1 /* $NetBSD: alpha_reloc.c,v 1.41 2014/08/25 20:40:52 joerg Exp $ */
2
3 /*
4 * Copyright (c) 2001 Wasabi Systems, Inc.
5 * All rights reserved.
6 *
7 * Written by Jason R. Thorpe for Wasabi Systems, Inc.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. All advertising materials mentioning features or use of this software
18 * must display the following acknowledgement:
19 * This product includes software developed for the NetBSD Project by
20 * Wasabi Systems, Inc.
21 * 4. The name of Wasabi Systems, Inc. may not be used to endorse
22 * or promote products derived from this software without specific prior
23 * written permission.
24 *
25 * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
27 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL WASABI SYSTEMS, INC
29 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35 * POSSIBILITY OF SUCH DAMAGE.
36 */
37
38 /*
39 * Copyright 1996, 1997, 1998, 1999 John D. Polstra.
40 * All rights reserved.
41 *
42 * Redistribution and use in source and binary forms, with or without
43 * modification, are permitted provided that the following conditions
44 * are met:
45 * 1. Redistributions of source code must retain the above copyright
46 * notice, this list of conditions and the following disclaimer.
47 * 2. Redistributions in binary form must reproduce the above copyright
48 * notice, this list of conditions and the following disclaimer in the
49 * documentation and/or other materials provided with the distribution.
50 *
51 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
52 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
53 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
54 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
55 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
56 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
57 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
58 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
59 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
60 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
61 */
62
63 #include <sys/cdefs.h>
64 #ifndef lint
65 __RCSID("$NetBSD: alpha_reloc.c,v 1.41 2014/08/25 20:40:52 joerg Exp $");
66 #endif /* not lint */
67
68 #include <sys/types.h>
69 #include <sys/tls.h>
70 #include <string.h>
71
72 #include "rtld.h"
73 #include "debug.h"
74
75 #ifdef RTLD_DEBUG_ALPHA
76 #define adbg(x) xprintf x
77 #else
78 #define adbg(x) /* nothing */
79 #endif
80
81 void _rtld_bind_start(void);
82 void _rtld_bind_start_old(void);
83 void _rtld_relocate_nonplt_self(Elf_Dyn *, Elf_Addr);
84 caddr_t _rtld_bind(const Obj_Entry *, Elf_Addr);
85 static inline int _rtld_relocate_plt_object(const Obj_Entry *,
86 const Elf_Rela *, Elf_Addr *);
87
88 void
_rtld_setup_pltgot(const Obj_Entry * obj)89 _rtld_setup_pltgot(const Obj_Entry *obj)
90 {
91 uint32_t word0;
92
93 /*
94 * The PLTGOT on the Alpha looks like this:
95 *
96 * PLT HEADER
97 * .
98 * . 32 bytes
99 * .
100 * PLT ENTRY #0
101 * .
102 * . 12 bytes
103 * .
104 * PLT ENTRY #1
105 * .
106 * . 12 bytes
107 * .
108 * etc.
109 *
110 * The old-format entries look like (displacements filled in
111 * by the linker):
112 *
113 * ldah $28, 0($31) # 0x279f0000
114 * lda $28, 0($28) # 0x239c0000
115 * br $31, plt0 # 0xc3e00000
116 *
117 * The new-format entries look like:
118 *
119 * br $28, plt0 # 0xc3800000
120 * # 0x00000000
121 * # 0x00000000
122 *
123 * What we do is fetch the first PLT entry and check to
124 * see the first word of it matches the first word of the
125 * old format. If so, we use a binding routine that can
126 * handle the old format, otherwise we use a binding routine
127 * that handles the new format.
128 *
129 * Note that this is done on a per-object basis, we can mix
130 * and match shared objects build with both the old and new
131 * linker.
132 */
133 word0 = *(uint32_t *)(((char *) obj->pltgot) + 32);
134 if ((word0 & 0xffff0000) == 0x279f0000) {
135 /* Old PLT entry format. */
136 adbg(("ALPHA: object %p has old PLT format\n", obj));
137 obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start_old;
138 obj->pltgot[3] = (Elf_Addr) obj;
139 } else {
140 /* New PLT entry format. */
141 adbg(("ALPHA: object %p has new PLT format\n", obj));
142 obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start;
143 obj->pltgot[3] = (Elf_Addr) obj;
144 }
145
146 __asm volatile("imb");
147 }
148
149 /*
150 * It is possible for the compiler to emit relocations for unaligned data.
151 * We handle this situation with these inlines.
152 */
153 #define RELOC_ALIGNED_P(x) \
154 (((uintptr_t)(x) & (sizeof(void *) - 1)) == 0)
155
156 static inline Elf_Addr
load_ptr(void * where)157 load_ptr(void *where)
158 {
159 Elf_Addr res;
160
161 memcpy(&res, where, sizeof(res));
162
163 return (res);
164 }
165
166 static inline void
store_ptr(void * where,Elf_Addr val)167 store_ptr(void *where, Elf_Addr val)
168 {
169
170 memcpy(where, &val, sizeof(val));
171 }
172
173 void
_rtld_relocate_nonplt_self(Elf_Dyn * dynp,Elf_Addr relocbase)174 _rtld_relocate_nonplt_self(Elf_Dyn *dynp, Elf_Addr relocbase)
175 {
176 const Elf_Rela *rela = 0, *relalim;
177 Elf_Addr relasz = 0;
178 Elf_Addr *where;
179
180 for (; dynp->d_tag != DT_NULL; dynp++) {
181 switch (dynp->d_tag) {
182 case DT_RELA:
183 rela = (const Elf_Rela *)(relocbase + dynp->d_un.d_ptr);
184 break;
185 case DT_RELASZ:
186 relasz = dynp->d_un.d_val;
187 break;
188 }
189 }
190 relalim = (const Elf_Rela *)((const uint8_t *)rela + relasz);
191 for (; rela < relalim; rela++) {
192 where = (Elf_Addr *)(relocbase + rela->r_offset);
193 /* XXX For some reason I see a few GLOB_DAT relocs here. */
194 *where += (Elf_Addr)relocbase;
195 }
196 }
197
198 int
_rtld_relocate_nonplt_objects(Obj_Entry * obj)199 _rtld_relocate_nonplt_objects(Obj_Entry *obj)
200 {
201 const Elf_Rela *rela;
202 Elf_Addr target = -1;
203
204 for (rela = obj->rela; rela < obj->relalim; rela++) {
205 Elf_Addr *where;
206 const Elf_Sym *def;
207 const Obj_Entry *defobj;
208 Elf_Addr tmp;
209 unsigned long symnum;
210
211 where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
212 symnum = ELF_R_SYM(rela->r_info);
213
214 switch (ELF_R_TYPE(rela->r_info)) {
215 case R_TYPE(NONE):
216 break;
217
218 case R_TYPE(REFQUAD):
219 case R_TYPE(GLOB_DAT):
220 def = _rtld_find_symdef(symnum, obj, &defobj, false);
221 if (def == NULL)
222 return -1;
223 target = (Elf_Addr)(defobj->relocbase +
224 def->st_value);
225
226 tmp = target + rela->r_addend;
227 if (__predict_true(RELOC_ALIGNED_P(where))) {
228 if (*where != tmp)
229 *where = tmp;
230 } else {
231 if (load_ptr(where) != tmp)
232 store_ptr(where, tmp);
233 }
234 rdbg(("REFQUAD/GLOB_DAT %s in %s --> %p in %s",
235 obj->strtab + obj->symtab[symnum].st_name,
236 obj->path, (void *)tmp, defobj->path));
237 break;
238
239 case R_TYPE(RELATIVE):
240 if (__predict_true(RELOC_ALIGNED_P(where)))
241 *where += (Elf_Addr)obj->relocbase;
242 else
243 store_ptr(where,
244 load_ptr(where) + (Elf_Addr)obj->relocbase);
245 rdbg(("RELATIVE in %s --> %p", obj->path,
246 (void *)*where));
247 break;
248
249 case R_TYPE(COPY):
250 /*
251 * These are deferred until all other relocations have
252 * been done. All we do here is make sure that the
253 * COPY relocation is not in a shared library. They
254 * are allowed only in executable files.
255 */
256 if (obj->isdynamic) {
257 _rtld_error(
258 "%s: Unexpected R_COPY relocation in shared library",
259 obj->path);
260 return -1;
261 }
262 rdbg(("COPY (avoid in main)"));
263 break;
264
265 case R_TYPE(TPREL64):
266 def = _rtld_find_symdef(symnum, obj, &defobj, false);
267 if (def == NULL)
268 return -1;
269
270 if (!defobj->tls_done &&
271 _rtld_tls_offset_allocate(obj))
272 return -1;
273
274 tmp = (Elf64_Addr)(def->st_value +
275 sizeof(struct tls_tcb) + defobj->tlsoffset +
276 rela->r_addend);
277
278 if (__predict_true(RELOC_ALIGNED_P(where)))
279 *where = tmp;
280 else
281 store_ptr(where, tmp);
282
283 rdbg(("TPREL64 %s in %s --> %p",
284 obj->strtab + obj->symtab[symnum].st_name,
285 obj->path, (void *)*where));
286
287 break;
288
289 case R_TYPE(DTPMOD64):
290 def = _rtld_find_symdef(symnum, obj, &defobj, false);
291 if (def == NULL)
292 return -1;
293
294 tmp = (Elf64_Addr)defobj->tlsindex;
295 if (__predict_true(RELOC_ALIGNED_P(where)))
296 *where = tmp;
297 else
298 store_ptr(where, tmp);
299
300 rdbg(("DTPMOD64 %s in %s --> %p",
301 obj->strtab + obj->symtab[symnum].st_name,
302 obj->path, (void *)*where));
303
304 break;
305
306 case R_TYPE(DTPREL64):
307 def = _rtld_find_symdef(symnum, obj, &defobj, false);
308 if (def == NULL)
309 return -1;
310
311 tmp = (Elf64_Addr)(def->st_value + rela->r_addend);
312 if (__predict_true(RELOC_ALIGNED_P(where)))
313 *where = tmp;
314 else
315 store_ptr(where, tmp);
316
317 rdbg(("DTPREL64 %s in %s --> %p",
318 obj->strtab + obj->symtab[symnum].st_name,
319 obj->path, (void *)*where));
320
321 break;
322
323 default:
324 rdbg(("sym = %lu, type = %lu, offset = %p, "
325 "addend = %p, contents = %p, symbol = %s",
326 symnum, (u_long)ELF_R_TYPE(rela->r_info),
327 (void *)rela->r_offset, (void *)rela->r_addend,
328 (void *)load_ptr(where),
329 obj->strtab + obj->symtab[symnum].st_name));
330 _rtld_error("%s: Unsupported relocation type %ld "
331 "in non-PLT relocations",
332 obj->path, (u_long) ELF_R_TYPE(rela->r_info));
333 return -1;
334 }
335 }
336 return 0;
337 }
338
339 int
_rtld_relocate_plt_lazy(const Obj_Entry * obj)340 _rtld_relocate_plt_lazy(const Obj_Entry *obj)
341 {
342 const Elf_Rela *rela;
343
344 if (!obj->relocbase)
345 return 0;
346
347 for (rela = obj->pltrela; rela < obj->pltrelalim; rela++) {
348 Elf_Addr *where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
349
350 assert(ELF_R_TYPE(rela->r_info) == R_TYPE(JMP_SLOT));
351
352 /* Just relocate the GOT slots pointing into the PLT */
353 *where += (Elf_Addr)obj->relocbase;
354 rdbg(("fixup !main in %s --> %p", obj->path, (void *)*where));
355 }
356
357 return 0;
358 }
359
360 static inline int
_rtld_relocate_plt_object(const Obj_Entry * obj,const Elf_Rela * rela,Elf_Addr * tp)361 _rtld_relocate_plt_object(const Obj_Entry *obj, const Elf_Rela *rela,
362 Elf_Addr *tp)
363 {
364 Elf_Addr *where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
365 Elf_Addr new_value;
366 const Elf_Sym *def;
367 const Obj_Entry *defobj;
368 Elf_Addr stubaddr;
369 unsigned long info = rela->r_info;
370
371 assert(ELF_R_TYPE(info) == R_TYPE(JMP_SLOT));
372
373 def = _rtld_find_plt_symdef(ELF_R_SYM(info), obj, &defobj, tp != NULL);
374 if (__predict_false(def == NULL))
375 return -1;
376 if (__predict_false(def == &_rtld_sym_zero))
377 return 0;
378
379 if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) {
380 if (tp == NULL)
381 return 0;
382 new_value = _rtld_resolve_ifunc(defobj, def);
383 } else {
384 new_value = (Elf_Addr)(defobj->relocbase + def->st_value);
385 }
386 rdbg(("bind now/fixup in %s --> old=%p new=%p",
387 defobj->strtab + def->st_name, (void *)*where, (void *)new_value));
388
389 if ((stubaddr = *where) != new_value) {
390 int64_t delta, idisp;
391 uint32_t insn[3], *stubptr;
392 int insncnt;
393 Elf_Addr pc;
394
395 /* Point this GOT entry at the target. */
396 *where = new_value;
397
398 /*
399 * Alpha shared objects may have multiple GOTs, each
400 * of which may point to this entry in the PLT. But,
401 * we only have a reference to the first GOT entry which
402 * points to this PLT entry. In order to avoid having to
403 * re-bind this call every time a non-first GOT entry is
404 * used, we will attempt to patch up the PLT entry to
405 * reference the target, rather than the binder.
406 *
407 * When the PLT stub gets control, PV contains the address
408 * of the PLT entry. Each PLT entry has room for 3 insns.
409 * If the displacement of the target from PV fits in a signed
410 * 32-bit integer, we can simply add it to PV. Otherwise,
411 * we must load the GOT entry itself into PV.
412 *
413 * Note if the shared object uses the old PLT format, then
414 * we cannot patch up the PLT safely, and so we skip it
415 * in that case[*].
416 *
417 * [*] Actually, if we're not doing lazy-binding, then
418 * we *can* (and do) patch up this PLT entry; the PLTGOT
419 * thunk won't yet point to any binder entry point, and
420 * so this test will fail as it would for the new PLT
421 * entry format.
422 */
423 if (obj->pltgot[2] == (Elf_Addr) &_rtld_bind_start_old) {
424 rdbg((" old PLT format"));
425 goto out;
426 }
427
428 delta = new_value - stubaddr;
429 rdbg((" stubaddr=%p, where-stubaddr=%ld, delta=%ld",
430 (void *)stubaddr, (long)where - (long)stubaddr,
431 (long)delta));
432 insncnt = 0;
433 if ((int32_t)delta == delta) {
434 /*
435 * We can adjust PV with an LDA, LDAH sequence.
436 *
437 * First, build an LDA insn to adjust the low 16
438 * bits.
439 */
440 insn[insncnt++] = 0x08 << 26 | 27 << 21 | 27 << 16 |
441 (delta & 0xffff);
442 rdbg((" LDA $27,%d($27)", (int16_t)delta));
443 /*
444 * Adjust the delta to account for the effects of
445 * the LDA, including sign-extension.
446 */
447 delta -= (int16_t)delta;
448 if (delta != 0) {
449 /*
450 * Build an LDAH instruction to adjust the
451 * high 16 bits.
452 */
453 insn[insncnt++] = 0x09 << 26 | 27 << 21 |
454 27 << 16 | ((delta >> 16) & 0xffff);
455 rdbg((" LDAH $27,%d($27)",
456 (int16_t)(delta >> 16)));
457 }
458 } else {
459 int64_t dhigh;
460
461 /* We must load the GOT entry. */
462 delta = (Elf_Addr)where - stubaddr;
463
464 /*
465 * If the GOT entry is too far away from the PLT
466 * entry, then we can't patch up the PLT entry.
467 * This PLT entry will have to be bound for each
468 * GOT entry except for the first one. This program
469 * will still run, albeit very slowly. It is very
470 * unlikely that this case will ever happen in
471 * practice.
472 */
473 if ((int32_t)delta != delta) {
474 rdbg((" PLT stub too far from GOT to relocate"));
475 goto out;
476 }
477 dhigh = delta - (int16_t)delta;
478 if (dhigh != 0) {
479 /*
480 * Build an LDAH instruction to adjust the
481 * high 16 bits.
482 */
483 insn[insncnt++] = 0x09 << 26 | 27 << 21 |
484 27 << 16 | ((dhigh >> 16) & 0xffff);
485 rdbg((" LDAH $27,%d($27)",
486 (int16_t)(dhigh >> 16)));
487 }
488 /* Build an LDQ to load the GOT entry. */
489 insn[insncnt++] = 0x29 << 26 | 27 << 21 |
490 27 << 16 | (delta & 0xffff);
491 rdbg((" LDQ $27,%d($27)",
492 (int16_t)delta));
493 }
494
495 /*
496 * Now, build a JMP or BR insn to jump to the target. If
497 * the displacement fits in a sign-extended 21-bit field,
498 * we can use the more efficient BR insn. Otherwise, we
499 * have to jump indirect through PV.
500 */
501 pc = stubaddr + (4 * (insncnt + 1));
502 idisp = (int64_t)(new_value - pc) >> 2;
503 if (-0x100000 <= idisp && idisp < 0x100000) {
504 insn[insncnt++] = 0x30 << 26 | 31 << 21 |
505 (idisp & 0x1fffff);
506 rdbg((" BR $31,%p", (void *)new_value));
507 } else {
508 insn[insncnt++] = 0x1a << 26 | 31 << 21 |
509 27 << 16 | (idisp & 0x3fff);
510 rdbg((" JMP $31,($27),%d",
511 (int)(idisp & 0x3fff)));
512 }
513
514 /*
515 * Fill in the tail of the PLT entry first, for reentrancy.
516 * Until we have overwritten the first insn (an unconditional
517 * branch), the remaining insns have no effect.
518 */
519 stubptr = (uint32_t *)stubaddr;
520 while (insncnt > 1) {
521 insncnt--;
522 stubptr[insncnt] = insn[insncnt];
523 }
524 /*
525 * Commit the tail of the insn sequence to memory
526 * before overwriting the first insn.
527 */
528 __asm volatile("wmb" ::: "memory");
529 stubptr[0] = insn[0];
530 /*
531 * I-stream will be sync'd when we either return from
532 * the binder (lazy bind case) or when the PLTGOT thunk
533 * is patched up (bind-now case).
534 */
535 }
536 out:
537 if (tp)
538 *tp = new_value;
539
540 return 0;
541 }
542
543 caddr_t
_rtld_bind(const Obj_Entry * obj,Elf_Addr reloff)544 _rtld_bind(const Obj_Entry *obj, Elf_Addr reloff)
545 {
546 const Elf_Rela *rela =
547 (const Elf_Rela *)((const uint8_t *)obj->pltrela + reloff);
548 Elf_Addr result = 0; /* XXX gcc */
549 int err;
550
551 _rtld_shared_enter();
552 err = _rtld_relocate_plt_object(obj, rela, &result);
553 if (err)
554 _rtld_die();
555 _rtld_shared_exit();
556
557 return (caddr_t)result;
558 }
559
560 int
_rtld_relocate_plt_objects(const Obj_Entry * obj)561 _rtld_relocate_plt_objects(const Obj_Entry *obj)
562 {
563 const Elf_Rela *rela;
564
565 for (rela = obj->pltrela; rela < obj->pltrelalim; rela++)
566 if (_rtld_relocate_plt_object(obj, rela, NULL) < 0)
567 return -1;
568
569 return 0;
570 }
571