1 // SPDX-License-Identifier: GPL-2.0-only
2 #include <byteswap.h>
3 #include <elf.h>
4 #include <endian.h>
5 #include <errno.h>
6 #include <fcntl.h>
7 #include <inttypes.h>
8 #include <stdbool.h>
9 #include <stdio.h>
10 #include <stdlib.h>
11 #include <string.h>
12 #include <sys/mman.h>
13 #include <sys/types.h>
14 #include <sys/stat.h>
15 #include <unistd.h>
16
17 #ifdef be32toh
18 /* If libc provides le{16,32,64}toh() then we'll use them */
19 #elif BYTE_ORDER == LITTLE_ENDIAN
20 # define le16toh(x) (x)
21 # define le32toh(x) (x)
22 # define le64toh(x) (x)
23 #elif BYTE_ORDER == BIG_ENDIAN
24 # define le16toh(x) bswap_16(x)
25 # define le32toh(x) bswap_32(x)
26 # define le64toh(x) bswap_64(x)
27 #endif
28
29 /* MIPS opcodes, in bits 31:26 of an instruction */
30 #define OP_SPECIAL 0x00
31 #define OP_REGIMM 0x01
32 #define OP_BEQ 0x04
33 #define OP_BNE 0x05
34 #define OP_BLEZ 0x06
35 #define OP_BGTZ 0x07
36 #define OP_BEQL 0x14
37 #define OP_BNEL 0x15
38 #define OP_BLEZL 0x16
39 #define OP_BGTZL 0x17
40 #define OP_LL 0x30
41 #define OP_LLD 0x34
42 #define OP_SC 0x38
43 #define OP_SCD 0x3c
44
45 /* Bits 20:16 of OP_REGIMM instructions */
46 #define REGIMM_BLTZ 0x00
47 #define REGIMM_BGEZ 0x01
48 #define REGIMM_BLTZL 0x02
49 #define REGIMM_BGEZL 0x03
50 #define REGIMM_BLTZAL 0x10
51 #define REGIMM_BGEZAL 0x11
52 #define REGIMM_BLTZALL 0x12
53 #define REGIMM_BGEZALL 0x13
54
55 /* Bits 5:0 of OP_SPECIAL instructions */
56 #define SPECIAL_SYNC 0x0f
57
usage(FILE * f)58 static void usage(FILE *f)
59 {
60 fprintf(f, "Usage: loongson3-llsc-check /path/to/vmlinux\n");
61 }
62
se16(uint16_t x)63 static int se16(uint16_t x)
64 {
65 return (int16_t)x;
66 }
67
is_ll(uint32_t insn)68 static bool is_ll(uint32_t insn)
69 {
70 switch (insn >> 26) {
71 case OP_LL:
72 case OP_LLD:
73 return true;
74
75 default:
76 return false;
77 }
78 }
79
is_sc(uint32_t insn)80 static bool is_sc(uint32_t insn)
81 {
82 switch (insn >> 26) {
83 case OP_SC:
84 case OP_SCD:
85 return true;
86
87 default:
88 return false;
89 }
90 }
91
is_sync(uint32_t insn)92 static bool is_sync(uint32_t insn)
93 {
94 /* Bits 31:11 should all be zeroes */
95 if (insn >> 11)
96 return false;
97
98 /* Bits 5:0 specify the SYNC special encoding */
99 if ((insn & 0x3f) != SPECIAL_SYNC)
100 return false;
101
102 return true;
103 }
104
is_branch(uint32_t insn,int * off)105 static bool is_branch(uint32_t insn, int *off)
106 {
107 switch (insn >> 26) {
108 case OP_BEQ:
109 case OP_BEQL:
110 case OP_BNE:
111 case OP_BNEL:
112 case OP_BGTZ:
113 case OP_BGTZL:
114 case OP_BLEZ:
115 case OP_BLEZL:
116 *off = se16(insn) + 1;
117 return true;
118
119 case OP_REGIMM:
120 switch ((insn >> 16) & 0x1f) {
121 case REGIMM_BGEZ:
122 case REGIMM_BGEZL:
123 case REGIMM_BGEZAL:
124 case REGIMM_BGEZALL:
125 case REGIMM_BLTZ:
126 case REGIMM_BLTZL:
127 case REGIMM_BLTZAL:
128 case REGIMM_BLTZALL:
129 *off = se16(insn) + 1;
130 return true;
131
132 default:
133 return false;
134 }
135
136 default:
137 return false;
138 }
139 }
140
check_ll(uint64_t pc,uint32_t * code,size_t sz)141 static int check_ll(uint64_t pc, uint32_t *code, size_t sz)
142 {
143 ssize_t i, max, sc_pos;
144 int off;
145
146 /*
147 * Every LL must be preceded by a sync instruction in order to ensure
148 * that instruction reordering doesn't allow a prior memory access to
149 * execute after the LL & cause erroneous results.
150 */
151 if (!is_sync(le32toh(code[-1]))) {
152 fprintf(stderr, "%" PRIx64 ": LL not preceded by sync\n", pc);
153 return -EINVAL;
154 }
155
156 /* Find the matching SC instruction */
157 max = sz / 4;
158 for (sc_pos = 0; sc_pos < max; sc_pos++) {
159 if (is_sc(le32toh(code[sc_pos])))
160 break;
161 }
162 if (sc_pos >= max) {
163 fprintf(stderr, "%" PRIx64 ": LL has no matching SC\n", pc);
164 return -EINVAL;
165 }
166
167 /*
168 * Check branches within the LL/SC loop target sync instructions,
169 * ensuring that speculative execution can't generate memory accesses
170 * due to instructions outside of the loop.
171 */
172 for (i = 0; i < sc_pos; i++) {
173 if (!is_branch(le32toh(code[i]), &off))
174 continue;
175
176 /*
177 * If the branch target is within the LL/SC loop then we don't
178 * need to worry about it.
179 */
180 if ((off >= -i) && (off <= sc_pos))
181 continue;
182
183 /* If the branch targets a sync instruction we're all good... */
184 if (is_sync(le32toh(code[i + off])))
185 continue;
186
187 /* ...but if not, we have a problem */
188 fprintf(stderr, "%" PRIx64 ": Branch target not a sync\n",
189 pc + (i * 4));
190 return -EINVAL;
191 }
192
193 return 0;
194 }
195
check_code(uint64_t pc,uint32_t * code,size_t sz)196 static int check_code(uint64_t pc, uint32_t *code, size_t sz)
197 {
198 int err = 0;
199
200 if (sz % 4) {
201 fprintf(stderr, "%" PRIx64 ": Section size not a multiple of 4\n",
202 pc);
203 err = -EINVAL;
204 sz -= (sz % 4);
205 }
206
207 if (is_ll(le32toh(code[0]))) {
208 fprintf(stderr, "%" PRIx64 ": First instruction in section is an LL\n",
209 pc);
210 err = -EINVAL;
211 }
212
213 #define advance() ( \
214 code++, \
215 pc += 4, \
216 sz -= 4 \
217 )
218
219 /*
220 * Skip the first instruction, allowing check_ll to look backwards
221 * unconditionally.
222 */
223 advance();
224
225 /* Now scan through the code looking for LL instructions */
226 for (; sz; advance()) {
227 if (is_ll(le32toh(code[0])))
228 err |= check_ll(pc, code, sz);
229 }
230
231 return err;
232 }
233
main(int argc,char * argv[])234 int main(int argc, char *argv[])
235 {
236 int vmlinux_fd, status, err, i;
237 const char *vmlinux_path;
238 struct stat st;
239 Elf64_Ehdr *eh;
240 Elf64_Shdr *sh;
241 void *vmlinux;
242
243 status = EXIT_FAILURE;
244
245 if (argc < 2) {
246 usage(stderr);
247 goto out_ret;
248 }
249
250 vmlinux_path = argv[1];
251 vmlinux_fd = open(vmlinux_path, O_RDONLY);
252 if (vmlinux_fd == -1) {
253 perror("Unable to open vmlinux");
254 goto out_ret;
255 }
256
257 err = fstat(vmlinux_fd, &st);
258 if (err) {
259 perror("Unable to stat vmlinux");
260 goto out_close;
261 }
262
263 vmlinux = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, vmlinux_fd, 0);
264 if (vmlinux == MAP_FAILED) {
265 perror("Unable to mmap vmlinux");
266 goto out_close;
267 }
268
269 eh = vmlinux;
270 if (memcmp(eh->e_ident, ELFMAG, SELFMAG)) {
271 fprintf(stderr, "vmlinux is not an ELF?\n");
272 goto out_munmap;
273 }
274
275 if (eh->e_ident[EI_CLASS] != ELFCLASS64) {
276 fprintf(stderr, "vmlinux is not 64b?\n");
277 goto out_munmap;
278 }
279
280 if (eh->e_ident[EI_DATA] != ELFDATA2LSB) {
281 fprintf(stderr, "vmlinux is not little endian?\n");
282 goto out_munmap;
283 }
284
285 for (i = 0; i < le16toh(eh->e_shnum); i++) {
286 sh = vmlinux + le64toh(eh->e_shoff) + (i * le16toh(eh->e_shentsize));
287
288 if (sh->sh_type != SHT_PROGBITS)
289 continue;
290 if (!(sh->sh_flags & SHF_EXECINSTR))
291 continue;
292
293 err = check_code(le64toh(sh->sh_addr),
294 vmlinux + le64toh(sh->sh_offset),
295 le64toh(sh->sh_size));
296 if (err)
297 goto out_munmap;
298 }
299
300 status = EXIT_SUCCESS;
301 out_munmap:
302 munmap(vmlinux, st.st_size);
303 out_close:
304 close(vmlinux_fd);
305 out_ret:
306 fprintf(stdout, "loongson3-llsc-check returns %s\n",
307 status ? "failure" : "success");
308 return status;
309 }
310