1 /* $NetBSD: mdreloc.c,v 1.38 2005/12/24 20:59:31 perry Exp $ */ 2 3 /*- 4 * Copyright (c) 1999, 2002 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Paul Kranenburg and by Charles M. Hannum. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. All advertising materials mentioning features or use of this software 19 * must display the following acknowledgement: 20 * This product includes software developed by the NetBSD 21 * Foundation, Inc. and its contributors. 22 * 4. Neither the name of The NetBSD Foundation nor the names of its 23 * contributors may be used to endorse or promote products derived 24 * from this software without specific prior written permission. 25 * 26 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 27 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 28 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 29 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 30 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 31 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 32 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 33 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 34 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 35 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 36 * POSSIBILITY OF SUCH DAMAGE. 37 */ 38 39 #include <sys/cdefs.h> 40 #ifndef lint 41 __RCSID("$NetBSD: mdreloc.c,v 1.38 2005/12/24 20:59:31 perry Exp $"); 42 #endif /* not lint */ 43 44 #include <errno.h> 45 #include <stdio.h> 46 #include <stdlib.h> 47 #include <string.h> 48 #include <unistd.h> 49 #include <sys/stat.h> 50 51 #include "rtldenv.h" 52 #include "debug.h" 53 #include "rtld.h" 54 55 /* 56 * The following table holds for each relocation type: 57 * - the width in bits of the memory location the relocation 58 * applies to (not currently used) 59 * - the number of bits the relocation value must be shifted to the 60 * right (i.e. discard least significant bits) to fit into 61 * the appropriate field in the instruction word. 62 * - flags indicating whether 63 * * the relocation involves a symbol 64 * * the relocation is relative to the current position 65 * * the relocation is for a GOT entry 66 * * the relocation is relative to the load address 67 * 68 */ 69 #define _RF_S 0x80000000 /* Resolve symbol */ 70 #define _RF_A 0x40000000 /* Use addend */ 71 #define _RF_P 0x20000000 /* Location relative */ 72 #define _RF_G 0x10000000 /* GOT offset */ 73 #define _RF_B 0x08000000 /* Load address relative */ 74 #define _RF_U 0x04000000 /* Unaligned */ 75 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 76 #define _RF_RS(s) ( (s) & 0xff) /* right shift */ 77 static const int reloc_target_flags[] = { 78 0, /* NONE */ 79 _RF_S|_RF_A| _RF_SZ(8) | _RF_RS(0), /* RELOC_8 */ 80 _RF_S|_RF_A| _RF_SZ(16) | _RF_RS(0), /* RELOC_16 */ 81 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* RELOC_32 */ 82 _RF_S|_RF_A|_RF_P| _RF_SZ(8) | _RF_RS(0), /* DISP_8 */ 83 _RF_S|_RF_A|_RF_P| _RF_SZ(16) | _RF_RS(0), /* DISP_16 */ 84 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* DISP_32 */ 85 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_30 */ 86 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_22 */ 87 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* HI22 */ 88 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 22 */ 89 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 13 */ 90 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* LO10 */ 91 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT10 */ 92 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT13 */ 93 _RF_G| _RF_SZ(32) | _RF_RS(10), /* GOT22 */ 94 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PC10 */ 95 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PC22 */ 96 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WPLT30 */ 97 _RF_SZ(32) | _RF_RS(0), /* COPY */ 98 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* GLOB_DAT */ 99 _RF_SZ(32) | _RF_RS(0), /* JMP_SLOT */ 100 _RF_A| _RF_B| _RF_SZ(32) | _RF_RS(0), /* RELATIVE */ 101 _RF_S|_RF_A| _RF_U| _RF_SZ(32) | _RF_RS(0), /* UA_32 */ 102 }; 103 104 #ifdef RTLD_DEBUG_RELOC 105 static const char *reloc_names[] = { 106 "NONE", "RELOC_8", "RELOC_16", "RELOC_32", "DISP_8", 107 "DISP_16", "DISP_32", "WDISP_30", "WDISP_22", "HI22", 108 "22", "13", "LO10", "GOT10", "GOT13", 109 "GOT22", "PC10", "PC22", "WPLT30", "COPY", 110 "GLOB_DAT", "JMP_SLOT", "RELATIVE", "UA_32" 111 }; 112 #endif 113 114 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 115 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 116 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 117 #define RELOC_UNALIGNED(t) ((reloc_target_flags[t] & _RF_U) != 0) 118 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 119 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 120 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 121 122 static const int reloc_target_bitmask[] = { 123 #define _BM(x) (~(-(1ULL << (x)))) 124 0, /* NONE */ 125 _BM(8), _BM(16), _BM(32), /* RELOC_8, _16, _32 */ 126 _BM(8), _BM(16), _BM(32), /* DISP8, DISP16, DISP32 */ 127 _BM(30), _BM(22), /* WDISP30, WDISP22 */ 128 _BM(22), _BM(22), /* HI22, _22 */ 129 _BM(13), _BM(10), /* RELOC_13, _LO10 */ 130 _BM(10), _BM(13), _BM(22), /* GOT10, GOT13, GOT22 */ 131 _BM(10), _BM(22), /* _PC10, _PC22 */ 132 _BM(30), 0, /* _WPLT30, _COPY */ 133 -1, -1, -1, /* _GLOB_DAT, JMP_SLOT, _RELATIVE */ 134 _BM(32) /* _UA32 */ 135 #undef _BM 136 }; 137 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 138 139 void _rtld_bind_start(void); 140 void _rtld_relocate_nonplt_self(Elf_Dyn *, Elf_Addr); 141 caddr_t _rtld_bind(const Obj_Entry *, Elf_Word); 142 static inline int _rtld_relocate_plt_object(const Obj_Entry *, 143 const Elf_Rela *, Elf_Addr *); 144 145 void 146 _rtld_setup_pltgot(const Obj_Entry *obj) 147 { 148 /* 149 * PLTGOT is the PLT on the sparc. 150 * The first entry holds the call the dynamic linker. 151 * We construct a `call' sequence that transfers 152 * to `_rtld_bind_start()'. 153 * The second entry holds the object identification. 154 * Note: each PLT entry is three words long. 155 */ 156 #define SAVE 0x9de3bfa0 /* i.e. `save %sp,-96,%sp' */ 157 #define CALL 0x40000000 158 #define NOP 0x01000000 159 obj->pltgot[0] = SAVE; 160 obj->pltgot[1] = CALL | 161 ((Elf_Addr) &_rtld_bind_start - (Elf_Addr) &obj->pltgot[1]) >> 2; 162 obj->pltgot[2] = NOP; 163 obj->pltgot[3] = (Elf_Addr) obj; 164 } 165 166 void 167 _rtld_relocate_nonplt_self(Elf_Dyn *dynp, Elf_Addr relocbase) 168 { 169 const Elf_Rela *rela = 0, *relalim; 170 Elf_Addr relasz = 0; 171 Elf_Addr *where; 172 173 for (; dynp->d_tag != DT_NULL; dynp++) { 174 switch (dynp->d_tag) { 175 case DT_RELA: 176 rela = (const Elf_Rela *)(relocbase + dynp->d_un.d_ptr); 177 break; 178 case DT_RELASZ: 179 relasz = dynp->d_un.d_val; 180 break; 181 } 182 } 183 relalim = (const Elf_Rela *)((caddr_t)rela + relasz); 184 for (; rela < relalim; rela++) { 185 where = (Elf_Addr *)(relocbase + rela->r_offset); 186 *where += (Elf_Addr)(relocbase + rela->r_addend); 187 } 188 } 189 190 int 191 _rtld_relocate_nonplt_objects(const Obj_Entry *obj) 192 { 193 const Elf_Rela *rela; 194 195 for (rela = obj->rela; rela < obj->relalim; rela++) { 196 Elf_Addr *where; 197 Elf_Word type, value, mask; 198 const Elf_Sym *def = NULL; 199 const Obj_Entry *defobj = NULL; 200 unsigned long symnum; 201 202 where = (Elf_Addr *) (obj->relocbase + rela->r_offset); 203 symnum = ELF_R_SYM(rela->r_info); 204 205 type = ELF_R_TYPE(rela->r_info); 206 if (type == R_TYPE(NONE)) 207 continue; 208 209 /* We do JMP_SLOTs in _rtld_bind() below */ 210 if (type == R_TYPE(JMP_SLOT)) 211 continue; 212 213 /* COPY relocs are also handled elsewhere */ 214 if (type == R_TYPE(COPY)) 215 continue; 216 217 /* 218 * We use the fact that relocation types are an `enum' 219 * Note: R_SPARC_6 is currently numerically largest. 220 */ 221 if (type > R_TYPE(6)) 222 return (-1); 223 224 value = rela->r_addend; 225 226 /* 227 * Handle relative relocs here, as an optimization. 228 */ 229 if (type == R_TYPE(RELATIVE)) { 230 *where += (Elf_Addr)(obj->relocbase + value); 231 rdbg(("RELATIVE in %s --> %p", obj->path, 232 (void *)*where)); 233 continue; 234 } 235 236 if (RELOC_RESOLVE_SYMBOL(type)) { 237 238 /* Find the symbol */ 239 def = _rtld_find_symdef(symnum, obj, &defobj, false); 240 if (def == NULL) 241 return (-1); 242 243 /* Add in the symbol's absolute address */ 244 value += (Elf_Word)(defobj->relocbase + def->st_value); 245 } 246 247 if (RELOC_PC_RELATIVE(type)) { 248 value -= (Elf_Word)where; 249 } 250 251 if (RELOC_BASE_RELATIVE(type)) { 252 /* 253 * Note that even though sparcs use `Elf_rela' 254 * exclusively we still need the implicit memory addend 255 * in relocations referring to GOT entries. 256 * Undoubtedly, someone f*cked this up in the distant 257 * past, and now we're stuck with it in the name of 258 * compatibility for all eternity.. 259 * 260 * In any case, the implicit and explicit should be 261 * mutually exclusive. We provide a check for that 262 * here. 263 */ 264 #define DIAGNOSTIC 265 #ifdef DIAGNOSTIC 266 if (value != 0 && *where != 0) { 267 xprintf("BASE_REL(%s): where=%p, *where 0x%x, " 268 "addend=0x%x, base %p\n", 269 obj->path, where, *where, 270 rela->r_addend, obj->relocbase); 271 } 272 #endif 273 value += (Elf_Word)(obj->relocbase + *where); 274 } 275 276 mask = RELOC_VALUE_BITMASK(type); 277 value >>= RELOC_VALUE_RIGHTSHIFT(type); 278 value &= mask; 279 280 if (RELOC_UNALIGNED(type)) { 281 /* Handle unaligned relocations. */ 282 Elf_Addr tmp = 0; 283 char *ptr = (char *)where; 284 int i, size = RELOC_TARGET_SIZE(type)/8; 285 286 /* Read it in one byte at a time. */ 287 for (i=0; i<size; i++) 288 tmp = (tmp << 8) | ptr[i]; 289 290 tmp &= ~mask; 291 tmp |= value; 292 293 /* Write it back out. */ 294 for (i=0; i<size; i++) 295 ptr[i] = ((tmp >> (8*i)) & 0xff); 296 #ifdef RTLD_DEBUG_RELOC 297 value = (Elf_Word)tmp; 298 #endif 299 300 } else { 301 *where &= ~mask; 302 *where |= value; 303 #ifdef RTLD_DEBUG_RELOC 304 value = (Elf_Word)*where; 305 #endif 306 } 307 #ifdef RTLD_DEBUG_RELOC 308 if (RELOC_RESOLVE_SYMBOL(type)) { 309 rdbg(("%s %s in %s --> %p in %s", reloc_names[type], 310 obj->strtab + obj->symtab[symnum].st_name, 311 obj->path, (void *)value, defobj->path)); 312 } else { 313 rdbg(("%s in %s --> %p", reloc_names[type], 314 obj->path, (void *)value)); 315 } 316 #endif 317 } 318 return (0); 319 } 320 321 int 322 _rtld_relocate_plt_lazy(const Obj_Entry *obj) 323 { 324 return (0); 325 } 326 327 caddr_t 328 _rtld_bind(const Obj_Entry *obj, Elf_Word reloff) 329 { 330 const Elf_Rela *rela = (const Elf_Rela *)((caddr_t)obj->pltrela + reloff); 331 Elf_Addr value; 332 int err; 333 334 err = _rtld_relocate_plt_object(obj, rela, &value); 335 if (err) 336 _rtld_die(); 337 338 return (caddr_t)value; 339 } 340 341 int 342 _rtld_relocate_plt_objects(const Obj_Entry *obj) 343 { 344 const Elf_Rela *rela = obj->pltrela; 345 346 for (; rela < obj->pltrelalim; rela++) 347 if (_rtld_relocate_plt_object(obj, rela, NULL) < 0) 348 return -1; 349 350 return 0; 351 } 352 353 static inline int 354 _rtld_relocate_plt_object(const Obj_Entry *obj, const Elf_Rela *rela, Elf_Addr *tp) 355 { 356 const Elf_Sym *def; 357 const Obj_Entry *defobj; 358 Elf_Word *where = (Elf_Addr *)(obj->relocbase + rela->r_offset); 359 Elf_Addr value; 360 361 /* Fully resolve procedure addresses now */ 362 363 assert(ELF_R_TYPE(rela->r_info) == R_TYPE(JMP_SLOT)); 364 365 def = _rtld_find_symdef(ELF_R_SYM(rela->r_info), obj, &defobj, true); 366 if (def == NULL) 367 return -1; 368 369 value = (Elf_Addr)(defobj->relocbase + def->st_value); 370 rdbg(("bind now/fixup in %s --> new=%p", 371 defobj->strtab + def->st_name, (void *)value)); 372 373 /* 374 * At the PLT entry pointed at by `where', we now construct 375 * a direct transfer to the now fully resolved function 376 * address. The resulting code in the jump slot is: 377 * 378 * sethi %hi(roffset), %g1 379 * sethi %hi(addr), %g1 380 * jmp %g1+%lo(addr) 381 * 382 * We write the third instruction first, since that leaves the 383 * previous `b,a' at the second word in place. Hence the whole 384 * PLT slot can be atomically change to the new sequence by 385 * writing the `sethi' instruction at word 2. 386 */ 387 #define SETHI 0x03000000 388 #define JMP 0x81c06000 389 #define NOP 0x01000000 390 where[2] = JMP | (value & 0x000003ff); 391 where[1] = SETHI | ((value >> 10) & 0x003fffff); 392 __asm volatile("iflush %0+8" : : "r" (where)); 393 __asm volatile("iflush %0+4" : : "r" (where)); 394 395 if (tp) 396 *tp = value; 397 398 return 0; 399 } 400