1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright 1996, 1997, 1998, 1999 John D. Polstra.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28 /*
29 * Dynamic linker for ELF.
30 *
31 * John Polstra <[email protected]>.
32 */
33
34 #define _WANT_P_OSREL
35 #include <sys/param.h>
36 #include <sys/mman.h>
37 #include <machine/cpufunc.h>
38 #include <machine/specialreg.h>
39 #include <machine/sysarch.h>
40
41 #include <dlfcn.h>
42 #include <err.h>
43 #include <errno.h>
44 #include <fcntl.h>
45 #include <stdarg.h>
46 #include <stdio.h>
47 #include <stdlib.h>
48 #include <string.h>
49 #include <unistd.h>
50
51 #include "debug.h"
52 #include "rtld.h"
53 #include "rtld_tls.h"
54
55 /*
56 * Process the special R_X86_64_COPY relocations in the main program. These
57 * copy data from a shared object into a region in the main program's BSS
58 * segment.
59 *
60 * Returns 0 on success, -1 on failure.
61 */
62 int
do_copy_relocations(Obj_Entry * dstobj)63 do_copy_relocations(Obj_Entry *dstobj)
64 {
65 const Elf_Rela *relalim;
66 const Elf_Rela *rela;
67
68 assert(dstobj->mainprog); /* COPY relocations are invalid elsewhere */
69
70 relalim = (const Elf_Rela *)((const char *) dstobj->rela + dstobj->relasize);
71 for (rela = dstobj->rela; rela < relalim; rela++) {
72 if (ELF_R_TYPE(rela->r_info) == R_X86_64_COPY) {
73 void *dstaddr;
74 const Elf_Sym *dstsym;
75 const char *name;
76 size_t size;
77 const void *srcaddr;
78 const Elf_Sym *srcsym;
79 const Obj_Entry *srcobj, *defobj;
80 SymLook req;
81 int res;
82
83 dstaddr = (void *)(dstobj->relocbase + rela->r_offset);
84 dstsym = dstobj->symtab + ELF_R_SYM(rela->r_info);
85 name = dstobj->strtab + dstsym->st_name;
86 size = dstsym->st_size;
87 symlook_init(&req, name);
88 req.ventry = fetch_ventry(dstobj, ELF_R_SYM(rela->r_info));
89 req.flags = SYMLOOK_EARLY;
90
91 for (srcobj = globallist_next(dstobj); srcobj != NULL;
92 srcobj = globallist_next(srcobj)) {
93 res = symlook_obj(&req, srcobj);
94 if (res == 0) {
95 srcsym = req.sym_out;
96 defobj = req.defobj_out;
97 break;
98 }
99 }
100
101 if (srcobj == NULL) {
102 _rtld_error("Undefined symbol \"%s\" referenced from COPY"
103 " relocation in %s", name, dstobj->path);
104 return -1;
105 }
106
107 srcaddr = (const void *)(defobj->relocbase + srcsym->st_value);
108 memcpy(dstaddr, srcaddr, size);
109 }
110 }
111
112 return 0;
113 }
114
115 /* Initialize the special GOT entries. */
116 void
init_pltgot(Obj_Entry * obj)117 init_pltgot(Obj_Entry *obj)
118 {
119 if (obj->pltgot != NULL) {
120 obj->pltgot[1] = (Elf_Addr) obj;
121 obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start;
122 }
123 }
124
125 /* Process the non-PLT relocations. */
126 int
reloc_non_plt(Obj_Entry * obj,Obj_Entry * obj_rtld,int flags,RtldLockState * lockstate)127 reloc_non_plt(Obj_Entry *obj, Obj_Entry *obj_rtld, int flags,
128 RtldLockState *lockstate)
129 {
130 const Elf_Rela *relalim;
131 const Elf_Rela *rela;
132 SymCache *cache;
133 const Elf_Sym *def;
134 const Obj_Entry *defobj;
135 Elf_Addr *where, symval;
136 Elf32_Addr *where32;
137 int r;
138
139 r = -1;
140 symval = 0;
141 def = NULL;
142
143 /*
144 * The dynamic loader may be called from a thread, we have
145 * limited amounts of stack available so we cannot use alloca().
146 */
147 if (obj != obj_rtld) {
148 cache = calloc(obj->dynsymcount, sizeof(SymCache));
149 /* No need to check for NULL here */
150 } else
151 cache = NULL;
152
153 relalim = (const Elf_Rela *)((const char*)obj->rela + obj->relasize);
154 for (rela = obj->rela; rela < relalim; rela++) {
155 /*
156 * First, resolve symbol for relocations which
157 * reference symbols.
158 */
159 switch (ELF_R_TYPE(rela->r_info)) {
160 case R_X86_64_64:
161 case R_X86_64_PC32:
162 case R_X86_64_GLOB_DAT:
163 case R_X86_64_TPOFF64:
164 case R_X86_64_TPOFF32:
165 case R_X86_64_DTPMOD64:
166 case R_X86_64_DTPOFF64:
167 case R_X86_64_DTPOFF32:
168 def = find_symdef(ELF_R_SYM(rela->r_info), obj,
169 &defobj, flags, cache, lockstate);
170 if (def == NULL)
171 goto done;
172 /*
173 * If symbol is IFUNC, only perform relocation
174 * when caller allowed it by passing
175 * SYMLOOK_IFUNC flag. Skip the relocations
176 * otherwise.
177 *
178 * Also error out in case IFUNC relocations
179 * are specified for TLS, which cannot be
180 * usefully interpreted.
181 */
182 if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) {
183 switch (ELF_R_TYPE(rela->r_info)) {
184 case R_X86_64_64:
185 case R_X86_64_PC32:
186 case R_X86_64_GLOB_DAT:
187 if ((flags & SYMLOOK_IFUNC) == 0) {
188 obj->non_plt_gnu_ifunc = true;
189 continue;
190 }
191 symval = (Elf_Addr)rtld_resolve_ifunc(
192 defobj, def);
193 break;
194 case R_X86_64_TPOFF64:
195 case R_X86_64_TPOFF32:
196 case R_X86_64_DTPMOD64:
197 case R_X86_64_DTPOFF64:
198 case R_X86_64_DTPOFF32:
199 _rtld_error("%s: IFUNC for TLS reloc",
200 obj->path);
201 goto done;
202 }
203 } else {
204 if ((flags & SYMLOOK_IFUNC) != 0)
205 continue;
206 symval = (Elf_Addr)defobj->relocbase +
207 def->st_value;
208 }
209 break;
210 default:
211 if ((flags & SYMLOOK_IFUNC) != 0)
212 continue;
213 break;
214 }
215 where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
216 where32 = (Elf32_Addr *)where;
217
218 switch (ELF_R_TYPE(rela->r_info)) {
219 case R_X86_64_NONE:
220 break;
221 case R_X86_64_64:
222 *where = symval + rela->r_addend;
223 break;
224 case R_X86_64_PC32:
225 /*
226 * I don't think the dynamic linker should
227 * ever see this type of relocation. But the
228 * binutils-2.6 tools sometimes generate it.
229 */
230 *where32 = (Elf32_Addr)(unsigned long)(symval +
231 rela->r_addend - (Elf_Addr)where);
232 break;
233 /* missing: R_X86_64_GOT32 R_X86_64_PLT32 */
234 case R_X86_64_COPY:
235 /*
236 * These are deferred until all other relocations have
237 * been done. All we do here is make sure that the COPY
238 * relocation is not in a shared library. They are
239 * allowed only in executable files.
240 */
241 if (!obj->mainprog) {
242 _rtld_error("%s: Unexpected R_X86_64_COPY "
243 "relocation in shared library", obj->path);
244 goto done;
245 }
246 break;
247 case R_X86_64_GLOB_DAT:
248 *where = symval;
249 break;
250 case R_X86_64_TPOFF64:
251 /*
252 * We lazily allocate offsets for static TLS
253 * as we see the first relocation that
254 * references the TLS block. This allows us to
255 * support (small amounts of) static TLS in
256 * dynamically loaded modules. If we run out
257 * of space, we generate an error.
258 */
259 if (!defobj->tls_static) {
260 if (!allocate_tls_offset(
261 __DECONST(Obj_Entry *, defobj))) {
262 _rtld_error("%s: No space available "
263 "for static Thread Local Storage",
264 obj->path);
265 goto done;
266 }
267 }
268 *where = (Elf_Addr)(def->st_value - defobj->tlsoffset +
269 rela->r_addend);
270 break;
271 case R_X86_64_TPOFF32:
272 /*
273 * We lazily allocate offsets for static TLS
274 * as we see the first relocation that
275 * references the TLS block. This allows us to
276 * support (small amounts of) static TLS in
277 * dynamically loaded modules. If we run out
278 * of space, we generate an error.
279 */
280 if (!defobj->tls_static) {
281 if (!allocate_tls_offset(
282 __DECONST(Obj_Entry *, defobj))) {
283 _rtld_error("%s: No space available "
284 "for static Thread Local Storage",
285 obj->path);
286 goto done;
287 }
288 }
289 *where32 = (Elf32_Addr)(def->st_value -
290 defobj->tlsoffset + rela->r_addend);
291 break;
292 case R_X86_64_DTPMOD64:
293 *where += (Elf_Addr)defobj->tlsindex;
294 break;
295 case R_X86_64_DTPOFF64:
296 *where += (Elf_Addr)(def->st_value + rela->r_addend);
297 break;
298 case R_X86_64_DTPOFF32:
299 *where32 += (Elf32_Addr)(def->st_value +
300 rela->r_addend);
301 break;
302 case R_X86_64_RELATIVE:
303 *where = (Elf_Addr)(obj->relocbase + rela->r_addend);
304 break;
305 case R_X86_64_IRELATIVE:
306 obj->irelative_nonplt = true;
307 break;
308
309 /*
310 * missing:
311 * R_X86_64_GOTPCREL, R_X86_64_32, R_X86_64_32S, R_X86_64_16,
312 * R_X86_64_PC16, R_X86_64_8, R_X86_64_PC8
313 */
314 default:
315 _rtld_error("%s: Unsupported relocation type %u"
316 " in non-PLT relocations\n", obj->path,
317 (unsigned int)ELF_R_TYPE(rela->r_info));
318 goto done;
319 }
320 }
321 r = 0;
322 done:
323 free(cache);
324 return (r);
325 }
326
327 /* Process the PLT relocations. */
328 int
reloc_plt(Obj_Entry * obj,int flags __unused,RtldLockState * lockstate __unused)329 reloc_plt(Obj_Entry *obj, int flags __unused, RtldLockState *lockstate __unused)
330 {
331 const Elf_Rela *relalim;
332 const Elf_Rela *rela;
333
334 relalim = (const Elf_Rela *)((const char *)obj->pltrela + obj->pltrelasize);
335 for (rela = obj->pltrela; rela < relalim; rela++) {
336 Elf_Addr *where;
337
338 switch(ELF_R_TYPE(rela->r_info)) {
339 case R_X86_64_JMP_SLOT:
340 /* Relocate the GOT slot pointing into the PLT. */
341 where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
342 *where += (Elf_Addr)obj->relocbase;
343 break;
344
345 case R_X86_64_IRELATIVE:
346 obj->irelative = true;
347 break;
348
349 default:
350 _rtld_error("Unknown relocation type %x in PLT",
351 (unsigned int)ELF_R_TYPE(rela->r_info));
352 return (-1);
353 }
354 }
355 return 0;
356 }
357
358 /* Relocate the jump slots in an object. */
359 int
reloc_jmpslots(Obj_Entry * obj,int flags,RtldLockState * lockstate)360 reloc_jmpslots(Obj_Entry *obj, int flags, RtldLockState *lockstate)
361 {
362 const Elf_Rela *relalim;
363 const Elf_Rela *rela;
364
365 if (obj->jmpslots_done)
366 return 0;
367 relalim = (const Elf_Rela *)((const char *)obj->pltrela + obj->pltrelasize);
368 for (rela = obj->pltrela; rela < relalim; rela++) {
369 Elf_Addr *where, target;
370 const Elf_Sym *def;
371 const Obj_Entry *defobj;
372
373 switch (ELF_R_TYPE(rela->r_info)) {
374 case R_X86_64_JMP_SLOT:
375 where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
376 def = find_symdef(ELF_R_SYM(rela->r_info), obj, &defobj,
377 SYMLOOK_IN_PLT | flags, NULL, lockstate);
378 if (def == NULL)
379 return (-1);
380 if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) {
381 obj->gnu_ifunc = true;
382 continue;
383 }
384 target = (Elf_Addr)(defobj->relocbase + def->st_value + rela->r_addend);
385 reloc_jmpslot(where, target, defobj, obj, (const Elf_Rel *)rela);
386 break;
387
388 case R_X86_64_IRELATIVE:
389 break;
390
391 default:
392 _rtld_error("Unknown relocation type %x in PLT",
393 (unsigned int)ELF_R_TYPE(rela->r_info));
394 return (-1);
395 }
396 }
397 obj->jmpslots_done = true;
398 return 0;
399 }
400
401 /* Fixup the jump slot at "where" to transfer control to "target". */
402 Elf_Addr
reloc_jmpslot(Elf_Addr * where,Elf_Addr target,const struct Struct_Obj_Entry * obj __unused,const struct Struct_Obj_Entry * refobj __unused,const Elf_Rel * rel __unused)403 reloc_jmpslot(Elf_Addr *where, Elf_Addr target,
404 const struct Struct_Obj_Entry *obj __unused,
405 const struct Struct_Obj_Entry *refobj __unused,
406 const Elf_Rel *rel __unused)
407 {
408 #ifdef dbg
409 dbg("reloc_jmpslot: *%p = %p", where, (void *)target);
410 #endif
411 if (!ld_bind_not)
412 *where = target;
413 return (target);
414 }
415
416 static void
reloc_iresolve_one(Obj_Entry * obj,const Elf_Rela * rela,RtldLockState * lockstate)417 reloc_iresolve_one(Obj_Entry *obj, const Elf_Rela *rela,
418 RtldLockState *lockstate)
419 {
420 Elf_Addr *where, target, *ptr;
421
422 ptr = (Elf_Addr *)(obj->relocbase + rela->r_addend);
423 where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
424 lock_release(rtld_bind_lock, lockstate);
425 target = call_ifunc_resolver(ptr);
426 wlock_acquire(rtld_bind_lock, lockstate);
427 *where = target;
428 }
429
430 int
reloc_iresolve(Obj_Entry * obj,RtldLockState * lockstate)431 reloc_iresolve(Obj_Entry *obj, RtldLockState *lockstate)
432 {
433 const Elf_Rela *relalim;
434 const Elf_Rela *rela;
435
436 if (!obj->irelative)
437 return (0);
438 obj->irelative = false;
439 relalim = (const Elf_Rela *)((const char *)obj->pltrela +
440 obj->pltrelasize);
441 for (rela = obj->pltrela; rela < relalim; rela++) {
442 if (ELF_R_TYPE(rela->r_info) == R_X86_64_IRELATIVE)
443 reloc_iresolve_one(obj, rela, lockstate);
444 }
445 return (0);
446 }
447
448 int
reloc_iresolve_nonplt(Obj_Entry * obj,RtldLockState * lockstate)449 reloc_iresolve_nonplt(Obj_Entry *obj, RtldLockState *lockstate)
450 {
451 const Elf_Rela *relalim;
452 const Elf_Rela *rela;
453
454 if (!obj->irelative_nonplt)
455 return (0);
456 obj->irelative_nonplt = false;
457 relalim = (const Elf_Rela *)((const char *)obj->rela + obj->relasize);
458 for (rela = obj->rela; rela < relalim; rela++) {
459 if (ELF_R_TYPE(rela->r_info) == R_X86_64_IRELATIVE)
460 reloc_iresolve_one(obj, rela, lockstate);
461 }
462 return (0);
463 }
464
465 int
reloc_gnu_ifunc(Obj_Entry * obj,int flags,RtldLockState * lockstate)466 reloc_gnu_ifunc(Obj_Entry *obj, int flags, RtldLockState *lockstate)
467 {
468 const Elf_Rela *relalim;
469 const Elf_Rela *rela;
470
471 if (!obj->gnu_ifunc)
472 return (0);
473 relalim = (const Elf_Rela *)((const char *)obj->pltrela + obj->pltrelasize);
474 for (rela = obj->pltrela; rela < relalim; rela++) {
475 Elf_Addr *where, target;
476 const Elf_Sym *def;
477 const Obj_Entry *defobj;
478
479 switch (ELF_R_TYPE(rela->r_info)) {
480 case R_X86_64_JMP_SLOT:
481 where = (Elf_Addr *)(obj->relocbase + rela->r_offset);
482 def = find_symdef(ELF_R_SYM(rela->r_info), obj, &defobj,
483 SYMLOOK_IN_PLT | flags, NULL, lockstate);
484 if (def == NULL)
485 return (-1);
486 if (ELF_ST_TYPE(def->st_info) != STT_GNU_IFUNC)
487 continue;
488 lock_release(rtld_bind_lock, lockstate);
489 target = (Elf_Addr)rtld_resolve_ifunc(defobj, def);
490 wlock_acquire(rtld_bind_lock, lockstate);
491 reloc_jmpslot(where, target, defobj, obj, (const Elf_Rel *)rela);
492 break;
493 }
494 }
495 obj->gnu_ifunc = false;
496 return (0);
497 }
498
499 uint32_t cpu_feature, cpu_feature2, cpu_stdext_feature, cpu_stdext_feature2;
500
501 void
ifunc_init(Elf_Auxinfo aux_info[__min_size (AT_COUNT)]__unused)502 ifunc_init(Elf_Auxinfo aux_info[__min_size(AT_COUNT)] __unused)
503 {
504 u_int p[4], cpu_high;
505
506 do_cpuid(1, p);
507 cpu_feature = p[3];
508 cpu_feature2 = p[2];
509 do_cpuid(0, p);
510 cpu_high = p[0];
511 if (cpu_high >= 7) {
512 cpuid_count(7, 0, p);
513 cpu_stdext_feature = p[1];
514 cpu_stdext_feature2 = p[2];
515 }
516 }
517
518 int __getosreldate(void);
519
520 void
allocate_initial_tls(Obj_Entry * objs)521 allocate_initial_tls(Obj_Entry *objs)
522 {
523 void *addr;
524
525 /*
526 * Fix the size of the static TLS block by using the maximum
527 * offset allocated so far and adding a bit for dynamic
528 * modules to use.
529 */
530 tls_static_space = tls_last_offset + ld_static_tls_extra;
531
532 addr = allocate_tls(objs, 0, TLS_TCB_SIZE, TLS_TCB_ALIGN);
533
534 /*
535 * This does not use _tcb_set() as it calls amd64_set_fsbase()
536 * which is an ifunc and rtld must not use ifuncs.
537 */
538 if (__getosreldate() >= P_OSREL_WRFSBASE &&
539 (cpu_stdext_feature & CPUID_STDEXT_FSGSBASE) != 0)
540 wrfsbase((uintptr_t)addr);
541 else
542 sysarch(AMD64_SET_FSBASE, &addr);
543 }
544
545 void *
__tls_get_addr(tls_index * ti)546 __tls_get_addr(tls_index *ti)
547 {
548 uintptr_t **dtvp;
549
550 dtvp = &_tcb_get()->tcb_dtv;
551 return (tls_get_addr_common(dtvp, ti->ti_module, ti->ti_offset));
552 }
553
554 size_t
calculate_tls_offset(size_t prev_offset,size_t prev_size __unused,size_t size,size_t align,size_t offset)555 calculate_tls_offset(size_t prev_offset, size_t prev_size __unused,
556 size_t size, size_t align, size_t offset)
557 {
558 size_t res;
559
560 /*
561 * res is the smallest integer satisfying res - prev_offset >= size
562 * and (-res) % p_align = p_vaddr % p_align (= p_offset % p_align).
563 */
564 res = prev_offset + size + align - 1;
565 res -= (res + offset) & (align - 1);
566 return (res);
567 }
568
569 size_t
calculate_first_tls_offset(size_t size,size_t align,size_t offset)570 calculate_first_tls_offset(size_t size, size_t align, size_t offset)
571 {
572 return (calculate_tls_offset(0, 0, size, align, offset));
573 }
574