1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright 1996, 1997, 1998, 1999 John D. Polstra.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28/*
29 * Dynamic linker for ELF.
30 *
31 * John Polstra <jdp@polstra.com>.
32 */
33
34#define _WANT_P_OSREL
35#include <sys/param.h>
36#include <sys/mman.h>
37#include <machine/cpufunc.h>
38#include <machine/specialreg.h>
39#include <machine/sysarch.h>
40
41#include <dlfcn.h>
42#include <err.h>
43#include <errno.h>
44#include <fcntl.h>
45#include <stdarg.h>
46#include <stdio.h>
47#include <stdlib.h>
48#include <string.h>
49#include <unistd.h>
50
51#include "debug.h"
52#include "rtld.h"
53#include "rtld_tls.h"
54
55/*
56 * Process the special R_X86_64_COPY relocations in the main program.  These
57 * copy data from a shared object into a region in the main program's BSS
58 * segment.
59 *
60 * Returns 0 on success, -1 on failure.
61 */
62int
63do_copy_relocations(Obj_Entry *dstobj)
64{
65    const Elf_Rela *relalim;
66    const Elf_Rela *rela;
67
68    assert(dstobj->mainprog);	/* COPY relocations are invalid elsewhere */
69
70    relalim = (const Elf_Rela *)((const char *) dstobj->rela + dstobj->relasize);
71    for (rela = dstobj->rela;  rela < relalim;  rela++) {
72	if (ELF_R_TYPE(rela->r_info) == R_X86_64_COPY) {
73	    void *dstaddr;
74	    const Elf_Sym *dstsym;
75	    const char *name;
76	    size_t size;
77	    const void *srcaddr;
78	    const Elf_Sym *srcsym;
79	    const Obj_Entry *srcobj, *defobj;
80	    SymLook req;
81	    int res;
82
83	    dstaddr = (void *)(dstobj->relocbase + rela->r_offset);
84	    dstsym = dstobj->symtab + ELF_R_SYM(rela->r_info);
85	    name = dstobj->strtab + dstsym->st_name;
86	    size = dstsym->st_size;
87	    symlook_init(&req, name);
88	    req.ventry = fetch_ventry(dstobj, ELF_R_SYM(rela->r_info));
89	    req.flags = SYMLOOK_EARLY;
90
91	    for (srcobj = globallist_next(dstobj); srcobj != NULL;
92	      srcobj = globallist_next(srcobj)) {
93		res = symlook_obj(&req, srcobj);
94		if (res == 0) {
95		    srcsym = req.sym_out;
96		    defobj = req.defobj_out;
97		    break;
98		}
99	    }
100
101	    if (srcobj == NULL) {
102		_rtld_error("Undefined symbol \"%s\" referenced from COPY"
103		  " relocation in %s", name, dstobj->path);
104		return -1;
105	    }
106
107	    srcaddr = (const void *)(defobj->relocbase + srcsym->st_value);
108	    memcpy(dstaddr, srcaddr, size);
109	}
110    }
111
112    return 0;
113}
114
115/* Initialize the special GOT entries. */
116void
117init_pltgot(Obj_Entry *obj)
118{
119    if (obj->pltgot != NULL) {
120	obj->pltgot[1] = (Elf_Addr) obj;
121	obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start;
122    }
123}
124
125/* Process the non-PLT relocations. */
126int
127reloc_non_plt(Obj_Entry *obj, Obj_Entry *obj_rtld, int flags,
128    RtldLockState *lockstate)
129{
130	const Elf_Rela *relalim;
131	const Elf_Rela *rela;
132	SymCache *cache;
133	const Elf_Sym *def;
134	const Obj_Entry *defobj;
135	Elf_Addr *where, symval;
136	Elf32_Addr *where32;
137	int r;
138
139	r = -1;
140	symval = 0;
141	def = NULL;
142
143	/*
144	 * The dynamic loader may be called from a thread, we have
145	 * limited amounts of stack available so we cannot use alloca().
146	 */
147	if (obj != obj_rtld) {
148		cache = calloc(obj->dynsymcount, sizeof(SymCache));
149		/* No need to check for NULL here */
150	} else
151		cache = NULL;
152
153	relalim = (const Elf_Rela *)((const char*)obj->rela + obj->relasize);
154	for (rela = obj->rela;  rela < relalim;  rela++) {
155		/*
156		 * First, resolve symbol for relocations which
157		 * reference symbols.
158		 */
159		switch (ELF_R_TYPE(rela->r_info)) {
160		case R_X86_64_64:
161		case R_X86_64_PC32:
162		case R_X86_64_GLOB_DAT:
163		case R_X86_64_TPOFF64:
164		case R_X86_64_TPOFF32:
165		case R_X86_64_DTPMOD64:
166		case R_X86_64_DTPOFF64:
167		case R_X86_64_DTPOFF32:
168			def = find_symdef(ELF_R_SYM(rela->r_info), obj,
169			    &defobj, flags, cache, lockstate);
170			if (def == NULL)
171				goto done;
172			/*
173			 * If symbol is IFUNC, only perform relocation
174			 * when caller allowed it by passing
175			 * SYMLOOK_IFUNC flag.  Skip the relocations
176			 * otherwise.
177			 *
178			 * Also error out in case IFUNC relocations
179			 * are specified for TLS, which cannot be
180			 * usefully interpreted.
181			 */
182			if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) {
183				switch (ELF_R_TYPE(rela->r_info)) {
184				case R_X86_64_64:
185				case R_X86_64_PC32:
186				case R_X86_64_GLOB_DAT:
187					if ((flags & SYMLOOK_IFUNC) == 0) {
188						obj->non_plt_gnu_ifunc = true;
189						continue;
190					}
191					symval = (Elf_Addr)rtld_resolve_ifunc(
192					    defobj, def);
193					break;
194				case R_X86_64_TPOFF64:
195				case R_X86_64_TPOFF32:
196				case R_X86_64_DTPMOD64:
197				case R_X86_64_DTPOFF64:
198				case R_X86_64_DTPOFF32:
199					_rtld_error("%s: IFUNC for TLS reloc",
200					    obj->path);
201					goto done;
202				}
203			} else {
204				if ((flags & SYMLOOK_IFUNC) != 0)
205					continue;
206				symval = (Elf_Addr)defobj->relocbase +
207				    def->st_value;
208			}
209			break;
210		default:
211			if ((flags & SYMLOOK_IFUNC) != 0)
212				continue;
213			break;
214		}
215		where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
216		where32 = (Elf32_Addr *)where;
217
218		switch (ELF_R_TYPE(rela->r_info)) {
219		case R_X86_64_NONE:
220			break;
221		case R_X86_64_64:
222			*where = symval + rela->r_addend;
223			break;
224		case R_X86_64_PC32:
225			/*
226			 * I don't think the dynamic linker should
227			 * ever see this type of relocation.  But the
228			 * binutils-2.6 tools sometimes generate it.
229			 */
230			*where32 = (Elf32_Addr)(unsigned long)(symval +
231		            rela->r_addend - (Elf_Addr)where);
232			break;
233		/* missing: R_X86_64_GOT32 R_X86_64_PLT32 */
234		case R_X86_64_COPY:
235			/*
236			 * These are deferred until all other relocations have
237			 * been done.  All we do here is make sure that the COPY
238			 * relocation is not in a shared library.  They are
239			 * allowed only in executable files.
240			 */
241			if (!obj->mainprog) {
242				_rtld_error("%s: Unexpected R_X86_64_COPY "
243				    "relocation in shared library", obj->path);
244				goto done;
245			}
246			break;
247		case R_X86_64_GLOB_DAT:
248			*where = symval;
249			break;
250		case R_X86_64_TPOFF64:
251			/*
252			 * We lazily allocate offsets for static TLS
253			 * as we see the first relocation that
254			 * references the TLS block. This allows us to
255			 * support (small amounts of) static TLS in
256			 * dynamically loaded modules. If we run out
257			 * of space, we generate an error.
258			 */
259			if (!defobj->tls_static) {
260				if (!allocate_tls_offset(
261				    __DECONST(Obj_Entry *, defobj))) {
262					_rtld_error("%s: No space available "
263					    "for static Thread Local Storage",
264					    obj->path);
265					goto done;
266				}
267			}
268			*where = (Elf_Addr)(def->st_value - defobj->tlsoffset +
269			    rela->r_addend);
270			break;
271		case R_X86_64_TPOFF32:
272			/*
273			 * We lazily allocate offsets for static TLS
274			 * as we see the first relocation that
275			 * references the TLS block. This allows us to
276			 * support (small amounts of) static TLS in
277			 * dynamically loaded modules. If we run out
278			 * of space, we generate an error.
279			 */
280			if (!defobj->tls_static) {
281				if (!allocate_tls_offset(
282				    __DECONST(Obj_Entry *, defobj))) {
283					_rtld_error("%s: No space available "
284					    "for static Thread Local Storage",
285					    obj->path);
286					goto done;
287				}
288			}
289			*where32 = (Elf32_Addr)(def->st_value -
290			    defobj->tlsoffset + rela->r_addend);
291			break;
292		case R_X86_64_DTPMOD64:
293			*where += (Elf_Addr)defobj->tlsindex;
294			break;
295		case R_X86_64_DTPOFF64:
296			*where += (Elf_Addr)(def->st_value + rela->r_addend);
297			break;
298		case R_X86_64_DTPOFF32:
299			*where32 += (Elf32_Addr)(def->st_value +
300			    rela->r_addend);
301			break;
302		case R_X86_64_RELATIVE:
303			*where = (Elf_Addr)(obj->relocbase + rela->r_addend);
304			break;
305		case R_X86_64_IRELATIVE:
306			obj->irelative_nonplt = true;
307			break;
308
309		/*
310		 * missing:
311		 * R_X86_64_GOTPCREL, R_X86_64_32, R_X86_64_32S, R_X86_64_16,
312		 * R_X86_64_PC16, R_X86_64_8, R_X86_64_PC8
313		 */
314		default:
315			_rtld_error("%s: Unsupported relocation type %u"
316			    " in non-PLT relocations\n", obj->path,
317			    (unsigned int)ELF_R_TYPE(rela->r_info));
318			goto done;
319		}
320	}
321	r = 0;
322done:
323	free(cache);
324	return (r);
325}
326
327/* Process the PLT relocations. */
328int
329reloc_plt(Obj_Entry *obj, int flags __unused, RtldLockState *lockstate __unused)
330{
331    const Elf_Rela *relalim;
332    const Elf_Rela *rela;
333
334    relalim = (const Elf_Rela *)((const char *)obj->pltrela + obj->pltrelasize);
335    for (rela = obj->pltrela;  rela < relalim;  rela++) {
336	Elf_Addr *where;
337
338	switch(ELF_R_TYPE(rela->r_info)) {
339	case R_X86_64_JMP_SLOT:
340	  /* Relocate the GOT slot pointing into the PLT. */
341	  where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
342	  *where += (Elf_Addr)obj->relocbase;
343	  break;
344
345	case R_X86_64_IRELATIVE:
346	  obj->irelative = true;
347	  break;
348
349	default:
350	  _rtld_error("Unknown relocation type %x in PLT",
351	    (unsigned int)ELF_R_TYPE(rela->r_info));
352	  return (-1);
353	}
354    }
355    return 0;
356}
357
358/* Relocate the jump slots in an object. */
359int
360reloc_jmpslots(Obj_Entry *obj, int flags, RtldLockState *lockstate)
361{
362    const Elf_Rela *relalim;
363    const Elf_Rela *rela;
364
365    if (obj->jmpslots_done)
366	return 0;
367    relalim = (const Elf_Rela *)((const char *)obj->pltrela + obj->pltrelasize);
368    for (rela = obj->pltrela;  rela < relalim;  rela++) {
369	Elf_Addr *where, target;
370	const Elf_Sym *def;
371	const Obj_Entry *defobj;
372
373	switch (ELF_R_TYPE(rela->r_info)) {
374	case R_X86_64_JMP_SLOT:
375	  where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
376	  def = find_symdef(ELF_R_SYM(rela->r_info), obj, &defobj,
377		SYMLOOK_IN_PLT | flags, NULL, lockstate);
378	  if (def == NULL)
379	      return (-1);
380	  if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) {
381	      obj->gnu_ifunc = true;
382	      continue;
383	  }
384	  target = (Elf_Addr)(defobj->relocbase + def->st_value + rela->r_addend);
385	  reloc_jmpslot(where, target, defobj, obj, (const Elf_Rel *)rela);
386	  break;
387
388	case R_X86_64_IRELATIVE:
389	  break;
390
391	default:
392	  _rtld_error("Unknown relocation type %x in PLT",
393	    (unsigned int)ELF_R_TYPE(rela->r_info));
394	  return (-1);
395	}
396    }
397    obj->jmpslots_done = true;
398    return 0;
399}
400
401/* Fixup the jump slot at "where" to transfer control to "target". */
402Elf_Addr
403reloc_jmpslot(Elf_Addr *where, Elf_Addr target,
404    const struct Struct_Obj_Entry *obj  __unused,
405    const struct Struct_Obj_Entry *refobj  __unused,
406    const Elf_Rel *rel  __unused)
407{
408#ifdef dbg
409	dbg("reloc_jmpslot: *%p = %p", where, (void *)target);
410#endif
411	if (!ld_bind_not)
412		*where = target;
413	return (target);
414}
415
416static void
417reloc_iresolve_one(Obj_Entry *obj, const Elf_Rela *rela,
418    RtldLockState *lockstate)
419{
420	Elf_Addr *where, target, *ptr;
421
422	ptr = (Elf_Addr *)(obj->relocbase + rela->r_addend);
423	where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
424	lock_release(rtld_bind_lock, lockstate);
425	target = call_ifunc_resolver(ptr);
426	wlock_acquire(rtld_bind_lock, lockstate);
427	*where = target;
428}
429
430int
431reloc_iresolve(Obj_Entry *obj, RtldLockState *lockstate)
432{
433	const Elf_Rela *relalim;
434	const Elf_Rela *rela;
435
436	if (!obj->irelative)
437		return (0);
438	obj->irelative = false;
439	relalim = (const Elf_Rela *)((const char *)obj->pltrela +
440	    obj->pltrelasize);
441	for (rela = obj->pltrela;  rela < relalim;  rela++) {
442		if (ELF_R_TYPE(rela->r_info) == R_X86_64_IRELATIVE)
443			reloc_iresolve_one(obj, rela, lockstate);
444	}
445	return (0);
446}
447
448int
449reloc_iresolve_nonplt(Obj_Entry *obj, RtldLockState *lockstate)
450{
451	const Elf_Rela *relalim;
452	const Elf_Rela *rela;
453
454	if (!obj->irelative_nonplt)
455		return (0);
456	obj->irelative_nonplt = false;
457	relalim = (const Elf_Rela *)((const char *)obj->rela + obj->relasize);
458	for (rela = obj->rela;  rela < relalim;  rela++) {
459		if (ELF_R_TYPE(rela->r_info) == R_X86_64_IRELATIVE)
460			reloc_iresolve_one(obj, rela, lockstate);
461	}
462	return (0);
463}
464
465int
466reloc_gnu_ifunc(Obj_Entry *obj, int flags, RtldLockState *lockstate)
467{
468    const Elf_Rela *relalim;
469    const Elf_Rela *rela;
470
471    if (!obj->gnu_ifunc)
472	return (0);
473    relalim = (const Elf_Rela *)((const char *)obj->pltrela + obj->pltrelasize);
474    for (rela = obj->pltrela;  rela < relalim;  rela++) {
475	Elf_Addr *where, target;
476	const Elf_Sym *def;
477	const Obj_Entry *defobj;
478
479	switch (ELF_R_TYPE(rela->r_info)) {
480	case R_X86_64_JMP_SLOT:
481	  where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
482	  def = find_symdef(ELF_R_SYM(rela->r_info), obj, &defobj,
483		SYMLOOK_IN_PLT | flags, NULL, lockstate);
484	  if (def == NULL)
485	      return (-1);
486	  if (ELF_ST_TYPE(def->st_info) != STT_GNU_IFUNC)
487	      continue;
488	  lock_release(rtld_bind_lock, lockstate);
489	  target = (Elf_Addr)rtld_resolve_ifunc(defobj, def);
490	  wlock_acquire(rtld_bind_lock, lockstate);
491	  reloc_jmpslot(where, target, defobj, obj, (const Elf_Rel *)rela);
492	  break;
493	}
494    }
495    obj->gnu_ifunc = false;
496    return (0);
497}
498
499uint32_t cpu_feature, cpu_feature2, cpu_stdext_feature, cpu_stdext_feature2;
500
501void
502ifunc_init(Elf_Auxinfo aux_info[__min_size(AT_COUNT)] __unused)
503{
504	u_int p[4], cpu_high;
505
506	do_cpuid(1, p);
507	cpu_feature = p[3];
508	cpu_feature2 = p[2];
509	do_cpuid(0, p);
510	cpu_high = p[0];
511	if (cpu_high >= 7) {
512		cpuid_count(7, 0, p);
513		cpu_stdext_feature = p[1];
514		cpu_stdext_feature2 = p[2];
515	}
516}
517
518int __getosreldate(void);
519
520void
521allocate_initial_tls(Obj_Entry *objs)
522{
523	void *addr;
524
525	/*
526	 * Fix the size of the static TLS block by using the maximum
527	 * offset allocated so far and adding a bit for dynamic
528	 * modules to use.
529	 */
530	tls_static_space = tls_last_offset + ld_static_tls_extra;
531
532	addr = allocate_tls(objs, 0, TLS_TCB_SIZE, TLS_TCB_ALIGN);
533
534	/*
535	 * This does not use _tcb_set() as it calls amd64_set_fsbase()
536	 * which is an ifunc and rtld must not use ifuncs.
537	 */
538	if (__getosreldate() >= P_OSREL_WRFSBASE &&
539	    (cpu_stdext_feature & CPUID_STDEXT_FSGSBASE) != 0)
540		wrfsbase((uintptr_t)addr);
541	else
542		sysarch(AMD64_SET_FSBASE, &addr);
543}
544
545void *
546__tls_get_addr(tls_index *ti)
547{
548	uintptr_t **dtvp;
549
550	dtvp = &_tcb_get()->tcb_dtv;
551	return (tls_get_addr_common(dtvp, ti->ti_module, ti->ti_offset));
552}
553
554size_t
555calculate_tls_offset(size_t prev_offset, size_t prev_size __unused,
556    size_t size, size_t align, size_t offset)
557{
558	size_t res;
559
560        /*
561	 * res is the smallest integer satisfying res - prev_offset >= size
562         * and (-res) % p_align = p_vaddr % p_align (= p_offset % p_align).
563	 */
564        res = prev_offset + size + align - 1;
565        res -= (res + offset) & (align - 1);
566        return (res);
567}
568
569size_t
570calculate_first_tls_offset(size_t size, size_t align, size_t offset)
571{
572	return (calculate_tls_offset(0, 0, size, align, offset));
573}
574