mdreloc.c revision 1.51
1/* $NetBSD: mdreloc.c,v 1.51 2017/08/10 19:03:26 joerg Exp $ */ 2 3/*- 4 * Copyright (c) 1999, 2002 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Paul Kranenburg and by Charles M. Hannum. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32#include <sys/cdefs.h> 33#ifndef lint 34__RCSID("$NetBSD: mdreloc.c,v 1.51 2017/08/10 19:03:26 joerg Exp $"); 35#endif /* not lint */ 36 37#include <errno.h> 38#include <stdio.h> 39#include <stdlib.h> 40#include <string.h> 41#include <unistd.h> 42 43#include "rtldenv.h" 44#include "debug.h" 45#include "rtld.h" 46 47/* 48 * The following table holds for each relocation type: 49 * - the width in bits of the memory location the relocation 50 * applies to (not currently used) 51 * - the number of bits the relocation value must be shifted to the 52 * right (i.e. discard least significant bits) to fit into 53 * the appropriate field in the instruction word. 54 * - flags indicating whether 55 * * the relocation involves a symbol 56 * * the relocation is relative to the current position 57 * * the relocation is for a GOT entry 58 * * the relocation is relative to the load address 59 * 60 */ 61#define _RF_S 0x80000000 /* Resolve symbol */ 62#define _RF_A 0x40000000 /* Use addend */ 63#define _RF_P 0x20000000 /* Location relative */ 64#define _RF_G 0x10000000 /* GOT offset */ 65#define _RF_B 0x08000000 /* Load address relative */ 66#define _RF_U 0x04000000 /* Unaligned */ 67#define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 68#define _RF_RS(s) ( (s) & 0xff) /* right shift */ 69static const int reloc_target_flags[R_TYPE(TLS_TPOFF64)+1] = { 70 0, /* NONE */ 71 _RF_S|_RF_A| _RF_SZ(8) | _RF_RS(0), /* RELOC_8 */ 72 _RF_S|_RF_A| _RF_SZ(16) | _RF_RS(0), /* RELOC_16 */ 73 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* RELOC_32 */ 74 _RF_S|_RF_A|_RF_P| _RF_SZ(8) | _RF_RS(0), /* DISP_8 */ 75 _RF_S|_RF_A|_RF_P| _RF_SZ(16) | _RF_RS(0), /* DISP_16 */ 76 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* DISP_32 */ 77 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_30 */ 78 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_22 */ 79 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* HI22 */ 80 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 22 */ 81 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 13 */ 82 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* LO10 */ 83 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT10 */ 84 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT13 */ 85 _RF_G| _RF_SZ(32) | _RF_RS(10), /* GOT22 */ 86 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PC10 */ 87 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PC22 */ 88 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WPLT30 */ 89 _RF_SZ(32) | _RF_RS(0), /* COPY */ 90 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* GLOB_DAT */ 91 _RF_SZ(32) | _RF_RS(0), /* JMP_SLOT */ 92 _RF_A| _RF_B| _RF_SZ(32) | _RF_RS(0), /* RELATIVE */ 93 _RF_S|_RF_A| _RF_U| _RF_SZ(32) | _RF_RS(0), /* UA_32 */ 94 95 /* TLS and 64 bit relocs not listed here... */ 96}; 97 98#ifdef RTLD_DEBUG_RELOC 99static const char *reloc_names[] = { 100 "NONE", "RELOC_8", "RELOC_16", "RELOC_32", "DISP_8", 101 "DISP_16", "DISP_32", "WDISP_30", "WDISP_22", "HI22", 102 "22", "13", "LO10", "GOT10", "GOT13", 103 "GOT22", "PC10", "PC22", "WPLT30", "COPY", 104 "GLOB_DAT", "JMP_SLOT", "RELATIVE", "UA_32", 105 106 /* not used with 32bit userland, besides a few of the TLS ones */ 107 "PLT32", 108 "HIPLT22", "LOPLT10", "LOPLT10", "PCPLT22", "PCPLT32", 109 "10", "11", "64", "OLO10", "HH22", 110 "HM10", "LM22", "PC_HH22", "PC_HM10", "PC_LM22", 111 "WDISP16", "WDISP19", "GLOB_JMP", "7", "5", "6", 112 "DISP64", "PLT64", "HIX22", "LOX10", "H44", "M44", 113 "L44", "REGISTER", "UA64", "UA16", 114 "TLS_GD_HI22", "TLS_GD_LO10", "TLS_GD_ADD", "TLS_GD_CALL", 115 "TLS_LDM_HI22", "TLS_LDM_LO10", "TLS_LDM_ADD", "TLS_LDM_CALL", 116 "TLS_LDO_HIX22", "TLS_LDO_LOX10", "TLS_LDO_ADD", "TLS_IE_HI22", 117 "TLS_IE_LO10", "TLS_IE_LD", "TLS_IE_LDX", "TLS_IE_ADD", "TLS_LE_HIX22", 118 "TLS_LE_LOX10", "TLS_DTPMOD32", "TLS_DTPMOD64", "TLS_DTPOFF32", 119 "TLS_DTPOFF64", "TLS_TPOFF32", "TLS_TPOFF64", 120}; 121#endif 122 123#define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 124#define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 125#define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 126#define RELOC_UNALIGNED(t) ((reloc_target_flags[t] & _RF_U) != 0) 127#define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 128#define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 129#define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 130#define RELOC_TLS(t) (t >= R_TYPE(TLS_GD_HI22)) 131 132static const int reloc_target_bitmask[] = { 133#define _BM(x) (~(-(1ULL << (x)))) 134 0, /* NONE */ 135 _BM(8), _BM(16), _BM(32), /* RELOC_8, _16, _32 */ 136 _BM(8), _BM(16), _BM(32), /* DISP8, DISP16, DISP32 */ 137 _BM(30), _BM(22), /* WDISP30, WDISP22 */ 138 _BM(22), _BM(22), /* HI22, _22 */ 139 _BM(13), _BM(10), /* RELOC_13, _LO10 */ 140 _BM(10), _BM(13), _BM(22), /* GOT10, GOT13, GOT22 */ 141 _BM(10), _BM(22), /* _PC10, _PC22 */ 142 _BM(30), 0, /* _WPLT30, _COPY */ 143 -1, -1, -1, /* _GLOB_DAT, JMP_SLOT, _RELATIVE */ 144 _BM(32) /* _UA32 */ 145#undef _BM 146}; 147#define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 148 149void _rtld_bind_start(void); 150void _rtld_relocate_nonplt_self(Elf_Dyn *, Elf_Addr); 151caddr_t _rtld_bind(const Obj_Entry *, Elf_Word); 152static inline int _rtld_relocate_plt_object(const Obj_Entry *, 153 const Elf_Rela *, Elf_Addr *); 154 155void 156_rtld_setup_pltgot(const Obj_Entry *obj) 157{ 158 /* 159 * PLTGOT is the PLT on the sparc. 160 * The first entry holds the call the dynamic linker. 161 * We construct a `call' sequence that transfers 162 * to `_rtld_bind_start()'. 163 * The second entry holds the object identification. 164 * Note: each PLT entry is three words long. 165 */ 166#define SAVE 0x9de3bfa0 /* i.e. `save %sp,-96,%sp' */ 167#define CALL 0x40000000 168#define NOP 0x01000000 169 obj->pltgot[0] = SAVE; 170 obj->pltgot[1] = CALL | 171 ((Elf_Addr) &_rtld_bind_start - (Elf_Addr) &obj->pltgot[1]) >> 2; 172 obj->pltgot[2] = NOP; 173 obj->pltgot[3] = (Elf_Addr) obj; 174} 175 176void 177_rtld_relocate_nonplt_self(Elf_Dyn *dynp, Elf_Addr relocbase) 178{ 179 const Elf_Rela *rela = 0, *relalim; 180 Elf_Addr relasz = 0; 181 Elf_Addr *where; 182 183 for (; dynp->d_tag != DT_NULL; dynp++) { 184 switch (dynp->d_tag) { 185 case DT_RELA: 186 rela = (const Elf_Rela *)(relocbase + dynp->d_un.d_ptr); 187 break; 188 case DT_RELASZ: 189 relasz = dynp->d_un.d_val; 190 break; 191 } 192 } 193 relalim = (const Elf_Rela *)((const uint8_t *)rela + relasz); 194 for (; rela < relalim; rela++) { 195 where = (Elf_Addr *)(relocbase + rela->r_offset); 196 *where += (Elf_Addr)(relocbase + rela->r_addend); 197 } 198} 199 200int 201_rtld_relocate_nonplt_objects(Obj_Entry *obj) 202{ 203 const Elf_Rela *rela; 204 const Elf_Sym *def = NULL; 205 const Obj_Entry *defobj = NULL; 206 unsigned long last_symnum = ULONG_MAX; 207 208 for (rela = obj->rela; rela < obj->relalim; rela++) { 209 Elf_Addr *where; 210 Elf_Word type, value, mask; 211 unsigned long symnum; 212 213 where = (Elf_Addr *) (obj->relocbase + rela->r_offset); 214 215 type = ELF_R_TYPE(rela->r_info); 216 if (type == R_TYPE(NONE)) 217 continue; 218 219 /* We do JMP_SLOTs in _rtld_bind() below */ 220 if (type == R_TYPE(JMP_SLOT)) 221 continue; 222 223 /* COPY relocs are also handled elsewhere */ 224 if (type == R_TYPE(COPY)) 225 continue; 226 227 /* 228 * We use the fact that relocation types are an `enum' 229 * Note: R_SPARC_TLS_TPOFF64 is currently numerically largest. 230 */ 231 if (type > R_TYPE(TLS_TPOFF64)) 232 return (-1); 233 234 value = rela->r_addend; 235 236 if (RELOC_RESOLVE_SYMBOL(type) || RELOC_TLS(type)) { 237 symnum = ELF_R_SYM(rela->r_info); 238 if (last_symnum != symnum) { 239 last_symnum = symnum; 240 def = _rtld_find_symdef(symnum, obj, &defobj, 241 false); 242 if (def == NULL) 243 return -1; 244 } 245 } 246 247 /* 248 * Handle TLS relocations here, they are different. 249 */ 250 if (RELOC_TLS(type)) { 251 switch (type) { 252 case R_TYPE(TLS_DTPMOD32): 253 *where = (Elf_Addr)defobj->tlsindex; 254 255 rdbg(("TLS_DTPMOD32 %s in %s --> %p", 256 obj->strtab + 257 obj->symtab[symnum].st_name, 258 obj->path, (void *)*where)); 259 260 break; 261 262 case R_TYPE(TLS_DTPOFF32): 263 *where = (Elf_Addr)(def->st_value 264 + rela->r_addend); 265 266 rdbg(("TLS_DTPOFF32 %s in %s --> %p", 267 obj->strtab + 268 obj->symtab[symnum].st_name, 269 obj->path, (void *)*where)); 270 271 break; 272 273 case R_TYPE(TLS_TPOFF32): 274 if (!defobj->tls_done && 275 _rtld_tls_offset_allocate(obj)) 276 return -1; 277 278 *where = (Elf_Addr)(def->st_value - 279 defobj->tlsoffset + rela->r_addend); 280 281 rdbg(("TLS_TPOFF32 %s in %s --> %p", 282 obj->strtab + 283 obj->symtab[symnum].st_name, 284 obj->path, (void *)*where)); 285 286 break; 287 } 288 continue; 289 } 290 291 /* 292 * If it is no TLS relocation (handled above), we can not 293 * deal with it if it is beyound R_SPARC_6. 294 */ 295 if (type > R_TYPE(6)) 296 return (-1); 297 298 /* 299 * Handle relative relocs here, as an optimization. 300 */ 301 if (type == R_TYPE(RELATIVE)) { 302 *where += (Elf_Addr)(obj->relocbase + value); 303 rdbg(("RELATIVE in %s --> %p", obj->path, 304 (void *)*where)); 305 continue; 306 } 307 308 if (RELOC_RESOLVE_SYMBOL(type)) { 309 /* Add in the symbol's absolute address */ 310 value += (Elf_Word)(defobj->relocbase + def->st_value); 311 } 312 313 if (RELOC_PC_RELATIVE(type)) { 314 value -= (Elf_Word)where; 315 } 316 317 if (RELOC_BASE_RELATIVE(type)) { 318 /* 319 * Note that even though sparcs use `Elf_rela' 320 * exclusively we still need the implicit memory addend 321 * in relocations referring to GOT entries. 322 * Undoubtedly, someone f*cked this up in the distant 323 * past, and now we're stuck with it in the name of 324 * compatibility for all eternity.. 325 * 326 * In any case, the implicit and explicit should be 327 * mutually exclusive. We provide a check for that 328 * here. 329 */ 330#define DIAGNOSTIC 331#ifdef DIAGNOSTIC 332 if (value != 0 && *where != 0) { 333 xprintf("BASE_REL(%s): where=%p, *where 0x%x, " 334 "addend=0x%x, base %p\n", 335 obj->path, where, *where, 336 rela->r_addend, obj->relocbase); 337 } 338#endif 339 value += (Elf_Word)(obj->relocbase + *where); 340 } 341 342 mask = RELOC_VALUE_BITMASK(type); 343 value >>= RELOC_VALUE_RIGHTSHIFT(type); 344 value &= mask; 345 346 if (RELOC_UNALIGNED(type)) { 347 /* Handle unaligned relocations. */ 348 Elf_Addr tmp = 0; 349 char *ptr = (char *)where; 350 int i, size = RELOC_TARGET_SIZE(type)/8; 351 352 /* Read it in one byte at a time. */ 353 for (i=0; i<size; i++) 354 tmp = (tmp << 8) | ptr[i]; 355 356 tmp &= ~mask; 357 tmp |= value; 358 359 /* Write it back out. */ 360 for (i=0; i<size; i++) 361 ptr[i] = ((tmp >> (8*i)) & 0xff); 362#ifdef RTLD_DEBUG_RELOC 363 value = (Elf_Word)tmp; 364#endif 365 366 } else { 367 *where &= ~mask; 368 *where |= value; 369#ifdef RTLD_DEBUG_RELOC 370 value = (Elf_Word)*where; 371#endif 372 } 373#ifdef RTLD_DEBUG_RELOC 374 if (RELOC_RESOLVE_SYMBOL(type)) { 375 rdbg(("%s %s in %s --> %p in %s", reloc_names[type], 376 obj->strtab + obj->symtab[symnum].st_name, 377 obj->path, (void *)value, defobj->path)); 378 } else { 379 rdbg(("%s in %s --> %p", reloc_names[type], 380 obj->path, (void *)value)); 381 } 382#endif 383 } 384 return (0); 385} 386 387int 388_rtld_relocate_plt_lazy(Obj_Entry *obj) 389{ 390 return (0); 391} 392 393caddr_t 394_rtld_bind(const Obj_Entry *obj, Elf_Word reloff) 395{ 396 const Elf_Rela *rela = (const Elf_Rela *)((const uint8_t *)obj->pltrela + reloff); 397 Elf_Addr value; 398 int err; 399 400 value = 0; /* XXX gcc */ 401 402 _rtld_shared_enter(); 403 err = _rtld_relocate_plt_object(obj, rela, &value); 404 if (err) 405 _rtld_die(); 406 _rtld_shared_exit(); 407 408 return (caddr_t)value; 409} 410 411int 412_rtld_relocate_plt_objects(const Obj_Entry *obj) 413{ 414 const Elf_Rela *rela = obj->pltrela; 415 416 for (; rela < obj->pltrelalim; rela++) 417 if (_rtld_relocate_plt_object(obj, rela, NULL) < 0) 418 return -1; 419 420 return 0; 421} 422 423static inline int 424_rtld_relocate_plt_object(const Obj_Entry *obj, const Elf_Rela *rela, Elf_Addr *tp) 425{ 426 const Elf_Sym *def; 427 const Obj_Entry *defobj; 428 Elf_Word *where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 429 Elf_Addr value; 430 unsigned long info = rela->r_info; 431 432 assert(ELF_R_TYPE(info) == R_TYPE(JMP_SLOT)); 433 434 def = _rtld_find_plt_symdef(ELF_R_SYM(info), obj, &defobj, tp != NULL); 435 if (__predict_false(def == NULL)) 436 return -1; 437 if (__predict_false(def == &_rtld_sym_zero)) 438 return 0; 439 440 if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) { 441 if (tp == NULL) 442 return 0; 443 value = _rtld_resolve_ifunc(defobj, def); 444 } else { 445 value = (Elf_Addr)(defobj->relocbase + def->st_value); 446 } 447 rdbg(("bind now/fixup in %s --> new=%p", 448 defobj->strtab + def->st_name, (void *)value)); 449 450 /* 451 * At the PLT entry pointed at by `where', we now construct 452 * a direct transfer to the now fully resolved function 453 * address. The resulting code in the jump slot is: 454 * 455 * sethi %hi(roffset), %g1 456 * sethi %hi(addr), %g1 457 * jmp %g1+%lo(addr) 458 * 459 * We write the third instruction first, since that leaves the 460 * previous `b,a' at the second word in place. Hence the whole 461 * PLT slot can be atomically change to the new sequence by 462 * writing the `sethi' instruction at word 2. 463 */ 464#define SETHI 0x03000000 465#define JMP 0x81c06000 466#define NOP 0x01000000 467 where[2] = JMP | (value & 0x000003ff); 468 where[1] = SETHI | ((value >> 10) & 0x003fffff); 469 __asm volatile("iflush %0+8" : : "r" (where)); 470 __asm volatile("iflush %0+4" : : "r" (where)); 471 472 if (tp) 473 *tp = value; 474 475 return 0; 476} 477