1 /* $OpenBSD: rtld_machine.c,v 1.42 2022/01/08 06:49:41 guenther Exp $ */
2
3 /*
4 * Copyright (c) 2004 Dale Rahn
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
16 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
17 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
19 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 *
27 */
28
29 #define _DYN_LOADER
30
31 #include <sys/types.h>
32 #include <sys/exec_elf.h>
33 #include <sys/syscall.h>
34 #include <sys/unistd.h>
35
36 #include <machine/reloc.h>
37
38 #include "util.h"
39 #include "resolve.h"
40
41 int64_t pcookie __attribute__((section(".openbsd.randomdata"))) __dso_hidden;
42
43 void _dl_bind_start(void); /* XXX */
44 Elf_Addr _dl_bind(elf_object_t *object, int reloff);
45 #define _RF_S 0x80000000 /* Resolve symbol */
46 #define _RF_A 0x40000000 /* Use addend */
47 #define _RF_P 0x20000000 /* Location relative */
48 #define _RF_G 0x10000000 /* GOT offset */
49 #define _RF_B 0x08000000 /* Load address relative */
50 #define _RF_E 0x02000000 /* ERROR */
51 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */
52 #define _RF_RS(s) ((s) & 0xff) /* right shift */
53 static const int reloc_target_flags[] = {
54 0, /* 0 NONE */
55 _RF_S|_RF_P|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 1 PC24 */
56 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 2 ABS32 */
57 _RF_S|_RF_P|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 3 REL32 */
58 _RF_S|_RF_P|_RF_A| _RF_E, /* 4 REL13 */
59 _RF_S|_RF_A| _RF_E, /* 5 ABS16 */
60 _RF_S|_RF_A| _RF_E, /* 6 ABS12 */
61 _RF_S|_RF_A| _RF_E, /* 7 T_ABS5 */
62 _RF_S|_RF_A| _RF_E, /* 8 ABS8 */
63 _RF_S|_RF_B|_RF_A| _RF_E, /* 9 SBREL32 */
64 _RF_S|_RF_P|_RF_A| _RF_E, /* 10 T_PC22 */
65 _RF_S|_RF_P|_RF_A| _RF_E, /* 11 T_PC8 */
66 _RF_E, /* 12 Reserved */
67 _RF_S|_RF_A| _RF_E, /* 13 SWI24 */
68 _RF_S|_RF_A| _RF_E, /* 14 T_SWI8 */
69 _RF_E, /* 15 OBSL */
70 _RF_E, /* 16 OBSL */
71 _RF_E, /* 17 UNUSED */
72 _RF_E, /* 18 UNUSED */
73 _RF_E, /* 19 UNUSED */
74 _RF_S| _RF_SZ(32) | _RF_RS(0), /* 20 COPY */
75 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 21 GLOB_DAT */
76 _RF_S| _RF_SZ(32) | _RF_RS(0), /* 22 JUMP_SLOT */
77 _RF_A| _RF_B| _RF_SZ(32) | _RF_RS(0), /* 23 RELATIVE */
78 _RF_E, /* 24 GOTOFF */
79 _RF_E, /* 25 GOTPC */
80 _RF_E, /* 26 GOT32 */
81 _RF_E, /* 27 PLT32 */
82 _RF_E, /* 28 UNUSED */
83 _RF_E, /* 29 UNUSED */
84 _RF_E, /* 30 UNUSED */
85 _RF_E, /* 31 UNUSED */
86 _RF_E, /* 32 A_PCR 0 */
87 _RF_E, /* 33 A_PCR 8 */
88 _RF_E, /* 34 A_PCR 16 */
89 _RF_E, /* 35 B_PCR 0 */
90 _RF_E, /* 36 B_PCR 12 */
91 _RF_E, /* 37 B_PCR 20 */
92 _RF_E, /* 38 RELAB32 */
93 _RF_E, /* 39 ROSGREL32 */
94 _RF_E, /* 40 V4BX */
95 _RF_E, /* 41 STKCHK */
96 _RF_E /* 42 TSTKCHK */
97 };
98
99 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0)
100 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0)
101 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0)
102 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0)
103 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff)
104 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff)
105
106 static const long reloc_target_bitmask[] = {
107 #define _BM(x) (~(-(1ULL << (x))))
108 _BM(0), /* 0 NONE */
109 _BM(24), /* 1 PC24 */
110 _BM(32), /* 2 ABS32 */
111 _BM(32), /* 3 REL32 */
112 _BM(0), /* 4 REL13 */
113 _BM(0), /* 5 ABS16 */
114 _BM(0), /* 6 ABS12 */
115 _BM(0), /* 7 T_ABS5 */
116 _BM(0), /* 8 ABS8 */
117 _BM(32), /* 9 SBREL32 */
118 _BM(0), /* 10 T_PC22 */
119 _BM(0), /* 11 T_PC8 */
120 _BM(0), /* 12 Reserved */
121 _BM(0), /* 13 SWI24 */
122 _BM(0), /* 14 T_SWI8 */
123 _BM(0), /* 15 OBSL */
124 _BM(0), /* 16 OBSL */
125 _BM(0), /* 17 UNUSED */
126 _BM(0), /* 18 UNUSED */
127 _BM(0), /* 19 UNUSED */
128 _BM(32), /* 20 COPY */
129 _BM(32), /* 21 GLOB_DAT */
130 _BM(32), /* 22 JUMP_SLOT */
131 _BM(32), /* 23 RELATIVE */
132 _BM(0), /* 24 GOTOFF */
133 _BM(0), /* 25 GOTPC */
134 _BM(0), /* 26 GOT32 */
135 _BM(0), /* 27 PLT32 */
136 _BM(0), /* 28 UNUSED */
137 _BM(0), /* 29 UNUSED */
138 _BM(0), /* 30 UNUSED */
139 _BM(0), /* 31 UNUSED */
140 _BM(0), /* 32 A_PCR 0 */
141 _BM(0), /* 33 A_PCR 8 */
142 _BM(0), /* 34 A_PCR 16 */
143 _BM(0), /* 35 B_PCR 0 */
144 _BM(0), /* 36 B_PCR 12 */
145 _BM(0), /* 37 B_PCR 20 */
146 _BM(0), /* 38 RELAB32 */
147 _BM(0), /* 39 ROSGREL32 */
148 _BM(0), /* 40 V4BX */
149 _BM(0), /* 41 STKCHK */
150 _BM(0) /* 42 TSTKCHK */
151 #undef _BM
152 };
153 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t])
154
155 #define R_TYPE(x) R_ARM_ ## x
156
157 void _dl_reloc_plt(Elf_Word *where, Elf_Addr value, Elf_Rel *rel);
158
159 int
_dl_md_reloc(elf_object_t * object,int rel,int relsz)160 _dl_md_reloc(elf_object_t *object, int rel, int relsz)
161 {
162 long i;
163 long numrel;
164 long relrel;
165 int fails = 0;
166 Elf_Addr loff;
167 Elf_Addr prev_value = 0;
168 const Elf_Sym *prev_sym = NULL;
169 Elf_Rel *rels;
170
171 loff = object->obj_base;
172 numrel = object->Dyn.info[relsz] / sizeof(Elf_Rel);
173 relrel = rel == DT_REL ? object->relcount : 0;
174 rels = (Elf_Rel *)(object->Dyn.info[rel]);
175
176 if (rels == NULL)
177 return 0;
178
179 if (relrel > numrel)
180 _dl_die("relcount > numrel: %ld > %ld", relrel, numrel);
181
182 /* tight loop for leading RELATIVE relocs */
183 for (i = 0; i < relrel; i++, rels++) {
184 Elf_Addr *where;
185
186 where = (Elf_Addr *)(rels->r_offset + loff);
187 *where += loff;
188 }
189 for (; i < numrel; i++, rels++) {
190 Elf_Addr *where, value, mask;
191 Elf_Word type;
192 const Elf_Sym *sym;
193 const char *symn;
194
195 type = ELF_R_TYPE(rels->r_info);
196
197 if (reloc_target_flags[type] & _RF_E)
198 _dl_die("bad relocation %ld %d", i, type);
199 if (type == R_TYPE(NONE))
200 continue;
201
202 if (type == R_TYPE(JUMP_SLOT) && rel != DT_JMPREL)
203 continue;
204
205 where = (Elf_Addr *)(rels->r_offset + loff);
206
207 if (RELOC_USE_ADDEND(type))
208 #ifdef LDSO_ARCH_IS_RELA_
209 value = rels->r_addend;
210 #else
211 value = *where & RELOC_VALUE_BITMASK(type);
212 #endif
213 else
214 value = 0;
215
216 sym = NULL;
217 symn = NULL;
218 if (RELOC_RESOLVE_SYMBOL(type)) {
219 sym = object->dyn.symtab;
220 sym += ELF_R_SYM(rels->r_info);
221 symn = object->dyn.strtab + sym->st_name;
222
223 if (sym->st_shndx != SHN_UNDEF &&
224 ELF_ST_BIND(sym->st_info) == STB_LOCAL) {
225 value += loff;
226 } else if (sym == prev_sym) {
227 value += prev_value;
228 } else {
229 struct sym_res sr;
230
231 sr = _dl_find_symbol(symn,
232 SYM_SEARCH_ALL|SYM_WARNNOTFOUND|
233 ((type == R_TYPE(JUMP_SLOT)) ?
234 SYM_PLT : SYM_NOTPLT), sym, object);
235 if (sr.sym == NULL) {
236 resolve_failed:
237 if (ELF_ST_BIND(sym->st_info) !=
238 STB_WEAK)
239 fails++;
240 continue;
241 }
242 prev_sym = sym;
243 prev_value = (Elf_Addr)(sr.obj->obj_base +
244 sr.sym->st_value);
245 value += prev_value;
246 }
247 }
248
249 if (type == R_TYPE(JUMP_SLOT)) {
250 /*
251 _dl_reloc_plt((Elf_Word *)where, value, rels);
252 */
253 *where = value;
254 continue;
255 }
256
257 if (type == R_TYPE(COPY)) {
258 void *dstaddr = where;
259 const void *srcaddr;
260 const Elf_Sym *dstsym = sym;
261 struct sym_res sr;
262
263 sr = _dl_find_symbol(symn,
264 SYM_SEARCH_OTHER|SYM_WARNNOTFOUND|SYM_NOTPLT,
265 dstsym, object);
266 if (sr.sym == NULL)
267 goto resolve_failed;
268
269 srcaddr = (void *)(sr.obj->obj_base + sr.sym->st_value);
270 _dl_bcopy(srcaddr, dstaddr, dstsym->st_size);
271 continue;
272 }
273
274 if (RELOC_PC_RELATIVE(type))
275 value -= (Elf_Addr)where;
276 if (RELOC_BASE_RELATIVE(type))
277 value += loff;
278
279 mask = RELOC_VALUE_BITMASK(type);
280 value >>= RELOC_VALUE_RIGHTSHIFT(type);
281 value &= mask;
282
283 *where &= ~mask;
284 *where |= value;
285 }
286
287 return fails;
288 }
289
290 /*
291 * Relocate the Global Offset Table (GOT).
292 * This is done by calling _dl_md_reloc on DT_JMPREL for DL_BIND_NOW,
293 * otherwise the lazy binding plt initialization is performed.
294 */
295 int
_dl_md_reloc_got(elf_object_t * object,int lazy)296 _dl_md_reloc_got(elf_object_t *object, int lazy)
297 {
298 int fails = 0;
299 Elf_Addr *pltgot = (Elf_Addr *)object->Dyn.info[DT_PLTGOT];
300 int i, num;
301 Elf_Rel *rel;
302
303 if (object->Dyn.info[DT_PLTREL] != DT_REL)
304 return 0;
305
306 if (!lazy) {
307 fails = _dl_md_reloc(object, DT_JMPREL, DT_PLTRELSZ);
308 } else {
309 rel = (Elf_Rel *)(object->Dyn.info[DT_JMPREL]);
310 num = (object->Dyn.info[DT_PLTRELSZ]);
311
312 for (i = 0; i < num/sizeof(Elf_Rel); i++, rel++) {
313 Elf_Addr *where;
314 where = (Elf_Addr *)(rel->r_offset + object->obj_base);
315 *where += object->obj_base;
316 }
317
318 pltgot[1] = (Elf_Addr)object;
319 pltgot[2] = (Elf_Addr)_dl_bind_start;
320 }
321
322 return fails;
323 }
324
325 Elf_Addr
_dl_bind(elf_object_t * object,int relidx)326 _dl_bind(elf_object_t *object, int relidx)
327 {
328 Elf_Rel *rel;
329 const Elf_Sym *sym;
330 const char *symn;
331 struct sym_res sr;
332 int64_t cookie = pcookie;
333 struct {
334 struct __kbind param;
335 Elf_Word newval;
336 } buf;
337
338 rel = ((Elf_Rel *)object->Dyn.info[DT_JMPREL]) + (relidx);
339
340 sym = object->dyn.symtab;
341 sym += ELF_R_SYM(rel->r_info);
342 symn = object->dyn.strtab + sym->st_name;
343
344 sr = _dl_find_symbol(symn, SYM_SEARCH_ALL|SYM_WARNNOTFOUND|SYM_PLT,
345 sym, object);
346 if (sr.sym == NULL)
347 _dl_die("lazy binding failed!");
348
349 buf.newval = sr.obj->obj_base + sr.sym->st_value;
350
351 if (__predict_false(sr.obj->traced) && _dl_trace_plt(sr.obj, symn))
352 return buf.newval;
353
354 buf.param.kb_addr = (Elf_Addr *)(object->obj_base + rel->r_offset);
355 buf.param.kb_size = sizeof(Elf_Word);
356
357 /* directly code the syscall, so that it's actually inline here */
358 {
359 register long syscall_num __asm("r12") = SYS_kbind;
360 register void *arg1 __asm("r0") = &buf;
361 register long arg2 __asm("r1") = sizeof(buf);
362 register long arg3 __asm("r2") = 0xffffffff & cookie;
363 register long arg4 __asm("r3") = 0xffffffff & (cookie >> 32);
364
365 __asm volatile("swi 0; dsb nsh; isb" : "+r" (arg1), "+r" (arg2)
366 : "r" (syscall_num), "r" (arg3), "r" (arg4)
367 : "cc", "memory");
368 }
369
370 return buf.newval;
371 }
372