1*1e43641eSderaadt /* $OpenBSD: boot_md.h,v 1.5 2023/11/18 16:26:16 deraadt Exp $ */
2c911477eSguenther
3c911477eSguenther /*
4c911477eSguenther * Copyright (c) 1998 Per Fogelstrom, Opsycon AB
5c911477eSguenther *
6c911477eSguenther * Redistribution and use in source and binary forms, with or without
7c911477eSguenther * modification, are permitted provided that the following conditions
8c911477eSguenther * are met:
9c911477eSguenther * 1. Redistributions of source code must retain the above copyright
10c911477eSguenther * notice, this list of conditions and the following disclaimer.
11c911477eSguenther * 2. Redistributions in binary form must reproduce the above copyright
12c911477eSguenther * notice, this list of conditions and the following disclaimer in the
13c911477eSguenther * documentation and/or other materials provided with the distribution.
14c911477eSguenther *
15c911477eSguenther * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
16c911477eSguenther * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
17c911477eSguenther * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18c911477eSguenther * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
19c911477eSguenther * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20c911477eSguenther * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21c911477eSguenther * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22c911477eSguenther * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23c911477eSguenther * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24c911477eSguenther * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25c911477eSguenther * SUCH DAMAGE.
26c911477eSguenther *
27c911477eSguenther */
28c911477eSguenther
29c911477eSguenther /*
30c911477eSguenther * IMPORTANT: any functions below are NOT protected by SSP. Please
31c911477eSguenther * do not add anything except what is required to reach GOT with
32c911477eSguenther * an adjustment.
33c911477eSguenther */
34c911477eSguenther
35c911477eSguenther #define _DYN_LOADER
36c911477eSguenther
37c911477eSguenther #include <sys/exec_elf.h>
385018f4d3Sguenther #include <sys/mman.h>
395018f4d3Sguenther
405018f4d3Sguenther #include <machine/reloc.h>
415018f4d3Sguenther
425018f4d3Sguenther __dead
43*1e43641eSderaadt void _csu_abort(void);
44c911477eSguenther
45c911477eSguenther #include "archdep.h"
46c911477eSguenther
47c911477eSguenther /*
48c911477eSguenther * Use the internal, hidden name for any syscalls we need, to avoid
49c911477eSguenther * accidental override by application code
50c911477eSguenther */
51c911477eSguenther #define REDIRECT_SYSCALL(x) typeof(x) x asm("_libc_"#x) __dso_hidden
52c911477eSguenther REDIRECT_SYSCALL(mprotect);
53df24df89Sderaadt REDIRECT_SYSCALL(mimmutable);
54c911477eSguenther
55c911477eSguenther typedef Elf_RelA RELOC_TYPE;
56c911477eSguenther
57c911477eSguenther static void *relro_addr;
58c911477eSguenther static size_t relro_size;
59c911477eSguenther #define RCRT0_RELRO() \
60c911477eSguenther do { \
61c911477eSguenther if (relro_addr != NULL && relro_size != 0) \
62c911477eSguenther mprotect(relro_addr, relro_size, PROT_READ); \
63df24df89Sderaadt mimmutable(relro_addr, relro_size); \
64c911477eSguenther } while (0)
65c911477eSguenther
66c911477eSguenther /*
67c911477eSguenther * Local decls.
68c911477eSguenther */
69c911477eSguenther void _dl_boot_bind(const long, long *, Elf_Dyn *);
70c911477eSguenther
71c911477eSguenther void
_dl_boot_bind(const long sp,long * dl_data,Elf_Dyn * dynp)72c911477eSguenther _dl_boot_bind(const long sp, long *dl_data, Elf_Dyn *dynp)
73c911477eSguenther {
74c911477eSguenther AuxInfo *auxstack;
75c911477eSguenther long *stack;
76c911477eSguenther int n, argc;
77c911477eSguenther char **argv, **envp;
78c911477eSguenther long loff;
79c911477eSguenther Elf_Phdr *phdp;
80fdacdf06Sguenther const RELOC_TYPE *rend;
81fdacdf06Sguenther const RELOC_TYPE *dt_reloc; /* DT_RELA */
82fdacdf06Sguenther Elf_Addr dt_relocsz; /* DT_RELASZ */
83fdacdf06Sguenther Elf_Addr dt_pltgot;
84fdacdf06Sguenther Elf_Addr dt_pltrelsz;
85fdacdf06Sguenther const Elf_Sym *dt_symtab;
86fdacdf06Sguenther const RELOC_TYPE *dt_jmprel;
87c911477eSguenther Elf_Addr i;
88c911477eSguenther
89c911477eSguenther /*
90c911477eSguenther * Scan argument and environment vectors. Find dynamic
91c911477eSguenther * data vector put after them.
92c911477eSguenther */
93c911477eSguenther stack = (long *)sp;
94c911477eSguenther argc = *stack++;
95c911477eSguenther argv = (char **)stack;
96c911477eSguenther envp = &argv[argc + 1];
97c911477eSguenther stack = (long *)envp;
98c911477eSguenther while (*stack++ != 0L)
99c911477eSguenther ;
100c911477eSguenther
101c911477eSguenther /*
102c911477eSguenther * Zero out dl_data.
103c911477eSguenther */
104c911477eSguenther for (n = 0; n <= AUX_entry; n++)
105c911477eSguenther dl_data[n] = 0;
106c911477eSguenther
107c911477eSguenther /*
108c911477eSguenther * Dig out auxiliary data set up by exec call. Move all known
109c911477eSguenther * tags to an indexed local table for easy access.
110c911477eSguenther */
111c911477eSguenther for (auxstack = (AuxInfo *)stack; auxstack->au_id != AUX_null;
112c911477eSguenther auxstack++) {
113c911477eSguenther if (auxstack->au_id > AUX_entry)
114c911477eSguenther continue;
115c911477eSguenther dl_data[auxstack->au_id] = auxstack->au_v;
116c911477eSguenther }
117c911477eSguenther loff = dl_data[AUX_base]; /* XXX assumes ld.so is linked at 0x0 */
118c911477eSguenther
119c911477eSguenther /*
120fdacdf06Sguenther * Scan the DYNAMIC section for the items we need
121c911477eSguenther */
122fdacdf06Sguenther dt_pltrelsz = dt_relocsz = dt_pltgot = 0;
123fdacdf06Sguenther dt_jmprel = dt_reloc = NULL;
124fdacdf06Sguenther dt_symtab = NULL;
125c911477eSguenther while (dynp->d_tag != DT_NULL) {
126c911477eSguenther /* first the tags that are pointers to be relocated */
127c911477eSguenther if (dynp->d_tag == DT_PLTGOT)
128fdacdf06Sguenther dt_pltgot = dynp->d_un.d_ptr + loff;
129c911477eSguenther else if (dynp->d_tag == DT_SYMTAB)
130fdacdf06Sguenther dt_symtab = (void *)(dynp->d_un.d_ptr + loff);
131c911477eSguenther else if (dynp->d_tag == RELOC_TAG) /* DT_{RELA,REL} */
132fdacdf06Sguenther dt_reloc = (void *)(dynp->d_un.d_ptr + loff);
133c911477eSguenther else if (dynp->d_tag == DT_JMPREL)
134fdacdf06Sguenther dt_jmprel = (void *)(dynp->d_un.d_ptr + loff);
135c911477eSguenther
136c911477eSguenther /* Now for the tags that are just sizes or counts */
137c911477eSguenther else if (dynp->d_tag == DT_PLTRELSZ)
138fdacdf06Sguenther dt_pltrelsz = dynp->d_un.d_val;
139c911477eSguenther else if (dynp->d_tag == RELOC_TAG+1) /* DT_{RELA,REL}SZ */
140fdacdf06Sguenther dt_relocsz = dynp->d_un.d_val;
141c911477eSguenther dynp++;
142c911477eSguenther }
143c911477eSguenther
144fdacdf06Sguenther rend = (RELOC_TYPE *)((char *)dt_jmprel + dt_pltrelsz);
145fdacdf06Sguenther for (; dt_jmprel < rend; dt_jmprel++) {
146c911477eSguenther const Elf_Sym *sp;
147c911477eSguenther
148fdacdf06Sguenther sp = dt_symtab + ELF_R_SYM(dt_jmprel->r_info);
149fdacdf06Sguenther if (!ELF_R_SYM(dt_jmprel->r_info) || sp->st_value != 0) {
150fdacdf06Sguenther Elf_Addr *ra = (Elf_Addr *)(dt_jmprel->r_offset + loff);
151fdacdf06Sguenther RELOC_JMPREL(dt_jmprel, sp, ra, loff, dt_pltgot);
152c911477eSguenther }
153c911477eSguenther }
154c911477eSguenther
155fdacdf06Sguenther rend = (RELOC_TYPE *)((char *)dt_reloc + dt_relocsz);
156fdacdf06Sguenther for (; dt_reloc < rend; dt_reloc++) {
157c911477eSguenther Elf_Addr *ra;
158c911477eSguenther const Elf_Sym *sp;
159c911477eSguenther
160fdacdf06Sguenther sp = dt_symtab + ELF_R_SYM(dt_reloc->r_info);
161fdacdf06Sguenther if (!ELF_R_SYM(dt_reloc->r_info) || sp->st_value != 0) {
162fdacdf06Sguenther ra = (Elf_Addr *)(dt_reloc->r_offset + loff);
163fdacdf06Sguenther RELOC_DYN(dt_reloc, sp, ra, loff);
164c911477eSguenther }
165c911477eSguenther }
166c911477eSguenther
167c911477eSguenther /* do any RWX -> RX fixups for executable PLTs and apply GNU_RELRO */
168c911477eSguenther phdp = (Elf_Phdr *)dl_data[AUX_phdr];
169c911477eSguenther for (i = 0; i < dl_data[AUX_phnum]; i++, phdp++) {
170c911477eSguenther switch (phdp->p_type) {
171c911477eSguenther case PT_LOAD:
172c911477eSguenther if ((phdp->p_flags & (PF_X | PF_W)) != (PF_X | PF_W))
173c911477eSguenther break;
174c911477eSguenther mprotect((void *)(phdp->p_vaddr + loff), phdp->p_memsz,
175c911477eSguenther PROT_READ);
176c911477eSguenther break;
177c911477eSguenther case PT_GNU_RELRO:
178c911477eSguenther relro_addr = (void *)(phdp->p_vaddr + loff);
179c911477eSguenther relro_size = phdp->p_memsz;
180c911477eSguenther /*
181c911477eSguenther * GNU_RELRO (a) covers the GOT, and (b) comes after
182c911477eSguenther * all LOAD sections, so if we found it then we're done
183c911477eSguenther */
184c911477eSguenther break;
185c911477eSguenther }
186c911477eSguenther }
187c911477eSguenther }
188