1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved. 24 */ 25 26 /* Get the x86 version of the relocation engine */ 27 #define DO_RELOC_LIBLD_X86 28 29 #include <string.h> 30 #include <stdio.h> 31 #include <strings.h> 32 #include <sys/elf_amd64.h> 33 #include <debug.h> 34 #include <reloc.h> 35 #include <i386/machdep_x86.h> 36 #include "msg.h" 37 #include "_libld.h" 38 39 /* 40 * This module uses do_reloc_ld() to execute several synthesized relocations. 41 * That function expects to be passed two things that we need to construct 42 * here: 43 * 44 * 1) A Rel_desc descriptor for each relocation type, from which the 45 * rel_rtype field, and nothing else, is obtained. This is easily 46 * handled by constructing the necessary descriptors. 47 * 48 * 2) A function, which called with the Rel_desc descriptor, returns 49 * a string representing the name of the symbol associated with 50 * the descriptor. The usual function for this is ld_reloc_sym_name(). 51 * However, that function will not work in this case, as these synthetic 52 * relocations do not have an associated symbol. We supply the 53 * syn_rdesc_sym_name() function to simply return the fixed name. 54 */ 55 static Rel_desc rdesc_r_amd64_gotpcrel = { 56 NULL, NULL, NULL, 0, 0, 0, R_AMD64_GOTPCREL }; 57 static Rel_desc rdesc_r_amd64_32 = { 58 NULL, NULL, NULL, 0, 0, 0, R_AMD64_32 }; 59 static Rel_desc rdesc_r_amd64_pc32 = { 60 NULL, NULL, NULL, 0, 0, 0, R_AMD64_PC32 }; 61 62 /*ARGSUSED*/ 63 static const char * 64 syn_rdesc_sym_name(Rel_desc *rdesc) 65 { 66 return (MSG_ORIG(MSG_SYM_PLTENT)); 67 } 68 69 /* 70 * Search the GOT index list for a GOT entry with a matching reference and the 71 * proper addend. 72 */ 73 static Gotndx * 74 ld_find_got_ndx(Alist *alp, Gotref gref, Ofl_desc *ofl, Rel_desc *rdesc) 75 { 76 Aliste idx; 77 Gotndx *gnp; 78 79 assert(rdesc != 0); 80 81 if ((gref == GOT_REF_TLSLD) && ofl->ofl_tlsldgotndx) 82 return (ofl->ofl_tlsldgotndx); 83 84 for (ALIST_TRAVERSE(alp, idx, gnp)) { 85 if ((rdesc->rel_raddend == gnp->gn_addend) && 86 (gnp->gn_gotref == gref)) { 87 return (gnp); 88 } 89 } 90 return (NULL); 91 } 92 93 static Xword 94 ld_calc_got_offset(Rel_desc *rdesc, Ofl_desc *ofl) 95 { 96 Os_desc *osp = ofl->ofl_osgot; 97 Sym_desc *sdp = rdesc->rel_sym; 98 Xword gotndx; 99 Gotref gref; 100 Gotndx *gnp; 101 102 if (rdesc->rel_flags & FLG_REL_DTLS) 103 gref = GOT_REF_TLSGD; 104 else if (rdesc->rel_flags & FLG_REL_MTLS) 105 gref = GOT_REF_TLSLD; 106 else if (rdesc->rel_flags & FLG_REL_STLS) 107 gref = GOT_REF_TLSIE; 108 else 109 gref = GOT_REF_GENERIC; 110 111 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, rdesc); 112 assert(gnp); 113 114 gotndx = (Xword)gnp->gn_gotndx; 115 116 if ((rdesc->rel_flags & FLG_REL_DTLS) && 117 (rdesc->rel_rtype == R_AMD64_DTPOFF64)) 118 gotndx++; 119 120 return ((Xword)(osp->os_shdr->sh_addr + (gotndx * M_GOT_ENTSIZE))); 121 } 122 123 static Word 124 ld_init_rel(Rel_desc *reld, Word *typedata, void *reloc) 125 { 126 Rela *rel = (Rela *)reloc; 127 128 /* LINTED */ 129 reld->rel_rtype = (Word)ELF_R_TYPE(rel->r_info, M_MACH); 130 reld->rel_roffset = rel->r_offset; 131 reld->rel_raddend = rel->r_addend; 132 *typedata = 0; 133 134 reld->rel_flags |= FLG_REL_RELA; 135 136 return ((Word)ELF_R_SYM(rel->r_info)); 137 } 138 139 static void 140 ld_mach_eflags(Ehdr *ehdr, Ofl_desc *ofl) 141 { 142 ofl->ofl_dehdr->e_flags |= ehdr->e_flags; 143 } 144 145 static void 146 ld_mach_make_dynamic(Ofl_desc *ofl, size_t *cnt) 147 { 148 if (!(ofl->ofl_flags & FLG_OF_RELOBJ)) { 149 /* 150 * Create this entry if we are going to create a PLT table. 151 */ 152 if (ofl->ofl_pltcnt) 153 (*cnt)++; /* DT_PLTGOT */ 154 } 155 } 156 157 static void 158 ld_mach_update_odynamic(Ofl_desc *ofl, Dyn **dyn) 159 { 160 if (((ofl->ofl_flags & FLG_OF_RELOBJ) == 0) && ofl->ofl_pltcnt) { 161 (*dyn)->d_tag = DT_PLTGOT; 162 if (ofl->ofl_osgot) 163 (*dyn)->d_un.d_ptr = ofl->ofl_osgot->os_shdr->sh_addr; 164 else 165 (*dyn)->d_un.d_ptr = 0; 166 (*dyn)++; 167 } 168 } 169 170 static Xword 171 ld_calc_plt_addr(Sym_desc *sdp, Ofl_desc *ofl) 172 { 173 Xword value; 174 175 value = (Xword)(ofl->ofl_osplt->os_shdr->sh_addr) + 176 M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) * M_PLT_ENTSIZE); 177 return (value); 178 } 179 180 /* 181 * Build a single plt entry - code is: 182 * JMP *name1@GOTPCREL(%rip) 183 * PUSHL $index 184 * JMP .PLT0 185 */ 186 static uchar_t pltn_entry[M_PLT_ENTSIZE] = { 187 /* 0x00 jmpq *name1@GOTPCREL(%rip) */ 0xff, 0x25, 0x00, 0x00, 0x00, 0x00, 188 /* 0x06 pushq $index */ 0x68, 0x00, 0x00, 0x00, 0x00, 189 /* 0x0b jmpq .plt0(%rip) */ 0xe9, 0x00, 0x00, 0x00, 0x00 190 /* 0x10 */ 191 }; 192 193 static uintptr_t 194 plt_entry(Ofl_desc * ofl, Sym_desc * sdp) 195 { 196 uchar_t *plt0, *pltent, *gotent; 197 Sword plt_off; 198 Word got_off; 199 Xword val1; 200 int bswap = (ofl->ofl_flags1 & FLG_OF1_ENCDIFF) != 0; 201 202 got_off = sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE; 203 plt_off = M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) * 204 M_PLT_ENTSIZE); 205 plt0 = (uchar_t *)(ofl->ofl_osplt->os_outdata->d_buf); 206 pltent = plt0 + plt_off; 207 gotent = (uchar_t *)(ofl->ofl_osgot->os_outdata->d_buf) + got_off; 208 209 bcopy(pltn_entry, pltent, sizeof (pltn_entry)); 210 /* 211 * Fill in the got entry with the address of the next instruction. 212 */ 213 /* LINTED */ 214 *(Word *)gotent = ofl->ofl_osplt->os_shdr->sh_addr + plt_off + 215 M_PLT_INSSIZE; 216 if (bswap) 217 /* LINTED */ 218 *(Word *)gotent = ld_bswap_Word(*(Word *)gotent); 219 220 /* 221 * If '-z noreloc' is specified - skip the do_reloc_ld 222 * stage. 223 */ 224 if (!OFL_DO_RELOC(ofl)) 225 return (1); 226 227 /* 228 * patchup: 229 * jmpq *name1@gotpcrel(%rip) 230 * 231 * NOTE: 0x06 represents next instruction. 232 */ 233 val1 = (ofl->ofl_osgot->os_shdr->sh_addr + got_off) - 234 (ofl->ofl_osplt->os_shdr->sh_addr + plt_off) - 0x06; 235 236 if (do_reloc_ld(&rdesc_r_amd64_gotpcrel, &pltent[0x02], &val1, 237 syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT), bswap, 238 ofl->ofl_lml) == 0) { 239 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLTNFAIL), 240 sdp->sd_aux->sa_PLTndx, demangle(sdp->sd_name)); 241 return (S_ERROR); 242 } 243 244 /* 245 * patchup: 246 * pushq $pltndx 247 */ 248 val1 = (Xword)(sdp->sd_aux->sa_PLTndx - 1); 249 250 if (do_reloc_ld(&rdesc_r_amd64_32, &pltent[0x07], &val1, 251 syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT), bswap, 252 ofl->ofl_lml) == 0) { 253 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLTNFAIL), 254 sdp->sd_aux->sa_PLTndx, demangle(sdp->sd_name)); 255 return (S_ERROR); 256 } 257 258 /* 259 * patchup: 260 * jmpq .plt0(%rip) 261 * NOTE: 0x10 represents next instruction. The rather complex 262 * series of casts is necessary to sign extend an offset into 263 * a 64-bit value while satisfying various compiler error 264 * checks. Handle with care. 265 */ 266 val1 = (Xword)((intptr_t)((uintptr_t)plt0 - 267 (uintptr_t)(&pltent[0x10]))); 268 269 if (do_reloc_ld(&rdesc_r_amd64_pc32, &pltent[0x0c], &val1, 270 syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT), bswap, 271 ofl->ofl_lml) == 0) { 272 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLTNFAIL), 273 sdp->sd_aux->sa_PLTndx, demangle(sdp->sd_name)); 274 return (S_ERROR); 275 } 276 277 return (1); 278 } 279 280 static uintptr_t 281 ld_perform_outreloc(Rel_desc * orsp, Ofl_desc * ofl, Boolean *remain_seen) 282 { 283 Os_desc * relosp, * osp = 0; 284 Word ndx; 285 Xword roffset, value; 286 Sxword raddend; 287 Rela rea; 288 char *relbits; 289 Sym_desc * sdp, * psym = (Sym_desc *)0; 290 int sectmoved = 0; 291 292 raddend = orsp->rel_raddend; 293 sdp = orsp->rel_sym; 294 295 /* 296 * If the section this relocation is against has been discarded 297 * (-zignore), then also discard (skip) the relocation itself. 298 */ 299 if (orsp->rel_isdesc && ((orsp->rel_flags & 300 (FLG_REL_GOT | FLG_REL_BSS | FLG_REL_PLT | FLG_REL_NOINFO)) == 0) && 301 (orsp->rel_isdesc->is_flags & FLG_IS_DISCARD)) { 302 DBG_CALL(Dbg_reloc_discard(ofl->ofl_lml, M_MACH, orsp)); 303 return (1); 304 } 305 306 /* 307 * If this is a relocation against a move table, or expanded move 308 * table, adjust the relocation entries. 309 */ 310 if (RELAUX_GET_MOVE(orsp)) 311 ld_adj_movereloc(ofl, orsp); 312 313 /* 314 * If this is a relocation against a section then we need to adjust the 315 * raddend field to compensate for the new position of the input section 316 * within the new output section. 317 */ 318 if (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION) { 319 if (ofl->ofl_parsyms && 320 (sdp->sd_isc->is_flags & FLG_IS_RELUPD) && 321 /* LINTED */ 322 (psym = ld_am_I_partial(orsp, orsp->rel_raddend))) { 323 DBG_CALL(Dbg_move_outsctadj(ofl->ofl_lml, psym)); 324 sectmoved = 1; 325 if (ofl->ofl_flags & FLG_OF_RELOBJ) 326 raddend = psym->sd_sym->st_value; 327 else 328 raddend = psym->sd_sym->st_value - 329 psym->sd_isc->is_osdesc->os_shdr->sh_addr; 330 /* LINTED */ 331 raddend += (Off)_elf_getxoff(psym->sd_isc->is_indata); 332 if (psym->sd_isc->is_shdr->sh_flags & SHF_ALLOC) 333 raddend += 334 psym->sd_isc->is_osdesc->os_shdr->sh_addr; 335 } else { 336 /* LINTED */ 337 raddend += (Off)_elf_getxoff(sdp->sd_isc->is_indata); 338 if (sdp->sd_isc->is_shdr->sh_flags & SHF_ALLOC) 339 raddend += 340 sdp->sd_isc->is_osdesc->os_shdr->sh_addr; 341 } 342 } 343 344 value = sdp->sd_sym->st_value; 345 346 if (orsp->rel_flags & FLG_REL_GOT) { 347 /* 348 * Note: for GOT relative relocations on amd64 349 * we discard the addend. It was relevant 350 * to the reference - not to the data item 351 * being referenced (ie: that -4 thing). 352 */ 353 raddend = 0; 354 osp = ofl->ofl_osgot; 355 roffset = ld_calc_got_offset(orsp, ofl); 356 357 } else if (orsp->rel_flags & FLG_REL_PLT) { 358 /* 359 * Note that relocations for PLT's actually 360 * cause a relocation againt the GOT. 361 */ 362 osp = ofl->ofl_osplt; 363 roffset = (ofl->ofl_osgot->os_shdr->sh_addr) + 364 sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE; 365 raddend = 0; 366 if (plt_entry(ofl, sdp) == S_ERROR) 367 return (S_ERROR); 368 369 } else if (orsp->rel_flags & FLG_REL_BSS) { 370 /* 371 * This must be a R_AMD64_COPY. For these set the roffset to 372 * point to the new symbols location. 373 */ 374 osp = ofl->ofl_isbss->is_osdesc; 375 roffset = value; 376 377 /* 378 * The raddend doesn't mean anything in a R_SPARC_COPY 379 * relocation. Null it out because it can confuse people. 380 */ 381 raddend = 0; 382 } else { 383 osp = RELAUX_GET_OSDESC(orsp); 384 385 /* 386 * Calculate virtual offset of reference point; equals offset 387 * into section + vaddr of section for loadable sections, or 388 * offset plus section displacement for nonloadable sections. 389 */ 390 roffset = orsp->rel_roffset + 391 (Off)_elf_getxoff(orsp->rel_isdesc->is_indata); 392 if (!(ofl->ofl_flags & FLG_OF_RELOBJ)) 393 roffset += orsp->rel_isdesc->is_osdesc-> 394 os_shdr->sh_addr; 395 } 396 397 if ((osp == 0) || ((relosp = osp->os_relosdesc) == 0)) 398 relosp = ofl->ofl_osrel; 399 400 /* 401 * Assign the symbols index for the output relocation. If the 402 * relocation refers to a SECTION symbol then it's index is based upon 403 * the output sections symbols index. Otherwise the index can be 404 * derived from the symbols index itself. 405 */ 406 if (orsp->rel_rtype == R_AMD64_RELATIVE) 407 ndx = STN_UNDEF; 408 else if ((orsp->rel_flags & FLG_REL_SCNNDX) || 409 (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION)) { 410 if (sectmoved == 0) { 411 /* 412 * Check for a null input section. This can 413 * occur if this relocation references a symbol 414 * generated by sym_add_sym(). 415 */ 416 if (sdp->sd_isc && sdp->sd_isc->is_osdesc) 417 ndx = sdp->sd_isc->is_osdesc->os_identndx; 418 else 419 ndx = sdp->sd_shndx; 420 } else 421 ndx = ofl->ofl_parexpnndx; 422 } else 423 ndx = sdp->sd_symndx; 424 425 /* 426 * Add the symbols 'value' to the addend field. 427 */ 428 if (orsp->rel_flags & FLG_REL_ADVAL) 429 raddend += value; 430 431 /* 432 * The addend field for R_AMD64_DTPMOD64 means nothing. The addend 433 * is propagated in the corresponding R_AMD64_DTPOFF64 relocation. 434 */ 435 if (orsp->rel_rtype == R_AMD64_DTPMOD64) 436 raddend = 0; 437 438 if ((orsp->rel_rtype != M_R_NONE) && 439 (orsp->rel_rtype != M_R_RELATIVE)) { 440 if (ndx == 0) { 441 Conv_inv_buf_t inv_buf; 442 Is_desc *isp = orsp->rel_isdesc; 443 444 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_REL_NOSYMBOL), 445 conv_reloc_type(ofl->ofl_nehdr->e_machine, 446 orsp->rel_rtype, 0, &inv_buf), 447 isp->is_file->ifl_name, EC_WORD(isp->is_scnndx), 448 isp->is_name, EC_XWORD(roffset)); 449 return (S_ERROR); 450 } 451 } 452 453 rea.r_info = ELF_R_INFO(ndx, orsp->rel_rtype); 454 rea.r_offset = roffset; 455 rea.r_addend = raddend; 456 DBG_CALL(Dbg_reloc_out(ofl, ELF_DBG_LD, SHT_RELA, &rea, relosp->os_name, 457 ld_reloc_sym_name(orsp))); 458 459 /* 460 * Assert we haven't walked off the end of our relocation table. 461 */ 462 assert(relosp->os_szoutrels <= relosp->os_shdr->sh_size); 463 464 relbits = (char *)relosp->os_outdata->d_buf; 465 466 (void) memcpy((relbits + relosp->os_szoutrels), 467 (char *)&rea, sizeof (Rela)); 468 relosp->os_szoutrels += (Xword)sizeof (Rela); 469 470 /* 471 * Determine if this relocation is against a non-writable, allocatable 472 * section. If so we may need to provide a text relocation diagnostic. 473 * Note that relocations against the .plt (R_AMD64_JUMP_SLOT) actually 474 * result in modifications to the .got. 475 */ 476 if (orsp->rel_rtype == R_AMD64_JUMP_SLOT) 477 osp = ofl->ofl_osgot; 478 479 ld_reloc_remain_entry(orsp, osp, ofl, remain_seen); 480 return (1); 481 } 482 483 /* 484 * amd64 Instructions for TLS processing 485 */ 486 static uchar_t tlsinstr_gd_ie[] = { 487 /* 488 * 0x00 movq %fs:0, %rax 489 */ 490 0x64, 0x48, 0x8b, 0x04, 0x25, 491 0x00, 0x00, 0x00, 0x00, 492 /* 493 * 0x09 addq x@gottpoff(%rip), %rax 494 */ 495 0x48, 0x03, 0x05, 0x00, 0x00, 496 0x00, 0x00 497 }; 498 499 static uchar_t tlsinstr_gd_le[] = { 500 /* 501 * 0x00 movq %fs:0, %rax 502 */ 503 0x64, 0x48, 0x8b, 0x04, 0x25, 504 0x00, 0x00, 0x00, 0x00, 505 /* 506 * 0x09 leaq x@gottpoff(%rip), %rax 507 */ 508 0x48, 0x8d, 0x80, 0x00, 0x00, 509 0x00, 0x00 510 }; 511 512 static uchar_t tlsinstr_ld_le[] = { 513 /* 514 * .byte 0x66 515 */ 516 0x66, 517 /* 518 * .byte 0x66 519 */ 520 0x66, 521 /* 522 * .byte 0x66 523 */ 524 0x66, 525 /* 526 * movq %fs:0, %rax 527 */ 528 0x64, 0x48, 0x8b, 0x04, 0x25, 529 0x00, 0x00, 0x00, 0x00 530 }; 531 532 #define REX_B 0x1 533 #define REX_X 0x2 534 #define REX_R 0x4 535 #define REX_W 0x8 536 #define REX_PREFIX 0x40 537 538 #define REX_RW (REX_PREFIX | REX_R | REX_W) 539 #define REX_BW (REX_PREFIX | REX_B | REX_W) 540 #define REX_BRW (REX_PREFIX | REX_B | REX_R | REX_W) 541 542 #define REG_ESP 0x4 543 544 #define INSN_ADDMR 0x03 /* addq mem,reg */ 545 #define INSN_ADDIR 0x81 /* addq imm,reg */ 546 #define INSN_MOVMR 0x8b /* movq mem,reg */ 547 #define INSN_MOVIR 0xc7 /* movq imm,reg */ 548 #define INSN_LEA 0x8d /* leaq mem,reg */ 549 550 static Fixupret 551 tls_fixups(Ofl_desc *ofl, Rel_desc *arsp) 552 { 553 Sym_desc *sdp = arsp->rel_sym; 554 Word rtype = arsp->rel_rtype; 555 uchar_t *offset; 556 557 offset = (uchar_t *)((uintptr_t)arsp->rel_roffset + 558 (uintptr_t)_elf_getxoff(arsp->rel_isdesc->is_indata) + 559 (uintptr_t)RELAUX_GET_OSDESC(arsp)->os_outdata->d_buf); 560 561 /* 562 * Note that in certain of the original insn sequences below, the 563 * instructions are not necessarily adjacent 564 */ 565 if (sdp->sd_ref == REF_DYN_NEED) { 566 /* 567 * IE reference model 568 */ 569 switch (rtype) { 570 case R_AMD64_TLSGD: 571 /* 572 * GD -> IE 573 * 574 * Transition: 575 * 0x00 .byte 0x66 576 * 0x01 leaq x@tlsgd(%rip), %rdi 577 * 0x08 .word 0x6666 578 * 0x0a rex64 579 * 0x0b call __tls_get_addr@plt 580 * 0x10 581 * To: 582 * 0x00 movq %fs:0, %rax 583 * 0x09 addq x@gottpoff(%rip), %rax 584 * 0x10 585 */ 586 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH, 587 R_AMD64_GOTTPOFF, arsp, ld_reloc_sym_name)); 588 arsp->rel_rtype = R_AMD64_GOTTPOFF; 589 arsp->rel_roffset += 8; 590 arsp->rel_raddend = (Sxword)-4; 591 592 /* 593 * Adjust 'offset' to beginning of instruction 594 * sequence. 595 */ 596 offset -= 4; 597 (void) memcpy(offset, tlsinstr_gd_ie, 598 sizeof (tlsinstr_gd_ie)); 599 return (FIX_RELOC); 600 601 case R_AMD64_PLT32: 602 /* 603 * Fixup done via the TLS_GD relocation. 604 */ 605 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH, 606 R_AMD64_NONE, arsp, ld_reloc_sym_name)); 607 return (FIX_DONE); 608 } 609 } 610 611 /* 612 * LE reference model 613 */ 614 switch (rtype) { 615 case R_AMD64_TLSGD: 616 /* 617 * GD -> LE 618 * 619 * Transition: 620 * 0x00 .byte 0x66 621 * 0x01 leaq x@tlsgd(%rip), %rdi 622 * 0x08 .word 0x6666 623 * 0x0a rex64 624 * 0x0b call __tls_get_addr@plt 625 * 0x10 626 * To: 627 * 0x00 movq %fs:0, %rax 628 * 0x09 leaq x@tpoff(%rax), %rax 629 * 0x10 630 */ 631 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH, 632 R_AMD64_TPOFF32, arsp, ld_reloc_sym_name)); 633 arsp->rel_rtype = R_AMD64_TPOFF32; 634 arsp->rel_roffset += 8; 635 arsp->rel_raddend = 0; 636 637 /* 638 * Adjust 'offset' to beginning of instruction sequence. 639 */ 640 offset -= 4; 641 (void) memcpy(offset, tlsinstr_gd_le, sizeof (tlsinstr_gd_le)); 642 return (FIX_RELOC); 643 644 case R_AMD64_GOTTPOFF: { 645 /* 646 * IE -> LE 647 * 648 * Transition 1: 649 * movq %fs:0, %reg 650 * addq x@gottpoff(%rip), %reg 651 * To: 652 * movq %fs:0, %reg 653 * leaq x@tpoff(%reg), %reg 654 * 655 * Transition (as a special case): 656 * movq %fs:0, %r12/%rsp 657 * addq x@gottpoff(%rip), %r12/%rsp 658 * To: 659 * movq %fs:0, %r12/%rsp 660 * addq x@tpoff(%rax), %r12/%rsp 661 * 662 * Transition 2: 663 * movq x@gottpoff(%rip), %reg 664 * movq %fs:(%reg), %reg 665 * To: 666 * movq x@tpoff(%reg), %reg 667 * movq %fs:(%reg), %reg 668 */ 669 Conv_inv_buf_t inv_buf; 670 uint8_t reg; /* Register */ 671 672 offset -= 3; 673 674 reg = offset[2] >> 3; /* Encoded dest. reg. operand */ 675 676 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH, 677 R_AMD64_TPOFF32, arsp, ld_reloc_sym_name)); 678 arsp->rel_rtype = R_AMD64_TPOFF32; 679 arsp->rel_raddend = 0; 680 681 /* 682 * This is transition 2, and the special case of form 1 where 683 * a normal transition would index %rsp or %r12 and need a SIB 684 * byte in the leaq for which we lack space 685 */ 686 if ((offset[1] == INSN_MOVMR) || 687 ((offset[1] == INSN_ADDMR) && (reg == REG_ESP))) { 688 /* 689 * If we needed an extra bit of MOD.reg to refer to 690 * this register as the dest of the original movq we 691 * need an extra bit of MOD.rm to refer to it in the 692 * dest of the replacement movq or addq. 693 */ 694 if (offset[0] == REX_RW) 695 offset[0] = REX_BW; 696 697 offset[1] = (offset[1] == INSN_MOVMR) ? 698 INSN_MOVIR : INSN_ADDIR; 699 offset[2] = 0xc0 | reg; 700 701 return (FIX_RELOC); 702 } else if (offset[1] == INSN_ADDMR) { 703 /* 704 * If we needed an extra bit of MOD.reg to refer to 705 * this register in the dest of the addq we need an 706 * extra bit of both MOD.reg and MOD.rm to refer to it 707 * in the source and dest of the leaq 708 */ 709 if (offset[0] == REX_RW) 710 offset[0] = REX_BRW; 711 712 offset[1] = INSN_LEA; 713 offset[2] = 0x80 | (reg << 3) | reg; 714 715 return (FIX_RELOC); 716 } 717 718 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_REL_BADTLSINS), 719 conv_reloc_amd64_type(arsp->rel_rtype, 0, &inv_buf), 720 arsp->rel_isdesc->is_file->ifl_name, 721 ld_reloc_sym_name(arsp), 722 arsp->rel_isdesc->is_name, 723 EC_OFF(arsp->rel_roffset)); 724 return (FIX_ERROR); 725 } 726 case R_AMD64_TLSLD: 727 /* 728 * LD -> LE 729 * 730 * Transition 731 * 0x00 leaq x1@tlsgd(%rip), %rdi 732 * 0x07 call __tls_get_addr@plt 733 * 0x0c 734 * To: 735 * 0x00 .byte 0x66 736 * 0x01 .byte 0x66 737 * 0x02 .byte 0x66 738 * 0x03 movq %fs:0, %rax 739 */ 740 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH, 741 R_AMD64_NONE, arsp, ld_reloc_sym_name)); 742 offset -= 3; 743 (void) memcpy(offset, tlsinstr_ld_le, sizeof (tlsinstr_ld_le)); 744 return (FIX_DONE); 745 746 case R_AMD64_DTPOFF32: 747 /* 748 * LD->LE 749 * 750 * Transition: 751 * 0x00 leaq x1@dtpoff(%rax), %rcx 752 * To: 753 * 0x00 leaq x1@tpoff(%rax), %rcx 754 */ 755 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH, 756 R_AMD64_TPOFF32, arsp, ld_reloc_sym_name)); 757 arsp->rel_rtype = R_AMD64_TPOFF32; 758 return (FIX_RELOC); 759 } 760 761 return (FIX_RELOC); 762 } 763 764 static uintptr_t 765 ld_do_activerelocs(Ofl_desc *ofl) 766 { 767 Rel_desc *arsp; 768 Rel_cachebuf *rcbp; 769 Aliste idx; 770 uintptr_t return_code = 1; 771 ofl_flag_t flags = ofl->ofl_flags; 772 773 if (aplist_nitems(ofl->ofl_actrels.rc_list) != 0) 774 DBG_CALL(Dbg_reloc_doact_title(ofl->ofl_lml)); 775 776 /* 777 * Process active relocations. 778 */ 779 REL_CACHE_TRAVERSE(&ofl->ofl_actrels, idx, rcbp, arsp) { 780 uchar_t *addr; 781 Xword value; 782 Sym_desc *sdp; 783 const char *ifl_name; 784 Xword refaddr; 785 int moved = 0; 786 Gotref gref; 787 Os_desc *osp; 788 789 /* 790 * If the section this relocation is against has been discarded 791 * (-zignore), then discard (skip) the relocation itself. 792 */ 793 if ((arsp->rel_isdesc->is_flags & FLG_IS_DISCARD) && 794 ((arsp->rel_flags & (FLG_REL_GOT | FLG_REL_BSS | 795 FLG_REL_PLT | FLG_REL_NOINFO)) == 0)) { 796 DBG_CALL(Dbg_reloc_discard(ofl->ofl_lml, M_MACH, arsp)); 797 continue; 798 } 799 800 /* 801 * We determine what the 'got reference' model (if required) 802 * is at this point. This needs to be done before tls_fixup() 803 * since it may 'transition' our instructions. 804 * 805 * The got table entries have already been assigned, 806 * and we bind to those initial entries. 807 */ 808 if (arsp->rel_flags & FLG_REL_DTLS) 809 gref = GOT_REF_TLSGD; 810 else if (arsp->rel_flags & FLG_REL_MTLS) 811 gref = GOT_REF_TLSLD; 812 else if (arsp->rel_flags & FLG_REL_STLS) 813 gref = GOT_REF_TLSIE; 814 else 815 gref = GOT_REF_GENERIC; 816 817 /* 818 * Perform any required TLS fixups. 819 */ 820 if (arsp->rel_flags & FLG_REL_TLSFIX) { 821 Fixupret ret; 822 823 if ((ret = tls_fixups(ofl, arsp)) == FIX_ERROR) 824 return (S_ERROR); 825 if (ret == FIX_DONE) 826 continue; 827 } 828 829 /* 830 * If this is a relocation against a move table, or 831 * expanded move table, adjust the relocation entries. 832 */ 833 if (RELAUX_GET_MOVE(arsp)) 834 ld_adj_movereloc(ofl, arsp); 835 836 sdp = arsp->rel_sym; 837 refaddr = arsp->rel_roffset + 838 (Off)_elf_getxoff(arsp->rel_isdesc->is_indata); 839 840 if ((arsp->rel_flags & FLG_REL_CLVAL) || 841 (arsp->rel_flags & FLG_REL_GOTCL)) 842 value = 0; 843 else if (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION) { 844 Sym_desc *sym; 845 846 /* 847 * The value for a symbol pointing to a SECTION 848 * is based off of that sections position. 849 */ 850 if ((sdp->sd_isc->is_flags & FLG_IS_RELUPD) && 851 /* LINTED */ 852 (sym = ld_am_I_partial(arsp, arsp->rel_raddend))) { 853 /* 854 * The symbol was moved, so adjust the value 855 * relative to the new section. 856 */ 857 value = sym->sd_sym->st_value; 858 moved = 1; 859 860 /* 861 * The original raddend covers the displacement 862 * from the section start to the desired 863 * address. The value computed above gets us 864 * from the section start to the start of the 865 * symbol range. Adjust the old raddend to 866 * remove the offset from section start to 867 * symbol start, leaving the displacement 868 * within the range of the symbol. 869 */ 870 arsp->rel_raddend -= sym->sd_osym->st_value; 871 } else { 872 value = _elf_getxoff(sdp->sd_isc->is_indata); 873 if (sdp->sd_isc->is_shdr->sh_flags & SHF_ALLOC) 874 value += sdp->sd_isc->is_osdesc-> 875 os_shdr->sh_addr; 876 } 877 if (sdp->sd_isc->is_shdr->sh_flags & SHF_TLS) 878 value -= ofl->ofl_tlsphdr->p_vaddr; 879 880 } else if (IS_SIZE(arsp->rel_rtype)) { 881 /* 882 * Size relocations require the symbols size. 883 */ 884 value = sdp->sd_sym->st_size; 885 886 } else if ((sdp->sd_flags & FLG_SY_CAP) && 887 sdp->sd_aux && sdp->sd_aux->sa_PLTndx) { 888 /* 889 * If relocation is against a capabilities symbol, we 890 * need to jump to an associated PLT, so that at runtime 891 * ld.so.1 is involved to determine the best binding 892 * choice. Otherwise, the value is the symbols value. 893 */ 894 value = ld_calc_plt_addr(sdp, ofl); 895 } else 896 value = sdp->sd_sym->st_value; 897 898 /* 899 * Relocation against the GLOBAL_OFFSET_TABLE. 900 */ 901 if ((arsp->rel_flags & FLG_REL_GOT) && 902 !ld_reloc_set_aux_osdesc(ofl, arsp, ofl->ofl_osgot)) 903 return (S_ERROR); 904 osp = RELAUX_GET_OSDESC(arsp); 905 906 /* 907 * If loadable and not producing a relocatable object add the 908 * sections virtual address to the reference address. 909 */ 910 if ((arsp->rel_flags & FLG_REL_LOAD) && 911 ((flags & FLG_OF_RELOBJ) == 0)) 912 refaddr += arsp->rel_isdesc->is_osdesc-> 913 os_shdr->sh_addr; 914 915 /* 916 * If this entry has a PLT assigned to it, its value is actually 917 * the address of the PLT (and not the address of the function). 918 */ 919 if (IS_PLT(arsp->rel_rtype)) { 920 if (sdp->sd_aux && sdp->sd_aux->sa_PLTndx) 921 value = ld_calc_plt_addr(sdp, ofl); 922 } 923 924 /* 925 * Add relocations addend to value. Add extra 926 * relocation addend if needed. 927 * 928 * Note: For GOT relative relocations on amd64 we discard the 929 * addend. It was relevant to the reference - not to the 930 * data item being referenced (ie: that -4 thing). 931 */ 932 if ((arsp->rel_flags & FLG_REL_GOT) == 0) 933 value += arsp->rel_raddend; 934 935 /* 936 * Determine whether the value needs further adjustment. Filter 937 * through the attributes of the relocation to determine what 938 * adjustment is required. Note, many of the following cases 939 * are only applicable when a .got is present. As a .got is 940 * not generated when a relocatable object is being built, 941 * any adjustments that require a .got need to be skipped. 942 */ 943 if ((arsp->rel_flags & FLG_REL_GOT) && 944 ((flags & FLG_OF_RELOBJ) == 0)) { 945 Xword R1addr; 946 uintptr_t R2addr; 947 Word gotndx; 948 Gotndx *gnp; 949 950 /* 951 * Perform relocation against GOT table. Since this 952 * doesn't fit exactly into a relocation we place the 953 * appropriate byte in the GOT directly 954 * 955 * Calculate offset into GOT at which to apply 956 * the relocation. 957 */ 958 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, arsp); 959 assert(gnp); 960 961 if (arsp->rel_rtype == R_AMD64_DTPOFF64) 962 gotndx = gnp->gn_gotndx + 1; 963 else 964 gotndx = gnp->gn_gotndx; 965 966 R1addr = (Xword)(gotndx * M_GOT_ENTSIZE); 967 968 /* 969 * Add the GOTs data's offset. 970 */ 971 R2addr = R1addr + (uintptr_t)osp->os_outdata->d_buf; 972 973 DBG_CALL(Dbg_reloc_doact(ofl->ofl_lml, ELF_DBG_LD_ACT, 974 M_MACH, SHT_RELA, arsp, R1addr, value, 975 ld_reloc_sym_name)); 976 977 /* 978 * And do it. 979 */ 980 if (ofl->ofl_flags1 & FLG_OF1_ENCDIFF) 981 *(Xword *)R2addr = ld_bswap_Xword(value); 982 else 983 *(Xword *)R2addr = value; 984 continue; 985 986 } else if (IS_GOT_BASED(arsp->rel_rtype) && 987 ((flags & FLG_OF_RELOBJ) == 0)) { 988 value -= ofl->ofl_osgot->os_shdr->sh_addr; 989 990 } else if (IS_GOTPCREL(arsp->rel_rtype) && 991 ((flags & FLG_OF_RELOBJ) == 0)) { 992 Gotndx *gnp; 993 994 /* 995 * Calculation: 996 * G + GOT + A - P 997 */ 998 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, arsp); 999 assert(gnp); 1000 value = (Xword)(ofl->ofl_osgot->os_shdr-> sh_addr) + 1001 ((Xword)gnp->gn_gotndx * M_GOT_ENTSIZE) + 1002 arsp->rel_raddend - refaddr; 1003 1004 } else if (IS_GOT_PC(arsp->rel_rtype) && 1005 ((flags & FLG_OF_RELOBJ) == 0)) { 1006 value = (Xword)(ofl->ofl_osgot->os_shdr-> 1007 sh_addr) - refaddr + arsp->rel_raddend; 1008 1009 } else if ((IS_PC_RELATIVE(arsp->rel_rtype)) && 1010 (((flags & FLG_OF_RELOBJ) == 0) || 1011 (osp == sdp->sd_isc->is_osdesc))) { 1012 value -= refaddr; 1013 1014 } else if (IS_TLS_INS(arsp->rel_rtype) && 1015 IS_GOT_RELATIVE(arsp->rel_rtype) && 1016 ((flags & FLG_OF_RELOBJ) == 0)) { 1017 Gotndx *gnp; 1018 1019 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, arsp); 1020 assert(gnp); 1021 value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE; 1022 1023 } else if (IS_GOT_RELATIVE(arsp->rel_rtype) && 1024 ((flags & FLG_OF_RELOBJ) == 0)) { 1025 Gotndx *gnp; 1026 1027 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, arsp); 1028 assert(gnp); 1029 value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE; 1030 1031 } else if ((arsp->rel_flags & FLG_REL_STLS) && 1032 ((flags & FLG_OF_RELOBJ) == 0)) { 1033 Xword tlsstatsize; 1034 1035 /* 1036 * This is the LE TLS reference model. Static 1037 * offset is hard-coded. 1038 */ 1039 tlsstatsize = S_ROUND(ofl->ofl_tlsphdr->p_memsz, 1040 M_TLSSTATALIGN); 1041 value = tlsstatsize - value; 1042 1043 /* 1044 * Since this code is fixed up, it assumes a negative 1045 * offset that can be added to the thread pointer. 1046 */ 1047 if (arsp->rel_rtype == R_AMD64_TPOFF32) 1048 value = -value; 1049 } 1050 1051 if (arsp->rel_isdesc->is_file) 1052 ifl_name = arsp->rel_isdesc->is_file->ifl_name; 1053 else 1054 ifl_name = MSG_INTL(MSG_STR_NULL); 1055 1056 /* 1057 * Make sure we have data to relocate. Compiler and assembler 1058 * developers have been known to generate relocations against 1059 * invalid sections (normally .bss), so for their benefit give 1060 * them sufficient information to help analyze the problem. 1061 * End users should never see this. 1062 */ 1063 if (arsp->rel_isdesc->is_indata->d_buf == 0) { 1064 Conv_inv_buf_t inv_buf; 1065 1066 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_REL_EMPTYSEC), 1067 conv_reloc_amd64_type(arsp->rel_rtype, 0, &inv_buf), 1068 ifl_name, ld_reloc_sym_name(arsp), 1069 EC_WORD(arsp->rel_isdesc->is_scnndx), 1070 arsp->rel_isdesc->is_name); 1071 return (S_ERROR); 1072 } 1073 1074 /* 1075 * Get the address of the data item we need to modify. 1076 */ 1077 addr = (uchar_t *)((uintptr_t)arsp->rel_roffset + 1078 (uintptr_t)_elf_getxoff(arsp->rel_isdesc->is_indata)); 1079 1080 DBG_CALL(Dbg_reloc_doact(ofl->ofl_lml, ELF_DBG_LD_ACT, 1081 M_MACH, SHT_RELA, arsp, EC_NATPTR(addr), value, 1082 ld_reloc_sym_name)); 1083 addr += (uintptr_t)osp->os_outdata->d_buf; 1084 1085 if ((((uintptr_t)addr - (uintptr_t)ofl->ofl_nehdr) > 1086 ofl->ofl_size) || (arsp->rel_roffset > 1087 osp->os_shdr->sh_size)) { 1088 int class; 1089 Conv_inv_buf_t inv_buf; 1090 1091 if (((uintptr_t)addr - (uintptr_t)ofl->ofl_nehdr) > 1092 ofl->ofl_size) 1093 class = ERR_FATAL; 1094 else 1095 class = ERR_WARNING; 1096 1097 ld_eprintf(ofl, class, MSG_INTL(MSG_REL_INVALOFFSET), 1098 conv_reloc_amd64_type(arsp->rel_rtype, 0, &inv_buf), 1099 ifl_name, EC_WORD(arsp->rel_isdesc->is_scnndx), 1100 arsp->rel_isdesc->is_name, ld_reloc_sym_name(arsp), 1101 EC_ADDR((uintptr_t)addr - 1102 (uintptr_t)ofl->ofl_nehdr)); 1103 1104 if (class == ERR_FATAL) { 1105 return_code = S_ERROR; 1106 continue; 1107 } 1108 } 1109 1110 /* 1111 * The relocation is additive. Ignore the previous symbol 1112 * value if this local partial symbol is expanded. 1113 */ 1114 if (moved) 1115 value -= *addr; 1116 1117 /* 1118 * If '-z noreloc' is specified - skip the do_reloc_ld stage. 1119 */ 1120 if (OFL_DO_RELOC(ofl)) { 1121 /* 1122 * If this is a PROGBITS section and the running linker 1123 * has a different byte order than the target host, 1124 * tell do_reloc_ld() to swap bytes. 1125 */ 1126 if (do_reloc_ld(arsp, addr, &value, ld_reloc_sym_name, 1127 ifl_name, OFL_SWAP_RELOC_DATA(ofl, arsp), 1128 ofl->ofl_lml) == 0) { 1129 ofl->ofl_flags |= FLG_OF_FATAL; 1130 return_code = S_ERROR; 1131 } 1132 } 1133 } 1134 return (return_code); 1135 } 1136 1137 static uintptr_t 1138 ld_add_outrel(Word flags, Rel_desc *rsp, Ofl_desc *ofl) 1139 { 1140 Rel_desc *orsp; 1141 Sym_desc *sdp = rsp->rel_sym; 1142 1143 /* 1144 * Static executables *do not* want any relocations against them. 1145 * Since our engine still creates relocations against a WEAK UNDEFINED 1146 * symbol in a static executable, it's best to disable them here 1147 * instead of through out the relocation code. 1148 */ 1149 if (OFL_IS_STATIC_EXEC(ofl)) 1150 return (1); 1151 1152 /* 1153 * If the symbol will be reduced, we can't leave outstanding 1154 * relocations against it, as nothing will ever be able to satisfy them 1155 * (and the symbol won't be in .dynsym 1156 */ 1157 if ((sdp != NULL) && 1158 (sdp->sd_sym->st_shndx == SHN_UNDEF) && 1159 (rsp->rel_rtype != M_R_NONE) && 1160 (rsp->rel_rtype != M_R_RELATIVE)) { 1161 if (ld_sym_reducable(ofl, sdp)) 1162 return (1); 1163 } 1164 1165 /* 1166 * If we are adding a output relocation against a section 1167 * symbol (non-RELATIVE) then mark that section. These sections 1168 * will be added to the .dynsym symbol table. 1169 */ 1170 if (sdp && (rsp->rel_rtype != M_R_RELATIVE) && 1171 ((flags & FLG_REL_SCNNDX) || 1172 (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION))) { 1173 1174 /* 1175 * If this is a COMMON symbol - no output section 1176 * exists yet - (it's created as part of sym_validate()). 1177 * So - we mark here that when it's created it should 1178 * be tagged with the FLG_OS_OUTREL flag. 1179 */ 1180 if ((sdp->sd_flags & FLG_SY_SPECSEC) && 1181 (sdp->sd_sym->st_shndx == SHN_COMMON)) { 1182 if (ELF_ST_TYPE(sdp->sd_sym->st_info) != STT_TLS) 1183 ofl->ofl_flags1 |= FLG_OF1_BSSOREL; 1184 else 1185 ofl->ofl_flags1 |= FLG_OF1_TLSOREL; 1186 } else { 1187 Os_desc *osp; 1188 Is_desc *isp = sdp->sd_isc; 1189 1190 if (isp && ((osp = isp->is_osdesc) != NULL) && 1191 ((osp->os_flags & FLG_OS_OUTREL) == 0)) { 1192 ofl->ofl_dynshdrcnt++; 1193 osp->os_flags |= FLG_OS_OUTREL; 1194 } 1195 } 1196 } 1197 1198 /* Enter it into the output relocation cache */ 1199 if ((orsp = ld_reloc_enter(ofl, &ofl->ofl_outrels, rsp, flags)) == NULL) 1200 return (S_ERROR); 1201 1202 if (flags & FLG_REL_GOT) 1203 ofl->ofl_relocgotsz += (Xword)sizeof (Rela); 1204 else if (flags & FLG_REL_PLT) 1205 ofl->ofl_relocpltsz += (Xword)sizeof (Rela); 1206 else if (flags & FLG_REL_BSS) 1207 ofl->ofl_relocbsssz += (Xword)sizeof (Rela); 1208 else if (flags & FLG_REL_NOINFO) 1209 ofl->ofl_relocrelsz += (Xword)sizeof (Rela); 1210 else 1211 RELAUX_GET_OSDESC(orsp)->os_szoutrels += (Xword)sizeof (Rela); 1212 1213 if (orsp->rel_rtype == M_R_RELATIVE) 1214 ofl->ofl_relocrelcnt++; 1215 1216 /* 1217 * We don't perform sorting on PLT relocations because 1218 * they have already been assigned a PLT index and if we 1219 * were to sort them we would have to re-assign the plt indexes. 1220 */ 1221 if (!(flags & FLG_REL_PLT)) 1222 ofl->ofl_reloccnt++; 1223 1224 /* 1225 * Insure a GLOBAL_OFFSET_TABLE is generated if required. 1226 */ 1227 if (IS_GOT_REQUIRED(orsp->rel_rtype)) 1228 ofl->ofl_flags |= FLG_OF_BLDGOT; 1229 1230 /* 1231 * Identify and possibly warn of a displacement relocation. 1232 */ 1233 if (orsp->rel_flags & FLG_REL_DISP) { 1234 ofl->ofl_dtflags_1 |= DF_1_DISPRELPND; 1235 1236 if (ofl->ofl_flags & FLG_OF_VERBOSE) 1237 ld_disp_errmsg(MSG_INTL(MSG_REL_DISPREL4), orsp, ofl); 1238 } 1239 DBG_CALL(Dbg_reloc_ors_entry(ofl->ofl_lml, ELF_DBG_LD, SHT_RELA, 1240 M_MACH, orsp)); 1241 return (1); 1242 } 1243 1244 /* 1245 * process relocation for a LOCAL symbol 1246 */ 1247 static uintptr_t 1248 ld_reloc_local(Rel_desc * rsp, Ofl_desc * ofl) 1249 { 1250 ofl_flag_t flags = ofl->ofl_flags; 1251 Sym_desc *sdp = rsp->rel_sym; 1252 Word shndx = sdp->sd_sym->st_shndx; 1253 Word ortype = rsp->rel_rtype; 1254 1255 /* 1256 * if ((shared object) and (not pc relative relocation) and 1257 * (not against ABS symbol)) 1258 * then 1259 * build R_AMD64_RELATIVE 1260 * fi 1261 */ 1262 if ((flags & FLG_OF_SHAROBJ) && (rsp->rel_flags & FLG_REL_LOAD) && 1263 !(IS_PC_RELATIVE(rsp->rel_rtype)) && !(IS_SIZE(rsp->rel_rtype)) && 1264 !(IS_GOT_BASED(rsp->rel_rtype)) && 1265 !(rsp->rel_isdesc != NULL && 1266 (rsp->rel_isdesc->is_shdr->sh_type == SHT_SUNW_dof)) && 1267 (((sdp->sd_flags & FLG_SY_SPECSEC) == 0) || 1268 (shndx != SHN_ABS) || (sdp->sd_aux && sdp->sd_aux->sa_symspec))) { 1269 1270 /* 1271 * R_AMD64_RELATIVE updates a 64bit address, if this 1272 * relocation isn't a 64bit binding then we can not 1273 * simplify it to a RELATIVE relocation. 1274 */ 1275 if (reloc_table[ortype].re_fsize != sizeof (Addr)) { 1276 return (ld_add_outrel(0, rsp, ofl)); 1277 } 1278 1279 rsp->rel_rtype = R_AMD64_RELATIVE; 1280 if (ld_add_outrel(FLG_REL_ADVAL, rsp, ofl) == S_ERROR) 1281 return (S_ERROR); 1282 rsp->rel_rtype = ortype; 1283 return (1); 1284 } 1285 1286 /* 1287 * If the relocation is against a 'non-allocatable' section 1288 * and we can not resolve it now - then give a warning 1289 * message. 1290 * 1291 * We can not resolve the symbol if either: 1292 * a) it's undefined 1293 * b) it's defined in a shared library and a 1294 * COPY relocation hasn't moved it to the executable 1295 * 1296 * Note: because we process all of the relocations against the 1297 * text segment before any others - we know whether 1298 * or not a copy relocation will be generated before 1299 * we get here (see reloc_init()->reloc_segments()). 1300 */ 1301 if (!(rsp->rel_flags & FLG_REL_LOAD) && 1302 ((shndx == SHN_UNDEF) || 1303 ((sdp->sd_ref == REF_DYN_NEED) && 1304 ((sdp->sd_flags & FLG_SY_MVTOCOMM) == 0)))) { 1305 Conv_inv_buf_t inv_buf; 1306 Os_desc *osp = RELAUX_GET_OSDESC(rsp); 1307 1308 /* 1309 * If the relocation is against a SHT_SUNW_ANNOTATE 1310 * section - then silently ignore that the relocation 1311 * can not be resolved. 1312 */ 1313 if (osp && (osp->os_shdr->sh_type == SHT_SUNW_ANNOTATE)) 1314 return (0); 1315 ld_eprintf(ofl, ERR_WARNING, MSG_INTL(MSG_REL_EXTERNSYM), 1316 conv_reloc_amd64_type(rsp->rel_rtype, 0, &inv_buf), 1317 rsp->rel_isdesc->is_file->ifl_name, 1318 ld_reloc_sym_name(rsp), osp->os_name); 1319 return (1); 1320 } 1321 1322 /* 1323 * Perform relocation. 1324 */ 1325 return (ld_add_actrel(0, rsp, ofl)); 1326 } 1327 1328 1329 static uintptr_t 1330 ld_reloc_TLS(Boolean local, Rel_desc * rsp, Ofl_desc * ofl) 1331 { 1332 Word rtype = rsp->rel_rtype; 1333 Sym_desc *sdp = rsp->rel_sym; 1334 ofl_flag_t flags = ofl->ofl_flags; 1335 Gotndx *gnp; 1336 1337 /* 1338 * If we're building an executable - use either the IE or LE access 1339 * model. If we're building a shared object process any IE model. 1340 */ 1341 if ((flags & FLG_OF_EXEC) || (IS_TLS_IE(rtype))) { 1342 /* 1343 * Set the DF_STATIC_TLS flag. 1344 */ 1345 ofl->ofl_dtflags |= DF_STATIC_TLS; 1346 1347 if (!local || ((flags & FLG_OF_EXEC) == 0)) { 1348 /* 1349 * Assign a GOT entry for static TLS references. 1350 */ 1351 if ((gnp = ld_find_got_ndx(sdp->sd_GOTndxs, 1352 GOT_REF_TLSIE, ofl, rsp)) == NULL) { 1353 1354 if (ld_assign_got_TLS(local, rsp, ofl, sdp, 1355 gnp, GOT_REF_TLSIE, FLG_REL_STLS, 1356 rtype, R_AMD64_TPOFF64, 0) == S_ERROR) 1357 return (S_ERROR); 1358 } 1359 1360 /* 1361 * IE access model. 1362 */ 1363 if (IS_TLS_IE(rtype)) 1364 return (ld_add_actrel(FLG_REL_STLS, rsp, ofl)); 1365 1366 /* 1367 * Fixups are required for other executable models. 1368 */ 1369 return (ld_add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS), 1370 rsp, ofl)); 1371 } 1372 1373 /* 1374 * LE access model. 1375 */ 1376 if (IS_TLS_LE(rtype)) 1377 return (ld_add_actrel(FLG_REL_STLS, rsp, ofl)); 1378 1379 return (ld_add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS), 1380 rsp, ofl)); 1381 } 1382 1383 /* 1384 * Building a shared object. 1385 * 1386 * Assign a GOT entry for a dynamic TLS reference. 1387 */ 1388 if (IS_TLS_LD(rtype) && ((gnp = ld_find_got_ndx(sdp->sd_GOTndxs, 1389 GOT_REF_TLSLD, ofl, rsp)) == NULL)) { 1390 1391 if (ld_assign_got_TLS(local, rsp, ofl, sdp, gnp, GOT_REF_TLSLD, 1392 FLG_REL_MTLS, rtype, R_AMD64_DTPMOD64, 0) == S_ERROR) 1393 return (S_ERROR); 1394 1395 } else if (IS_TLS_GD(rtype) && 1396 ((gnp = ld_find_got_ndx(sdp->sd_GOTndxs, GOT_REF_TLSGD, 1397 ofl, rsp)) == NULL)) { 1398 1399 if (ld_assign_got_TLS(local, rsp, ofl, sdp, gnp, GOT_REF_TLSGD, 1400 FLG_REL_DTLS, rtype, R_AMD64_DTPMOD64, 1401 R_AMD64_DTPOFF64) == S_ERROR) 1402 return (S_ERROR); 1403 } 1404 1405 if (IS_TLS_LD(rtype)) 1406 return (ld_add_actrel(FLG_REL_MTLS, rsp, ofl)); 1407 1408 return (ld_add_actrel(FLG_REL_DTLS, rsp, ofl)); 1409 } 1410 1411 /* ARGSUSED5 */ 1412 static uintptr_t 1413 ld_assign_got_ndx(Alist **alpp, Gotndx *pgnp, Gotref gref, Ofl_desc *ofl, 1414 Rel_desc *rsp, Sym_desc *sdp) 1415 { 1416 Xword raddend; 1417 Gotndx gn, *gnp; 1418 Aliste idx; 1419 uint_t gotents; 1420 1421 raddend = rsp->rel_raddend; 1422 if (pgnp && (pgnp->gn_addend == raddend) && (pgnp->gn_gotref == gref)) 1423 return (1); 1424 1425 if ((gref == GOT_REF_TLSGD) || (gref == GOT_REF_TLSLD)) 1426 gotents = 2; 1427 else 1428 gotents = 1; 1429 1430 gn.gn_addend = raddend; 1431 gn.gn_gotndx = ofl->ofl_gotcnt; 1432 gn.gn_gotref = gref; 1433 1434 ofl->ofl_gotcnt += gotents; 1435 1436 if (gref == GOT_REF_TLSLD) { 1437 if (ofl->ofl_tlsldgotndx == NULL) { 1438 if ((gnp = libld_malloc(sizeof (Gotndx))) == NULL) 1439 return (S_ERROR); 1440 (void) memcpy(gnp, &gn, sizeof (Gotndx)); 1441 ofl->ofl_tlsldgotndx = gnp; 1442 } 1443 return (1); 1444 } 1445 1446 idx = 0; 1447 for (ALIST_TRAVERSE(*alpp, idx, gnp)) { 1448 if (gnp->gn_addend > raddend) 1449 break; 1450 } 1451 1452 /* 1453 * GOT indexes are maintained on an Alist, where there is typically 1454 * only one index. The usage of this list is to scan the list to find 1455 * an index, and then apply that index immediately to a relocation. 1456 * Thus there are no external references to these GOT index structures 1457 * that can be compromised by the Alist being reallocated. 1458 */ 1459 if (alist_insert(alpp, &gn, sizeof (Gotndx), 1460 AL_CNT_SDP_GOT, idx) == NULL) 1461 return (S_ERROR); 1462 1463 return (1); 1464 } 1465 1466 static void 1467 ld_assign_plt_ndx(Sym_desc * sdp, Ofl_desc *ofl) 1468 { 1469 sdp->sd_aux->sa_PLTndx = 1 + ofl->ofl_pltcnt++; 1470 sdp->sd_aux->sa_PLTGOTndx = ofl->ofl_gotcnt++; 1471 ofl->ofl_flags |= FLG_OF_BLDGOT; 1472 } 1473 1474 static uchar_t plt0_template[M_PLT_ENTSIZE] = { 1475 /* 0x00 PUSHQ GOT+8(%rip) */ 0xff, 0x35, 0x00, 0x00, 0x00, 0x00, 1476 /* 0x06 JMP *GOT+16(%rip) */ 0xff, 0x25, 0x00, 0x00, 0x00, 0x00, 1477 /* 0x0c NOP */ 0x90, 1478 /* 0x0d NOP */ 0x90, 1479 /* 0x0e NOP */ 0x90, 1480 /* 0x0f NOP */ 0x90 1481 }; 1482 1483 /* 1484 * Initializes .got[0] with the _DYNAMIC symbol value. 1485 */ 1486 static uintptr_t 1487 ld_fillin_gotplt(Ofl_desc *ofl) 1488 { 1489 int bswap = (ofl->ofl_flags1 & FLG_OF1_ENCDIFF) != 0; 1490 1491 if (ofl->ofl_osgot) { 1492 Sym_desc *sdp; 1493 1494 if ((sdp = ld_sym_find(MSG_ORIG(MSG_SYM_DYNAMIC_U), 1495 SYM_NOHASH, NULL, ofl)) != NULL) { 1496 uchar_t *genptr; 1497 1498 genptr = ((uchar_t *)ofl->ofl_osgot->os_outdata->d_buf + 1499 (M_GOT_XDYNAMIC * M_GOT_ENTSIZE)); 1500 /* LINTED */ 1501 *(Xword *)genptr = sdp->sd_sym->st_value; 1502 if (bswap) 1503 /* LINTED */ 1504 *(Xword *)genptr = 1505 /* LINTED */ 1506 ld_bswap_Xword(*(Xword *)genptr); 1507 } 1508 } 1509 1510 /* 1511 * Fill in the reserved slot in the procedure linkage table the first 1512 * entry is: 1513 * 0x00 PUSHQ GOT+8(%rip) # GOT[1] 1514 * 0x06 JMP *GOT+16(%rip) # GOT[2] 1515 * 0x0c NOP 1516 * 0x0d NOP 1517 * 0x0e NOP 1518 * 0x0f NOP 1519 */ 1520 if ((ofl->ofl_flags & FLG_OF_DYNAMIC) && ofl->ofl_osplt) { 1521 uchar_t *pltent; 1522 Xword val1; 1523 1524 pltent = (uchar_t *)ofl->ofl_osplt->os_outdata->d_buf; 1525 bcopy(plt0_template, pltent, sizeof (plt0_template)); 1526 1527 /* 1528 * If '-z noreloc' is specified - skip the do_reloc_ld 1529 * stage. 1530 */ 1531 if (!OFL_DO_RELOC(ofl)) 1532 return (1); 1533 1534 /* 1535 * filin: 1536 * PUSHQ GOT + 8(%rip) 1537 * 1538 * Note: 0x06 below represents the offset to the 1539 * next instruction - which is what %rip will 1540 * be pointing at. 1541 */ 1542 val1 = (ofl->ofl_osgot->os_shdr->sh_addr) + 1543 (M_GOT_XLINKMAP * M_GOT_ENTSIZE) - 1544 ofl->ofl_osplt->os_shdr->sh_addr - 0x06; 1545 1546 if (do_reloc_ld(&rdesc_r_amd64_gotpcrel, &pltent[0x02], 1547 &val1, syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT), 1548 bswap, ofl->ofl_lml) == 0) { 1549 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLT0FAIL)); 1550 return (S_ERROR); 1551 } 1552 1553 /* 1554 * filin: 1555 * JMP *GOT+16(%rip) 1556 */ 1557 val1 = (ofl->ofl_osgot->os_shdr->sh_addr) + 1558 (M_GOT_XRTLD * M_GOT_ENTSIZE) - 1559 ofl->ofl_osplt->os_shdr->sh_addr - 0x0c; 1560 1561 if (do_reloc_ld(&rdesc_r_amd64_gotpcrel, &pltent[0x08], 1562 &val1, syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT), 1563 bswap, ofl->ofl_lml) == 0) { 1564 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLT0FAIL)); 1565 return (S_ERROR); 1566 } 1567 } 1568 1569 return (1); 1570 } 1571 1572 1573 1574 /* 1575 * Template for generating "void (*)(void)" function 1576 */ 1577 static const uchar_t nullfunc_tmpl[] = { /* amd64 */ 1578 /* 0x00 */ 0x55, /* pushq %rbp */ 1579 /* 0x01 */ 0x48, 0x8b, 0xec, /* movq %rsp,%rbp */ 1580 /* 0x04 */ 0x48, 0x8b, 0xe5, /* movq %rbp,%rsp */ 1581 /* 0x07 */ 0x5d, /* popq %rbp */ 1582 /* 0x08 */ 0xc3 /* ret */ 1583 }; 1584 1585 1586 /* 1587 * Function used to provide fill padding in SHF_EXECINSTR sections 1588 * 1589 * entry: 1590 * 1591 * base - base address of section being filled 1592 * offset - starting offset for fill within memory referenced by base 1593 * cnt - # bytes to be filled 1594 * 1595 * exit: 1596 * The fill has been completed. 1597 */ 1598 static void 1599 execfill(void *base, off_t off, size_t cnt) 1600 { 1601 /* 1602 * 0x90 is an X86 NOP instruction in both 32 and 64-bit worlds. 1603 * There are no alignment constraints. 1604 */ 1605 (void) memset(off + (char *)base, 0x90, cnt); 1606 } 1607 1608 1609 /* 1610 * Return the ld_targ definition for this target. 1611 */ 1612 const Target * 1613 ld_targ_init_x86(void) 1614 { 1615 static const Target _ld_targ = { 1616 { /* Target_mach */ 1617 M_MACH, /* m_mach */ 1618 M_MACHPLUS, /* m_machplus */ 1619 M_FLAGSPLUS, /* m_flagsplus */ 1620 M_CLASS, /* m_class */ 1621 M_DATA, /* m_data */ 1622 1623 M_SEGM_ALIGN, /* m_segm_align */ 1624 M_SEGM_ORIGIN, /* m_segm_origin */ 1625 M_SEGM_AORIGIN, /* m_segm_aorigin */ 1626 M_DATASEG_PERM, /* m_dataseg_perm */ 1627 M_STACK_PERM, /* m_stack_perm */ 1628 M_WORD_ALIGN, /* m_word_align */ 1629 MSG_ORIG(MSG_PTH_RTLD_AMD64), /* m_def_interp */ 1630 1631 /* Relocation type codes */ 1632 M_R_ARRAYADDR, /* m_r_arrayaddr */ 1633 M_R_COPY, /* m_r_copy */ 1634 M_R_GLOB_DAT, /* m_r_glob_dat */ 1635 M_R_JMP_SLOT, /* m_r_jmp_slot */ 1636 M_R_NUM, /* m_r_num */ 1637 M_R_NONE, /* m_r_none */ 1638 M_R_RELATIVE, /* m_r_relative */ 1639 M_R_REGISTER, /* m_r_register */ 1640 1641 /* Relocation related constants */ 1642 M_REL_DT_COUNT, /* m_rel_dt_count */ 1643 M_REL_DT_ENT, /* m_rel_dt_ent */ 1644 M_REL_DT_SIZE, /* m_rel_dt_size */ 1645 M_REL_DT_TYPE, /* m_rel_dt_type */ 1646 M_REL_SHT_TYPE, /* m_rel_sht_type */ 1647 1648 /* GOT related constants */ 1649 M_GOT_ENTSIZE, /* m_got_entsize */ 1650 M_GOT_XNumber, /* m_got_xnumber */ 1651 1652 /* PLT related constants */ 1653 M_PLT_ALIGN, /* m_plt_align */ 1654 M_PLT_ENTSIZE, /* m_plt_entsize */ 1655 M_PLT_RESERVSZ, /* m_plt_reservsz */ 1656 M_PLT_SHF_FLAGS, /* m_plt_shf_flags */ 1657 1658 /* Section type of .eh_frame/.eh_frame_hdr sections */ 1659 SHT_AMD64_UNWIND, /* m_sht_unwind */ 1660 1661 M_DT_REGISTER, /* m_dt_register */ 1662 }, 1663 { /* Target_machid */ 1664 M_ID_ARRAY, /* id_array */ 1665 M_ID_BSS, /* id_bss */ 1666 M_ID_CAP, /* id_cap */ 1667 M_ID_CAPINFO, /* id_capinfo */ 1668 M_ID_CAPCHAIN, /* id_capchain */ 1669 M_ID_DATA, /* id_data */ 1670 M_ID_DYNAMIC, /* id_dynamic */ 1671 M_ID_DYNSORT, /* id_dynsort */ 1672 M_ID_DYNSTR, /* id_dynstr */ 1673 M_ID_DYNSYM, /* id_dynsym */ 1674 M_ID_DYNSYM_NDX, /* id_dynsym_ndx */ 1675 M_ID_GOT, /* id_got */ 1676 M_ID_UNKNOWN, /* id_gotdata (unused) */ 1677 M_ID_HASH, /* id_hash */ 1678 M_ID_INTERP, /* id_interp */ 1679 M_ID_LBSS, /* id_lbss */ 1680 M_ID_LDYNSYM, /* id_ldynsym */ 1681 M_ID_NOTE, /* id_note */ 1682 M_ID_NULL, /* id_null */ 1683 M_ID_PLT, /* id_plt */ 1684 M_ID_REL, /* id_rel */ 1685 M_ID_STRTAB, /* id_strtab */ 1686 M_ID_SYMINFO, /* id_syminfo */ 1687 M_ID_SYMTAB, /* id_symtab */ 1688 M_ID_SYMTAB_NDX, /* id_symtab_ndx */ 1689 M_ID_TEXT, /* id_text */ 1690 M_ID_TLS, /* id_tls */ 1691 M_ID_TLSBSS, /* id_tlsbss */ 1692 M_ID_UNKNOWN, /* id_unknown */ 1693 M_ID_UNWIND, /* id_unwind */ 1694 M_ID_UNWINDHDR, /* id_unwindhdr */ 1695 M_ID_USER, /* id_user */ 1696 M_ID_VERSION, /* id_version */ 1697 }, 1698 { /* Target_nullfunc */ 1699 nullfunc_tmpl, /* nf_template */ 1700 sizeof (nullfunc_tmpl), /* nf_size */ 1701 }, 1702 { /* Target_fillfunc */ 1703 execfill /* ff_execfill */ 1704 }, 1705 { /* Target_machrel */ 1706 reloc_table, 1707 1708 ld_init_rel, /* mr_init_rel */ 1709 ld_mach_eflags, /* mr_mach_eflags */ 1710 ld_mach_make_dynamic, /* mr_mach_make_dynamic */ 1711 ld_mach_update_odynamic, /* mr_mach_update_odynamic */ 1712 ld_calc_plt_addr, /* mr_calc_plt_addr */ 1713 ld_perform_outreloc, /* mr_perform_outreloc */ 1714 ld_do_activerelocs, /* mr_do_activerelocs */ 1715 ld_add_outrel, /* mr_add_outrel */ 1716 NULL, /* mr_reloc_register */ 1717 ld_reloc_local, /* mr_reloc_local */ 1718 NULL, /* mr_reloc_GOTOP */ 1719 ld_reloc_TLS, /* mr_reloc_TLS */ 1720 NULL, /* mr_assign_got */ 1721 ld_find_got_ndx, /* mr_find_got_ndx */ 1722 ld_calc_got_offset, /* mr_calc_got_offset */ 1723 ld_assign_got_ndx, /* mr_assign_got_ndx */ 1724 ld_assign_plt_ndx, /* mr_assign_plt_ndx */ 1725 NULL, /* mr_allocate_got */ 1726 ld_fillin_gotplt, /* mr_fillin_gotplt */ 1727 }, 1728 { /* Target_machsym */ 1729 NULL, /* ms_reg_check */ 1730 NULL, /* ms_mach_sym_typecheck */ 1731 NULL, /* ms_is_regsym */ 1732 NULL, /* ms_reg_find */ 1733 NULL /* ms_reg_enter */ 1734 } 1735 }; 1736 1737 return (&_ld_targ); 1738 } 1739