mdreloc.c revision 1.67
1 /* $NetBSD: mdreloc.c,v 1.67 2017/12/25 17:00:15 joerg Exp $ */ 2 3 /*- 4 * Copyright (c) 2000 Eduardo Horvath. 5 * Copyright (c) 1999, 2002 The NetBSD Foundation, Inc. 6 * All rights reserved. 7 * 8 * This code is derived from software contributed to The NetBSD Foundation 9 * by Paul Kranenburg and by Charles M. Hannum. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 #ifndef lint 35 __RCSID("$NetBSD: mdreloc.c,v 1.67 2017/12/25 17:00:15 joerg Exp $"); 36 #endif /* not lint */ 37 38 #include <errno.h> 39 #include <stdio.h> 40 #include <stdlib.h> 41 #include <string.h> 42 #include <unistd.h> 43 44 #include "rtldenv.h" 45 #include "debug.h" 46 #include "rtld.h" 47 48 /* 49 * The following table holds for each relocation type: 50 * - the width in bits of the memory location the relocation 51 * applies to (not currently used) 52 * - the number of bits the relocation value must be shifted to the 53 * right (i.e. discard least significant bits) to fit into 54 * the appropriate field in the instruction word. 55 * - flags indicating whether 56 * * the relocation involves a symbol 57 * * the relocation is relative to the current position 58 * * the relocation is for a GOT entry 59 * * the relocation is relative to the load address 60 * 61 */ 62 #define _RF_S 0x80000000 /* Resolve symbol */ 63 #define _RF_A 0x40000000 /* Use addend */ 64 #define _RF_P 0x20000000 /* Location relative */ 65 #define _RF_G 0x10000000 /* GOT offset */ 66 #define _RF_B 0x08000000 /* Load address relative */ 67 #define _RF_U 0x04000000 /* Unaligned */ 68 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 69 #define _RF_RS(s) ( (s) & 0xff) /* right shift */ 70 static const int reloc_target_flags[R_TYPE(TLS_TPOFF64)+1] = { 71 0, /* NONE */ 72 _RF_S|_RF_A| _RF_SZ(8) | _RF_RS(0), /* RELOC_8 */ 73 _RF_S|_RF_A| _RF_SZ(16) | _RF_RS(0), /* RELOC_16 */ 74 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* RELOC_32 */ 75 _RF_S|_RF_A|_RF_P| _RF_SZ(8) | _RF_RS(0), /* DISP_8 */ 76 _RF_S|_RF_A|_RF_P| _RF_SZ(16) | _RF_RS(0), /* DISP_16 */ 77 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* DISP_32 */ 78 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_30 */ 79 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_22 */ 80 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* HI22 */ 81 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 22 */ 82 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 13 */ 83 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* LO10 */ 84 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT10 */ 85 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT13 */ 86 _RF_G| _RF_SZ(32) | _RF_RS(10), /* GOT22 */ 87 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PC10 */ 88 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PC22 */ 89 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WPLT30 */ 90 _RF_SZ(32) | _RF_RS(0), /* COPY */ 91 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* GLOB_DAT */ 92 _RF_SZ(32) | _RF_RS(0), /* JMP_SLOT */ 93 _RF_A| _RF_B| _RF_SZ(64) | _RF_RS(0), /* RELATIVE */ 94 _RF_S|_RF_A| _RF_U| _RF_SZ(32) | _RF_RS(0), /* UA_32 */ 95 96 _RF_A| _RF_SZ(32) | _RF_RS(0), /* PLT32 */ 97 _RF_A| _RF_SZ(32) | _RF_RS(10), /* HIPLT22 */ 98 _RF_A| _RF_SZ(32) | _RF_RS(0), /* LOPLT10 */ 99 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PCPLT32 */ 100 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PCPLT22 */ 101 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PCPLT10 */ 102 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 10 */ 103 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 11 */ 104 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* 64 */ 105 _RF_S|_RF_A|/*extra*/ _RF_SZ(32) | _RF_RS(0), /* OLO10 */ 106 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(42), /* HH22 */ 107 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(32), /* HM10 */ 108 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* LM22 */ 109 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(42), /* PC_HH22 */ 110 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(32), /* PC_HM10 */ 111 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PC_LM22 */ 112 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP16 */ 113 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP19 */ 114 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* GLOB_JMP */ 115 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 7 */ 116 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 5 */ 117 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 6 */ 118 _RF_S|_RF_A|_RF_P| _RF_SZ(64) | _RF_RS(0), /* DISP64 */ 119 _RF_A| _RF_SZ(64) | _RF_RS(0), /* PLT64 */ 120 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* HIX22 */ 121 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* LOX10 */ 122 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(22), /* H44 */ 123 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(12), /* M44 */ 124 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* L44 */ 125 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* REGISTER */ 126 _RF_S|_RF_A| _RF_U| _RF_SZ(64) | _RF_RS(0), /* UA64 */ 127 _RF_S|_RF_A| _RF_U| _RF_SZ(16) | _RF_RS(0), /* UA16 */ 128 /* TLS relocs not represented here! */ 129 }; 130 131 #ifdef RTLD_DEBUG_RELOC 132 static const char *reloc_names[] = { 133 "NONE", "RELOC_8", "RELOC_16", "RELOC_32", "DISP_8", 134 "DISP_16", "DISP_32", "WDISP_30", "WDISP_22", "HI22", 135 "22", "13", "LO10", "GOT10", "GOT13", 136 "GOT22", "PC10", "PC22", "WPLT30", "COPY", 137 "GLOB_DAT", "JMP_SLOT", "RELATIVE", "UA_32", "PLT32", 138 "HIPLT22", "LOPLT10", "LOPLT10", "PCPLT22", "PCPLT32", 139 "10", "11", "64", "OLO10", "HH22", 140 "HM10", "LM22", "PC_HH22", "PC_HM10", "PC_LM22", 141 "WDISP16", "WDISP19", "GLOB_JMP", "7", "5", "6", 142 "DISP64", "PLT64", "HIX22", "LOX10", "H44", "M44", 143 "L44", "REGISTER", "UA64", "UA16", 144 "TLS_GD_HI22", "TLS_GD_LO10", "TLS_GD_ADD", "TLS_GD_CALL", 145 "TLS_LDM_HI22", "TLS_LDM_LO10", "TLS_LDM_ADD", "TLS_LDM_CALL", 146 "TLS_LDO_HIX22", "TLS_LDO_LOX10", "TLS_LDO_ADD", "TLS_IE_HI22", 147 "TLS_IE_LO10", "TLS_IE_LD", "TLS_IE_LDX", "TLS_IE_ADD", "TLS_LE_HIX22", 148 "TLS_LE_LOX10", "TLS_DTPMOD32", "TLS_DTPMOD64", "TLS_DTPOFF32", 149 "TLS_DTPOFF64", "TLS_TPOFF32", "TLS_TPOFF64", 150 }; 151 #endif 152 153 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 154 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 155 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 156 #define RELOC_UNALIGNED(t) ((reloc_target_flags[t] & _RF_U) != 0) 157 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 158 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 159 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 160 #define RELOC_TLS(t) (t >= R_TYPE(TLS_GD_HI22)) 161 162 static const long reloc_target_bitmask[] = { 163 #define _BM(x) (~(-(1ULL << (x)))) 164 0, /* NONE */ 165 _BM(8), _BM(16), _BM(32), /* RELOC_8, _16, _32 */ 166 _BM(8), _BM(16), _BM(32), /* DISP8, DISP16, DISP32 */ 167 _BM(30), _BM(22), /* WDISP30, WDISP22 */ 168 _BM(22), _BM(22), /* HI22, _22 */ 169 _BM(13), _BM(10), /* RELOC_13, _LO10 */ 170 _BM(10), _BM(13), _BM(22), /* GOT10, GOT13, GOT22 */ 171 _BM(10), _BM(22), /* _PC10, _PC22 */ 172 _BM(30), 0, /* _WPLT30, _COPY */ 173 -1, _BM(32), -1, /* _GLOB_DAT, JMP_SLOT, _RELATIVE */ 174 _BM(32), _BM(32), /* _UA32, PLT32 */ 175 _BM(22), _BM(10), /* _HIPLT22, LOPLT10 */ 176 _BM(32), _BM(22), _BM(10), /* _PCPLT32, _PCPLT22, _PCPLT10 */ 177 _BM(10), _BM(11), -1, /* _10, _11, _64 */ 178 _BM(13), _BM(22), /* _OLO10, _HH22 */ 179 _BM(10), _BM(22), /* _HM10, _LM22 */ 180 _BM(22), _BM(10), _BM(22), /* _PC_HH22, _PC_HM10, _PC_LM22 */ 181 _BM(16), _BM(19), /* _WDISP16, _WDISP19 */ 182 -1, /* GLOB_JMP */ 183 _BM(7), _BM(5), _BM(6), /* _7, _5, _6 */ 184 -1, -1, /* DISP64, PLT64 */ 185 _BM(22), _BM(13), /* HIX22, LOX10 */ 186 _BM(22), _BM(10), _BM(12), /* H44, M44, L44 */ 187 -1, -1, _BM(16), /* REGISTER, UA64, UA16 */ 188 #undef _BM 189 }; 190 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 191 192 /* 193 * Instruction templates: 194 */ 195 #define BAA 0x30680000 /* ba,a %xcc, 0 */ 196 #define SETHI 0x03000000 /* sethi %hi(0), %g1 */ 197 #define JMP 0x81c06000 /* jmpl %g1+%lo(0), %g0 */ 198 #define NOP 0x01000000 /* sethi %hi(0), %g0 */ 199 #define OR 0x82106000 /* or %g1, 0, %g1 */ 200 #define XOR 0x82186000 /* xor %g1, 0, %g1 */ 201 #define MOV71 0x8213e000 /* or %o7, 0, %g1 */ 202 #define MOV17 0x9e106000 /* or %g1, 0, %o7 */ 203 #define CALL 0x40000000 /* call 0 */ 204 #define SLLX 0x83287000 /* sllx %g1, 0, %g1 */ 205 #define NEG 0x82200001 /* neg %g1 */ 206 #define SETHIG5 0x0b000000 /* sethi %hi(0), %g5 */ 207 #define ORG5 0x82104005 /* or %g1, %g5, %g1 */ 208 209 210 /* %hi(v)/%lo(v) with variable shift */ 211 #define HIVAL(v, s) (((v) >> (s)) & 0x003fffff) 212 #define LOVAL(v, s) (((v) >> (s)) & 0x000003ff) 213 214 void _rtld_bind_start_0(long, long); 215 void _rtld_bind_start_1(long, long); 216 void _rtld_relocate_nonplt_self(Elf_Dyn *, Elf_Addr); 217 caddr_t _rtld_bind(const Obj_Entry *, Elf_Word); 218 219 /* 220 * Install rtld function call into this PLT slot. 221 */ 222 #define SAVE 0x9de3bf50 /* i.e. `save %sp,-176,%sp' */ 223 #define SETHI_l0 0x21000000 224 #define SETHI_l1 0x23000000 225 #define OR_l0_l0 0xa0142000 226 #define SLLX_l0_32_l0 0xa12c3020 227 #define OR_l0_l1_l0 0xa0140011 228 #define JMPL_l0_o0 0x91c42000 229 #define MOV_g1_o1 0x92100001 230 231 void _rtld_install_plt(Elf_Word *, Elf_Addr); 232 static inline int _rtld_relocate_plt_object(const Obj_Entry *, 233 const Elf_Rela *, Elf_Addr *); 234 235 void 236 _rtld_install_plt(Elf_Word *pltgot, Elf_Addr proc) 237 { 238 pltgot[0] = SAVE; 239 pltgot[1] = SETHI_l0 | HIVAL(proc, 42); 240 pltgot[2] = SETHI_l1 | HIVAL(proc, 10); 241 pltgot[3] = OR_l0_l0 | LOVAL(proc, 32); 242 pltgot[4] = SLLX_l0_32_l0; 243 pltgot[5] = OR_l0_l1_l0; 244 pltgot[6] = JMPL_l0_o0 | LOVAL(proc, 0); 245 pltgot[7] = MOV_g1_o1; 246 } 247 248 void 249 _rtld_setup_pltgot(const Obj_Entry *obj) 250 { 251 /* 252 * On sparc64 we got troubles. 253 * 254 * Instructions are 4 bytes long. 255 * Elf[64]_Addr is 8 bytes long, so are our pltglot[] 256 * array entries. 257 * Each PLT entry jumps to PLT0 to enter the dynamic 258 * linker. 259 * Loading an arbitrary 64-bit pointer takes 6 260 * instructions and 2 registers. 261 * 262 * Somehow we need to issue a save to get a new stack 263 * frame, load the address of the dynamic linker, and 264 * jump there, in 8 instructions or less. 265 * 266 * Oh, we need to fill out both PLT0 and PLT1. 267 */ 268 { 269 Elf_Word *entry = (Elf_Word *)obj->pltgot; 270 271 /* Install in entries 0 and 1 */ 272 _rtld_install_plt(&entry[0], (Elf_Addr) &_rtld_bind_start_0); 273 _rtld_install_plt(&entry[8], (Elf_Addr) &_rtld_bind_start_1); 274 275 /* 276 * Install the object reference in first slot 277 * of entry 2. 278 */ 279 obj->pltgot[8] = (Elf_Addr) obj; 280 } 281 } 282 283 void 284 _rtld_relocate_nonplt_self(Elf_Dyn *dynp, Elf_Addr relocbase) 285 { 286 const Elf_Rela *rela = 0, *relalim; 287 Elf_Addr relasz = 0; 288 Elf_Addr *where; 289 290 for (; dynp->d_tag != DT_NULL; dynp++) { 291 switch (dynp->d_tag) { 292 case DT_RELA: 293 rela = (const Elf_Rela *)(relocbase + dynp->d_un.d_ptr); 294 break; 295 case DT_RELASZ: 296 relasz = dynp->d_un.d_val; 297 break; 298 } 299 } 300 relalim = (const Elf_Rela *)((const uint8_t *)rela + relasz); 301 for (; rela < relalim; rela++) { 302 where = (Elf_Addr *)(relocbase + rela->r_offset); 303 *where = (Elf_Addr)(relocbase + rela->r_addend); 304 } 305 } 306 307 int 308 _rtld_relocate_nonplt_objects(Obj_Entry *obj) 309 { 310 const Elf_Rela *rela; 311 const Elf_Sym *def = NULL; 312 const Obj_Entry *defobj = NULL; 313 unsigned long last_symnum = ULONG_MAX; 314 315 for (rela = obj->rela; rela < obj->relalim; rela++) { 316 Elf_Addr *where; 317 Elf_Word type; 318 Elf_Addr value = 0, mask; 319 unsigned long symnum; 320 321 where = (Elf_Addr *) (obj->relocbase + rela->r_offset); 322 323 type = ELF_R_TYPE(rela->r_info); 324 if (type == R_TYPE(NONE)) 325 continue; 326 327 /* OLO10 relocations have extra info */ 328 if ((type & 0x00ff) == R_SPARC_OLO10) 329 type = R_SPARC_OLO10; 330 331 /* We do JMP_SLOTs in _rtld_bind() below */ 332 if (type == R_TYPE(JMP_SLOT)) 333 continue; 334 335 /* IFUNC relocations are handled in _rtld_call_ifunc */ 336 if (type == R_TYPE(IRELATIVE)) { 337 if (obj->ifunc_remaining_nonplt == 0) 338 obj->ifunc_remaining_nonplt = rela - obj->rela + 1; 339 continue; 340 } 341 342 /* COPY relocs are also handled elsewhere */ 343 if (type == R_TYPE(COPY)) 344 continue; 345 346 /* 347 * We use the fact that relocation types are an `enum' 348 * Note: R_SPARC_TLS_TPOFF64 is currently numerically largest. 349 */ 350 if (type > R_TYPE(TLS_TPOFF64)) { 351 dbg(("unknown relocation type %x at %p", type, rela)); 352 return -1; 353 } 354 355 value = rela->r_addend; 356 357 if (RELOC_RESOLVE_SYMBOL(type) || RELOC_TLS(type)) { 358 symnum = ELF_R_SYM(rela->r_info); 359 if (last_symnum != symnum) { 360 last_symnum = symnum; 361 def = _rtld_find_symdef(symnum, obj, &defobj, 362 false); 363 if (def == NULL) 364 return -1; 365 } 366 } 367 368 /* 369 * Handle TLS relocations here, they are different. 370 */ 371 if (RELOC_TLS(type)) { 372 switch (type) { 373 case R_TYPE(TLS_DTPMOD64): 374 *where = (Elf64_Addr)defobj->tlsindex; 375 376 rdbg(("TLS_DTPMOD64 %s in %s --> %p", 377 obj->strtab + 378 obj->symtab[symnum].st_name, 379 obj->path, (void *)*where)); 380 381 break; 382 383 case R_TYPE(TLS_DTPOFF64): 384 *where = (Elf64_Addr)(def->st_value 385 + rela->r_addend); 386 387 rdbg(("DTPOFF64 %s in %s --> %p", 388 obj->strtab + 389 obj->symtab[symnum].st_name, 390 obj->path, (void *)*where)); 391 392 break; 393 394 case R_TYPE(TLS_TPOFF64): 395 if (!defobj->tls_done && 396 _rtld_tls_offset_allocate(obj)) 397 return -1; 398 399 *where = (Elf64_Addr)(def->st_value - 400 defobj->tlsoffset + rela->r_addend); 401 402 rdbg(("TLS_TPOFF64 %s in %s --> %p", 403 obj->strtab + obj->symtab[symnum].st_name, 404 obj->path, (void *)*where)); 405 406 break; 407 } 408 continue; 409 } 410 411 /* 412 * Handle relative relocs here, as an optimization. 413 */ 414 if (type == R_TYPE(RELATIVE)) { 415 *where = (Elf_Addr)(obj->relocbase + value); 416 rdbg(("RELATIVE in %s --> %p", obj->path, 417 (void *)*where)); 418 continue; 419 } 420 421 if (RELOC_RESOLVE_SYMBOL(type)) { 422 /* Add in the symbol's absolute address */ 423 value += (Elf_Addr)(defobj->relocbase + def->st_value); 424 } 425 426 if (type == R_SPARC_OLO10) { 427 value = (value & 0x3ff) 428 + (((Elf64_Xword)rela->r_info<<32)>>40); 429 } 430 431 if (RELOC_PC_RELATIVE(type)) { 432 value -= (Elf_Addr)where; 433 } 434 435 if (RELOC_BASE_RELATIVE(type)) { 436 /* 437 * Note that even though sparcs use `Elf_rela' 438 * exclusively we still need the implicit memory addend 439 * in relocations referring to GOT entries. 440 * Undoubtedly, someone f*cked this up in the distant 441 * past, and now we're stuck with it in the name of 442 * compatibility for all eternity.. 443 * 444 * In any case, the implicit and explicit should be 445 * mutually exclusive. We provide a check for that 446 * here. 447 */ 448 #ifdef DIAGNOSTIC 449 if (value != 0 && *where != 0) { 450 xprintf("BASE_REL(%s): where=%p, *where 0x%lx, " 451 "addend=0x%lx, base %p\n", 452 obj->path, where, *where, 453 rela->r_addend, obj->relocbase); 454 } 455 #endif 456 /* XXXX -- apparently we ignore the preexisting value */ 457 value += (Elf_Addr)(obj->relocbase); 458 } 459 460 mask = RELOC_VALUE_BITMASK(type); 461 value >>= RELOC_VALUE_RIGHTSHIFT(type); 462 value &= mask; 463 464 if (RELOC_UNALIGNED(type)) { 465 /* Handle unaligned relocations. */ 466 Elf_Addr tmp = 0; 467 char *ptr = (char *)where; 468 int i, size = RELOC_TARGET_SIZE(type)/8; 469 470 /* Read it in one byte at a time. */ 471 for (i=0; i<size; i++) 472 tmp = (tmp << 8) | ptr[i]; 473 474 tmp &= ~mask; 475 tmp |= value; 476 477 /* Write it back out. */ 478 for (i=0; i<size; i++) 479 ptr[i] = ((tmp >> (8*i)) & 0xff); 480 #ifdef RTLD_DEBUG_RELOC 481 value = (Elf_Addr)tmp; 482 #endif 483 484 } else if (RELOC_TARGET_SIZE(type) > 32) { 485 *where &= ~mask; 486 *where |= value; 487 #ifdef RTLD_DEBUG_RELOC 488 value = (Elf_Addr)*where; 489 #endif 490 } else { 491 Elf32_Addr *where32 = (Elf32_Addr *)where; 492 493 *where32 &= ~mask; 494 *where32 |= value; 495 #ifdef RTLD_DEBUG_RELOC 496 value = (Elf_Addr)*where32; 497 #endif 498 } 499 500 #ifdef RTLD_DEBUG_RELOC 501 if (RELOC_RESOLVE_SYMBOL(type)) { 502 rdbg(("%s %s in %s --> %p in %s", reloc_names[type], 503 obj->strtab + obj->symtab[symnum].st_name, 504 obj->path, (void *)value, defobj->path)); 505 } else { 506 rdbg(("%s in %s --> %p", reloc_names[type], 507 obj->path, (void *)value)); 508 } 509 #endif 510 } 511 return (0); 512 } 513 514 int 515 _rtld_relocate_plt_lazy(Obj_Entry *obj) 516 { 517 const Elf_Rela *rela; 518 519 for (rela = obj->pltrelalim; rela-- > obj->pltrela; ) { 520 if (ELF_R_TYPE(rela->r_info) == R_TYPE(JMP_IREL)) 521 obj->ifunc_remaining = obj->pltrelalim - rela + 1; 522 } 523 524 return 0; 525 } 526 527 caddr_t 528 _rtld_bind(const Obj_Entry *obj, Elf_Word reloff) 529 { 530 const Elf_Rela *rela = obj->pltrela + reloff; 531 Elf_Addr result; 532 int err; 533 534 result = 0; /* XXX gcc */ 535 536 if (ELF_R_TYPE(obj->pltrela->r_info) == R_TYPE(JMP_SLOT) || 537 ELF_R_TYPE(obj->pltrela->r_info) == R_TYPE(JMP_IREL)) { 538 /* 539 * XXXX 540 * 541 * The first four PLT entries are reserved. There is some 542 * disagreement whether they should have associated relocation 543 * entries. Both the SPARC 32-bit and 64-bit ELF 544 * specifications say that they should have relocation entries, 545 * but the 32-bit SPARC binutils do not generate them, and now 546 * the 64-bit SPARC binutils have stopped generating them too. 547 * 548 * So, to provide binary compatibility, we will check the first 549 * entry, if it is reserved it should not be of the type 550 * JMP_SLOT or JMP_REL. If it is either of those, then 551 * the 4 reserved entries were not generated and our index 552 * is 4 entries too far. 553 */ 554 rela -= 4; 555 } 556 557 _rtld_shared_enter(); 558 err = _rtld_relocate_plt_object(obj, rela, &result); 559 if (err) 560 _rtld_die(); 561 _rtld_shared_exit(); 562 563 return (caddr_t)result; 564 } 565 566 int 567 _rtld_relocate_plt_objects(const Obj_Entry *obj) 568 { 569 const Elf_Rela *rela; 570 571 rela = obj->pltrela; 572 573 /* 574 * Check for first four reserved entries - and skip them. 575 * See above for details. 576 */ 577 if (ELF_R_TYPE(obj->pltrela->r_info) != R_TYPE(JMP_SLOT) && 578 ELF_R_TYPE(obj->pltrela->r_info) != R_TYPE(JMP_IREL)) 579 rela += 4; 580 581 for (; rela < obj->pltrelalim; rela++) 582 if (_rtld_relocate_plt_object(obj, rela, NULL) < 0) 583 return -1; 584 585 return 0; 586 } 587 588 static inline void 589 _rtld_write_plt(Elf_Word *where, Elf_Addr value, const Elf_Rela *rela, 590 const Obj_Entry *obj) 591 { 592 Elf_Addr offset, offBAA; 593 594 /* 595 * At the PLT entry pointed at by `where', we now construct a direct 596 * transfer to the now fully resolved function address. 597 * 598 * A PLT entry is supposed to start by looking like this: 599 * 600 * sethi %hi(. - .PLT0), %g1 601 * ba,a %xcc, .PLT1 602 * nop 603 * nop 604 * nop 605 * nop 606 * nop 607 * nop 608 * 609 * When we replace these entries we start from the last instruction 610 * and do it in reverse order so the last thing we do is replace the 611 * branch. That allows us to change this atomically. 612 * 613 * We now need to find out how far we need to jump. We have a choice 614 * of several different relocation techniques which are increasingly 615 * expensive. 616 */ 617 618 offset = ((Elf_Addr)where) - value; 619 offBAA = value - (((Elf_Addr)where) + 4); /* ba,a at where[1] */ 620 if (rela && rela->r_addend) { 621 Elf_Addr *ptr = (Elf_Addr *)where; 622 /* 623 * This entry is >= 32768. The relocations points to a 624 * PC-relative pointer to the bind_0 stub at the top of the 625 * PLT section. Update it to point to the target function. 626 */ 627 ptr[0] += value - (Elf_Addr)obj->pltgot; 628 } else if (offBAA <= (1L<<20) && (Elf_SOff)offBAA >= -(1L<<20)) { 629 /* 630 * We're within 1MB -- we can use a direct branch insn. 631 * 632 * We can generate this pattern: 633 * 634 * sethi %hi(. - .PLT0), %g1 635 * ba,a %xcc, addr 636 * nop 637 * nop 638 * nop 639 * nop 640 * nop 641 * nop 642 * 643 */ 644 where[1] = BAA | ((offBAA >> 2) & 0x7ffff); 645 __asm volatile("iflush %0+4" : : "r" (where)); 646 } else if (value < (1L<<32)) { 647 /* 648 * We're within 32-bits of address zero. 649 * 650 * The resulting code in the jump slot is: 651 * 652 * sethi %hi(. - .PLT0), %g1 653 * sethi %hi(addr), %g1 654 * jmp %g1+%lo(addr) 655 * nop 656 * nop 657 * nop 658 * nop 659 * nop 660 * 661 */ 662 where[2] = JMP | LOVAL(value, 0); 663 where[1] = SETHI | HIVAL(value, 10); 664 __asm volatile("iflush %0+8" : : "r" (where)); 665 __asm volatile("iflush %0+4" : : "r" (where)); 666 } else if ((Elf_SOff)value <= 0 && (Elf_SOff)value > -(1L<<32)) { 667 /* 668 * We're within 32-bits of address -1. 669 * 670 * The resulting code in the jump slot is: 671 * 672 * sethi %hi(. - .PLT0), %g1 673 * sethi %hix(addr), %g1 674 * xor %g1, %lox(addr), %g1 675 * jmp %g1 676 * nop 677 * nop 678 * nop 679 * nop 680 * 681 */ 682 where[3] = JMP; 683 where[2] = XOR | (value & 0x00003ff) | 0x1c00; 684 where[1] = SETHI | HIVAL(~value, 10); 685 __asm volatile("iflush %0+12" : : "r" (where)); 686 __asm volatile("iflush %0+8" : : "r" (where)); 687 __asm volatile("iflush %0+4" : : "r" (where)); 688 } else if ((offset+8) <= (1L<<31) && 689 (Elf_SOff)(offset+8) >= -((1L<<31) - 4)) { 690 /* 691 * We're within 32-bits -- we can use a direct call insn 692 * 693 * The resulting code in the jump slot is: 694 * 695 * sethi %hi(. - .PLT0), %g1 696 * mov %o7, %g1 697 * call (.+offset) 698 * mov %g1, %o7 699 * nop 700 * nop 701 * nop 702 * nop 703 * 704 */ 705 offset += 8; /* call is at where[2], 8 byte further */ 706 where[3] = MOV17; 707 where[2] = CALL | ((-offset >> 2) & 0x3fffffff); 708 where[1] = MOV71; 709 __asm volatile("iflush %0+12" : : "r" (where)); 710 __asm volatile("iflush %0+8" : : "r" (where)); 711 __asm volatile("iflush %0+4" : : "r" (where)); 712 } else if ((Elf_SOff)value > 0 && value < (1L<<44)) { 713 /* 714 * We're within 44 bits. We can generate this pattern: 715 * 716 * The resulting code in the jump slot is: 717 * 718 * sethi %hi(. - .PLT0), %g1 719 * sethi %h44(addr), %g1 720 * or %g1, %m44(addr), %g1 721 * sllx %g1, 12, %g1 722 * jmp %g1+%l44(addr) 723 * nop 724 * nop 725 * nop 726 * 727 */ 728 where[4] = JMP | LOVAL(value, 0); 729 where[3] = SLLX | 12; 730 where[2] = OR | (((value) >> 12) & 0x00001fff); 731 where[1] = SETHI | HIVAL(value, 22); 732 __asm volatile("iflush %0+16" : : "r" (where)); 733 __asm volatile("iflush %0+12" : : "r" (where)); 734 __asm volatile("iflush %0+8" : : "r" (where)); 735 __asm volatile("iflush %0+4" : : "r" (where)); 736 } else if ((Elf_SOff)value < 0 && (Elf_SOff)value > -(1L<<44)) { 737 /* 738 * We're within 44 bits. We can generate this pattern: 739 * 740 * The resulting code in the jump slot is: 741 * 742 * sethi %hi(. - .PLT0), %g1 743 * sethi %hi((-addr)>>12), %g1 744 * or %g1, %lo((-addr)>>12), %g1 745 * neg %g1 746 * sllx %g1, 12, %g1 747 * jmp %g1+(addr&0x0fff) 748 * nop 749 * nop 750 * 751 */ 752 Elf_Addr neg = (~value+1)>>12; 753 where[5] = JMP | (value & 0x0fff); 754 where[4] = SLLX | 12; 755 where[3] = NEG; 756 where[2] = OR | (LOVAL(neg, 0)+1); 757 where[1] = SETHI | HIVAL(neg, 10); 758 __asm volatile("iflush %0+20" : : "r" (where)); 759 __asm volatile("iflush %0+16" : : "r" (where)); 760 __asm volatile("iflush %0+12" : : "r" (where)); 761 __asm volatile("iflush %0+8" : : "r" (where)); 762 __asm volatile("iflush %0+4" : : "r" (where)); 763 } else { 764 /* 765 * We need to load all 64-bits 766 * 767 * The resulting code in the jump slot is: 768 * 769 * sethi %hi(. - .PLT0), %g1 770 * sethi %hh(addr), %g1 771 * sethi %lm(addr), %g5 772 * or %g1, %hm(addr), %g1 773 * sllx %g1, 32, %g1 774 * or %g1, %g5, %g1 775 * jmp %g1+%lo(addr) 776 * nop 777 * 778 */ 779 where[6] = JMP | LOVAL(value, 0); 780 where[5] = ORG5; 781 where[4] = SLLX | 32; 782 where[3] = OR | LOVAL(value, 32); 783 where[2] = SETHIG5 | HIVAL(value, 10); 784 where[1] = SETHI | HIVAL(value, 42); 785 __asm volatile("iflush %0+24" : : "r" (where)); 786 __asm volatile("iflush %0+20" : : "r" (where)); 787 __asm volatile("iflush %0+16" : : "r" (where)); 788 __asm volatile("iflush %0+12" : : "r" (where)); 789 __asm volatile("iflush %0+8" : : "r" (where)); 790 __asm volatile("iflush %0+4" : : "r" (where)); 791 } 792 } 793 794 /* 795 * New inline function that is called by _rtld_relocate_plt_object and 796 * _rtld_bind 797 */ 798 static inline int 799 _rtld_relocate_plt_object(const Obj_Entry *obj, const Elf_Rela *rela, 800 Elf_Addr *tp) 801 { 802 Elf_Word *where = (Elf_Word *)(obj->relocbase + rela->r_offset); 803 const Elf_Sym *def; 804 const Obj_Entry *defobj; 805 Elf_Addr value; 806 unsigned long info = rela->r_info; 807 808 if (ELF_R_TYPE(info) == R_TYPE(JMP_IREL)) 809 return 0; 810 811 assert(ELF_R_TYPE(info) == R_TYPE(JMP_SLOT)); 812 813 def = _rtld_find_plt_symdef(ELF_R_SYM(info), obj, &defobj, tp != NULL); 814 if (__predict_false(def == NULL)) 815 return -1; 816 if (__predict_false(def == &_rtld_sym_zero)) 817 return 0; 818 819 if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) { 820 if (tp == NULL) 821 return 0; 822 value = _rtld_resolve_ifunc(defobj, def); 823 } else { 824 value = (Elf_Addr)(defobj->relocbase + def->st_value); 825 } 826 rdbg(("bind now/fixup in %s at %p --> new=%p", 827 defobj->strtab + def->st_name, (void*)where, (void *)value)); 828 829 _rtld_write_plt(where, value, rela, obj); 830 831 if (tp) 832 *tp = value; 833 834 return 0; 835 } 836 837 void 838 _rtld_call_ifunc(Obj_Entry *obj, sigset_t *mask, u_int cur_objgen) 839 { 840 const Elf_Rela *rela; 841 Elf_Addr *where; 842 Elf_Word *where2; 843 Elf_Addr target; 844 845 while (obj->ifunc_remaining > 0 && _rtld_objgen == cur_objgen) { 846 rela = obj->pltrelalim - --obj->ifunc_remaining; 847 if (ELF_R_TYPE(rela->r_info) != R_TYPE(JMP_IREL)) 848 continue; 849 where2 = (Elf_Word *)(obj->relocbase + rela->r_offset); 850 target = (Elf_Addr)(obj->relocbase + rela->r_addend); 851 _rtld_exclusive_exit(mask); 852 target = _rtld_resolve_ifunc2(obj, target); 853 _rtld_exclusive_enter(mask); 854 _rtld_write_plt(where2, target, NULL, obj); 855 } 856 857 while (obj->ifunc_remaining_nonplt > 0 && _rtld_objgen == cur_objgen) { 858 rela = obj->relalim - --obj->ifunc_remaining_nonplt; 859 if (ELF_R_TYPE(rela->r_info) != R_TYPE(IRELATIVE)) 860 continue; 861 where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 862 target = (Elf_Addr)(obj->relocbase + rela->r_addend); 863 _rtld_exclusive_exit(mask); 864 target = _rtld_resolve_ifunc2(obj, target); 865 _rtld_exclusive_enter(mask); 866 if (*where != target) 867 *where = target; 868 } 869 } 870
Indexes created Tue Sep 30 20:09:53 GMT 2025