1 /* $NetBSD: alpha_reloc.c,v 1.41 2014/08/25 20:40:52 joerg Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Wasabi Systems, Inc. 5 * All rights reserved. 6 * 7 * Written by Jason R. Thorpe for Wasabi Systems, Inc. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed for the NetBSD Project by 20 * Wasabi Systems, Inc. 21 * 4. The name of Wasabi Systems, Inc. may not be used to endorse 22 * or promote products derived from this software without specific prior 23 * written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 27 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 28 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL WASABI SYSTEMS, INC 29 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 30 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 31 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 32 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 33 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 34 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 35 * POSSIBILITY OF SUCH DAMAGE. 36 */ 37 38 /* 39 * Copyright 1996, 1997, 1998, 1999 John D. Polstra. 40 * All rights reserved. 41 * 42 * Redistribution and use in source and binary forms, with or without 43 * modification, are permitted provided that the following conditions 44 * are met: 45 * 1. Redistributions of source code must retain the above copyright 46 * notice, this list of conditions and the following disclaimer. 47 * 2. Redistributions in binary form must reproduce the above copyright 48 * notice, this list of conditions and the following disclaimer in the 49 * documentation and/or other materials provided with the distribution. 50 * 51 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 52 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 53 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 54 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 55 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 56 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 57 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 58 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 59 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 60 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 61 */ 62 63 #include <sys/cdefs.h> 64 #ifndef lint 65 __RCSID("$NetBSD: alpha_reloc.c,v 1.41 2014/08/25 20:40:52 joerg Exp $"); 66 #endif /* not lint */ 67 68 #include <sys/types.h> 69 #include <sys/tls.h> 70 #include <string.h> 71 72 #include "rtld.h" 73 #include "debug.h" 74 75 #ifdef RTLD_DEBUG_ALPHA 76 #define adbg(x) xprintf x 77 #else 78 #define adbg(x) /* nothing */ 79 #endif 80 81 void _rtld_bind_start(void); 82 void _rtld_bind_start_old(void); 83 void _rtld_relocate_nonplt_self(Elf_Dyn *, Elf_Addr); 84 caddr_t _rtld_bind(const Obj_Entry *, Elf_Addr); 85 static inline int _rtld_relocate_plt_object(const Obj_Entry *, 86 const Elf_Rela *, Elf_Addr *); 87 88 void 89 _rtld_setup_pltgot(const Obj_Entry *obj) 90 { 91 uint32_t word0; 92 93 /* 94 * The PLTGOT on the Alpha looks like this: 95 * 96 * PLT HEADER 97 * . 98 * . 32 bytes 99 * . 100 * PLT ENTRY #0 101 * . 102 * . 12 bytes 103 * . 104 * PLT ENTRY #1 105 * . 106 * . 12 bytes 107 * . 108 * etc. 109 * 110 * The old-format entries look like (displacements filled in 111 * by the linker): 112 * 113 * ldah $28, 0($31) # 0x279f0000 114 * lda $28, 0($28) # 0x239c0000 115 * br $31, plt0 # 0xc3e00000 116 * 117 * The new-format entries look like: 118 * 119 * br $28, plt0 # 0xc3800000 120 * # 0x00000000 121 * # 0x00000000 122 * 123 * What we do is fetch the first PLT entry and check to 124 * see the first word of it matches the first word of the 125 * old format. If so, we use a binding routine that can 126 * handle the old format, otherwise we use a binding routine 127 * that handles the new format. 128 * 129 * Note that this is done on a per-object basis, we can mix 130 * and match shared objects build with both the old and new 131 * linker. 132 */ 133 word0 = *(uint32_t *)(((char *) obj->pltgot) + 32); 134 if ((word0 & 0xffff0000) == 0x279f0000) { 135 /* Old PLT entry format. */ 136 adbg(("ALPHA: object %p has old PLT format\n", obj)); 137 obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start_old; 138 obj->pltgot[3] = (Elf_Addr) obj; 139 } else { 140 /* New PLT entry format. */ 141 adbg(("ALPHA: object %p has new PLT format\n", obj)); 142 obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start; 143 obj->pltgot[3] = (Elf_Addr) obj; 144 } 145 146 __asm volatile("imb"); 147 } 148 149 /* 150 * It is possible for the compiler to emit relocations for unaligned data. 151 * We handle this situation with these inlines. 152 */ 153 #define RELOC_ALIGNED_P(x) \ 154 (((uintptr_t)(x) & (sizeof(void *) - 1)) == 0) 155 156 static inline Elf_Addr 157 load_ptr(void *where) 158 { 159 Elf_Addr res; 160 161 memcpy(&res, where, sizeof(res)); 162 163 return (res); 164 } 165 166 static inline void 167 store_ptr(void *where, Elf_Addr val) 168 { 169 170 memcpy(where, &val, sizeof(val)); 171 } 172 173 void 174 _rtld_relocate_nonplt_self(Elf_Dyn *dynp, Elf_Addr relocbase) 175 { 176 const Elf_Rela *rela = 0, *relalim; 177 Elf_Addr relasz = 0; 178 Elf_Addr *where; 179 180 for (; dynp->d_tag != DT_NULL; dynp++) { 181 switch (dynp->d_tag) { 182 case DT_RELA: 183 rela = (const Elf_Rela *)(relocbase + dynp->d_un.d_ptr); 184 break; 185 case DT_RELASZ: 186 relasz = dynp->d_un.d_val; 187 break; 188 } 189 } 190 relalim = (const Elf_Rela *)((const uint8_t *)rela + relasz); 191 for (; rela < relalim; rela++) { 192 where = (Elf_Addr *)(relocbase + rela->r_offset); 193 /* XXX For some reason I see a few GLOB_DAT relocs here. */ 194 *where += (Elf_Addr)relocbase; 195 } 196 } 197 198 int 199 _rtld_relocate_nonplt_objects(Obj_Entry *obj) 200 { 201 const Elf_Rela *rela; 202 Elf_Addr target = -1; 203 204 for (rela = obj->rela; rela < obj->relalim; rela++) { 205 Elf_Addr *where; 206 const Elf_Sym *def; 207 const Obj_Entry *defobj; 208 Elf_Addr tmp; 209 unsigned long symnum; 210 211 where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 212 symnum = ELF_R_SYM(rela->r_info); 213 214 switch (ELF_R_TYPE(rela->r_info)) { 215 case R_TYPE(NONE): 216 break; 217 218 case R_TYPE(REFQUAD): 219 case R_TYPE(GLOB_DAT): 220 def = _rtld_find_symdef(symnum, obj, &defobj, false); 221 if (def == NULL) 222 return -1; 223 target = (Elf_Addr)(defobj->relocbase + 224 def->st_value); 225 226 tmp = target + rela->r_addend; 227 if (__predict_true(RELOC_ALIGNED_P(where))) { 228 if (*where != tmp) 229 *where = tmp; 230 } else { 231 if (load_ptr(where) != tmp) 232 store_ptr(where, tmp); 233 } 234 rdbg(("REFQUAD/GLOB_DAT %s in %s --> %p in %s", 235 obj->strtab + obj->symtab[symnum].st_name, 236 obj->path, (void *)tmp, defobj->path)); 237 break; 238 239 case R_TYPE(RELATIVE): 240 if (__predict_true(RELOC_ALIGNED_P(where))) 241 *where += (Elf_Addr)obj->relocbase; 242 else 243 store_ptr(where, 244 load_ptr(where) + (Elf_Addr)obj->relocbase); 245 rdbg(("RELATIVE in %s --> %p", obj->path, 246 (void *)*where)); 247 break; 248 249 case R_TYPE(COPY): 250 /* 251 * These are deferred until all other relocations have 252 * been done. All we do here is make sure that the 253 * COPY relocation is not in a shared library. They 254 * are allowed only in executable files. 255 */ 256 if (obj->isdynamic) { 257 _rtld_error( 258 "%s: Unexpected R_COPY relocation in shared library", 259 obj->path); 260 return -1; 261 } 262 rdbg(("COPY (avoid in main)")); 263 break; 264 265 case R_TYPE(TPREL64): 266 def = _rtld_find_symdef(symnum, obj, &defobj, false); 267 if (def == NULL) 268 return -1; 269 270 if (!defobj->tls_done && 271 _rtld_tls_offset_allocate(obj)) 272 return -1; 273 274 tmp = (Elf64_Addr)(def->st_value + 275 sizeof(struct tls_tcb) + defobj->tlsoffset + 276 rela->r_addend); 277 278 if (__predict_true(RELOC_ALIGNED_P(where))) 279 *where = tmp; 280 else 281 store_ptr(where, tmp); 282 283 rdbg(("TPREL64 %s in %s --> %p", 284 obj->strtab + obj->symtab[symnum].st_name, 285 obj->path, (void *)*where)); 286 287 break; 288 289 case R_TYPE(DTPMOD64): 290 def = _rtld_find_symdef(symnum, obj, &defobj, false); 291 if (def == NULL) 292 return -1; 293 294 tmp = (Elf64_Addr)defobj->tlsindex; 295 if (__predict_true(RELOC_ALIGNED_P(where))) 296 *where = tmp; 297 else 298 store_ptr(where, tmp); 299 300 rdbg(("DTPMOD64 %s in %s --> %p", 301 obj->strtab + obj->symtab[symnum].st_name, 302 obj->path, (void *)*where)); 303 304 break; 305 306 case R_TYPE(DTPREL64): 307 def = _rtld_find_symdef(symnum, obj, &defobj, false); 308 if (def == NULL) 309 return -1; 310 311 tmp = (Elf64_Addr)(def->st_value + rela->r_addend); 312 if (__predict_true(RELOC_ALIGNED_P(where))) 313 *where = tmp; 314 else 315 store_ptr(where, tmp); 316 317 rdbg(("DTPREL64 %s in %s --> %p", 318 obj->strtab + obj->symtab[symnum].st_name, 319 obj->path, (void *)*where)); 320 321 break; 322 323 default: 324 rdbg(("sym = %lu, type = %lu, offset = %p, " 325 "addend = %p, contents = %p, symbol = %s", 326 symnum, (u_long)ELF_R_TYPE(rela->r_info), 327 (void *)rela->r_offset, (void *)rela->r_addend, 328 (void *)load_ptr(where), 329 obj->strtab + obj->symtab[symnum].st_name)); 330 _rtld_error("%s: Unsupported relocation type %ld " 331 "in non-PLT relocations", 332 obj->path, (u_long) ELF_R_TYPE(rela->r_info)); 333 return -1; 334 } 335 } 336 return 0; 337 } 338 339 int 340 _rtld_relocate_plt_lazy(const Obj_Entry *obj) 341 { 342 const Elf_Rela *rela; 343 344 if (!obj->relocbase) 345 return 0; 346 347 for (rela = obj->pltrela; rela < obj->pltrelalim; rela++) { 348 Elf_Addr *where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 349 350 assert(ELF_R_TYPE(rela->r_info) == R_TYPE(JMP_SLOT)); 351 352 /* Just relocate the GOT slots pointing into the PLT */ 353 *where += (Elf_Addr)obj->relocbase; 354 rdbg(("fixup !main in %s --> %p", obj->path, (void *)*where)); 355 } 356 357 return 0; 358 } 359 360 static inline int 361 _rtld_relocate_plt_object(const Obj_Entry *obj, const Elf_Rela *rela, 362 Elf_Addr *tp) 363 { 364 Elf_Addr *where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 365 Elf_Addr new_value; 366 const Elf_Sym *def; 367 const Obj_Entry *defobj; 368 Elf_Addr stubaddr; 369 unsigned long info = rela->r_info; 370 371 assert(ELF_R_TYPE(info) == R_TYPE(JMP_SLOT)); 372 373 def = _rtld_find_plt_symdef(ELF_R_SYM(info), obj, &defobj, tp != NULL); 374 if (__predict_false(def == NULL)) 375 return -1; 376 if (__predict_false(def == &_rtld_sym_zero)) 377 return 0; 378 379 if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) { 380 if (tp == NULL) 381 return 0; 382 new_value = _rtld_resolve_ifunc(defobj, def); 383 } else { 384 new_value = (Elf_Addr)(defobj->relocbase + def->st_value); 385 } 386 rdbg(("bind now/fixup in %s --> old=%p new=%p", 387 defobj->strtab + def->st_name, (void *)*where, (void *)new_value)); 388 389 if ((stubaddr = *where) != new_value) { 390 int64_t delta, idisp; 391 uint32_t insn[3], *stubptr; 392 int insncnt; 393 Elf_Addr pc; 394 395 /* Point this GOT entry at the target. */ 396 *where = new_value; 397 398 /* 399 * Alpha shared objects may have multiple GOTs, each 400 * of which may point to this entry in the PLT. But, 401 * we only have a reference to the first GOT entry which 402 * points to this PLT entry. In order to avoid having to 403 * re-bind this call every time a non-first GOT entry is 404 * used, we will attempt to patch up the PLT entry to 405 * reference the target, rather than the binder. 406 * 407 * When the PLT stub gets control, PV contains the address 408 * of the PLT entry. Each PLT entry has room for 3 insns. 409 * If the displacement of the target from PV fits in a signed 410 * 32-bit integer, we can simply add it to PV. Otherwise, 411 * we must load the GOT entry itself into PV. 412 * 413 * Note if the shared object uses the old PLT format, then 414 * we cannot patch up the PLT safely, and so we skip it 415 * in that case[*]. 416 * 417 * [*] Actually, if we're not doing lazy-binding, then 418 * we *can* (and do) patch up this PLT entry; the PLTGOT 419 * thunk won't yet point to any binder entry point, and 420 * so this test will fail as it would for the new PLT 421 * entry format. 422 */ 423 if (obj->pltgot[2] == (Elf_Addr) &_rtld_bind_start_old) { 424 rdbg((" old PLT format")); 425 goto out; 426 } 427 428 delta = new_value - stubaddr; 429 rdbg((" stubaddr=%p, where-stubaddr=%ld, delta=%ld", 430 (void *)stubaddr, (long)where - (long)stubaddr, 431 (long)delta)); 432 insncnt = 0; 433 if ((int32_t)delta == delta) { 434 /* 435 * We can adjust PV with an LDA, LDAH sequence. 436 * 437 * First, build an LDA insn to adjust the low 16 438 * bits. 439 */ 440 insn[insncnt++] = 0x08 << 26 | 27 << 21 | 27 << 16 | 441 (delta & 0xffff); 442 rdbg((" LDA $27,%d($27)", (int16_t)delta)); 443 /* 444 * Adjust the delta to account for the effects of 445 * the LDA, including sign-extension. 446 */ 447 delta -= (int16_t)delta; 448 if (delta != 0) { 449 /* 450 * Build an LDAH instruction to adjust the 451 * high 16 bits. 452 */ 453 insn[insncnt++] = 0x09 << 26 | 27 << 21 | 454 27 << 16 | ((delta >> 16) & 0xffff); 455 rdbg((" LDAH $27,%d($27)", 456 (int16_t)(delta >> 16))); 457 } 458 } else { 459 int64_t dhigh; 460 461 /* We must load the GOT entry. */ 462 delta = (Elf_Addr)where - stubaddr; 463 464 /* 465 * If the GOT entry is too far away from the PLT 466 * entry, then we can't patch up the PLT entry. 467 * This PLT entry will have to be bound for each 468 * GOT entry except for the first one. This program 469 * will still run, albeit very slowly. It is very 470 * unlikely that this case will ever happen in 471 * practice. 472 */ 473 if ((int32_t)delta != delta) { 474 rdbg((" PLT stub too far from GOT to relocate")); 475 goto out; 476 } 477 dhigh = delta - (int16_t)delta; 478 if (dhigh != 0) { 479 /* 480 * Build an LDAH instruction to adjust the 481 * high 16 bits. 482 */ 483 insn[insncnt++] = 0x09 << 26 | 27 << 21 | 484 27 << 16 | ((dhigh >> 16) & 0xffff); 485 rdbg((" LDAH $27,%d($27)", 486 (int16_t)(dhigh >> 16))); 487 } 488 /* Build an LDQ to load the GOT entry. */ 489 insn[insncnt++] = 0x29 << 26 | 27 << 21 | 490 27 << 16 | (delta & 0xffff); 491 rdbg((" LDQ $27,%d($27)", 492 (int16_t)delta)); 493 } 494 495 /* 496 * Now, build a JMP or BR insn to jump to the target. If 497 * the displacement fits in a sign-extended 21-bit field, 498 * we can use the more efficient BR insn. Otherwise, we 499 * have to jump indirect through PV. 500 */ 501 pc = stubaddr + (4 * (insncnt + 1)); 502 idisp = (int64_t)(new_value - pc) >> 2; 503 if (-0x100000 <= idisp && idisp < 0x100000) { 504 insn[insncnt++] = 0x30 << 26 | 31 << 21 | 505 (idisp & 0x1fffff); 506 rdbg((" BR $31,%p", (void *)new_value)); 507 } else { 508 insn[insncnt++] = 0x1a << 26 | 31 << 21 | 509 27 << 16 | (idisp & 0x3fff); 510 rdbg((" JMP $31,($27),%d", 511 (int)(idisp & 0x3fff))); 512 } 513 514 /* 515 * Fill in the tail of the PLT entry first, for reentrancy. 516 * Until we have overwritten the first insn (an unconditional 517 * branch), the remaining insns have no effect. 518 */ 519 stubptr = (uint32_t *)stubaddr; 520 while (insncnt > 1) { 521 insncnt--; 522 stubptr[insncnt] = insn[insncnt]; 523 } 524 /* 525 * Commit the tail of the insn sequence to memory 526 * before overwriting the first insn. 527 */ 528 __asm volatile("wmb" ::: "memory"); 529 stubptr[0] = insn[0]; 530 /* 531 * I-stream will be sync'd when we either return from 532 * the binder (lazy bind case) or when the PLTGOT thunk 533 * is patched up (bind-now case). 534 */ 535 } 536 out: 537 if (tp) 538 *tp = new_value; 539 540 return 0; 541 } 542 543 caddr_t 544 _rtld_bind(const Obj_Entry *obj, Elf_Addr reloff) 545 { 546 const Elf_Rela *rela = 547 (const Elf_Rela *)((const uint8_t *)obj->pltrela + reloff); 548 Elf_Addr result = 0; /* XXX gcc */ 549 int err; 550 551 _rtld_shared_enter(); 552 err = _rtld_relocate_plt_object(obj, rela, &result); 553 if (err) 554 _rtld_die(); 555 _rtld_shared_exit(); 556 557 return (caddr_t)result; 558 } 559 560 int 561 _rtld_relocate_plt_objects(const Obj_Entry *obj) 562 { 563 const Elf_Rela *rela; 564 565 for (rela = obj->pltrela; rela < obj->pltrelalim; rela++) 566 if (_rtld_relocate_plt_object(obj, rela, NULL) < 0) 567 return -1; 568 569 return 0; 570 } 571