1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved. 24 * Copyright (c) 2012, Joyent, Inc. All rights reserved. 25 */ 26 27 /* 28 * amd64 machine dependent and ELF file class dependent functions. 29 * Contains routines for performing function binding and symbol relocations. 30 */ 31 32 #include <stdio.h> 33 #include <sys/elf.h> 34 #include <sys/elf_amd64.h> 35 #include <sys/mman.h> 36 #include <dlfcn.h> 37 #include <synch.h> 38 #include <string.h> 39 #include <debug.h> 40 #include <reloc.h> 41 #include <conv.h> 42 #include "_rtld.h" 43 #include "_audit.h" 44 #include "_elf.h" 45 #include "_inline_gen.h" 46 #include "_inline_reloc.h" 47 #include "msg.h" 48 49 extern void elf_rtbndr(Rt_map *, ulong_t, caddr_t); 50 51 int 52 elf_mach_flags_check(Rej_desc *rej, Ehdr *ehdr) 53 { 54 /* 55 * Check machine type and flags. 56 */ 57 if (ehdr->e_flags != 0) { 58 rej->rej_type = SGS_REJ_BADFLAG; 59 rej->rej_info = (uint_t)ehdr->e_flags; 60 return (0); 61 } 62 return (1); 63 } 64 65 void 66 ldso_plt_init(Rt_map *lmp) 67 { 68 /* 69 * There is no need to analyze ld.so because we don't map in any of 70 * its dependencies. However we may map these dependencies in later 71 * (as if ld.so had dlopened them), so initialize the plt and the 72 * permission information. 73 */ 74 if (PLTGOT(lmp)) 75 elf_plt_init((PLTGOT(lmp)), (caddr_t)lmp); 76 } 77 78 static const uchar_t dyn_plt_template[] = { 79 /* 0x00 */ 0x55, /* pushq %rbp */ 80 /* 0x01 */ 0x48, 0x89, 0xe5, /* movq %rsp, %rbp */ 81 /* 0x04 */ 0x48, 0x83, 0xec, 0x10, /* subq $0x10, %rsp */ 82 /* 0x08 */ 0x4c, 0x8d, 0x1d, 0x00, /* leaq trace_fields(%rip), %r11 */ 83 0x00, 0x00, 0x00, 84 /* 0x0f */ 0x4c, 0x89, 0x5d, 0xf8, /* movq %r11, -0x8(%rbp) */ 85 /* 0x13 */ 0x49, 0xbb, 0x00, 0x00, /* movq $elf_plt_trace, %r11 */ 86 0x00, 0x00, 0x00, 87 0x00, 0x00, 0x00, 88 /* 0x1d */ 0x41, 0xff, 0xe3 /* jmp *%r11 */ 89 /* 0x20 */ 90 }; 91 92 /* 93 * And the virutal outstanding relocations against the 94 * above block are: 95 * 96 * reloc offset Addend symbol 97 * R_AMD64_PC32 0x0b -4 trace_fields 98 * R_AMD64_64 0x15 0 elf_plt_trace 99 */ 100 101 #define TRCREL1OFF 0x0b 102 #define TRCREL2OFF 0x15 103 104 int dyn_plt_ent_size = sizeof (dyn_plt_template); 105 106 /* 107 * the dynamic plt entry is: 108 * 109 * pushq %rbp 110 * movq %rsp, %rbp 111 * subq $0x10, %rsp 112 * leaq trace_fields(%rip), %r11 113 * movq %r11, -0x8(%rbp) 114 * movq $elf_plt_trace, %r11 115 * jmp *%r11 116 * dyn_data: 117 * .align 8 118 * uintptr_t reflmp 119 * uintptr_t deflmp 120 * uint_t symndx 121 * uint_t sb_flags 122 * Sym symdef 123 */ 124 static caddr_t 125 elf_plt_trace_write(ulong_t roffset, Rt_map *rlmp, Rt_map *dlmp, Sym *sym, 126 uint_t symndx, uint_t pltndx, caddr_t to, uint_t sb_flags, int *fail) 127 { 128 extern int elf_plt_trace(); 129 ulong_t got_entry; 130 uchar_t *dyn_plt; 131 uintptr_t *dyndata; 132 133 /* 134 * We only need to add the glue code if there is an auditing 135 * library that is interested in this binding. 136 */ 137 dyn_plt = (uchar_t *)((uintptr_t)AUDINFO(rlmp)->ai_dynplts + 138 (pltndx * dyn_plt_ent_size)); 139 140 /* 141 * Have we initialized this dynamic plt entry yet? If we haven't do it 142 * now. Otherwise this function has been called before, but from a 143 * different plt (ie. from another shared object). In that case 144 * we just set the plt to point to the new dyn_plt. 145 */ 146 if (*dyn_plt == 0) { 147 Sym *symp; 148 Xword symvalue; 149 Lm_list *lml = LIST(rlmp); 150 151 (void) memcpy((void *)dyn_plt, dyn_plt_template, 152 sizeof (dyn_plt_template)); 153 dyndata = (uintptr_t *)((uintptr_t)dyn_plt + 154 ROUND(sizeof (dyn_plt_template), M_WORD_ALIGN)); 155 156 /* 157 * relocate: 158 * leaq trace_fields(%rip), %r11 159 * R_AMD64_PC32 0x0b -4 trace_fields 160 */ 161 symvalue = (Xword)((uintptr_t)dyndata - 162 (uintptr_t)(&dyn_plt[TRCREL1OFF]) - 4); 163 if (do_reloc_rtld(R_AMD64_PC32, &dyn_plt[TRCREL1OFF], 164 &symvalue, MSG_ORIG(MSG_SYM_LADYNDATA), 165 MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) { 166 *fail = 1; 167 return (0); 168 } 169 170 /* 171 * relocating: 172 * movq $elf_plt_trace, %r11 173 * R_AMD64_64 0x15 0 elf_plt_trace 174 */ 175 symvalue = (Xword)elf_plt_trace; 176 if (do_reloc_rtld(R_AMD64_64, &dyn_plt[TRCREL2OFF], 177 &symvalue, MSG_ORIG(MSG_SYM_ELFPLTTRACE), 178 MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) { 179 *fail = 1; 180 return (0); 181 } 182 183 *dyndata++ = (uintptr_t)rlmp; 184 *dyndata++ = (uintptr_t)dlmp; 185 *dyndata = (uintptr_t)(((uint64_t)sb_flags << 32) | symndx); 186 dyndata++; 187 symp = (Sym *)dyndata; 188 *symp = *sym; 189 symp->st_value = (Addr)to; 190 } 191 192 got_entry = (ulong_t)roffset; 193 *(ulong_t *)got_entry = (ulong_t)dyn_plt; 194 return ((caddr_t)dyn_plt); 195 } 196 197 /* 198 * Function binding routine - invoked on the first call to a function through 199 * the procedure linkage table; 200 * passes first through an assembly language interface. 201 * 202 * Takes the offset into the relocation table of the associated 203 * relocation entry and the address of the link map (rt_private_map struct) 204 * for the entry. 205 * 206 * Returns the address of the function referenced after re-writing the PLT 207 * entry to invoke the function directly. 208 * 209 * On error, causes process to terminate with a signal. 210 */ 211 ulong_t 212 elf_bndr(Rt_map *lmp, ulong_t pltndx, caddr_t from) 213 { 214 Rt_map *nlmp, *llmp; 215 ulong_t addr, reloff, symval, rsymndx; 216 char *name; 217 Rela *rptr; 218 Sym *rsym, *nsym; 219 uint_t binfo, sb_flags = 0, dbg_class; 220 Slookup sl; 221 Sresult sr; 222 int entry, lmflags; 223 Lm_list *lml; 224 225 /* 226 * For compatibility with libthread (TI_VERSION 1) we track the entry 227 * value. A zero value indicates we have recursed into ld.so.1 to 228 * further process a locking request. Under this recursion we disable 229 * tsort and cleanup activities. 230 */ 231 entry = enter(0); 232 233 lml = LIST(lmp); 234 if ((lmflags = lml->lm_flags) & LML_FLG_RTLDLM) { 235 dbg_class = dbg_desc->d_class; 236 dbg_desc->d_class = 0; 237 } 238 239 /* 240 * Perform some basic sanity checks. If we didn't get a load map or 241 * the relocation offset is invalid then its possible someone has walked 242 * over the .got entries or jumped to plt0 out of the blue. 243 */ 244 if ((!lmp) && (pltndx <= 245 (ulong_t)PLTRELSZ(lmp) / (ulong_t)RELENT(lmp))) { 246 Conv_inv_buf_t inv_buf; 247 248 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_PLTREF), 249 conv_reloc_amd64_type(R_AMD64_JUMP_SLOT, 0, &inv_buf), 250 EC_NATPTR(lmp), EC_XWORD(pltndx), EC_NATPTR(from)); 251 rtldexit(lml, 1); 252 } 253 reloff = pltndx * (ulong_t)RELENT(lmp); 254 255 /* 256 * Use relocation entry to get symbol table entry and symbol name. 257 */ 258 addr = (ulong_t)JMPREL(lmp); 259 rptr = (Rela *)(addr + reloff); 260 rsymndx = ELF_R_SYM(rptr->r_info); 261 rsym = (Sym *)((ulong_t)SYMTAB(lmp) + (rsymndx * SYMENT(lmp))); 262 name = (char *)(STRTAB(lmp) + rsym->st_name); 263 264 /* 265 * Determine the last link-map of this list, this'll be the starting 266 * point for any tsort() processing. 267 */ 268 llmp = lml->lm_tail; 269 270 /* 271 * Find definition for symbol. Initialize the symbol lookup, and 272 * symbol result, data structures. 273 */ 274 SLOOKUP_INIT(sl, name, lmp, lml->lm_head, ld_entry_cnt, 0, 275 rsymndx, rsym, 0, LKUP_DEFT); 276 SRESULT_INIT(sr, name); 277 278 if (lookup_sym(&sl, &sr, &binfo, NULL) == 0) { 279 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_NOSYM), NAME(lmp), 280 demangle(name)); 281 rtldexit(lml, 1); 282 } 283 284 name = (char *)sr.sr_name; 285 nlmp = sr.sr_dmap; 286 nsym = sr.sr_sym; 287 288 symval = nsym->st_value; 289 290 if (!(FLAGS(nlmp) & FLG_RT_FIXED) && 291 (nsym->st_shndx != SHN_ABS)) 292 symval += ADDR(nlmp); 293 if ((lmp != nlmp) && ((FLAGS1(nlmp) & FL1_RT_NOINIFIN) == 0)) { 294 /* 295 * Record that this new link map is now bound to the caller. 296 */ 297 if (bind_one(lmp, nlmp, BND_REFER) == 0) 298 rtldexit(lml, 1); 299 } 300 301 if ((lml->lm_tflags | AFLAGS(lmp) | AFLAGS(nlmp)) & 302 LML_TFLG_AUD_SYMBIND) { 303 uint_t symndx = (((uintptr_t)nsym - 304 (uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp)); 305 symval = audit_symbind(lmp, nlmp, nsym, symndx, symval, 306 &sb_flags); 307 } 308 309 if (!(rtld_flags & RT_FL_NOBIND)) { 310 addr = rptr->r_offset; 311 if (!(FLAGS(lmp) & FLG_RT_FIXED)) 312 addr += ADDR(lmp); 313 if (((lml->lm_tflags | AFLAGS(lmp)) & 314 (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) && 315 AUDINFO(lmp)->ai_dynplts) { 316 int fail = 0; 317 uint_t pltndx = reloff / sizeof (Rela); 318 uint_t symndx = (((uintptr_t)nsym - 319 (uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp)); 320 321 symval = (ulong_t)elf_plt_trace_write(addr, lmp, nlmp, 322 nsym, symndx, pltndx, (caddr_t)symval, sb_flags, 323 &fail); 324 if (fail) 325 rtldexit(lml, 1); 326 } else { 327 /* 328 * Write standard PLT entry to jump directly 329 * to newly bound function. 330 */ 331 *(ulong_t *)addr = symval; 332 } 333 } 334 335 /* 336 * Print binding information and rebuild PLT entry. 337 */ 338 DBG_CALL(Dbg_bind_global(lmp, (Addr)from, (Off)(from - ADDR(lmp)), 339 (Xword)(reloff / sizeof (Rela)), PLT_T_FULL, nlmp, (Addr)symval, 340 nsym->st_value, name, binfo)); 341 342 /* 343 * Complete any processing for newly loaded objects. Note we don't 344 * know exactly where any new objects are loaded (we know the object 345 * that supplied the symbol, but others may have been loaded lazily as 346 * we searched for the symbol), so sorting starts from the last 347 * link-map know on entry to this routine. 348 */ 349 if (entry) 350 load_completion(llmp); 351 352 /* 353 * Some operations like dldump() or dlopen()'ing a relocatable object 354 * result in objects being loaded on rtld's link-map, make sure these 355 * objects are initialized also. 356 */ 357 if ((LIST(nlmp)->lm_flags & LML_FLG_RTLDLM) && LIST(nlmp)->lm_init) 358 load_completion(nlmp); 359 360 /* 361 * Make sure the object to which we've bound has had it's .init fired. 362 * Cleanup before return to user code. 363 */ 364 if (entry) { 365 is_dep_init(nlmp, lmp); 366 leave(lml, 0); 367 } 368 369 if (lmflags & LML_FLG_RTLDLM) 370 dbg_desc->d_class = dbg_class; 371 372 return (symval); 373 } 374 375 /* 376 * Read and process the relocations for one link object, we assume all 377 * relocation sections for loadable segments are stored contiguously in 378 * the file. 379 */ 380 int 381 elf_reloc(Rt_map *lmp, uint_t plt, int *in_nfavl, APlist **textrel) 382 { 383 ulong_t relbgn, relend, relsiz, basebgn; 384 ulong_t pltbgn, pltend, _pltbgn, _pltend; 385 ulong_t roffset, rsymndx, psymndx = 0; 386 ulong_t dsymndx; 387 uchar_t rtype; 388 long reladd, value, pvalue; 389 Sym *symref, *psymref, *symdef, *psymdef; 390 Syminfo *sip; 391 char *name, *pname; 392 Rt_map *_lmp, *plmp; 393 int ret = 1, noplt = 0; 394 int relacount = RELACOUNT(lmp), plthint = 0; 395 Rela *rel; 396 uint_t binfo, pbinfo; 397 APlist *bound = NULL; 398 399 /* 400 * Although only necessary for lazy binding, initialize the first 401 * global offset entry to go to elf_rtbndr(). dbx(1) seems 402 * to find this useful. 403 */ 404 if ((plt == 0) && PLTGOT(lmp)) { 405 mmapobj_result_t *mpp; 406 407 /* 408 * Make sure the segment is writable. 409 */ 410 if ((((mpp = 411 find_segment((caddr_t)PLTGOT(lmp), lmp)) != NULL) && 412 ((mpp->mr_prot & PROT_WRITE) == 0)) && 413 ((set_prot(lmp, mpp, 1) == 0) || 414 (aplist_append(textrel, mpp, AL_CNT_TEXTREL) == NULL))) 415 return (0); 416 417 elf_plt_init(PLTGOT(lmp), (caddr_t)lmp); 418 } 419 420 /* 421 * Initialize the plt start and end addresses. 422 */ 423 if ((pltbgn = (ulong_t)JMPREL(lmp)) != 0) 424 pltend = pltbgn + (ulong_t)(PLTRELSZ(lmp)); 425 426 relsiz = (ulong_t)(RELENT(lmp)); 427 basebgn = ADDR(lmp); 428 429 if (PLTRELSZ(lmp)) 430 plthint = PLTRELSZ(lmp) / relsiz; 431 432 /* 433 * If we've been called upon to promote an RTLD_LAZY object to an 434 * RTLD_NOW then we're only interested in scaning the .plt table. 435 * An uninitialized .plt is the case where the associated got entry 436 * points back to the plt itself. Determine the range of the real .plt 437 * entries using the _PROCEDURE_LINKAGE_TABLE_ symbol. 438 */ 439 if (plt) { 440 Slookup sl; 441 Sresult sr; 442 443 relbgn = pltbgn; 444 relend = pltend; 445 if (!relbgn || (relbgn == relend)) 446 return (1); 447 448 /* 449 * Initialize the symbol lookup, and symbol result, data 450 * structures. 451 */ 452 SLOOKUP_INIT(sl, MSG_ORIG(MSG_SYM_PLT), lmp, lmp, ld_entry_cnt, 453 elf_hash(MSG_ORIG(MSG_SYM_PLT)), 0, 0, 0, LKUP_DEFT); 454 SRESULT_INIT(sr, MSG_ORIG(MSG_SYM_PLT)); 455 456 if (elf_find_sym(&sl, &sr, &binfo, NULL) == 0) 457 return (1); 458 459 symdef = sr.sr_sym; 460 _pltbgn = symdef->st_value; 461 if (!(FLAGS(lmp) & FLG_RT_FIXED) && 462 (symdef->st_shndx != SHN_ABS)) 463 _pltbgn += basebgn; 464 _pltend = _pltbgn + (((PLTRELSZ(lmp) / relsiz)) * 465 M_PLT_ENTSIZE) + M_PLT_RESERVSZ; 466 467 } else { 468 /* 469 * The relocation sections appear to the run-time linker as a 470 * single table. Determine the address of the beginning and end 471 * of this table. There are two different interpretations of 472 * the ABI at this point: 473 * 474 * o The REL table and its associated RELSZ indicate the 475 * concatenation of *all* relocation sections (this is the 476 * model our link-editor constructs). 477 * 478 * o The REL table and its associated RELSZ indicate the 479 * concatenation of all *but* the .plt relocations. These 480 * relocations are specified individually by the JMPREL and 481 * PLTRELSZ entries. 482 * 483 * Determine from our knowledege of the relocation range and 484 * .plt range, the range of the total relocation table. Note 485 * that one other ABI assumption seems to be that the .plt 486 * relocations always follow any other relocations, the 487 * following range checking drops that assumption. 488 */ 489 relbgn = (ulong_t)(REL(lmp)); 490 relend = relbgn + (ulong_t)(RELSZ(lmp)); 491 if (pltbgn) { 492 if (!relbgn || (relbgn > pltbgn)) 493 relbgn = pltbgn; 494 if (!relbgn || (relend < pltend)) 495 relend = pltend; 496 } 497 } 498 if (!relbgn || (relbgn == relend)) { 499 DBG_CALL(Dbg_reloc_run(lmp, 0, plt, DBG_REL_NONE)); 500 return (1); 501 } 502 DBG_CALL(Dbg_reloc_run(lmp, M_REL_SHT_TYPE, plt, DBG_REL_START)); 503 504 /* 505 * If we're processing a dynamic executable in lazy mode there is no 506 * need to scan the .rel.plt table, however if we're processing a shared 507 * object in lazy mode the .got addresses associated to each .plt must 508 * be relocated to reflect the location of the shared object. 509 */ 510 if (pltbgn && ((MODE(lmp) & RTLD_NOW) == 0) && 511 (FLAGS(lmp) & FLG_RT_FIXED)) 512 noplt = 1; 513 514 sip = SYMINFO(lmp); 515 /* 516 * Loop through relocations. 517 */ 518 while (relbgn < relend) { 519 mmapobj_result_t *mpp; 520 uint_t sb_flags = 0; 521 522 rtype = ELF_R_TYPE(((Rela *)relbgn)->r_info, M_MACH); 523 524 /* 525 * If this is a RELATIVE relocation in a shared object (the 526 * common case), and if we are not debugging, then jump into a 527 * tighter relocation loop (elf_reloc_relative). 528 */ 529 if ((rtype == R_AMD64_RELATIVE) && 530 ((FLAGS(lmp) & FLG_RT_FIXED) == 0) && (DBG_ENABLED == 0)) { 531 if (relacount) { 532 relbgn = elf_reloc_relative_count(relbgn, 533 relacount, relsiz, basebgn, lmp, 534 textrel, 0); 535 relacount = 0; 536 } else { 537 relbgn = elf_reloc_relative(relbgn, relend, 538 relsiz, basebgn, lmp, textrel, 0); 539 } 540 if (relbgn >= relend) 541 break; 542 rtype = ELF_R_TYPE(((Rela *)relbgn)->r_info, M_MACH); 543 } 544 545 roffset = ((Rela *)relbgn)->r_offset; 546 547 /* 548 * If this is a shared object, add the base address to offset. 549 */ 550 if (!(FLAGS(lmp) & FLG_RT_FIXED)) { 551 /* 552 * If we're processing lazy bindings, we have to step 553 * through the plt entries and add the base address 554 * to the corresponding got entry. 555 */ 556 if (plthint && (plt == 0) && 557 (rtype == R_AMD64_JUMP_SLOT) && 558 ((MODE(lmp) & RTLD_NOW) == 0)) { 559 relbgn = elf_reloc_relative_count(relbgn, 560 plthint, relsiz, basebgn, lmp, textrel, 1); 561 plthint = 0; 562 continue; 563 } 564 roffset += basebgn; 565 } 566 567 reladd = (long)(((Rela *)relbgn)->r_addend); 568 rsymndx = ELF_R_SYM(((Rela *)relbgn)->r_info); 569 rel = (Rela *)relbgn; 570 relbgn += relsiz; 571 572 /* 573 * Optimizations. 574 */ 575 if (rtype == R_AMD64_NONE) 576 continue; 577 if (noplt && ((ulong_t)rel >= pltbgn) && 578 ((ulong_t)rel < pltend)) { 579 relbgn = pltend; 580 continue; 581 } 582 583 /* 584 * If we're promoting plts, determine if this one has already 585 * been written. 586 */ 587 if (plt && ((*(ulong_t *)roffset < _pltbgn) || 588 (*(ulong_t *)roffset > _pltend))) 589 continue; 590 591 /* 592 * If this relocation is not against part of the image 593 * mapped into memory we skip it. 594 */ 595 if ((mpp = find_segment((caddr_t)roffset, lmp)) == NULL) { 596 elf_reloc_bad(lmp, (void *)rel, rtype, roffset, 597 rsymndx); 598 continue; 599 } 600 601 binfo = 0; 602 /* 603 * If a symbol index is specified then get the symbol table 604 * entry, locate the symbol definition, and determine its 605 * address. 606 */ 607 if (rsymndx) { 608 /* 609 * If a Syminfo section is provided, determine if this 610 * symbol is deferred, and if so, skip this relocation. 611 */ 612 if (sip && is_sym_deferred((ulong_t)rel, basebgn, lmp, 613 textrel, sip, rsymndx)) 614 continue; 615 616 /* 617 * Get the local symbol table entry. 618 */ 619 symref = (Sym *)((ulong_t)SYMTAB(lmp) + 620 (rsymndx * SYMENT(lmp))); 621 622 /* 623 * If this is a local symbol, just use the base address. 624 * (we should have no local relocations in the 625 * executable). 626 */ 627 if (ELF_ST_BIND(symref->st_info) == STB_LOCAL) { 628 value = basebgn; 629 name = NULL; 630 631 /* 632 * Special case TLS relocations. 633 */ 634 if (rtype == R_AMD64_DTPMOD64) { 635 /* 636 * Use the TLS modid. 637 */ 638 value = TLSMODID(lmp); 639 640 } else if ((rtype == R_AMD64_TPOFF64) || 641 (rtype == R_AMD64_TPOFF32)) { 642 if ((value = elf_static_tls(lmp, symref, 643 rel, rtype, 0, roffset, 0)) == 0) { 644 ret = 0; 645 break; 646 } 647 } 648 } else { 649 /* 650 * If the symbol index is equal to the previous 651 * symbol index relocation we processed then 652 * reuse the previous values. (Note that there 653 * have been cases where a relocation exists 654 * against a copy relocation symbol, our ld(1) 655 * should optimize this away, but make sure we 656 * don't use the same symbol information should 657 * this case exist). 658 */ 659 if ((rsymndx == psymndx) && 660 (rtype != R_AMD64_COPY)) { 661 /* LINTED */ 662 if (psymdef == 0) { 663 DBG_CALL(Dbg_bind_weak(lmp, 664 (Addr)roffset, (Addr) 665 (roffset - basebgn), name)); 666 continue; 667 } 668 /* LINTED */ 669 value = pvalue; 670 /* LINTED */ 671 name = pname; 672 /* LINTED */ 673 symdef = psymdef; 674 /* LINTED */ 675 symref = psymref; 676 /* LINTED */ 677 _lmp = plmp; 678 /* LINTED */ 679 binfo = pbinfo; 680 681 if ((LIST(_lmp)->lm_tflags | 682 AFLAGS(_lmp)) & 683 LML_TFLG_AUD_SYMBIND) { 684 value = audit_symbind(lmp, _lmp, 685 /* LINTED */ 686 symdef, dsymndx, value, 687 &sb_flags); 688 } 689 } else { 690 Slookup sl; 691 Sresult sr; 692 693 /* 694 * Lookup the symbol definition. 695 * Initialize the symbol lookup, and 696 * symbol result, data structure. 697 */ 698 name = (char *)(STRTAB(lmp) + 699 symref->st_name); 700 701 SLOOKUP_INIT(sl, name, lmp, 0, 702 ld_entry_cnt, 0, rsymndx, symref, 703 rtype, LKUP_STDRELOC); 704 SRESULT_INIT(sr, name); 705 symdef = NULL; 706 707 if (lookup_sym(&sl, &sr, &binfo, 708 in_nfavl)) { 709 name = (char *)sr.sr_name; 710 _lmp = sr.sr_dmap; 711 symdef = sr.sr_sym; 712 } 713 714 /* 715 * If the symbol is not found and the 716 * reference was not to a weak symbol, 717 * report an error. Weak references 718 * may be unresolved. 719 */ 720 /* BEGIN CSTYLED */ 721 if (symdef == 0) { 722 if (sl.sl_bind != STB_WEAK) { 723 if (elf_reloc_error(lmp, name, 724 rel, binfo)) 725 continue; 726 727 ret = 0; 728 break; 729 730 } else { 731 psymndx = rsymndx; 732 psymdef = 0; 733 734 DBG_CALL(Dbg_bind_weak(lmp, 735 (Addr)roffset, (Addr) 736 (roffset - basebgn), name)); 737 continue; 738 } 739 } 740 /* END CSTYLED */ 741 742 /* 743 * If symbol was found in an object 744 * other than the referencing object 745 * then record the binding. 746 */ 747 if ((lmp != _lmp) && ((FLAGS1(_lmp) & 748 FL1_RT_NOINIFIN) == 0)) { 749 if (aplist_test(&bound, _lmp, 750 AL_CNT_RELBIND) == 0) { 751 ret = 0; 752 break; 753 } 754 } 755 756 /* 757 * Calculate the location of definition; 758 * symbol value plus base address of 759 * containing shared object. 760 */ 761 if (IS_SIZE(rtype)) 762 value = symdef->st_size; 763 else 764 value = symdef->st_value; 765 766 if (!(FLAGS(_lmp) & FLG_RT_FIXED) && 767 !(IS_SIZE(rtype)) && 768 (symdef->st_shndx != SHN_ABS) && 769 (ELF_ST_TYPE(symdef->st_info) != 770 STT_TLS)) 771 value += ADDR(_lmp); 772 773 /* 774 * Retain this symbol index and the 775 * value in case it can be used for the 776 * subsequent relocations. 777 */ 778 if (rtype != R_AMD64_COPY) { 779 psymndx = rsymndx; 780 pvalue = value; 781 pname = name; 782 psymdef = symdef; 783 psymref = symref; 784 plmp = _lmp; 785 pbinfo = binfo; 786 } 787 if ((LIST(_lmp)->lm_tflags | 788 AFLAGS(_lmp)) & 789 LML_TFLG_AUD_SYMBIND) { 790 dsymndx = (((uintptr_t)symdef - 791 (uintptr_t)SYMTAB(_lmp)) / 792 SYMENT(_lmp)); 793 value = audit_symbind(lmp, _lmp, 794 symdef, dsymndx, value, 795 &sb_flags); 796 } 797 } 798 799 /* 800 * If relocation is PC-relative, subtract 801 * offset address. 802 */ 803 if (IS_PC_RELATIVE(rtype)) 804 value -= roffset; 805 806 /* 807 * Special case TLS relocations. 808 */ 809 if (rtype == R_AMD64_DTPMOD64) { 810 /* 811 * Relocation value is the TLS modid. 812 */ 813 value = TLSMODID(_lmp); 814 815 } else if ((rtype == R_AMD64_TPOFF64) || 816 (rtype == R_AMD64_TPOFF32)) { 817 if ((value = elf_static_tls(_lmp, 818 symdef, rel, rtype, name, roffset, 819 value)) == 0) { 820 ret = 0; 821 break; 822 } 823 } 824 } 825 } else { 826 /* 827 * Special cases. 828 */ 829 if (rtype == R_AMD64_DTPMOD64) { 830 /* 831 * TLS relocation value is the TLS modid. 832 */ 833 value = TLSMODID(lmp); 834 } else 835 value = basebgn; 836 837 name = NULL; 838 } 839 840 DBG_CALL(Dbg_reloc_in(LIST(lmp), ELF_DBG_RTLD, M_MACH, 841 M_REL_SHT_TYPE, rel, NULL, 0, name)); 842 843 /* 844 * Make sure the segment is writable. 845 */ 846 if (((mpp->mr_prot & PROT_WRITE) == 0) && 847 ((set_prot(lmp, mpp, 1) == 0) || 848 (aplist_append(textrel, mpp, AL_CNT_TEXTREL) == NULL))) { 849 ret = 0; 850 break; 851 } 852 853 /* 854 * Call relocation routine to perform required relocation. 855 */ 856 switch (rtype) { 857 case R_AMD64_COPY: 858 if (elf_copy_reloc(name, symref, lmp, (void *)roffset, 859 symdef, _lmp, (const void *)value) == 0) 860 ret = 0; 861 break; 862 case R_AMD64_JUMP_SLOT: 863 if (((LIST(lmp)->lm_tflags | AFLAGS(lmp)) & 864 (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) && 865 AUDINFO(lmp)->ai_dynplts) { 866 int fail = 0; 867 int pltndx = (((ulong_t)rel - 868 (uintptr_t)JMPREL(lmp)) / relsiz); 869 int symndx = (((uintptr_t)symdef - 870 (uintptr_t)SYMTAB(_lmp)) / SYMENT(_lmp)); 871 872 (void) elf_plt_trace_write(roffset, lmp, _lmp, 873 symdef, symndx, pltndx, (caddr_t)value, 874 sb_flags, &fail); 875 if (fail) 876 ret = 0; 877 } else { 878 /* 879 * Write standard PLT entry to jump directly 880 * to newly bound function. 881 */ 882 DBG_CALL(Dbg_reloc_apply_val(LIST(lmp), 883 ELF_DBG_RTLD, (Xword)roffset, 884 (Xword)value)); 885 *(ulong_t *)roffset = value; 886 } 887 break; 888 default: 889 value += reladd; 890 /* 891 * Write the relocation out. 892 */ 893 if (do_reloc_rtld(rtype, (uchar_t *)roffset, 894 (Xword *)&value, name, NAME(lmp), LIST(lmp)) == 0) 895 ret = 0; 896 897 DBG_CALL(Dbg_reloc_apply_val(LIST(lmp), ELF_DBG_RTLD, 898 (Xword)roffset, (Xword)value)); 899 } 900 901 if ((ret == 0) && 902 ((LIST(lmp)->lm_flags & LML_FLG_TRC_WARN) == 0)) 903 break; 904 905 if (binfo) { 906 DBG_CALL(Dbg_bind_global(lmp, (Addr)roffset, 907 (Off)(roffset - basebgn), (Xword)(-1), PLT_T_FULL, 908 _lmp, (Addr)value, symdef->st_value, name, binfo)); 909 } 910 } 911 912 return (relocate_finish(lmp, bound, ret)); 913 } 914 915 /* 916 * Initialize the first few got entries so that function calls go to 917 * elf_rtbndr: 918 * 919 * GOT[GOT_XLINKMAP] = the address of the link map 920 * GOT[GOT_XRTLD] = the address of rtbinder 921 */ 922 void 923 elf_plt_init(void *got, caddr_t l) 924 { 925 uint64_t *_got; 926 /* LINTED */ 927 Rt_map *lmp = (Rt_map *)l; 928 929 _got = (uint64_t *)got + M_GOT_XLINKMAP; 930 *_got = (uint64_t)lmp; 931 _got = (uint64_t *)got + M_GOT_XRTLD; 932 *_got = (uint64_t)elf_rtbndr; 933 } 934 935 /* 936 * Plt writing interface to allow debugging initialization to be generic. 937 */ 938 Pltbindtype 939 /* ARGSUSED1 */ 940 elf_plt_write(uintptr_t addr, uintptr_t vaddr, void *rptr, uintptr_t symval, 941 Xword pltndx) 942 { 943 Rela *rel = (Rela*)rptr; 944 uintptr_t pltaddr; 945 946 pltaddr = addr + rel->r_offset; 947 *(ulong_t *)pltaddr = (ulong_t)symval + rel->r_addend; 948 DBG_CALL(pltcntfull++); 949 return (PLT_T_FULL); 950 } 951 952 /* 953 * Provide a machine specific interface to the conversion routine. By calling 954 * the machine specific version, rather than the generic version, we insure that 955 * the data tables/strings for all known machine versions aren't dragged into 956 * ld.so.1. 957 */ 958 const char * 959 _conv_reloc_type(uint_t rel) 960 { 961 static Conv_inv_buf_t inv_buf; 962 963 return (conv_reloc_amd64_type(rel, 0, &inv_buf)); 964 } 965