1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright 1996, 1997, 1998, 1999 John D. Polstra. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 * 27 * $FreeBSD$ 28 */ 29 30 /* 31 * Dynamic linker for ELF. 32 * 33 * John Polstra <jdp@polstra.com>. 34 */ 35 36 #include <sys/param.h> 37 #include <sys/mman.h> 38 #include <machine/segments.h> 39 #include <machine/sysarch.h> 40 41 #include <dlfcn.h> 42 #include <err.h> 43 #include <errno.h> 44 #include <fcntl.h> 45 #include <stdarg.h> 46 #include <stdio.h> 47 #include <stdlib.h> 48 #include <string.h> 49 #include <unistd.h> 50 51 #include "debug.h" 52 #include "rtld.h" 53 #include "rtld_tls.h" 54 55 /* 56 * Process the special R_386_COPY relocations in the main program. These 57 * copy data from a shared object into a region in the main program's BSS 58 * segment. 59 * 60 * Returns 0 on success, -1 on failure. 61 */ 62 int 63 do_copy_relocations(Obj_Entry *dstobj) 64 { 65 const Elf_Rel *rellim; 66 const Elf_Rel *rel; 67 68 assert(dstobj->mainprog); /* COPY relocations are invalid elsewhere */ 69 70 rellim = (const Elf_Rel *) ((caddr_t) dstobj->rel + dstobj->relsize); 71 for (rel = dstobj->rel; rel < rellim; rel++) { 72 if (ELF_R_TYPE(rel->r_info) == R_386_COPY) { 73 void *dstaddr; 74 const Elf_Sym *dstsym; 75 const char *name; 76 size_t size; 77 const void *srcaddr; 78 const Elf_Sym *srcsym; 79 const Obj_Entry *srcobj, *defobj; 80 SymLook req; 81 int res; 82 83 dstaddr = (void *) (dstobj->relocbase + rel->r_offset); 84 dstsym = dstobj->symtab + ELF_R_SYM(rel->r_info); 85 name = dstobj->strtab + dstsym->st_name; 86 size = dstsym->st_size; 87 symlook_init(&req, name); 88 req.ventry = fetch_ventry(dstobj, ELF_R_SYM(rel->r_info)); 89 req.flags = SYMLOOK_EARLY; 90 91 for (srcobj = globallist_next(dstobj); srcobj != NULL; 92 srcobj = globallist_next(srcobj)) { 93 res = symlook_obj(&req, srcobj); 94 if (res == 0) { 95 srcsym = req.sym_out; 96 defobj = req.defobj_out; 97 break; 98 } 99 } 100 101 if (srcobj == NULL) { 102 _rtld_error("Undefined symbol \"%s\" referenced from COPY" 103 " relocation in %s", name, dstobj->path); 104 return -1; 105 } 106 107 srcaddr = (const void *) (defobj->relocbase + srcsym->st_value); 108 memcpy(dstaddr, srcaddr, size); 109 } 110 } 111 112 return 0; 113 } 114 115 /* Initialize the special GOT entries. */ 116 void 117 init_pltgot(Obj_Entry *obj) 118 { 119 if (obj->pltgot != NULL) { 120 obj->pltgot[1] = (Elf_Addr) obj; 121 obj->pltgot[2] = (Elf_Addr) &_rtld_bind_start; 122 } 123 } 124 125 /* Process the non-PLT relocations. */ 126 int 127 reloc_non_plt(Obj_Entry *obj, Obj_Entry *obj_rtld, int flags, 128 RtldLockState *lockstate) 129 { 130 const Elf_Rel *rellim; 131 const Elf_Rel *rel; 132 SymCache *cache; 133 const Elf_Sym *def; 134 const Obj_Entry *defobj; 135 Elf_Addr *where, symval, add; 136 int r; 137 138 r = -1; 139 /* 140 * The dynamic loader may be called from a thread, we have 141 * limited amounts of stack available so we cannot use alloca(). 142 */ 143 if (obj != obj_rtld) { 144 cache = calloc(obj->dynsymcount, sizeof(SymCache)); 145 /* No need to check for NULL here */ 146 } else 147 cache = NULL; 148 149 rellim = (const Elf_Rel *)((caddr_t) obj->rel + obj->relsize); 150 for (rel = obj->rel; rel < rellim; rel++) { 151 switch (ELF_R_TYPE(rel->r_info)) { 152 case R_386_32: 153 case R_386_PC32: 154 case R_386_GLOB_DAT: 155 case R_386_TLS_TPOFF: 156 case R_386_TLS_TPOFF32: 157 case R_386_TLS_DTPMOD32: 158 case R_386_TLS_DTPOFF32: 159 def = find_symdef(ELF_R_SYM(rel->r_info), obj, &defobj, 160 flags, cache, lockstate); 161 if (def == NULL) 162 goto done; 163 if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) { 164 switch (ELF_R_TYPE(rel->r_info)) { 165 case R_386_32: 166 case R_386_PC32: 167 case R_386_GLOB_DAT: 168 if ((flags & SYMLOOK_IFUNC) == 0) { 169 obj->non_plt_gnu_ifunc = true; 170 continue; 171 } 172 symval = (Elf_Addr)rtld_resolve_ifunc( 173 defobj, def); 174 break; 175 case R_386_TLS_TPOFF: 176 case R_386_TLS_TPOFF32: 177 case R_386_TLS_DTPMOD32: 178 case R_386_TLS_DTPOFF32: 179 _rtld_error("%s: IFUNC for TLS reloc", 180 obj->path); 181 goto done; 182 } 183 } else { 184 if ((flags & SYMLOOK_IFUNC) != 0) 185 continue; 186 symval = (Elf_Addr)defobj->relocbase + 187 def->st_value; 188 } 189 break; 190 default: 191 if ((flags & SYMLOOK_IFUNC) != 0) 192 continue; 193 break; 194 } 195 where = (Elf_Addr *)(obj->relocbase + rel->r_offset); 196 197 switch (ELF_R_TYPE(rel->r_info)) { 198 case R_386_NONE: 199 break; 200 case R_386_32: 201 *where += symval; 202 break; 203 case R_386_PC32: 204 /* 205 * I don't think the dynamic linker should ever 206 * see this type of relocation. But the 207 * binutils-2.6 tools sometimes generate it. 208 */ 209 *where += symval - (Elf_Addr)where; 210 break; 211 case R_386_COPY: 212 /* 213 * These are deferred until all other 214 * relocations have been done. All we do here 215 * is make sure that the COPY relocation is 216 * not in a shared library. They are allowed 217 * only in executable files. 218 */ 219 if (!obj->mainprog) { 220 _rtld_error("%s: Unexpected R_386_COPY " 221 "relocation in shared library", obj->path); 222 goto done; 223 } 224 break; 225 case R_386_GLOB_DAT: 226 *where = symval; 227 break; 228 case R_386_RELATIVE: 229 *where += (Elf_Addr)obj->relocbase; 230 break; 231 case R_386_TLS_TPOFF: 232 case R_386_TLS_TPOFF32: 233 /* 234 * We lazily allocate offsets for static TLS 235 * as we see the first relocation that 236 * references the TLS block. This allows us to 237 * support (small amounts of) static TLS in 238 * dynamically loaded modules. If we run out 239 * of space, we generate an error. 240 */ 241 if (!defobj->tls_done) { 242 if (!allocate_tls_offset((Obj_Entry*) defobj)) { 243 _rtld_error("%s: No space available " 244 "for static Thread Local Storage", 245 obj->path); 246 goto done; 247 } 248 } 249 add = (Elf_Addr)(def->st_value - defobj->tlsoffset); 250 if (ELF_R_TYPE(rel->r_info) == R_386_TLS_TPOFF) 251 *where += add; 252 else 253 *where -= add; 254 break; 255 case R_386_TLS_DTPMOD32: 256 *where += (Elf_Addr)defobj->tlsindex; 257 break; 258 case R_386_TLS_DTPOFF32: 259 *where += (Elf_Addr) def->st_value; 260 break; 261 default: 262 _rtld_error("%s: Unsupported relocation type %d" 263 " in non-PLT relocations\n", obj->path, 264 ELF_R_TYPE(rel->r_info)); 265 goto done; 266 } 267 } 268 r = 0; 269 done: 270 free(cache); 271 return (r); 272 } 273 274 /* Process the PLT relocations. */ 275 int 276 reloc_plt(Obj_Entry *obj) 277 { 278 const Elf_Rel *rellim; 279 const Elf_Rel *rel; 280 281 rellim = (const Elf_Rel *)((char *)obj->pltrel + obj->pltrelsize); 282 for (rel = obj->pltrel; rel < rellim; rel++) { 283 Elf_Addr *where/*, val*/; 284 285 switch (ELF_R_TYPE(rel->r_info)) { 286 case R_386_JMP_SLOT: 287 /* Relocate the GOT slot pointing into the PLT. */ 288 where = (Elf_Addr *)(obj->relocbase + rel->r_offset); 289 *where += (Elf_Addr)obj->relocbase; 290 break; 291 292 case R_386_IRELATIVE: 293 obj->irelative = true; 294 break; 295 296 default: 297 _rtld_error("Unknown relocation type %x in PLT", 298 ELF_R_TYPE(rel->r_info)); 299 return (-1); 300 } 301 } 302 return 0; 303 } 304 305 /* Relocate the jump slots in an object. */ 306 int 307 reloc_jmpslots(Obj_Entry *obj, int flags, RtldLockState *lockstate) 308 { 309 const Elf_Rel *rellim; 310 const Elf_Rel *rel; 311 312 if (obj->jmpslots_done) 313 return 0; 314 rellim = (const Elf_Rel *)((char *)obj->pltrel + obj->pltrelsize); 315 for (rel = obj->pltrel; rel < rellim; rel++) { 316 Elf_Addr *where, target; 317 const Elf_Sym *def; 318 const Obj_Entry *defobj; 319 320 switch (ELF_R_TYPE(rel->r_info)) { 321 case R_386_JMP_SLOT: 322 where = (Elf_Addr *)(obj->relocbase + rel->r_offset); 323 def = find_symdef(ELF_R_SYM(rel->r_info), obj, &defobj, 324 SYMLOOK_IN_PLT | flags, NULL, lockstate); 325 if (def == NULL) 326 return (-1); 327 if (ELF_ST_TYPE(def->st_info) == STT_GNU_IFUNC) { 328 obj->gnu_ifunc = true; 329 continue; 330 } 331 target = (Elf_Addr)(defobj->relocbase + def->st_value); 332 reloc_jmpslot(where, target, defobj, obj, rel); 333 break; 334 335 case R_386_IRELATIVE: 336 break; 337 338 default: 339 _rtld_error("Unknown relocation type %x in PLT", 340 ELF_R_TYPE(rel->r_info)); 341 return (-1); 342 } 343 } 344 345 obj->jmpslots_done = true; 346 return 0; 347 } 348 349 /* Fixup the jump slot at "where" to transfer control to "target". */ 350 Elf_Addr 351 reloc_jmpslot(Elf_Addr *where, Elf_Addr target, 352 const struct Struct_Obj_Entry *obj, const struct Struct_Obj_Entry *refobj, 353 const Elf_Rel *rel) 354 { 355 #ifdef dbg 356 dbg("reloc_jmpslot: *%p = %p", where, (void *)target); 357 #endif 358 if (!ld_bind_not) 359 *where = target; 360 return (target); 361 } 362 363 int 364 reloc_iresolve(Obj_Entry *obj, RtldLockState *lockstate) 365 { 366 const Elf_Rel *rellim; 367 const Elf_Rel *rel; 368 Elf_Addr *where, target; 369 370 if (!obj->irelative) 371 return (0); 372 rellim = (const Elf_Rel *)((char *)obj->pltrel + obj->pltrelsize); 373 for (rel = obj->pltrel; rel < rellim; rel++) { 374 switch (ELF_R_TYPE(rel->r_info)) { 375 case R_386_IRELATIVE: 376 where = (Elf_Addr *)(obj->relocbase + rel->r_offset); 377 lock_release(rtld_bind_lock, lockstate); 378 target = call_ifunc_resolver(obj->relocbase + *where); 379 wlock_acquire(rtld_bind_lock, lockstate); 380 *where = target; 381 break; 382 } 383 } 384 obj->irelative = false; 385 return (0); 386 } 387 388 int 389 reloc_gnu_ifunc(Obj_Entry *obj, int flags, RtldLockState *lockstate) 390 { 391 const Elf_Rel *rellim; 392 const Elf_Rel *rel; 393 394 if (!obj->gnu_ifunc) 395 return (0); 396 rellim = (const Elf_Rel *)((char *)obj->pltrel + obj->pltrelsize); 397 for (rel = obj->pltrel; rel < rellim; rel++) { 398 Elf_Addr *where, target; 399 const Elf_Sym *def; 400 const Obj_Entry *defobj; 401 402 switch (ELF_R_TYPE(rel->r_info)) { 403 case R_386_JMP_SLOT: 404 where = (Elf_Addr *)(obj->relocbase + rel->r_offset); 405 def = find_symdef(ELF_R_SYM(rel->r_info), obj, &defobj, 406 SYMLOOK_IN_PLT | flags, NULL, lockstate); 407 if (def == NULL) 408 return (-1); 409 if (ELF_ST_TYPE(def->st_info) != STT_GNU_IFUNC) 410 continue; 411 lock_release(rtld_bind_lock, lockstate); 412 target = (Elf_Addr)rtld_resolve_ifunc(defobj, def); 413 wlock_acquire(rtld_bind_lock, lockstate); 414 reloc_jmpslot(where, target, defobj, obj, rel); 415 break; 416 } 417 } 418 419 obj->gnu_ifunc = false; 420 return (0); 421 } 422 423 uint32_t cpu_feature, cpu_feature2, cpu_stdext_feature, cpu_stdext_feature2; 424 425 static void 426 rtld_cpuid_count(int idx, int cnt, u_int *p) 427 { 428 429 __asm __volatile( 430 " pushl %%ebx\n" 431 " cpuid\n" 432 " movl %%ebx,%1\n" 433 " popl %%ebx\n" 434 : "=a" (p[0]), "=r" (p[1]), "=c" (p[2]), "=d" (p[3]) 435 : "0" (idx), "2" (cnt)); 436 } 437 438 void 439 ifunc_init(Elf_Auxinfo aux_info[__min_size(AT_COUNT)] __unused) 440 { 441 u_int p[4], cpu_high; 442 int cpuid_supported; 443 444 __asm __volatile( 445 " pushfl\n" 446 " popl %%eax\n" 447 " movl %%eax,%%ecx\n" 448 " xorl $0x200000,%%eax\n" 449 " pushl %%eax\n" 450 " popfl\n" 451 " pushfl\n" 452 " popl %%eax\n" 453 " xorl %%eax,%%ecx\n" 454 " je 1f\n" 455 " movl $1,%0\n" 456 " jmp 2f\n" 457 "1: movl $0,%0\n" 458 "2:\n" 459 : "=r" (cpuid_supported) : : "eax", "ecx"); 460 if (!cpuid_supported) 461 return; 462 463 rtld_cpuid_count(1, 0, p); 464 cpu_feature = p[3]; 465 cpu_feature2 = p[2]; 466 rtld_cpuid_count(0, 0, p); 467 cpu_high = p[0]; 468 if (cpu_high >= 7) { 469 rtld_cpuid_count(7, 0, p); 470 cpu_stdext_feature = p[1]; 471 cpu_stdext_feature2 = p[2]; 472 } 473 } 474 475 void 476 allocate_initial_tls(Obj_Entry *objs) 477 { 478 void* tls; 479 480 /* 481 * Fix the size of the static TLS block by using the maximum 482 * offset allocated so far and adding a bit for dynamic modules to 483 * use. 484 */ 485 tls_static_space = tls_last_offset + RTLD_STATIC_TLS_EXTRA; 486 tls = allocate_tls(objs, NULL, 3*sizeof(Elf_Addr), sizeof(Elf_Addr)); 487 i386_set_gsbase(tls); 488 } 489 490 /* GNU ABI */ 491 __attribute__((__regparm__(1))) 492 void *___tls_get_addr(tls_index *ti) 493 { 494 Elf_Addr** segbase; 495 496 __asm __volatile("movl %%gs:0, %0" : "=r" (segbase)); 497 498 return tls_get_addr_common(&segbase[1], ti->ti_module, ti->ti_offset); 499 } 500 501 /* Sun ABI */ 502 void *__tls_get_addr(tls_index *ti) 503 { 504 Elf_Addr** segbase; 505 506 __asm __volatile("movl %%gs:0, %0" : "=r" (segbase)); 507 508 return tls_get_addr_common(&segbase[1], ti->ti_module, ti->ti_offset); 509 } 510