1 /* $NetBSD: mdreloc.c,v 1.50 2010/09/24 12:00:10 skrll Exp $ */ 2 3 /*- 4 * Copyright (c) 2000 Eduardo Horvath. 5 * Copyright (c) 1999, 2002 The NetBSD Foundation, Inc. 6 * All rights reserved. 7 * 8 * This code is derived from software contributed to The NetBSD Foundation 9 * by Paul Kranenburg and by Charles M. Hannum. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 #ifndef lint 35 __RCSID("$NetBSD: mdreloc.c,v 1.50 2010/09/24 12:00:10 skrll Exp $"); 36 #endif /* not lint */ 37 38 #include <errno.h> 39 #include <stdio.h> 40 #include <stdlib.h> 41 #include <string.h> 42 #include <unistd.h> 43 44 #include "rtldenv.h" 45 #include "debug.h" 46 #include "rtld.h" 47 48 /* 49 * The following table holds for each relocation type: 50 * - the width in bits of the memory location the relocation 51 * applies to (not currently used) 52 * - the number of bits the relocation value must be shifted to the 53 * right (i.e. discard least significant bits) to fit into 54 * the appropriate field in the instruction word. 55 * - flags indicating whether 56 * * the relocation involves a symbol 57 * * the relocation is relative to the current position 58 * * the relocation is for a GOT entry 59 * * the relocation is relative to the load address 60 * 61 */ 62 #define _RF_S 0x80000000 /* Resolve symbol */ 63 #define _RF_A 0x40000000 /* Use addend */ 64 #define _RF_P 0x20000000 /* Location relative */ 65 #define _RF_G 0x10000000 /* GOT offset */ 66 #define _RF_B 0x08000000 /* Load address relative */ 67 #define _RF_U 0x04000000 /* Unaligned */ 68 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 69 #define _RF_RS(s) ( (s) & 0xff) /* right shift */ 70 static const int reloc_target_flags[] = { 71 0, /* NONE */ 72 _RF_S|_RF_A| _RF_SZ(8) | _RF_RS(0), /* RELOC_8 */ 73 _RF_S|_RF_A| _RF_SZ(16) | _RF_RS(0), /* RELOC_16 */ 74 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* RELOC_32 */ 75 _RF_S|_RF_A|_RF_P| _RF_SZ(8) | _RF_RS(0), /* DISP_8 */ 76 _RF_S|_RF_A|_RF_P| _RF_SZ(16) | _RF_RS(0), /* DISP_16 */ 77 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* DISP_32 */ 78 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_30 */ 79 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_22 */ 80 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* HI22 */ 81 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 22 */ 82 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 13 */ 83 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* LO10 */ 84 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT10 */ 85 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT13 */ 86 _RF_G| _RF_SZ(32) | _RF_RS(10), /* GOT22 */ 87 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PC10 */ 88 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PC22 */ 89 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WPLT30 */ 90 _RF_SZ(32) | _RF_RS(0), /* COPY */ 91 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* GLOB_DAT */ 92 _RF_SZ(32) | _RF_RS(0), /* JMP_SLOT */ 93 _RF_A| _RF_B| _RF_SZ(64) | _RF_RS(0), /* RELATIVE */ 94 _RF_S|_RF_A| _RF_U| _RF_SZ(32) | _RF_RS(0), /* UA_32 */ 95 96 _RF_A| _RF_SZ(32) | _RF_RS(0), /* PLT32 */ 97 _RF_A| _RF_SZ(32) | _RF_RS(10), /* HIPLT22 */ 98 _RF_A| _RF_SZ(32) | _RF_RS(0), /* LOPLT10 */ 99 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PCPLT32 */ 100 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PCPLT22 */ 101 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PCPLT10 */ 102 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 10 */ 103 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 11 */ 104 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* 64 */ 105 _RF_S|_RF_A|/*extra*/ _RF_SZ(32) | _RF_RS(0), /* OLO10 */ 106 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(42), /* HH22 */ 107 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(32), /* HM10 */ 108 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* LM22 */ 109 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(42), /* PC_HH22 */ 110 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(32), /* PC_HM10 */ 111 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PC_LM22 */ 112 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP16 */ 113 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP19 */ 114 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* GLOB_JMP */ 115 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 7 */ 116 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 5 */ 117 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 6 */ 118 _RF_S|_RF_A|_RF_P| _RF_SZ(64) | _RF_RS(0), /* DISP64 */ 119 _RF_A| _RF_SZ(64) | _RF_RS(0), /* PLT64 */ 120 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* HIX22 */ 121 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* LOX10 */ 122 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(22), /* H44 */ 123 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(12), /* M44 */ 124 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* L44 */ 125 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* REGISTER */ 126 _RF_S|_RF_A| _RF_U| _RF_SZ(64) | _RF_RS(0), /* UA64 */ 127 _RF_S|_RF_A| _RF_U| _RF_SZ(16) | _RF_RS(0), /* UA16 */ 128 }; 129 130 #ifdef RTLD_DEBUG_RELOC 131 static const char *reloc_names[] = { 132 "NONE", "RELOC_8", "RELOC_16", "RELOC_32", "DISP_8", 133 "DISP_16", "DISP_32", "WDISP_30", "WDISP_22", "HI22", 134 "22", "13", "LO10", "GOT10", "GOT13", 135 "GOT22", "PC10", "PC22", "WPLT30", "COPY", 136 "GLOB_DAT", "JMP_SLOT", "RELATIVE", "UA_32", "PLT32", 137 "HIPLT22", "LOPLT10", "LOPLT10", "PCPLT22", "PCPLT32", 138 "10", "11", "64", "OLO10", "HH22", 139 "HM10", "LM22", "PC_HH22", "PC_HM10", "PC_LM22", 140 "WDISP16", "WDISP19", "GLOB_JMP", "7", "5", "6", 141 "DISP64", "PLT64", "HIX22", "LOX10", "H44", "M44", 142 "L44", "REGISTER", "UA64", "UA16" 143 }; 144 #endif 145 146 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 147 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 148 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 149 #define RELOC_UNALIGNED(t) ((reloc_target_flags[t] & _RF_U) != 0) 150 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 151 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 152 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 153 154 static const long reloc_target_bitmask[] = { 155 #define _BM(x) (~(-(1ULL << (x)))) 156 0, /* NONE */ 157 _BM(8), _BM(16), _BM(32), /* RELOC_8, _16, _32 */ 158 _BM(8), _BM(16), _BM(32), /* DISP8, DISP16, DISP32 */ 159 _BM(30), _BM(22), /* WDISP30, WDISP22 */ 160 _BM(22), _BM(22), /* HI22, _22 */ 161 _BM(13), _BM(10), /* RELOC_13, _LO10 */ 162 _BM(10), _BM(13), _BM(22), /* GOT10, GOT13, GOT22 */ 163 _BM(10), _BM(22), /* _PC10, _PC22 */ 164 _BM(30), 0, /* _WPLT30, _COPY */ 165 _BM(32), _BM(32), _BM(32), /* _GLOB_DAT, JMP_SLOT, _RELATIVE */ 166 _BM(32), _BM(32), /* _UA32, PLT32 */ 167 _BM(22), _BM(10), /* _HIPLT22, LOPLT10 */ 168 _BM(32), _BM(22), _BM(10), /* _PCPLT32, _PCPLT22, _PCPLT10 */ 169 _BM(10), _BM(11), -1, /* _10, _11, _64 */ 170 _BM(10), _BM(22), /* _OLO10, _HH22 */ 171 _BM(10), _BM(22), /* _HM10, _LM22 */ 172 _BM(22), _BM(10), _BM(22), /* _PC_HH22, _PC_HM10, _PC_LM22 */ 173 _BM(16), _BM(19), /* _WDISP16, _WDISP19 */ 174 -1, /* GLOB_JMP */ 175 _BM(7), _BM(5), _BM(6) /* _7, _5, _6 */ 176 -1, -1, /* DISP64, PLT64 */ 177 _BM(22), _BM(13), /* HIX22, LOX10 */ 178 _BM(22), _BM(10), _BM(13), /* H44, M44, L44 */ 179 -1, -1, _BM(16), /* REGISTER, UA64, UA16 */ 180 #undef _BM 181 }; 182 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 183 184 /* 185 * Instruction templates: 186 */ 187 #define BAA 0x10400000 /* ba,a %xcc, 0 */ 188 #define SETHI 0x03000000 /* sethi %hi(0), %g1 */ 189 #define JMP 0x81c06000 /* jmpl %g1+%lo(0), %g0 */ 190 #define NOP 0x01000000 /* sethi %hi(0), %g0 */ 191 #define OR 0x82806000 /* or %g1, 0, %g1 */ 192 #define XOR 0x82c06000 /* xor %g1, 0, %g1 */ 193 #define MOV71 0x8283a000 /* or %o7, 0, %g1 */ 194 #define MOV17 0x9c806000 /* or %g1, 0, %o7 */ 195 #define CALL 0x40000000 /* call 0 */ 196 #define SLLX 0x8b407000 /* sllx %g1, 0, %g1 */ 197 #define SETHIG5 0x0b000000 /* sethi %hi(0), %g5 */ 198 #define ORG5 0x82804005 /* or %g1, %g5, %g1 */ 199 200 201 /* %hi(v)/%lo(v) with variable shift */ 202 #define HIVAL(v, s) (((v) >> (s)) & 0x003fffff) 203 #define LOVAL(v, s) (((v) >> (s)) & 0x000003ff) 204 205 void _rtld_bind_start_0(long, long); 206 void _rtld_bind_start_1(long, long); 207 void _rtld_relocate_nonplt_self(Elf_Dyn *, Elf_Addr); 208 caddr_t _rtld_bind(const Obj_Entry *, Elf_Word); 209 210 /* 211 * Install rtld function call into this PLT slot. 212 */ 213 #define SAVE 0x9de3bf50 /* i.e. `save %sp,-176,%sp' */ 214 #define SETHI_l0 0x21000000 215 #define SETHI_l1 0x23000000 216 #define OR_l0_l0 0xa0142000 217 #define SLLX_l0_32_l0 0xa12c3020 218 #define OR_l0_l1_l0 0xa0140011 219 #define JMPL_l0_o0 0x91c42000 220 #define MOV_g1_o1 0x92100001 221 222 void _rtld_install_plt(Elf_Word *, Elf_Addr); 223 static inline int _rtld_relocate_plt_object(const Obj_Entry *, 224 const Elf_Rela *, Elf_Addr *); 225 226 void 227 _rtld_install_plt(Elf_Word *pltgot, Elf_Addr proc) 228 { 229 pltgot[0] = SAVE; 230 pltgot[1] = SETHI_l0 | HIVAL(proc, 42); 231 pltgot[2] = SETHI_l1 | HIVAL(proc, 10); 232 pltgot[3] = OR_l0_l0 | LOVAL(proc, 32); 233 pltgot[4] = SLLX_l0_32_l0; 234 pltgot[5] = OR_l0_l1_l0; 235 pltgot[6] = JMPL_l0_o0 | LOVAL(proc, 0); 236 pltgot[7] = MOV_g1_o1; 237 } 238 239 void 240 _rtld_setup_pltgot(const Obj_Entry *obj) 241 { 242 /* 243 * On sparc64 we got troubles. 244 * 245 * Instructions are 4 bytes long. 246 * Elf[64]_Addr is 8 bytes long, so are our pltglot[] 247 * array entries. 248 * Each PLT entry jumps to PLT0 to enter the dynamic 249 * linker. 250 * Loading an arbitrary 64-bit pointer takes 6 251 * instructions and 2 registers. 252 * 253 * Somehow we need to issue a save to get a new stack 254 * frame, load the address of the dynamic linker, and 255 * jump there, in 8 instructions or less. 256 * 257 * Oh, we need to fill out both PLT0 and PLT1. 258 */ 259 { 260 Elf_Word *entry = (Elf_Word *)obj->pltgot; 261 262 /* Install in entries 0 and 1 */ 263 _rtld_install_plt(&entry[0], (Elf_Addr) &_rtld_bind_start_0); 264 _rtld_install_plt(&entry[8], (Elf_Addr) &_rtld_bind_start_1); 265 266 /* 267 * Install the object reference in first slot 268 * of entry 2. 269 */ 270 obj->pltgot[8] = (Elf_Addr) obj; 271 } 272 } 273 274 void 275 _rtld_relocate_nonplt_self(Elf_Dyn *dynp, Elf_Addr relocbase) 276 { 277 const Elf_Rela *rela = 0, *relalim; 278 Elf_Addr relasz = 0; 279 Elf_Addr *where; 280 281 for (; dynp->d_tag != DT_NULL; dynp++) { 282 switch (dynp->d_tag) { 283 case DT_RELA: 284 rela = (const Elf_Rela *)(relocbase + dynp->d_un.d_ptr); 285 break; 286 case DT_RELASZ: 287 relasz = dynp->d_un.d_val; 288 break; 289 } 290 } 291 relalim = (const Elf_Rela *)((const uint8_t *)rela + relasz); 292 for (; rela < relalim; rela++) { 293 where = (Elf_Addr *)(relocbase + rela->r_offset); 294 *where = (Elf_Addr)(relocbase + rela->r_addend); 295 } 296 } 297 298 int 299 _rtld_relocate_nonplt_objects(Obj_Entry *obj) 300 { 301 const Elf_Rela *rela; 302 const Elf_Sym *def = NULL; 303 const Obj_Entry *defobj = NULL; 304 305 for (rela = obj->rela; rela < obj->relalim; rela++) { 306 Elf_Addr *where; 307 Elf_Word type; 308 Elf_Addr value = 0, mask; 309 unsigned long symnum; 310 311 where = (Elf_Addr *) (obj->relocbase + rela->r_offset); 312 symnum = ELF_R_SYM(rela->r_info); 313 314 type = ELF_R_TYPE(rela->r_info); 315 if (type == R_TYPE(NONE)) 316 continue; 317 318 /* We do JMP_SLOTs in _rtld_bind() below */ 319 if (type == R_TYPE(JMP_SLOT)) 320 continue; 321 322 /* COPY relocs are also handled elsewhere */ 323 if (type == R_TYPE(COPY)) 324 continue; 325 326 /* 327 * We use the fact that relocation types are an `enum' 328 * Note: R_SPARC_UA16 is currently numerically largest. 329 */ 330 if (type > R_TYPE(UA16)) 331 return (-1); 332 333 value = rela->r_addend; 334 335 /* 336 * Handle relative relocs here, as an optimization. 337 */ 338 if (type == R_TYPE(RELATIVE)) { 339 *where = (Elf_Addr)(obj->relocbase + value); 340 rdbg(("RELATIVE in %s --> %p", obj->path, 341 (void *)*where)); 342 continue; 343 } 344 345 if (RELOC_RESOLVE_SYMBOL(type)) { 346 347 /* Find the symbol */ 348 def = _rtld_find_symdef(symnum, obj, &defobj, 349 false); 350 if (def == NULL) 351 return -1; 352 353 /* Add in the symbol's absolute address */ 354 value += (Elf_Addr)(defobj->relocbase + def->st_value); 355 } 356 357 if (RELOC_PC_RELATIVE(type)) { 358 value -= (Elf_Addr)where; 359 } 360 361 if (RELOC_BASE_RELATIVE(type)) { 362 /* 363 * Note that even though sparcs use `Elf_rela' 364 * exclusively we still need the implicit memory addend 365 * in relocations referring to GOT entries. 366 * Undoubtedly, someone f*cked this up in the distant 367 * past, and now we're stuck with it in the name of 368 * compatibility for all eternity.. 369 * 370 * In any case, the implicit and explicit should be 371 * mutually exclusive. We provide a check for that 372 * here. 373 */ 374 #ifdef DIAGNOSTIC 375 if (value != 0 && *where != 0) { 376 xprintf("BASE_REL(%s): where=%p, *where 0x%lx, " 377 "addend=0x%lx, base %p\n", 378 obj->path, where, *where, 379 rela->r_addend, obj->relocbase); 380 } 381 #endif 382 /* XXXX -- apparently we ignore the preexisting value */ 383 value += (Elf_Addr)(obj->relocbase); 384 } 385 386 mask = RELOC_VALUE_BITMASK(type); 387 value >>= RELOC_VALUE_RIGHTSHIFT(type); 388 value &= mask; 389 390 if (RELOC_UNALIGNED(type)) { 391 /* Handle unaligned relocations. */ 392 Elf_Addr tmp = 0; 393 char *ptr = (char *)where; 394 int i, size = RELOC_TARGET_SIZE(type)/8; 395 396 /* Read it in one byte at a time. */ 397 for (i=0; i<size; i++) 398 tmp = (tmp << 8) | ptr[i]; 399 400 tmp &= ~mask; 401 tmp |= value; 402 403 /* Write it back out. */ 404 for (i=0; i<size; i++) 405 ptr[i] = ((tmp >> (8*i)) & 0xff); 406 #ifdef RTLD_DEBUG_RELOC 407 value = (Elf_Addr)tmp; 408 #endif 409 410 } else if (RELOC_TARGET_SIZE(type) > 32) { 411 *where &= ~mask; 412 *where |= value; 413 #ifdef RTLD_DEBUG_RELOC 414 value = (Elf_Addr)*where; 415 #endif 416 } else { 417 Elf32_Addr *where32 = (Elf32_Addr *)where; 418 419 *where32 &= ~mask; 420 *where32 |= value; 421 #ifdef RTLD_DEBUG_RELOC 422 value = (Elf_Addr)*where32; 423 #endif 424 } 425 426 #ifdef RTLD_DEBUG_RELOC 427 if (RELOC_RESOLVE_SYMBOL(type)) { 428 rdbg(("%s %s in %s --> %p in %s", reloc_names[type], 429 obj->strtab + obj->symtab[symnum].st_name, 430 obj->path, (void *)value, defobj->path)); 431 } else { 432 rdbg(("%s in %s --> %p", reloc_names[type], 433 obj->path, (void *)value)); 434 } 435 #endif 436 } 437 return (0); 438 } 439 440 int 441 _rtld_relocate_plt_lazy(const Obj_Entry *obj) 442 { 443 return (0); 444 } 445 446 caddr_t 447 _rtld_bind(const Obj_Entry *obj, Elf_Word reloff) 448 { 449 const Elf_Rela *rela = obj->pltrela + reloff; 450 Elf_Addr result; 451 int err; 452 453 result = 0; /* XXX gcc */ 454 455 if (ELF_R_TYPE(obj->pltrela->r_info) == R_TYPE(JMP_SLOT)) { 456 /* 457 * XXXX 458 * 459 * The first four PLT entries are reserved. There is some 460 * disagreement whether they should have associated relocation 461 * entries. Both the SPARC 32-bit and 64-bit ELF 462 * specifications say that they should have relocation entries, 463 * but the 32-bit SPARC binutils do not generate them, and now 464 * the 64-bit SPARC binutils have stopped generating them too. 465 * 466 * So, to provide binary compatibility, we will check the first 467 * entry, if it is reserved it should not be of the type 468 * JMP_SLOT. If it is JMP_SLOT, then the 4 reserved entries 469 * were not generated and our index is 4 entries too far. 470 */ 471 rela -= 4; 472 } 473 474 err = _rtld_relocate_plt_object(obj, rela, &result); 475 if (err) 476 _rtld_die(); 477 478 return (caddr_t)result; 479 } 480 481 int 482 _rtld_relocate_plt_objects(const Obj_Entry *obj) 483 { 484 const Elf_Rela *rela; 485 486 rela = obj->pltrela; 487 488 /* 489 * Check for first four reserved entries - and skip them. 490 * See above for details. 491 */ 492 if (ELF_R_TYPE(obj->pltrela->r_info) != R_TYPE(JMP_SLOT)) 493 rela += 4; 494 495 for (; rela < obj->pltrelalim; rela++) 496 if (_rtld_relocate_plt_object(obj, rela, NULL) < 0) 497 return -1; 498 499 return 0; 500 } 501 502 /* 503 * New inline function that is called by _rtld_relocate_plt_object and 504 * _rtld_bind 505 */ 506 static inline int 507 _rtld_relocate_plt_object(const Obj_Entry *obj, const Elf_Rela *rela, 508 Elf_Addr *tp) 509 { 510 Elf_Word *where = (Elf_Word *)(obj->relocbase + rela->r_offset); 511 const Elf_Sym *def; 512 const Obj_Entry *defobj; 513 Elf_Addr value, offset; 514 unsigned long info = rela->r_info; 515 516 assert(ELF_R_TYPE(info) == R_TYPE(JMP_SLOT)); 517 518 def = _rtld_find_plt_symdef(ELF_R_SYM(info), obj, &defobj, tp != NULL); 519 if (__predict_false(def == NULL)) 520 return -1; 521 if (__predict_false(def == &_rtld_sym_zero)) 522 return 0; 523 524 value = (Elf_Addr)(defobj->relocbase + def->st_value); 525 rdbg(("bind now/fixup in %s --> new=%p", 526 defobj->strtab + def->st_name, (void *)value)); 527 528 /* 529 * At the PLT entry pointed at by `where', we now construct a direct 530 * transfer to the now fully resolved function address. 531 * 532 * A PLT entry is supposed to start by looking like this: 533 * 534 * sethi %hi(. - .PLT0), %g1 535 * ba,a %xcc, .PLT1 536 * nop 537 * nop 538 * nop 539 * nop 540 * nop 541 * nop 542 * 543 * When we replace these entries we start from the last instruction 544 * and do it in reverse order so the last thing we do is replace the 545 * branch. That allows us to change this atomically. 546 * 547 * We now need to find out how far we need to jump. We have a choice 548 * of several different relocation techniques which are increasingly 549 * expensive. 550 */ 551 552 offset = ((Elf_Addr)where) - value; 553 if (rela->r_addend) { 554 Elf_Addr *ptr = (Elf_Addr *)where; 555 /* 556 * This entry is >= 32768. The relocations points to a 557 * PC-relative pointer to the bind_0 stub at the top of the 558 * PLT section. Update it to point to the target function. 559 */ 560 ptr[0] += value - (Elf_Addr)obj->pltgot; 561 562 } else if (offset <= (1L<<20) && (Elf_SOff)offset >= -(1L<<20)) { 563 /* 564 * We're within 1MB -- we can use a direct branch insn. 565 * 566 * We can generate this pattern: 567 * 568 * sethi %hi(. - .PLT0), %g1 569 * ba,a %xcc, addr 570 * nop 571 * nop 572 * nop 573 * nop 574 * nop 575 * nop 576 * 577 */ 578 where[1] = BAA | ((offset >> 2) & 0x3fffff); 579 __asm volatile("iflush %0+4" : : "r" (where)); 580 } else if (value < (1L<<32)) { 581 /* 582 * We're within 32-bits of address zero. 583 * 584 * The resulting code in the jump slot is: 585 * 586 * sethi %hi(. - .PLT0), %g1 587 * sethi %hi(addr), %g1 588 * jmp %g1+%lo(addr) 589 * nop 590 * nop 591 * nop 592 * nop 593 * nop 594 * 595 */ 596 where[2] = JMP | LOVAL(value, 0); 597 where[1] = SETHI | HIVAL(value, 10); 598 __asm volatile("iflush %0+8" : : "r" (where)); 599 __asm volatile("iflush %0+4" : : "r" (where)); 600 601 } else if ((Elf_SOff)value <= 0 && (Elf_SOff)value > -(1L<<32)) { 602 /* 603 * We're within 32-bits of address -1. 604 * 605 * The resulting code in the jump slot is: 606 * 607 * sethi %hi(. - .PLT0), %g1 608 * sethi %hix(addr), %g1 609 * xor %g1, %lox(addr), %g1 610 * jmp %g1 611 * nop 612 * nop 613 * nop 614 * nop 615 * 616 */ 617 where[3] = JMP; 618 where[2] = XOR | ((~value) & 0x00001fff); 619 where[1] = SETHI | HIVAL(~value, 10); 620 __asm volatile("iflush %0+12" : : "r" (where)); 621 __asm volatile("iflush %0+8" : : "r" (where)); 622 __asm volatile("iflush %0+4" : : "r" (where)); 623 624 } else if (offset <= (1L<<32) && (Elf_SOff)offset >= -((1L<<32) - 4)) { 625 /* 626 * We're within 32-bits -- we can use a direct call insn 627 * 628 * The resulting code in the jump slot is: 629 * 630 * sethi %hi(. - .PLT0), %g1 631 * mov %o7, %g1 632 * call (.+offset) 633 * mov %g1, %o7 634 * nop 635 * nop 636 * nop 637 * nop 638 * 639 */ 640 where[3] = MOV17; 641 where[2] = CALL | ((offset >> 4) & 0x3fffffff); 642 where[1] = MOV71; 643 __asm volatile("iflush %0+12" : : "r" (where)); 644 __asm volatile("iflush %0+8" : : "r" (where)); 645 __asm volatile("iflush %0+4" : : "r" (where)); 646 647 } else if (offset < (1L<<44)) { 648 /* 649 * We're within 44 bits. We can generate this pattern: 650 * 651 * The resulting code in the jump slot is: 652 * 653 * sethi %hi(. - .PLT0), %g1 654 * sethi %h44(addr), %g1 655 * or %g1, %m44(addr), %g1 656 * sllx %g1, 12, %g1 657 * jmp %g1+%l44(addr) 658 * nop 659 * nop 660 * nop 661 * 662 */ 663 where[4] = JMP | LOVAL(offset, 0); 664 where[3] = SLLX | 12; 665 where[2] = OR | (((offset) >> 12) & 0x00001fff); 666 where[1] = SETHI | HIVAL(offset, 22); 667 __asm volatile("iflush %0+16" : : "r" (where)); 668 __asm volatile("iflush %0+12" : : "r" (where)); 669 __asm volatile("iflush %0+8" : : "r" (where)); 670 __asm volatile("iflush %0+4" : : "r" (where)); 671 672 } else if ((Elf_SOff)offset < 0 && (Elf_SOff)offset > -(1L<<44)) { 673 /* 674 * We're within 44 bits. We can generate this pattern: 675 * 676 * The resulting code in the jump slot is: 677 * 678 * sethi %hi(. - .PLT0), %g1 679 * sethi %h44(-addr), %g1 680 * xor %g1, %m44(-addr), %g1 681 * sllx %g1, 12, %g1 682 * jmp %g1+%l44(addr) 683 * nop 684 * nop 685 * nop 686 * 687 */ 688 where[4] = JMP | LOVAL(offset, 0); 689 where[3] = SLLX | 12; 690 where[2] = XOR | (((~offset) >> 12) & 0x00001fff); 691 where[1] = SETHI | HIVAL(~offset, 22); 692 __asm volatile("iflush %0+16" : : "r" (where)); 693 __asm volatile("iflush %0+12" : : "r" (where)); 694 __asm volatile("iflush %0+8" : : "r" (where)); 695 __asm volatile("iflush %0+4" : : "r" (where)); 696 697 } else { 698 /* 699 * We need to load all 64-bits 700 * 701 * The resulting code in the jump slot is: 702 * 703 * sethi %hi(. - .PLT0), %g1 704 * sethi %hh(addr), %g1 705 * sethi %lm(addr), %g5 706 * or %g1, %hm(addr), %g1 707 * sllx %g1, 32, %g1 708 * or %g1, %g5, %g1 709 * jmp %g1+%lo(addr) 710 * nop 711 * 712 */ 713 where[6] = JMP | LOVAL(value, 0); 714 where[5] = ORG5; 715 where[4] = SLLX | 32; 716 where[3] = OR | LOVAL(value, 32); 717 where[2] = SETHIG5 | HIVAL(value, 10); 718 where[1] = SETHI | HIVAL(value, 42); 719 __asm volatile("iflush %0+24" : : "r" (where)); 720 __asm volatile("iflush %0+20" : : "r" (where)); 721 __asm volatile("iflush %0+16" : : "r" (where)); 722 __asm volatile("iflush %0+12" : : "r" (where)); 723 __asm volatile("iflush %0+8" : : "r" (where)); 724 __asm volatile("iflush %0+4" : : "r" (where)); 725 726 } 727 728 if (tp) 729 *tp = value; 730 731 return 0; 732 } 733