1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright 1996, 1997, 1998, 1999 John D. Polstra.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28/*
29 * Dynamic linker for ELF.
30 *
31 * John Polstra <jdp@polstra.com>.
32 */
33
34#include <sys/param.h>
35#include <sys/mman.h>
36#include <machine/segments.h>
37#include <machine/sysarch.h>
38
39#include <dlfcn.h>
40#include <err.h>
41#include <errno.h>
42#include <fcntl.h>
43#include <stdarg.h>
44#include <stdio.h>
45#include <stdlib.h>
46#include <string.h>
47#include <unistd.h>
48
49#include "debug.h"
50#include "rtld.h"
51#include "rtld_tls.h"
52
53/*
54 * Process the special R_386_COPY relocations in the main program.  These
55 * copy data from a shared object into a region in the main program's BSS
56 * segment.
57 *
58 * Returns 0 on success, -1 on failure.
59 */
60int
61do_copy_relocations(Obj_Entry *dstobj)
62{
63    const Elf_Rel *rellim;
64    const Elf_Rel *rel;
65
66    assert(dstobj->mainprog);	/* COPY relocations are invalid elsewhere */
67
68    rellim = (const Elf_Rel *)((const char *)dstobj->rel + dstobj->relsize);
69    for (rel = dstobj->rel;  rel < rellim;  rel++) {
70	if (ELF_R_TYPE(rel->r_info) == R_386_COPY) {
71	    void *dstaddr;
72	    const Elf_Sym *dstsym;
73	    const char *name;
74	    size_t size;
75	    const void *srcaddr;
76	    const Elf_Sym *srcsym;
77	    const Obj_Entry *srcobj, *defobj;
78	    SymLook req;
79	    int res;
80
81	    dstaddr = (void *)(dstobj->relocbase + rel->r_offset);
82	    dstsym = dstobj->symtab + ELF_R_SYM(rel->r_info);
83	    name = dstobj->strtab + dstsym->st_name;
84	    size = dstsym->st_size;
85	    symlook_init(&req, name);
86	    req.ventry = fetch_ventry(dstobj, ELF_R_SYM(rel->r_info));
87	    req.flags = SYMLOOK_EARLY;
88
89	    for (srcobj = globallist_next(dstobj);  srcobj != NULL;
90	      srcobj = globallist_next(srcobj)) {
91		res = symlook_obj(&req, srcobj);
92		if (res == 0) {
93		    srcsym = req.sym_out;
94		    defobj = req.defobj_out;
95		    break;
96		}
97	    }
98
99	    if (srcobj == NULL) {
100		_rtld_error("Undefined symbol \"%s\" referenced from COPY"
101		  " relocation in %s", name, dstobj->path);
102		return -1;
103	    }
104
105	    srcaddr = (const void *)(defobj->relocbase + srcsym->st_value);
106	    memcpy(dstaddr, srcaddr, size);
107	}
108    }
109
110    return 0;
111}
112
113/* Initialize the special GOT entries. */
114void
115init_pltgot(Obj_Entry *obj)
116{
117    if (obj->pltgot != NULL) {
118	obj->pltgot[1] = (Elf_Addr) obj;
119	obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start;
120    }
121}
122
123/* Process the non-PLT relocations. */
124int
125reloc_non_plt(Obj_Entry *obj, Obj_Entry *obj_rtld, int flags,
126    RtldLockState *lockstate)
127{
128	const Elf_Rel *rellim;
129	const Elf_Rel *rel;
130	SymCache *cache;
131	const Elf_Sym *def;
132	const Obj_Entry *defobj;
133	Elf_Addr *where, symval, add;
134	int r;
135
136	r = -1;
137	/*
138	 * The dynamic loader may be called from a thread, we have
139	 * limited amounts of stack available so we cannot use alloca().
140	 */
141	if (obj != obj_rtld) {
142		cache = calloc(obj->dynsymcount, sizeof(SymCache));
143		/* No need to check for NULL here */
144	} else
145		cache = NULL;
146
147	/* Appease some compilers. */
148	symval = 0;
149	def = NULL;
150
151	rellim = (const Elf_Rel *)((const char *)obj->rel + obj->relsize);
152	for (rel = obj->rel;  rel < rellim;  rel++) {
153		switch (ELF_R_TYPE(rel->r_info)) {
154		case R_386_32:
155		case R_386_PC32:
156		case R_386_GLOB_DAT:
157		case R_386_TLS_TPOFF:
158		case R_386_TLS_TPOFF32:
159		case R_386_TLS_DTPMOD32:
160		case R_386_TLS_DTPOFF32:
161			def = find_symdef(ELF_R_SYM(rel->r_info), obj, &defobj,
162			    flags, cache, lockstate);
163			if (def == NULL)
164				goto done;
165			if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) {
166				switch (ELF_R_TYPE(rel->r_info)) {
167				case R_386_32:
168				case R_386_PC32:
169				case R_386_GLOB_DAT:
170					if ((flags & SYMLOOK_IFUNC) == 0) {
171						obj->non_plt_gnu_ifunc = true;
172						continue;
173					}
174					symval = (Elf_Addr)rtld_resolve_ifunc(
175					    defobj, def);
176					break;
177				case R_386_TLS_TPOFF:
178				case R_386_TLS_TPOFF32:
179				case R_386_TLS_DTPMOD32:
180				case R_386_TLS_DTPOFF32:
181					_rtld_error("%s: IFUNC for TLS reloc",
182					    obj->path);
183					goto done;
184				}
185			} else {
186				if ((flags & SYMLOOK_IFUNC) != 0)
187					continue;
188				symval = (Elf_Addr)defobj->relocbase +
189				    def->st_value;
190			}
191			break;
192		default:
193			if ((flags & SYMLOOK_IFUNC) != 0)
194				continue;
195			break;
196		}
197		where = (Elf_Addr *)(obj->relocbase + rel->r_offset);
198
199		switch (ELF_R_TYPE(rel->r_info)) {
200		case R_386_NONE:
201			break;
202		case R_386_32:
203			*where += symval;
204			break;
205		case R_386_PC32:
206		    /*
207		     * I don't think the dynamic linker should ever
208		     * see this type of relocation.  But the
209		     * binutils-2.6 tools sometimes generate it.
210		     */
211		    *where += symval - (Elf_Addr)where;
212		    break;
213		case R_386_COPY:
214			/*
215			 * These are deferred until all other
216			 * relocations have been done.  All we do here
217			 * is make sure that the COPY relocation is
218			 * not in a shared library.  They are allowed
219			 * only in executable files.
220			 */
221			if (!obj->mainprog) {
222				_rtld_error("%s: Unexpected R_386_COPY "
223				    "relocation in shared library", obj->path);
224				goto done;
225			}
226			break;
227		case R_386_GLOB_DAT:
228			*where = symval;
229			break;
230		case R_386_RELATIVE:
231			*where += (Elf_Addr)obj->relocbase;
232			break;
233		case R_386_TLS_TPOFF:
234		case R_386_TLS_TPOFF32:
235			/*
236			 * We lazily allocate offsets for static TLS
237			 * as we see the first relocation that
238			 * references the TLS block. This allows us to
239			 * support (small amounts of) static TLS in
240			 * dynamically loaded modules. If we run out
241			 * of space, we generate an error.
242			 */
243			if (!defobj->tls_static) {
244				if (!allocate_tls_offset(
245				    __DECONST(Obj_Entry *, defobj))) {
246					_rtld_error("%s: No space available "
247					    "for static Thread Local Storage",
248					    obj->path);
249					goto done;
250				}
251			}
252			add = (Elf_Addr)(def->st_value - defobj->tlsoffset);
253			if (ELF_R_TYPE(rel->r_info) == R_386_TLS_TPOFF)
254				*where += add;
255			else
256				*where -= add;
257			break;
258		case R_386_TLS_DTPMOD32:
259			*where += (Elf_Addr)defobj->tlsindex;
260			break;
261		case R_386_TLS_DTPOFF32:
262			*where += (Elf_Addr) def->st_value;
263			break;
264		case R_386_IRELATIVE:
265			obj->irelative_nonplt = true;
266			break;
267		default:
268			_rtld_error("%s: Unsupported relocation type %d"
269			    " in non-PLT relocations\n", obj->path,
270			    ELF_R_TYPE(rel->r_info));
271			goto done;
272		}
273	}
274	r = 0;
275done:
276	free(cache);
277	return (r);
278}
279
280/* Process the PLT relocations. */
281int
282reloc_plt(Obj_Entry *obj, int flags __unused, RtldLockState *lockstate __unused)
283{
284    const Elf_Rel *rellim;
285    const Elf_Rel *rel;
286
287    rellim = (const Elf_Rel *)((const char *)obj->pltrel + obj->pltrelsize);
288    for (rel = obj->pltrel;  rel < rellim;  rel++) {
289	Elf_Addr *where/*, val*/;
290
291	switch (ELF_R_TYPE(rel->r_info)) {
292	case R_386_JMP_SLOT:
293	  /* Relocate the GOT slot pointing into the PLT. */
294	  where = (Elf_Addr *)(obj->relocbase + rel->r_offset);
295	  *where += (Elf_Addr)obj->relocbase;
296	  break;
297
298	case R_386_IRELATIVE:
299	  obj->irelative = true;
300	  break;
301
302	default:
303	  _rtld_error("Unknown relocation type %x in PLT",
304	    ELF_R_TYPE(rel->r_info));
305	  return (-1);
306	}
307    }
308    return 0;
309}
310
311/* Relocate the jump slots in an object. */
312int
313reloc_jmpslots(Obj_Entry *obj, int flags, RtldLockState *lockstate)
314{
315    const Elf_Rel *rellim;
316    const Elf_Rel *rel;
317
318    if (obj->jmpslots_done)
319	return 0;
320    rellim = (const Elf_Rel *)((const char *)obj->pltrel + obj->pltrelsize);
321    for (rel = obj->pltrel;  rel < rellim;  rel++) {
322	Elf_Addr *where, target;
323	const Elf_Sym *def;
324	const Obj_Entry *defobj;
325
326	switch (ELF_R_TYPE(rel->r_info)) {
327	case R_386_JMP_SLOT:
328	  where = (Elf_Addr *)(obj->relocbase + rel->r_offset);
329	  def = find_symdef(ELF_R_SYM(rel->r_info), obj, &defobj,
330		SYMLOOK_IN_PLT | flags, NULL, lockstate);
331	  if (def == NULL)
332	      return (-1);
333	  if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) {
334	      obj->gnu_ifunc = true;
335	      continue;
336	  }
337	  target = (Elf_Addr)(defobj->relocbase + def->st_value);
338	  reloc_jmpslot(where, target, defobj, obj, rel);
339	  break;
340
341	case R_386_IRELATIVE:
342	  break;
343
344	default:
345	  _rtld_error("Unknown relocation type %x in PLT",
346	    ELF_R_TYPE(rel->r_info));
347	  return (-1);
348	}
349    }
350
351    obj->jmpslots_done = true;
352    return 0;
353}
354
355/* Fixup the jump slot at "where" to transfer control to "target". */
356Elf_Addr
357reloc_jmpslot(Elf_Addr *where, Elf_Addr target,
358    const Obj_Entry *obj __unused, const Obj_Entry *refobj __unused,
359    const Elf_Rel *rel __unused)
360{
361#ifdef dbg
362	dbg("reloc_jmpslot: *%p = %p", where, (void *)target);
363#endif
364	if (!ld_bind_not)
365		*where = target;
366	return (target);
367}
368
369static void
370reloc_iresolve_one(Obj_Entry *obj, const Elf_Rel *rel,
371    RtldLockState *lockstate)
372{
373	Elf_Addr *where, target;
374
375	where = (Elf_Addr *)(obj->relocbase + rel->r_offset);
376	lock_release(rtld_bind_lock, lockstate);
377	target = call_ifunc_resolver(obj->relocbase + *where);
378	wlock_acquire(rtld_bind_lock, lockstate);
379	*where = target;
380}
381
382int
383reloc_iresolve(Obj_Entry *obj, RtldLockState *lockstate)
384{
385	const Elf_Rel *rellim;
386	const Elf_Rel *rel;
387
388	if (!obj->irelative)
389		return (0);
390	obj->irelative = false;
391	rellim = (const Elf_Rel *)((const char *)obj->pltrel + obj->pltrelsize);
392	for (rel = obj->pltrel;  rel < rellim;  rel++) {
393		if (ELF_R_TYPE(rel->r_info) == R_386_IRELATIVE)
394			reloc_iresolve_one(obj, rel, lockstate);
395	}
396	return (0);
397}
398
399int
400reloc_iresolve_nonplt(Obj_Entry *obj, RtldLockState *lockstate)
401{
402	const Elf_Rel *rellim;
403	const Elf_Rel *rel;
404
405	if (!obj->irelative_nonplt)
406		return (0);
407	obj->irelative_nonplt = false;
408	rellim = (const Elf_Rel *)((const char *)obj->rel + obj->relsize);
409	for (rel = obj->rel;  rel < rellim;  rel++) {
410		if (ELF_R_TYPE(rel->r_info) == R_386_IRELATIVE)
411			reloc_iresolve_one(obj, rel, lockstate);
412	}
413	return (0);
414}
415
416int
417reloc_gnu_ifunc(Obj_Entry *obj, int flags, RtldLockState *lockstate)
418{
419    const Elf_Rel *rellim;
420    const Elf_Rel *rel;
421
422    if (!obj->gnu_ifunc)
423	return (0);
424    rellim = (const Elf_Rel *)((const char *)obj->pltrel + obj->pltrelsize);
425    for (rel = obj->pltrel;  rel < rellim;  rel++) {
426	Elf_Addr *where, target;
427	const Elf_Sym *def;
428	const Obj_Entry *defobj;
429
430	switch (ELF_R_TYPE(rel->r_info)) {
431	case R_386_JMP_SLOT:
432	  where = (Elf_Addr *)(obj->relocbase + rel->r_offset);
433	  def = find_symdef(ELF_R_SYM(rel->r_info), obj, &defobj,
434		SYMLOOK_IN_PLT | flags, NULL, lockstate);
435	  if (def == NULL)
436	      return (-1);
437	  if (ELF_ST_TYPE(def->st_info) != STT_GNU_IFUNC)
438	      continue;
439	  lock_release(rtld_bind_lock, lockstate);
440	  target = (Elf_Addr)rtld_resolve_ifunc(defobj, def);
441	  wlock_acquire(rtld_bind_lock, lockstate);
442	  reloc_jmpslot(where, target, defobj, obj, rel);
443	  break;
444	}
445    }
446
447    obj->gnu_ifunc = false;
448    return (0);
449}
450
451uint32_t cpu_feature, cpu_feature2, cpu_stdext_feature, cpu_stdext_feature2;
452
453static void
454rtld_cpuid_count(int idx, int cnt, u_int *p)
455{
456
457	__asm __volatile(
458	    "	pushl	%%ebx\n"
459	    "	cpuid\n"
460	    "	movl	%%ebx,%1\n"
461	    "	popl	%%ebx\n"
462	    : "=a" (p[0]), "=r" (p[1]), "=c" (p[2]), "=d" (p[3])
463	    :  "0" (idx), "2" (cnt));
464}
465
466void
467ifunc_init(Elf_Auxinfo aux_info[__min_size(AT_COUNT)] __unused)
468{
469	u_int p[4], cpu_high;
470	int cpuid_supported;
471
472	__asm __volatile(
473	    "	pushfl\n"
474	    "	popl	%%eax\n"
475	    "	movl    %%eax,%%ecx\n"
476	    "	xorl    $0x200000,%%eax\n"
477	    "	pushl	%%eax\n"
478	    "	popfl\n"
479	    "	pushfl\n"
480	    "	popl    %%eax\n"
481	    "	xorl    %%eax,%%ecx\n"
482	    "	je	1f\n"
483	    "	movl	$1,%0\n"
484	    "	jmp	2f\n"
485	    "1:	movl	$0,%0\n"
486	    "2:\n"
487	    : "=r" (cpuid_supported) : : "eax", "ecx");
488	if (!cpuid_supported)
489		return;
490
491	rtld_cpuid_count(1, 0, p);
492	cpu_feature = p[3];
493	cpu_feature2 = p[2];
494	rtld_cpuid_count(0, 0, p);
495	cpu_high = p[0];
496	if (cpu_high >= 7) {
497		rtld_cpuid_count(7, 0, p);
498		cpu_stdext_feature = p[1];
499		cpu_stdext_feature2 = p[2];
500	}
501}
502
503void
504allocate_initial_tls(Obj_Entry *objs)
505{
506    void* tls;
507
508    /*
509     * Fix the size of the static TLS block by using the maximum
510     * offset allocated so far and adding a bit for dynamic modules to
511     * use.
512     */
513    tls_static_space = tls_last_offset + ld_static_tls_extra;
514    tls = allocate_tls(objs, NULL, TLS_TCB_SIZE, TLS_TCB_ALIGN);
515    _tcb_set(tls);
516}
517
518/* GNU ABI */
519__attribute__((__regparm__(1)))
520void *
521___tls_get_addr(tls_index *ti)
522{
523	uintptr_t **dtvp;
524
525	dtvp = &_tcb_get()->tcb_dtv;
526	return (tls_get_addr_common(dtvp, ti->ti_module, ti->ti_offset));
527}
528
529/* Sun ABI */
530void *
531__tls_get_addr(tls_index *ti)
532{
533	uintptr_t **dtvp;
534
535	dtvp = &_tcb_get()->tcb_dtv;
536	return (tls_get_addr_common(dtvp, ti->ti_module, ti->ti_offset));
537}
538
539size_t
540calculate_tls_offset(size_t prev_offset, size_t prev_size __unused,
541    size_t size, size_t align, size_t offset)
542{
543	size_t res;
544
545        /*
546	 * res is the smallest integer satisfying res - prev_offset >= size
547         * and (-res) % p_align = p_vaddr % p_align (= p_offset % p_align).
548	 */
549        res = prev_offset + size + align - 1;
550        res -= (res + offset) & (align - 1);
551        return (res);
552}
553
554size_t
555calculate_first_tls_offset(size_t size, size_t align, size_t offset)
556{
557	return (calculate_tls_offset(0, 0, size, align, offset));
558}
559