1 /* $OpenBSD: rtld_machine.c,v 1.22 2014/05/25 21:27:07 brad Exp $ */ 2 3 /* 4 * Copyright (c) 2002,2004 Dale Rahn 5 * Copyright (c) 2001 Niklas Hallqvist 6 * Copyright (c) 2001 Artur Grabowski 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS 18 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 19 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 /*- 30 * Copyright (c) 2000 Eduardo Horvath. 31 * Copyright (c) 1999 The NetBSD Foundation, Inc. 32 * All rights reserved. 33 * 34 * This code is derived from software contributed to The NetBSD Foundation 35 * by Paul Kranenburg. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 3. All advertising materials mentioning features or use of this software 46 * must display the following acknowledgement: 47 * This product includes software developed by the NetBSD 48 * Foundation, Inc. and its contributors. 49 * 4. Neither the name of The NetBSD Foundation nor the names of its 50 * contributors may be used to endorse or promote products derived 51 * from this software without specific prior written permission. 52 * 53 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 54 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 56 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 57 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 58 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 59 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 60 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 61 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 62 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 63 * POSSIBILITY OF SUCH DAMAGE. 64 */ 65 66 #define _DYN_LOADER 67 68 #include <sys/types.h> 69 #include <sys/mman.h> 70 71 #include <nlist.h> 72 #include <link.h> 73 #include <signal.h> 74 75 #include "syscall.h" 76 #include "archdep.h" 77 #include "resolve.h" 78 79 /* 80 * The following table holds for each relocation type: 81 * - the width in bits of the memory location the relocation 82 * applies to (not currently used) 83 * - the number of bits the relocation value must be shifted to the 84 * right (i.e. discard least significant bits) to fit into 85 * the appropriate field in the instruction word. 86 * - flags indicating whether 87 * * the relocation involves a symbol 88 * * the relocation is relative to the current position 89 * * the relocation is for a GOT entry 90 * * the relocation is relative to the load address 91 * 92 */ 93 #define _RF_S 0x80000000 /* Resolve symbol */ 94 #define _RF_A 0x40000000 /* Use addend */ 95 #define _RF_P 0x20000000 /* Location relative */ 96 #define _RF_G 0x10000000 /* GOT offset */ 97 #define _RF_B 0x08000000 /* Load address relative */ 98 #define _RF_U 0x04000000 /* Unaligned */ 99 #define _RF_E 0x02000000 /* ERROR */ 100 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 101 #define _RF_RS(s) ((s) & 0xff) /* right shift */ 102 static int reloc_target_flags[] = { 103 0, /* 0 NONE */ 104 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* 1 _64*/ 105 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* 2 PC32 */ 106 _RF_G|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 3 GOT32 */ 107 _RF_E|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 4 PLT32 */ 108 _RF_S| _RF_SZ(32) | _RF_RS(0), /* 5 COPY */ 109 _RF_S| _RF_SZ(64) | _RF_RS(0), /* 6 GLOB_DAT*/ 110 _RF_S| _RF_SZ(64) | _RF_RS(0), /* 7 JUMP_SLOT*/ 111 _RF_A| _RF_B| _RF_SZ(64) | _RF_RS(0), /* 8 RELATIVE*/ 112 _RF_E, /* 9 GOTPCREL*/ 113 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 10 32 */ 114 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 11 32S */ 115 _RF_S|_RF_A| _RF_SZ(16) | _RF_RS(0), /* 12 16 */ 116 _RF_S|_RF_A|_RF_P| _RF_SZ(16) | _RF_RS(0), /* 13 PC16 */ 117 _RF_S|_RF_A| _RF_SZ(8) | _RF_RS(0), /* 14 8 */ 118 _RF_S|_RF_A|_RF_P| _RF_SZ(8) | _RF_RS(0), /* 15 PC8 */ 119 _RF_E, /* 16 DTPMOD64*/ 120 _RF_E, /* 17 DTPOFF64*/ 121 _RF_E, /* 18 TPOFF64 */ 122 _RF_E, /* 19 TLSGD */ 123 _RF_E, /* 20 TLSLD */ 124 _RF_E, /* 21 DTPOFF32*/ 125 _RF_E, /* 22 GOTTPOFF*/ 126 _RF_E /* 23 TPOFF32*/ 127 }; 128 129 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 130 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 131 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 132 #define RELOC_UNALIGNED(t) ((reloc_target_flags[t] & _RF_U) != 0) 133 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 134 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 135 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 136 #define RELOC_ERROR(t) (reloc_target_flags[t] & _RF_E) 137 138 static Elf_Addr reloc_target_bitmask[] = { 139 #define _BM(x) (~(Elf_Addr)0 >> ((8*sizeof(reloc_target_bitmask[0])) - (x))) 140 0, /* 0 NONE */ 141 _BM(64), /* 1 _64*/ 142 _BM(32), /* 2 PC32 */ 143 _BM(32), /* 3 GOT32 */ 144 _BM(32), /* 4 PLT32 */ 145 0, /* 5 COPY */ 146 _BM(64), /* 6 GLOB_DAT*/ 147 _BM(64), /* 7 JUMP_SLOT*/ 148 _BM(64), /* 8 RELATIVE*/ 149 _BM(32), /* 9 GOTPCREL*/ 150 _BM(32), /* 10 32 */ 151 _BM(32), /* 11 32S */ 152 _BM(16), /* 12 16 */ 153 _BM(16), /* 13 PC16 */ 154 _BM(8), /* 14 8 */ 155 _BM(8), /* 15 PC8 */ 156 0, /* 16 DTPMOD64*/ 157 0, /* 17 DTPOFF64*/ 158 0, /* 18 TPOFF64 */ 159 0, /* 19 TLSGD */ 160 0, /* 20 TLSLD */ 161 0, /* 21 DTPOFF32*/ 162 0, /* 22 GOTTPOFF*/ 163 0 /* 23 TPOFF32*/ 164 #undef _BM 165 }; 166 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 167 168 void _dl_reloc_plt(Elf_Addr *where, Elf_Addr value); 169 170 int 171 _dl_md_reloc(elf_object_t *object, int rel, int relsz) 172 { 173 long i; 174 long numrel; 175 long relrel; 176 int fails = 0; 177 Elf_Addr loff; 178 Elf_Addr prev_value = 0; 179 const Elf_Sym *prev_sym = NULL; 180 Elf_RelA *rels; 181 struct load_list *llist; 182 183 loff = object->obj_base; 184 numrel = object->Dyn.info[relsz] / sizeof(Elf_RelA); 185 relrel = rel == DT_RELA ? object->relacount : 0; 186 rels = (Elf_RelA *)(object->Dyn.info[rel]); 187 if (rels == NULL) 188 return(0); 189 190 if (relrel > numrel) { 191 _dl_printf("relacount > numrel: %ld > %ld\n", relrel, numrel); 192 _dl_exit(20); 193 } 194 195 /* 196 * unprotect some segments if we need it. 197 */ 198 if ((object->dyn.textrel == 1) && (rel == DT_REL || rel == DT_RELA)) { 199 for (llist = object->load_list; llist != NULL; llist = llist->next) { 200 if (!(llist->prot & PROT_WRITE)) 201 _dl_mprotect(llist->start, llist->size, 202 llist->prot|PROT_WRITE); 203 } 204 } 205 206 /* tight loop for leading RELATIVE relocs */ 207 for (i = 0; i < relrel; i++, rels++) { 208 Elf_Addr *where; 209 210 #ifdef DEBUG 211 if (ELF_R_TYPE(rels->r_info) != R_TYPE(RELATIVE)) { 212 _dl_printf("RELACOUNT wrong\n"); 213 _dl_exit(20); 214 } 215 #endif 216 where = (Elf_Addr *)(rels->r_offset + loff); 217 *where = rels->r_addend + loff; 218 } 219 for (; i < numrel; i++, rels++) { 220 Elf_Addr *where, value, ooff, mask; 221 Elf_Word type; 222 const Elf_Sym *sym, *this; 223 const char *symn; 224 225 type = ELF_R_TYPE(rels->r_info); 226 227 if (RELOC_ERROR(type)) { 228 _dl_printf("relocation error %d idx %d\n", type, i); 229 _dl_exit(20); 230 } 231 232 if (type == R_TYPE(NONE)) 233 continue; 234 235 if (type == R_TYPE(JUMP_SLOT) && rel != DT_JMPREL) 236 continue; 237 238 where = (Elf_Addr *)(rels->r_offset + loff); 239 240 if (RELOC_USE_ADDEND(type)) 241 value = rels->r_addend; 242 else 243 value = 0; 244 245 sym = NULL; 246 symn = NULL; 247 if (RELOC_RESOLVE_SYMBOL(type)) { 248 sym = object->dyn.symtab; 249 sym += ELF_R_SYM(rels->r_info); 250 symn = object->dyn.strtab + sym->st_name; 251 252 if (sym->st_shndx != SHN_UNDEF && 253 ELF_ST_BIND(sym->st_info) == STB_LOCAL) { 254 value += loff; 255 } else if (sym == prev_sym) { 256 value += prev_value; 257 } else { 258 this = NULL; 259 ooff = _dl_find_symbol_bysym(object, 260 ELF_R_SYM(rels->r_info), &this, 261 SYM_SEARCH_ALL|SYM_WARNNOTFOUND| 262 ((type == R_TYPE(JUMP_SLOT))? 263 SYM_PLT:SYM_NOTPLT), 264 sym, NULL); 265 if (this == NULL) { 266 resolve_failed: 267 if (ELF_ST_BIND(sym->st_info) != 268 STB_WEAK) 269 fails++; 270 continue; 271 } 272 prev_sym = sym; 273 prev_value = (Elf_Addr)(ooff + this->st_value); 274 value += prev_value; 275 } 276 } 277 278 if (type == R_TYPE(JUMP_SLOT)) { 279 _dl_reloc_plt(where, value); 280 continue; 281 } 282 283 if (type == R_TYPE(COPY)) { 284 void *dstaddr = where; 285 const void *srcaddr; 286 const Elf_Sym *dstsym = sym, *srcsym = NULL; 287 Elf_Addr soff; 288 289 soff = _dl_find_symbol(symn, &srcsym, 290 SYM_SEARCH_OTHER|SYM_WARNNOTFOUND| 291 ((type == R_TYPE(JUMP_SLOT)) ? SYM_PLT:SYM_NOTPLT), 292 dstsym, object, NULL); 293 if (srcsym == NULL) 294 goto resolve_failed; 295 296 srcaddr = (void *)(soff + srcsym->st_value); 297 _dl_bcopy(srcaddr, dstaddr, dstsym->st_size); 298 continue; 299 } 300 301 if (RELOC_PC_RELATIVE(type)) 302 value -= (Elf_Addr)where; 303 if (RELOC_BASE_RELATIVE(type)) 304 value += loff; 305 306 mask = RELOC_VALUE_BITMASK(type); 307 value >>= RELOC_VALUE_RIGHTSHIFT(type); 308 value &= mask; 309 310 if (RELOC_UNALIGNED(type)) { 311 /* Handle unaligned relocations. */ 312 Elf_Addr tmp = 0; 313 char *ptr = (char *)where; 314 int i, size = RELOC_TARGET_SIZE(type)/8; 315 316 /* Read it in one byte at a time. */ 317 for (i=0; i<size; i++) 318 tmp = (tmp << 8) | ptr[i]; 319 320 tmp &= ~mask; 321 tmp |= value; 322 323 /* Write it back out. */ 324 for (i=0; i<size; i++) 325 ptr[i] = ((tmp >> (8*i)) & 0xff); 326 } else if (RELOC_TARGET_SIZE(type) > 32) { 327 *where &= ~mask; 328 *where |= value; 329 } else { 330 Elf32_Addr *where32 = (Elf32_Addr *)where; 331 332 *where32 &= ~mask; 333 *where32 |= value; 334 } 335 } 336 337 /* reprotect the unprotected segments */ 338 if ((object->dyn.textrel == 1) && (rel == DT_REL || rel == DT_RELA)) { 339 for (llist = object->load_list; llist != NULL; llist = llist->next) { 340 if (!(llist->prot & PROT_WRITE)) 341 _dl_mprotect(llist->start, llist->size, 342 llist->prot); 343 } 344 } 345 346 return (fails); 347 } 348 349 void 350 _dl_reloc_plt(Elf_Addr *where, Elf_Addr value) 351 { 352 *where = value; 353 } 354 355 /* 356 * Resolve a symbol at run-time. 357 */ 358 Elf_Addr 359 _dl_bind(elf_object_t *object, int index) 360 { 361 Elf_RelA *rel; 362 Elf_Word *addr; 363 const Elf_Sym *sym, *this; 364 const char *symn; 365 const elf_object_t *sobj; 366 Elf_Addr ooff, newval; 367 sigset_t savedmask; 368 369 rel = (Elf_RelA *)(object->Dyn.info[DT_JMPREL]); 370 371 rel += index; 372 373 sym = object->dyn.symtab; 374 sym += ELF_R_SYM(rel->r_info); 375 symn = object->dyn.strtab + sym->st_name; 376 377 addr = (Elf_Word *)(object->obj_base + rel->r_offset); 378 this = NULL; 379 ooff = _dl_find_symbol(symn, &this, 380 SYM_SEARCH_ALL|SYM_WARNNOTFOUND|SYM_PLT, sym, object, &sobj); 381 if (this == NULL) { 382 _dl_printf("lazy binding failed!\n"); 383 *(volatile int *)0 = 0; /* XXX */ 384 } 385 386 newval = ooff + this->st_value + rel->r_addend; 387 388 if (sobj->traced && _dl_trace_plt(sobj, symn)) 389 return newval; 390 391 /* if GOT is protected, allow the write */ 392 if (object->got_size != 0) { 393 _dl_thread_bind_lock(0, &savedmask); 394 _dl_mprotect((void*)object->got_start, object->got_size, 395 PROT_READ|PROT_WRITE); 396 } 397 398 _dl_reloc_plt((Elf_Addr *)addr, newval); 399 400 /* put the GOT back to RO */ 401 if (object->got_size != 0) { 402 _dl_mprotect((void*)object->got_start, object->got_size, 403 PROT_READ); 404 _dl_thread_bind_lock(1, &savedmask); 405 } 406 407 return(newval); 408 } 409 410 int 411 _dl_md_reloc_got(elf_object_t *object, int lazy) 412 { 413 extern void _dl_bind_start(void); /* XXX */ 414 int fails = 0; 415 Elf_Addr *pltgot = (Elf_Addr *)object->Dyn.info[DT_PLTGOT]; 416 int i, num; 417 Elf_RelA *rel; 418 Elf_Addr ooff; 419 const Elf_Sym *this; 420 421 if (pltgot == NULL) 422 return (0); /* it is possible to have no PLT/GOT relocations */ 423 424 pltgot[1] = (Elf_Addr)object; 425 pltgot[2] = (Elf_Addr)&_dl_bind_start; 426 427 if (object->Dyn.info[DT_PLTREL] != DT_RELA) 428 return (0); 429 430 object->got_addr = 0; 431 object->got_size = 0; 432 this = NULL; 433 ooff = _dl_find_symbol("__got_start", &this, 434 SYM_SEARCH_OBJ|SYM_NOWARNNOTFOUND|SYM_PLT, NULL, object, NULL); 435 if (this != NULL) 436 object->got_addr = ooff + this->st_value; 437 438 this = NULL; 439 ooff = _dl_find_symbol("__got_end", &this, 440 SYM_SEARCH_OBJ|SYM_NOWARNNOTFOUND|SYM_PLT, NULL, object, NULL); 441 if (this != NULL) 442 object->got_size = ooff + this->st_value - object->got_addr; 443 444 if (object->got_addr == 0) 445 object->got_start = 0; 446 else { 447 object->got_start = ELF_TRUNC(object->got_addr, _dl_pagesz); 448 object->got_size += object->got_addr - object->got_start; 449 object->got_size = ELF_ROUND(object->got_size, _dl_pagesz); 450 } 451 452 if (object->traced) 453 lazy = 1; 454 455 if (!lazy) { 456 fails = _dl_md_reloc(object, DT_JMPREL, DT_PLTRELSZ); 457 } else { 458 rel = (Elf_RelA *)(object->Dyn.info[DT_JMPREL]); 459 num = (object->Dyn.info[DT_PLTRELSZ]); 460 for (i = 0; i < num/sizeof(Elf_RelA); i++, rel++) { 461 Elf_Addr *where; 462 where = (Elf_Addr *)(rel->r_offset + object->obj_base); 463 *where += object->obj_base; 464 } 465 466 } 467 468 /* PLT is already RO on i386, no point in mprotecting it, just GOT */ 469 if (object->got_size != 0) 470 _dl_mprotect((void*)object->got_start, object->got_size, 471 PROT_READ); 472 473 return (fails); 474 } 475