1/* Machine-dependent ELF dynamic relocation inline functions. x86-64 version.
2 Copyright (C) 2001-2021 Free Software Foundation, Inc.
3 This file is part of the GNU C Library.
4 Contributed by Andreas Jaeger <aj@suse.de>.
5
6 The GNU C Library is free software; you can redistribute it and/or
7 modify it under the terms of the GNU Lesser General Public
8 License as published by the Free Software Foundation; either
9 version 2.1 of the License, or (at your option) any later version.
10
11 The GNU C Library is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public
17 License along with the GNU C Library; if not, see
18 <https://www.gnu.org/licenses/>. */
19
20#ifndef dl_machine_h
21#define dl_machine_h
22
23#define ELF_MACHINE_NAME "x86_64"
24
25#include <sys/param.h>
26#include <sysdep.h>
27#include <tls.h>
28#include <dl-tlsdesc.h>
29
30/* Return nonzero iff ELF header is compatible with the running host. */
31static inline int __attribute__ ((unused))
32elf_machine_matches_host (const ElfW(Ehdr) *ehdr)
33{
34 return ehdr->e_machine == EM_X86_64;
35}
36
37
38/* Return the link-time address of _DYNAMIC. Conveniently, this is the
39 first element of the GOT. This must be inlined in a function which
40 uses global data. */
41static inline ElfW(Addr) __attribute__ ((unused))
42elf_machine_dynamic (void)
43{
44 /* This produces an IP-relative reloc which is resolved at link time. */
45 extern const ElfW(Addr) _GLOBAL_OFFSET_TABLE_[] attribute_hidden;
46 return _GLOBAL_OFFSET_TABLE_[0];
47}
48
49
50/* Return the run-time load address of the shared object. */
51static inline ElfW(Addr) __attribute__ ((unused))
52elf_machine_load_address (void)
53{
54 /* Compute the difference between the runtime address of _DYNAMIC as seen
55 by an IP-relative reference, and the link-time address found in the
56 special unrelocated first GOT entry. */
57 extern ElfW(Dyn) _DYNAMIC[] attribute_hidden;
58 return (ElfW(Addr)) &_DYNAMIC - elf_machine_dynamic ();
59}
60
61/* Set up the loaded object described by L so its unrelocated PLT
62 entries will jump to the on-demand fixup code in dl-runtime.c. */
63
64static inline int __attribute__ ((unused, always_inline))
65elf_machine_runtime_setup (struct link_map *l, int lazy, int profile)
66{
67 Elf64_Addr *got;
68 extern void _dl_runtime_resolve_fxsave (ElfW(Word)) attribute_hidden;
69 extern void _dl_runtime_resolve_xsave (ElfW(Word)) attribute_hidden;
70 extern void _dl_runtime_resolve_xsavec (ElfW(Word)) attribute_hidden;
71 extern void _dl_runtime_profile_sse (ElfW(Word)) attribute_hidden;
72 extern void _dl_runtime_profile_avx (ElfW(Word)) attribute_hidden;
73 extern void _dl_runtime_profile_avx512 (ElfW(Word)) attribute_hidden;
74
75 if (l->l_info[DT_JMPREL] && lazy)
76 {
77 /* The GOT entries for functions in the PLT have not yet been filled
78 in. Their initial contents will arrange when called to push an
79 offset into the .rel.plt section, push _GLOBAL_OFFSET_TABLE_[1],
80 and then jump to _GLOBAL_OFFSET_TABLE_[2]. */
81 got = (Elf64_Addr *) D_PTR (l, l_info[DT_PLTGOT]);
82 /* If a library is prelinked but we have to relocate anyway,
83 we have to be able to undo the prelinking of .got.plt.
84 The prelinker saved us here address of .plt + 0x16. */
85 if (got[1])
86 {
87 l->l_mach.plt = got[1] + l->l_addr;
88 l->l_mach.gotplt = (ElfW(Addr)) &got[3];
89 }
90 /* Identify this shared object. */
91 *(ElfW(Addr) *) (got + 1) = (ElfW(Addr)) l;
92
93 /* The got[2] entry contains the address of a function which gets
94 called to get the address of a so far unresolved function and
95 jump to it. The profiling extension of the dynamic linker allows
96 to intercept the calls to collect information. In this case we
97 don't store the address in the GOT so that all future calls also
98 end in this function. */
99 if (__glibc_unlikely (profile))
100 {
101 if (CPU_FEATURE_USABLE (AVX512F))
102 *(ElfW(Addr) *) (got + 2) = (ElfW(Addr)) &_dl_runtime_profile_avx512;
103 else if (CPU_FEATURE_USABLE (AVX))
104 *(ElfW(Addr) *) (got + 2) = (ElfW(Addr)) &_dl_runtime_profile_avx;
105 else
106 *(ElfW(Addr) *) (got + 2) = (ElfW(Addr)) &_dl_runtime_profile_sse;
107
108 if (GLRO(dl_profile) != NULL
109 && _dl_name_match_p (GLRO(dl_profile), l))
110 /* This is the object we are looking for. Say that we really
111 want profiling and the timers are started. */
112 GL(dl_profile_map) = l;
113 }
114 else
115 {
116 /* This function will get called to fix up the GOT entry
117 indicated by the offset on the stack, and then jump to
118 the resolved address. */
119 if (GLRO(dl_x86_cpu_features).xsave_state_size != 0)
120 *(ElfW(Addr) *) (got + 2)
121 = (CPU_FEATURE_USABLE (XSAVEC)
122 ? (ElfW(Addr)) &_dl_runtime_resolve_xsavec
123 : (ElfW(Addr)) &_dl_runtime_resolve_xsave);
124 else
125 *(ElfW(Addr) *) (got + 2)
126 = (ElfW(Addr)) &_dl_runtime_resolve_fxsave;
127 }
128 }
129
130 return lazy;
131}
132
133/* Initial entry point code for the dynamic linker.
134 The C function `_dl_start' is the real entry point;
135 its return value is the user program's entry point. */
136#define RTLD_START asm ("\n\
137.text\n\
138 .align 16\n\
139.globl _start\n\
140.globl _dl_start_user\n\
141_start:\n\
142 movq %rsp, %rdi\n\
143 call _dl_start\n\
144_dl_start_user:\n\
145 # Save the user entry point address in %r12.\n\
146 movq %rax, %r12\n\
147 # See if we were run as a command with the executable file\n\
148 # name as an extra leading argument.\n\
149 movl _dl_skip_args(%rip), %eax\n\
150 # Pop the original argument count.\n\
151 popq %rdx\n\
152 # Adjust the stack pointer to skip _dl_skip_args words.\n\
153 leaq (%rsp,%rax,8), %rsp\n\
154 # Subtract _dl_skip_args from argc.\n\
155 subl %eax, %edx\n\
156 # Push argc back on the stack.\n\
157 pushq %rdx\n\
158 # Call _dl_init (struct link_map *main_map, int argc, char **argv, char **env)\n\
159 # argc -> rsi\n\
160 movq %rdx, %rsi\n\
161 # Save %rsp value in %r13.\n\
162 movq %rsp, %r13\n\
163 # And align stack for the _dl_init call. \n\
164 andq $-16, %rsp\n\
165 # _dl_loaded -> rdi\n\
166 movq _rtld_local(%rip), %rdi\n\
167 # env -> rcx\n\
168 leaq 16(%r13,%rdx,8), %rcx\n\
169 # argv -> rdx\n\
170 leaq 8(%r13), %rdx\n\
171 # Clear %rbp to mark outermost frame obviously even for constructors.\n\
172 xorl %ebp, %ebp\n\
173 # Call the function to run the initializers.\n\
174 call _dl_init\n\
175 # Pass our finalizer function to the user in %rdx, as per ELF ABI.\n\
176 leaq _dl_fini(%rip), %rdx\n\
177 # And make sure %rsp points to argc stored on the stack.\n\
178 movq %r13, %rsp\n\
179 # Jump to the user's entry point.\n\
180 jmp *%r12\n\
181.previous\n\
182");
183
184/* ELF_RTYPE_CLASS_PLT iff TYPE describes relocation of a PLT entry or
185 TLS variable, so undefined references should not be allowed to
186 define the value.
187 ELF_RTYPE_CLASS_COPY iff TYPE should not be allowed to resolve to one
188 of the main executable's symbols, as for a COPY reloc.
189 ELF_RTYPE_CLASS_EXTERN_PROTECTED_DATA iff TYPE describes relocation may
190 against protected data whose address be external due to copy relocation.
191 */
192#define elf_machine_type_class(type) \
193 ((((type) == R_X86_64_JUMP_SLOT \
194 || (type) == R_X86_64_DTPMOD64 \
195 || (type) == R_X86_64_DTPOFF64 \
196 || (type) == R_X86_64_TPOFF64 \
197 || (type) == R_X86_64_TLSDESC) \
198 * ELF_RTYPE_CLASS_PLT) \
199 | (((type) == R_X86_64_COPY) * ELF_RTYPE_CLASS_COPY) \
200 | (((type) == R_X86_64_GLOB_DAT) * ELF_RTYPE_CLASS_EXTERN_PROTECTED_DATA))
201
202/* A reloc type used for ld.so cmdline arg lookups to reject PLT entries. */
203#define ELF_MACHINE_JMP_SLOT R_X86_64_JUMP_SLOT
204
205/* The relative ifunc relocation. */
206// XXX This is a work-around for a broken linker. Remove!
207#define ELF_MACHINE_IRELATIVE R_X86_64_IRELATIVE
208
209/* The x86-64 never uses Elf64_Rel/Elf32_Rel relocations. */
210#define ELF_MACHINE_NO_REL 1
211#define ELF_MACHINE_NO_RELA 0
212
213/* We define an initialization function. This is called very early in
214 _dl_sysdep_start. */
215#define DL_PLATFORM_INIT dl_platform_init ()
216
217static inline void __attribute__ ((unused))
218dl_platform_init (void)
219{
220#if IS_IN (rtld)
221 /* _dl_x86_init_cpu_features is a wrapper for init_cpu_features which
222 has been called early from __libc_start_main in static executable. */
223 _dl_x86_init_cpu_features ();
224#else
225 if (GLRO(dl_platform) != NULL && *GLRO(dl_platform) == '\0')
226 /* Avoid an empty string which would disturb us. */
227 GLRO(dl_platform) = NULL;
228#endif
229}
230
231static inline ElfW(Addr)
232elf_machine_fixup_plt (struct link_map *map, lookup_t t,
233 const ElfW(Sym) *refsym, const ElfW(Sym) *sym,
234 const ElfW(Rela) *reloc,
235 ElfW(Addr) *reloc_addr, ElfW(Addr) value)
236{
237 return *reloc_addr = value;
238}
239
240/* Return the final value of a PLT relocation. On x86-64 the
241 JUMP_SLOT relocation ignores the addend. */
242static inline ElfW(Addr)
243elf_machine_plt_value (struct link_map *map, const ElfW(Rela) *reloc,
244 ElfW(Addr) value)
245{
246 return value;
247}
248
249
250/* Names of the architecture-specific auditing callback functions. */
251#define ARCH_LA_PLTENTER x86_64_gnu_pltenter
252#define ARCH_LA_PLTEXIT x86_64_gnu_pltexit
253
254#endif /* !dl_machine_h */
255
256#ifdef RESOLVE_MAP
257
258/* Perform the relocation specified by RELOC and SYM (which is fully resolved).
259 MAP is the object containing the reloc. */
260
261auto inline void
262__attribute__ ((always_inline))
263elf_machine_rela (struct link_map *map, const ElfW(Rela) *reloc,
264 const ElfW(Sym) *sym, const struct r_found_version *version,
265 void *const reloc_addr_arg, int skip_ifunc)
266{
267 ElfW(Addr) *const reloc_addr = reloc_addr_arg;
268 const unsigned long int r_type = ELFW(R_TYPE) (reloc->r_info);
269
270# if !defined RTLD_BOOTSTRAP || !defined HAVE_Z_COMBRELOC
271 if (__glibc_unlikely (r_type == R_X86_64_RELATIVE))
272 {
273# if !defined RTLD_BOOTSTRAP && !defined HAVE_Z_COMBRELOC
274 /* This is defined in rtld.c, but nowhere in the static libc.a;
275 make the reference weak so static programs can still link.
276 This declaration cannot be done when compiling rtld.c
277 (i.e. #ifdef RTLD_BOOTSTRAP) because rtld.c contains the
278 common defn for _dl_rtld_map, which is incompatible with a
279 weak decl in the same file. */
280# ifndef SHARED
281 weak_extern (GL(dl_rtld_map));
282# endif
283 if (map != &GL(dl_rtld_map)) /* Already done in rtld itself. */
284# endif
285 *reloc_addr = map->l_addr + reloc->r_addend;
286 }
287 else
288# endif
289# if !defined RTLD_BOOTSTRAP
290 /* l_addr + r_addend may be > 0xffffffff and R_X86_64_RELATIVE64
291 relocation updates the whole 64-bit entry. */
292 if (__glibc_unlikely (r_type == R_X86_64_RELATIVE64))
293 *(Elf64_Addr *) reloc_addr = (Elf64_Addr) map->l_addr + reloc->r_addend;
294 else
295# endif
296 if (__glibc_unlikely (r_type == R_X86_64_NONE))
297 return;
298 else
299 {
300# ifndef RTLD_BOOTSTRAP
301 const ElfW(Sym) *const refsym = sym;
302# endif
303 struct link_map *sym_map = RESOLVE_MAP (&sym, version, r_type);
304 ElfW(Addr) value = SYMBOL_ADDRESS (sym_map, sym, true);
305
306 if (sym != NULL
307 && __glibc_unlikely (ELFW(ST_TYPE) (sym->st_info) == STT_GNU_IFUNC)
308 && __glibc_likely (sym->st_shndx != SHN_UNDEF)
309 && __glibc_likely (!skip_ifunc))
310 {
311# ifndef RTLD_BOOTSTRAP
312 if (sym_map != map
313 && !sym_map->l_relocated)
314 {
315 const char *strtab
316 = (const char *) D_PTR (map, l_info[DT_STRTAB]);
317 if (sym_map->l_type == lt_executable)
318 _dl_fatal_printf ("\
319%s: IFUNC symbol '%s' referenced in '%s' is defined in the executable \
320and creates an unsatisfiable circular dependency.\n",
321 RTLD_PROGNAME, strtab + refsym->st_name,
322 map->l_name);
323 else
324 _dl_error_printf ("\
325%s: Relink `%s' with `%s' for IFUNC symbol `%s'\n",
326 RTLD_PROGNAME, map->l_name,
327 sym_map->l_name,
328 strtab + refsym->st_name);
329 }
330# endif
331 value = ((ElfW(Addr) (*) (void)) value) ();
332 }
333
334 switch (r_type)
335 {
336# ifndef RTLD_BOOTSTRAP
337# ifdef __ILP32__
338 case R_X86_64_SIZE64:
339 /* Set to symbol size plus addend. */
340 *(Elf64_Addr *) (uintptr_t) reloc_addr
341 = (Elf64_Addr) sym->st_size + reloc->r_addend;
342 break;
343
344 case R_X86_64_SIZE32:
345# else
346 case R_X86_64_SIZE64:
347# endif
348 /* Set to symbol size plus addend. */
349 value = sym->st_size;
350# endif
351 /* Fall through. */
352 case R_X86_64_GLOB_DAT:
353 case R_X86_64_JUMP_SLOT:
354 *reloc_addr = value + reloc->r_addend;
355 break;
356
357# ifndef RESOLVE_CONFLICT_FIND_MAP
358 case R_X86_64_DTPMOD64:
359# ifdef RTLD_BOOTSTRAP
360 /* During startup the dynamic linker is always the module
361 with index 1.
362 XXX If this relocation is necessary move before RESOLVE
363 call. */
364 *reloc_addr = 1;
365# else
366 /* Get the information from the link map returned by the
367 resolve function. */
368 if (sym_map != NULL)
369 *reloc_addr = sym_map->l_tls_modid;
370# endif
371 break;
372 case R_X86_64_DTPOFF64:
373# ifndef RTLD_BOOTSTRAP
374 /* During relocation all TLS symbols are defined and used.
375 Therefore the offset is already correct. */
376 if (sym != NULL)
377 {
378 value = sym->st_value + reloc->r_addend;
379# ifdef __ILP32__
380 /* This relocation type computes a signed offset that is
381 usually negative. The symbol and addend values are 32
382 bits but the GOT entry is 64 bits wide and the whole
383 64-bit entry is used as a signed quantity, so we need
384 to sign-extend the computed value to 64 bits. */
385 *(Elf64_Sxword *) reloc_addr = (Elf64_Sxword) (Elf32_Sword) value;
386# else
387 *reloc_addr = value;
388# endif
389 }
390# endif
391 break;
392 case R_X86_64_TLSDESC:
393 {
394 struct tlsdesc volatile *td =
395 (struct tlsdesc volatile *)reloc_addr;
396
397# ifndef RTLD_BOOTSTRAP
398 if (! sym)
399 {
400 td->arg = (void*)reloc->r_addend;
401 td->entry = _dl_tlsdesc_undefweak;
402 }
403 else
404# endif
405 {
406# ifndef RTLD_BOOTSTRAP
407# ifndef SHARED
408 CHECK_STATIC_TLS (map, sym_map);
409# else
410 if (!TRY_STATIC_TLS (map, sym_map))
411 {
412 td->arg = _dl_make_tlsdesc_dynamic
413 (sym_map, sym->st_value + reloc->r_addend);
414 td->entry = _dl_tlsdesc_dynamic;
415 }
416 else
417# endif
418# endif
419 {
420 td->arg = (void*)(sym->st_value - sym_map->l_tls_offset
421 + reloc->r_addend);
422 td->entry = _dl_tlsdesc_return;
423 }
424 }
425 break;
426 }
427 case R_X86_64_TPOFF64:
428 /* The offset is negative, forward from the thread pointer. */
429# ifndef RTLD_BOOTSTRAP
430 if (sym != NULL)
431# endif
432 {
433# ifndef RTLD_BOOTSTRAP
434 CHECK_STATIC_TLS (map, sym_map);
435# endif
436 /* We know the offset of the object the symbol is contained in.
437 It is a negative value which will be added to the
438 thread pointer. */
439 value = (sym->st_value + reloc->r_addend
440 - sym_map->l_tls_offset);
441# ifdef __ILP32__
442 /* The symbol and addend values are 32 bits but the GOT
443 entry is 64 bits wide and the whole 64-bit entry is used
444 as a signed quantity, so we need to sign-extend the
445 computed value to 64 bits. */
446 *(Elf64_Sxword *) reloc_addr = (Elf64_Sxword) (Elf32_Sword) value;
447# else
448 *reloc_addr = value;
449# endif
450 }
451 break;
452# endif
453
454# ifndef RTLD_BOOTSTRAP
455 case R_X86_64_64:
456 /* value + r_addend may be > 0xffffffff and R_X86_64_64
457 relocation updates the whole 64-bit entry. */
458 *(Elf64_Addr *) reloc_addr = (Elf64_Addr) value + reloc->r_addend;
459 break;
460# ifndef __ILP32__
461 case R_X86_64_SIZE32:
462 /* Set to symbol size plus addend. */
463 value = sym->st_size;
464# endif
465 /* Fall through. */
466 case R_X86_64_32:
467 value += reloc->r_addend;
468 *(unsigned int *) reloc_addr = value;
469
470 const char *fmt;
471 if (__glibc_unlikely (value > UINT_MAX))
472 {
473 const char *strtab;
474
475 fmt = "\
476%s: Symbol `%s' causes overflow in R_X86_64_32 relocation\n";
477# ifndef RESOLVE_CONFLICT_FIND_MAP
478 print_err:
479# endif
480 strtab = (const char *) D_PTR (map, l_info[DT_STRTAB]);
481
482 _dl_error_printf (fmt, RTLD_PROGNAME, strtab + refsym->st_name);
483 }
484 break;
485# ifndef RESOLVE_CONFLICT_FIND_MAP
486 /* Not needed for dl-conflict.c. */
487 case R_X86_64_PC32:
488 value += reloc->r_addend - (ElfW(Addr)) reloc_addr;
489 *(unsigned int *) reloc_addr = value;
490 if (__glibc_unlikely (value != (int) value))
491 {
492 fmt = "\
493%s: Symbol `%s' causes overflow in R_X86_64_PC32 relocation\n";
494 goto print_err;
495 }
496 break;
497 case R_X86_64_COPY:
498 if (sym == NULL)
499 /* This can happen in trace mode if an object could not be
500 found. */
501 break;
502 memcpy (reloc_addr_arg, (void *) value,
503 MIN (sym->st_size, refsym->st_size));
504 if (__glibc_unlikely (sym->st_size > refsym->st_size)
505 || (__glibc_unlikely (sym->st_size < refsym->st_size)
506 && GLRO(dl_verbose)))
507 {
508 fmt = "\
509%s: Symbol `%s' has different size in shared object, consider re-linking\n";
510 goto print_err;
511 }
512 break;
513# endif
514 case R_X86_64_IRELATIVE:
515 value = map->l_addr + reloc->r_addend;
516 if (__glibc_likely (!skip_ifunc))
517 value = ((ElfW(Addr) (*) (void)) value) ();
518 *reloc_addr = value;
519 break;
520 default:
521 _dl_reloc_bad_type (map, r_type, 0);
522 break;
523# endif
524 }
525 }
526}
527
528auto inline void
529__attribute ((always_inline))
530elf_machine_rela_relative (ElfW(Addr) l_addr, const ElfW(Rela) *reloc,
531 void *const reloc_addr_arg)
532{
533 ElfW(Addr) *const reloc_addr = reloc_addr_arg;
534#if !defined RTLD_BOOTSTRAP
535 /* l_addr + r_addend may be > 0xffffffff and R_X86_64_RELATIVE64
536 relocation updates the whole 64-bit entry. */
537 if (__glibc_unlikely (ELFW(R_TYPE) (reloc->r_info) == R_X86_64_RELATIVE64))
538 *(Elf64_Addr *) reloc_addr = (Elf64_Addr) l_addr + reloc->r_addend;
539 else
540#endif
541 {
542 assert (ELFW(R_TYPE) (reloc->r_info) == R_X86_64_RELATIVE);
543 *reloc_addr = l_addr + reloc->r_addend;
544 }
545}
546
547auto inline void
548__attribute ((always_inline))
549elf_machine_lazy_rel (struct link_map *map,
550 ElfW(Addr) l_addr, const ElfW(Rela) *reloc,
551 int skip_ifunc)
552{
553 ElfW(Addr) *const reloc_addr = (void *) (l_addr + reloc->r_offset);
554 const unsigned long int r_type = ELFW(R_TYPE) (reloc->r_info);
555
556 /* Check for unexpected PLT reloc type. */
557 if (__glibc_likely (r_type == R_X86_64_JUMP_SLOT))
558 {
559 /* Prelink has been deprecated. */
560 if (__glibc_likely (map->l_mach.plt == 0))
561 *reloc_addr += l_addr;
562 else
563 *reloc_addr =
564 map->l_mach.plt
565 + (((ElfW(Addr)) reloc_addr) - map->l_mach.gotplt) * 2;
566 }
567 else if (__glibc_likely (r_type == R_X86_64_TLSDESC))
568 {
569 const Elf_Symndx symndx = ELFW (R_SYM) (reloc->r_info);
570 const ElfW (Sym) *symtab = (const void *)D_PTR (map, l_info[DT_SYMTAB]);
571 const ElfW (Sym) *sym = &symtab[symndx];
572 const struct r_found_version *version = NULL;
573
574 if (map->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
575 {
576 const ElfW (Half) *vernum =
577 (const void *)D_PTR (map, l_info[VERSYMIDX (DT_VERSYM)]);
578 version = &map->l_versions[vernum[symndx] & 0x7fff];
579 }
580
581 /* Always initialize TLS descriptors completely at load time, in
582 case static TLS is allocated for it that requires locking. */
583 elf_machine_rela (map, reloc, sym, version, reloc_addr, skip_ifunc);
584 }
585 else if (__glibc_unlikely (r_type == R_X86_64_IRELATIVE))
586 {
587 ElfW(Addr) value = map->l_addr + reloc->r_addend;
588 if (__glibc_likely (!skip_ifunc))
589 value = ((ElfW(Addr) (*) (void)) value) ();
590 *reloc_addr = value;
591 }
592 else
593 _dl_reloc_bad_type (map, r_type, 1);
594}
595
596#endif /* RESOLVE_MAP */
597