1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  */
  26 /*
  27  * Copyright 2019 Joyent, Inc.
  28  */
  29 
  30 /*
  31  * x86 relocation code.
  32  */
  33 
  34 #include <sys/types.h>
  35 #include <sys/param.h>
  36 #include <sys/sysmacros.h>
  37 #include <sys/systm.h>
  38 #include <sys/user.h>
  39 #include <sys/bootconf.h>
  40 #include <sys/modctl.h>
  41 #include <sys/elf.h>
  42 #include <sys/kobj.h>
  43 #include <sys/kobj_impl.h>
  44 #include <sys/tnf.h>
  45 #include <sys/tnf_probe.h>
  46 
  47 #include "reloc.h"
  48 
  49 
  50 /*
  51  * Probe Discovery
  52  */
  53 
  54 #define PROBE_MARKER_SYMBOL     "__tnf_probe_version_1"
  55 #define TAG_MARKER_SYMBOL       "__tnf_tag_version_1"
  56 
  57 extern int tnf_splice_probes(int, tnf_probe_control_t *, tnf_tag_data_t *);
  58 
  59 /*
  60  * The kernel run-time linker calls this to try to resolve a reference
  61  * it can't otherwise resolve.  We see if it's marking a probe control
  62  * block; if so, we do the resolution and return 0.  If not, we return
  63  * 1 to show that we can't resolve it, either.
  64  */
  65 static int
  66 tnf_reloc_resolve(char *symname, Addr *value_p,
  67     Elf64_Sxword *addend_p,
  68     long offset,
  69     tnf_probe_control_t **probelist,
  70     tnf_tag_data_t **taglist)
  71 {
  72         if (strcmp(symname, PROBE_MARKER_SYMBOL) == 0) {
  73                 *addend_p = 0;
  74                 ((tnf_probe_control_t *)offset)->next = *probelist;
  75                 *probelist = (tnf_probe_control_t *)offset;
  76                 return (0);
  77         }
  78         if (strcmp(symname, TAG_MARKER_SYMBOL) == 0) {
  79                 *addend_p = 0;
  80                 *value_p = (Addr)*taglist;
  81                 *taglist = (tnf_tag_data_t *)offset;
  82                 return (0);
  83         }
  84         return (1);
  85 }
  86 
  87 #define SDT_NOP         0x90
  88 #define SDT_NOPS        5
  89 
  90 static int
  91 sdt_reloc_resolve(struct module *mp, char *symname, uint8_t *instr)
  92 {
  93         sdt_probedesc_t *sdp;
  94         int i;
  95 
  96         /*
  97          * The "statically defined tracing" (SDT) provider for DTrace uses
  98          * a mechanism similar to TNF, but somewhat simpler.  (Surprise,
  99          * surprise.)  The SDT mechanism works by replacing calls to the
 100          * undefined routine __dtrace_probe_[name] with nop instructions.
 101          * The relocations are logged, and SDT itself will later patch the
 102          * running binary appropriately.
 103          */
 104         if (strncmp(symname, sdt_prefix, strlen(sdt_prefix)) != 0)
 105                 return (1);
 106 
 107         symname += strlen(sdt_prefix);
 108 
 109         sdp = kobj_alloc(sizeof (sdt_probedesc_t), KM_WAIT);
 110         sdp->sdpd_name = kobj_alloc(strlen(symname) + 1, KM_WAIT);
 111         bcopy(symname, sdp->sdpd_name, strlen(symname) + 1);
 112 
 113         sdp->sdpd_offset = (uintptr_t)instr;
 114         sdp->sdpd_next = mp->sdt_probes;
 115         mp->sdt_probes = sdp;
 116 
 117         for (i = 0; i < SDT_NOPS; i++)
 118                 instr[i - 1] = SDT_NOP;
 119 
 120         return (0);
 121 }
 122 
 123 
 124 /*
 125  * We're relying on the fact that the call we're replacing is
 126  * call (e8) plus 4 bytes of address, making a 5 byte instruction
 127  */
 128 #define NOP_INSTR       0x90
 129 #define SMAP_NOPS       5
 130 
 131 /*
 132  * Currently the only call replaced as a hot inline
 133  * is smap_enable() and smap_disable(). If more are needed
 134  * we should probably come up with an sdt probe like prefix
 135  * and look for those instead of exact call names.
 136  */
 137 static int
 138 smap_reloc_resolve(struct module *mp, char *symname, uint8_t *instr)
 139 {
 140         uint_t symlen;
 141         hotinline_desc_t *hid;
 142 
 143         if (strcmp(symname, "smap_enable") == 0 ||
 144             strcmp(symname, "smap_disable") == 0) {
 145 
 146 #ifdef  KOBJ_DEBUG
 147                 if (kobj_debug & D_RELOCATIONS) {
 148                         _kobj_printf(ops, "smap_reloc_resolve: %s relocating "
 149                             "enable/disable_smap\n", mp->filename);
 150                 }
 151 #endif
 152 
 153                 hid = kobj_alloc(sizeof (hotinline_desc_t), KM_WAIT);
 154                 symlen = strlen(symname) + 1;
 155                 hid->hid_symname = kobj_alloc(symlen, KM_WAIT);
 156                 bcopy(symname, hid->hid_symname, symlen);
 157 
 158                 /*
 159                  * We backtrack one byte here to consume the call
 160                  * instruction itself.
 161                  */
 162                 hid->hid_instr_offset = (uintptr_t)instr - 1;
 163                 hid->hid_next = mp->hi_calls;
 164                 mp->hi_calls = hid;
 165 
 166                 memset((void *)hid->hid_instr_offset, NOP_INSTR, SMAP_NOPS);
 167 
 168                 return (0);
 169         }
 170 
 171         return (1);
 172 }
 173 
 174 int
 175 do_relocate(struct module *mp, char *reltbl, Word relshtype, int nreloc,
 176     int relocsize, Addr baseaddr)
 177 {
 178         unsigned long stndx;
 179         unsigned long off;      /* can't be register for tnf_reloc_resolve() */
 180         register unsigned long reladdr, rend;
 181         register unsigned int rtype;
 182         unsigned long value;
 183         Elf64_Sxword addend;
 184         Sym *symref;
 185         int err = 0;
 186         tnf_probe_control_t *probelist = NULL;
 187         tnf_tag_data_t *taglist = NULL;
 188         int symnum;
 189         reladdr = (unsigned long)reltbl;
 190         rend = reladdr + nreloc * relocsize;
 191 
 192 #ifdef  KOBJ_DEBUG
 193         if (kobj_debug & D_RELOCATIONS) {
 194                 _kobj_printf(ops, "krtld:\ttype\t\t\toffset\t   addend"
 195                     "      symbol\n");
 196                 _kobj_printf(ops, "krtld:\t\t\t\t\t   value\n");
 197         }
 198 #endif
 199 
 200         symnum = -1;
 201         /* loop through relocations */
 202         while (reladdr < rend) {
 203                 symnum++;
 204                 rtype = ELF_R_TYPE(((Rela *)reladdr)->r_info);
 205                 off = ((Rela *)reladdr)->r_offset;
 206                 stndx = ELF_R_SYM(((Rela *)reladdr)->r_info);
 207                 if (stndx >= mp->nsyms) {
 208                         _kobj_printf(ops, "do_relocate: bad strndx %d\n",
 209                             symnum);
 210                         return (-1);
 211                 }
 212                 if ((rtype > R_AMD64_NUM) || IS_TLS_INS(rtype)) {
 213                         _kobj_printf(ops, "krtld: invalid relocation type %d",
 214                             rtype);
 215                         _kobj_printf(ops, " at 0x%llx:", off);
 216                         _kobj_printf(ops, " file=%s\n", mp->filename);
 217                         err = 1;
 218                         continue;
 219                 }
 220 
 221 
 222                 addend = (long)(((Rela *)reladdr)->r_addend);
 223                 reladdr += relocsize;
 224 
 225 
 226                 if (rtype == R_AMD64_NONE)
 227                         continue;
 228 
 229 #ifdef  KOBJ_DEBUG
 230                 if (kobj_debug & D_RELOCATIONS) {
 231                         Sym *   symp;
 232                         symp = (Sym *)
 233                             (mp->symtbl+(stndx * mp->symhdr->sh_entsize));
 234                         _kobj_printf(ops, "krtld:\t%s",
 235                             conv_reloc_amd64_type(rtype));
 236                         _kobj_printf(ops, "\t0x%8llx", off);
 237                         _kobj_printf(ops, " 0x%8llx", addend);
 238                         _kobj_printf(ops, "  %s\n",
 239                             (const char *)mp->strings + symp->st_name);
 240                 }
 241 #endif
 242 
 243                 if (!(mp->flags & KOBJ_EXEC))
 244                         off += baseaddr;
 245 
 246                 /*
 247                  * if R_AMD64_RELATIVE, simply add base addr
 248                  * to reloc location
 249                  */
 250 
 251                 if (rtype == R_AMD64_RELATIVE) {
 252                         value = baseaddr;
 253                 } else {
 254                         /*
 255                          * get symbol table entry - if symbol is local
 256                          * value is base address of this object
 257                          */
 258                         symref = (Sym *)
 259                             (mp->symtbl+(stndx * mp->symhdr->sh_entsize));
 260 
 261                         if (ELF_ST_BIND(symref->st_info) == STB_LOCAL) {
 262                                 /* *** this is different for .o and .so */
 263                                 value = symref->st_value;
 264                         } else {
 265                                 /*
 266                                  * It's global. Allow weak references.  If
 267                                  * the symbol is undefined, give TNF (the
 268                                  * kernel probes facility) a chance to see
 269                                  * if it's a probe site, and fix it up if so.
 270                                  */
 271                                 if (symref->st_shndx == SHN_UNDEF &&
 272                                     sdt_reloc_resolve(mp, mp->strings +
 273                                     symref->st_name, (uint8_t *)off) == 0)
 274                                         continue;
 275 
 276                                 if (symref->st_shndx == SHN_UNDEF &&
 277                                     smap_reloc_resolve(mp, mp->strings +
 278                                     symref->st_name, (uint8_t *)off) == 0)
 279                                         continue;
 280 
 281                                 if (symref->st_shndx == SHN_UNDEF &&
 282                                     tnf_reloc_resolve(mp->strings +
 283                                     symref->st_name, &symref->st_value,
 284                                     &addend, off, &probelist, &taglist) != 0) {
 285                                         if (ELF_ST_BIND(symref->st_info)
 286                                             != STB_WEAK) {
 287                                                 _kobj_printf(ops,
 288                                                     "not found: %s\n",
 289                                                     mp->strings +
 290                                                     symref->st_name);
 291                                                 err = 1;
 292                                         }
 293                                         continue;
 294                                 } else { /* symbol found  - relocate */
 295                                         /*
 296                                          * calculate location of definition
 297                                          * - symbol value plus base address of
 298                                          * containing shared object
 299                                          */
 300                                         value = symref->st_value;
 301 
 302                                 } /* end else symbol found */
 303                         } /* end global or weak */
 304                 } /* end not R_AMD64_RELATIVE */
 305 
 306                 value += addend;
 307                 /*
 308                  * calculate final value -
 309                  * if PC-relative, subtract ref addr
 310                  */
 311                 if (IS_PC_RELATIVE(rtype))
 312                         value -= off;
 313 
 314 #ifdef  KOBJ_DEBUG
 315                 if (kobj_debug & D_RELOCATIONS) {
 316                         _kobj_printf(ops, "krtld:\t\t\t\t0x%8llx", off);
 317                         _kobj_printf(ops, " 0x%8llx\n", value);
 318                 }
 319 #endif
 320 
 321                 if (do_reloc_krtld(rtype, (unsigned char *)off, &value,
 322                     (const char *)mp->strings + symref->st_name,
 323                     mp->filename) == 0)
 324                         err = 1;
 325 
 326         } /* end of while loop */
 327         if (err)
 328                 return (-1);
 329 
 330         if (tnf_splice_probes(mp->flags & KOBJ_PRIM, probelist, taglist))
 331                 mp->flags |= KOBJ_TNF_PROBE;
 332 
 333         return (0);
 334 }
 335 
 336 int
 337 do_relocations(struct module *mp)
 338 {
 339         uint_t shn;
 340         Shdr *shp, *rshp;
 341         uint_t nreloc;
 342 
 343         /* do the relocations */
 344         for (shn = 1; shn < mp->hdr.e_shnum; shn++) {
 345                 rshp = (Shdr *)
 346                     (mp->shdrs + shn * mp->hdr.e_shentsize);
 347                 if (rshp->sh_type == SHT_REL) {
 348                         _kobj_printf(ops, "%s can't process type SHT_REL\n",
 349                             mp->filename);
 350                         return (-1);
 351                 }
 352                 if (rshp->sh_type != SHT_RELA)
 353                         continue;
 354                 if (rshp->sh_link != mp->symtbl_section) {
 355                         _kobj_printf(ops, "%s reloc for non-default symtab\n",
 356                             mp->filename);
 357                         return (-1);
 358                 }
 359                 if (rshp->sh_info >= mp->hdr.e_shnum) {
 360                         _kobj_printf(ops, "do_relocations: %s sh_info ",
 361                             mp->filename);
 362                         _kobj_printf(ops, "out of range %d\n", shn);
 363                         goto bad;
 364                 }
 365                 nreloc = rshp->sh_size / rshp->sh_entsize;
 366 
 367                 /* get the section header that this reloc table refers to */
 368                 shp = (Shdr *)
 369                     (mp->shdrs + rshp->sh_info * mp->hdr.e_shentsize);
 370 
 371                 /*
 372                  * Do not relocate any section that isn't loaded into memory.
 373                  * Most commonly this will skip over the .rela.stab* sections
 374                  */
 375                 if (!(shp->sh_flags & SHF_ALLOC))
 376                         continue;
 377 #ifdef  KOBJ_DEBUG
 378                 if (kobj_debug & D_RELOCATIONS) {
 379                         _kobj_printf(ops, "krtld: relocating: file=%s ",
 380                             mp->filename);
 381                         _kobj_printf(ops, "section=%d\n", shn);
 382                 }
 383 #endif
 384 
 385                 if (do_relocate(mp, (char *)rshp->sh_addr, rshp->sh_type,
 386                     nreloc, rshp->sh_entsize, shp->sh_addr) < 0) {
 387                         _kobj_printf(ops,
 388                             "do_relocations: %s do_relocate failed\n",
 389                             mp->filename);
 390                         goto bad;
 391                 }
 392                 kobj_free((void *)rshp->sh_addr, rshp->sh_size);
 393                 rshp->sh_addr = 0;
 394         }
 395         mp->flags |= KOBJ_RELOCATED;
 396         return (0);
 397 bad:
 398         kobj_free((void *)rshp->sh_addr, rshp->sh_size);
 399         rshp->sh_addr = 0;
 400         return (-1);
 401 }