1 /* $NetBSD: alpha_reloc.c,v 1.44 2023/06/04 01:24:57 joerg Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Wasabi Systems, Inc. 5 * All rights reserved. 6 * 7 * Written by Jason R. Thorpe for Wasabi Systems, Inc. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed for the NetBSD Project by 20 * Wasabi Systems, Inc. 21 * 4. The name of Wasabi Systems, Inc. may not be used to endorse 22 * or promote products derived from this software without specific prior 23 * written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 27 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 28 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL WASABI SYSTEMS, INC 29 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 30 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 31 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 32 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 33 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 34 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 35 * POSSIBILITY OF SUCH DAMAGE. 36 */ 37 38 /* 39 * Copyright 1996, 1997, 1998, 1999 John D. Polstra. 40 * All rights reserved. 41 * 42 * Redistribution and use in source and binary forms, with or without 43 * modification, are permitted provided that the following conditions 44 * are met: 45 * 1. Redistributions of source code must retain the above copyright 46 * notice, this list of conditions and the following disclaimer. 47 * 2. Redistributions in binary form must reproduce the above copyright 48 * notice, this list of conditions and the following disclaimer in the 49 * documentation and/or other materials provided with the distribution. 50 * 51 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 52 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 53 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 54 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 55 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 56 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 57 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 58 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 59 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 60 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 61 */ 62 63 #include <sys/cdefs.h> 64 #ifndef lint 65 __RCSID("$NetBSD: alpha_reloc.c,v 1.44 2023/06/04 01:24:57 joerg Exp $"); 66 #endif /* not lint */ 67 68 #include <sys/types.h> 69 #include <sys/tls.h> 70 #include <string.h> 71 72 #include "rtld.h" 73 #include "debug.h" 74 75 #ifdef RTLD_DEBUG_ALPHA 76 #define adbg(x) xprintf x 77 #else 78 #define adbg(x) /* nothing */ 79 #endif 80 81 void _rtld_bind_start(void); 82 void _rtld_bind_start_old(void); 83 void _rtld_relocate_nonplt_self(Elf_Dyn *, Elf_Addr); 84 caddr_t _rtld_bind(const Obj_Entry *, Elf_Addr); 85 static inline int _rtld_relocate_plt_object(const Obj_Entry *, 86 const Elf_Rela *, Elf_Addr *); 87 88 void 89 _rtld_setup_pltgot(const Obj_Entry *obj) 90 { 91 uint32_t word0; 92 93 /* 94 * The PLTGOT on the Alpha looks like this: 95 * 96 * PLT HEADER 97 * . 98 * . 32 bytes 99 * . 100 * PLT ENTRY #0 101 * . 102 * . 12 bytes 103 * . 104 * PLT ENTRY #1 105 * . 106 * . 12 bytes 107 * . 108 * etc. 109 * 110 * The old-format entries look like (displacements filled in 111 * by the linker): 112 * 113 * ldah $28, 0($31) # 0x279f0000 114 * lda $28, 0($28) # 0x239c0000 115 * br $31, plt0 # 0xc3e00000 116 * 117 * The new-format entries look like: 118 * 119 * br $28, plt0 # 0xc3800000 120 * # 0x00000000 121 * # 0x00000000 122 * 123 * What we do is fetch the first PLT entry and check to 124 * see the first word of it matches the first word of the 125 * old format. If so, we use a binding routine that can 126 * handle the old format, otherwise we use a binding routine 127 * that handles the new format. 128 * 129 * Note that this is done on a per-object basis, we can mix 130 * and match shared objects build with both the old and new 131 * linker. 132 */ 133 word0 = *(uint32_t *)(((char *) obj->pltgot) + 32); 134 if ((word0 & 0xffff0000) == 0x279f0000) { 135 /* Old PLT entry format. */ 136 adbg(("ALPHA: object %p has old PLT format\n", obj)); 137 obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start_old; 138 obj->pltgot[3] = (Elf_Addr) obj; 139 } else { 140 /* New PLT entry format. */ 141 adbg(("ALPHA: object %p has new PLT format\n", obj)); 142 obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start; 143 obj->pltgot[3] = (Elf_Addr) obj; 144 } 145 146 __asm volatile("imb"); 147 } 148 149 /* 150 * It is possible for the compiler to emit relocations for unaligned data. 151 * We handle this situation with these inlines. 152 */ 153 #define RELOC_ALIGNED_P(x) \ 154 (((uintptr_t)(x) & (sizeof(void *) - 1)) == 0) 155 156 static inline Elf_Addr 157 load_ptr(void *where) 158 { 159 Elf_Addr res; 160 161 memcpy(&res, where, sizeof(res)); 162 163 return (res); 164 } 165 166 static inline void 167 store_ptr(void *where, Elf_Addr val) 168 { 169 170 memcpy(where, &val, sizeof(val)); 171 } 172 173 void 174 _rtld_relocate_nonplt_self(Elf_Dyn *dynp, Elf_Addr relocbase) 175 { 176 const Elf_Rela *rela = 0, *relalim; 177 Elf_Addr relasz = 0; 178 Elf_Addr *where; 179 180 for (; dynp->d_tag != DT_NULL; dynp++) { 181 switch (dynp->d_tag) { 182 case DT_RELA: 183 rela = (const Elf_Rela *)(relocbase + dynp->d_un.d_ptr); 184 break; 185 case DT_RELASZ: 186 relasz = dynp->d_un.d_val; 187 break; 188 } 189 } 190 relalim = (const Elf_Rela *)((const uint8_t *)rela + relasz); 191 for (; rela < relalim; rela++) { 192 where = (Elf_Addr *)(relocbase + rela->r_offset); 193 /* XXX For some reason I see a few GLOB_DAT relocs here. */ 194 *where += (Elf_Addr)relocbase; 195 } 196 } 197 198 int 199 _rtld_relocate_nonplt_objects(Obj_Entry *obj) 200 { 201 const Elf_Rela *rela; 202 Elf_Addr target = -1; 203 const Elf_Sym *def = NULL; 204 const Obj_Entry *defobj = NULL; 205 unsigned long last_symnum = ULONG_MAX; 206 207 for (rela = obj->rela; rela < obj->relalim; rela++) { 208 Elf_Addr *where; 209 Elf_Addr tmp; 210 unsigned long symnum; 211 212 where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 213 214 switch (ELF_R_TYPE(rela->r_info)) { 215 case R_TYPE(REFQUAD): 216 case R_TYPE(GLOB_DAT): 217 case R_TYPE(TPREL64): 218 case R_TYPE(DTPMOD64): 219 case R_TYPE(DTPREL64): 220 symnum = ELF_R_SYM(rela->r_info); 221 if (last_symnum != symnum) { 222 last_symnum = symnum; 223 def = _rtld_find_symdef(symnum, obj, &defobj, 224 false); 225 if (def == NULL) 226 return -1; 227 } 228 break; 229 230 default: 231 break; 232 } 233 234 switch (ELF_R_TYPE(rela->r_info)) { 235 case R_TYPE(NONE): 236 break; 237 238 case R_TYPE(REFQUAD): 239 case R_TYPE(GLOB_DAT): 240 target = (Elf_Addr)(defobj->relocbase + 241 def->st_value); 242 243 tmp = target + rela->r_addend; 244 if (__predict_true(RELOC_ALIGNED_P(where))) { 245 if (*where != tmp) 246 *where = tmp; 247 } else { 248 if (load_ptr(where) != tmp) 249 store_ptr(where, tmp); 250 } 251 rdbg(("REFQUAD/GLOB_DAT %s in %s --> %p in %s", 252 obj->strtab + obj->symtab[symnum].st_name, 253 obj->path, (void *)tmp, defobj->path)); 254 break; 255 256 case R_TYPE(RELATIVE): 257 if (__predict_true(RELOC_ALIGNED_P(where))) 258 *where += (Elf_Addr)obj->relocbase; 259 else 260 store_ptr(where, 261 load_ptr(where) + (Elf_Addr)obj->relocbase); 262 rdbg(("RELATIVE in %s --> %p", obj->path, 263 (void *)*where)); 264 break; 265 266 case R_TYPE(COPY): 267 /* 268 * These are deferred until all other relocations have 269 * been done. All we do here is make sure that the 270 * COPY relocation is not in a shared library. They 271 * are allowed only in executable files. 272 */ 273 if (obj->isdynamic) { 274 _rtld_error( 275 "%s: Unexpected R_COPY relocation in shared library", 276 obj->path); 277 return -1; 278 } 279 rdbg(("COPY (avoid in main)")); 280 break; 281 282 case R_TYPE(TPREL64): 283 if (!defobj->tls_static && 284 _rtld_tls_offset_allocate(__UNCONST(defobj))) 285 return -1; 286 287 tmp = (Elf64_Addr)(def->st_value + 288 sizeof(struct tls_tcb) + defobj->tlsoffset + 289 rela->r_addend); 290 291 if (__predict_true(RELOC_ALIGNED_P(where))) 292 *where = tmp; 293 else 294 store_ptr(where, tmp); 295 296 rdbg(("TPREL64 %s in %s --> %p", 297 obj->strtab + obj->symtab[symnum].st_name, 298 obj->path, (void *)*where)); 299 300 break; 301 302 case R_TYPE(DTPMOD64): 303 tmp = (Elf64_Addr)defobj->tlsindex; 304 if (__predict_true(RELOC_ALIGNED_P(where))) 305 *where = tmp; 306 else 307 store_ptr(where, tmp); 308 309 rdbg(("DTPMOD64 %s in %s --> %p", 310 obj->strtab + obj->symtab[symnum].st_name, 311 obj->path, (void *)*where)); 312 313 break; 314 315 case R_TYPE(DTPREL64): 316 tmp = (Elf64_Addr)(def->st_value + rela->r_addend); 317 if (__predict_true(RELOC_ALIGNED_P(where))) 318 *where = tmp; 319 else 320 store_ptr(where, tmp); 321 322 rdbg(("DTPREL64 %s in %s --> %p", 323 obj->strtab + obj->symtab[symnum].st_name, 324 obj->path, (void *)*where)); 325 326 break; 327 328 default: 329 rdbg(("sym = %lu, type = %lu, offset = %p, " 330 "addend = %p, contents = %p, symbol = %s", 331 (u_long)ELF_R_SYM(rela->r_info), 332 (u_long)ELF_R_TYPE(rela->r_info), 333 (void *)rela->r_offset, (void *)rela->r_addend, 334 (void *)load_ptr(where), 335 obj->strtab + obj->symtab[symnum].st_name)); 336 _rtld_error("%s: Unsupported relocation type %ld " 337 "in non-PLT relocations", 338 obj->path, (u_long) ELF_R_TYPE(rela->r_info)); 339 return -1; 340 } 341 } 342 return 0; 343 } 344 345 int 346 _rtld_relocate_plt_lazy(Obj_Entry *obj) 347 { 348 const Elf_Rela *rela; 349 350 if (!obj->relocbase) 351 return 0; 352 353 for (rela = obj->pltrela; rela < obj->pltrelalim; rela++) { 354 Elf_Addr *where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 355 356 assert(ELF_R_TYPE(rela->r_info) == R_TYPE(JMP_SLOT)); 357 358 /* Just relocate the GOT slots pointing into the PLT */ 359 *where += (Elf_Addr)obj->relocbase; 360 rdbg(("fixup !main in %s --> %p", obj->path, (void *)*where)); 361 } 362 363 return 0; 364 } 365 366 static inline int 367 _rtld_relocate_plt_object(const Obj_Entry *obj, const Elf_Rela *rela, 368 Elf_Addr *tp) 369 { 370 Elf_Addr *where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 371 Elf_Addr new_value; 372 const Elf_Sym *def; 373 const Obj_Entry *defobj; 374 Elf_Addr stubaddr; 375 unsigned long info = rela->r_info; 376 377 assert(ELF_R_TYPE(info) == R_TYPE(JMP_SLOT)); 378 379 def = _rtld_find_plt_symdef(ELF_R_SYM(info), obj, &defobj, tp != NULL); 380 if (__predict_false(def == NULL)) 381 return -1; 382 if (__predict_false(def == &_rtld_sym_zero)) 383 return 0; 384 385 if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) { 386 if (tp == NULL) 387 return 0; 388 new_value = _rtld_resolve_ifunc(defobj, def); 389 } else { 390 new_value = (Elf_Addr)(defobj->relocbase + def->st_value); 391 } 392 rdbg(("bind now/fixup in %s --> old=%p new=%p", 393 defobj->strtab + def->st_name, (void *)*where, (void *)new_value)); 394 395 if ((stubaddr = *where) != new_value) { 396 int64_t delta, idisp; 397 uint32_t insn[3], *stubptr; 398 int insncnt; 399 Elf_Addr pc; 400 401 /* Point this GOT entry at the target. */ 402 *where = new_value; 403 404 /* 405 * Alpha shared objects may have multiple GOTs, each 406 * of which may point to this entry in the PLT. But, 407 * we only have a reference to the first GOT entry which 408 * points to this PLT entry. In order to avoid having to 409 * re-bind this call every time a non-first GOT entry is 410 * used, we will attempt to patch up the PLT entry to 411 * reference the target, rather than the binder. 412 * 413 * When the PLT stub gets control, PV contains the address 414 * of the PLT entry. Each PLT entry has room for 3 insns. 415 * If the displacement of the target from PV fits in a signed 416 * 32-bit integer, we can simply add it to PV. Otherwise, 417 * we must load the GOT entry itself into PV. 418 * 419 * Note if the shared object uses the old PLT format, then 420 * we cannot patch up the PLT safely, and so we skip it 421 * in that case[*]. 422 * 423 * [*] Actually, if we're not doing lazy-binding, then 424 * we *can* (and do) patch up this PLT entry; the PLTGOT 425 * thunk won't yet point to any binder entry point, and 426 * so this test will fail as it would for the new PLT 427 * entry format. 428 */ 429 if (obj->pltgot[2] == (Elf_Addr) &_rtld_bind_start_old) { 430 rdbg((" old PLT format")); 431 goto out; 432 } 433 434 delta = new_value - stubaddr; 435 rdbg((" stubaddr=%p, where-stubaddr=%ld, delta=%ld", 436 (void *)stubaddr, (long)where - (long)stubaddr, 437 (long)delta)); 438 insncnt = 0; 439 if ((int32_t)delta == delta) { 440 /* 441 * We can adjust PV with an LDA, LDAH sequence. 442 * 443 * First, build an LDA insn to adjust the low 16 444 * bits. 445 */ 446 insn[insncnt++] = 0x08 << 26 | 27 << 21 | 27 << 16 | 447 (delta & 0xffff); 448 rdbg((" LDA $27,%d($27)", (int16_t)delta)); 449 /* 450 * Adjust the delta to account for the effects of 451 * the LDA, including sign-extension. 452 */ 453 delta -= (int16_t)delta; 454 if (delta != 0) { 455 /* 456 * Build an LDAH instruction to adjust the 457 * high 16 bits. 458 */ 459 insn[insncnt++] = 0x09 << 26 | 27 << 21 | 460 27 << 16 | ((delta >> 16) & 0xffff); 461 rdbg((" LDAH $27,%d($27)", 462 (int16_t)(delta >> 16))); 463 } 464 } else { 465 int64_t dhigh; 466 467 /* We must load the GOT entry. */ 468 delta = (Elf_Addr)where - stubaddr; 469 470 /* 471 * If the GOT entry is too far away from the PLT 472 * entry, then we can't patch up the PLT entry. 473 * This PLT entry will have to be bound for each 474 * GOT entry except for the first one. This program 475 * will still run, albeit very slowly. It is very 476 * unlikely that this case will ever happen in 477 * practice. 478 */ 479 if ((int32_t)delta != delta) { 480 rdbg((" PLT stub too far from GOT to relocate")); 481 goto out; 482 } 483 dhigh = delta - (int16_t)delta; 484 if (dhigh != 0) { 485 /* 486 * Build an LDAH instruction to adjust the 487 * high 16 bits. 488 */ 489 insn[insncnt++] = 0x09 << 26 | 27 << 21 | 490 27 << 16 | ((dhigh >> 16) & 0xffff); 491 rdbg((" LDAH $27,%d($27)", 492 (int16_t)(dhigh >> 16))); 493 } 494 /* Build an LDQ to load the GOT entry. */ 495 insn[insncnt++] = 0x29 << 26 | 27 << 21 | 496 27 << 16 | (delta & 0xffff); 497 rdbg((" LDQ $27,%d($27)", 498 (int16_t)delta)); 499 } 500 501 /* 502 * Now, build a JMP or BR insn to jump to the target. If 503 * the displacement fits in a sign-extended 21-bit field, 504 * we can use the more efficient BR insn. Otherwise, we 505 * have to jump indirect through PV. 506 */ 507 pc = stubaddr + (4 * (insncnt + 1)); 508 idisp = (int64_t)(new_value - pc) >> 2; 509 if (-0x100000 <= idisp && idisp < 0x100000) { 510 insn[insncnt++] = 0x30 << 26 | 31 << 21 | 511 (idisp & 0x1fffff); 512 rdbg((" BR $31,%p", (void *)new_value)); 513 } else { 514 insn[insncnt++] = 0x1a << 26 | 31 << 21 | 515 27 << 16 | (idisp & 0x3fff); 516 rdbg((" JMP $31,($27),%d", 517 (int)(idisp & 0x3fff))); 518 } 519 520 /* 521 * Fill in the tail of the PLT entry first, for reentrancy. 522 * Until we have overwritten the first insn (an unconditional 523 * branch), the remaining insns have no effect. 524 */ 525 stubptr = (uint32_t *)stubaddr; 526 while (insncnt > 1) { 527 insncnt--; 528 stubptr[insncnt] = insn[insncnt]; 529 } 530 /* 531 * Commit the tail of the insn sequence to memory 532 * before overwriting the first insn. 533 */ 534 __asm volatile("wmb" ::: "memory"); 535 stubptr[0] = insn[0]; 536 /* 537 * I-stream will be sync'd when we either return from 538 * the binder (lazy bind case) or when the PLTGOT thunk 539 * is patched up (bind-now case). 540 */ 541 } 542 out: 543 if (tp) 544 *tp = new_value; 545 546 return 0; 547 } 548 549 caddr_t 550 _rtld_bind(const Obj_Entry *obj, Elf_Addr reloff) 551 { 552 const Elf_Rela *rela = 553 (const Elf_Rela *)((const uint8_t *)obj->pltrela + reloff); 554 Elf_Addr result = 0; /* XXX gcc */ 555 int err; 556 557 _rtld_shared_enter(); 558 err = _rtld_relocate_plt_object(obj, rela, &result); 559 if (err) 560 _rtld_die(); 561 _rtld_shared_exit(); 562 563 return (caddr_t)result; 564 } 565 566 int 567 _rtld_relocate_plt_objects(const Obj_Entry *obj) 568 { 569 const Elf_Rela *rela; 570 571 for (rela = obj->pltrela; rela < obj->pltrelalim; rela++) 572 if (_rtld_relocate_plt_object(obj, rela, NULL) < 0) 573 return -1; 574 575 return 0; 576 } 577