1 /* $OpenBSD: rtld_machine.c,v 1.51 2023/01/29 20:30:21 gnezdo Exp $ */
2
3 /*
4 * Copyright (c) 2002 Dale Rahn
5 * Copyright (c) 2001 Niklas Hallqvist
6 * Copyright (c) 2001 Artur Grabowski
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
18 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29 /*-
30 * Copyright (c) 2000 Eduardo Horvath.
31 * Copyright (c) 1999 The NetBSD Foundation, Inc.
32 * All rights reserved.
33 *
34 * This code is derived from software contributed to The NetBSD Foundation
35 * by Paul Kranenburg.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. All advertising materials mentioning features or use of this software
46 * must display the following acknowledgement:
47 * This product includes software developed by the NetBSD
48 * Foundation, Inc. and its contributors.
49 * 4. Neither the name of The NetBSD Foundation nor the names of its
50 * contributors may be used to endorse or promote products derived
51 * from this software without specific prior written permission.
52 *
53 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
54 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
56 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
57 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
58 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
59 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
60 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
61 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
62 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
63 * POSSIBILITY OF SUCH DAMAGE.
64 */
65
66 #define _DYN_LOADER
67
68 #include <sys/types.h>
69 #include <sys/exec_elf.h>
70 #include <sys/syscall.h>
71 #include <sys/unistd.h>
72
73 #include <machine/reloc.h>
74
75 #include "util.h"
76 #include "resolve.h"
77
78 int64_t pcookie __attribute__((section(".openbsd.randomdata"))) __dso_hidden;
79
80 /*
81 * The following table holds for each relocation type:
82 * - the width in bits of the memory location the relocation
83 * applies to (not currently used)
84 * - the number of bits the relocation value must be shifted to the
85 * right (i.e. discard least significant bits) to fit into
86 * the appropriate field in the instruction word.
87 * - flags indicating whether
88 * * the relocation involves a symbol
89 * * the relocation is relative to the current position
90 * * the relocation is for a GOT entry
91 * * the relocation is relative to the load address
92 *
93 */
94 #define _RF_S 0x80000000 /* Resolve symbol */
95 #define _RF_A 0x40000000 /* Use addend */
96 #define _RF_P 0x20000000 /* Location relative */
97 #define _RF_G 0x10000000 /* GOT offset */
98 #define _RF_B 0x08000000 /* Load address relative */
99 #define _RF_E 0x02000000 /* ERROR */
100 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */
101 #define _RF_RS(s) ((s) & 0xff) /* right shift */
102 static const int reloc_target_flags[] = {
103 0, /* NONE */
104 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 32 */
105 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PC32 */
106 _RF_G| _RF_SZ(32) | _RF_RS(00), /* GOT32 */
107 _RF_A| _RF_SZ(32) | _RF_RS(0), /* PLT32 */
108 _RF_S| _RF_SZ(32) | _RF_RS(0), /* COPY */
109 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* GLOB_DAT */
110 _RF_S| _RF_SZ(32) | _RF_RS(0), /* JUMP_SLOT */
111 _RF_A| _RF_B| _RF_SZ(32) | _RF_RS(0), /* RELATIVE */
112 _RF_E, /* GOTOFF */
113 _RF_E, /* GOTPC */
114 _RF_E, /* 32PLT */
115 _RF_E, /* DUMMY 12 */
116 _RF_E, /* DUMMY 13 */
117 _RF_E, /* TLS_TPOFF */
118 _RF_E, /* TLS_IE */
119 _RF_E, /* TLS_GITIE */
120 _RF_E, /* TLS_LE */
121 _RF_E, /* TLS_GD */
122 _RF_E, /* TLS_LDM */
123 _RF_S|_RF_A| _RF_SZ(16) | _RF_RS(0), /* 16 */
124 _RF_S|_RF_A|_RF_P| _RF_SZ(16) | _RF_RS(0), /* PC16 */
125 _RF_S|_RF_A| _RF_SZ(8) | _RF_RS(0), /* 8 */
126 _RF_S|_RF_A|_RF_P| _RF_SZ(8) | _RF_RS(0), /* PC8 */
127 };
128
129 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0)
130 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0)
131 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0)
132 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0)
133 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff)
134 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff)
135 #define RELOC_ERROR(t) \
136 ((t) >= nitems(reloc_target_flags) || (reloc_target_flags[t] & _RF_E))
137
138 static const long reloc_target_bitmask[] = {
139 #define _BM(x) (~(-(1ULL << (x))))
140 0, /* NONE */
141 _BM(32), /* RELOC_32*/
142 _BM(32), /* PC32 */
143 _BM(32), /* GOT32 */
144 _BM(32), /* PLT32 */
145 0, /* COPY */
146 _BM(32), /* GLOB_DAT */
147 _BM(32), /* JUMP_SLOT */
148 _BM(32), /* RELATIVE */
149 0, /* GOTOFF XXX */
150 0, /* GOTPC XXX */
151 0, /* DUMMY 11 */
152 0, /* DUMMY 12 */
153 0, /* DUMMY 13 */
154 0, /* DUMMY 14 */
155 0, /* DUMMY 15 */
156 0, /* DUMMY 16 */
157 0, /* DUMMY 17 */
158 0, /* DUMMY 18 */
159 0, /* DUMMY 19 */
160 _BM(16), /* RELOC_16 */
161 _BM(8), /* PC_16 */
162 _BM(8), /* RELOC_8 */
163 _BM(8), /* RELOC_PC8 */
164 #undef _BM
165 };
166 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t])
167
168 void _dl_reloc_plt(Elf_Addr *where, Elf_Addr value);
169
170 int
_dl_md_reloc(elf_object_t * object,int rel,int relsz)171 _dl_md_reloc(elf_object_t *object, int rel, int relsz)
172 {
173 long i;
174 long numrel;
175 long relrel;
176 int fails = 0;
177 Elf_Addr loff;
178 Elf_Addr prev_value = 0;
179 const Elf_Sym *prev_sym = NULL;
180 Elf_Rel *rels;
181
182 loff = object->obj_base;
183 numrel = object->Dyn.info[relsz] / sizeof(Elf_Rel);
184 relrel = rel == DT_REL ? object->relcount : 0;
185 rels = (Elf_Rel *)(object->Dyn.info[rel]);
186 if (rels == NULL)
187 return 0;
188
189 if (relrel > numrel)
190 _dl_die("relcount > numrel: %ld > %ld", relrel, numrel);
191
192 /* tight loop for leading RELATIVE relocs */
193 for (i = 0; i < relrel; i++, rels++) {
194 Elf_Addr *where;
195
196 where = (Elf_Addr *)(rels->r_offset + loff);
197 *where += loff;
198 }
199 for (; i < numrel; i++, rels++) {
200 Elf_Addr *where, value, mask;
201 Elf_Word type;
202 const Elf_Sym *sym;
203 const char *symn;
204
205 type = ELF_R_TYPE(rels->r_info);
206
207 if (RELOC_ERROR(type))
208 _dl_die("relocation error %d idx %ld", type, i);
209
210 if (type == R_TYPE(NONE))
211 continue;
212
213 if (type == R_TYPE(JUMP_SLOT) && rel != DT_JMPREL)
214 continue;
215
216 where = (Elf_Addr *)(rels->r_offset + loff);
217
218 if (RELOC_USE_ADDEND(type))
219 value = *where & RELOC_VALUE_BITMASK(type);
220 else
221 value = 0;
222
223 sym = NULL;
224 symn = NULL;
225 if (RELOC_RESOLVE_SYMBOL(type)) {
226 sym = object->dyn.symtab;
227 sym += ELF_R_SYM(rels->r_info);
228 symn = object->dyn.strtab + sym->st_name;
229
230 if (sym->st_shndx != SHN_UNDEF &&
231 ELF_ST_BIND(sym->st_info) == STB_LOCAL) {
232 value += loff;
233 } else if (sym == prev_sym) {
234 value += prev_value;
235 } else {
236 struct sym_res sr;
237
238 sr = _dl_find_symbol(symn,
239 SYM_SEARCH_ALL|SYM_WARNNOTFOUND|
240 ((type == R_TYPE(JUMP_SLOT))?
241 SYM_PLT:SYM_NOTPLT), sym, object);
242 if (sr.sym == NULL) {
243 resolve_failed:
244 if (ELF_ST_BIND(sym->st_info) !=
245 STB_WEAK)
246 fails++;
247 continue;
248 }
249 prev_sym = sym;
250 prev_value = (Elf_Addr)(sr.obj->obj_base +
251 sr.sym->st_value);
252 value += prev_value;
253 }
254 }
255
256 if (type == R_TYPE(JUMP_SLOT)) {
257 _dl_reloc_plt((Elf_Word *)where, value);
258 continue;
259 }
260
261 if (type == R_TYPE(COPY)) {
262 void *dstaddr = where;
263 const void *srcaddr;
264 const Elf_Sym *dstsym = sym;
265 struct sym_res sr;
266
267 sr = _dl_find_symbol(symn,
268 SYM_SEARCH_OTHER|SYM_WARNNOTFOUND|SYM_NOTPLT,
269 dstsym, object);
270 if (sr.sym == NULL)
271 goto resolve_failed;
272
273 srcaddr = (void *)(sr.obj->obj_base + sr.sym->st_value);
274 _dl_bcopy(srcaddr, dstaddr, dstsym->st_size);
275 continue;
276 }
277
278 if (RELOC_PC_RELATIVE(type))
279 value -= (Elf_Addr)where;
280 if (RELOC_BASE_RELATIVE(type))
281 value += loff;
282
283 mask = RELOC_VALUE_BITMASK(type);
284 value >>= RELOC_VALUE_RIGHTSHIFT(type);
285 value &= mask;
286
287 *where &= ~mask;
288 *where |= value;
289 }
290
291 return fails;
292 }
293
294 #if 0
295 struct jmpslot {
296 u_short opcode;
297 u_short addr[2];
298 u_short reloc_index;
299 #define JMPSLOT_RELOC_MASK 0xffff
300 };
301 #define JUMP 0xe990 /* NOP + JMP opcode */
302 #endif
303
304 void
_dl_reloc_plt(Elf_Addr * where,Elf_Addr value)305 _dl_reloc_plt(Elf_Addr *where, Elf_Addr value)
306 {
307 *where = value;
308 }
309
310 /*
311 * Resolve a symbol at run-time.
312 */
313 Elf_Addr
_dl_bind(elf_object_t * object,int index)314 _dl_bind(elf_object_t *object, int index)
315 {
316 Elf_Rel *rel;
317 const Elf_Sym *sym;
318 const char *symn;
319 struct sym_res sr;
320 uint64_t cookie = pcookie;
321 struct {
322 struct __kbind param;
323 Elf_Addr newval;
324 } buf;
325
326 rel = (Elf_Rel *)(object->Dyn.info[DT_JMPREL]);
327
328 rel += index/sizeof(Elf_Rel);
329
330 sym = object->dyn.symtab;
331 sym += ELF_R_SYM(rel->r_info);
332 symn = object->dyn.strtab + sym->st_name;
333
334 sr = _dl_find_symbol(symn, SYM_SEARCH_ALL|SYM_WARNNOTFOUND|SYM_PLT,
335 sym, object);
336 if (sr.sym == NULL)
337 _dl_die("lazy binding failed!");
338
339 buf.newval = sr.obj->obj_base + sr.sym->st_value;
340
341 if (__predict_false(sr.obj->traced) && _dl_trace_plt(sr.obj, symn))
342 return buf.newval;
343
344 buf.param.kb_addr = (Elf_Word *)(object->obj_base + rel->r_offset);
345 buf.param.kb_size = sizeof(Elf_Addr);
346
347 /* directly code the syscall, so that it's actually inline here */
348 {
349 register long syscall_num __asm("eax") = SYS_kbind;
350
351 __asm volatile("lea %3, %%edx; pushl 4(%%edx);"
352 " pushl (%%edx); pushl %2; pushl %1;"
353 " push %%eax; int $0x80; addl $20, %%esp" :
354 "+a" (syscall_num) : "r" (&buf), "i" (sizeof(buf)),
355 "m" (cookie) : "edx", "cc", "memory");
356 }
357
358 return buf.newval;
359 }
360
361 int
_dl_md_reloc_got(elf_object_t * object,int lazy)362 _dl_md_reloc_got(elf_object_t *object, int lazy)
363 {
364 extern void _dl_bind_start(void); /* XXX */
365 int fails = 0;
366 Elf_Addr *pltgot = (Elf_Addr *)object->Dyn.info[DT_PLTGOT];
367 int i, num;
368 Elf_Rel *rel;
369
370 if (pltgot == NULL)
371 return 0; /* it is possible to have no PLT/GOT relocations */
372
373 if (object->Dyn.info[DT_PLTREL] != DT_REL)
374 return 0;
375
376 if (!lazy) {
377 fails = _dl_md_reloc(object, DT_JMPREL, DT_PLTRELSZ);
378 } else {
379 pltgot[1] = (Elf_Addr)object;
380 pltgot[2] = (Elf_Addr)&_dl_bind_start;
381
382 rel = (Elf_Rel *)(object->Dyn.info[DT_JMPREL]);
383 num = (object->Dyn.info[DT_PLTRELSZ]);
384 for (i = 0; i < num/sizeof(Elf_Rel); i++, rel++) {
385 Elf_Addr *where;
386 where = (Elf_Addr *)(rel->r_offset + object->obj_base);
387 *where += object->obj_base;
388 }
389 }
390
391 return fails;
392 }
393