1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
24 * Use is subject to license terms.
25 */
26 /*
27 * Copyright 2019 Joyent, Inc.
28 */
29
30 /*
31 * x86 relocation code.
32 */
33
34 #include <sys/types.h>
35 #include <sys/param.h>
36 #include <sys/sysmacros.h>
37 #include <sys/systm.h>
38 #include <sys/user.h>
39 #include <sys/bootconf.h>
40 #include <sys/modctl.h>
41 #include <sys/elf.h>
42 #include <sys/kobj.h>
43 #include <sys/kobj_impl.h>
44 #include <sys/tnf.h>
45 #include <sys/tnf_probe.h>
46
47 #include "reloc.h"
48
49
50 /*
51 * Probe Discovery
52 */
53
54 #define PROBE_MARKER_SYMBOL "__tnf_probe_version_1"
55 #define TAG_MARKER_SYMBOL "__tnf_tag_version_1"
56
57 extern int tnf_splice_probes(int, tnf_probe_control_t *, tnf_tag_data_t *);
58
59 /*
60 * The kernel run-time linker calls this to try to resolve a reference
61 * it can't otherwise resolve. We see if it's marking a probe control
62 * block; if so, we do the resolution and return 0. If not, we return
63 * 1 to show that we can't resolve it, either.
64 */
65 static int
66 tnf_reloc_resolve(char *symname, Addr *value_p,
67 Elf64_Sxword *addend_p,
68 long offset,
69 tnf_probe_control_t **probelist,
70 tnf_tag_data_t **taglist)
71 {
72 if (strcmp(symname, PROBE_MARKER_SYMBOL) == 0) {
73 *addend_p = 0;
74 ((tnf_probe_control_t *)offset)->next = *probelist;
75 *probelist = (tnf_probe_control_t *)offset;
76 return (0);
77 }
78 if (strcmp(symname, TAG_MARKER_SYMBOL) == 0) {
79 *addend_p = 0;
80 *value_p = (Addr)*taglist;
81 *taglist = (tnf_tag_data_t *)offset;
82 return (0);
83 }
84 return (1);
85 }
86
87 #define SDT_NOP 0x90
88 #define SDT_NOPS 5
89
90 static int
91 sdt_reloc_resolve(struct module *mp, char *symname, uint8_t *instr)
92 {
93 sdt_probedesc_t *sdp;
94 int i;
95
96 /*
97 * The "statically defined tracing" (SDT) provider for DTrace uses
98 * a mechanism similar to TNF, but somewhat simpler. (Surprise,
99 * surprise.) The SDT mechanism works by replacing calls to the
100 * undefined routine __dtrace_probe_[name] with nop instructions.
101 * The relocations are logged, and SDT itself will later patch the
102 * running binary appropriately.
103 */
104 if (strncmp(symname, sdt_prefix, strlen(sdt_prefix)) != 0)
105 return (1);
106
107 symname += strlen(sdt_prefix);
108
109 sdp = kobj_alloc(sizeof (sdt_probedesc_t), KM_WAIT);
110 sdp->sdpd_name = kobj_alloc(strlen(symname) + 1, KM_WAIT);
111 bcopy(symname, sdp->sdpd_name, strlen(symname) + 1);
112
113 sdp->sdpd_offset = (uintptr_t)instr;
114 sdp->sdpd_next = mp->sdt_probes;
115 mp->sdt_probes = sdp;
116
117 for (i = 0; i < SDT_NOPS; i++)
118 instr[i - 1] = SDT_NOP;
119
120 return (0);
121 }
122
123
124 /*
125 * We're relying on the fact that the call we're replacing is
126 * call (e8) plus 4 bytes of address, making a 5 byte instruction
127 */
128 #define NOP_INSTR 0x90
129 #define SMAP_NOPS 5
130
131 /*
132 * Currently the only call replaced as a hot inline
133 * is smap_enable() and smap_disable(). If more are needed
134 * we should probably come up with an sdt probe like prefix
135 * and look for those instead of exact call names.
136 */
137 static int
138 smap_reloc_resolve(struct module *mp, char *symname, uint8_t *instr)
139 {
140 uint_t symlen;
141 hotinline_desc_t *hid;
142
143 if (strcmp(symname, "smap_enable") == 0 ||
144 strcmp(symname, "smap_disable") == 0) {
145
146 #ifdef KOBJ_DEBUG
147 if (kobj_debug & D_RELOCATIONS) {
148 _kobj_printf(ops, "smap_reloc_resolve: %s relocating "
149 "enable/disable_smap\n", mp->filename);
150 }
151 #endif
152
153 hid = kobj_alloc(sizeof (hotinline_desc_t), KM_WAIT);
154 symlen = strlen(symname) + 1;
155 hid->hid_symname = kobj_alloc(symlen, KM_WAIT);
156 bcopy(symname, hid->hid_symname, symlen);
157
158 /*
159 * We backtrack one byte here to consume the call
160 * instruction itself.
161 */
162 hid->hid_instr_offset = (uintptr_t)instr - 1;
163 hid->hid_next = mp->hi_calls;
164 mp->hi_calls = hid;
165
166 memset((void *)hid->hid_instr_offset, NOP_INSTR, SMAP_NOPS);
167
168 return (0);
169 }
170
171 return (1);
172 }
173
174 int
175 do_relocate(struct module *mp, char *reltbl, Word relshtype, int nreloc,
176 int relocsize, Addr baseaddr)
177 {
178 unsigned long stndx;
179 unsigned long off; /* can't be register for tnf_reloc_resolve() */
180 register unsigned long reladdr, rend;
181 register unsigned int rtype;
182 unsigned long value;
183 Elf64_Sxword addend;
184 Sym *symref;
185 int err = 0;
186 tnf_probe_control_t *probelist = NULL;
187 tnf_tag_data_t *taglist = NULL;
188 int symnum;
189 reladdr = (unsigned long)reltbl;
190 rend = reladdr + nreloc * relocsize;
191
192 #ifdef KOBJ_DEBUG
193 if (kobj_debug & D_RELOCATIONS) {
194 _kobj_printf(ops, "krtld:\ttype\t\t\toffset\t addend"
195 " symbol\n");
196 _kobj_printf(ops, "krtld:\t\t\t\t\t value\n");
197 }
198 #endif
199
200 symnum = -1;
201 /* loop through relocations */
202 while (reladdr < rend) {
203 symnum++;
204 rtype = ELF_R_TYPE(((Rela *)reladdr)->r_info);
205 off = ((Rela *)reladdr)->r_offset;
206 stndx = ELF_R_SYM(((Rela *)reladdr)->r_info);
207 if (stndx >= mp->nsyms) {
208 _kobj_printf(ops, "do_relocate: bad strndx %d\n",
209 symnum);
210 return (-1);
211 }
212 if ((rtype > R_AMD64_NUM) || IS_TLS_INS(rtype)) {
213 _kobj_printf(ops, "krtld: invalid relocation type %d",
214 rtype);
215 _kobj_printf(ops, " at 0x%llx:", off);
216 _kobj_printf(ops, " file=%s\n", mp->filename);
217 err = 1;
218 continue;
219 }
220
221
222 addend = (long)(((Rela *)reladdr)->r_addend);
223 reladdr += relocsize;
224
225
226 if (rtype == R_AMD64_NONE)
227 continue;
228
229 #ifdef KOBJ_DEBUG
230 if (kobj_debug & D_RELOCATIONS) {
231 Sym * symp;
232 symp = (Sym *)
233 (mp->symtbl+(stndx * mp->symhdr->sh_entsize));
234 _kobj_printf(ops, "krtld:\t%s",
235 conv_reloc_amd64_type(rtype));
236 _kobj_printf(ops, "\t0x%8llx", off);
237 _kobj_printf(ops, " 0x%8llx", addend);
238 _kobj_printf(ops, " %s\n",
239 (const char *)mp->strings + symp->st_name);
240 }
241 #endif
242
243 if (!(mp->flags & KOBJ_EXEC))
244 off += baseaddr;
245
246 /*
247 * if R_AMD64_RELATIVE, simply add base addr
248 * to reloc location
249 */
250
251 if (rtype == R_AMD64_RELATIVE) {
252 value = baseaddr;
253 } else {
254 /*
255 * get symbol table entry - if symbol is local
256 * value is base address of this object
257 */
258 symref = (Sym *)
259 (mp->symtbl+(stndx * mp->symhdr->sh_entsize));
260
261 if (ELF_ST_BIND(symref->st_info) == STB_LOCAL) {
262 /* *** this is different for .o and .so */
263 value = symref->st_value;
264 } else {
265 /*
266 * It's global. Allow weak references. If
267 * the symbol is undefined, give TNF (the
268 * kernel probes facility) a chance to see
269 * if it's a probe site, and fix it up if so.
270 */
271 if (symref->st_shndx == SHN_UNDEF &&
272 sdt_reloc_resolve(mp, mp->strings +
273 symref->st_name, (uint8_t *)off) == 0)
274 continue;
275
276 if (symref->st_shndx == SHN_UNDEF &&
277 smap_reloc_resolve(mp, mp->strings +
278 symref->st_name, (uint8_t *)off) == 0)
279 continue;
280
281 if (symref->st_shndx == SHN_UNDEF &&
282 tnf_reloc_resolve(mp->strings +
283 symref->st_name, &symref->st_value,
284 &addend, off, &probelist, &taglist) != 0) {
285 if (ELF_ST_BIND(symref->st_info)
286 != STB_WEAK) {
287 _kobj_printf(ops,
288 "not found: %s\n",
289 mp->strings +
290 symref->st_name);
291 err = 1;
292 }
293 continue;
294 } else { /* symbol found - relocate */
295 /*
296 * calculate location of definition
297 * - symbol value plus base address of
298 * containing shared object
299 */
300 value = symref->st_value;
301
302 } /* end else symbol found */
303 } /* end global or weak */
304 } /* end not R_AMD64_RELATIVE */
305
306 value += addend;
307 /*
308 * calculate final value -
309 * if PC-relative, subtract ref addr
310 */
311 if (IS_PC_RELATIVE(rtype))
312 value -= off;
313
314 #ifdef KOBJ_DEBUG
315 if (kobj_debug & D_RELOCATIONS) {
316 _kobj_printf(ops, "krtld:\t\t\t\t0x%8llx", off);
317 _kobj_printf(ops, " 0x%8llx\n", value);
318 }
319 #endif
320
321 if (do_reloc_krtld(rtype, (unsigned char *)off, &value,
322 (const char *)mp->strings + symref->st_name,
323 mp->filename) == 0)
324 err = 1;
325
326 } /* end of while loop */
327 if (err)
328 return (-1);
329
330 if (tnf_splice_probes(mp->flags & KOBJ_PRIM, probelist, taglist))
331 mp->flags |= KOBJ_TNF_PROBE;
332
333 return (0);
334 }
335
336 int
337 do_relocations(struct module *mp)
338 {
339 uint_t shn;
340 Shdr *shp, *rshp;
341 uint_t nreloc;
342
343 /* do the relocations */
344 for (shn = 1; shn < mp->hdr.e_shnum; shn++) {
345 rshp = (Shdr *)
346 (mp->shdrs + shn * mp->hdr.e_shentsize);
347 if (rshp->sh_type == SHT_REL) {
348 _kobj_printf(ops, "%s can't process type SHT_REL\n",
349 mp->filename);
350 return (-1);
351 }
352 if (rshp->sh_type != SHT_RELA)
353 continue;
354 if (rshp->sh_link != mp->symtbl_section) {
355 _kobj_printf(ops, "%s reloc for non-default symtab\n",
356 mp->filename);
357 return (-1);
358 }
359 if (rshp->sh_info >= mp->hdr.e_shnum) {
360 _kobj_printf(ops, "do_relocations: %s sh_info ",
361 mp->filename);
362 _kobj_printf(ops, "out of range %d\n", shn);
363 goto bad;
364 }
365 nreloc = rshp->sh_size / rshp->sh_entsize;
366
367 /* get the section header that this reloc table refers to */
368 shp = (Shdr *)
369 (mp->shdrs + rshp->sh_info * mp->hdr.e_shentsize);
370
371 /*
372 * Do not relocate any section that isn't loaded into memory.
373 * Most commonly this will skip over the .rela.stab* sections
374 */
375 if (!(shp->sh_flags & SHF_ALLOC))
376 continue;
377 #ifdef KOBJ_DEBUG
378 if (kobj_debug & D_RELOCATIONS) {
379 _kobj_printf(ops, "krtld: relocating: file=%s ",
380 mp->filename);
381 _kobj_printf(ops, "section=%d\n", shn);
382 }
383 #endif
384
385 if (do_relocate(mp, (char *)rshp->sh_addr, rshp->sh_type,
386 nreloc, rshp->sh_entsize, shp->sh_addr) < 0) {
387 _kobj_printf(ops,
388 "do_relocations: %s do_relocate failed\n",
389 mp->filename);
390 goto bad;
391 }
392 kobj_free((void *)rshp->sh_addr, rshp->sh_size);
393 rshp->sh_addr = 0;
394 }
395 mp->flags |= KOBJ_RELOCATED;
396 return (0);
397 bad:
398 kobj_free((void *)rshp->sh_addr, rshp->sh_size);
399 rshp->sh_addr = 0;
400 return (-1);
401 }