
3744     return;
3745 
3746  found:
3747     /* Now know where the strtab and symtab are.  Snarf them.  */
3748 
3749     segsz = shdr[str_idx].sh_size;
3750     strings = g_try_malloc(segsz);
3751     if (!strings) {
3752         goto give_up;
3753     }
3754     if (!imgsrc_read(strings, shdr[str_idx].sh_offset, segsz, src, NULL)) {
3755         goto give_up;
3756     }
3757 
3758     segsz = shdr[sym_idx].sh_size;
3759     if (segsz / sizeof(struct elf_sym) > INT_MAX) {
3760         /*
3761          * Implausibly large symbol table: give up rather than ploughing
3762          * on with the number of symbols calculation overflowing.
3763          */
3764         goto give_up;
3765     }
3766     nsyms = segsz / sizeof(struct elf_sym);
3767     syms = g_try_malloc(segsz);
3768     if (!syms) {
3769         goto give_up;
3770     }
3771     if (!imgsrc_read(syms, shdr[sym_idx].sh_offset, segsz, src, NULL)) {
3772         goto give_up;
3773     }
3774 
3775     for (i = 0; i < nsyms; ) {
3776         bswap_sym(syms + i);
3777         /* Throw away entries which we do not need.  */
3778         if (syms[i].st_shndx == SHN_UNDEF
3779             || syms[i].st_shndx >= SHN_LORESERVE
3780             || ELF_ST_TYPE(syms[i].st_info) != STT_FUNC) {
3781             if (i < --nsyms) {
3782                 syms[i] = syms[nsyms];
3783             }
3784         } else {
3785 #if defined(TARGET_ARM) || defined (TARGET_MIPS)
3786             /* The bottom address bit marks a Thumb or MIPS16 symbol.  */
3787             syms[i].st_value &= ~(target_ulong)1;
3788 #endif
3789             syms[i].st_value += load_bias;
3790             i++;
3791         }
3792     }
3793 
3794     /* No "useful" symbol.  */
3795     if (nsyms == 0) {
3796         goto give_up;
3797     }
3798 
3799     /*
3800      * Attempt to free the storage associated with the local symbols
3801      * that we threw away.  Whether or not this has any effect on the
3802      * memory allocation depends on the malloc implementation and how
3803      * many symbols we managed to discard.
3804      */
3805     new_syms = g_try_renew(struct elf_sym, syms, nsyms);
3806     if (new_syms == NULL) {
3807         goto give_up;
3808     }
3809     syms = new_syms;
3810 
3811     qsort(syms, nsyms, sizeof(*syms), symcmp);
3812 
3813     {
3814         struct syminfo *s = g_new(struct syminfo, 1);
3815 
3816         s->disas_strtab = strings;
3817         s->disas_num_syms = nsyms;
3818 #if ELF_CLASS == ELFCLASS32
3819         s->disas_symtab.elf32 = syms;
3820 #else
3821         s->disas_symtab.elf64 = syms;
3822 #endif
3823         s->lookup_symbol = lookup_symbolxx;
3824         s->next = syminfos;
3825         syminfos = s;
3826     }
3827     return;
3828 
3829  give_up:
3830     g_free(strings);
3831     g_free(syms);
3832 }
3833 
get_elf_eflags(int fd)3834 uint32_t get_elf_eflags(int fd)
3835 {
3836     struct elfhdr ehdr;
3837     off_t offset;
3838     int ret;
3839 
3840     /* Read ELF header */
3841     offset = lseek(fd, 0, SEEK_SET);
3842     if (offset == (off_t) -1) {
3843         return 0;
3844     }
3845     ret = read(fd, &ehdr, sizeof(ehdr));
3846     if (ret < sizeof(ehdr)) {
3847         return 0;
3848     }
3849     offset = lseek(fd, offset, SEEK_SET);
3850     if (offset == (off_t) -1) {
3851         return 0;
3852     }
3853 
3854     /* Check ELF signature */
3855     if (!elf_check_ident(&ehdr)) {
3856         return 0;
3857     }
3858 
3859     /* check header */
3860     bswap_ehdr(&ehdr);
3861     if (!elf_check_ehdr(&ehdr)) {
3862         return 0;
3863     }
3864 
3865     /* return architecture id */
3866     return ehdr.e_flags;
3867 }
3868 
load_elf_binary(struct linux_binprm * bprm,struct image_info * info)3869 int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
3870 {
3871     /*
3872      * We need a copy of the elf header for passing to create_elf_tables.
3873      * We will have overwritten the original when we re-use bprm->buf
3874      * while loading the interpreter.  Allocate the storage for this now
3875      * and let elf_load_image do any swapping that may be required.
3876      */
3877     struct elfhdr ehdr;
3878     struct image_info interp_info, vdso_info;
3879     char *elf_interpreter = NULL;
3880     char *scratch;
3881 
3882     memset(&interp_info, 0, sizeof(interp_info));
3883 #ifdef TARGET_MIPS
3884     interp_info.fp_abi = MIPS_ABI_FP_UNKNOWN;
3885 #endif
3886 
3887     load_elf_image(bprm->filename, &bprm->src, info, &ehdr, &elf_interpreter);
3888 
3889     /* Do this so that we can load the interpreter, if need be.  We will
3890        change some of these later */
3891     bprm->p = setup_arg_pages(bprm, info);
3892 
3893     scratch = g_new0(char, TARGET_PAGE_SIZE);
3894     if (STACK_GROWS_DOWN) {
3895         bprm->p = copy_elf_strings(1, &bprm->filename, scratch,
3896                                    bprm->p, info->stack_limit);
3897         info->file_string = bprm->p;
3898         bprm->p = copy_elf_strings(bprm->envc, bprm->envp, scratch,
3899                                    bprm->p, info->stack_limit);
3900         info->env_strings = bprm->p;
3901         bprm->p = copy_elf_strings(bprm->argc, bprm->argv, scratch,
3902                                    bprm->p, info->stack_limit);
3903         info->arg_strings = bprm->p;
3904     } else {
3905         info->arg_strings = bprm->p;
3906         bprm->p = copy_elf_strings(bprm->argc, bprm->argv, scratch,
3907                                    bprm->p, info->stack_limit);
3908         info->env_strings = bprm->p;
3909         bprm->p = copy_elf_strings(bprm->envc, bprm->envp, scratch,
3910                                    bprm->p, info->stack_limit);
3911         info->file_string = bprm->p;
3912         bprm->p = copy_elf_strings(1, &bprm->filename, scratch,
3913                                    bprm->p, info->stack_limit);
3914     }
3915 
3916     g_free(scratch);
3917 
3918     if (!bprm->p) {
3919         fprintf(stderr, "%s: %s\n", bprm->filename, strerror(E2BIG));
3920         exit(-1);
3921     }
3922 
3923     if (elf_interpreter) {
3924         load_elf_interp(elf_interpreter, &interp_info, bprm->buf);
3925 
3926         /*
3927          * While unusual because of ELF_ET_DYN_BASE, if we are unlucky
3928          * with the mappings the interpreter can be loaded above but
3929          * near the main executable, which can leave very little room
3930          * for the heap.
3931          * If the current brk has less than 16MB, use the end of the
3932          * interpreter.
3933          */
3934         if (interp_info.brk > info->brk &&
3935             interp_info.load_bias - info->brk < 16 * MiB)  {
3936             info->brk = interp_info.brk;
3937         }
3938 
3939         /* If the program interpreter is one of these two, then assume
3940            an iBCS2 image.  Otherwise assume a native linux image.  */
3941 
3942         if (strcmp(elf_interpreter, "/usr/lib/libc.so.1") == 0
3943             || strcmp(elf_interpreter, "/usr/lib/ld.so.1") == 0) {
3944             info->personality = PER_SVR4;
3945 
3946             /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
3947                and some applications "depend" upon this behavior.  Since
3948                we do not have the power to recompile these, we emulate
3949                the SVr4 behavior.  Sigh.  */
3950             target_mmap(0, TARGET_PAGE_SIZE, PROT_READ | PROT_EXEC,
3951                         MAP_FIXED_NOREPLACE | MAP_PRIVATE | MAP_ANONYMOUS,
3952                         -1, 0);
3953         }
3954 #ifdef TARGET_MIPS
3955         info->interp_fp_abi = interp_info.fp_abi;
3956 #endif
3957     }
3958 
3959     /*
3960      * Load a vdso if available, which will amongst other things contain the
3961      * signal trampolines.  Otherwise, allocate a separate page for them.
3962      */
3963     const VdsoImageInfo *vdso = vdso_image_info(info->elf_flags);
3964     if (vdso) {
3965         load_elf_vdso(&vdso_info, vdso);
3966         info->vdso = vdso_info.load_bias;
3967     } else if (TARGET_ARCH_HAS_SIGTRAMP_PAGE) {
3968         abi_long tramp_page = target_mmap(0, TARGET_PAGE_SIZE,
3969                                           PROT_READ | PROT_WRITE,
3970                                           MAP_PRIVATE | MAP_ANON, -1, 0);
3971         if (tramp_page == -1) {
3972             return -errno;
3973         }
3974 
3975         setup_sigtramp(tramp_page);
3976         target_mprotect(tramp_page, TARGET_PAGE_SIZE, PROT_READ | PROT_EXEC);
3977     }
3978 
3979     bprm->p = create_elf_tables(bprm->p, bprm->argc, bprm->envc, &ehdr, info,
3980                                 elf_interpreter ? &interp_info : NULL,
3981                                 vdso ? &vdso_info : NULL);
3982     info->start_stack = bprm->p;
3983 
3984     /* If we have an interpreter, set that as the program's entry point.
3985        Copy the load_bias as well, to help PPC64 interpret the entry
3986        point as a function descriptor.  Do this after creating elf tables
3987        so that we copy the original program entry point into the AUXV.  */
3988     if (elf_interpreter) {
3989         info->load_bias = interp_info.load_bias;
3990         info->entry = interp_info.entry;
3991         g_free(elf_interpreter);
3992     }
3993 
3994 #ifdef USE_ELF_CORE_DUMP
3995     bprm->core_dump = &elf_core_dump;
3996 #endif
3997 
3998     return 0;
3999 }
4000 
4001 #ifdef USE_ELF_CORE_DUMP
4002 
4003 /*
4004  * Definitions to generate Intel SVR4-like core files.
4005  * These mostly have the same names as the SVR4 types with "target_elf_"
4006  * tacked on the front to prevent clashes with linux definitions,
4007  * and the typedef forms have been avoided.  This is mostly like
4008  * the SVR4 structure, but more Linuxy, with things that Linux does
4009  * not support and which gdb doesn't really use excluded.
4010  *
4011  * Fields we don't dump (their contents is zero) in linux-user qemu
4012  * are marked with XXX.
4013  *
4014  * Core dump code is copied from linux kernel (fs/binfmt_elf.c).
4015  *
4016  * Porting ELF coredump for target is (quite) simple process.  First you
4017  * define USE_ELF_CORE_DUMP in target ELF code (where init_thread() for
4018  * the target resides):
4019  *
4020  * #define USE_ELF_CORE_DUMP
4021  *
4022  * Next you define type of register set used for dumping.  ELF specification
4023  * says that it needs to be array of elf_greg_t that has size of ELF_NREG.
4024  *
4025  * typedef <target_regtype> target_elf_greg_t;
4026  * #define ELF_NREG <number of registers>
4027  * typedef taret_elf_greg_t target_elf_gregset_t[ELF_NREG];
4028  *
4029  * Last step is to implement target specific function that copies registers
4030  * from given cpu into just specified register set.  Prototype is:
4031  *
4032  * static void elf_core_copy_regs(taret_elf_gregset_t *regs,
4033  *                                const CPUArchState *env);
4034  *
4035  * Parameters:
4036  *     regs - copy register values into here (allocated and zeroed by caller)
4037  *     env - copy registers from here
4038  *
4039  * Example for ARM target is provided in this file.
4040  */
4041 
4042 struct target_elf_siginfo {
4043     abi_int    si_signo; /* signal number */
4044     abi_int    si_code;  /* extra code */
4045     abi_int    si_errno; /* errno */
4046 };
4047 
4048 struct target_elf_prstatus {
4049     struct target_elf_siginfo pr_info;      /* Info associated with signal */
4050     abi_short          pr_cursig;    /* Current signal */
4051     abi_ulong          pr_sigpend;   /* XXX */
4052     abi_ulong          pr_sighold;   /* XXX */
4053     target_pid_t       pr_pid;
4054     target_pid_t       pr_ppid;
4055     target_pid_t       pr_pgrp;
4056     target_pid_t       pr_sid;
4057     struct target_timeval pr_utime;  /* XXX User time */
4058     struct target_timeval pr_stime;  /* XXX System time */
4059     struct target_timeval pr_cutime; /* XXX Cumulative user time */
4060     struct target_timeval pr_cstime; /* XXX Cumulative system time */
4061     target_elf_gregset_t      pr_reg;       /* GP registers */
4062     abi_int            pr_fpvalid;   /* XXX */
4063 };
4064 
4065 #define ELF_PRARGSZ     (80) /* Number of chars for args */
4066 
4067 struct target_elf_prpsinfo {
4068     char         pr_state;       /* numeric process state */
4069     char         pr_sname;       /* char for pr_state */
4070     char         pr_zomb;        /* zombie */
4071     char         pr_nice;        /* nice val */
4072     abi_ulong    pr_flag;        /* flags */
4073     target_uid_t pr_uid;
4074     target_gid_t pr_gid;
4075     target_pid_t pr_pid, pr_ppid, pr_pgrp, pr_sid;
4076     /* Lots missing */
4077     char    pr_fname[16] QEMU_NONSTRING; /* filename of executable */
4078     char    pr_psargs[ELF_PRARGSZ]; /* initial part of arg list */
4079 };
4080 
bswap_prstatus(struct target_elf_prstatus * prstatus)4081 static void bswap_prstatus(struct target_elf_prstatus *prstatus)
4082 {
4083     if (!target_needs_bswap()) {
4084         return;
4085     }
4086 
4087     prstatus->pr_info.si_signo = tswap32(prstatus->pr_info.si_signo);
4088     prstatus->pr_info.si_code = tswap32(prstatus->pr_info.si_code);
4089     prstatus->pr_info.si_errno = tswap32(prstatus->pr_info.si_errno);
4090     prstatus->pr_cursig = tswap16(prstatus->pr_cursig);
4091     prstatus->pr_sigpend = tswapal(prstatus->pr_sigpend);
4092     prstatus->pr_sighold = tswapal(prstatus->pr_sighold);
4093     prstatus->pr_pid = tswap32(prstatus->pr_pid);
4094     prstatus->pr_ppid = tswap32(prstatus->pr_ppid);
4095     prstatus->pr_pgrp = tswap32(prstatus->pr_pgrp);
4096     prstatus->pr_sid = tswap32(prstatus->pr_sid);
4097     /* cpu times are not filled, so we skip them */
4098     /* regs should be in correct format already */
4099     prstatus->pr_fpvalid = tswap32(prstatus->pr_fpvalid);
4100 }
4101 
bswap_psinfo(struct target_elf_prpsinfo * psinfo)4102 static void bswap_psinfo(struct target_elf_prpsinfo *psinfo)
4103 {
4104     if (!target_needs_bswap()) {
4105         return;
4106     }
4107 
4108     psinfo->pr_flag = tswapal(psinfo->pr_flag);
4109     psinfo->pr_uid = tswap16(psinfo->pr_uid);
4110     psinfo->pr_gid = tswap16(psinfo->pr_gid);
4111     psinfo->pr_pid = tswap32(psinfo->pr_pid);
4112     psinfo->pr_ppid = tswap32(psinfo->pr_ppid);
4113     psinfo->pr_pgrp = tswap32(psinfo->pr_pgrp);
4114     psinfo->pr_sid = tswap32(psinfo->pr_sid);
4115 }
4116 
bswap_note(struct elf_note * en)4117 static void bswap_note(struct elf_note *en)
4118 {
4119     if (!target_needs_bswap()) {
4120         return;
4121     }
4122 
4123     bswap32s(&en->n_namesz);
4124     bswap32s(&en->n_descsz);
4125     bswap32s(&en->n_type);
4126 }
4127 
4128 /*
4129  * Calculate file (dump) size of given memory region.
4130  */
vma_dump_size(vaddr start,vaddr end,int flags)4131 static size_t vma_dump_size(vaddr start, vaddr end, int flags)
4132 {
4133     /* The area must be readable. */
4134     if (!(flags & PAGE_READ)) {
4135         return 0;
4136     }
4137 
4138     /*
4139      * Usually we don't dump executable pages as they contain
4140      * non-writable code that debugger can read directly from
4141      * target library etc. If there is no elf header, we dump it.
4142      */
4143     if (!(flags & PAGE_WRITE_ORG) &&
4144         (flags & PAGE_EXEC) &&
4145         memcmp(g2h_untagged(start), ELFMAG, SELFMAG) == 0) {
4146         return 0;
4147     }
4148 
4149     return end - start;
4150 }
4151 
size_note(const char * name,size_t datasz)4152 static size_t size_note(const char *name, size_t datasz)
4153 {
4154     size_t namesz = strlen(name) + 1;
4155 
4156     namesz = ROUND_UP(namesz, 4);
4157     datasz = ROUND_UP(datasz, 4);
4158 
4159     return sizeof(struct elf_note) + namesz + datasz;
4160 }
4161 
fill_note(void ** pptr,int type,const char * name,size_t datasz)4162 static void *fill_note(void **pptr, int type, const char *name, size_t datasz)
4163 {
4164     void *ptr = *pptr;
4165     struct elf_note *n = ptr;
4166     size_t namesz = strlen(name) + 1;
4167 
4168     n->n_namesz = namesz;
4169     n->n_descsz = datasz;
4170     n->n_type = type;
4171     bswap_note(n);
4172 
4173     ptr += sizeof(*n);
4174     memcpy(ptr, name, namesz);
4175 
4176     namesz = ROUND_UP(namesz, 4);
4177     datasz = ROUND_UP(datasz, 4);
4178 
4179     *pptr = ptr + namesz + datasz;
4180     return ptr + namesz;
4181 }
4182 
fill_elf_header(struct elfhdr * elf,int segs,uint16_t machine,uint32_t flags)4183 static void fill_elf_header(struct elfhdr *elf, int segs, uint16_t machine,
4184                             uint32_t flags)
4185 {
4186     memcpy(elf->e_ident, ELFMAG, SELFMAG);
4187 
4188     elf->e_ident[EI_CLASS] = ELF_CLASS;
4189     elf->e_ident[EI_DATA] = ELF_DATA;
4190     elf->e_ident[EI_VERSION] = EV_CURRENT;
4191     elf->e_ident[EI_OSABI] = ELF_OSABI;
4192 
4193     elf->e_type = ET_CORE;
4194     elf->e_machine = machine;
4195     elf->e_version = EV_CURRENT;
4196     elf->e_phoff = sizeof(struct elfhdr);
4197     elf->e_flags = flags;
4198     elf->e_ehsize = sizeof(struct elfhdr);
4199     elf->e_phentsize = sizeof(struct elf_phdr);
4200     elf->e_phnum = segs;
4201 
4202     bswap_ehdr(elf);
4203 }
4204 
fill_elf_note_phdr(struct elf_phdr * phdr,size_t sz,off_t offset)4205 static void fill_elf_note_phdr(struct elf_phdr *phdr, size_t sz, off_t offset)
4206 {
4207     phdr->p_type = PT_NOTE;
4208     phdr->p_offset = offset;
4209     phdr->p_filesz = sz;
4210 
4211     bswap_phdr(phdr, 1);
4212 }
4213 
fill_prstatus_note(void * data,CPUState * cpu,int signr)4214 static void fill_prstatus_note(void *data, CPUState *cpu, int signr)
4215 {
4216     /*
4217      * Because note memory is only aligned to 4, and target_elf_prstatus
4218      * may well have higher alignment requirements, fill locally and
4219      * memcpy to the destination afterward.
4220      */
4221     struct target_elf_prstatus prstatus = {
4222         .pr_info.si_signo = signr,
4223         .pr_cursig = signr,
4224         .pr_pid = get_task_state(cpu)->ts_tid,
4225         .pr_ppid = getppid(),
4226         .pr_pgrp = getpgrp(),
4227         .pr_sid = getsid(0),
4228     };
4229 
4230     elf_core_copy_regs(&prstatus.pr_reg, cpu_env(cpu));
4231     bswap_prstatus(&prstatus);
4232     memcpy(data, &prstatus, sizeof(prstatus));
4233 }
4234 
fill_prpsinfo_note(void * data,const TaskState * ts)4235 static void fill_prpsinfo_note(void *data, const TaskState *ts)
4236 {
4237     /*
4238      * Because note memory is only aligned to 4, and target_elf_prpsinfo
4239      * may well have higher alignment requirements, fill locally and
4240      * memcpy to the destination afterward.
4241      */
4242     struct target_elf_prpsinfo psinfo = {
4243         .pr_pid = getpid(),
4244         .pr_ppid = getppid(),
4245         .pr_pgrp = getpgrp(),
4246         .pr_sid = getsid(0),
4247         .pr_uid = getuid(),
4248         .pr_gid = getgid(),
4249     };
4250     char *base_filename;
4251     size_t len;
4252 
4253     len = ts->info->env_strings - ts->info->arg_strings;
4254     len = MIN(len, ELF_PRARGSZ);
4255     memcpy(&psinfo.pr_psargs, g2h_untagged(ts->info->arg_strings), len);
4256     for (size_t i = 0; i < len; i++) {
4257         if (psinfo.pr_psargs[i] == 0) {
4258             psinfo.pr_psargs[i] = ' ';
4259         }
4260     }
4261 
4262     base_filename = g_path_get_basename(ts->bprm->filename);
4263     /*
4264      * Using strncpy here is fine: at max-length,
4265      * this field is not NUL-terminated.
4266      */
4267     strncpy(psinfo.pr_fname, base_filename, sizeof(psinfo.pr_fname));
4268     g_free(base_filename);
4269 
4270     bswap_psinfo(&psinfo);
4271     memcpy(data, &psinfo, sizeof(psinfo));
4272 }
4273 
fill_auxv_note(void * data,const TaskState * ts)4274 static void fill_auxv_note(void *data, const TaskState *ts)
4275 {
4276     memcpy(data, g2h_untagged(ts->info->saved_auxv), ts->info->auxv_len);
4277 }
4278 
4279 /*
4280  * Constructs name of coredump file.  We have following convention
4281  * for the name:
4282  *     qemu_<basename-of-target-binary>_<date>-<time>_<pid>.core
4283  *
4284  * Returns the filename
4285  */
core_dump_filename(const TaskState * ts)4286 static char *core_dump_filename(const TaskState *ts)
4287 {
4288     g_autoptr(GDateTime) now = g_date_time_new_now_local();
4289     g_autofree char *nowstr = g_date_time_format(now, "%Y%m%d-%H%M%S");
4290     g_autofree char *base_filename = g_path_get_basename(ts->bprm->filename);
4291 
4292     return g_strdup_printf("qemu_%s_%s_%d.core",
4293                            base_filename, nowstr, (int)getpid());
4294 }
4295 
dump_write(int fd,const void * ptr,size_t size)4296 static int dump_write(int fd, const void *ptr, size_t size)
4297 {
4298     const char *bufp = (const char *)ptr;
4299     ssize_t bytes_written, bytes_left;
4300 
4301     bytes_written = 0;
4302     bytes_left = size;
4303 
4304     /*
4305      * In normal conditions, single write(2) should do but
4306      * in case of socket etc. this mechanism is more portable.
4307      */
4308     do {
4309         bytes_written = write(fd, bufp, bytes_left);
4310         if (bytes_written < 0) {
4311             if (errno == EINTR)
4312                 continue;
4313             return (-1);
4314         } else if (bytes_written == 0) { /* eof */
4315             return (-1);
4316         }
4317         bufp += bytes_written;
4318         bytes_left -= bytes_written;
4319     } while (bytes_left > 0);
4320 
4321     return (0);
4322 }
4323 
wmr_page_unprotect_regions(void * opaque,vaddr start,vaddr end,int flags)4324 static int wmr_page_unprotect_regions(void *opaque, vaddr start,
4325                                       vaddr end, int flags)
4326 {
4327     if ((flags & (PAGE_WRITE | PAGE_WRITE_ORG)) == PAGE_WRITE_ORG) {
4328         size_t step = MAX(TARGET_PAGE_SIZE, qemu_real_host_page_size());
4329 
4330         while (1) {
4331             page_unprotect(NULL, start, 0);
4332             if (end - start <= step) {
4333                 break;
4334             }
4335             start += step;
4336         }
4337     }
4338     return 0;
4339 }
4340 
4341 typedef struct {
4342     unsigned count;
4343     size_t size;
4344 } CountAndSizeRegions;
4345 
wmr_count_and_size_regions(void * opaque,vaddr start,vaddr end,int flags)4346 static int wmr_count_and_size_regions(void *opaque, vaddr start,
4347                                       vaddr end, int flags)
4348 {
4349     CountAndSizeRegions *css = opaque;
4350 
4351     css->count++;
4352     css->size += vma_dump_size(start, end, flags);
4353     return 0;
4354 }
4355 
4356 typedef struct {
4357     struct elf_phdr *phdr;
4358     off_t offset;
4359 } FillRegionPhdr;
4360 
wmr_fill_region_phdr(void * opaque,vaddr start,vaddr end,int flags)4361 static int wmr_fill_region_phdr(void *opaque, vaddr start,
4362                                 vaddr end, int flags)
4363 {
4364     FillRegionPhdr *d = opaque;
4365     struct elf_phdr *phdr = d->phdr;
4366 
4367     phdr->p_type = PT_LOAD;
4368     phdr->p_vaddr = start;
4369     phdr->p_paddr = 0;
4370     phdr->p_filesz = vma_dump_size(start, end, flags);
4371     phdr->p_offset = d->offset;
4372     d->offset += phdr->p_filesz;
4373     phdr->p_memsz = end - start;
4374     phdr->p_flags = (flags & PAGE_READ ? PF_R : 0)
4375                   | (flags & PAGE_WRITE_ORG ? PF_W : 0)
4376                   | (flags & PAGE_EXEC ? PF_X : 0);
4377     phdr->p_align = ELF_EXEC_PAGESIZE;
4378 
4379     bswap_phdr(phdr, 1);
4380     d->phdr = phdr + 1;
4381     return 0;
4382 }
4383 
wmr_write_region(void * opaque,vaddr start,vaddr end,int flags)4384 static int wmr_write_region(void *opaque, vaddr start,
4385                             vaddr end, int flags)
4386 {
4387     int fd = *(int *)opaque;
4388     size_t size = vma_dump_size(start, end, flags);
4389 
4390     if (!size) {
4391         return 0;
4392     }
4393     return dump_write(fd, g2h_untagged(start), size);
4394 }
4395 
4396 /*
4397  * Write out ELF coredump.
4398  *
4399  * See documentation of ELF object file format in:
4400  * http://www.caldera.com/developers/devspecs/gabi41.pdf
4401  *
4402  * Coredump format in linux is following:
4403  *
4404  * 0   +----------------------+         \
4405  *     | ELF header           | ET_CORE  |
4406  *     +----------------------+          |
4407  *     | ELF program headers  |          |--- headers
4408  *     | - NOTE section       |          |
4409  *     | - PT_LOAD sections   |          |
4410  *     +----------------------+         /
4411  *     | NOTEs:               |
4412  *     | - NT_PRSTATUS        |
4413  *     | - NT_PRSINFO         |
4414  *     | - NT_AUXV            |
4415  *     +----------------------+ <-- aligned to target page
4416  *     | Process memory dump  |
4417  *     :                      :
4418  *     .                      .
4419  *     :                      :
4420  *     |                      |
4421  *     +----------------------+
4422  *
4423  * NT_PRSTATUS -> struct elf_prstatus (per thread)
4424  * NT_PRSINFO  -> struct elf_prpsinfo
4425  * NT_AUXV is array of { type, value } pairs (see fill_auxv_note()).
4426  *
4427  * Format follows System V format as close as possible.  Current
4428  * version limitations are as follows:
4429  *     - no floating point registers are dumped
4430  *
4431  * Function returns 0 in case of success, negative errno otherwise.
4432  *
4433  * TODO: make this work also during runtime: it should be
4434  * possible to force coredump from running process and then
4435  * continue processing.  For example qemu could set up SIGUSR2
4436  * handler (provided that target process haven't registered
4437  * handler for that) that does the dump when signal is received.
4438  */
elf_core_dump(int signr,const CPUArchState * env)4439 static int elf_core_dump(int signr, const CPUArchState *env)
4440 {
4441     const CPUState *cpu = env_cpu_const(env);
4442     const TaskState *ts = (const TaskState *)get_task_state((CPUState *)cpu);
4443     struct rlimit dumpsize;
4444     CountAndSizeRegions css;
4445     off_t offset, note_offset, data_offset;
4446     size_t note_size;
4447     int cpus, ret;
4448     int fd = -1;
4449     CPUState *cpu_iter;
4450 
4451     if (prctl(PR_GET_DUMPABLE) == 0) {
4452         return 0;
4453     }
4454 
4455     if (getrlimit(RLIMIT_CORE, &dumpsize) < 0 || dumpsize.rlim_cur == 0) {
4456         return 0;
4457     }
4458 
4459     cpu_list_lock();
4460     mmap_lock();
4461 
4462     /* By unprotecting, we merge vmas that might be split. */
4463     walk_memory_regions(NULL, wmr_page_unprotect_regions);
4464 
4465     /*
4466      * Walk through target process memory mappings and
4467      * set up structure containing this information.
4468      */
4469     memset(&css, 0, sizeof(css));
4470     walk_memory_regions(&css, wmr_count_and_size_regions);
4471 
4472     cpus = 0;
4473     CPU_FOREACH(cpu_iter) {
4474         cpus++;
4475     }
4476 
4477     offset = sizeof(struct elfhdr);
4478     offset += (css.count + 1) * sizeof(struct elf_phdr);
4479     note_offset = offset;
4480 
4481     offset += size_note("CORE", ts->info->auxv_len);
4482     offset += size_note("CORE", sizeof(struct target_elf_prpsinfo));
4483     offset += size_note("CORE", sizeof(struct target_elf_prstatus)) * cpus;
4484     note_size = offset - note_offset;
4485     data_offset = ROUND_UP(offset, ELF_EXEC_PAGESIZE);
4486 
4487     /* Do not dump if the corefile size exceeds the limit. */
4488     if (dumpsize.rlim_cur != RLIM_INFINITY
4489         && dumpsize.rlim_cur < data_offset + css.size) {
4490         errno = 0;
4491         goto out;
4492     }
4493 
4494     {
4495         g_autofree char *corefile = core_dump_filename(ts);
4496         fd = open(corefile, O_WRONLY | O_CREAT | O_TRUNC,
4497                   S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
4498     }
4499     if (fd < 0) {
4500         goto out;
4501     }
4502 
4503     /*
4504      * There is a fair amount of alignment padding within the notes
4505      * as well as preceeding the process memory.  Allocate a zeroed
4506      * block to hold it all.  Write all of the headers directly into
4507      * this buffer and then write it out as a block.
4508      */
4509     {
4510         g_autofree void *header = g_malloc0(data_offset);
4511         FillRegionPhdr frp;
4512         void *hptr, *dptr;
4513 
4514         /* Create elf file header. */
4515         hptr = header;
4516         fill_elf_header(hptr, css.count + 1, ELF_MACHINE, 0);
4517         hptr += sizeof(struct elfhdr);
4518 
4519         /* Create elf program headers. */
4520         fill_elf_note_phdr(hptr, note_size, note_offset);
4521         hptr += sizeof(struct elf_phdr);
4522 
4523         frp.phdr = hptr;
4524         frp.offset = data_offset;
4525         walk_memory_regions(&frp, wmr_fill_region_phdr);
4526         hptr = frp.phdr;
4527 
4528         /* Create the notes. */
4529         dptr = fill_note(&hptr, NT_AUXV, "CORE", ts->info->auxv_len);
4530         fill_auxv_note(dptr, ts);
4531 
4532         dptr = fill_note(&hptr, NT_PRPSINFO, "CORE",
4533                          sizeof(struct target_elf_prpsinfo));
4534         fill_prpsinfo_note(dptr, ts);
4535 
4536         CPU_FOREACH(cpu_iter) {
4537             dptr = fill_note(&hptr, NT_PRSTATUS, "CORE",
4538                              sizeof(struct target_elf_prstatus));
4539             fill_prstatus_note(dptr, cpu_iter, cpu_iter == cpu ? signr : 0);
4540         }
4541 
4542         if (dump_write(fd, header, data_offset) < 0) {
4543             goto out;
4544         }
4545     }
4546 
4547     /*
4548      * Finally write process memory into the corefile as well.
4549      */
4550     if (walk_memory_regions(&fd, wmr_write_region) < 0) {
4551         goto out;
4552     }
4553     errno = 0;
4554 
4555  out:
4556     ret = -errno;
4557     mmap_unlock();
4558     cpu_list_unlock();
4559     if (fd >= 0) {
4560         close(fd);
4561     }
4562     return ret;
4563 }
4564 #endif /* USE_ELF_CORE_DUMP */
4565 
do_init_thread(struct target_pt_regs * regs,struct image_info * infop)4566 void do_init_thread(struct target_pt_regs *regs, struct image_info *infop)
4567 {
4568     init_thread(regs, infop);
4569 }
4570