1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 1990, 1991 UNIX System Laboratories, Inc.
24 * Copyright (c) 1988 AT&T
25 * All Rights Reserved
26 *
27 * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
28 */
29
30 /* Get the x86 version of the relocation engine */
31 #define DO_RELOC_LIBLD_X86
32
33 #include <string.h>
34 #include <stdio.h>
35 #include <sys/elf_386.h>
36 #include <debug.h>
37 #include <reloc.h>
38 #include <i386/machdep_x86.h>
39 #include "msg.h"
40 #include "_libld.h"
41
42 /*
43 * Search the GOT index list for a GOT entry with a matching reference.
44 */
45 /* ARGSUSED3 */
46 static Gotndx *
ld_find_got_ndx(Alist * alp,Gotref gref,Ofl_desc * ofl,Rel_desc * rdesc)47 ld_find_got_ndx(Alist *alp, Gotref gref, Ofl_desc *ofl, Rel_desc *rdesc)
48 {
49 Aliste idx;
50 Gotndx *gnp;
51
52 if ((gref == GOT_REF_TLSLD) && ofl->ofl_tlsldgotndx)
53 return (ofl->ofl_tlsldgotndx);
54
55 for (ALIST_TRAVERSE(alp, idx, gnp)) {
56 if (gnp->gn_gotref == gref)
57 return (gnp);
58 }
59 return (NULL);
60 }
61
62 static Xword
ld_calc_got_offset(Rel_desc * rdesc,Ofl_desc * ofl)63 ld_calc_got_offset(Rel_desc *rdesc, Ofl_desc *ofl)
64 {
65 Os_desc *osp = ofl->ofl_osgot;
66 Sym_desc *sdp = rdesc->rel_sym;
67 Xword gotndx;
68 Gotref gref;
69 Gotndx *gnp;
70
71 if (rdesc->rel_flags & FLG_REL_DTLS)
72 gref = GOT_REF_TLSGD;
73 else if (rdesc->rel_flags & FLG_REL_MTLS)
74 gref = GOT_REF_TLSLD;
75 else if (rdesc->rel_flags & FLG_REL_STLS)
76 gref = GOT_REF_TLSIE;
77 else
78 gref = GOT_REF_GENERIC;
79
80 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, NULL);
81 assert(gnp);
82
83 gotndx = (Xword)gnp->gn_gotndx;
84
85 if ((rdesc->rel_flags & FLG_REL_DTLS) &&
86 (rdesc->rel_rtype == R_386_TLS_DTPOFF32))
87 gotndx++;
88
89 return ((Xword)(osp->os_shdr->sh_addr + (gotndx * M_GOT_ENTSIZE)));
90 }
91
92 static Word
ld_init_rel(Rel_desc * reld,Word * typedata,void * reloc)93 ld_init_rel(Rel_desc *reld, Word *typedata, void *reloc)
94 {
95 Rel *rel = (Rel *)reloc;
96
97 /* LINTED */
98 reld->rel_rtype = (Word)ELF_R_TYPE(rel->r_info, M_MACH);
99 reld->rel_roffset = rel->r_offset;
100 reld->rel_raddend = 0;
101 *typedata = 0;
102
103 return ((Word)ELF_R_SYM(rel->r_info));
104 }
105
106 static void
ld_mach_eflags(Ehdr * ehdr,Ofl_desc * ofl)107 ld_mach_eflags(Ehdr *ehdr, Ofl_desc *ofl)
108 {
109 ofl->ofl_dehdr->e_flags |= ehdr->e_flags;
110 }
111
112 static void
ld_mach_make_dynamic(Ofl_desc * ofl,size_t * cnt)113 ld_mach_make_dynamic(Ofl_desc *ofl, size_t *cnt)
114 {
115 if (!(ofl->ofl_flags & FLG_OF_RELOBJ)) {
116 /*
117 * Create this entry if we are going to create a PLT table.
118 */
119 if (ofl->ofl_pltcnt)
120 (*cnt)++; /* DT_PLTGOT */
121 }
122 }
123
124 static void
ld_mach_update_odynamic(Ofl_desc * ofl,Dyn ** dyn)125 ld_mach_update_odynamic(Ofl_desc *ofl, Dyn **dyn)
126 {
127 if (((ofl->ofl_flags & FLG_OF_RELOBJ) == 0) && ofl->ofl_pltcnt) {
128 (*dyn)->d_tag = DT_PLTGOT;
129 if (ofl->ofl_osgot)
130 (*dyn)->d_un.d_ptr = ofl->ofl_osgot->os_shdr->sh_addr;
131 else
132 (*dyn)->d_un.d_ptr = 0;
133 (*dyn)++;
134 }
135 }
136
137 static Xword
ld_calc_plt_addr(Sym_desc * sdp,Ofl_desc * ofl)138 ld_calc_plt_addr(Sym_desc *sdp, Ofl_desc *ofl)
139 {
140 Xword value;
141
142 value = (Xword)(ofl->ofl_osplt->os_shdr->sh_addr) +
143 M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) * M_PLT_ENTSIZE);
144 return (value);
145 }
146
147 /*
148 * Build a single plt entry - code is:
149 * if (building dynamic executable)
150 * JMP *got_off
151 * else
152 * JMP *got_off@GOT(%ebx)
153 * PUSHL &rel_off
154 * JMP -n(%pc) # -n is pcrel offset to first plt entry
155 *
156 * The got_off@GOT entry gets filled with the address of the PUSHL,
157 * so the first pass through the plt jumps back here, jumping
158 * in turn to the first plt entry, which jumps to the dynamic
159 * linker. The dynamic linker then patches the GOT, rerouting
160 * future plt calls to the proper destination.
161 */
162 static void
plt_entry(Ofl_desc * ofl,Word rel_off,Sym_desc * sdp)163 plt_entry(Ofl_desc * ofl, Word rel_off, Sym_desc * sdp)
164 {
165 uchar_t *pltent, *gotent;
166 Sword plt_off;
167 Word got_off;
168 int bswap = (ofl->ofl_flags1 & FLG_OF1_ENCDIFF) != 0;
169
170 got_off = sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE;
171 plt_off = M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) *
172 M_PLT_ENTSIZE);
173 pltent = (uchar_t *)(ofl->ofl_osplt->os_outdata->d_buf) + plt_off;
174 gotent = (uchar_t *)(ofl->ofl_osgot->os_outdata->d_buf) + got_off;
175
176 /*
177 * Fill in the got entry with the address of the next instruction.
178 */
179 /* LINTED */
180 *(Word *)gotent = ofl->ofl_osplt->os_shdr->sh_addr + plt_off +
181 M_PLT_INSSIZE;
182 if (bswap)
183 /* LINTED */
184 *(Word *)gotent = ld_bswap_Word(*(Word *)gotent);
185
186 if (!(ofl->ofl_flags & FLG_OF_SHAROBJ)) {
187 pltent[0] = M_SPECIAL_INST;
188 pltent[1] = M_JMP_DISP_IND;
189 pltent += 2;
190 /* LINTED */
191 *(Word *)pltent = (Word)(ofl->ofl_osgot->os_shdr->sh_addr +
192 got_off);
193 } else {
194 pltent[0] = M_SPECIAL_INST;
195 pltent[1] = M_JMP_REG_DISP_IND;
196 pltent += 2;
197 /* LINTED */
198 *(Word *)pltent = (Word)got_off;
199 }
200 if (bswap)
201 /* LINTED */
202 *(Word *)pltent = ld_bswap_Word(*(Word *)pltent);
203 pltent += 4;
204
205 pltent[0] = M_INST_PUSHL;
206 pltent++;
207 /* LINTED */
208 *(Word *)pltent = (Word)rel_off;
209 if (bswap)
210 /* LINTED */
211 *(Word *)pltent = ld_bswap_Word(*(Word *)pltent);
212 pltent += 4;
213
214 plt_off = -(plt_off + 16); /* JMP, PUSHL, JMP take 16 bytes */
215 pltent[0] = M_INST_JMP;
216 pltent++;
217 /* LINTED */
218 *(Word *)pltent = (Word)plt_off;
219 if (bswap)
220 /* LINTED */
221 *(Word *)pltent = ld_bswap_Word(*(Word *)pltent);
222 }
223
224 static uintptr_t
ld_perform_outreloc(Rel_desc * orsp,Ofl_desc * ofl,Boolean * remain_seen)225 ld_perform_outreloc(Rel_desc * orsp, Ofl_desc * ofl, Boolean *remain_seen)
226 {
227 Os_desc * relosp, * osp = 0;
228 Word ndx, roffset, value;
229 Rel rea;
230 char *relbits;
231 Sym_desc * sdp, * psym = (Sym_desc *)0;
232 int sectmoved = 0;
233
234 sdp = orsp->rel_sym;
235
236 /*
237 * If the section this relocation is against has been discarded
238 * (-zignore), then also discard (skip) the relocation itself.
239 */
240 if (orsp->rel_isdesc && ((orsp->rel_flags &
241 (FLG_REL_GOT | FLG_REL_BSS | FLG_REL_PLT | FLG_REL_NOINFO)) == 0) &&
242 (orsp->rel_isdesc->is_flags & FLG_IS_DISCARD)) {
243 DBG_CALL(Dbg_reloc_discard(ofl->ofl_lml, M_MACH, orsp));
244 return (1);
245 }
246
247 /*
248 * If this is a relocation against a move table, or expanded move
249 * table, adjust the relocation entries.
250 */
251 if (RELAUX_GET_MOVE(orsp))
252 ld_adj_movereloc(ofl, orsp);
253
254 /*
255 * If this is a relocation against a section using a partial initialized
256 * symbol, adjust the embedded symbol info.
257 *
258 * The second argument of the am_I_partial() is the value stored at the
259 * target address relocation is going to be applied.
260 */
261 if (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION) {
262 if (ofl->ofl_parsyms &&
263 (sdp->sd_isc->is_flags & FLG_IS_RELUPD) &&
264 /* LINTED */
265 (psym = ld_am_I_partial(orsp, *(Xword *)
266 ((uchar_t *)(orsp->rel_isdesc->is_indata->d_buf) +
267 orsp->rel_roffset)))) {
268 DBG_CALL(Dbg_move_outsctadj(ofl->ofl_lml, psym));
269 sectmoved = 1;
270 }
271 }
272
273 value = sdp->sd_sym->st_value;
274
275 if (orsp->rel_flags & FLG_REL_GOT) {
276 osp = ofl->ofl_osgot;
277 roffset = (Word)ld_calc_got_offset(orsp, ofl);
278
279 } else if (orsp->rel_flags & FLG_REL_PLT) {
280 /*
281 * Note that relocations for PLT's actually
282 * cause a relocation againt the GOT.
283 */
284 osp = ofl->ofl_osplt;
285 roffset = (Word) (ofl->ofl_osgot->os_shdr->sh_addr) +
286 sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE;
287
288 plt_entry(ofl, osp->os_relosdesc->os_szoutrels, sdp);
289
290 } else if (orsp->rel_flags & FLG_REL_BSS) {
291 /*
292 * This must be a R_386_COPY. For these set the roffset to
293 * point to the new symbols location.
294 */
295 osp = ofl->ofl_isbss->is_osdesc;
296 roffset = (Word)value;
297 } else {
298 osp = RELAUX_GET_OSDESC(orsp);
299
300 /*
301 * Calculate virtual offset of reference point; equals offset
302 * into section + vaddr of section for loadable sections, or
303 * offset plus section displacement for nonloadable sections.
304 */
305 roffset = orsp->rel_roffset +
306 (Off)_elf_getxoff(orsp->rel_isdesc->is_indata);
307 if (!(ofl->ofl_flags & FLG_OF_RELOBJ))
308 roffset += orsp->rel_isdesc->is_osdesc->
309 os_shdr->sh_addr;
310 }
311
312 if ((osp == 0) || ((relosp = osp->os_relosdesc) == 0))
313 relosp = ofl->ofl_osrel;
314
315 /*
316 * Assign the symbols index for the output relocation. If the
317 * relocation refers to a SECTION symbol then it's index is based upon
318 * the output sections symbols index. Otherwise the index can be
319 * derived from the symbols index itself.
320 */
321 if (orsp->rel_rtype == R_386_RELATIVE)
322 ndx = STN_UNDEF;
323 else if ((orsp->rel_flags & FLG_REL_SCNNDX) ||
324 (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION)) {
325 if (sectmoved == 0) {
326 /*
327 * Check for a null input section. This can
328 * occur if this relocation references a symbol
329 * generated by sym_add_sym().
330 */
331 if (sdp->sd_isc && sdp->sd_isc->is_osdesc)
332 ndx = sdp->sd_isc->is_osdesc->os_identndx;
333 else
334 ndx = sdp->sd_shndx;
335 } else
336 ndx = ofl->ofl_parexpnndx;
337 } else
338 ndx = sdp->sd_symndx;
339
340 /*
341 * If we have a replacement value for the relocation
342 * target, put it in place now.
343 */
344 if (orsp->rel_flags & FLG_REL_NADDEND) {
345 Xword addend = orsp->rel_raddend;
346 uchar_t *addr;
347
348 /*
349 * Get the address of the data item we need to modify.
350 */
351 addr = (uchar_t *)((uintptr_t)orsp->rel_roffset +
352 (uintptr_t)_elf_getxoff(orsp->rel_isdesc->is_indata));
353 addr += (uintptr_t)RELAUX_GET_OSDESC(orsp)->os_outdata->d_buf;
354 if (ld_reloc_targval_set(ofl, orsp, addr, addend) == 0)
355 return (S_ERROR);
356 }
357
358 if ((orsp->rel_rtype != M_R_NONE) &&
359 (orsp->rel_rtype != M_R_RELATIVE)) {
360 if (ndx == 0) {
361 Conv_inv_buf_t inv_buf;
362 Is_desc *isp = orsp->rel_isdesc;
363
364 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_REL_NOSYMBOL),
365 conv_reloc_type(ofl->ofl_nehdr->e_machine,
366 orsp->rel_rtype, 0, &inv_buf),
367 isp->is_file->ifl_name, EC_WORD(isp->is_scnndx),
368 isp->is_name, EC_XWORD(roffset));
369 return (S_ERROR);
370 }
371 }
372
373 rea.r_info = ELF_R_INFO(ndx, orsp->rel_rtype);
374 rea.r_offset = roffset;
375 DBG_CALL(Dbg_reloc_out(ofl, ELF_DBG_LD, SHT_REL, &rea, relosp->os_name,
376 ld_reloc_sym_name(orsp)));
377
378 /*
379 * Assert we haven't walked off the end of our relocation table.
380 */
381 assert(relosp->os_szoutrels <= relosp->os_shdr->sh_size);
382
383 relbits = (char *)relosp->os_outdata->d_buf;
384
385 (void) memcpy((relbits + relosp->os_szoutrels),
386 (char *)&rea, sizeof (Rel));
387 relosp->os_szoutrels += sizeof (Rel);
388
389 /*
390 * Determine if this relocation is against a non-writable, allocatable
391 * section. If so we may need to provide a text relocation diagnostic.
392 * Note that relocations against the .plt (R_386_JMP_SLOT) actually
393 * result in modifications to the .got.
394 */
395 if (orsp->rel_rtype == R_386_JMP_SLOT)
396 osp = ofl->ofl_osgot;
397
398 ld_reloc_remain_entry(orsp, osp, ofl, remain_seen);
399 return (1);
400 }
401
402 /*
403 * i386 Instructions for TLS processing
404 */
405 static uchar_t tlsinstr_gd_ie[] = {
406 /*
407 * 0x00 movl %gs:0x0, %eax
408 */
409 0x65, 0xa1, 0x00, 0x00, 0x00, 0x00,
410 /*
411 * 0x06 addl x(%eax), %eax
412 * 0x0c ...
413 */
414 0x03, 0x80, 0x00, 0x00, 0x00, 0x00
415 };
416
417 static uchar_t tlsinstr_gd_le[] = {
418 /*
419 * 0x00 movl %gs:0x0, %eax
420 */
421 0x65, 0xa1, 0x00, 0x00, 0x00, 0x00,
422 /*
423 * 0x06 addl $0x0, %eax
424 */
425 0x05, 0x00, 0x00, 0x00, 0x00,
426 /*
427 * 0x0b nop
428 * 0x0c
429 */
430 0x90
431 };
432
433 static uchar_t tlsinstr_ld_le_movgs[] = {
434 /*
435 * 0x00 movl %gs:0x0,%eax
436 */
437 0x65, 0xa1, 0x00, 0x00, 0x00, 0x00,
438 };
439
440 /*
441 * 0x00 nopl 0(%eax,%eax) -- the intel recommended 5-byte nop
442 * See Intel® 64 and IA-32 Architectures Software Developer’s Manual
443 * Volume 2B: Instruction Set Reference, M-U
444 * Table 4-12, Recommended Multi-Byte Sequence of NOP Instruction
445 */
446 static uchar_t tlsinstr_nop5[] = {
447
448 0x0f, 0x1f, 0x44, 0x00, 0x00
449 };
450
451 #define TLS_GD_IE_MOV 0x8b /* movl opcode */
452 #define TLS_GD_IE_POP 0x58 /* popl + reg */
453
454 #define TLS_GD_LE_MOVL 0xb8 /* movl + reg */
455
456 #define TLS_NOP 0x90 /* NOP instruction */
457
458 #define MODRM_MSK_MOD 0xc0
459 #define MODRM_MSK_RO 0x38
460 #define MODRM_MSK_RM 0x07
461
462 #define SIB_MSK_SS 0xc0
463 #define SIB_MSK_IND 0x38
464 #define SIB_MSK_BS 0x07
465
466 static Fixupret
tls_fixups(Ofl_desc * ofl,Rel_desc * arsp)467 tls_fixups(Ofl_desc *ofl, Rel_desc *arsp)
468 {
469 Sym_desc *sdp = arsp->rel_sym;
470 Word rtype = arsp->rel_rtype;
471 uchar_t *offset, r1, r2;
472
473 offset = (uchar_t *)((uintptr_t)arsp->rel_roffset +
474 (uintptr_t)_elf_getxoff(arsp->rel_isdesc->is_indata) +
475 (uintptr_t)RELAUX_GET_OSDESC(arsp)->os_outdata->d_buf);
476
477 if (sdp->sd_ref == REF_DYN_NEED) {
478 /*
479 * IE reference model
480 */
481 switch (rtype) {
482 case R_386_TLS_GD:
483 /*
484 * Transition:
485 * 0x0 leal x@tlsgd(,r1,1), %eax
486 * 0x7 call ___tls_get_addr
487 * 0xc
488 * To:
489 * 0x0 movl %gs:0, %eax
490 * 0x6 addl x@gotntpoff(r1), %eax
491 */
492 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
493 R_386_TLS_GOTIE, arsp, ld_reloc_sym_name));
494 arsp->rel_rtype = R_386_TLS_GOTIE;
495 arsp->rel_roffset += 5;
496
497 /*
498 * Adjust 'offset' to beginning of instruction
499 * sequence.
500 */
501 offset -= 3;
502 r1 = (offset[2] & SIB_MSK_IND) >> 3;
503 (void) memcpy(offset, tlsinstr_gd_ie,
504 sizeof (tlsinstr_gd_ie));
505
506 /*
507 * set register %r1 into the addl
508 * instruction.
509 */
510 offset[0x7] |= r1;
511 return (FIX_RELOC);
512
513 case R_386_TLS_GD_PLT:
514 /*
515 * Fixup done via the TLS_GD relocation
516 */
517 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
518 R_386_NONE, arsp, ld_reloc_sym_name));
519 return (FIX_DONE);
520 }
521 }
522
523 /*
524 * LE reference model
525 */
526 switch (rtype) {
527 case R_386_TLS_GD:
528 /*
529 * Transition:
530 * 0x0 leal x@tlsgd(,r1,1), %eax
531 * 0x7 call ___tls_get_addr
532 * 0xc
533 * To:
534 * 0x0 movl %gs:0, %eax
535 * 0x6 addl $x@ntpoff, %eax
536 * 0xb nop
537 * 0xc
538 */
539 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
540 R_386_TLS_LE, arsp, ld_reloc_sym_name));
541
542 arsp->rel_rtype = R_386_TLS_LE;
543 arsp->rel_roffset += 4;
544
545 /*
546 * Adjust 'offset' to beginning of instruction
547 * sequence.
548 */
549 offset -= 3;
550 (void) memcpy(offset, tlsinstr_gd_le,
551 sizeof (tlsinstr_gd_le));
552 return (FIX_RELOC);
553
554 case R_386_TLS_GD_PLT:
555 case R_386_PLT32:
556 /*
557 * Fixup done via the TLS_GD/TLS_LDM relocation processing
558 * and ld_reloc_plt() handling __tls_get_addr().
559 */
560 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
561 R_386_NONE, arsp, ld_reloc_sym_name));
562 return (FIX_DONE);
563
564 case R_386_TLS_LDM_PLT:
565 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
566 R_386_NONE, arsp, ld_reloc_sym_name));
567
568 /*
569 * Transition:
570 * call __tls_get_addr()
571 * to:
572 * nopl 0x0(%eax,%eax)
573 */
574 (void) memcpy(offset - 1, tlsinstr_nop5,
575 sizeof (tlsinstr_nop5));
576 return (FIX_DONE);
577
578 case R_386_TLS_LDM:
579 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
580 R_386_NONE, arsp, ld_reloc_sym_name));
581
582 /*
583 * Transition:
584 *
585 * 0x00 leal x1@tlsldm(%ebx), %eax
586 * 0x06 call ___tls_get_addr
587 *
588 * to:
589 *
590 * 0x00 movl %gs:0, %eax
591 */
592 (void) memcpy(offset - 2, tlsinstr_ld_le_movgs,
593 sizeof (tlsinstr_ld_le_movgs));
594
595 /*
596 * We implicitly treat this as if a R_386_TLS_LDM_PLT for the
597 * __tls_get_addr call followed it as the GNU compiler
598 * doesn't generate one. This is safe, because if one _does_
599 * exist we'll just write the nop again.
600 */
601 (void) memcpy(offset + 4, tlsinstr_nop5,
602 sizeof (tlsinstr_nop5));
603 return (FIX_DONE);
604
605 case R_386_TLS_LDO_32:
606 /*
607 * Instructions:
608 *
609 * 0x10 leal x1@dtpoff(%eax), %edx R_386_TLS_LDO_32
610 * to
611 * 0x10 leal x1@ntpoff(%eax), %edx R_386_TLS_LE
612 *
613 */
614 offset -= 2;
615
616 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
617 R_386_TLS_LE, arsp, ld_reloc_sym_name));
618 arsp->rel_rtype = R_386_TLS_LE;
619 return (FIX_RELOC);
620
621 case R_386_TLS_GOTIE:
622 /*
623 * These transitions are a little different than the
624 * others, in that we could have multiple instructions
625 * pointed to by a single relocation. Depending upon the
626 * instruction, we perform a different code transition.
627 *
628 * Here's the known transitions:
629 *
630 * 1) movl foo@gotntpoff(%reg1), %reg2
631 * 0x8b, 0x80 | (reg2 << 3) | reg1, foo@gotntpoff
632 *
633 * 2) addl foo@gotntpoff(%reg1), %reg2
634 * 0x03, 0x80 | (reg2 << 3) | reg1, foo@gotntpoff
635 *
636 * Transitions IE -> LE
637 *
638 * 1) movl $foo@ntpoff, %reg2
639 * 0xc7, 0xc0 | reg2, foo@ntpoff
640 *
641 * 2) addl $foo@ntpoff, %reg2
642 * 0x81, 0xc0 | reg2, foo@ntpoff
643 *
644 * Note: reg1 != 4 (%esp)
645 */
646 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
647 R_386_TLS_LE, arsp, ld_reloc_sym_name));
648 arsp->rel_rtype = R_386_TLS_LE;
649
650 offset -= 2;
651 r2 = (offset[1] & MODRM_MSK_RO) >> 3;
652 if (offset[0] == 0x8b) {
653 /* case 1 above */
654 offset[0] = 0xc7; /* movl */
655 offset[1] = 0xc0 | r2;
656 return (FIX_RELOC);
657 }
658
659 if (offset[0] == 0x03) {
660 /* case 2 above */
661 assert(offset[0] == 0x03);
662 offset[0] = 0x81; /* addl */
663 offset[1] = 0xc0 | r2;
664 return (FIX_RELOC);
665 }
666
667 /*
668 * Unexpected instruction sequence - fatal error.
669 */
670 {
671 Conv_inv_buf_t inv_buf;
672
673 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_REL_BADTLSINS),
674 conv_reloc_386_type(arsp->rel_rtype, 0, &inv_buf),
675 arsp->rel_isdesc->is_file->ifl_name,
676 ld_reloc_sym_name(arsp),
677 arsp->rel_isdesc->is_name,
678 EC_OFF(arsp->rel_roffset));
679 }
680 return (FIX_ERROR);
681
682 case R_386_TLS_IE:
683 /*
684 * These transitions are a little different than the
685 * others, in that we could have multiple instructions
686 * pointed to by a single relocation. Depending upon the
687 * instruction, we perform a different code transition.
688 *
689 * Here's the known transitions:
690 * 1) movl foo@indntpoff, %eax
691 * 0xa1, foo@indntpoff
692 *
693 * 2) movl foo@indntpoff, %eax
694 * 0x8b, 0x05 | (reg << 3), foo@gotntpoff
695 *
696 * 3) addl foo@indntpoff, %eax
697 * 0x03, 0x05 | (reg << 3), foo@gotntpoff
698 *
699 * Transitions IE -> LE
700 *
701 * 1) movl $foo@ntpoff, %eax
702 * 0xb8, foo@ntpoff
703 *
704 * 2) movl $foo@ntpoff, %reg
705 * 0xc7, 0xc0 | reg, foo@ntpoff
706 *
707 * 3) addl $foo@ntpoff, %reg
708 * 0x81, 0xc0 | reg, foo@ntpoff
709 */
710 arsp->rel_rtype = R_386_TLS_LE;
711 offset--;
712 if (offset[0] == 0xa1) {
713 /* case 1 above */
714 offset[0] = 0xb8; /* movl */
715 return (FIX_RELOC);
716 }
717
718 offset--;
719 if (offset[0] == 0x8b) {
720 /* case 2 above */
721 r2 = (offset[1] & MODRM_MSK_RO) >> 3;
722 offset[0] = 0xc7; /* movl */
723 offset[1] = 0xc0 | r2;
724 return (FIX_RELOC);
725 }
726 if (offset[0] == 0x03) {
727 /* case 3 above */
728 r2 = (offset[1] & MODRM_MSK_RO) >> 3;
729 offset[0] = 0x81; /* addl */
730 offset[1] = 0xc0 | r2;
731 return (FIX_RELOC);
732 }
733 /*
734 * Unexpected instruction sequence - fatal error.
735 */
736 {
737 Conv_inv_buf_t inv_buf;
738
739 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_REL_BADTLSINS),
740 conv_reloc_386_type(arsp->rel_rtype, 0, &inv_buf),
741 arsp->rel_isdesc->is_file->ifl_name,
742 ld_reloc_sym_name(arsp),
743 arsp->rel_isdesc->is_name,
744 EC_OFF(arsp->rel_roffset));
745 }
746 return (FIX_ERROR);
747 }
748 return (FIX_RELOC);
749 }
750
751 static uintptr_t
ld_do_activerelocs(Ofl_desc * ofl)752 ld_do_activerelocs(Ofl_desc *ofl)
753 {
754 Rel_desc *arsp;
755 Rel_cachebuf *rcbp;
756 Aliste idx;
757 uintptr_t return_code = 1;
758 ofl_flag_t flags = ofl->ofl_flags;
759
760 if (aplist_nitems(ofl->ofl_actrels.rc_list) != 0)
761 DBG_CALL(Dbg_reloc_doact_title(ofl->ofl_lml));
762
763 /*
764 * Process active relocations.
765 */
766 REL_CACHE_TRAVERSE(&ofl->ofl_actrels, idx, rcbp, arsp) {
767 uchar_t *addr;
768 Xword value;
769 Sym_desc *sdp;
770 const char *ifl_name;
771 Xword refaddr;
772 int moved = 0;
773 Gotref gref;
774 Os_desc *osp;
775
776 /*
777 * If the section this relocation is against has been discarded
778 * (-zignore), then discard (skip) the relocation itself.
779 */
780 if ((arsp->rel_isdesc->is_flags & FLG_IS_DISCARD) &&
781 ((arsp->rel_flags & (FLG_REL_GOT | FLG_REL_BSS |
782 FLG_REL_PLT | FLG_REL_NOINFO)) == 0)) {
783 DBG_CALL(Dbg_reloc_discard(ofl->ofl_lml, M_MACH, arsp));
784 continue;
785 }
786
787 /*
788 * We determine what the 'got reference' model (if required)
789 * is at this point. This needs to be done before tls_fixup()
790 * since it may 'transition' our instructions.
791 *
792 * The got table entries have already been assigned,
793 * and we bind to those initial entries.
794 */
795 if (arsp->rel_flags & FLG_REL_DTLS)
796 gref = GOT_REF_TLSGD;
797 else if (arsp->rel_flags & FLG_REL_MTLS)
798 gref = GOT_REF_TLSLD;
799 else if (arsp->rel_flags & FLG_REL_STLS)
800 gref = GOT_REF_TLSIE;
801 else
802 gref = GOT_REF_GENERIC;
803
804 /*
805 * Perform any required TLS fixups.
806 */
807 if (arsp->rel_flags & FLG_REL_TLSFIX) {
808 Fixupret ret;
809
810 if ((ret = tls_fixups(ofl, arsp)) == FIX_ERROR)
811 return (S_ERROR);
812 if (ret == FIX_DONE)
813 continue;
814 }
815
816 /*
817 * If this is a relocation against a move table, or
818 * expanded move table, adjust the relocation entries.
819 */
820 if (RELAUX_GET_MOVE(arsp))
821 ld_adj_movereloc(ofl, arsp);
822
823 sdp = arsp->rel_sym;
824 refaddr = arsp->rel_roffset +
825 (Off)_elf_getxoff(arsp->rel_isdesc->is_indata);
826
827 if (arsp->rel_flags & FLG_REL_CLVAL)
828 value = 0;
829 else if (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION) {
830 /*
831 * The value for a symbol pointing to a SECTION
832 * is based off of that sections position.
833 */
834 if (sdp->sd_isc->is_flags & FLG_IS_RELUPD) {
835 Sym_desc *sym;
836 Xword radd;
837 uchar_t *raddr = (uchar_t *)
838 arsp->rel_isdesc->is_indata->d_buf +
839 arsp->rel_roffset;
840
841 /*
842 * This is a REL platform. Hence, the second
843 * argument of ld_am_I_partial() is the value
844 * stored at the target address where the
845 * relocation is going to be applied.
846 */
847 if (ld_reloc_targval_get(ofl, arsp, raddr,
848 &radd) == 0)
849 return (S_ERROR);
850 sym = ld_am_I_partial(arsp, radd);
851 if (sym) {
852 Sym *osym = sym->sd_osym;
853
854 /*
855 * The symbol was moved, so adjust the
856 * value relative to the new section.
857 */
858 value = sym->sd_sym->st_value;
859 moved = 1;
860
861 /*
862 * The original raddend covers the
863 * displacement from the section start
864 * to the desired address. The value
865 * computed above gets us from the
866 * section start to the start of the
867 * symbol range. Adjust the old raddend
868 * to remove the offset from section
869 * start to symbol start, leaving the
870 * displacement within the range of
871 * the symbol.
872 */
873 if (osym->st_value != 0) {
874 radd -= osym->st_value;
875 if (ld_reloc_targval_set(ofl,
876 arsp, raddr, radd) == 0)
877 return (S_ERROR);
878 }
879 }
880 }
881 if (!moved) {
882 value = _elf_getxoff(sdp->sd_isc->is_indata);
883 if (sdp->sd_isc->is_shdr->sh_flags & SHF_ALLOC)
884 value += sdp->sd_isc->
885 is_osdesc->os_shdr->sh_addr;
886 }
887 if (sdp->sd_isc->is_shdr->sh_flags & SHF_TLS)
888 value -= ofl->ofl_tlsphdr->p_vaddr;
889
890 } else if (IS_SIZE(arsp->rel_rtype)) {
891 /*
892 * Size relocations require the symbols size.
893 */
894 value = sdp->sd_sym->st_size;
895
896 } else if ((sdp->sd_flags & FLG_SY_CAP) &&
897 sdp->sd_aux && sdp->sd_aux->sa_PLTndx) {
898 /*
899 * If relocation is against a capabilities symbol, we
900 * need to jump to an associated PLT, so that at runtime
901 * ld.so.1 is involved to determine the best binding
902 * choice. Otherwise, the value is the symbols value.
903 */
904 value = ld_calc_plt_addr(sdp, ofl);
905
906 } else
907 value = sdp->sd_sym->st_value;
908
909 /*
910 * Relocation against the GLOBAL_OFFSET_TABLE.
911 */
912 if ((arsp->rel_flags & FLG_REL_GOT) &&
913 !ld_reloc_set_aux_osdesc(ofl, arsp, ofl->ofl_osgot))
914 return (S_ERROR);
915 osp = RELAUX_GET_OSDESC(arsp);
916
917 /*
918 * If loadable and not producing a relocatable object add the
919 * sections virtual address to the reference address.
920 */
921 if ((arsp->rel_flags & FLG_REL_LOAD) &&
922 ((flags & FLG_OF_RELOBJ) == 0))
923 refaddr +=
924 arsp->rel_isdesc->is_osdesc->os_shdr->sh_addr;
925
926 /*
927 * If this entry has a PLT assigned to it, its value is actually
928 * the address of the PLT (and not the address of the function).
929 */
930 if (IS_PLT(arsp->rel_rtype)) {
931 if (sdp->sd_aux && sdp->sd_aux->sa_PLTndx)
932 value = ld_calc_plt_addr(sdp, ofl);
933 }
934
935 /*
936 * Determine whether the value needs further adjustment. Filter
937 * through the attributes of the relocation to determine what
938 * adjustment is required. Note, many of the following cases
939 * are only applicable when a .got is present. As a .got is
940 * not generated when a relocatable object is being built,
941 * any adjustments that require a .got need to be skipped.
942 */
943 if ((arsp->rel_flags & FLG_REL_GOT) &&
944 ((flags & FLG_OF_RELOBJ) == 0)) {
945 Xword R1addr;
946 uintptr_t R2addr;
947 Word gotndx;
948 Gotndx *gnp;
949
950 /*
951 * Perform relocation against GOT table. Since this
952 * doesn't fit exactly into a relocation we place the
953 * appropriate byte in the GOT directly
954 *
955 * Calculate offset into GOT at which to apply
956 * the relocation.
957 */
958 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, NULL);
959 assert(gnp);
960
961 if (arsp->rel_rtype == R_386_TLS_DTPOFF32)
962 gotndx = gnp->gn_gotndx + 1;
963 else
964 gotndx = gnp->gn_gotndx;
965
966 R1addr = (Xword)(gotndx * M_GOT_ENTSIZE);
967
968 /*
969 * Add the GOTs data's offset.
970 */
971 R2addr = R1addr + (uintptr_t)osp->os_outdata->d_buf;
972
973 DBG_CALL(Dbg_reloc_doact(ofl->ofl_lml, ELF_DBG_LD_ACT,
974 M_MACH, SHT_REL, arsp, R1addr, value,
975 ld_reloc_sym_name));
976
977 /*
978 * And do it.
979 */
980 if (ofl->ofl_flags1 & FLG_OF1_ENCDIFF)
981 *(Xword *)R2addr = ld_bswap_Xword(value);
982 else
983 *(Xword *)R2addr = value;
984 continue;
985
986 } else if (IS_GOT_BASED(arsp->rel_rtype) &&
987 ((flags & FLG_OF_RELOBJ) == 0)) {
988 value -= ofl->ofl_osgot->os_shdr->sh_addr;
989
990 } else if (IS_GOT_PC(arsp->rel_rtype) &&
991 ((flags & FLG_OF_RELOBJ) == 0)) {
992 value = (Xword)(ofl->ofl_osgot->os_shdr->sh_addr) -
993 refaddr;
994
995 } else if ((IS_PC_RELATIVE(arsp->rel_rtype)) &&
996 (((flags & FLG_OF_RELOBJ) == 0) ||
997 (osp == sdp->sd_isc->is_osdesc))) {
998 value -= refaddr;
999
1000 } else if (IS_TLS_INS(arsp->rel_rtype) &&
1001 IS_GOT_RELATIVE(arsp->rel_rtype) &&
1002 ((flags & FLG_OF_RELOBJ) == 0)) {
1003 Gotndx *gnp;
1004
1005 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, NULL);
1006 assert(gnp);
1007 value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE;
1008 if (arsp->rel_rtype == R_386_TLS_IE) {
1009 value += ofl->ofl_osgot->os_shdr->sh_addr;
1010 }
1011
1012 } else if (IS_GOT_RELATIVE(arsp->rel_rtype) &&
1013 ((flags & FLG_OF_RELOBJ) == 0)) {
1014 Gotndx *gnp;
1015
1016 gnp = ld_find_got_ndx(sdp->sd_GOTndxs,
1017 GOT_REF_GENERIC, ofl, NULL);
1018 assert(gnp);
1019 value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE;
1020
1021 } else if ((arsp->rel_flags & FLG_REL_STLS) &&
1022 ((flags & FLG_OF_RELOBJ) == 0)) {
1023 Xword tlsstatsize;
1024
1025 /*
1026 * This is the LE TLS reference model. Static
1027 * offset is hard-coded.
1028 */
1029 tlsstatsize = S_ROUND(ofl->ofl_tlsphdr->p_memsz,
1030 M_TLSSTATALIGN);
1031 value = tlsstatsize - value;
1032
1033 /*
1034 * Since this code is fixed up, it assumes a
1035 * negative offset that can be added to the
1036 * thread pointer.
1037 */
1038 if ((arsp->rel_rtype == R_386_TLS_LDO_32) ||
1039 (arsp->rel_rtype == R_386_TLS_LE))
1040 value = -value;
1041 }
1042
1043 if (arsp->rel_isdesc->is_file)
1044 ifl_name = arsp->rel_isdesc->is_file->ifl_name;
1045 else
1046 ifl_name = MSG_INTL(MSG_STR_NULL);
1047
1048 /*
1049 * Make sure we have data to relocate. Compiler and assembler
1050 * developers have been known to generate relocations against
1051 * invalid sections (normally .bss), so for their benefit give
1052 * them sufficient information to help analyze the problem.
1053 * End users should never see this.
1054 */
1055 if (arsp->rel_isdesc->is_indata->d_buf == 0) {
1056 Conv_inv_buf_t inv_buf;
1057
1058 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_REL_EMPTYSEC),
1059 conv_reloc_386_type(arsp->rel_rtype, 0, &inv_buf),
1060 ifl_name, ld_reloc_sym_name(arsp),
1061 EC_WORD(arsp->rel_isdesc->is_scnndx),
1062 arsp->rel_isdesc->is_name);
1063 return (S_ERROR);
1064 }
1065
1066 /*
1067 * Get the address of the data item we need to modify.
1068 */
1069 addr = (uchar_t *)((uintptr_t)arsp->rel_roffset +
1070 (uintptr_t)_elf_getxoff(arsp->rel_isdesc->is_indata));
1071
1072 DBG_CALL(Dbg_reloc_doact(ofl->ofl_lml, ELF_DBG_LD_ACT,
1073 M_MACH, SHT_REL, arsp, EC_NATPTR(addr), value,
1074 ld_reloc_sym_name));
1075 addr += (uintptr_t)osp->os_outdata->d_buf;
1076
1077 if ((((uintptr_t)addr - (uintptr_t)ofl->ofl_nehdr) >
1078 ofl->ofl_size) || (arsp->rel_roffset >
1079 osp->os_shdr->sh_size)) {
1080 Conv_inv_buf_t inv_buf;
1081 int class;
1082
1083 if (((uintptr_t)addr - (uintptr_t)ofl->ofl_nehdr) >
1084 ofl->ofl_size)
1085 class = ERR_FATAL;
1086 else
1087 class = ERR_WARNING;
1088
1089 ld_eprintf(ofl, class, MSG_INTL(MSG_REL_INVALOFFSET),
1090 conv_reloc_386_type(arsp->rel_rtype, 0, &inv_buf),
1091 ifl_name, EC_WORD(arsp->rel_isdesc->is_scnndx),
1092 arsp->rel_isdesc->is_name, ld_reloc_sym_name(arsp),
1093 EC_ADDR((uintptr_t)addr -
1094 (uintptr_t)ofl->ofl_nehdr));
1095
1096 if (class == ERR_FATAL) {
1097 return_code = S_ERROR;
1098 continue;
1099 }
1100 }
1101
1102 /*
1103 * The relocation is additive. Ignore the previous symbol
1104 * value if this local partial symbol is expanded.
1105 */
1106 if (moved)
1107 value -= *addr;
1108
1109 /*
1110 * If we have a replacement value for the relocation
1111 * target, put it in place now.
1112 */
1113 if (arsp->rel_flags & FLG_REL_NADDEND) {
1114 Xword addend = arsp->rel_raddend;
1115
1116 if (ld_reloc_targval_set(ofl, arsp, addr, addend) == 0)
1117 return (S_ERROR);
1118 }
1119
1120 /*
1121 * If '-z noreloc' is specified - skip the do_reloc_ld stage.
1122 */
1123 if (OFL_DO_RELOC(ofl)) {
1124 if (do_reloc_ld(arsp, addr, &value, ld_reloc_sym_name,
1125 ifl_name, OFL_SWAP_RELOC_DATA(ofl, arsp),
1126 ofl->ofl_lml) == 0) {
1127 ofl->ofl_flags |= FLG_OF_FATAL;
1128 return_code = S_ERROR;
1129 }
1130 }
1131 }
1132 return (return_code);
1133 }
1134
1135 /*
1136 * Add an output relocation record.
1137 */
1138 static uintptr_t
ld_add_outrel(Word flags,Rel_desc * rsp,Ofl_desc * ofl)1139 ld_add_outrel(Word flags, Rel_desc *rsp, Ofl_desc *ofl)
1140 {
1141 Rel_desc *orsp;
1142 Sym_desc *sdp = rsp->rel_sym;
1143
1144 /*
1145 * Static executables *do not* want any relocations against them.
1146 * Since our engine still creates relocations against a WEAK UNDEFINED
1147 * symbol in a static executable, it's best to disable them here
1148 * instead of through out the relocation code.
1149 */
1150 if (OFL_IS_STATIC_EXEC(ofl))
1151 return (1);
1152
1153 /*
1154 * If the symbol will be reduced, we can't leave outstanding
1155 * relocations against it, as nothing will ever be able to satisfy them
1156 * (and the symbol won't be in .dynsym
1157 */
1158 if ((sdp != NULL) &&
1159 (sdp->sd_sym->st_shndx == SHN_UNDEF) &&
1160 (rsp->rel_rtype != M_R_NONE) &&
1161 (rsp->rel_rtype != M_R_RELATIVE)) {
1162 if (ld_sym_reducable(ofl, sdp))
1163 return (1);
1164 }
1165
1166 /*
1167 * If we are adding a output relocation against a section
1168 * symbol (non-RELATIVE) then mark that section. These sections
1169 * will be added to the .dynsym symbol table.
1170 */
1171 if (sdp && (rsp->rel_rtype != M_R_RELATIVE) &&
1172 ((flags & FLG_REL_SCNNDX) ||
1173 (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION))) {
1174
1175 /*
1176 * If this is a COMMON symbol - no output section
1177 * exists yet - (it's created as part of sym_validate()).
1178 * So - we mark here that when it's created it should
1179 * be tagged with the FLG_OS_OUTREL flag.
1180 */
1181 if ((sdp->sd_flags & FLG_SY_SPECSEC) &&
1182 (sdp->sd_sym->st_shndx == SHN_COMMON)) {
1183 if (ELF_ST_TYPE(sdp->sd_sym->st_info) != STT_TLS)
1184 ofl->ofl_flags1 |= FLG_OF1_BSSOREL;
1185 else
1186 ofl->ofl_flags1 |= FLG_OF1_TLSOREL;
1187 } else {
1188 Os_desc *osp;
1189 Is_desc *isp = sdp->sd_isc;
1190
1191 if (isp && ((osp = isp->is_osdesc) != NULL) &&
1192 ((osp->os_flags & FLG_OS_OUTREL) == 0)) {
1193 ofl->ofl_dynshdrcnt++;
1194 osp->os_flags |= FLG_OS_OUTREL;
1195 }
1196 }
1197 }
1198
1199 /* Enter it into the output relocation cache */
1200 if ((orsp = ld_reloc_enter(ofl, &ofl->ofl_outrels, rsp, flags)) == NULL)
1201 return (S_ERROR);
1202
1203 if (flags & FLG_REL_GOT)
1204 ofl->ofl_relocgotsz += (Xword)sizeof (Rel);
1205 else if (flags & FLG_REL_PLT)
1206 ofl->ofl_relocpltsz += (Xword)sizeof (Rel);
1207 else if (flags & FLG_REL_BSS)
1208 ofl->ofl_relocbsssz += (Xword)sizeof (Rel);
1209 else if (flags & FLG_REL_NOINFO)
1210 ofl->ofl_relocrelsz += (Xword)sizeof (Rel);
1211 else
1212 RELAUX_GET_OSDESC(orsp)->os_szoutrels += (Xword)sizeof (Rel);
1213
1214 if (orsp->rel_rtype == M_R_RELATIVE)
1215 ofl->ofl_relocrelcnt++;
1216
1217 /*
1218 * We don't perform sorting on PLT relocations because
1219 * they have already been assigned a PLT index and if we
1220 * were to sort them we would have to re-assign the plt indexes.
1221 */
1222 if (!(flags & FLG_REL_PLT))
1223 ofl->ofl_reloccnt++;
1224
1225 /*
1226 * Insure a GLOBAL_OFFSET_TABLE is generated if required.
1227 */
1228 if (IS_GOT_REQUIRED(orsp->rel_rtype))
1229 ofl->ofl_flags |= FLG_OF_BLDGOT;
1230
1231 /*
1232 * Identify and possibly warn of a displacement relocation.
1233 */
1234 if (orsp->rel_flags & FLG_REL_DISP) {
1235 ofl->ofl_dtflags_1 |= DF_1_DISPRELPND;
1236
1237 if (ofl->ofl_flags & FLG_OF_VERBOSE)
1238 ld_disp_errmsg(MSG_INTL(MSG_REL_DISPREL4), orsp, ofl);
1239 }
1240 DBG_CALL(Dbg_reloc_ors_entry(ofl->ofl_lml, ELF_DBG_LD, SHT_REL,
1241 M_MACH, orsp));
1242 return (1);
1243 }
1244
1245 /*
1246 * process relocation for a LOCAL symbol
1247 */
1248 static uintptr_t
ld_reloc_local(Rel_desc * rsp,Ofl_desc * ofl)1249 ld_reloc_local(Rel_desc * rsp, Ofl_desc * ofl)
1250 {
1251 ofl_flag_t flags = ofl->ofl_flags;
1252 Sym_desc *sdp = rsp->rel_sym;
1253 Word shndx = sdp->sd_sym->st_shndx;
1254
1255 /*
1256 * if ((shared object) and (not pc relative relocation) and
1257 * (not against ABS symbol))
1258 * then
1259 * build R_386_RELATIVE
1260 * fi
1261 */
1262 if ((flags & FLG_OF_SHAROBJ) && (rsp->rel_flags & FLG_REL_LOAD) &&
1263 !(IS_PC_RELATIVE(rsp->rel_rtype)) && !(IS_SIZE(rsp->rel_rtype)) &&
1264 !(IS_GOT_BASED(rsp->rel_rtype)) &&
1265 !(rsp->rel_isdesc != NULL &&
1266 (rsp->rel_isdesc->is_shdr->sh_type == SHT_SUNW_dof)) &&
1267 (((sdp->sd_flags & FLG_SY_SPECSEC) == 0) ||
1268 (shndx != SHN_ABS) || (sdp->sd_aux && sdp->sd_aux->sa_symspec))) {
1269 Word ortype = rsp->rel_rtype;
1270
1271 rsp->rel_rtype = R_386_RELATIVE;
1272 if (ld_add_outrel(0, rsp, ofl) == S_ERROR)
1273 return (S_ERROR);
1274 rsp->rel_rtype = ortype;
1275 }
1276
1277 /*
1278 * If the relocation is against a 'non-allocatable' section
1279 * and we can not resolve it now - then give a warning
1280 * message.
1281 *
1282 * We can not resolve the symbol if either:
1283 * a) it's undefined
1284 * b) it's defined in a shared library and a
1285 * COPY relocation hasn't moved it to the executable
1286 *
1287 * Note: because we process all of the relocations against the
1288 * text segment before any others - we know whether
1289 * or not a copy relocation will be generated before
1290 * we get here (see reloc_init()->reloc_segments()).
1291 */
1292 if (!(rsp->rel_flags & FLG_REL_LOAD) &&
1293 ((shndx == SHN_UNDEF) ||
1294 ((sdp->sd_ref == REF_DYN_NEED) &&
1295 ((sdp->sd_flags & FLG_SY_MVTOCOMM) == 0)))) {
1296 Conv_inv_buf_t inv_buf;
1297 Os_desc *osp = RELAUX_GET_OSDESC(rsp);
1298
1299 /*
1300 * If the relocation is against a SHT_SUNW_ANNOTATE
1301 * section - then silently ignore that the relocation
1302 * can not be resolved.
1303 */
1304 if (osp && (osp->os_shdr->sh_type == SHT_SUNW_ANNOTATE))
1305 return (0);
1306 ld_eprintf(ofl, ERR_WARNING, MSG_INTL(MSG_REL_EXTERNSYM),
1307 conv_reloc_386_type(rsp->rel_rtype, 0, &inv_buf),
1308 rsp->rel_isdesc->is_file->ifl_name,
1309 ld_reloc_sym_name(rsp), osp->os_name);
1310 return (1);
1311 }
1312
1313 /*
1314 * Perform relocation.
1315 */
1316 return (ld_add_actrel(0, rsp, ofl));
1317 }
1318
1319 static uintptr_t
ld_reloc_TLS(Boolean local,Rel_desc * rsp,Ofl_desc * ofl)1320 ld_reloc_TLS(Boolean local, Rel_desc * rsp, Ofl_desc * ofl)
1321 {
1322 Word rtype = rsp->rel_rtype;
1323 Sym_desc *sdp = rsp->rel_sym;
1324 ofl_flag_t flags = ofl->ofl_flags;
1325 Gotndx *gnp;
1326
1327 /*
1328 * If we're building an executable - use either the IE or LE access
1329 * model. If we're building a shared object process any IE model.
1330 */
1331 if ((flags & FLG_OF_EXEC) || (IS_TLS_IE(rtype))) {
1332 /*
1333 * Set the DF_STATIC_TLS flag.
1334 */
1335 ofl->ofl_dtflags |= DF_STATIC_TLS;
1336
1337 if (!local || ((flags & FLG_OF_EXEC) == 0)) {
1338 /*
1339 * Assign a GOT entry for static TLS references.
1340 */
1341 if ((gnp = ld_find_got_ndx(sdp->sd_GOTndxs,
1342 GOT_REF_TLSIE, ofl, NULL)) == NULL) {
1343
1344 if (ld_assign_got_TLS(local, rsp, ofl, sdp,
1345 gnp, GOT_REF_TLSIE, FLG_REL_STLS,
1346 rtype, R_386_TLS_TPOFF, 0) == S_ERROR)
1347 return (S_ERROR);
1348 }
1349
1350 /*
1351 * IE access model.
1352 */
1353 if (IS_TLS_IE(rtype)) {
1354 if (ld_add_actrel(FLG_REL_STLS,
1355 rsp, ofl) == S_ERROR)
1356 return (S_ERROR);
1357
1358 /*
1359 * A non-pic shared object needs to adjust the
1360 * active relocation (indntpoff).
1361 */
1362 if (((flags & FLG_OF_EXEC) == 0) &&
1363 (rtype == R_386_TLS_IE)) {
1364 rsp->rel_rtype = R_386_RELATIVE;
1365 return (ld_add_outrel(0, rsp, ofl));
1366 }
1367 return (1);
1368 }
1369
1370 /*
1371 * Fixups are required for other executable models.
1372 */
1373 return (ld_add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS),
1374 rsp, ofl));
1375 }
1376
1377 /*
1378 * LE access model.
1379 */
1380 if (IS_TLS_LE(rtype) || (rtype == R_386_TLS_LDO_32))
1381 return (ld_add_actrel(FLG_REL_STLS, rsp, ofl));
1382
1383 return (ld_add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS),
1384 rsp, ofl));
1385 }
1386
1387 /*
1388 * Building a shared object.
1389 *
1390 * Assign a GOT entry for a dynamic TLS reference.
1391 */
1392 if (IS_TLS_LD(rtype) && ((gnp = ld_find_got_ndx(sdp->sd_GOTndxs,
1393 GOT_REF_TLSLD, ofl, NULL)) == NULL)) {
1394
1395 if (ld_assign_got_TLS(local, rsp, ofl, sdp, gnp, GOT_REF_TLSLD,
1396 FLG_REL_MTLS, rtype, R_386_TLS_DTPMOD32, 0) == S_ERROR)
1397 return (S_ERROR);
1398
1399 } else if (IS_TLS_GD(rtype) && ((gnp = ld_find_got_ndx(sdp->sd_GOTndxs,
1400 GOT_REF_TLSGD, ofl, NULL)) == NULL)) {
1401
1402 if (ld_assign_got_TLS(local, rsp, ofl, sdp, gnp, GOT_REF_TLSGD,
1403 FLG_REL_DTLS, rtype, R_386_TLS_DTPMOD32,
1404 R_386_TLS_DTPOFF32) == S_ERROR)
1405 return (S_ERROR);
1406 }
1407
1408 /*
1409 * For GD/LD TLS reference - TLS_{GD,LD}_CALL, this will eventually
1410 * cause a call to __tls_get_addr(). Convert this relocation to that
1411 * symbol now, and prepare for the PLT magic.
1412 */
1413 if ((rtype == R_386_TLS_GD_PLT) || (rtype == R_386_TLS_LDM_PLT)) {
1414 Sym_desc *tlsgetsym;
1415
1416 if ((tlsgetsym = ld_sym_add_u(MSG_ORIG(MSG_SYM_TLSGETADDR_UU),
1417 ofl, MSG_STR_TLSREL)) == (Sym_desc *)S_ERROR)
1418 return (S_ERROR);
1419
1420 rsp->rel_sym = tlsgetsym;
1421 rsp->rel_rtype = R_386_PLT32;
1422
1423 if (ld_reloc_plt(rsp, ofl) == S_ERROR)
1424 return (S_ERROR);
1425
1426 rsp->rel_sym = sdp;
1427 rsp->rel_rtype = rtype;
1428 return (1);
1429 }
1430
1431 if (IS_TLS_LD(rtype))
1432 return (ld_add_actrel(FLG_REL_MTLS, rsp, ofl));
1433
1434 return (ld_add_actrel(FLG_REL_DTLS, rsp, ofl));
1435 }
1436
1437 /* ARGSUSED4 */
1438 static uintptr_t
ld_assign_got_ndx(Alist ** alpp,Gotndx * pgnp,Gotref gref,Ofl_desc * ofl,Rel_desc * rsp,Sym_desc * sdp)1439 ld_assign_got_ndx(Alist **alpp, Gotndx *pgnp, Gotref gref, Ofl_desc *ofl,
1440 Rel_desc *rsp, Sym_desc *sdp)
1441 {
1442 Gotndx gn, *gnp;
1443 uint_t gotents;
1444
1445 if (pgnp)
1446 return (1);
1447
1448 if ((gref == GOT_REF_TLSGD) || (gref == GOT_REF_TLSLD))
1449 gotents = 2;
1450 else
1451 gotents = 1;
1452
1453 gn.gn_addend = 0;
1454 gn.gn_gotndx = ofl->ofl_gotcnt;
1455 gn.gn_gotref = gref;
1456
1457 ofl->ofl_gotcnt += gotents;
1458
1459 if (gref == GOT_REF_TLSLD) {
1460 if (ofl->ofl_tlsldgotndx == NULL) {
1461 if ((gnp = libld_malloc(sizeof (Gotndx))) == NULL)
1462 return (S_ERROR);
1463 (void) memcpy(gnp, &gn, sizeof (Gotndx));
1464 ofl->ofl_tlsldgotndx = gnp;
1465 }
1466 return (1);
1467 }
1468
1469 /*
1470 * GOT indexes are maintained on an Alist, where there is typically
1471 * only one index. The usage of this list is to scan the list to find
1472 * an index, and then apply that index immediately to a relocation.
1473 * Thus there are no external references to these GOT index structures
1474 * that can be compromised by the Alist being reallocated.
1475 */
1476 if (alist_append(alpp, &gn, sizeof (Gotndx), AL_CNT_SDP_GOT) == NULL)
1477 return (S_ERROR);
1478
1479 return (1);
1480 }
1481
1482 static void
ld_assign_plt_ndx(Sym_desc * sdp,Ofl_desc * ofl)1483 ld_assign_plt_ndx(Sym_desc * sdp, Ofl_desc *ofl)
1484 {
1485 sdp->sd_aux->sa_PLTndx = 1 + ofl->ofl_pltcnt++;
1486 sdp->sd_aux->sa_PLTGOTndx = ofl->ofl_gotcnt++;
1487 ofl->ofl_flags |= FLG_OF_BLDGOT;
1488 }
1489
1490 /*
1491 * Initializes .got[0] with the _DYNAMIC symbol value.
1492 */
1493 static uintptr_t
ld_fillin_gotplt(Ofl_desc * ofl)1494 ld_fillin_gotplt(Ofl_desc *ofl)
1495 {
1496 ofl_flag_t flags = ofl->ofl_flags;
1497 int bswap = (ofl->ofl_flags1 & FLG_OF1_ENCDIFF) != 0;
1498
1499 if (ofl->ofl_osgot) {
1500 Sym_desc *sdp;
1501
1502 if ((sdp = ld_sym_find(MSG_ORIG(MSG_SYM_DYNAMIC_U),
1503 SYM_NOHASH, NULL, ofl)) != NULL) {
1504 uchar_t *genptr;
1505
1506 genptr = ((uchar_t *)ofl->ofl_osgot->os_outdata->d_buf +
1507 (M_GOT_XDYNAMIC * M_GOT_ENTSIZE));
1508 /* LINTED */
1509 *(Word *)genptr = (Word)sdp->sd_sym->st_value;
1510 if (bswap)
1511 /* LINTED */
1512 *(Word *)genptr =
1513 /* LINTED */
1514 ld_bswap_Word(*(Word *)genptr);
1515 }
1516 }
1517
1518 /*
1519 * Fill in the reserved slot in the procedure linkage table the first
1520 * entry is:
1521 * if (building executable) {
1522 * PUSHL got[1] # the address of the link map entry
1523 * JMP * got[2] # the address of rtbinder
1524 * } else {
1525 * PUSHL got[1]@GOT(%ebx) # the address of the link map entry
1526 * JMP * got[2]@GOT(%ebx) # the address of rtbinder
1527 * }
1528 */
1529 if ((flags & FLG_OF_DYNAMIC) && ofl->ofl_osplt) {
1530 uchar_t *pltent;
1531
1532 pltent = (uchar_t *)ofl->ofl_osplt->os_outdata->d_buf;
1533 if (!(flags & FLG_OF_SHAROBJ)) {
1534 pltent[0] = M_SPECIAL_INST;
1535 pltent[1] = M_PUSHL_DISP;
1536 pltent += 2;
1537 /* LINTED */
1538 *(Word *)pltent = (Word)(ofl->ofl_osgot->os_shdr->
1539 sh_addr + M_GOT_XLINKMAP * M_GOT_ENTSIZE);
1540 if (bswap)
1541 /* LINTED */
1542 *(Word *)pltent =
1543 /* LINTED */
1544 ld_bswap_Word(*(Word *)pltent);
1545 pltent += 4;
1546 pltent[0] = M_SPECIAL_INST;
1547 pltent[1] = M_JMP_DISP_IND;
1548 pltent += 2;
1549 /* LINTED */
1550 *(Word *)pltent = (Word)(ofl->ofl_osgot->os_shdr->
1551 sh_addr + M_GOT_XRTLD * M_GOT_ENTSIZE);
1552 if (bswap)
1553 /* LINTED */
1554 *(Word *)pltent =
1555 /* LINTED */
1556 ld_bswap_Word(*(Word *)pltent);
1557 } else {
1558 pltent[0] = M_SPECIAL_INST;
1559 pltent[1] = M_PUSHL_REG_DISP;
1560 pltent += 2;
1561 /* LINTED */
1562 *(Word *)pltent = (Word)(M_GOT_XLINKMAP *
1563 M_GOT_ENTSIZE);
1564 if (bswap)
1565 /* LINTED */
1566 *(Word *)pltent =
1567 /* LINTED */
1568 ld_bswap_Word(*(Word *)pltent);
1569 pltent += 4;
1570 pltent[0] = M_SPECIAL_INST;
1571 pltent[1] = M_JMP_REG_DISP_IND;
1572 pltent += 2;
1573 /* LINTED */
1574 *(Word *)pltent = (Word)(M_GOT_XRTLD *
1575 M_GOT_ENTSIZE);
1576 if (bswap)
1577 /* LINTED */
1578 *(Word *)pltent =
1579 /* LINTED */
1580 ld_bswap_Word(*(Word *)pltent);
1581 }
1582 }
1583 return (1);
1584 }
1585
1586
1587
1588 /*
1589 * Template for generating "void (*)(void)" function
1590 */
1591 static const uchar_t nullfunc_tmpl[] = { /* IA32 */
1592 /* 0x00 */ 0xc3 /* ret */
1593 };
1594
1595
1596
1597 /*
1598 * Function used to provide fill padding in SHF_EXECINSTR sections
1599 *
1600 * entry:
1601 *
1602 * base - base address of section being filled
1603 * offset - starting offset for fill within memory referenced by base
1604 * cnt - # bytes to be filled
1605 *
1606 * exit:
1607 * The fill has been completed.
1608 */
1609 static void
execfill(void * base,off_t off,size_t cnt)1610 execfill(void *base, off_t off, size_t cnt)
1611 {
1612 /*
1613 * 0x90 is an X86 NOP instruction in both 32 and 64-bit worlds.
1614 * There are no alignment constraints.
1615 */
1616 (void) memset(off + (char *)base, 0x90, cnt);
1617 }
1618
1619
1620 /*
1621 * Return the ld_targ definition for this target.
1622 */
1623 const Target *
ld_targ_init_x86(void)1624 ld_targ_init_x86(void)
1625 {
1626 static const Target _ld_targ = {
1627 { /* Target_mach */
1628 M_MACH, /* m_mach */
1629 M_MACHPLUS, /* m_machplus */
1630 M_FLAGSPLUS, /* m_flagsplus */
1631 M_CLASS, /* m_class */
1632 M_DATA, /* m_data */
1633
1634 M_SEGM_ALIGN, /* m_segm_align */
1635 M_SEGM_ORIGIN, /* m_segm_origin */
1636 M_SEGM_AORIGIN, /* m_segm_aorigin */
1637 M_DATASEG_PERM, /* m_dataseg_perm */
1638 M_STACK_PERM, /* m_stack_perm */
1639 M_WORD_ALIGN, /* m_word_align */
1640 MSG_ORIG(MSG_PTH_RTLD), /* m_def_interp */
1641
1642 /* Relocation type codes */
1643 M_R_ARRAYADDR, /* m_r_arrayaddr */
1644 M_R_COPY, /* m_r_copy */
1645 M_R_GLOB_DAT, /* m_r_glob_dat */
1646 M_R_JMP_SLOT, /* m_r_jmp_slot */
1647 M_R_NUM, /* m_r_num */
1648 M_R_NONE, /* m_r_none */
1649 M_R_RELATIVE, /* m_r_relative */
1650 M_R_REGISTER, /* m_r_register */
1651
1652 /* Relocation related constants */
1653 M_REL_DT_COUNT, /* m_rel_dt_count */
1654 M_REL_DT_ENT, /* m_rel_dt_ent */
1655 M_REL_DT_SIZE, /* m_rel_dt_size */
1656 M_REL_DT_TYPE, /* m_rel_dt_type */
1657 M_REL_SHT_TYPE, /* m_rel_sht_type */
1658
1659 /* GOT related constants */
1660 M_GOT_ENTSIZE, /* m_got_entsize */
1661 M_GOT_XNumber, /* m_got_xnumber */
1662
1663 /* PLT related constants */
1664 M_PLT_ALIGN, /* m_plt_align */
1665 M_PLT_ENTSIZE, /* m_plt_entsize */
1666 M_PLT_RESERVSZ, /* m_plt_reservsz */
1667 M_PLT_SHF_FLAGS, /* m_plt_shf_flags */
1668
1669 /* Section type of .eh_frame/.eh_frame_hdr sections */
1670 SHT_PROGBITS, /* m_sht_unwind */
1671
1672 M_DT_REGISTER, /* m_dt_register */
1673 },
1674 { /* Target_machid */
1675 M_ID_ARRAY, /* id_array */
1676 M_ID_BSS, /* id_bss */
1677 M_ID_CAP, /* id_cap */
1678 M_ID_CAPINFO, /* id_capinfo */
1679 M_ID_CAPCHAIN, /* id_capchain */
1680 M_ID_DATA, /* id_data */
1681 M_ID_DYNAMIC, /* id_dynamic */
1682 M_ID_DYNSORT, /* id_dynsort */
1683 M_ID_DYNSTR, /* id_dynstr */
1684 M_ID_DYNSYM, /* id_dynsym */
1685 M_ID_DYNSYM_NDX, /* id_dynsym_ndx */
1686 M_ID_GOT, /* id_got */
1687 M_ID_UNKNOWN, /* id_gotdata (unused) */
1688 M_ID_HASH, /* id_hash */
1689 M_ID_INTERP, /* id_interp */
1690 M_ID_LBSS, /* id_lbss */
1691 M_ID_LDYNSYM, /* id_ldynsym */
1692 M_ID_NOTE, /* id_note */
1693 M_ID_NULL, /* id_null */
1694 M_ID_PLT, /* id_plt */
1695 M_ID_REL, /* id_rel */
1696 M_ID_STRTAB, /* id_strtab */
1697 M_ID_SYMINFO, /* id_syminfo */
1698 M_ID_SYMTAB, /* id_symtab */
1699 M_ID_SYMTAB_NDX, /* id_symtab_ndx */
1700 M_ID_TEXT, /* id_text */
1701 M_ID_TLS, /* id_tls */
1702 M_ID_TLSBSS, /* id_tlsbss */
1703 M_ID_UNKNOWN, /* id_unknown */
1704 M_ID_UNWIND, /* id_unwind */
1705 M_ID_UNWINDHDR, /* id_unwindhdr */
1706 M_ID_USER, /* id_user */
1707 M_ID_VERSION, /* id_version */
1708 },
1709 { /* Target_nullfunc */
1710 nullfunc_tmpl, /* nf_template */
1711 sizeof (nullfunc_tmpl), /* nf_size */
1712 },
1713 { /* Target_fillfunc */
1714 execfill /* ff_execfill */
1715 },
1716 { /* Target_machrel */
1717 reloc_table,
1718
1719 ld_init_rel, /* mr_init_rel */
1720 ld_mach_eflags, /* mr_mach_eflags */
1721 ld_mach_make_dynamic, /* mr_mach_make_dynamic */
1722 ld_mach_update_odynamic, /* mr_mach_update_odynamic */
1723 ld_calc_plt_addr, /* mr_calc_plt_addr */
1724 ld_perform_outreloc, /* mr_perform_outreloc */
1725 ld_do_activerelocs, /* mr_do_activerelocs */
1726 ld_add_outrel, /* mr_add_outrel */
1727 NULL, /* mr_reloc_register */
1728 ld_reloc_local, /* mr_reloc_local */
1729 NULL, /* mr_reloc_GOTOP */
1730 ld_reloc_TLS, /* mr_reloc_TLS */
1731 NULL, /* mr_assign_got */
1732 ld_find_got_ndx, /* mr_find_got_ndx */
1733 ld_calc_got_offset, /* mr_calc_got_offset */
1734 ld_assign_got_ndx, /* mr_assign_got_ndx */
1735 ld_assign_plt_ndx, /* mr_assign_plt_ndx */
1736 NULL, /* mr_allocate_got */
1737 ld_fillin_gotplt, /* mr_fillin_gotplt */
1738 },
1739 { /* Target_machsym */
1740 NULL, /* ms_reg_check */
1741 NULL, /* ms_mach_sym_typecheck */
1742 NULL, /* ms_is_regsym */
1743 NULL, /* ms_reg_find */
1744 NULL /* ms_reg_enter */
1745 }
1746 };
1747
1748 return (&_ld_targ);
1749 }
1750