1 /* $NetBSD: mdreloc.c,v 1.60 2024/08/03 21:59:58 riastradh Exp $ */ 2 3 /*- 4 * Copyright (c) 1999, 2002 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Paul Kranenburg and by Charles M. Hannum. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * SPARC ELF relocations. 34 * 35 * Reference: 36 * 37 * SPARC Compliance Definition 2.4.1 38 * http://sparc.org/wp-content/uploads/2014/01/SCD.2.4.1.pdf.gz 39 */ 40 41 #include <sys/cdefs.h> 42 #ifndef lint 43 __RCSID("$NetBSD: mdreloc.c,v 1.60 2024/08/03 21:59:58 riastradh Exp $"); 44 #endif /* not lint */ 45 46 #include <machine/elf_support.h> 47 48 #include <errno.h> 49 #include <stdio.h> 50 #include <stdlib.h> 51 #include <string.h> 52 #include <unistd.h> 53 54 #include "rtldenv.h" 55 #include "debug.h" 56 #include "rtld.h" 57 58 /* 59 * The following table holds for each relocation type: 60 * - the width in bits of the memory location the relocation 61 * applies to (not currently used) 62 * - the number of bits the relocation value must be shifted to the 63 * right (i.e. discard least significant bits) to fit into 64 * the appropriate field in the instruction word. 65 * - flags indicating whether 66 * * the relocation involves a symbol 67 * * the relocation is relative to the current position 68 * * the relocation is for a GOT entry 69 * * the relocation is relative to the load address 70 * 71 */ 72 #define _RF_S 0x80000000 /* Resolve symbol */ 73 #define _RF_A 0x40000000 /* Use addend */ 74 #define _RF_P 0x20000000 /* Location relative */ 75 #define _RF_G 0x10000000 /* GOT offset */ 76 #define _RF_B 0x08000000 /* Load address relative */ 77 #define _RF_U 0x04000000 /* Unaligned */ 78 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 79 #define _RF_RS(s) ( (s) & 0xff) /* right shift */ 80 static const int reloc_target_flags[R_TYPE(TLS_TPOFF64)+1] = { 81 0, /* NONE */ 82 _RF_S|_RF_A| _RF_SZ(8) | _RF_RS(0), /* RELOC_8 */ 83 _RF_S|_RF_A| _RF_SZ(16) | _RF_RS(0), /* RELOC_16 */ 84 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* RELOC_32 */ 85 _RF_S|_RF_A|_RF_P| _RF_SZ(8) | _RF_RS(0), /* DISP_8 */ 86 _RF_S|_RF_A|_RF_P| _RF_SZ(16) | _RF_RS(0), /* DISP_16 */ 87 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* DISP_32 */ 88 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_30 */ 89 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_22 */ 90 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* HI22 */ 91 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 22 */ 92 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 13 */ 93 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* LO10 */ 94 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT10 */ 95 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT13 */ 96 _RF_G| _RF_SZ(32) | _RF_RS(10), /* GOT22 */ 97 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PC10 */ 98 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PC22 */ 99 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WPLT30 */ 100 _RF_SZ(32) | _RF_RS(0), /* COPY */ 101 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* GLOB_DAT */ 102 _RF_SZ(32) | _RF_RS(0), /* JMP_SLOT */ 103 _RF_A| _RF_B| _RF_SZ(32) | _RF_RS(0), /* RELATIVE */ 104 _RF_S|_RF_A| _RF_U| _RF_SZ(32) | _RF_RS(0), /* UA_32 */ 105 106 /* TLS and 64 bit relocs not listed here... */ 107 }; 108 109 #ifdef RTLD_DEBUG_RELOC 110 static const char *reloc_names[] = { 111 "NONE", "RELOC_8", "RELOC_16", "RELOC_32", "DISP_8", 112 "DISP_16", "DISP_32", "WDISP_30", "WDISP_22", "HI22", 113 "22", "13", "LO10", "GOT10", "GOT13", 114 "GOT22", "PC10", "PC22", "WPLT30", "COPY", 115 "GLOB_DAT", "JMP_SLOT", "RELATIVE", "UA_32", 116 117 /* not used with 32bit userland, besides a few of the TLS ones */ 118 "PLT32", 119 "HIPLT22", "LOPLT10", "LOPLT10", "PCPLT22", "PCPLT32", 120 "10", "11", "64", "OLO10", "HH22", 121 "HM10", "LM22", "PC_HH22", "PC_HM10", "PC_LM22", 122 "WDISP16", "WDISP19", "GLOB_JMP", "7", "5", "6", 123 "DISP64", "PLT64", "HIX22", "LOX10", "H44", "M44", 124 "L44", "REGISTER", "UA64", "UA16", 125 "TLS_GD_HI22", "TLS_GD_LO10", "TLS_GD_ADD", "TLS_GD_CALL", 126 "TLS_LDM_HI22", "TLS_LDM_LO10", "TLS_LDM_ADD", "TLS_LDM_CALL", 127 "TLS_LDO_HIX22", "TLS_LDO_LOX10", "TLS_LDO_ADD", "TLS_IE_HI22", 128 "TLS_IE_LO10", "TLS_IE_LD", "TLS_IE_LDX", "TLS_IE_ADD", "TLS_LE_HIX22", 129 "TLS_LE_LOX10", "TLS_DTPMOD32", "TLS_DTPMOD64", "TLS_DTPOFF32", 130 "TLS_DTPOFF64", "TLS_TPOFF32", "TLS_TPOFF64", 131 }; 132 #endif 133 134 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 135 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 136 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 137 #define RELOC_UNALIGNED(t) ((reloc_target_flags[t] & _RF_U) != 0) 138 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 139 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 140 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 141 #define RELOC_TLS(t) (t >= R_TYPE(TLS_GD_HI22)) 142 143 static const int reloc_target_bitmask[] = { 144 #define _BM(x) (~(-(1ULL << (x)))) 145 0, /* NONE */ 146 _BM(8), _BM(16), _BM(32), /* RELOC_8, _16, _32 */ 147 _BM(8), _BM(16), _BM(32), /* DISP8, DISP16, DISP32 */ 148 _BM(30), _BM(22), /* WDISP30, WDISP22 */ 149 _BM(22), _BM(22), /* HI22, _22 */ 150 _BM(13), _BM(10), /* RELOC_13, _LO10 */ 151 _BM(10), _BM(13), _BM(22), /* GOT10, GOT13, GOT22 */ 152 _BM(10), _BM(22), /* _PC10, _PC22 */ 153 _BM(30), 0, /* _WPLT30, _COPY */ 154 -1, -1, -1, /* _GLOB_DAT, JMP_SLOT, _RELATIVE */ 155 _BM(32) /* _UA32 */ 156 #undef _BM 157 }; 158 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 159 160 void _rtld_bind_start(void); 161 void _rtld_relocate_nonplt_self(Elf_Dyn *, Elf_Addr); 162 caddr_t _rtld_bind(const Obj_Entry *, Elf_Word); 163 static inline int _rtld_relocate_plt_object(const Obj_Entry *, 164 const Elf_Rela *, Elf_Addr *); 165 166 void 167 _rtld_setup_pltgot(const Obj_Entry *obj) 168 { 169 /* 170 * PLTGOT is the PLT on the sparc. 171 * The first entry holds the call the dynamic linker. 172 * We construct a `call' sequence that transfers 173 * to `_rtld_bind_start()'. 174 * The second entry holds the object identification. 175 * Note: each PLT entry is three words long. 176 */ 177 #define SAVE 0x9de3bfa0 /* i.e. `save %sp,-96,%sp' */ 178 #define CALL 0x40000000 179 #define NOP 0x01000000 180 obj->pltgot[0] = SAVE; 181 obj->pltgot[1] = CALL | 182 ((Elf_Addr) &_rtld_bind_start - (Elf_Addr) &obj->pltgot[1]) >> 2; 183 obj->pltgot[2] = NOP; 184 obj->pltgot[3] = (Elf_Addr) obj; 185 } 186 187 void 188 _rtld_relocate_nonplt_self(Elf_Dyn *dynp, Elf_Addr relocbase) 189 { 190 const Elf_Rela *rela = 0, *relalim; 191 Elf_Addr relasz = 0; 192 Elf_Addr *where; 193 194 for (; dynp->d_tag != DT_NULL; dynp++) { 195 switch (dynp->d_tag) { 196 case DT_RELA: 197 rela = (const Elf_Rela *)(relocbase + dynp->d_un.d_ptr); 198 break; 199 case DT_RELASZ: 200 relasz = dynp->d_un.d_val; 201 break; 202 } 203 } 204 relalim = (const Elf_Rela *)((const uint8_t *)rela + relasz); 205 for (; rela < relalim; rela++) { 206 where = (Elf_Addr *)(relocbase + rela->r_offset); 207 *where += (Elf_Addr)(relocbase + rela->r_addend); 208 } 209 } 210 211 int 212 _rtld_relocate_nonplt_objects(Obj_Entry *obj) 213 { 214 const Elf_Rela *rela; 215 const Elf_Sym *def = NULL; 216 const Obj_Entry *defobj = NULL; 217 unsigned long last_symnum = ULONG_MAX; 218 219 for (rela = obj->rela; rela < obj->relalim; rela++) { 220 Elf_Addr *where; 221 Elf_Word type, value, mask; 222 unsigned long symnum; 223 224 where = (Elf_Addr *) (obj->relocbase + rela->r_offset); 225 226 type = ELF_R_TYPE(rela->r_info); 227 if (type == R_TYPE(NONE)) 228 continue; 229 230 /* We do JMP_SLOTs in _rtld_bind() below */ 231 if (type == R_TYPE(JMP_SLOT)) 232 continue; 233 234 /* IFUNC relocations are handled in _rtld_call_ifunc */ 235 if (type == R_TYPE(IRELATIVE)) { 236 if (obj->ifunc_remaining_nonplt == 0) { 237 obj->ifunc_remaining_nonplt = 238 obj->relalim - rela; 239 } 240 continue; 241 } 242 243 /* COPY relocs are also handled elsewhere */ 244 if (type == R_TYPE(COPY)) 245 continue; 246 247 /* 248 * We use the fact that relocation types are an `enum' 249 * Note: R_SPARC_TLS_TPOFF64 is currently numerically largest. 250 */ 251 if (type > R_TYPE(TLS_TPOFF64)) 252 return (-1); 253 254 value = rela->r_addend; 255 256 if (RELOC_RESOLVE_SYMBOL(type) || RELOC_TLS(type)) { 257 symnum = ELF_R_SYM(rela->r_info); 258 if (last_symnum != symnum) { 259 last_symnum = symnum; 260 def = _rtld_find_symdef(symnum, obj, &defobj, 261 false); 262 if (def == NULL) 263 return -1; 264 } 265 } 266 267 /* 268 * Handle TLS relocations here, they are different. 269 */ 270 if (RELOC_TLS(type)) { 271 switch (type) { 272 case R_TYPE(TLS_DTPMOD32): 273 *where = (Elf_Addr)defobj->tlsindex; 274 275 rdbg(("TLS_DTPMOD32 %s in %s --> %p", 276 obj->strtab + 277 obj->symtab[symnum].st_name, 278 obj->path, (void *)*where)); 279 280 break; 281 282 case R_TYPE(TLS_DTPOFF32): 283 *where = (Elf_Addr)(def->st_value 284 + rela->r_addend); 285 286 rdbg(("TLS_DTPOFF32 %s in %s --> %p", 287 obj->strtab + 288 obj->symtab[symnum].st_name, 289 obj->path, (void *)*where)); 290 291 break; 292 293 case R_TYPE(TLS_TPOFF32): 294 if (!defobj->tls_static && 295 _rtld_tls_offset_allocate(__UNCONST(defobj))) 296 return -1; 297 298 *where = (Elf_Addr)(def->st_value - 299 defobj->tlsoffset + rela->r_addend); 300 301 rdbg(("TLS_TPOFF32 %s in %s --> %p", 302 obj->strtab + 303 obj->symtab[symnum].st_name, 304 obj->path, (void *)*where)); 305 306 break; 307 } 308 continue; 309 } 310 311 /* 312 * If it is no TLS relocation (handled above), we can not 313 * deal with it if it is beyond R_SPARC_6. 314 */ 315 if (type > R_TYPE(6)) 316 return (-1); 317 318 /* 319 * Handle relative relocs here, as an optimization. 320 */ 321 if (type == R_TYPE(RELATIVE)) { 322 *where += (Elf_Addr)(obj->relocbase + value); 323 rdbg(("RELATIVE in %s --> %p", obj->path, 324 (void *)*where)); 325 continue; 326 } 327 328 if (RELOC_RESOLVE_SYMBOL(type)) { 329 /* Add in the symbol's absolute address */ 330 value += (Elf_Word)(defobj->relocbase + def->st_value); 331 } 332 333 if (RELOC_PC_RELATIVE(type)) { 334 value -= (Elf_Word)where; 335 } 336 337 if (RELOC_BASE_RELATIVE(type)) { 338 /* 339 * Note that even though sparcs use `Elf_rela' 340 * exclusively we still need the implicit memory addend 341 * in relocations referring to GOT entries. 342 * Undoubtedly, someone f*cked this up in the distant 343 * past, and now we're stuck with it in the name of 344 * compatibility for all eternity.. 345 * 346 * In any case, the implicit and explicit should be 347 * mutually exclusive. We provide a check for that 348 * here. 349 */ 350 #define DIAGNOSTIC 351 #ifdef DIAGNOSTIC 352 if (value != 0 && *where != 0) { 353 xprintf("BASE_REL(%s): where=%p, *where 0x%x, " 354 "addend=0x%x, base %p\n", 355 obj->path, where, *where, 356 rela->r_addend, obj->relocbase); 357 } 358 #endif 359 value += (Elf_Word)(obj->relocbase + *where); 360 } 361 362 mask = RELOC_VALUE_BITMASK(type); 363 value >>= RELOC_VALUE_RIGHTSHIFT(type); 364 value &= mask; 365 366 if (RELOC_UNALIGNED(type)) { 367 /* Handle unaligned relocations. */ 368 Elf_Addr tmp = 0; 369 char *ptr = (char *)where; 370 int i, size = RELOC_TARGET_SIZE(type)/8; 371 372 /* Read it in one byte at a time. */ 373 for (i=0; i<size; i++) 374 tmp = (tmp << 8) | ptr[i]; 375 376 tmp &= ~mask; 377 tmp |= value; 378 379 /* Write it back out. */ 380 for (i=0; i<size; i++) 381 ptr[i] = ((tmp >> (8*i)) & 0xff); 382 #ifdef RTLD_DEBUG_RELOC 383 value = (Elf_Word)tmp; 384 #endif 385 386 } else { 387 *where &= ~mask; 388 *where |= value; 389 #ifdef RTLD_DEBUG_RELOC 390 value = (Elf_Word)*where; 391 #endif 392 } 393 #ifdef RTLD_DEBUG_RELOC 394 if (RELOC_RESOLVE_SYMBOL(type)) { 395 rdbg(("%s %s in %s --> %p in %s", reloc_names[type], 396 obj->strtab + obj->symtab[ELF_R_SYM(rela->r_info)].st_name, 397 obj->path, (void *)value, defobj->path)); 398 } else { 399 rdbg(("%s in %s --> %p", reloc_names[type], 400 obj->path, (void *)value)); 401 } 402 #endif 403 } 404 return (0); 405 } 406 407 int 408 _rtld_relocate_plt_lazy(Obj_Entry *obj) 409 { 410 const Elf_Rela *rela; 411 412 for (rela = obj->pltrelalim; rela-- > obj->pltrela; ) { 413 if (ELF_R_TYPE(rela->r_info) == R_TYPE(JMP_IREL)) 414 obj->ifunc_remaining = obj->pltrelalim - rela + 1; 415 } 416 417 return 0; 418 } 419 420 caddr_t 421 _rtld_bind(const Obj_Entry *obj, Elf_Word reloff) 422 { 423 const Elf_Rela *rela = (const Elf_Rela *)((const uint8_t *)obj->pltrela + reloff); 424 Elf_Addr value; 425 int err; 426 427 value = 0; /* XXX gcc */ 428 429 _rtld_shared_enter(); 430 err = _rtld_relocate_plt_object(obj, rela, &value); 431 if (err) 432 _rtld_die(); 433 _rtld_shared_exit(); 434 435 return (caddr_t)value; 436 } 437 438 int 439 _rtld_relocate_plt_objects(const Obj_Entry *obj) 440 { 441 const Elf_Rela *rela = obj->pltrela; 442 443 for (; rela < obj->pltrelalim; rela++) 444 if (_rtld_relocate_plt_object(obj, rela, NULL) < 0) 445 return -1; 446 447 return 0; 448 } 449 450 static inline int 451 _rtld_relocate_plt_object(const Obj_Entry *obj, const Elf_Rela *rela, Elf_Addr *tp) 452 { 453 const Elf_Sym *def; 454 const Obj_Entry *defobj; 455 Elf_Word *where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 456 Elf_Addr value; 457 unsigned long info = rela->r_info; 458 459 if (ELF_R_TYPE(info) == R_TYPE(JMP_IREL)) 460 return 0; 461 462 assert(ELF_R_TYPE(info) == R_TYPE(JMP_SLOT)); 463 464 def = _rtld_find_plt_symdef(ELF_R_SYM(info), obj, &defobj, tp != NULL); 465 if (__predict_false(def == NULL)) 466 return -1; 467 if (__predict_false(def == &_rtld_sym_zero)) 468 return 0; 469 470 if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) { 471 if (tp == NULL) 472 return 0; 473 value = _rtld_resolve_ifunc(defobj, def); 474 } else { 475 value = (Elf_Addr)(defobj->relocbase + def->st_value); 476 } 477 rdbg(("bind now/fixup in %s --> new=%p", 478 defobj->strtab + def->st_name, (void *)value)); 479 480 sparc_write_branch(where + 1, (void *)value); 481 482 if (tp) 483 *tp = value; 484 485 return 0; 486 } 487