1 /* $NetBSD: alpha_reloc.c,v 1.24 2003/07/24 10:12:27 skrll Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Wasabi Systems, Inc. 5 * All rights reserved. 6 * 7 * Written by Jason R. Thorpe for Wasabi Systems, Inc. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed for the NetBSD Project by 20 * Wasabi Systems, Inc. 21 * 4. The name of Wasabi Systems, Inc. may not be used to endorse 22 * or promote products derived from this software without specific prior 23 * written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 27 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 28 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL WASABI SYSTEMS, INC 29 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 30 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 31 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 32 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 33 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 34 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 35 * POSSIBILITY OF SUCH DAMAGE. 36 */ 37 38 /* 39 * Copyright 1996, 1997, 1998, 1999 John D. Polstra. 40 * All rights reserved. 41 * 42 * Redistribution and use in source and binary forms, with or without 43 * modification, are permitted provided that the following conditions 44 * are met: 45 * 1. Redistributions of source code must retain the above copyright 46 * notice, this list of conditions and the following disclaimer. 47 * 2. Redistributions in binary form must reproduce the above copyright 48 * notice, this list of conditions and the following disclaimer in the 49 * documentation and/or other materials provided with the distribution. 50 * 51 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 52 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 53 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 54 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 55 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 56 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 57 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 58 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 59 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 60 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 61 */ 62 63 #include <sys/types.h> 64 #include <sys/stat.h> 65 #include <string.h> 66 67 #include "rtld.h" 68 #include "debug.h" 69 70 #ifdef RTLD_DEBUG_ALPHA 71 #define adbg(x) xprintf x 72 #else 73 #define adbg(x) /* nothing */ 74 #endif 75 76 void _rtld_bind_start(void); 77 void _rtld_bind_start_old(void); 78 void _rtld_relocate_nonplt_self(Elf_Dyn *, Elf_Addr); 79 caddr_t _rtld_bind(const Obj_Entry *, Elf_Word); 80 81 void 82 _rtld_setup_pltgot(const Obj_Entry *obj) 83 { 84 uint32_t word0; 85 86 /* 87 * The PLTGOT on the Alpha looks like this: 88 * 89 * PLT HEADER 90 * . 91 * . 32 bytes 92 * . 93 * PLT ENTRY #0 94 * . 95 * . 12 bytes 96 * . 97 * PLT ENTRY #1 98 * . 99 * . 12 bytes 100 * . 101 * etc. 102 * 103 * The old-format entries look like (displacements filled in 104 * by the linker): 105 * 106 * ldah $28, 0($31) # 0x279f0000 107 * lda $28, 0($28) # 0x239c0000 108 * br $31, plt0 # 0xc3e00000 109 * 110 * The new-format entries look like: 111 * 112 * br $28, plt0 # 0xc3800000 113 * # 0x00000000 114 * # 0x00000000 115 * 116 * What we do is fetch the first PLT entry and check to 117 * see the first word of it matches the first word of the 118 * old format. If so, we use a binding routine that can 119 * handle the old format, otherwise we use a binding routine 120 * that handles the new format. 121 * 122 * Note that this is done on a per-object basis, we can mix 123 * and match shared objects build with both the old and new 124 * linker. 125 */ 126 word0 = *(uint32_t *)(((char *) obj->pltgot) + 32); 127 if ((word0 & 0xffff0000) == 0x279f0000) { 128 /* Old PLT entry format. */ 129 adbg(("ALPHA: object %p has old PLT format\n", obj)); 130 obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start_old; 131 obj->pltgot[3] = (Elf_Addr) obj; 132 } else { 133 /* New PLT entry format. */ 134 adbg(("ALPHA: object %p has new PLT format\n", obj)); 135 obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start; 136 obj->pltgot[3] = (Elf_Addr) obj; 137 } 138 139 __asm __volatile("imb"); 140 } 141 142 /* 143 * It is possible for the compiler to emit relocations for unaligned data. 144 * We handle this situation with these inlines. 145 */ 146 #define RELOC_ALIGNED_P(x) \ 147 (((uintptr_t)(x) & (sizeof(void *) - 1)) == 0) 148 149 static __inline Elf_Addr 150 load_ptr(void *where) 151 { 152 Elf_Addr res; 153 154 memcpy(&res, where, sizeof(res)); 155 156 return (res); 157 } 158 159 static __inline void 160 store_ptr(void *where, Elf_Addr val) 161 { 162 163 memcpy(where, &val, sizeof(val)); 164 } 165 166 void 167 _rtld_relocate_nonplt_self(Elf_Dyn *dynp, Elf_Addr relocbase) 168 { 169 const Elf_Rela *rela = 0, *relalim; 170 Elf_Addr relasz = 0; 171 Elf_Addr *where; 172 173 for (; dynp->d_tag != DT_NULL; dynp++) { 174 switch (dynp->d_tag) { 175 case DT_RELA: 176 rela = (const Elf_Rela *)(relocbase + dynp->d_un.d_ptr); 177 break; 178 case DT_RELASZ: 179 relasz = dynp->d_un.d_val; 180 break; 181 } 182 } 183 relalim = (const Elf_Rela *)((caddr_t)rela + relasz); 184 for (; rela < relalim; rela++) { 185 where = (Elf_Addr *)(relocbase + rela->r_offset); 186 /* XXX For some reason I see a few GLOB_DAT relocs here. */ 187 *where += (Elf_Addr)relocbase; 188 } 189 } 190 191 int 192 _rtld_relocate_nonplt_objects(const Obj_Entry *obj) 193 { 194 const Elf_Rela *rela; 195 #define COMBRELOC 196 #ifdef COMBRELOC 197 unsigned long lastsym = -1; 198 #endif 199 Elf_Addr target; 200 201 for (rela = obj->rela; rela < obj->relalim; rela++) { 202 Elf_Addr *where; 203 const Elf_Sym *def; 204 const Obj_Entry *defobj; 205 Elf_Addr tmp; 206 unsigned long symnum; 207 208 where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 209 symnum = ELF_R_SYM(rela->r_info); 210 211 switch (ELF_R_TYPE(rela->r_info)) { 212 case R_TYPE(NONE): 213 break; 214 215 case R_TYPE(REFQUAD): 216 case R_TYPE(GLOB_DAT): 217 #ifdef COMBRELOC 218 if (symnum != lastsym) { 219 #endif 220 def = _rtld_find_symdef(symnum, obj, &defobj, 221 false); 222 if (def == NULL) 223 return -1; 224 target = (Elf_Addr)(defobj->relocbase + 225 def->st_value); 226 #ifdef COMBRELOC 227 lastsym = symnum; 228 } 229 #endif 230 231 tmp = target + rela->r_addend; 232 if (__predict_true(RELOC_ALIGNED_P(where))) { 233 if (*where != tmp) 234 *where = tmp; 235 } else { 236 if (load_ptr(where) != tmp) 237 store_ptr(where, tmp); 238 } 239 rdbg(("REFQUAD/GLOB_DAT %s in %s --> %p in %s", 240 obj->strtab + obj->symtab[symnum].st_name, 241 obj->path, (void *)tmp, defobj->path)); 242 break; 243 244 case R_TYPE(RELATIVE): 245 if (__predict_true(RELOC_ALIGNED_P(where))) 246 *where += (Elf_Addr)obj->relocbase; 247 else 248 store_ptr(where, 249 load_ptr(where) + (Elf_Addr)obj->relocbase); 250 rdbg(("RELATIVE in %s --> %p", obj->path, 251 (void *)*where)); 252 break; 253 254 case R_TYPE(COPY): 255 /* 256 * These are deferred until all other relocations have 257 * been done. All we do here is make sure that the 258 * COPY relocation is not in a shared library. They 259 * are allowed only in executable files. 260 */ 261 if (obj->isdynamic) { 262 _rtld_error( 263 "%s: Unexpected R_COPY relocation in shared library", 264 obj->path); 265 return -1; 266 } 267 rdbg(("COPY (avoid in main)")); 268 break; 269 270 default: 271 rdbg(("sym = %lu, type = %lu, offset = %p, " 272 "addend = %p, contents = %p, symbol = %s", 273 symnum, (u_long)ELF_R_TYPE(rela->r_info), 274 (void *)rela->r_offset, (void *)rela->r_addend, 275 (void *)load_ptr(where), 276 obj->strtab + obj->symtab[symnum].st_name)); 277 _rtld_error("%s: Unsupported relocation type %ld " 278 "in non-PLT relocations\n", 279 obj->path, (u_long) ELF_R_TYPE(rela->r_info)); 280 return -1; 281 } 282 } 283 return 0; 284 } 285 286 int 287 _rtld_relocate_plt_lazy(const Obj_Entry *obj) 288 { 289 const Elf_Rela *rela; 290 291 if (!obj->relocbase) 292 return 0; 293 294 for (rela = obj->pltrela; rela < obj->pltrelalim; rela++) { 295 Elf_Addr *where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 296 297 assert(ELF_R_TYPE(rela->r_info) == R_TYPE(JMP_SLOT)); 298 299 /* Just relocate the GOT slots pointing into the PLT */ 300 *where += (Elf_Addr)obj->relocbase; 301 rdbg(("fixup !main in %s --> %p", obj->path, (void *)*where)); 302 } 303 304 return 0; 305 } 306 307 caddr_t 308 _rtld_bind(const Obj_Entry *obj, Elf_Word reloff) 309 { 310 const Elf_Rela *rela = (const Elf_Rela *)((caddr_t)obj->pltrela + reloff); 311 Elf_Addr *where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 312 Elf_Addr new_value; 313 const Elf_Sym *def; 314 const Obj_Entry *defobj; 315 Elf_Addr stubaddr; 316 317 assert(ELF_R_TYPE(rela->r_info) == R_TYPE(JMP_SLOT)); 318 319 def = _rtld_find_symdef(ELF_R_SYM(rela->r_info), obj, &defobj, true); 320 if (def == NULL) 321 _rtld_die(); 322 323 new_value = (Elf_Addr)(defobj->relocbase + def->st_value); 324 rdbg(("bind now/fixup in %s --> old=%p new=%p", 325 defobj->strtab + def->st_name, (void *)*where, (void *)new_value)); 326 327 if ((stubaddr = *where) != new_value) { 328 int64_t delta, idisp; 329 uint32_t insn[3], *stubptr; 330 int insncnt; 331 Elf_Addr pc; 332 333 /* Point this GOT entry at the target. */ 334 *where = new_value; 335 336 /* 337 * Alpha shared objects may have multiple GOTs, each 338 * of which may point to this entry in the PLT. But, 339 * we only have a reference to the first GOT entry which 340 * points to this PLT entry. In order to avoid having to 341 * re-bind this call every time a non-first GOT entry is 342 * used, we will attempt to patch up the PLT entry to 343 * reference the target, rather than the binder. 344 * 345 * When the PLT stub gets control, PV contains the address 346 * of the PLT entry. Each PLT entry has room for 3 insns. 347 * If the displacement of the target from PV fits in a signed 348 * 32-bit integer, we can simply add it to PV. Otherwise, 349 * we must load the GOT entry itself into PV. 350 * 351 * Note if the shared object uses the old PLT format, then 352 * we cannot patch up the PLT safely, and so we skip it 353 * in that case[*]. 354 * 355 * [*] Actually, if we're not doing lazy-binding, then 356 * we *can* (and do) patch up this PLT entry; the PLTGOT 357 * thunk won't yet point to any binder entry point, and 358 * so this test will fail as it would for the new PLT 359 * entry format. 360 */ 361 if (obj->pltgot[2] == (Elf_Addr) &_rtld_bind_start_old) { 362 rdbg((" old PLT format")); 363 goto out; 364 } 365 366 delta = new_value - stubaddr; 367 rdbg((" stubaddr=%p, where-stubaddr=%ld, delta=%ld", 368 (void *)stubaddr, (long)where - (long)stubaddr, 369 (long)delta)); 370 insncnt = 0; 371 if ((int32_t)delta == delta) { 372 /* 373 * We can adjust PV with an LDA, LDAH sequence. 374 * 375 * First, build an LDA insn to adjust the low 16 376 * bits. 377 */ 378 insn[insncnt++] = 0x08 << 26 | 27 << 21 | 27 << 16 | 379 (delta & 0xffff); 380 rdbg((" LDA $27,%d($27)", (int16_t)delta)); 381 /* 382 * Adjust the delta to account for the effects of 383 * the LDA, including sign-extension. 384 */ 385 delta -= (int16_t)delta; 386 if (delta != 0) { 387 /* 388 * Build an LDAH instruction to adjust the 389 * high 16 bits. 390 */ 391 insn[insncnt++] = 0x09 << 26 | 27 << 21 | 392 27 << 16 | ((delta >> 16) & 0xffff); 393 rdbg((" LDAH $27,%d($27)", 394 (int16_t)(delta >> 16))); 395 } 396 } else { 397 int64_t dhigh; 398 399 /* We must load the GOT entry. */ 400 delta = (Elf_Addr)where - stubaddr; 401 402 /* 403 * If the GOT entry is too far away from the PLT 404 * entry, then we can't patch up the PLT entry. 405 * This PLT entry will have to be bound for each 406 * GOT entry except for the first one. This program 407 * will still run, albeit very slowly. It is very 408 * unlikely that this case will ever happen in 409 * practice. 410 */ 411 if ((int32_t)delta != delta) { 412 rdbg((" PLT stub too far from GOT to relocate")); 413 goto out; 414 } 415 dhigh = delta - (int16_t)delta; 416 if (dhigh != 0) { 417 /* 418 * Build an LDAH instruction to adjust the 419 * high 16 bits. 420 */ 421 insn[insncnt++] = 0x09 << 26 | 27 << 21 | 422 27 << 16 | ((dhigh >> 16) & 0xffff); 423 rdbg((" LDAH $27,%d($27)", 424 (int16_t)(dhigh >> 16))); 425 } 426 /* Build an LDQ to load the GOT entry. */ 427 insn[insncnt++] = 0x29 << 26 | 27 << 21 | 428 27 << 16 | (delta & 0xffff); 429 rdbg((" LDQ $27,%d($27)", 430 (int16_t)delta)); 431 } 432 433 /* 434 * Now, build a JMP or BR insn to jump to the target. If 435 * the displacement fits in a sign-extended 21-bit field, 436 * we can use the more efficient BR insn. Otherwise, we 437 * have to jump indirect through PV. 438 */ 439 pc = stubaddr + (4 * (insncnt + 1)); 440 idisp = (int64_t)(new_value - pc) >> 2; 441 if (-0x100000 <= idisp && idisp < 0x100000) { 442 insn[insncnt++] = 0x30 << 26 | 31 << 21 | 443 (idisp & 0x1fffff); 444 rdbg((" BR $31,%p", (void *)new_value)); 445 } else { 446 insn[insncnt++] = 0x1a << 26 | 31 << 21 | 447 27 << 16 | (idisp & 0x3fff); 448 rdbg((" JMP $31,($27),%d", 449 (int)(idisp & 0x3fff))); 450 } 451 452 /* 453 * Fill in the tail of the PLT entry first, for reentrancy. 454 * Until we have overwritten the first insn (an unconditional 455 * branch), the remaining insns have no effect. 456 */ 457 stubptr = (uint32_t *)stubaddr; 458 while (insncnt > 1) { 459 insncnt--; 460 stubptr[insncnt] = insn[insncnt]; 461 } 462 /* 463 * Commit the tail of the insn sequence to memory 464 * before overwriting the first insn. 465 */ 466 __asm __volatile("wmb" ::: "memory"); 467 stubptr[0] = insn[0]; 468 /* 469 * I-stream will be sync'd when we either return from 470 * the binder (lazy bind case) or when the PLTGOT thunk 471 * is patched up (bind-now case). 472 */ 473 } 474 475 out: 476 return (caddr_t)new_value; 477 } 478