1 /* $NetBSD: mdreloc.c,v 1.32 2002/10/18 20:35:25 thorpej Exp $ */ 2 3 /*- 4 * Copyright (c) 2000 Eduardo Horvath. 5 * Copyright (c) 1999, 2002 The NetBSD Foundation, Inc. 6 * All rights reserved. 7 * 8 * This code is derived from software contributed to The NetBSD Foundation 9 * by Paul Kranenburg and by Charles M. Hannum. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. All advertising materials mentioning features or use of this software 20 * must display the following acknowledgement: 21 * This product includes software developed by the NetBSD 22 * Foundation, Inc. and its contributors. 23 * 4. Neither the name of The NetBSD Foundation nor the names of its 24 * contributors may be used to endorse or promote products derived 25 * from this software without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37 * POSSIBILITY OF SUCH DAMAGE. 38 */ 39 40 #include <errno.h> 41 #include <stdio.h> 42 #include <stdlib.h> 43 #include <string.h> 44 #include <unistd.h> 45 #include <sys/stat.h> 46 47 #include "rtldenv.h" 48 #include "debug.h" 49 #include "rtld.h" 50 51 /* 52 * The following table holds for each relocation type: 53 * - the width in bits of the memory location the relocation 54 * applies to (not currently used) 55 * - the number of bits the relocation value must be shifted to the 56 * right (i.e. discard least significant bits) to fit into 57 * the appropriate field in the instruction word. 58 * - flags indicating whether 59 * * the relocation involves a symbol 60 * * the relocation is relative to the current position 61 * * the relocation is for a GOT entry 62 * * the relocation is relative to the load address 63 * 64 */ 65 #define _RF_S 0x80000000 /* Resolve symbol */ 66 #define _RF_A 0x40000000 /* Use addend */ 67 #define _RF_P 0x20000000 /* Location relative */ 68 #define _RF_G 0x10000000 /* GOT offset */ 69 #define _RF_B 0x08000000 /* Load address relative */ 70 #define _RF_U 0x04000000 /* Unaligned */ 71 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 72 #define _RF_RS(s) ( (s) & 0xff) /* right shift */ 73 static const int reloc_target_flags[] = { 74 0, /* NONE */ 75 _RF_S|_RF_A| _RF_SZ(8) | _RF_RS(0), /* RELOC_8 */ 76 _RF_S|_RF_A| _RF_SZ(16) | _RF_RS(0), /* RELOC_16 */ 77 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* RELOC_32 */ 78 _RF_S|_RF_A|_RF_P| _RF_SZ(8) | _RF_RS(0), /* DISP_8 */ 79 _RF_S|_RF_A|_RF_P| _RF_SZ(16) | _RF_RS(0), /* DISP_16 */ 80 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* DISP_32 */ 81 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_30 */ 82 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP_22 */ 83 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* HI22 */ 84 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 22 */ 85 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 13 */ 86 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* LO10 */ 87 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT10 */ 88 _RF_G| _RF_SZ(32) | _RF_RS(0), /* GOT13 */ 89 _RF_G| _RF_SZ(32) | _RF_RS(10), /* GOT22 */ 90 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PC10 */ 91 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PC22 */ 92 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WPLT30 */ 93 _RF_SZ(32) | _RF_RS(0), /* COPY */ 94 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* GLOB_DAT */ 95 _RF_SZ(32) | _RF_RS(0), /* JMP_SLOT */ 96 _RF_A| _RF_B| _RF_SZ(64) | _RF_RS(0), /* RELATIVE */ 97 _RF_S|_RF_A| _RF_U| _RF_SZ(32) | _RF_RS(0), /* UA_32 */ 98 99 _RF_A| _RF_SZ(32) | _RF_RS(0), /* PLT32 */ 100 _RF_A| _RF_SZ(32) | _RF_RS(10), /* HIPLT22 */ 101 _RF_A| _RF_SZ(32) | _RF_RS(0), /* LOPLT10 */ 102 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PCPLT32 */ 103 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PCPLT22 */ 104 _RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PCPLT10 */ 105 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 10 */ 106 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 11 */ 107 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* 64 */ 108 _RF_S|_RF_A|/*extra*/ _RF_SZ(32) | _RF_RS(0), /* OLO10 */ 109 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(42), /* HH22 */ 110 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(32), /* HM10 */ 111 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* LM22 */ 112 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(42), /* PC_HH22 */ 113 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(32), /* PC_HM10 */ 114 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(10), /* PC_LM22 */ 115 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP16 */ 116 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(2), /* WDISP19 */ 117 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* GLOB_JMP */ 118 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 7 */ 119 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 5 */ 120 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 6 */ 121 _RF_S|_RF_A|_RF_P| _RF_SZ(64) | _RF_RS(0), /* DISP64 */ 122 _RF_A| _RF_SZ(64) | _RF_RS(0), /* PLT64 */ 123 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(10), /* HIX22 */ 124 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* LOX10 */ 125 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(22), /* H44 */ 126 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(12), /* M44 */ 127 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* L44 */ 128 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* REGISTER */ 129 _RF_S|_RF_A| _RF_U| _RF_SZ(64) | _RF_RS(0), /* UA64 */ 130 _RF_S|_RF_A| _RF_U| _RF_SZ(16) | _RF_RS(0), /* UA16 */ 131 }; 132 133 #ifdef RTLD_DEBUG_RELOC 134 static const char *reloc_names[] = { 135 "NONE", "RELOC_8", "RELOC_16", "RELOC_32", "DISP_8", 136 "DISP_16", "DISP_32", "WDISP_30", "WDISP_22", "HI22", 137 "22", "13", "LO10", "GOT10", "GOT13", 138 "GOT22", "PC10", "PC22", "WPLT30", "COPY", 139 "GLOB_DAT", "JMP_SLOT", "RELATIVE", "UA_32", "PLT32", 140 "HIPLT22", "LOPLT10", "LOPLT10", "PCPLT22", "PCPLT32", 141 "10", "11", "64", "OLO10", "HH22", 142 "HM10", "LM22", "PC_HH22", "PC_HM10", "PC_LM22", 143 "WDISP16", "WDISP19", "GLOB_JMP", "7", "5", "6", 144 "DISP64", "PLT64", "HIX22", "LOX10", "H44", "M44", 145 "L44", "REGISTER", "UA64", "UA16" 146 }; 147 #endif 148 149 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 150 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 151 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 152 #define RELOC_UNALIGNED(t) ((reloc_target_flags[t] & _RF_U) != 0) 153 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 154 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 155 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 156 157 static const long reloc_target_bitmask[] = { 158 #define _BM(x) (~(-(1ULL << (x)))) 159 0, /* NONE */ 160 _BM(8), _BM(16), _BM(32), /* RELOC_8, _16, _32 */ 161 _BM(8), _BM(16), _BM(32), /* DISP8, DISP16, DISP32 */ 162 _BM(30), _BM(22), /* WDISP30, WDISP22 */ 163 _BM(22), _BM(22), /* HI22, _22 */ 164 _BM(13), _BM(10), /* RELOC_13, _LO10 */ 165 _BM(10), _BM(13), _BM(22), /* GOT10, GOT13, GOT22 */ 166 _BM(10), _BM(22), /* _PC10, _PC22 */ 167 _BM(30), 0, /* _WPLT30, _COPY */ 168 _BM(32), _BM(32), _BM(32), /* _GLOB_DAT, JMP_SLOT, _RELATIVE */ 169 _BM(32), _BM(32), /* _UA32, PLT32 */ 170 _BM(22), _BM(10), /* _HIPLT22, LOPLT10 */ 171 _BM(32), _BM(22), _BM(10), /* _PCPLT32, _PCPLT22, _PCPLT10 */ 172 _BM(10), _BM(11), -1, /* _10, _11, _64 */ 173 _BM(10), _BM(22), /* _OLO10, _HH22 */ 174 _BM(10), _BM(22), /* _HM10, _LM22 */ 175 _BM(22), _BM(10), _BM(22), /* _PC_HH22, _PC_HM10, _PC_LM22 */ 176 _BM(16), _BM(19), /* _WDISP16, _WDISP19 */ 177 -1, /* GLOB_JMP */ 178 _BM(7), _BM(5), _BM(6) /* _7, _5, _6 */ 179 -1, -1, /* DISP64, PLT64 */ 180 _BM(22), _BM(13), /* HIX22, LOX10 */ 181 _BM(22), _BM(10), _BM(13), /* H44, M44, L44 */ 182 -1, -1, _BM(16), /* REGISTER, UA64, UA16 */ 183 #undef _BM 184 }; 185 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 186 187 /* 188 * Instruction templates: 189 */ 190 #define BAA 0x10400000 /* ba,a %xcc, 0 */ 191 #define SETHI 0x03000000 /* sethi %hi(0), %g1 */ 192 #define JMP 0x81c06000 /* jmpl %g1+%lo(0), %g0 */ 193 #define NOP 0x01000000 /* sethi %hi(0), %g0 */ 194 #define OR 0x82806000 /* or %g1, 0, %g1 */ 195 #define XOR 0x82c06000 /* xor %g1, 0, %g1 */ 196 #define MOV71 0x8283a000 /* or %o7, 0, %g1 */ 197 #define MOV17 0x9c806000 /* or %g1, 0, %o7 */ 198 #define CALL 0x40000000 /* call 0 */ 199 #define SLLX 0x8b407000 /* sllx %g1, 0, %g1 */ 200 #define SETHIG5 0x0b000000 /* sethi %hi(0), %g5 */ 201 #define ORG5 0x82804005 /* or %g1, %g5, %g1 */ 202 203 204 /* %hi(v)/%lo(v) with variable shift */ 205 #define HIVAL(v, s) (((v) >> (s)) & 0x003fffff) 206 #define LOVAL(v, s) (((v) >> (s)) & 0x000003ff) 207 208 void _rtld_bind_start_0(long, long); 209 void _rtld_bind_start_1(long, long); 210 void _rtld_relocate_nonplt_self(Elf_Dyn *, Elf_Addr); 211 caddr_t _rtld_bind __P((const Obj_Entry *, Elf_Word)); 212 213 /* 214 * Install rtld function call into this PLT slot. 215 */ 216 #define SAVE 0x9de3bf50 /* i.e. `save %sp,-176,%sp' */ 217 #define SETHI_l0 0x21000000 218 #define SETHI_l1 0x23000000 219 #define OR_l0_l0 0xa0142000 220 #define SLLX_l0_32_l0 0xa12c3020 221 #define OR_l0_l1_l0 0xa0140011 222 #define JMPL_l0_o0 0x91c42000 223 #define MOV_g1_o1 0x92100001 224 225 void _rtld_install_plt __P((Elf_Word *pltgot, Elf_Addr proc)); 226 227 void 228 _rtld_install_plt(pltgot, proc) 229 Elf_Word *pltgot; 230 Elf_Addr proc; 231 { 232 pltgot[0] = SAVE; 233 pltgot[1] = SETHI_l0 | HIVAL(proc, 42); 234 pltgot[2] = SETHI_l1 | HIVAL(proc, 10); 235 pltgot[3] = OR_l0_l0 | LOVAL(proc, 32); 236 pltgot[4] = SLLX_l0_32_l0; 237 pltgot[5] = OR_l0_l1_l0; 238 pltgot[6] = JMPL_l0_o0 | LOVAL(proc, 0); 239 pltgot[7] = MOV_g1_o1; 240 } 241 242 void 243 _rtld_setup_pltgot(const Obj_Entry *obj) 244 { 245 /* 246 * On sparc64 we got troubles. 247 * 248 * Instructions are 4 bytes long. 249 * Elf[64]_Addr is 8 bytes long, so are our pltglot[] 250 * array entries. 251 * Each PLT entry jumps to PLT0 to enter the dynamic 252 * linker. 253 * Loading an arbitrary 64-bit pointer takes 6 254 * instructions and 2 registers. 255 * 256 * Somehow we need to issue a save to get a new stack 257 * frame, load the address of the dynamic linker, and 258 * jump there, in 8 instructions or less. 259 * 260 * Oh, we need to fill out both PLT0 and PLT1. 261 */ 262 { 263 Elf_Word *entry = (Elf_Word *)obj->pltgot; 264 265 /* Install in entries 0 and 1 */ 266 _rtld_install_plt(&entry[0], (Elf_Addr) &_rtld_bind_start_0); 267 _rtld_install_plt(&entry[8], (Elf_Addr) &_rtld_bind_start_1); 268 269 /* 270 * Install the object reference in first slot 271 * of entry 2. 272 */ 273 obj->pltgot[8] = (Elf_Addr) obj; 274 } 275 } 276 277 void 278 _rtld_relocate_nonplt_self(dynp, relocbase) 279 Elf_Dyn *dynp; 280 Elf_Addr relocbase; 281 { 282 const Elf_Rela *rela = 0, *relalim; 283 Elf_Addr relasz = 0; 284 Elf_Addr *where; 285 286 for (; dynp->d_tag != DT_NULL; dynp++) { 287 switch (dynp->d_tag) { 288 case DT_RELA: 289 rela = (const Elf_Rela *)(relocbase + dynp->d_un.d_ptr); 290 break; 291 case DT_RELASZ: 292 relasz = dynp->d_un.d_val; 293 break; 294 } 295 } 296 relalim = (const Elf_Rela *)((caddr_t)rela + relasz); 297 for (; rela < relalim; rela++) { 298 where = (Elf_Addr *)(relocbase + rela->r_offset); 299 *where = (Elf_Addr)(relocbase + rela->r_addend); 300 } 301 } 302 303 int 304 _rtld_relocate_nonplt_objects(obj) 305 const Obj_Entry *obj; 306 { 307 const Elf_Rela *rela; 308 309 for (rela = obj->rela; rela < obj->relalim; rela++) { 310 Elf_Addr *where; 311 Elf_Word type; 312 Elf_Addr value = 0, mask; 313 const Elf_Sym *def = NULL; 314 const Obj_Entry *defobj = NULL; 315 unsigned long symnum; 316 317 where = (Elf_Addr *) (obj->relocbase + rela->r_offset); 318 symnum = ELF_R_SYM(rela->r_info); 319 320 type = ELF_R_TYPE(rela->r_info); 321 if (type == R_TYPE(NONE)) 322 continue; 323 324 /* We do JMP_SLOTs in _rtld_bind() below */ 325 if (type == R_TYPE(JMP_SLOT)) 326 continue; 327 328 /* COPY relocs are also handled elsewhere */ 329 if (type == R_TYPE(COPY)) 330 continue; 331 332 /* 333 * We use the fact that relocation types are an `enum' 334 * Note: R_SPARC_UA16 is currently numerically largest. 335 */ 336 if (type > R_TYPE(UA16)) 337 return (-1); 338 339 value = rela->r_addend; 340 341 /* 342 * Handle relative relocs here, as an optimization. 343 */ 344 if (type == R_TYPE(RELATIVE)) { 345 *where = (Elf_Addr)(obj->relocbase + value); 346 rdbg(("RELATIVE in %s --> %p", obj->path, 347 (void *)*where)); 348 continue; 349 } 350 351 if (RELOC_RESOLVE_SYMBOL(type)) { 352 353 /* Find the symbol */ 354 def = _rtld_find_symdef(symnum, obj, &defobj, false); 355 if (def == NULL) 356 return (-1); 357 358 /* Add in the symbol's absolute address */ 359 value += (Elf_Addr)(defobj->relocbase + def->st_value); 360 } 361 362 if (RELOC_PC_RELATIVE(type)) { 363 value -= (Elf_Addr)where; 364 } 365 366 if (RELOC_BASE_RELATIVE(type)) { 367 /* 368 * Note that even though sparcs use `Elf_rela' 369 * exclusively we still need the implicit memory addend 370 * in relocations referring to GOT entries. 371 * Undoubtedly, someone f*cked this up in the distant 372 * past, and now we're stuck with it in the name of 373 * compatibility for all eternity.. 374 * 375 * In any case, the implicit and explicit should be 376 * mutually exclusive. We provide a check for that 377 * here. 378 */ 379 #ifdef DIAGNOSTIC 380 if (value != 0 && *where != 0) { 381 xprintf("BASE_REL(%s): where=%p, *where 0x%lx, " 382 "addend=0x%lx, base %p\n", 383 obj->path, where, *where, 384 rela->r_addend, obj->relocbase); 385 } 386 #endif 387 /* XXXX -- apparently we ignore the preexisting value */ 388 value += (Elf_Addr)(obj->relocbase); 389 } 390 391 mask = RELOC_VALUE_BITMASK(type); 392 value >>= RELOC_VALUE_RIGHTSHIFT(type); 393 value &= mask; 394 395 if (RELOC_UNALIGNED(type)) { 396 /* Handle unaligned relocations. */ 397 Elf_Addr tmp = 0; 398 char *ptr = (char *)where; 399 int i, size = RELOC_TARGET_SIZE(type)/8; 400 401 /* Read it in one byte at a time. */ 402 for (i=0; i<size; i++) 403 tmp = (tmp << 8) | ptr[i]; 404 405 tmp &= ~mask; 406 tmp |= value; 407 408 /* Write it back out. */ 409 for (i=0; i<size; i++) 410 ptr[i] = ((tmp >> (8*i)) & 0xff); 411 #ifdef RTLD_DEBUG_RELOC 412 value = (Elf_Addr)tmp; 413 #endif 414 415 } else if (RELOC_TARGET_SIZE(type) > 32) { 416 *where &= ~mask; 417 *where |= value; 418 #ifdef RTLD_DEBUG_RELOC 419 value = (Elf_Addr)*where; 420 #endif 421 } else { 422 Elf32_Addr *where32 = (Elf32_Addr *)where; 423 424 *where32 &= ~mask; 425 *where32 |= value; 426 #ifdef RTLD_DEBUG_RELOC 427 value = (Elf_Addr)*where32; 428 #endif 429 } 430 431 #ifdef RTLD_DEBUG_RELOC 432 if (RELOC_RESOLVE_SYMBOL(type)) { 433 rdbg(("%s %s in %s --> %p in %s", reloc_names[type], 434 obj->strtab + obj->symtab[symnum].st_name, 435 obj->path, (void *)*where, defobj->path)); 436 } else { 437 rdbg(("%s in %s --> %p", reloc_names[type], 438 obj->path, (void *)*where)); 439 } 440 #endif 441 } 442 return (0); 443 } 444 445 int 446 _rtld_relocate_plt_lazy(obj) 447 const Obj_Entry *obj; 448 { 449 return (0); 450 } 451 452 caddr_t 453 _rtld_bind(obj, reloff) 454 const Obj_Entry *obj; 455 Elf_Word reloff; 456 { 457 const Elf_Rela *rela = obj->pltrela + reloff; 458 const Elf_Sym *def; 459 const Obj_Entry *defobj; 460 Elf_Word *where; 461 Elf_Addr value, offset; 462 463 if (ELF_R_TYPE(obj->pltrela->r_info) == R_TYPE(JMP_SLOT)) { 464 /* 465 * XXXX 466 * 467 * The first four PLT entries are reserved. There is some 468 * disagreement whether they should have associated relocation 469 * entries. Both the SPARC 32-bit and 64-bit ELF 470 * specifications say that they should have relocation entries, 471 * but the 32-bit SPARC binutils do not generate them, and now 472 * the 64-bit SPARC binutils have stopped generating them too. 473 * 474 * So, to provide binary compatibility, we will check the first 475 * entry, if it is reserved it should not be of the type 476 * JMP_SLOT. If it is JMP_SLOT, then the 4 reserved entries 477 * were not generated and our index is 4 entries too far. 478 */ 479 rela -= 4; 480 } 481 482 where = (Elf_Word *)(obj->relocbase + rela->r_offset); 483 484 /* Fully resolve procedure addresses now */ 485 486 assert(ELF_R_TYPE(rela->r_info) == R_TYPE(JMP_SLOT)); 487 488 def = _rtld_find_symdef(ELF_R_SYM(rela->r_info), obj, &defobj, true); 489 if (def == NULL) 490 _rtld_die(); 491 492 value = (Elf_Addr)(defobj->relocbase + def->st_value); 493 rdbg(("bind now/fixup in %s --> new=%p", 494 defobj->strtab + def->st_name, (void *)value)); 495 496 /* 497 * At the PLT entry pointed at by `where', we now construct 498 * a direct transfer to the now fully resolved function 499 * address. 500 * 501 * A PLT entry is supposed to start by looking like this: 502 * 503 * sethi %hi(. - .PLT0), %g1 504 * ba,a %xcc, .PLT1 505 * nop 506 * nop 507 * nop 508 * nop 509 * nop 510 * nop 511 * 512 * When we replace these entries we start from the second 513 * entry and do it in reverse order so the last thing we 514 * do is replace the branch. That allows us to change this 515 * atomically. 516 * 517 * We now need to find out how far we need to jump. We 518 * have a choice of several different relocation techniques 519 * which are increasingly expensive. 520 */ 521 522 offset = ((Elf_Addr)where) - value; 523 if (rela->r_addend) { 524 Elf_Addr *ptr = (Elf_Addr *)where; 525 /* 526 * This entry is >=32768. The relocations points to a 527 * PC-relative pointer to the bind_0 stub at the top of the 528 * PLT section. Update it to point to the target function. 529 */ 530 ptr[0] += value - (Elf_Addr)obj->pltgot; 531 532 } else if (offset <= (1L<<20) && offset >= -(1L<<20)) { 533 /* 534 * We're within 1MB -- we can use a direct branch insn. 535 * 536 * We can generate this pattern: 537 * 538 * sethi %hi(. - .PLT0), %g1 539 * ba,a %xcc, addr 540 * nop 541 * nop 542 * nop 543 * nop 544 * nop 545 * nop 546 * 547 */ 548 where[1] = BAA | ((offset >> 2) &0x3fffff); 549 __asm __volatile("iflush %0+4" : : "r" (where)); 550 } else if (value >= 0 && value < (1L<<32)) { 551 /* 552 * We're within 32-bits of address zero. 553 * 554 * The resulting code in the jump slot is: 555 * 556 * sethi %hi(. - .PLT0), %g1 557 * sethi %hi(addr), %g1 558 * jmp %g1+%lo(addr) 559 * nop 560 * nop 561 * nop 562 * nop 563 * nop 564 * 565 */ 566 where[2] = JMP | LOVAL(value, 0); 567 where[1] = SETHI | HIVAL(value, 10); 568 __asm __volatile("iflush %0+8" : : "r" (where)); 569 __asm __volatile("iflush %0+4" : : "r" (where)); 570 571 } else if (value <= 0 && value > -(1L<<32)) { 572 /* 573 * We're within 32-bits of address -1. 574 * 575 * The resulting code in the jump slot is: 576 * 577 * sethi %hi(. - .PLT0), %g1 578 * sethi %hix(addr), %g1 579 * xor %g1, %lox(addr), %g1 580 * jmp %g1 581 * nop 582 * nop 583 * nop 584 * nop 585 * 586 */ 587 where[3] = JMP; 588 where[2] = XOR | ((~value) & 0x00001fff); 589 where[1] = SETHI | HIVAL(~value, 10); 590 __asm __volatile("iflush %0+12" : : "r" (where)); 591 __asm __volatile("iflush %0+8" : : "r" (where)); 592 __asm __volatile("iflush %0+4" : : "r" (where)); 593 594 } else if (offset <= (1L<<32) && offset >= -((1L<<32) - 4)) { 595 /* 596 * We're within 32-bits -- we can use a direct call insn 597 * 598 * The resulting code in the jump slot is: 599 * 600 * sethi %hi(. - .PLT0), %g1 601 * mov %o7, %g1 602 * call (.+offset) 603 * mov %g1, %o7 604 * nop 605 * nop 606 * nop 607 * nop 608 * 609 */ 610 where[3] = MOV17; 611 where[2] = CALL | ((offset >> 4) & 0x3fffffff); 612 where[1] = MOV71; 613 __asm __volatile("iflush %0+12" : : "r" (where)); 614 __asm __volatile("iflush %0+8" : : "r" (where)); 615 __asm __volatile("iflush %0+4" : : "r" (where)); 616 617 } else if (offset >= 0 && offset < (1L<<44)) { 618 /* 619 * We're within 44 bits. We can generate this pattern: 620 * 621 * The resulting code in the jump slot is: 622 * 623 * sethi %hi(. - .PLT0), %g1 624 * sethi %h44(addr), %g1 625 * or %g1, %m44(addr), %g1 626 * sllx %g1, 12, %g1 627 * jmp %g1+%l44(addr) 628 * nop 629 * nop 630 * nop 631 * 632 */ 633 where[4] = JMP | LOVAL(offset, 0); 634 where[3] = SLLX | 12; 635 where[2] = OR | (((offset) >> 12) & 0x00001fff); 636 where[1] = SETHI | HIVAL(offset, 22); 637 __asm __volatile("iflush %0+16" : : "r" (where)); 638 __asm __volatile("iflush %0+12" : : "r" (where)); 639 __asm __volatile("iflush %0+8" : : "r" (where)); 640 __asm __volatile("iflush %0+4" : : "r" (where)); 641 642 } else if (offset < 0 && offset > -(1L<<44)) { 643 /* 644 * We're within 44 bits. We can generate this pattern: 645 * 646 * The resulting code in the jump slot is: 647 * 648 * sethi %hi(. - .PLT0), %g1 649 * sethi %h44(-addr), %g1 650 * xor %g1, %m44(-addr), %g1 651 * sllx %g1, 12, %g1 652 * jmp %g1+%l44(addr) 653 * nop 654 * nop 655 * nop 656 * 657 */ 658 where[4] = JMP | LOVAL(offset, 0); 659 where[3] = SLLX | 12; 660 where[2] = XOR | (((~offset) >> 12) & 0x00001fff); 661 where[1] = SETHI | HIVAL(~offset, 22); 662 __asm __volatile("iflush %0+16" : : "r" (where)); 663 __asm __volatile("iflush %0+12" : : "r" (where)); 664 __asm __volatile("iflush %0+8" : : "r" (where)); 665 __asm __volatile("iflush %0+4" : : "r" (where)); 666 667 } else { 668 /* 669 * We need to load all 64-bits 670 * 671 * The resulting code in the jump slot is: 672 * 673 * sethi %hi(. - .PLT0), %g1 674 * sethi %hh(addr), %g1 675 * sethi %lm(addr), %g5 676 * or %g1, %hm(addr), %g1 677 * sllx %g1, 32, %g1 678 * or %g1, %g5, %g1 679 * jmp %g1+%lo(addr) 680 * nop 681 * 682 */ 683 where[6] = JMP | LOVAL(value, 0); 684 where[5] = ORG5; 685 where[4] = SLLX | 32; 686 where[3] = OR | LOVAL(value, 32); 687 where[2] = SETHIG5 | HIVAL(value, 10); 688 where[1] = SETHI | HIVAL(value, 42); 689 __asm __volatile("iflush %0+24" : : "r" (where)); 690 __asm __volatile("iflush %0+20" : : "r" (where)); 691 __asm __volatile("iflush %0+16" : : "r" (where)); 692 __asm __volatile("iflush %0+12" : : "r" (where)); 693 __asm __volatile("iflush %0+8" : : "r" (where)); 694 __asm __volatile("iflush %0+4" : : "r" (where)); 695 696 } 697 698 return (caddr_t)value; 699 } 700