1 /* $OpenBSD: rtld_machine.c,v 1.46 2011/04/06 11:36:25 miod Exp $ */ 2 3 /* 4 * Copyright (c) 1999 Dale Rahn 5 * Copyright (c) 2001 Niklas Hallqvist 6 * Copyright (c) 2001 Artur Grabowski 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS 18 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 19 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 /*- 30 * Copyright (c) 2000 Eduardo Horvath. 31 * Copyright (c) 1999 The NetBSD Foundation, Inc. 32 * All rights reserved. 33 * 34 * This code is derived from software contributed to The NetBSD Foundation 35 * by Paul Kranenburg. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 3. All advertising materials mentioning features or use of this software 46 * must display the following acknowledgement: 47 * This product includes software developed by the NetBSD 48 * Foundation, Inc. and its contributors. 49 * 4. Neither the name of The NetBSD Foundation nor the names of its 50 * contributors may be used to endorse or promote products derived 51 * from this software without specific prior written permission. 52 * 53 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 54 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 56 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 57 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 58 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 59 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 60 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 61 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 62 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 63 * POSSIBILITY OF SUCH DAMAGE. 64 */ 65 66 #define _DYN_LOADER 67 68 #include <sys/types.h> 69 #include <sys/cdefs.h> 70 #include <sys/mman.h> 71 72 #include <nlist.h> 73 #include <link.h> 74 #include <signal.h> 75 76 #include "syscall.h" 77 #include "archdep.h" 78 #include "resolve.h" 79 80 /* 81 * The following table holds for each relocation type: 82 * - the width in bits of the memory location the relocation 83 * applies to (not currently used) 84 * - the number of bits the relocation value must be shifted to the 85 * right (i.e. discard least significant bits) to fit into 86 * the appropriate field in the instruction word. 87 * - flags indicating whether 88 * * the relocation involves a symbol 89 * * the relocation is relative to the current position 90 * * the relocation is for a GOT entry 91 * * the relocation is relative to the load address 92 * 93 */ 94 #define _RF_S 0x80000000 /* Resolve symbol */ 95 #define _RF_A 0x40000000 /* Use addend */ 96 #define _RF_P 0x20000000 /* Location relative */ 97 #define _RF_G 0x10000000 /* GOT offset */ 98 #define _RF_B 0x08000000 /* Load address relative */ 99 #define _RF_U 0x04000000 /* Unaligned */ 100 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 101 #define _RF_RS(s) ((s) & 0xff) /* right shift */ 102 static int reloc_target_flags[] = { 103 0, /* NONE */ 104 _RF_S|_RF_A| _RF_SZ(8) | _RF_RS(0), /* RELOC_8 */ 105 _RF_S|_RF_A| _RF_SZ(16) | _RF_RS(0), /* RELOC_16 */ 106 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* RELOC_32 */ 107 _RF_S|_RF_A|_RF_P| _RF_SZ(8) | _RF_RS(0), /* DISP_8 */ 108 _RF_S|_RF_A|_RF_P| _RF_SZ(16) | _RF_RS(0), /* DISP_16 */ 109 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* DISP_32 */ 110 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_30 */ 111 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_22 */ 112 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* HI22 */ 113 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 22 */ 114 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 13 */ 115 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* LO10 */ 116 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT10 */ 117 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT13 */ 118 _RF_G| _RF_SZ(32) | _RF_RS(10), /* GOT22 */ 119 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PC10 */ 120 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PC22 */ 121 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WPLT30 */ 122 _RF_S| _RF_SZ(32) | _RF_RS(0), /* COPY */ 123 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* GLOB_DAT */ 124 _RF_S| _RF_SZ(32) | _RF_RS(0), /* JMP_SLOT */ 125 _RF_A| _RF_B| _RF_SZ(64) | _RF_RS(0), /* RELATIVE */ 126 _RF_S|_RF_A| _RF_U| _RF_SZ(32) | _RF_RS(0), /* UA_32 */ 127 128 _RF_A| _RF_SZ(32) | _RF_RS(0), /* PLT32 */ 129 _RF_A| _RF_SZ(32) | _RF_RS(10), /* HIPLT22 */ 130 _RF_A| _RF_SZ(32) | _RF_RS(0), /* LOPLT10 */ 131 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PCPLT32 */ 132 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PCPLT22 */ 133 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PCPLT10 */ 134 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 10 */ 135 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 11 */ 136 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* 64 */ 137 _RF_S|_RF_A|/*extra*/ _RF_SZ(32) | _RF_RS(0), /* OLO10 */ 138 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(42), /* HH22 */ 139 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(32), /* HM10 */ 140 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* LM22 */ 141 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(42), /* PC_HH22 */ 142 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(32), /* PC_HM10 */ 143 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PC_LM22 */ 144 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP16 */ 145 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP19 */ 146 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* GLOB_JMP */ 147 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 7 */ 148 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 5 */ 149 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 6 */ 150 _RF_S|_RF_A|_RF_P| _RF_SZ(64) | _RF_RS(0), /* DISP64 */ 151 _RF_A| _RF_SZ(64) | _RF_RS(0), /* PLT64 */ 152 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* HIX22 */ 153 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* LOX10 */ 154 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(22), /* H44 */ 155 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(12), /* M44 */ 156 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* L44 */ 157 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* REGISTER */ 158 _RF_S|_RF_A| _RF_U| _RF_SZ(64) | _RF_RS(0), /* UA64 */ 159 _RF_S|_RF_A| _RF_U| _RF_SZ(16) | _RF_RS(0), /* UA16 */ 160 }; 161 162 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 163 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 164 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 165 #define RELOC_UNALIGNED(t) ((reloc_target_flags[t] & _RF_U) != 0) 166 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 167 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 168 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 169 170 static long reloc_target_bitmask[] = { 171 #define _BM(x) (~(-(1ULL << (x)))) 172 0, /* NONE */ 173 _BM(8), _BM(16), _BM(32), /* RELOC_8, _16, _32 */ 174 _BM(8), _BM(16), _BM(32), /* DISP8, DISP16, DISP32 */ 175 _BM(30), _BM(22), /* WDISP30, WDISP22 */ 176 _BM(22), _BM(22), /* HI22, _22 */ 177 _BM(13), _BM(10), /* RELOC_13, _LO10 */ 178 _BM(10), _BM(13), _BM(22), /* GOT10, GOT13, GOT22 */ 179 _BM(10), _BM(22), /* _PC10, _PC22 */ 180 _BM(30), 0, /* _WPLT30, _COPY */ 181 -1, _BM(32), -1, /* _GLOB_DAT, JMP_SLOT, _RELATIVE */ 182 _BM(32), _BM(32), /* _UA32, PLT32 */ 183 _BM(22), _BM(10), /* _HIPLT22, LOPLT10 */ 184 _BM(32), _BM(22), _BM(10), /* _PCPLT32, _PCPLT22, _PCPLT10 */ 185 _BM(10), _BM(11), -1, /* _10, _11, _64 */ 186 _BM(10), _BM(22), /* _OLO10, _HH22 */ 187 _BM(10), _BM(22), /* _HM10, _LM22 */ 188 _BM(22), _BM(10), _BM(22), /* _PC_HH22, _PC_HM10, _PC_LM22 */ 189 _BM(16), _BM(19), /* _WDISP16, _WDISP19 */ 190 -1, /* GLOB_JMP */ 191 _BM(7), _BM(5), _BM(6) /* _7, _5, _6 */ 192 -1, -1, /* DISP64, PLT64 */ 193 _BM(22), _BM(13), /* HIX22, LOX10 */ 194 _BM(22), _BM(10), _BM(13), /* H44, M44, L44 */ 195 -1, -1, _BM(16), /* REGISTER, UA64, UA16 */ 196 #undef _BM 197 }; 198 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 199 200 void _dl_reloc_plt(elf_object_t *object, Elf_Word *where, Elf_Addr value, 201 Elf_RelA *rela); 202 void _dl_install_plt(Elf_Word *pltgot, Elf_Addr proc); 203 204 int 205 _dl_md_reloc(elf_object_t *object, int rel, int relasz) 206 { 207 long i; 208 long numrela; 209 int fails = 0; 210 Elf_Addr loff; 211 Elf_RelA *relas; 212 struct load_list *llist; 213 214 loff = object->obj_base; 215 numrela = object->Dyn.info[relasz] / sizeof(Elf64_Rela); 216 relas = (Elf64_Rela *)(object->Dyn.info[rel]); 217 218 if (relas == NULL) 219 return(0); 220 221 /* 222 * unprotect some segments if we need it. 223 */ 224 if ((object->dyn.textrel == 1) && (rel == DT_REL || rel == DT_RELA)) { 225 for (llist = object->load_list; llist != NULL; llist = llist->next) { 226 if (!(llist->prot & PROT_WRITE)) 227 _dl_mprotect(llist->start, llist->size, 228 llist->prot|PROT_WRITE); 229 } 230 } 231 232 for (i = 0; i < numrela; i++, relas++) { 233 Elf_Addr *where, value, ooff, mask; 234 Elf_Word type; 235 const Elf_Sym *sym, *this; 236 const char *symn; 237 238 type = ELF_R_TYPE(relas->r_info); 239 240 if (type == R_TYPE(NONE)) 241 continue; 242 243 if (type == R_TYPE(JMP_SLOT) && rel != DT_JMPREL) 244 continue; 245 246 where = (Elf_Addr *)(relas->r_offset + loff); 247 248 if (RELOC_USE_ADDEND(type)) 249 value = relas->r_addend; 250 else 251 value = 0; 252 253 sym = NULL; 254 symn = NULL; 255 if (RELOC_RESOLVE_SYMBOL(type)) { 256 sym = object->dyn.symtab; 257 sym += ELF_R_SYM(relas->r_info); 258 symn = object->dyn.strtab + sym->st_name; 259 260 if (sym->st_shndx != SHN_UNDEF && 261 ELF_ST_BIND(sym->st_info) == STB_LOCAL) { 262 value += loff; 263 } else { 264 this = NULL; 265 ooff = _dl_find_symbol_bysym(object, 266 ELF_R_SYM(relas->r_info), &this, 267 SYM_SEARCH_ALL|SYM_WARNNOTFOUND| 268 ((type == R_TYPE(JMP_SLOT)) ? 269 SYM_PLT : SYM_NOTPLT), 270 sym, NULL); 271 if (this == NULL) { 272 resolve_failed: 273 if (ELF_ST_BIND(sym->st_info) != 274 STB_WEAK) 275 fails++; 276 continue; 277 } 278 value += (Elf_Addr)(ooff + this->st_value); 279 } 280 } 281 282 if (type == R_TYPE(JMP_SLOT)) { 283 _dl_reloc_plt(object, (Elf_Word *)where, value, relas); 284 continue; 285 } 286 287 if (type == R_TYPE(COPY)) { 288 void *dstaddr = where; 289 const void *srcaddr; 290 const Elf_Sym *dstsym = sym, *srcsym = NULL; 291 size_t size = dstsym->st_size; 292 Elf_Addr soff; 293 294 soff = _dl_find_symbol(symn, &srcsym, 295 SYM_SEARCH_OTHER|SYM_WARNNOTFOUND|SYM_NOTPLT, 296 dstsym, object, NULL); 297 if (srcsym == NULL) 298 goto resolve_failed; 299 300 srcaddr = (void *)(soff + srcsym->st_value); 301 _dl_bcopy(srcaddr, dstaddr, size); 302 continue; 303 } 304 305 if (RELOC_PC_RELATIVE(type)) 306 value -= (Elf_Addr)where; 307 if (RELOC_BASE_RELATIVE(type)) 308 value += loff; 309 310 mask = RELOC_VALUE_BITMASK(type); 311 value >>= RELOC_VALUE_RIGHTSHIFT(type); 312 value &= mask; 313 314 if (RELOC_UNALIGNED(type)) { 315 /* Handle unaligned relocations. */ 316 Elf_Addr tmp = 0; 317 char *ptr = (char *)where; 318 int i, size = RELOC_TARGET_SIZE(type)/8; 319 320 /* Read it in one byte at a time. */ 321 for (i=0; i<size; i++) 322 tmp = (tmp << 8) | ptr[i]; 323 324 tmp &= ~mask; 325 tmp |= value; 326 327 /* Write it back out. */ 328 for (i=0; i<size; i++) 329 ptr[i] = ((tmp >> (8*i)) & 0xff); 330 } else if (RELOC_TARGET_SIZE(type) > 32) { 331 *where &= ~mask; 332 *where |= value; 333 } else { 334 Elf32_Addr *where32 = (Elf32_Addr *)where; 335 336 *where32 &= ~mask; 337 *where32 |= value; 338 } 339 } 340 341 /* reprotect the unprotected segments */ 342 if ((object->dyn.textrel == 1) && (rel == DT_REL || rel == DT_RELA)) { 343 for (llist = object->load_list; llist != NULL; llist = llist->next) { 344 if (!(llist->prot & PROT_WRITE)) 345 _dl_mprotect(llist->start, llist->size, 346 llist->prot); 347 } 348 } 349 350 return (fails); 351 } 352 353 /* 354 * Instruction templates: 355 */ 356 #define BAA 0x10400000 /* ba,a %xcc, 0 */ 357 #define SETHI 0x03000000 /* sethi %hi(0), %g1 */ 358 #define JMP 0x81c06000 /* jmpl %g1+%lo(0), %g0 */ 359 #define NOP 0x01000000 /* sethi %hi(0), %g0 */ 360 #define OR 0x82106000 /* or %g1, 0, %g1 */ 361 #define ORG5 0x8a116000 /* or %g5, 0, %g5 */ 362 #define XOR 0x82186000 /* xor %g1, 0, %g1 */ 363 #define MOV71 0x8283a000 /* or %o7, 0, %g1 */ 364 #define MOV17 0x9c806000 /* or %g1, 0, %o7 */ 365 #define CALL 0x40000000 /* call 0 */ 366 #define SLLX 0x83287000 /* sllx %g1, 0, %g1 */ 367 #define SLLXG5 0x8b297000 /* sllx %g5, 0, %g5 */ 368 #define SRAX 0x83387000 /* srax %g1, 0, %g1 */ 369 #define SETHIG5 0x0b000000 /* sethi %hi(0), %g5 */ 370 #define ORG15 0x82804005 /* or %g1, %g5, %g1 */ 371 372 373 /* %hi(v) with variable shift */ 374 #define HIVAL(v, s) (((v) >> (s)) & 0x003fffff) 375 #define LOVAL(v) ((v) & 0x000003ff) 376 377 void 378 _dl_reloc_plt(elf_object_t *object, Elf_Word *where, Elf_Addr value, 379 Elf_RelA *rela) 380 { 381 Elf_Addr offset; 382 383 /* 384 * At the PLT entry pointed at by `where', we now construct 385 * a direct transfer to the now fully resolved function 386 * address. 387 * 388 * A PLT entry is supposed to start by looking like this: 389 * 390 * sethi %hi(. - .PLT0), %g1 391 * ba,a %xcc, .PLT1 392 * nop 393 * nop 394 * nop 395 * nop 396 * nop 397 * nop 398 * 399 * When we replace these entries we start from the second 400 * entry and do it in reverse order so the last thing we 401 * do is replace the branch. That allows us to change this 402 * atomically. 403 * 404 * We now need to find out how far we need to jump. We 405 * have a choice of several different relocation techniques 406 * which are increasingly expensive. 407 */ 408 409 offset = ((Elf_Addr)where) - value; 410 if (rela->r_addend) { 411 Elf_Addr *ptr = (Elf_Addr *)where; 412 /* 413 * This entry is >32768. The relocation points to a 414 * PC-relative pointer to the _dl_bind_start_0 stub at 415 * the top of the PLT section. Update it to point to 416 * the target function. 417 */ 418 ptr[0] += value - object->Dyn.info[DT_PLTGOT]; 419 420 } else if (offset <= (1L<<20) && offset >= -(1L<<20)) { 421 /* 422 * We're within 1MB -- we can use a direct branch insn. 423 * 424 * We can generate this pattern: 425 * 426 * sethi %hi(. - .PLT0), %g1 427 * ba,a %xcc, addr 428 * nop 429 * nop 430 * nop 431 * nop 432 * nop 433 * nop 434 * 435 */ 436 where[1] = BAA | ((offset >> 2) &0x3fffff); 437 __asm __volatile("iflush %0+4" : : "r" (where)); 438 } else if (value < (1UL<<32)) { 439 /* 440 * We're within 32-bits of address zero. 441 * 442 * The resulting code in the jump slot is: 443 * 444 * sethi %hi(. - .PLT0), %g1 445 * sethi %hi(addr), %g1 446 * jmp %g1+%lo(addr) 447 * nop 448 * nop 449 * nop 450 * nop 451 * nop 452 * 453 */ 454 where[2] = JMP | LOVAL(value); 455 where[1] = SETHI | HIVAL(value, 10); 456 __asm __volatile("iflush %0+8" : : "r" (where)); 457 __asm __volatile("iflush %0+4" : : "r" (where)); 458 459 } else if (value > -(1UL<<32)) { 460 /* 461 * We're within 32-bits of address -1. 462 * 463 * The resulting code in the jump slot is: 464 * 465 * sethi %hi(. - .PLT0), %g1 466 * sethi %hix(addr), %g1 467 * xor %g1, %lox(addr), %g1 468 * jmp %g1 469 * nop 470 * nop 471 * nop 472 * nop 473 * 474 */ 475 where[3] = JMP; 476 where[2] = XOR | ((~value) & 0x00001fff); 477 where[1] = SETHI | HIVAL(~value, 10); 478 __asm __volatile("iflush %0+12" : : "r" (where)); 479 __asm __volatile("iflush %0+8" : : "r" (where)); 480 __asm __volatile("iflush %0+4" : : "r" (where)); 481 482 } else if (offset <= (1L<<32) && offset >= -((1L<<32) - 4)) { 483 /* 484 * We're within 32-bits -- we can use a direct call insn 485 * 486 * The resulting code in the jump slot is: 487 * 488 * sethi %hi(. - .PLT0), %g1 489 * mov %o7, %g1 490 * call (.+offset) 491 * mov %g1, %o7 492 * nop 493 * nop 494 * nop 495 * nop 496 * 497 */ 498 where[3] = MOV17; 499 where[2] = CALL | ((offset >> 4) & 0x3fffffff); 500 where[1] = MOV71; 501 __asm __volatile("iflush %0+12" : : "r" (where)); 502 __asm __volatile("iflush %0+8" : : "r" (where)); 503 __asm __volatile("iflush %0+4" : : "r" (where)); 504 505 } else if (value < (1L<<42)) { 506 /* 507 * Target 42bits or smaller. 508 * We can generate this pattern: 509 * 510 * The resulting code in the jump slot is: 511 * 512 * sethi %hi(. - .PLT0), %g1 513 * sethi %hi(addr >> 20), %g1 514 * or %g1, %lo(addr >> 10), %g1 515 * sllx %g1, 10, %g1 516 * jmp %g1+%lo(addr) 517 * nop 518 * nop 519 * nop 520 * 521 * this can handle addresses 0 - 0x3fffffffffc 522 */ 523 where[4] = JMP | LOVAL(value); 524 where[3] = SLLX | 10; 525 where[2] = OR | LOVAL(value >> 10); 526 where[1] = SETHI | HIVAL(value, 20); 527 __asm __volatile("iflush %0+16" : : "r" (where)); 528 __asm __volatile("iflush %0+12" : : "r" (where)); 529 __asm __volatile("iflush %0+8" : : "r" (where)); 530 __asm __volatile("iflush %0+4" : : "r" (where)); 531 532 } else if (value > -(1UL<<41)) { 533 /* 534 * Large target >= 0xfffffe0000000000UL 535 * We can generate this pattern: 536 * 537 * The resulting code in the jump slot is: 538 * 539 * sethi %hi(. - .PLT0), %g1 540 * sethi %hi(addr >> 20), %g1 541 * or %g1, %lo(addr >> 10), %g1 542 * sllx %g1, 32, %g1 543 * srax %g1, 22, %g1 544 * jmp %g1+%lo(addr) 545 * nop 546 * nop 547 * nop 548 * 549 */ 550 where[5] = JMP | LOVAL(value); 551 where[4] = SRAX | 22; 552 where[3] = SLLX | 32; 553 where[2] = OR | LOVAL(value >> 10); 554 where[1] = SETHI | HIVAL(value, 20); 555 556 __asm __volatile("iflush %0+16" : : "r" (where)); 557 __asm __volatile("iflush %0+12" : : "r" (where)); 558 __asm __volatile("iflush %0+8" : : "r" (where)); 559 __asm __volatile("iflush %0+4" : : "r" (where)); 560 561 } else { 562 /* 563 * We need to load all 64-bits 564 * 565 * The resulting code in the jump slot is: 566 * 567 * sethi %hi(. - .PLT0), %g1 568 * sethi %hi(addr >> 42), %g5 569 * sethi %hi(addr >> 10), %g1 570 * or %g1, %lo(addr >> 32), %g5 571 * sllx %g5, 32, %g5 572 * or %g1, %g5, %g1 573 * jmp %g1+%lo(addr) 574 * nop 575 * 576 */ 577 where[6] = JMP | LOVAL(value); 578 where[5] = ORG15; 579 where[4] = SLLXG5 | 32; 580 where[3] = ORG5 | LOVAL(value >> 32); 581 where[2] = SETHI | HIVAL(value, 10); 582 where[1] = SETHIG5 | HIVAL(value, 42); 583 __asm __volatile("iflush %0+24" : : "r" (where)); 584 __asm __volatile("iflush %0+20" : : "r" (where)); 585 __asm __volatile("iflush %0+16" : : "r" (where)); 586 __asm __volatile("iflush %0+12" : : "r" (where)); 587 __asm __volatile("iflush %0+8" : : "r" (where)); 588 __asm __volatile("iflush %0+4" : : "r" (where)); 589 } 590 } 591 592 /* 593 * Resolve a symbol at run-time. 594 */ 595 Elf_Addr 596 _dl_bind(elf_object_t *object, int index) 597 { 598 Elf_RelA *rela; 599 Elf_Word *addr; 600 Elf_Addr ooff; 601 const Elf_Sym *sym, *this; 602 const char *symn; 603 sigset_t savedmask; 604 605 rela = (Elf_RelA *)(object->Dyn.info[DT_JMPREL]); 606 if (ELF_R_TYPE(rela->r_info) == R_TYPE(JMP_SLOT)) { 607 /* 608 * XXXX 609 * 610 * The first four PLT entries are reserved. There 611 * is some disagreement whether they should have 612 * associated relocation entries. Both the SPARC 613 * 32-bit and 64-bit ELF specifications say that 614 * they should have relocation entries, but the 615 * 32-bit SPARC binutils do not generate them, 616 * and now the 64-bit SPARC binutils have stopped 617 * generating them too. 618 * 619 * So, to provide binary compatibility, we will 620 * check the first entry, if it is reserved it 621 * should not be of the type JMP_SLOT. If it 622 * is JMP_SLOT, then the 4 reserved entries were 623 * not generated and our index is 4 entries too far. 624 */ 625 index -= 4; 626 } 627 628 rela += index; 629 630 sym = object->dyn.symtab; 631 sym += ELF64_R_SYM(rela->r_info); 632 symn = object->dyn.strtab + sym->st_name; 633 634 addr = (Elf_Word *)(object->obj_base + rela->r_offset); 635 this = NULL; 636 ooff = _dl_find_symbol(symn, &this, 637 SYM_SEARCH_ALL|SYM_WARNNOTFOUND|SYM_PLT, sym, 638 object, NULL); 639 if (this == NULL) { 640 _dl_printf("lazy binding failed!\n"); 641 *((int *)0) = 0; /* XXX */ 642 } 643 644 /* if PLT is protected, allow the write */ 645 if (object->plt_size != 0) { 646 _dl_thread_bind_lock(0, &savedmask); 647 _dl_mprotect((void*)object->plt_start, object->plt_size, 648 PROT_READ|PROT_WRITE|PROT_EXEC); 649 } 650 651 _dl_reloc_plt(object, addr, ooff + this->st_value, rela); 652 653 /* if PLT is (to be protected), change back to RO/X */ 654 if (object->plt_size != 0) { 655 _dl_mprotect((void*)object->plt_start, object->plt_size, 656 PROT_READ|PROT_EXEC); 657 _dl_thread_bind_lock(1, &savedmask); 658 } 659 660 return ooff + this->st_value; 661 } 662 663 /* 664 * Install rtld function call into this PLT slot. 665 */ 666 #define SAVE 0x9de3bf50 667 #define SETHI_l0 0x21000000 668 #define SETHI_l1 0x23000000 669 #define OR_l0_l0 0xa0142000 670 #define SLLX_l0_32_l0 0xa12c3020 671 #define OR_l0_l1_l0 0xa0140011 672 #define JMPL_l0_o1 0x93c42000 673 #define MOV_g1_o0 0x90100001 674 675 void 676 _dl_install_plt(Elf_Word *pltgot, Elf_Addr proc) 677 { 678 pltgot[0] = SAVE; 679 pltgot[1] = SETHI_l0 | HIVAL(proc, 42); 680 pltgot[2] = SETHI_l1 | HIVAL(proc, 10); 681 pltgot[3] = OR_l0_l0 | LOVAL((proc) >> 32); 682 pltgot[4] = SLLX_l0_32_l0; 683 pltgot[5] = OR_l0_l1_l0; 684 pltgot[6] = JMPL_l0_o1 | LOVAL(proc); 685 pltgot[7] = MOV_g1_o0; 686 } 687 688 void _dl_bind_start_0(long, long); 689 void _dl_bind_start_1(long, long); 690 691 /* 692 * Relocate the Global Offset Table (GOT). 693 */ 694 int 695 _dl_md_reloc_got(elf_object_t *object, int lazy) 696 { 697 int fails = 0; 698 Elf_Addr *pltgot = (Elf_Addr *)object->Dyn.info[DT_PLTGOT]; 699 Elf_Word *entry = (Elf_Word *)pltgot; 700 Elf_Addr ooff; 701 Elf_Addr plt_addr; 702 const Elf_Sym *this; 703 704 if (object->Dyn.info[DT_PLTREL] != DT_RELA) 705 return (0); 706 707 object->got_addr = 0; 708 object->got_size = 0; 709 this = NULL; 710 ooff = _dl_find_symbol("__got_start", &this, 711 SYM_SEARCH_OBJ|SYM_NOWARNNOTFOUND|SYM_PLT, NULL, 712 object, NULL); 713 if (this != NULL) 714 object->got_addr = ooff + this->st_value; 715 716 this = NULL; 717 ooff = _dl_find_symbol("__got_end", &this, 718 SYM_SEARCH_OBJ|SYM_NOWARNNOTFOUND|SYM_PLT, NULL, 719 object, NULL); 720 if (this != NULL) 721 object->got_size = ooff + this->st_value - object->got_addr; 722 723 plt_addr = 0; 724 object->plt_size = 0; 725 this = NULL; 726 ooff = _dl_find_symbol("__plt_start", &this, 727 SYM_SEARCH_OBJ|SYM_NOWARNNOTFOUND|SYM_PLT, NULL, 728 object, NULL); 729 if (this != NULL) 730 plt_addr = ooff + this->st_value; 731 732 this = NULL; 733 ooff = _dl_find_symbol("__plt_end", &this, 734 SYM_SEARCH_OBJ|SYM_NOWARNNOTFOUND|SYM_PLT, NULL, 735 object, NULL); 736 if (this != NULL) 737 object->plt_size = ooff + this->st_value - plt_addr; 738 739 if (object->got_addr == 0) 740 object->got_start = 0; 741 else { 742 object->got_start = ELF_TRUNC(object->got_addr, _dl_pagesz); 743 object->got_size += object->got_addr - object->got_start; 744 object->got_size = ELF_ROUND(object->got_size, _dl_pagesz); 745 } 746 if (plt_addr == 0) 747 object->plt_start = 0; 748 else { 749 object->plt_start = ELF_TRUNC(plt_addr, _dl_pagesz); 750 object->plt_size += plt_addr - object->plt_start; 751 object->plt_size = ELF_ROUND(object->plt_size, _dl_pagesz); 752 } 753 754 if (!lazy) { 755 fails = _dl_md_reloc(object, DT_JMPREL, DT_PLTRELSZ); 756 } else { 757 _dl_install_plt(&entry[0], (Elf_Addr)&_dl_bind_start_0); 758 _dl_install_plt(&entry[8], (Elf_Addr)&_dl_bind_start_1); 759 760 pltgot[8] = (Elf_Addr)object; 761 } 762 if (object->got_size != 0) 763 _dl_mprotect((void*)object->got_start, object->got_size, 764 PROT_READ); 765 if (object->plt_size != 0) 766 _dl_mprotect((void*)object->plt_start, object->plt_size, 767 PROT_READ|PROT_EXEC); 768 769 return (fails); 770 } 771