1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
24 */
25
26 /* Get the x86 version of the relocation engine */
27 #define DO_RELOC_LIBLD_X86
28
29 #include <string.h>
30 #include <stdio.h>
31 #include <strings.h>
32 #include <sys/elf_amd64.h>
33 #include <debug.h>
34 #include <reloc.h>
35 #include <i386/machdep_x86.h>
36 #include "msg.h"
37 #include "_libld.h"
38
39 /*
40 * This module uses do_reloc_ld() to execute several synthesized relocations.
41 * That function expects to be passed two things that we need to construct
42 * here:
43 *
44 * 1) A Rel_desc descriptor for each relocation type, from which the
45 * rel_rtype field, and nothing else, is obtained. This is easily
46 * handled by constructing the necessary descriptors.
47 *
48 * 2) A function, which called with the Rel_desc descriptor, returns
49 * a string representing the name of the symbol associated with
50 * the descriptor. The usual function for this is ld_reloc_sym_name().
51 * However, that function will not work in this case, as these synthetic
52 * relocations do not have an associated symbol. We supply the
53 * syn_rdesc_sym_name() function to simply return the fixed name.
54 */
55 static Rel_desc rdesc_r_amd64_gotpcrel = {
56 NULL, NULL, NULL, 0, 0, 0, R_AMD64_GOTPCREL };
57 static Rel_desc rdesc_r_amd64_32 = {
58 NULL, NULL, NULL, 0, 0, 0, R_AMD64_32 };
59 static Rel_desc rdesc_r_amd64_pc32 = {
60 NULL, NULL, NULL, 0, 0, 0, R_AMD64_PC32 };
61
62 /*ARGSUSED*/
63 static const char *
syn_rdesc_sym_name(Rel_desc * rdesc)64 syn_rdesc_sym_name(Rel_desc *rdesc)
65 {
66 return (MSG_ORIG(MSG_SYM_PLTENT));
67 }
68
69 /*
70 * Search the GOT index list for a GOT entry with a matching reference and the
71 * proper addend.
72 */
73 static Gotndx *
ld_find_got_ndx(Alist * alp,Gotref gref,Ofl_desc * ofl,Rel_desc * rdesc)74 ld_find_got_ndx(Alist *alp, Gotref gref, Ofl_desc *ofl, Rel_desc *rdesc)
75 {
76 Aliste idx;
77 Gotndx *gnp;
78
79 assert(rdesc != 0);
80
81 if ((gref == GOT_REF_TLSLD) && ofl->ofl_tlsldgotndx)
82 return (ofl->ofl_tlsldgotndx);
83
84 for (ALIST_TRAVERSE(alp, idx, gnp)) {
85 if ((rdesc->rel_raddend == gnp->gn_addend) &&
86 (gnp->gn_gotref == gref)) {
87 return (gnp);
88 }
89 }
90 return (NULL);
91 }
92
93 static Xword
ld_calc_got_offset(Rel_desc * rdesc,Ofl_desc * ofl)94 ld_calc_got_offset(Rel_desc *rdesc, Ofl_desc *ofl)
95 {
96 Os_desc *osp = ofl->ofl_osgot;
97 Sym_desc *sdp = rdesc->rel_sym;
98 Xword gotndx;
99 Gotref gref;
100 Gotndx *gnp;
101
102 if (rdesc->rel_flags & FLG_REL_DTLS)
103 gref = GOT_REF_TLSGD;
104 else if (rdesc->rel_flags & FLG_REL_MTLS)
105 gref = GOT_REF_TLSLD;
106 else if (rdesc->rel_flags & FLG_REL_STLS)
107 gref = GOT_REF_TLSIE;
108 else
109 gref = GOT_REF_GENERIC;
110
111 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, rdesc);
112 assert(gnp);
113
114 gotndx = (Xword)gnp->gn_gotndx;
115
116 if ((rdesc->rel_flags & FLG_REL_DTLS) &&
117 (rdesc->rel_rtype == R_AMD64_DTPOFF64))
118 gotndx++;
119
120 return ((Xword)(osp->os_shdr->sh_addr + (gotndx * M_GOT_ENTSIZE)));
121 }
122
123 static Word
ld_init_rel(Rel_desc * reld,Word * typedata,void * reloc)124 ld_init_rel(Rel_desc *reld, Word *typedata, void *reloc)
125 {
126 Rela *rel = (Rela *)reloc;
127
128 /* LINTED */
129 reld->rel_rtype = (Word)ELF_R_TYPE(rel->r_info, M_MACH);
130 reld->rel_roffset = rel->r_offset;
131 reld->rel_raddend = rel->r_addend;
132 *typedata = 0;
133
134 reld->rel_flags |= FLG_REL_RELA;
135
136 return ((Word)ELF_R_SYM(rel->r_info));
137 }
138
139 static void
ld_mach_eflags(Ehdr * ehdr,Ofl_desc * ofl)140 ld_mach_eflags(Ehdr *ehdr, Ofl_desc *ofl)
141 {
142 ofl->ofl_dehdr->e_flags |= ehdr->e_flags;
143 }
144
145 static void
ld_mach_make_dynamic(Ofl_desc * ofl,size_t * cnt)146 ld_mach_make_dynamic(Ofl_desc *ofl, size_t *cnt)
147 {
148 if (!(ofl->ofl_flags & FLG_OF_RELOBJ)) {
149 /*
150 * Create this entry if we are going to create a PLT table.
151 */
152 if (ofl->ofl_pltcnt)
153 (*cnt)++; /* DT_PLTGOT */
154 }
155 }
156
157 static void
ld_mach_update_odynamic(Ofl_desc * ofl,Dyn ** dyn)158 ld_mach_update_odynamic(Ofl_desc *ofl, Dyn **dyn)
159 {
160 if (((ofl->ofl_flags & FLG_OF_RELOBJ) == 0) && ofl->ofl_pltcnt) {
161 (*dyn)->d_tag = DT_PLTGOT;
162 if (ofl->ofl_osgot)
163 (*dyn)->d_un.d_ptr = ofl->ofl_osgot->os_shdr->sh_addr;
164 else
165 (*dyn)->d_un.d_ptr = 0;
166 (*dyn)++;
167 }
168 }
169
170 static Xword
ld_calc_plt_addr(Sym_desc * sdp,Ofl_desc * ofl)171 ld_calc_plt_addr(Sym_desc *sdp, Ofl_desc *ofl)
172 {
173 Xword value;
174
175 value = (Xword)(ofl->ofl_osplt->os_shdr->sh_addr) +
176 M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) * M_PLT_ENTSIZE);
177 return (value);
178 }
179
180 /*
181 * Build a single plt entry - code is:
182 * JMP *name1@GOTPCREL(%rip)
183 * PUSHL $index
184 * JMP .PLT0
185 */
186 static uchar_t pltn_entry[M_PLT_ENTSIZE] = {
187 /* 0x00 jmpq *name1@GOTPCREL(%rip) */ 0xff, 0x25, 0x00, 0x00, 0x00, 0x00,
188 /* 0x06 pushq $index */ 0x68, 0x00, 0x00, 0x00, 0x00,
189 /* 0x0b jmpq .plt0(%rip) */ 0xe9, 0x00, 0x00, 0x00, 0x00
190 /* 0x10 */
191 };
192
193 static uintptr_t
plt_entry(Ofl_desc * ofl,Sym_desc * sdp)194 plt_entry(Ofl_desc * ofl, Sym_desc * sdp)
195 {
196 uchar_t *plt0, *pltent, *gotent;
197 Sword plt_off;
198 Word got_off;
199 Xword val1;
200 int bswap = (ofl->ofl_flags1 & FLG_OF1_ENCDIFF) != 0;
201
202 got_off = sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE;
203 plt_off = M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) *
204 M_PLT_ENTSIZE);
205 plt0 = (uchar_t *)(ofl->ofl_osplt->os_outdata->d_buf);
206 pltent = plt0 + plt_off;
207 gotent = (uchar_t *)(ofl->ofl_osgot->os_outdata->d_buf) + got_off;
208
209 bcopy(pltn_entry, pltent, sizeof (pltn_entry));
210 /*
211 * Fill in the got entry with the address of the next instruction.
212 */
213 /* LINTED */
214 *(Word *)gotent = ofl->ofl_osplt->os_shdr->sh_addr + plt_off +
215 M_PLT_INSSIZE;
216 if (bswap)
217 /* LINTED */
218 *(Word *)gotent = ld_bswap_Word(*(Word *)gotent);
219
220 /*
221 * If '-z noreloc' is specified - skip the do_reloc_ld
222 * stage.
223 */
224 if (!OFL_DO_RELOC(ofl))
225 return (1);
226
227 /*
228 * patchup:
229 * jmpq *name1@gotpcrel(%rip)
230 *
231 * NOTE: 0x06 represents next instruction.
232 */
233 val1 = (ofl->ofl_osgot->os_shdr->sh_addr + got_off) -
234 (ofl->ofl_osplt->os_shdr->sh_addr + plt_off) - 0x06;
235
236 if (do_reloc_ld(&rdesc_r_amd64_gotpcrel, &pltent[0x02], &val1,
237 syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT), bswap,
238 ofl->ofl_lml) == 0) {
239 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLTNFAIL),
240 sdp->sd_aux->sa_PLTndx, demangle(sdp->sd_name));
241 return (S_ERROR);
242 }
243
244 /*
245 * patchup:
246 * pushq $pltndx
247 */
248 val1 = (Xword)(sdp->sd_aux->sa_PLTndx - 1);
249
250 if (do_reloc_ld(&rdesc_r_amd64_32, &pltent[0x07], &val1,
251 syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT), bswap,
252 ofl->ofl_lml) == 0) {
253 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLTNFAIL),
254 sdp->sd_aux->sa_PLTndx, demangle(sdp->sd_name));
255 return (S_ERROR);
256 }
257
258 /*
259 * patchup:
260 * jmpq .plt0(%rip)
261 * NOTE: 0x10 represents next instruction. The rather complex
262 * series of casts is necessary to sign extend an offset into
263 * a 64-bit value while satisfying various compiler error
264 * checks. Handle with care.
265 */
266 val1 = (Xword)((intptr_t)((uintptr_t)plt0 -
267 (uintptr_t)(&pltent[0x10])));
268
269 if (do_reloc_ld(&rdesc_r_amd64_pc32, &pltent[0x0c], &val1,
270 syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT), bswap,
271 ofl->ofl_lml) == 0) {
272 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLTNFAIL),
273 sdp->sd_aux->sa_PLTndx, demangle(sdp->sd_name));
274 return (S_ERROR);
275 }
276
277 return (1);
278 }
279
280 static uintptr_t
ld_perform_outreloc(Rel_desc * orsp,Ofl_desc * ofl,Boolean * remain_seen)281 ld_perform_outreloc(Rel_desc * orsp, Ofl_desc * ofl, Boolean *remain_seen)
282 {
283 Os_desc * relosp, * osp = 0;
284 Word ndx;
285 Xword roffset, value;
286 Sxword raddend;
287 Rela rea;
288 char *relbits;
289 Sym_desc * sdp, * psym = (Sym_desc *)0;
290 int sectmoved = 0;
291
292 raddend = orsp->rel_raddend;
293 sdp = orsp->rel_sym;
294
295 /*
296 * If the section this relocation is against has been discarded
297 * (-zignore), then also discard (skip) the relocation itself.
298 */
299 if (orsp->rel_isdesc && ((orsp->rel_flags &
300 (FLG_REL_GOT | FLG_REL_BSS | FLG_REL_PLT | FLG_REL_NOINFO)) == 0) &&
301 (orsp->rel_isdesc->is_flags & FLG_IS_DISCARD)) {
302 DBG_CALL(Dbg_reloc_discard(ofl->ofl_lml, M_MACH, orsp));
303 return (1);
304 }
305
306 /*
307 * If this is a relocation against a move table, or expanded move
308 * table, adjust the relocation entries.
309 */
310 if (RELAUX_GET_MOVE(orsp))
311 ld_adj_movereloc(ofl, orsp);
312
313 /*
314 * If this is a relocation against a section then we need to adjust the
315 * raddend field to compensate for the new position of the input section
316 * within the new output section.
317 */
318 if (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION) {
319 if (ofl->ofl_parsyms &&
320 (sdp->sd_isc->is_flags & FLG_IS_RELUPD) &&
321 /* LINTED */
322 (psym = ld_am_I_partial(orsp, orsp->rel_raddend))) {
323 DBG_CALL(Dbg_move_outsctadj(ofl->ofl_lml, psym));
324 sectmoved = 1;
325 if (ofl->ofl_flags & FLG_OF_RELOBJ)
326 raddend = psym->sd_sym->st_value;
327 else
328 raddend = psym->sd_sym->st_value -
329 psym->sd_isc->is_osdesc->os_shdr->sh_addr;
330 /* LINTED */
331 raddend += (Off)_elf_getxoff(psym->sd_isc->is_indata);
332 if (psym->sd_isc->is_shdr->sh_flags & SHF_ALLOC)
333 raddend +=
334 psym->sd_isc->is_osdesc->os_shdr->sh_addr;
335 } else {
336 /* LINTED */
337 raddend += (Off)_elf_getxoff(sdp->sd_isc->is_indata);
338 if (sdp->sd_isc->is_shdr->sh_flags & SHF_ALLOC)
339 raddend +=
340 sdp->sd_isc->is_osdesc->os_shdr->sh_addr;
341 }
342 }
343
344 value = sdp->sd_sym->st_value;
345
346 if (orsp->rel_flags & FLG_REL_GOT) {
347 /*
348 * Note: for GOT relative relocations on amd64
349 * we discard the addend. It was relevant
350 * to the reference - not to the data item
351 * being referenced (ie: that -4 thing).
352 */
353 raddend = 0;
354 osp = ofl->ofl_osgot;
355 roffset = ld_calc_got_offset(orsp, ofl);
356
357 } else if (orsp->rel_flags & FLG_REL_PLT) {
358 /*
359 * Note that relocations for PLT's actually
360 * cause a relocation againt the GOT.
361 */
362 osp = ofl->ofl_osplt;
363 roffset = (ofl->ofl_osgot->os_shdr->sh_addr) +
364 sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE;
365 raddend = 0;
366 if (plt_entry(ofl, sdp) == S_ERROR)
367 return (S_ERROR);
368
369 } else if (orsp->rel_flags & FLG_REL_BSS) {
370 /*
371 * This must be a R_AMD64_COPY. For these set the roffset to
372 * point to the new symbols location.
373 */
374 osp = ofl->ofl_isbss->is_osdesc;
375 roffset = value;
376
377 /*
378 * The raddend doesn't mean anything in a R_SPARC_COPY
379 * relocation. Null it out because it can confuse people.
380 */
381 raddend = 0;
382 } else {
383 osp = RELAUX_GET_OSDESC(orsp);
384
385 /*
386 * Calculate virtual offset of reference point; equals offset
387 * into section + vaddr of section for loadable sections, or
388 * offset plus section displacement for nonloadable sections.
389 */
390 roffset = orsp->rel_roffset +
391 (Off)_elf_getxoff(orsp->rel_isdesc->is_indata);
392 if (!(ofl->ofl_flags & FLG_OF_RELOBJ))
393 roffset += orsp->rel_isdesc->is_osdesc->
394 os_shdr->sh_addr;
395 }
396
397 if ((osp == 0) || ((relosp = osp->os_relosdesc) == 0))
398 relosp = ofl->ofl_osrel;
399
400 /*
401 * Assign the symbols index for the output relocation. If the
402 * relocation refers to a SECTION symbol then it's index is based upon
403 * the output sections symbols index. Otherwise the index can be
404 * derived from the symbols index itself.
405 */
406 if (orsp->rel_rtype == R_AMD64_RELATIVE)
407 ndx = STN_UNDEF;
408 else if ((orsp->rel_flags & FLG_REL_SCNNDX) ||
409 (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION)) {
410 if (sectmoved == 0) {
411 /*
412 * Check for a null input section. This can
413 * occur if this relocation references a symbol
414 * generated by sym_add_sym().
415 */
416 if (sdp->sd_isc && sdp->sd_isc->is_osdesc)
417 ndx = sdp->sd_isc->is_osdesc->os_identndx;
418 else
419 ndx = sdp->sd_shndx;
420 } else
421 ndx = ofl->ofl_parexpnndx;
422 } else
423 ndx = sdp->sd_symndx;
424
425 /*
426 * Add the symbols 'value' to the addend field.
427 */
428 if (orsp->rel_flags & FLG_REL_ADVAL)
429 raddend += value;
430
431 /*
432 * The addend field for R_AMD64_DTPMOD64 means nothing. The addend
433 * is propagated in the corresponding R_AMD64_DTPOFF64 relocation.
434 */
435 if (orsp->rel_rtype == R_AMD64_DTPMOD64)
436 raddend = 0;
437
438 if ((orsp->rel_rtype != M_R_NONE) &&
439 (orsp->rel_rtype != M_R_RELATIVE)) {
440 if (ndx == 0) {
441 Conv_inv_buf_t inv_buf;
442 Is_desc *isp = orsp->rel_isdesc;
443
444 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_REL_NOSYMBOL),
445 conv_reloc_type(ofl->ofl_nehdr->e_machine,
446 orsp->rel_rtype, 0, &inv_buf),
447 isp->is_file->ifl_name, EC_WORD(isp->is_scnndx),
448 isp->is_name, EC_XWORD(roffset));
449 return (S_ERROR);
450 }
451 }
452
453 rea.r_info = ELF_R_INFO(ndx, orsp->rel_rtype);
454 rea.r_offset = roffset;
455 rea.r_addend = raddend;
456 DBG_CALL(Dbg_reloc_out(ofl, ELF_DBG_LD, SHT_RELA, &rea, relosp->os_name,
457 ld_reloc_sym_name(orsp)));
458
459 /*
460 * Assert we haven't walked off the end of our relocation table.
461 */
462 assert(relosp->os_szoutrels <= relosp->os_shdr->sh_size);
463
464 relbits = (char *)relosp->os_outdata->d_buf;
465
466 (void) memcpy((relbits + relosp->os_szoutrels),
467 (char *)&rea, sizeof (Rela));
468 relosp->os_szoutrels += (Xword)sizeof (Rela);
469
470 /*
471 * Determine if this relocation is against a non-writable, allocatable
472 * section. If so we may need to provide a text relocation diagnostic.
473 * Note that relocations against the .plt (R_AMD64_JUMP_SLOT) actually
474 * result in modifications to the .got.
475 */
476 if (orsp->rel_rtype == R_AMD64_JUMP_SLOT)
477 osp = ofl->ofl_osgot;
478
479 ld_reloc_remain_entry(orsp, osp, ofl, remain_seen);
480 return (1);
481 }
482
483 /*
484 * amd64 Instructions for TLS processing
485 */
486 static uchar_t tlsinstr_gd_ie[] = {
487 /*
488 * 0x00 movq %fs:0, %rax
489 */
490 0x64, 0x48, 0x8b, 0x04, 0x25,
491 0x00, 0x00, 0x00, 0x00,
492 /*
493 * 0x09 addq x@gottpoff(%rip), %rax
494 */
495 0x48, 0x03, 0x05, 0x00, 0x00,
496 0x00, 0x00
497 };
498
499 static uchar_t tlsinstr_gd_le[] = {
500 /*
501 * 0x00 movq %fs:0, %rax
502 */
503 0x64, 0x48, 0x8b, 0x04, 0x25,
504 0x00, 0x00, 0x00, 0x00,
505 /*
506 * 0x09 leaq x@gottpoff(%rip), %rax
507 */
508 0x48, 0x8d, 0x80, 0x00, 0x00,
509 0x00, 0x00
510 };
511
512 static uchar_t tlsinstr_ld_le[] = {
513 /*
514 * .byte 0x66
515 */
516 0x66,
517 /*
518 * .byte 0x66
519 */
520 0x66,
521 /*
522 * .byte 0x66
523 */
524 0x66,
525 /*
526 * movq %fs:0, %rax
527 */
528 0x64, 0x48, 0x8b, 0x04, 0x25,
529 0x00, 0x00, 0x00, 0x00
530 };
531
532 #define REX_B 0x1
533 #define REX_X 0x2
534 #define REX_R 0x4
535 #define REX_W 0x8
536 #define REX_PREFIX 0x40
537
538 #define REX_RW (REX_PREFIX | REX_R | REX_W)
539 #define REX_BW (REX_PREFIX | REX_B | REX_W)
540 #define REX_BRW (REX_PREFIX | REX_B | REX_R | REX_W)
541
542 #define REG_ESP 0x4
543
544 #define INSN_ADDMR 0x03 /* addq mem,reg */
545 #define INSN_ADDIR 0x81 /* addq imm,reg */
546 #define INSN_MOVMR 0x8b /* movq mem,reg */
547 #define INSN_MOVIR 0xc7 /* movq imm,reg */
548 #define INSN_LEA 0x8d /* leaq mem,reg */
549
550 static Fixupret
tls_fixups(Ofl_desc * ofl,Rel_desc * arsp)551 tls_fixups(Ofl_desc *ofl, Rel_desc *arsp)
552 {
553 Sym_desc *sdp = arsp->rel_sym;
554 Word rtype = arsp->rel_rtype;
555 uchar_t *offset;
556
557 offset = (uchar_t *)((uintptr_t)arsp->rel_roffset +
558 (uintptr_t)_elf_getxoff(arsp->rel_isdesc->is_indata) +
559 (uintptr_t)RELAUX_GET_OSDESC(arsp)->os_outdata->d_buf);
560
561 /*
562 * Note that in certain of the original insn sequences below, the
563 * instructions are not necessarily adjacent
564 */
565 if (sdp->sd_ref == REF_DYN_NEED) {
566 /*
567 * IE reference model
568 */
569 switch (rtype) {
570 case R_AMD64_TLSGD:
571 /*
572 * GD -> IE
573 *
574 * Transition:
575 * 0x00 .byte 0x66
576 * 0x01 leaq x@tlsgd(%rip), %rdi
577 * 0x08 .word 0x6666
578 * 0x0a rex64
579 * 0x0b call __tls_get_addr@plt
580 * 0x10
581 * To:
582 * 0x00 movq %fs:0, %rax
583 * 0x09 addq x@gottpoff(%rip), %rax
584 * 0x10
585 */
586 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
587 R_AMD64_GOTTPOFF, arsp, ld_reloc_sym_name));
588 arsp->rel_rtype = R_AMD64_GOTTPOFF;
589 arsp->rel_roffset += 8;
590 arsp->rel_raddend = (Sxword)-4;
591
592 /*
593 * Adjust 'offset' to beginning of instruction
594 * sequence.
595 */
596 offset -= 4;
597 (void) memcpy(offset, tlsinstr_gd_ie,
598 sizeof (tlsinstr_gd_ie));
599 return (FIX_RELOC);
600
601 case R_AMD64_PLT32:
602 /*
603 * Fixup done via the TLS_GD relocation.
604 */
605 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
606 R_AMD64_NONE, arsp, ld_reloc_sym_name));
607 return (FIX_DONE);
608 }
609 }
610
611 /*
612 * LE reference model
613 */
614 switch (rtype) {
615 case R_AMD64_TLSGD:
616 /*
617 * GD -> LE
618 *
619 * Transition:
620 * 0x00 .byte 0x66
621 * 0x01 leaq x@tlsgd(%rip), %rdi
622 * 0x08 .word 0x6666
623 * 0x0a rex64
624 * 0x0b call __tls_get_addr@plt
625 * 0x10
626 * To:
627 * 0x00 movq %fs:0, %rax
628 * 0x09 leaq x@tpoff(%rax), %rax
629 * 0x10
630 */
631 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
632 R_AMD64_TPOFF32, arsp, ld_reloc_sym_name));
633 arsp->rel_rtype = R_AMD64_TPOFF32;
634 arsp->rel_roffset += 8;
635 arsp->rel_raddend = 0;
636
637 /*
638 * Adjust 'offset' to beginning of instruction sequence.
639 */
640 offset -= 4;
641 (void) memcpy(offset, tlsinstr_gd_le, sizeof (tlsinstr_gd_le));
642 return (FIX_RELOC);
643
644 case R_AMD64_GOTTPOFF: {
645 /*
646 * IE -> LE
647 *
648 * Transition 1:
649 * movq %fs:0, %reg
650 * addq x@gottpoff(%rip), %reg
651 * To:
652 * movq %fs:0, %reg
653 * leaq x@tpoff(%reg), %reg
654 *
655 * Transition (as a special case):
656 * movq %fs:0, %r12/%rsp
657 * addq x@gottpoff(%rip), %r12/%rsp
658 * To:
659 * movq %fs:0, %r12/%rsp
660 * addq x@tpoff(%rax), %r12/%rsp
661 *
662 * Transition 2:
663 * movq x@gottpoff(%rip), %reg
664 * movq %fs:(%reg), %reg
665 * To:
666 * movq x@tpoff(%reg), %reg
667 * movq %fs:(%reg), %reg
668 */
669 Conv_inv_buf_t inv_buf;
670 uint8_t reg; /* Register */
671
672 offset -= 3;
673
674 reg = offset[2] >> 3; /* Encoded dest. reg. operand */
675
676 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
677 R_AMD64_TPOFF32, arsp, ld_reloc_sym_name));
678 arsp->rel_rtype = R_AMD64_TPOFF32;
679 arsp->rel_raddend = 0;
680
681 /*
682 * This is transition 2, and the special case of form 1 where
683 * a normal transition would index %rsp or %r12 and need a SIB
684 * byte in the leaq for which we lack space
685 */
686 if ((offset[1] == INSN_MOVMR) ||
687 ((offset[1] == INSN_ADDMR) && (reg == REG_ESP))) {
688 /*
689 * If we needed an extra bit of MOD.reg to refer to
690 * this register as the dest of the original movq we
691 * need an extra bit of MOD.rm to refer to it in the
692 * dest of the replacement movq or addq.
693 */
694 if (offset[0] == REX_RW)
695 offset[0] = REX_BW;
696
697 offset[1] = (offset[1] == INSN_MOVMR) ?
698 INSN_MOVIR : INSN_ADDIR;
699 offset[2] = 0xc0 | reg;
700
701 return (FIX_RELOC);
702 } else if (offset[1] == INSN_ADDMR) {
703 /*
704 * If we needed an extra bit of MOD.reg to refer to
705 * this register in the dest of the addq we need an
706 * extra bit of both MOD.reg and MOD.rm to refer to it
707 * in the source and dest of the leaq
708 */
709 if (offset[0] == REX_RW)
710 offset[0] = REX_BRW;
711
712 offset[1] = INSN_LEA;
713 offset[2] = 0x80 | (reg << 3) | reg;
714
715 return (FIX_RELOC);
716 }
717
718 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_REL_BADTLSINS),
719 conv_reloc_amd64_type(arsp->rel_rtype, 0, &inv_buf),
720 arsp->rel_isdesc->is_file->ifl_name,
721 ld_reloc_sym_name(arsp),
722 arsp->rel_isdesc->is_name,
723 EC_OFF(arsp->rel_roffset));
724 return (FIX_ERROR);
725 }
726 case R_AMD64_TLSLD:
727 /*
728 * LD -> LE
729 *
730 * Transition
731 * 0x00 leaq x1@tlsgd(%rip), %rdi
732 * 0x07 call __tls_get_addr@plt
733 * 0x0c
734 * To:
735 * 0x00 .byte 0x66
736 * 0x01 .byte 0x66
737 * 0x02 .byte 0x66
738 * 0x03 movq %fs:0, %rax
739 */
740 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
741 R_AMD64_NONE, arsp, ld_reloc_sym_name));
742 offset -= 3;
743 (void) memcpy(offset, tlsinstr_ld_le, sizeof (tlsinstr_ld_le));
744 return (FIX_DONE);
745
746 case R_AMD64_DTPOFF32:
747 /*
748 * LD->LE
749 *
750 * Transition:
751 * 0x00 leaq x1@dtpoff(%rax), %rcx
752 * To:
753 * 0x00 leaq x1@tpoff(%rax), %rcx
754 */
755 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
756 R_AMD64_TPOFF32, arsp, ld_reloc_sym_name));
757 arsp->rel_rtype = R_AMD64_TPOFF32;
758 return (FIX_RELOC);
759 }
760
761 return (FIX_RELOC);
762 }
763
764 static uintptr_t
ld_do_activerelocs(Ofl_desc * ofl)765 ld_do_activerelocs(Ofl_desc *ofl)
766 {
767 Rel_desc *arsp;
768 Rel_cachebuf *rcbp;
769 Aliste idx;
770 uintptr_t return_code = 1;
771 ofl_flag_t flags = ofl->ofl_flags;
772
773 if (aplist_nitems(ofl->ofl_actrels.rc_list) != 0)
774 DBG_CALL(Dbg_reloc_doact_title(ofl->ofl_lml));
775
776 /*
777 * Process active relocations.
778 */
779 REL_CACHE_TRAVERSE(&ofl->ofl_actrels, idx, rcbp, arsp) {
780 uchar_t *addr;
781 Xword value;
782 Sym_desc *sdp;
783 const char *ifl_name;
784 Xword refaddr;
785 int moved = 0;
786 Gotref gref;
787 Os_desc *osp;
788
789 /*
790 * If the section this relocation is against has been discarded
791 * (-zignore), then discard (skip) the relocation itself.
792 */
793 if ((arsp->rel_isdesc->is_flags & FLG_IS_DISCARD) &&
794 ((arsp->rel_flags & (FLG_REL_GOT | FLG_REL_BSS |
795 FLG_REL_PLT | FLG_REL_NOINFO)) == 0)) {
796 DBG_CALL(Dbg_reloc_discard(ofl->ofl_lml, M_MACH, arsp));
797 continue;
798 }
799
800 /*
801 * We determine what the 'got reference' model (if required)
802 * is at this point. This needs to be done before tls_fixup()
803 * since it may 'transition' our instructions.
804 *
805 * The got table entries have already been assigned,
806 * and we bind to those initial entries.
807 */
808 if (arsp->rel_flags & FLG_REL_DTLS)
809 gref = GOT_REF_TLSGD;
810 else if (arsp->rel_flags & FLG_REL_MTLS)
811 gref = GOT_REF_TLSLD;
812 else if (arsp->rel_flags & FLG_REL_STLS)
813 gref = GOT_REF_TLSIE;
814 else
815 gref = GOT_REF_GENERIC;
816
817 /*
818 * Perform any required TLS fixups.
819 */
820 if (arsp->rel_flags & FLG_REL_TLSFIX) {
821 Fixupret ret;
822
823 if ((ret = tls_fixups(ofl, arsp)) == FIX_ERROR)
824 return (S_ERROR);
825 if (ret == FIX_DONE)
826 continue;
827 }
828
829 /*
830 * If this is a relocation against a move table, or
831 * expanded move table, adjust the relocation entries.
832 */
833 if (RELAUX_GET_MOVE(arsp))
834 ld_adj_movereloc(ofl, arsp);
835
836 sdp = arsp->rel_sym;
837 refaddr = arsp->rel_roffset +
838 (Off)_elf_getxoff(arsp->rel_isdesc->is_indata);
839
840 if ((arsp->rel_flags & FLG_REL_CLVAL) ||
841 (arsp->rel_flags & FLG_REL_GOTCL))
842 value = 0;
843 else if (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION) {
844 Sym_desc *sym;
845
846 /*
847 * The value for a symbol pointing to a SECTION
848 * is based off of that sections position.
849 */
850 if ((sdp->sd_isc->is_flags & FLG_IS_RELUPD) &&
851 /* LINTED */
852 (sym = ld_am_I_partial(arsp, arsp->rel_raddend))) {
853 /*
854 * The symbol was moved, so adjust the value
855 * relative to the new section.
856 */
857 value = sym->sd_sym->st_value;
858 moved = 1;
859
860 /*
861 * The original raddend covers the displacement
862 * from the section start to the desired
863 * address. The value computed above gets us
864 * from the section start to the start of the
865 * symbol range. Adjust the old raddend to
866 * remove the offset from section start to
867 * symbol start, leaving the displacement
868 * within the range of the symbol.
869 */
870 arsp->rel_raddend -= sym->sd_osym->st_value;
871 } else {
872 value = _elf_getxoff(sdp->sd_isc->is_indata);
873 if (sdp->sd_isc->is_shdr->sh_flags & SHF_ALLOC)
874 value += sdp->sd_isc->is_osdesc->
875 os_shdr->sh_addr;
876 }
877 if (sdp->sd_isc->is_shdr->sh_flags & SHF_TLS)
878 value -= ofl->ofl_tlsphdr->p_vaddr;
879
880 } else if (IS_SIZE(arsp->rel_rtype)) {
881 /*
882 * Size relocations require the symbols size.
883 */
884 value = sdp->sd_sym->st_size;
885
886 } else if ((sdp->sd_flags & FLG_SY_CAP) &&
887 sdp->sd_aux && sdp->sd_aux->sa_PLTndx) {
888 /*
889 * If relocation is against a capabilities symbol, we
890 * need to jump to an associated PLT, so that at runtime
891 * ld.so.1 is involved to determine the best binding
892 * choice. Otherwise, the value is the symbols value.
893 */
894 value = ld_calc_plt_addr(sdp, ofl);
895 } else
896 value = sdp->sd_sym->st_value;
897
898 /*
899 * Relocation against the GLOBAL_OFFSET_TABLE.
900 */
901 if ((arsp->rel_flags & FLG_REL_GOT) &&
902 !ld_reloc_set_aux_osdesc(ofl, arsp, ofl->ofl_osgot))
903 return (S_ERROR);
904 osp = RELAUX_GET_OSDESC(arsp);
905
906 /*
907 * If loadable and not producing a relocatable object add the
908 * sections virtual address to the reference address.
909 */
910 if ((arsp->rel_flags & FLG_REL_LOAD) &&
911 ((flags & FLG_OF_RELOBJ) == 0))
912 refaddr += arsp->rel_isdesc->is_osdesc->
913 os_shdr->sh_addr;
914
915 /*
916 * If this entry has a PLT assigned to it, its value is actually
917 * the address of the PLT (and not the address of the function).
918 */
919 if (IS_PLT(arsp->rel_rtype)) {
920 if (sdp->sd_aux && sdp->sd_aux->sa_PLTndx)
921 value = ld_calc_plt_addr(sdp, ofl);
922 }
923
924 /*
925 * Add relocations addend to value. Add extra
926 * relocation addend if needed.
927 *
928 * Note: For GOT relative relocations on amd64 we discard the
929 * addend. It was relevant to the reference - not to the
930 * data item being referenced (ie: that -4 thing).
931 */
932 if ((arsp->rel_flags & FLG_REL_GOT) == 0)
933 value += arsp->rel_raddend;
934
935 /*
936 * Determine whether the value needs further adjustment. Filter
937 * through the attributes of the relocation to determine what
938 * adjustment is required. Note, many of the following cases
939 * are only applicable when a .got is present. As a .got is
940 * not generated when a relocatable object is being built,
941 * any adjustments that require a .got need to be skipped.
942 */
943 if ((arsp->rel_flags & FLG_REL_GOT) &&
944 ((flags & FLG_OF_RELOBJ) == 0)) {
945 Xword R1addr;
946 uintptr_t R2addr;
947 Word gotndx;
948 Gotndx *gnp;
949
950 /*
951 * Perform relocation against GOT table. Since this
952 * doesn't fit exactly into a relocation we place the
953 * appropriate byte in the GOT directly
954 *
955 * Calculate offset into GOT at which to apply
956 * the relocation.
957 */
958 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, arsp);
959 assert(gnp);
960
961 if (arsp->rel_rtype == R_AMD64_DTPOFF64)
962 gotndx = gnp->gn_gotndx + 1;
963 else
964 gotndx = gnp->gn_gotndx;
965
966 R1addr = (Xword)(gotndx * M_GOT_ENTSIZE);
967
968 /*
969 * Add the GOTs data's offset.
970 */
971 R2addr = R1addr + (uintptr_t)osp->os_outdata->d_buf;
972
973 DBG_CALL(Dbg_reloc_doact(ofl->ofl_lml, ELF_DBG_LD_ACT,
974 M_MACH, SHT_RELA, arsp, R1addr, value,
975 ld_reloc_sym_name));
976
977 /*
978 * And do it.
979 */
980 if (ofl->ofl_flags1 & FLG_OF1_ENCDIFF)
981 *(Xword *)R2addr = ld_bswap_Xword(value);
982 else
983 *(Xword *)R2addr = value;
984 continue;
985
986 } else if (IS_GOT_BASED(arsp->rel_rtype) &&
987 ((flags & FLG_OF_RELOBJ) == 0)) {
988 value -= ofl->ofl_osgot->os_shdr->sh_addr;
989
990 } else if (IS_GOTPCREL(arsp->rel_rtype) &&
991 ((flags & FLG_OF_RELOBJ) == 0)) {
992 Gotndx *gnp;
993
994 /*
995 * Calculation:
996 * G + GOT + A - P
997 */
998 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, arsp);
999 assert(gnp);
1000 value = (Xword)(ofl->ofl_osgot->os_shdr-> sh_addr) +
1001 ((Xword)gnp->gn_gotndx * M_GOT_ENTSIZE) +
1002 arsp->rel_raddend - refaddr;
1003
1004 } else if (IS_GOT_PC(arsp->rel_rtype) &&
1005 ((flags & FLG_OF_RELOBJ) == 0)) {
1006 value = (Xword)(ofl->ofl_osgot->os_shdr->
1007 sh_addr) - refaddr + arsp->rel_raddend;
1008
1009 } else if ((IS_PC_RELATIVE(arsp->rel_rtype)) &&
1010 (((flags & FLG_OF_RELOBJ) == 0) ||
1011 (osp == sdp->sd_isc->is_osdesc))) {
1012 value -= refaddr;
1013
1014 } else if (IS_TLS_INS(arsp->rel_rtype) &&
1015 IS_GOT_RELATIVE(arsp->rel_rtype) &&
1016 ((flags & FLG_OF_RELOBJ) == 0)) {
1017 Gotndx *gnp;
1018
1019 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, arsp);
1020 assert(gnp);
1021 value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE;
1022
1023 } else if (IS_GOT_RELATIVE(arsp->rel_rtype) &&
1024 ((flags & FLG_OF_RELOBJ) == 0)) {
1025 Gotndx *gnp;
1026
1027 gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, arsp);
1028 assert(gnp);
1029 value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE;
1030
1031 } else if ((arsp->rel_flags & FLG_REL_STLS) &&
1032 ((flags & FLG_OF_RELOBJ) == 0)) {
1033 Xword tlsstatsize;
1034
1035 /*
1036 * This is the LE TLS reference model. Static
1037 * offset is hard-coded.
1038 */
1039 tlsstatsize = S_ROUND(ofl->ofl_tlsphdr->p_memsz,
1040 M_TLSSTATALIGN);
1041 value = tlsstatsize - value;
1042
1043 /*
1044 * Since this code is fixed up, it assumes a negative
1045 * offset that can be added to the thread pointer.
1046 */
1047 if (arsp->rel_rtype == R_AMD64_TPOFF32)
1048 value = -value;
1049 }
1050
1051 if (arsp->rel_isdesc->is_file)
1052 ifl_name = arsp->rel_isdesc->is_file->ifl_name;
1053 else
1054 ifl_name = MSG_INTL(MSG_STR_NULL);
1055
1056 /*
1057 * Make sure we have data to relocate. Compiler and assembler
1058 * developers have been known to generate relocations against
1059 * invalid sections (normally .bss), so for their benefit give
1060 * them sufficient information to help analyze the problem.
1061 * End users should never see this.
1062 */
1063 if (arsp->rel_isdesc->is_indata->d_buf == 0) {
1064 Conv_inv_buf_t inv_buf;
1065
1066 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_REL_EMPTYSEC),
1067 conv_reloc_amd64_type(arsp->rel_rtype, 0, &inv_buf),
1068 ifl_name, ld_reloc_sym_name(arsp),
1069 EC_WORD(arsp->rel_isdesc->is_scnndx),
1070 arsp->rel_isdesc->is_name);
1071 return (S_ERROR);
1072 }
1073
1074 /*
1075 * Get the address of the data item we need to modify.
1076 */
1077 addr = (uchar_t *)((uintptr_t)arsp->rel_roffset +
1078 (uintptr_t)_elf_getxoff(arsp->rel_isdesc->is_indata));
1079
1080 DBG_CALL(Dbg_reloc_doact(ofl->ofl_lml, ELF_DBG_LD_ACT,
1081 M_MACH, SHT_RELA, arsp, EC_NATPTR(addr), value,
1082 ld_reloc_sym_name));
1083 addr += (uintptr_t)osp->os_outdata->d_buf;
1084
1085 if ((((uintptr_t)addr - (uintptr_t)ofl->ofl_nehdr) >
1086 ofl->ofl_size) || (arsp->rel_roffset >
1087 osp->os_shdr->sh_size)) {
1088 int class;
1089 Conv_inv_buf_t inv_buf;
1090
1091 if (((uintptr_t)addr - (uintptr_t)ofl->ofl_nehdr) >
1092 ofl->ofl_size)
1093 class = ERR_FATAL;
1094 else
1095 class = ERR_WARNING;
1096
1097 ld_eprintf(ofl, class, MSG_INTL(MSG_REL_INVALOFFSET),
1098 conv_reloc_amd64_type(arsp->rel_rtype, 0, &inv_buf),
1099 ifl_name, EC_WORD(arsp->rel_isdesc->is_scnndx),
1100 arsp->rel_isdesc->is_name, ld_reloc_sym_name(arsp),
1101 EC_ADDR((uintptr_t)addr -
1102 (uintptr_t)ofl->ofl_nehdr));
1103
1104 if (class == ERR_FATAL) {
1105 return_code = S_ERROR;
1106 continue;
1107 }
1108 }
1109
1110 /*
1111 * The relocation is additive. Ignore the previous symbol
1112 * value if this local partial symbol is expanded.
1113 */
1114 if (moved)
1115 value -= *addr;
1116
1117 /*
1118 * If '-z noreloc' is specified - skip the do_reloc_ld stage.
1119 */
1120 if (OFL_DO_RELOC(ofl)) {
1121 /*
1122 * If this is a PROGBITS section and the running linker
1123 * has a different byte order than the target host,
1124 * tell do_reloc_ld() to swap bytes.
1125 */
1126 if (do_reloc_ld(arsp, addr, &value, ld_reloc_sym_name,
1127 ifl_name, OFL_SWAP_RELOC_DATA(ofl, arsp),
1128 ofl->ofl_lml) == 0) {
1129 ofl->ofl_flags |= FLG_OF_FATAL;
1130 return_code = S_ERROR;
1131 }
1132 }
1133 }
1134 return (return_code);
1135 }
1136
1137 static uintptr_t
ld_add_outrel(Word flags,Rel_desc * rsp,Ofl_desc * ofl)1138 ld_add_outrel(Word flags, Rel_desc *rsp, Ofl_desc *ofl)
1139 {
1140 Rel_desc *orsp;
1141 Sym_desc *sdp = rsp->rel_sym;
1142
1143 /*
1144 * Static executables *do not* want any relocations against them.
1145 * Since our engine still creates relocations against a WEAK UNDEFINED
1146 * symbol in a static executable, it's best to disable them here
1147 * instead of through out the relocation code.
1148 */
1149 if (OFL_IS_STATIC_EXEC(ofl))
1150 return (1);
1151
1152 /*
1153 * If the symbol will be reduced, we can't leave outstanding
1154 * relocations against it, as nothing will ever be able to satisfy them
1155 * (and the symbol won't be in .dynsym
1156 */
1157 if ((sdp != NULL) &&
1158 (sdp->sd_sym->st_shndx == SHN_UNDEF) &&
1159 (rsp->rel_rtype != M_R_NONE) &&
1160 (rsp->rel_rtype != M_R_RELATIVE)) {
1161 if (ld_sym_reducable(ofl, sdp))
1162 return (1);
1163 }
1164
1165 /*
1166 * If we are adding a output relocation against a section
1167 * symbol (non-RELATIVE) then mark that section. These sections
1168 * will be added to the .dynsym symbol table.
1169 */
1170 if (sdp && (rsp->rel_rtype != M_R_RELATIVE) &&
1171 ((flags & FLG_REL_SCNNDX) ||
1172 (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION))) {
1173
1174 /*
1175 * If this is a COMMON symbol - no output section
1176 * exists yet - (it's created as part of sym_validate()).
1177 * So - we mark here that when it's created it should
1178 * be tagged with the FLG_OS_OUTREL flag.
1179 */
1180 if ((sdp->sd_flags & FLG_SY_SPECSEC) &&
1181 (sdp->sd_sym->st_shndx == SHN_COMMON)) {
1182 if (ELF_ST_TYPE(sdp->sd_sym->st_info) != STT_TLS)
1183 ofl->ofl_flags1 |= FLG_OF1_BSSOREL;
1184 else
1185 ofl->ofl_flags1 |= FLG_OF1_TLSOREL;
1186 } else {
1187 Os_desc *osp;
1188 Is_desc *isp = sdp->sd_isc;
1189
1190 if (isp && ((osp = isp->is_osdesc) != NULL) &&
1191 ((osp->os_flags & FLG_OS_OUTREL) == 0)) {
1192 ofl->ofl_dynshdrcnt++;
1193 osp->os_flags |= FLG_OS_OUTREL;
1194 }
1195 }
1196 }
1197
1198 /* Enter it into the output relocation cache */
1199 if ((orsp = ld_reloc_enter(ofl, &ofl->ofl_outrels, rsp, flags)) == NULL)
1200 return (S_ERROR);
1201
1202 if (flags & FLG_REL_GOT)
1203 ofl->ofl_relocgotsz += (Xword)sizeof (Rela);
1204 else if (flags & FLG_REL_PLT)
1205 ofl->ofl_relocpltsz += (Xword)sizeof (Rela);
1206 else if (flags & FLG_REL_BSS)
1207 ofl->ofl_relocbsssz += (Xword)sizeof (Rela);
1208 else if (flags & FLG_REL_NOINFO)
1209 ofl->ofl_relocrelsz += (Xword)sizeof (Rela);
1210 else
1211 RELAUX_GET_OSDESC(orsp)->os_szoutrels += (Xword)sizeof (Rela);
1212
1213 if (orsp->rel_rtype == M_R_RELATIVE)
1214 ofl->ofl_relocrelcnt++;
1215
1216 /*
1217 * We don't perform sorting on PLT relocations because
1218 * they have already been assigned a PLT index and if we
1219 * were to sort them we would have to re-assign the plt indexes.
1220 */
1221 if (!(flags & FLG_REL_PLT))
1222 ofl->ofl_reloccnt++;
1223
1224 /*
1225 * Insure a GLOBAL_OFFSET_TABLE is generated if required.
1226 */
1227 if (IS_GOT_REQUIRED(orsp->rel_rtype))
1228 ofl->ofl_flags |= FLG_OF_BLDGOT;
1229
1230 /*
1231 * Identify and possibly warn of a displacement relocation.
1232 */
1233 if (orsp->rel_flags & FLG_REL_DISP) {
1234 ofl->ofl_dtflags_1 |= DF_1_DISPRELPND;
1235
1236 if (ofl->ofl_flags & FLG_OF_VERBOSE)
1237 ld_disp_errmsg(MSG_INTL(MSG_REL_DISPREL4), orsp, ofl);
1238 }
1239 DBG_CALL(Dbg_reloc_ors_entry(ofl->ofl_lml, ELF_DBG_LD, SHT_RELA,
1240 M_MACH, orsp));
1241 return (1);
1242 }
1243
1244 /*
1245 * process relocation for a LOCAL symbol
1246 */
1247 static uintptr_t
ld_reloc_local(Rel_desc * rsp,Ofl_desc * ofl)1248 ld_reloc_local(Rel_desc * rsp, Ofl_desc * ofl)
1249 {
1250 ofl_flag_t flags = ofl->ofl_flags;
1251 Sym_desc *sdp = rsp->rel_sym;
1252 Word shndx = sdp->sd_sym->st_shndx;
1253 Word ortype = rsp->rel_rtype;
1254
1255 /*
1256 * if ((shared object) and (not pc relative relocation) and
1257 * (not against ABS symbol))
1258 * then
1259 * build R_AMD64_RELATIVE
1260 * fi
1261 */
1262 if ((flags & FLG_OF_SHAROBJ) && (rsp->rel_flags & FLG_REL_LOAD) &&
1263 !(IS_PC_RELATIVE(rsp->rel_rtype)) && !(IS_SIZE(rsp->rel_rtype)) &&
1264 !(IS_GOT_BASED(rsp->rel_rtype)) &&
1265 !(rsp->rel_isdesc != NULL &&
1266 (rsp->rel_isdesc->is_shdr->sh_type == SHT_SUNW_dof)) &&
1267 (((sdp->sd_flags & FLG_SY_SPECSEC) == 0) ||
1268 (shndx != SHN_ABS) || (sdp->sd_aux && sdp->sd_aux->sa_symspec))) {
1269
1270 /*
1271 * R_AMD64_RELATIVE updates a 64bit address, if this
1272 * relocation isn't a 64bit binding then we can not
1273 * simplify it to a RELATIVE relocation.
1274 */
1275 if (reloc_table[ortype].re_fsize != sizeof (Addr)) {
1276 return (ld_add_outrel(0, rsp, ofl));
1277 }
1278
1279 rsp->rel_rtype = R_AMD64_RELATIVE;
1280 if (ld_add_outrel(FLG_REL_ADVAL, rsp, ofl) == S_ERROR)
1281 return (S_ERROR);
1282 rsp->rel_rtype = ortype;
1283 return (1);
1284 }
1285
1286 /*
1287 * If the relocation is against a 'non-allocatable' section
1288 * and we can not resolve it now - then give a warning
1289 * message.
1290 *
1291 * We can not resolve the symbol if either:
1292 * a) it's undefined
1293 * b) it's defined in a shared library and a
1294 * COPY relocation hasn't moved it to the executable
1295 *
1296 * Note: because we process all of the relocations against the
1297 * text segment before any others - we know whether
1298 * or not a copy relocation will be generated before
1299 * we get here (see reloc_init()->reloc_segments()).
1300 */
1301 if (!(rsp->rel_flags & FLG_REL_LOAD) &&
1302 ((shndx == SHN_UNDEF) ||
1303 ((sdp->sd_ref == REF_DYN_NEED) &&
1304 ((sdp->sd_flags & FLG_SY_MVTOCOMM) == 0)))) {
1305 Conv_inv_buf_t inv_buf;
1306 Os_desc *osp = RELAUX_GET_OSDESC(rsp);
1307
1308 /*
1309 * If the relocation is against a SHT_SUNW_ANNOTATE
1310 * section - then silently ignore that the relocation
1311 * can not be resolved.
1312 */
1313 if (osp && (osp->os_shdr->sh_type == SHT_SUNW_ANNOTATE))
1314 return (0);
1315 ld_eprintf(ofl, ERR_WARNING, MSG_INTL(MSG_REL_EXTERNSYM),
1316 conv_reloc_amd64_type(rsp->rel_rtype, 0, &inv_buf),
1317 rsp->rel_isdesc->is_file->ifl_name,
1318 ld_reloc_sym_name(rsp), osp->os_name);
1319 return (1);
1320 }
1321
1322 /*
1323 * Perform relocation.
1324 */
1325 return (ld_add_actrel(0, rsp, ofl));
1326 }
1327
1328
1329 static uintptr_t
ld_reloc_TLS(Boolean local,Rel_desc * rsp,Ofl_desc * ofl)1330 ld_reloc_TLS(Boolean local, Rel_desc * rsp, Ofl_desc * ofl)
1331 {
1332 Word rtype = rsp->rel_rtype;
1333 Sym_desc *sdp = rsp->rel_sym;
1334 ofl_flag_t flags = ofl->ofl_flags;
1335 Gotndx *gnp;
1336
1337 /*
1338 * If we're building an executable - use either the IE or LE access
1339 * model. If we're building a shared object process any IE model.
1340 */
1341 if ((flags & FLG_OF_EXEC) || (IS_TLS_IE(rtype))) {
1342 /*
1343 * Set the DF_STATIC_TLS flag.
1344 */
1345 ofl->ofl_dtflags |= DF_STATIC_TLS;
1346
1347 if (!local || ((flags & FLG_OF_EXEC) == 0)) {
1348 /*
1349 * Assign a GOT entry for static TLS references.
1350 */
1351 if ((gnp = ld_find_got_ndx(sdp->sd_GOTndxs,
1352 GOT_REF_TLSIE, ofl, rsp)) == NULL) {
1353
1354 if (ld_assign_got_TLS(local, rsp, ofl, sdp,
1355 gnp, GOT_REF_TLSIE, FLG_REL_STLS,
1356 rtype, R_AMD64_TPOFF64, 0) == S_ERROR)
1357 return (S_ERROR);
1358 }
1359
1360 /*
1361 * IE access model.
1362 */
1363 if (IS_TLS_IE(rtype))
1364 return (ld_add_actrel(FLG_REL_STLS, rsp, ofl));
1365
1366 /*
1367 * Fixups are required for other executable models.
1368 */
1369 return (ld_add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS),
1370 rsp, ofl));
1371 }
1372
1373 /*
1374 * LE access model.
1375 */
1376 if (IS_TLS_LE(rtype))
1377 return (ld_add_actrel(FLG_REL_STLS, rsp, ofl));
1378
1379 return (ld_add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS),
1380 rsp, ofl));
1381 }
1382
1383 /*
1384 * Building a shared object.
1385 *
1386 * Assign a GOT entry for a dynamic TLS reference.
1387 */
1388 if (IS_TLS_LD(rtype) && ((gnp = ld_find_got_ndx(sdp->sd_GOTndxs,
1389 GOT_REF_TLSLD, ofl, rsp)) == NULL)) {
1390
1391 if (ld_assign_got_TLS(local, rsp, ofl, sdp, gnp, GOT_REF_TLSLD,
1392 FLG_REL_MTLS, rtype, R_AMD64_DTPMOD64, 0) == S_ERROR)
1393 return (S_ERROR);
1394
1395 } else if (IS_TLS_GD(rtype) &&
1396 ((gnp = ld_find_got_ndx(sdp->sd_GOTndxs, GOT_REF_TLSGD,
1397 ofl, rsp)) == NULL)) {
1398
1399 if (ld_assign_got_TLS(local, rsp, ofl, sdp, gnp, GOT_REF_TLSGD,
1400 FLG_REL_DTLS, rtype, R_AMD64_DTPMOD64,
1401 R_AMD64_DTPOFF64) == S_ERROR)
1402 return (S_ERROR);
1403 }
1404
1405 if (IS_TLS_LD(rtype))
1406 return (ld_add_actrel(FLG_REL_MTLS, rsp, ofl));
1407
1408 return (ld_add_actrel(FLG_REL_DTLS, rsp, ofl));
1409 }
1410
1411 /* ARGSUSED5 */
1412 static uintptr_t
ld_assign_got_ndx(Alist ** alpp,Gotndx * pgnp,Gotref gref,Ofl_desc * ofl,Rel_desc * rsp,Sym_desc * sdp)1413 ld_assign_got_ndx(Alist **alpp, Gotndx *pgnp, Gotref gref, Ofl_desc *ofl,
1414 Rel_desc *rsp, Sym_desc *sdp)
1415 {
1416 Xword raddend;
1417 Gotndx gn, *gnp;
1418 Aliste idx;
1419 uint_t gotents;
1420
1421 raddend = rsp->rel_raddend;
1422 if (pgnp && (pgnp->gn_addend == raddend) && (pgnp->gn_gotref == gref))
1423 return (1);
1424
1425 if ((gref == GOT_REF_TLSGD) || (gref == GOT_REF_TLSLD))
1426 gotents = 2;
1427 else
1428 gotents = 1;
1429
1430 gn.gn_addend = raddend;
1431 gn.gn_gotndx = ofl->ofl_gotcnt;
1432 gn.gn_gotref = gref;
1433
1434 ofl->ofl_gotcnt += gotents;
1435
1436 if (gref == GOT_REF_TLSLD) {
1437 if (ofl->ofl_tlsldgotndx == NULL) {
1438 if ((gnp = libld_malloc(sizeof (Gotndx))) == NULL)
1439 return (S_ERROR);
1440 (void) memcpy(gnp, &gn, sizeof (Gotndx));
1441 ofl->ofl_tlsldgotndx = gnp;
1442 }
1443 return (1);
1444 }
1445
1446 idx = 0;
1447 for (ALIST_TRAVERSE(*alpp, idx, gnp)) {
1448 if (gnp->gn_addend > raddend)
1449 break;
1450 }
1451
1452 /*
1453 * GOT indexes are maintained on an Alist, where there is typically
1454 * only one index. The usage of this list is to scan the list to find
1455 * an index, and then apply that index immediately to a relocation.
1456 * Thus there are no external references to these GOT index structures
1457 * that can be compromised by the Alist being reallocated.
1458 */
1459 if (alist_insert(alpp, &gn, sizeof (Gotndx),
1460 AL_CNT_SDP_GOT, idx) == NULL)
1461 return (S_ERROR);
1462
1463 return (1);
1464 }
1465
1466 static void
ld_assign_plt_ndx(Sym_desc * sdp,Ofl_desc * ofl)1467 ld_assign_plt_ndx(Sym_desc * sdp, Ofl_desc *ofl)
1468 {
1469 sdp->sd_aux->sa_PLTndx = 1 + ofl->ofl_pltcnt++;
1470 sdp->sd_aux->sa_PLTGOTndx = ofl->ofl_gotcnt++;
1471 ofl->ofl_flags |= FLG_OF_BLDGOT;
1472 }
1473
1474 static uchar_t plt0_template[M_PLT_ENTSIZE] = {
1475 /* 0x00 PUSHQ GOT+8(%rip) */ 0xff, 0x35, 0x00, 0x00, 0x00, 0x00,
1476 /* 0x06 JMP *GOT+16(%rip) */ 0xff, 0x25, 0x00, 0x00, 0x00, 0x00,
1477 /* 0x0c NOP */ 0x90,
1478 /* 0x0d NOP */ 0x90,
1479 /* 0x0e NOP */ 0x90,
1480 /* 0x0f NOP */ 0x90
1481 };
1482
1483 /*
1484 * Initializes .got[0] with the _DYNAMIC symbol value.
1485 */
1486 static uintptr_t
ld_fillin_gotplt(Ofl_desc * ofl)1487 ld_fillin_gotplt(Ofl_desc *ofl)
1488 {
1489 int bswap = (ofl->ofl_flags1 & FLG_OF1_ENCDIFF) != 0;
1490
1491 if (ofl->ofl_osgot) {
1492 Sym_desc *sdp;
1493
1494 if ((sdp = ld_sym_find(MSG_ORIG(MSG_SYM_DYNAMIC_U),
1495 SYM_NOHASH, NULL, ofl)) != NULL) {
1496 uchar_t *genptr;
1497
1498 genptr = ((uchar_t *)ofl->ofl_osgot->os_outdata->d_buf +
1499 (M_GOT_XDYNAMIC * M_GOT_ENTSIZE));
1500 /* LINTED */
1501 *(Xword *)genptr = sdp->sd_sym->st_value;
1502 if (bswap)
1503 /* LINTED */
1504 *(Xword *)genptr =
1505 /* LINTED */
1506 ld_bswap_Xword(*(Xword *)genptr);
1507 }
1508 }
1509
1510 /*
1511 * Fill in the reserved slot in the procedure linkage table the first
1512 * entry is:
1513 * 0x00 PUSHQ GOT+8(%rip) # GOT[1]
1514 * 0x06 JMP *GOT+16(%rip) # GOT[2]
1515 * 0x0c NOP
1516 * 0x0d NOP
1517 * 0x0e NOP
1518 * 0x0f NOP
1519 */
1520 if ((ofl->ofl_flags & FLG_OF_DYNAMIC) && ofl->ofl_osplt) {
1521 uchar_t *pltent;
1522 Xword val1;
1523
1524 pltent = (uchar_t *)ofl->ofl_osplt->os_outdata->d_buf;
1525 bcopy(plt0_template, pltent, sizeof (plt0_template));
1526
1527 /*
1528 * If '-z noreloc' is specified - skip the do_reloc_ld
1529 * stage.
1530 */
1531 if (!OFL_DO_RELOC(ofl))
1532 return (1);
1533
1534 /*
1535 * filin:
1536 * PUSHQ GOT + 8(%rip)
1537 *
1538 * Note: 0x06 below represents the offset to the
1539 * next instruction - which is what %rip will
1540 * be pointing at.
1541 */
1542 val1 = (ofl->ofl_osgot->os_shdr->sh_addr) +
1543 (M_GOT_XLINKMAP * M_GOT_ENTSIZE) -
1544 ofl->ofl_osplt->os_shdr->sh_addr - 0x06;
1545
1546 if (do_reloc_ld(&rdesc_r_amd64_gotpcrel, &pltent[0x02],
1547 &val1, syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT),
1548 bswap, ofl->ofl_lml) == 0) {
1549 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLT0FAIL));
1550 return (S_ERROR);
1551 }
1552
1553 /*
1554 * filin:
1555 * JMP *GOT+16(%rip)
1556 */
1557 val1 = (ofl->ofl_osgot->os_shdr->sh_addr) +
1558 (M_GOT_XRTLD * M_GOT_ENTSIZE) -
1559 ofl->ofl_osplt->os_shdr->sh_addr - 0x0c;
1560
1561 if (do_reloc_ld(&rdesc_r_amd64_gotpcrel, &pltent[0x08],
1562 &val1, syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT),
1563 bswap, ofl->ofl_lml) == 0) {
1564 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLT0FAIL));
1565 return (S_ERROR);
1566 }
1567 }
1568
1569 return (1);
1570 }
1571
1572
1573
1574 /*
1575 * Template for generating "void (*)(void)" function
1576 */
1577 static const uchar_t nullfunc_tmpl[] = { /* amd64 */
1578 /* 0x00 */ 0x55, /* pushq %rbp */
1579 /* 0x01 */ 0x48, 0x8b, 0xec, /* movq %rsp,%rbp */
1580 /* 0x04 */ 0x48, 0x8b, 0xe5, /* movq %rbp,%rsp */
1581 /* 0x07 */ 0x5d, /* popq %rbp */
1582 /* 0x08 */ 0xc3 /* ret */
1583 };
1584
1585
1586 /*
1587 * Function used to provide fill padding in SHF_EXECINSTR sections
1588 *
1589 * entry:
1590 *
1591 * base - base address of section being filled
1592 * offset - starting offset for fill within memory referenced by base
1593 * cnt - # bytes to be filled
1594 *
1595 * exit:
1596 * The fill has been completed.
1597 */
1598 static void
execfill(void * base,off_t off,size_t cnt)1599 execfill(void *base, off_t off, size_t cnt)
1600 {
1601 /*
1602 * 0x90 is an X86 NOP instruction in both 32 and 64-bit worlds.
1603 * There are no alignment constraints.
1604 */
1605 (void) memset(off + (char *)base, 0x90, cnt);
1606 }
1607
1608
1609 /*
1610 * Return the ld_targ definition for this target.
1611 */
1612 const Target *
ld_targ_init_x86(void)1613 ld_targ_init_x86(void)
1614 {
1615 static const Target _ld_targ = {
1616 { /* Target_mach */
1617 M_MACH, /* m_mach */
1618 M_MACHPLUS, /* m_machplus */
1619 M_FLAGSPLUS, /* m_flagsplus */
1620 M_CLASS, /* m_class */
1621 M_DATA, /* m_data */
1622
1623 M_SEGM_ALIGN, /* m_segm_align */
1624 M_SEGM_ORIGIN, /* m_segm_origin */
1625 M_SEGM_AORIGIN, /* m_segm_aorigin */
1626 M_DATASEG_PERM, /* m_dataseg_perm */
1627 M_STACK_PERM, /* m_stack_perm */
1628 M_WORD_ALIGN, /* m_word_align */
1629 MSG_ORIG(MSG_PTH_RTLD_AMD64), /* m_def_interp */
1630
1631 /* Relocation type codes */
1632 M_R_ARRAYADDR, /* m_r_arrayaddr */
1633 M_R_COPY, /* m_r_copy */
1634 M_R_GLOB_DAT, /* m_r_glob_dat */
1635 M_R_JMP_SLOT, /* m_r_jmp_slot */
1636 M_R_NUM, /* m_r_num */
1637 M_R_NONE, /* m_r_none */
1638 M_R_RELATIVE, /* m_r_relative */
1639 M_R_REGISTER, /* m_r_register */
1640
1641 /* Relocation related constants */
1642 M_REL_DT_COUNT, /* m_rel_dt_count */
1643 M_REL_DT_ENT, /* m_rel_dt_ent */
1644 M_REL_DT_SIZE, /* m_rel_dt_size */
1645 M_REL_DT_TYPE, /* m_rel_dt_type */
1646 M_REL_SHT_TYPE, /* m_rel_sht_type */
1647
1648 /* GOT related constants */
1649 M_GOT_ENTSIZE, /* m_got_entsize */
1650 M_GOT_XNumber, /* m_got_xnumber */
1651
1652 /* PLT related constants */
1653 M_PLT_ALIGN, /* m_plt_align */
1654 M_PLT_ENTSIZE, /* m_plt_entsize */
1655 M_PLT_RESERVSZ, /* m_plt_reservsz */
1656 M_PLT_SHF_FLAGS, /* m_plt_shf_flags */
1657
1658 /* Section type of .eh_frame/.eh_frame_hdr sections */
1659 SHT_AMD64_UNWIND, /* m_sht_unwind */
1660
1661 M_DT_REGISTER, /* m_dt_register */
1662 },
1663 { /* Target_machid */
1664 M_ID_ARRAY, /* id_array */
1665 M_ID_BSS, /* id_bss */
1666 M_ID_CAP, /* id_cap */
1667 M_ID_CAPINFO, /* id_capinfo */
1668 M_ID_CAPCHAIN, /* id_capchain */
1669 M_ID_DATA, /* id_data */
1670 M_ID_DYNAMIC, /* id_dynamic */
1671 M_ID_DYNSORT, /* id_dynsort */
1672 M_ID_DYNSTR, /* id_dynstr */
1673 M_ID_DYNSYM, /* id_dynsym */
1674 M_ID_DYNSYM_NDX, /* id_dynsym_ndx */
1675 M_ID_GOT, /* id_got */
1676 M_ID_UNKNOWN, /* id_gotdata (unused) */
1677 M_ID_HASH, /* id_hash */
1678 M_ID_INTERP, /* id_interp */
1679 M_ID_LBSS, /* id_lbss */
1680 M_ID_LDYNSYM, /* id_ldynsym */
1681 M_ID_NOTE, /* id_note */
1682 M_ID_NULL, /* id_null */
1683 M_ID_PLT, /* id_plt */
1684 M_ID_REL, /* id_rel */
1685 M_ID_STRTAB, /* id_strtab */
1686 M_ID_SYMINFO, /* id_syminfo */
1687 M_ID_SYMTAB, /* id_symtab */
1688 M_ID_SYMTAB_NDX, /* id_symtab_ndx */
1689 M_ID_TEXT, /* id_text */
1690 M_ID_TLS, /* id_tls */
1691 M_ID_TLSBSS, /* id_tlsbss */
1692 M_ID_UNKNOWN, /* id_unknown */
1693 M_ID_UNWIND, /* id_unwind */
1694 M_ID_UNWINDHDR, /* id_unwindhdr */
1695 M_ID_USER, /* id_user */
1696 M_ID_VERSION, /* id_version */
1697 },
1698 { /* Target_nullfunc */
1699 nullfunc_tmpl, /* nf_template */
1700 sizeof (nullfunc_tmpl), /* nf_size */
1701 },
1702 { /* Target_fillfunc */
1703 execfill /* ff_execfill */
1704 },
1705 { /* Target_machrel */
1706 reloc_table,
1707
1708 ld_init_rel, /* mr_init_rel */
1709 ld_mach_eflags, /* mr_mach_eflags */
1710 ld_mach_make_dynamic, /* mr_mach_make_dynamic */
1711 ld_mach_update_odynamic, /* mr_mach_update_odynamic */
1712 ld_calc_plt_addr, /* mr_calc_plt_addr */
1713 ld_perform_outreloc, /* mr_perform_outreloc */
1714 ld_do_activerelocs, /* mr_do_activerelocs */
1715 ld_add_outrel, /* mr_add_outrel */
1716 NULL, /* mr_reloc_register */
1717 ld_reloc_local, /* mr_reloc_local */
1718 NULL, /* mr_reloc_GOTOP */
1719 ld_reloc_TLS, /* mr_reloc_TLS */
1720 NULL, /* mr_assign_got */
1721 ld_find_got_ndx, /* mr_find_got_ndx */
1722 ld_calc_got_offset, /* mr_calc_got_offset */
1723 ld_assign_got_ndx, /* mr_assign_got_ndx */
1724 ld_assign_plt_ndx, /* mr_assign_plt_ndx */
1725 NULL, /* mr_allocate_got */
1726 ld_fillin_gotplt, /* mr_fillin_gotplt */
1727 },
1728 { /* Target_machsym */
1729 NULL, /* ms_reg_check */
1730 NULL, /* ms_mach_sym_typecheck */
1731 NULL, /* ms_is_regsym */
1732 NULL, /* ms_reg_find */
1733 NULL /* ms_reg_enter */
1734 }
1735 };
1736
1737 return (&_ld_targ);
1738 }
1739