1*280aa8f0Sderaadt /* $OpenBSD: boot_md.h,v 1.5 2023/11/18 18:02:47 deraadt Exp $ */
2c911477eSguenther
3c911477eSguenther /*
4c911477eSguenther * Copyright (c) 1998 Per Fogelstrom, Opsycon AB
5c911477eSguenther *
6c911477eSguenther * Redistribution and use in source and binary forms, with or without
7c911477eSguenther * modification, are permitted provided that the following conditions
8c911477eSguenther * are met:
9c911477eSguenther * 1. Redistributions of source code must retain the above copyright
10c911477eSguenther * notice, this list of conditions and the following disclaimer.
11c911477eSguenther * 2. Redistributions in binary form must reproduce the above copyright
12c911477eSguenther * notice, this list of conditions and the following disclaimer in the
13c911477eSguenther * documentation and/or other materials provided with the distribution.
14c911477eSguenther *
15c911477eSguenther * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
16c911477eSguenther * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
17c911477eSguenther * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18c911477eSguenther * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
19c911477eSguenther * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20c911477eSguenther * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21c911477eSguenther * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22c911477eSguenther * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23c911477eSguenther * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24c911477eSguenther * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25c911477eSguenther * SUCH DAMAGE.
26c911477eSguenther *
27c911477eSguenther */
28c911477eSguenther
29c911477eSguenther /*
30c911477eSguenther * IMPORTANT: any functions below are NOT protected by SSP. Please
31c911477eSguenther * do not add anything except what is required to reach GOT with
32c911477eSguenther * an adjustment.
33c911477eSguenther */
34c911477eSguenther
35c911477eSguenther #define _DYN_LOADER
36c911477eSguenther
37c911477eSguenther #include <sys/exec_elf.h>
385018f4d3Sguenther #include <sys/mman.h>
395018f4d3Sguenther
405018f4d3Sguenther #include <machine/reloc.h>
415018f4d3Sguenther
425018f4d3Sguenther __dead
43*280aa8f0Sderaadt void _csu_abort(void);
44c911477eSguenther
45c911477eSguenther #include "archdep.h"
46c911477eSguenther
47c911477eSguenther /*
48c911477eSguenther * Use the internal, hidden name for any syscalls we need, to avoid
49c911477eSguenther * accidental override by application code
50c911477eSguenther */
51c911477eSguenther #define REDIRECT_SYSCALL(x) typeof(x) x asm("_libc_"#x) __dso_hidden
52c911477eSguenther REDIRECT_SYSCALL(mprotect);
53df24df89Sderaadt REDIRECT_SYSCALL(mimmutable);
54c911477eSguenther
55c911477eSguenther #define DT_PROC(n) ((n) - DT_LOPROC)
56c911477eSguenther
57c911477eSguenther #if RELOC_TAG == DT_RELA
58c911477eSguenther typedef Elf_RelA RELOC_TYPE;
59c911477eSguenther #elif RELOC_TAG == DT_REL
60c911477eSguenther typedef Elf_Rel RELOC_TYPE;
61c911477eSguenther #else
62c911477eSguenther # error "unknown RELOC_TAG"
63c911477eSguenther #endif
64c911477eSguenther
65c911477eSguenther /* The set of dynamic tags that we're interested in for bootstrapping */
66c911477eSguenther struct boot_dyn {
67c911477eSguenther RELOC_TYPE *dt_reloc; /* DT_RELA or DT_REL */
68c911477eSguenther Elf_Addr dt_relocsz; /* DT_RELASZ or DT_RELSZ */
69c911477eSguenther Elf_Addr *dt_pltgot;
70c911477eSguenther const Elf_Sym *dt_symtab;
71c911477eSguenther u_long dt_proc[DT_PROCNUM];
72c911477eSguenther };
73c911477eSguenther
74c911477eSguenther static void *relro_addr;
75c911477eSguenther static size_t relro_size;
76c911477eSguenther #define RCRT0_RELRO() \
77c911477eSguenther do { \
78c911477eSguenther if (relro_addr != NULL && relro_size != 0) \
79c911477eSguenther mprotect(relro_addr, relro_size, PROT_READ); \
80df24df89Sderaadt mimmutable(relro_addr, relro_size); \
81c911477eSguenther } while (0)
82c911477eSguenther
83c911477eSguenther /*
84c911477eSguenther * Local decls.
85c911477eSguenther */
86c911477eSguenther void _dl_boot_bind(const long, long *, Elf_Dyn *);
87c911477eSguenther
88c911477eSguenther void
_dl_boot_bind(const long sp,long * dl_data,Elf_Dyn * dynp)89c911477eSguenther _dl_boot_bind(const long sp, long *dl_data, Elf_Dyn *dynp)
90c911477eSguenther {
91c911477eSguenther struct boot_dyn dynld; /* Resolver data for the loader */
92c911477eSguenther AuxInfo *auxstack;
93c911477eSguenther long *stack;
94c911477eSguenther int n, argc;
95c911477eSguenther char **argv, **envp;
96c911477eSguenther long loff;
97c911477eSguenther RELOC_TYPE *rp;
98c911477eSguenther Elf_Phdr *phdp;
99c911477eSguenther Elf_Addr i;
100c911477eSguenther
101c911477eSguenther /*
102c911477eSguenther * Scan argument and environment vectors. Find dynamic
103c911477eSguenther * data vector put after them.
104c911477eSguenther */
105c911477eSguenther stack = (long *)sp;
106c911477eSguenther argc = *stack++;
107c911477eSguenther argv = (char **)stack;
108c911477eSguenther envp = &argv[argc + 1];
109c911477eSguenther stack = (long *)envp;
110c911477eSguenther while (*stack++ != 0L)
111c911477eSguenther ;
112c911477eSguenther
113c911477eSguenther /*
114c911477eSguenther * Zero out dl_data.
115c911477eSguenther */
116c911477eSguenther for (n = 0; n <= AUX_entry; n++)
117c911477eSguenther dl_data[n] = 0;
118c911477eSguenther
119c911477eSguenther /*
120c911477eSguenther * Dig out auxiliary data set up by exec call. Move all known
121c911477eSguenther * tags to an indexed local table for easy access.
122c911477eSguenther */
123c911477eSguenther for (auxstack = (AuxInfo *)stack; auxstack->au_id != AUX_null;
124c911477eSguenther auxstack++) {
125c911477eSguenther if (auxstack->au_id > AUX_entry)
126c911477eSguenther continue;
127c911477eSguenther dl_data[auxstack->au_id] = auxstack->au_v;
128c911477eSguenther }
129c911477eSguenther loff = dl_data[AUX_base]; /* XXX assumes ld.so is linked at 0x0 */
130c911477eSguenther
131c911477eSguenther /*
132c911477eSguenther * We need to do 'selfreloc' in case the code weren't
133c911477eSguenther * loaded at the address it was linked to.
134c911477eSguenther *
135c911477eSguenther * Scan the DYNAMIC section for the loader.
136c911477eSguenther * Cache the data for easier access.
137c911477eSguenther */
138c911477eSguenther _dl_memset(&dynld, 0, sizeof(dynld));
139c911477eSguenther while (dynp->d_tag != DT_NULL) {
140c911477eSguenther /* first the tags that are pointers to be relocated */
141c911477eSguenther if (dynp->d_tag == DT_PLTGOT)
142c911477eSguenther dynld.dt_pltgot = (void *)(dynp->d_un.d_ptr + loff);
143c911477eSguenther else if (dynp->d_tag == DT_SYMTAB)
144c911477eSguenther dynld.dt_symtab = (void *)(dynp->d_un.d_ptr + loff);
145c911477eSguenther else if (dynp->d_tag == RELOC_TAG) /* DT_{RELA,REL} */
146c911477eSguenther dynld.dt_reloc = (void *)(dynp->d_un.d_ptr + loff);
147c911477eSguenther
148c911477eSguenther /* Now for the tags that are just sizes or counts */
149c911477eSguenther else if (dynp->d_tag == RELOC_TAG+1) /* DT_{RELA,REL}SZ */
150c911477eSguenther dynld.dt_relocsz = dynp->d_un.d_val;
151c911477eSguenther else if (dynp->d_tag >= DT_LOPROC &&
152c911477eSguenther dynp->d_tag < DT_LOPROC + DT_PROCNUM)
153c911477eSguenther dynld.dt_proc[dynp->d_tag - DT_LOPROC] =
154c911477eSguenther dynp->d_un.d_val;
155c911477eSguenther dynp++;
156c911477eSguenther }
157c911477eSguenther
158c911477eSguenther rp = dynld.dt_reloc;
159c911477eSguenther for (i = 0; i < dynld.dt_relocsz; i += sizeof *rp) {
160c911477eSguenther Elf_Addr *ra;
161c911477eSguenther const Elf_Sym *sp;
162c911477eSguenther
163c911477eSguenther sp = dynld.dt_symtab + ELF_R_SYM(rp->r_info);
164c911477eSguenther if (!ELF_R_SYM(rp->r_info) || sp->st_value != 0) {
165c911477eSguenther ra = (Elf_Addr *)(rp->r_offset + loff);
166c911477eSguenther RELOC_DYN(rp, sp, ra, loff);
167c911477eSguenther }
168c911477eSguenther rp++;
169c911477eSguenther }
170c911477eSguenther
171c911477eSguenther RELOC_GOT(&dynld, loff);
172c911477eSguenther
173c911477eSguenther /* apply GNU_RELRO */
174c911477eSguenther phdp = (Elf_Phdr *)dl_data[AUX_phdr];
175c911477eSguenther for (i = 0; i < dl_data[AUX_phnum]; i++, phdp++) {
176c911477eSguenther switch (phdp->p_type) {
177c911477eSguenther case PT_GNU_RELRO:
178c911477eSguenther relro_addr = (void *)(phdp->p_vaddr + loff);
179c911477eSguenther relro_size = phdp->p_memsz;
180c911477eSguenther /*
181c911477eSguenther * GNU_RELRO (a) covers the GOT, and (b) comes after
182c911477eSguenther * all LOAD sections, so if we found it then we're done
183c911477eSguenther */
184c911477eSguenther break;
185c911477eSguenther }
186c911477eSguenther }
187c911477eSguenther }
188