1 /* $OpenBSD: rtld_machine.c,v 1.35 2016/07/04 04:33:35 guenther Exp $ */ 2 3 /* 4 * Copyright (c) 2002 Dale Rahn 5 * Copyright (c) 2001 Niklas Hallqvist 6 * Copyright (c) 2001 Artur Grabowski 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS 18 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 19 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 /*- 30 * Copyright (c) 2000 Eduardo Horvath. 31 * Copyright (c) 1999 The NetBSD Foundation, Inc. 32 * All rights reserved. 33 * 34 * This code is derived from software contributed to The NetBSD Foundation 35 * by Paul Kranenburg. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 3. All advertising materials mentioning features or use of this software 46 * must display the following acknowledgement: 47 * This product includes software developed by the NetBSD 48 * Foundation, Inc. and its contributors. 49 * 4. Neither the name of The NetBSD Foundation nor the names of its 50 * contributors may be used to endorse or promote products derived 51 * from this software without specific prior written permission. 52 * 53 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 54 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 56 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 57 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 58 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 59 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 60 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 61 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 62 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 63 * POSSIBILITY OF SUCH DAMAGE. 64 */ 65 66 #define _DYN_LOADER 67 68 #include <sys/types.h> 69 #include <sys/mman.h> 70 #include <sys/syscall.h> 71 #include <sys/unistd.h> 72 73 #include <nlist.h> 74 #include <link.h> 75 76 #include "syscall.h" 77 #include "archdep.h" 78 #include "resolve.h" 79 80 int64_t pcookie __attribute__((section(".openbsd.randomdata"))) __dso_hidden; 81 82 /* 83 * The following table holds for each relocation type: 84 * - the width in bits of the memory location the relocation 85 * applies to (not currently used) 86 * - the number of bits the relocation value must be shifted to the 87 * right (i.e. discard least significant bits) to fit into 88 * the appropriate field in the instruction word. 89 * - flags indicating whether 90 * * the relocation involves a symbol 91 * * the relocation is relative to the current position 92 * * the relocation is for a GOT entry 93 * * the relocation is relative to the load address 94 * 95 */ 96 #define _RF_S 0x80000000 /* Resolve symbol */ 97 #define _RF_A 0x40000000 /* Use addend */ 98 #define _RF_P 0x20000000 /* Location relative */ 99 #define _RF_G 0x10000000 /* GOT offset */ 100 #define _RF_B 0x08000000 /* Load address relative */ 101 #define _RF_U 0x04000000 /* Unaligned */ 102 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 103 #define _RF_RS(s) ((s) & 0xff) /* right shift */ 104 static int reloc_target_flags[] = { 105 0, /* NONE */ 106 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* RELOC_32*/ 107 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PC32 */ 108 _RF_G| _RF_SZ(32) | _RF_RS(00), /* GOT32 */ 109 _RF_A| _RF_SZ(32) | _RF_RS(0), /* PLT32 */ 110 _RF_S| _RF_SZ(32) | _RF_RS(0), /* COPY */ 111 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* GLOB_DAT */ 112 _RF_S| _RF_SZ(32) | _RF_RS(0), /* JUMP_SLOT */ 113 _RF_A| _RF_B| _RF_SZ(32) | _RF_RS(0), /* RELATIVE */ 114 0, /* GOTOFF XXX */ 115 0, /* GOTPC XXX */ 116 0, /* DUMMY 11 */ 117 0, /* DUMMY 12 */ 118 0, /* DUMMY 13 */ 119 0, /* DUMMY 14 */ 120 0, /* DUMMY 15 */ 121 0, /* DUMMY 16 */ 122 0, /* DUMMY 17 */ 123 0, /* DUMMY 18 */ 124 0, /* DUMMY 19 */ 125 _RF_S|_RF_A| _RF_SZ(16) | _RF_RS(0), /* RELOC_16 */ 126 _RF_S|_RF_A|_RF_P| _RF_SZ(16) | _RF_RS(0), /* PC_16 */ 127 _RF_S|_RF_A| _RF_SZ(8) | _RF_RS(0), /* RELOC_8 */ 128 _RF_S|_RF_A|_RF_P| _RF_SZ(8) | _RF_RS(0), /* RELOC_PC8 */ 129 }; 130 131 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 132 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 133 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 134 #define RELOC_UNALIGNED(t) ((reloc_target_flags[t] & _RF_U) != 0) 135 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 136 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 137 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 138 139 static long reloc_target_bitmask[] = { 140 #define _BM(x) (~(-(1ULL << (x)))) 141 0, /* NONE */ 142 _BM(32), /* RELOC_32*/ 143 _BM(32), /* PC32 */ 144 _BM(32), /* GOT32 */ 145 _BM(32), /* PLT32 */ 146 0, /* COPY */ 147 _BM(32), /* GLOB_DAT */ 148 _BM(32), /* JUMP_SLOT */ 149 _BM(32), /* RELATIVE */ 150 0, /* GOTOFF XXX */ 151 0, /* GOTPC XXX */ 152 0, /* DUMMY 11 */ 153 0, /* DUMMY 12 */ 154 0, /* DUMMY 13 */ 155 0, /* DUMMY 14 */ 156 0, /* DUMMY 15 */ 157 0, /* DUMMY 16 */ 158 0, /* DUMMY 17 */ 159 0, /* DUMMY 18 */ 160 0, /* DUMMY 19 */ 161 _BM(16), /* RELOC_16 */ 162 _BM(8), /* PC_16 */ 163 _BM(8), /* RELOC_8 */ 164 _BM(8), /* RELOC_PC8 */ 165 #undef _BM 166 }; 167 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 168 169 void _dl_reloc_plt(Elf_Addr *where, Elf_Addr value); 170 171 int 172 _dl_md_reloc(elf_object_t *object, int rel, int relsz) 173 { 174 long i; 175 long numrel; 176 long relrel; 177 int fails = 0; 178 Elf_Addr loff; 179 Elf_Addr prev_value = 0; 180 const Elf_Sym *prev_sym = NULL; 181 Elf_Rel *rels; 182 struct load_list *llist; 183 184 loff = object->obj_base; 185 numrel = object->Dyn.info[relsz] / sizeof(Elf32_Rel); 186 relrel = rel == DT_REL ? object->relcount : 0; 187 rels = (Elf32_Rel *)(object->Dyn.info[rel]); 188 if (rels == NULL) 189 return(0); 190 191 if (relrel > numrel) { 192 _dl_printf("relcount > numrel: %ld > %ld\n", relrel, numrel); 193 _dl_exit(20); 194 } 195 196 /* 197 * unprotect some segments if we need it. 198 */ 199 if ((object->dyn.textrel == 1) && (rel == DT_REL || rel == DT_RELA)) { 200 for (llist = object->load_list; llist != NULL; llist = llist->next) { 201 if (!(llist->prot & PROT_WRITE)) 202 _dl_mprotect(llist->start, llist->size, 203 PROT_READ | PROT_WRITE); 204 } 205 } 206 207 /* tight loop for leading RELATIVE relocs */ 208 for (i = 0; i < relrel; i++, rels++) { 209 Elf_Addr *where; 210 211 #ifdef DEBUG 212 if (ELF_R_TYPE(rels->r_info) != R_TYPE(RELATIVE)) { 213 _dl_printf("RELCOUNT wrong\n"); 214 _dl_exit(20); 215 } 216 #endif 217 where = (Elf_Addr *)(rels->r_offset + loff); 218 *where += loff; 219 } 220 for (; i < numrel; i++, rels++) { 221 Elf_Addr *where, value, ooff, mask; 222 Elf_Word type; 223 const Elf_Sym *sym, *this; 224 const char *symn; 225 226 type = ELF_R_TYPE(rels->r_info); 227 228 if (type == R_TYPE(NONE)) 229 continue; 230 231 if (type == R_TYPE(JUMP_SLOT) && rel != DT_JMPREL) 232 continue; 233 234 where = (Elf_Addr *)(rels->r_offset + loff); 235 236 if (RELOC_USE_ADDEND(type)) 237 value = *where & RELOC_VALUE_BITMASK(type); 238 else 239 value = 0; 240 241 sym = NULL; 242 symn = NULL; 243 if (RELOC_RESOLVE_SYMBOL(type)) { 244 sym = object->dyn.symtab; 245 sym += ELF_R_SYM(rels->r_info); 246 symn = object->dyn.strtab + sym->st_name; 247 248 if (sym->st_shndx != SHN_UNDEF && 249 ELF_ST_BIND(sym->st_info) == STB_LOCAL) { 250 value += loff; 251 } else if (sym == prev_sym) { 252 value += prev_value; 253 } else { 254 this = NULL; 255 ooff = _dl_find_symbol_bysym(object, 256 ELF_R_SYM(rels->r_info), &this, 257 SYM_SEARCH_ALL|SYM_WARNNOTFOUND| 258 ((type == R_TYPE(JUMP_SLOT))? 259 SYM_PLT:SYM_NOTPLT), 260 sym, NULL); 261 if (this == NULL) { 262 resolve_failed: 263 if (ELF_ST_BIND(sym->st_info) != 264 STB_WEAK) 265 fails++; 266 continue; 267 } 268 prev_sym = sym; 269 prev_value = (Elf_Addr)(ooff + this->st_value); 270 value += prev_value; 271 } 272 } 273 274 if (type == R_TYPE(JUMP_SLOT)) { 275 _dl_reloc_plt((Elf_Word *)where, value); 276 continue; 277 } 278 279 if (type == R_TYPE(COPY)) { 280 void *dstaddr = where; 281 const void *srcaddr; 282 const Elf_Sym *dstsym = sym, *srcsym = NULL; 283 size_t size = dstsym->st_size; 284 Elf_Addr soff; 285 286 soff = _dl_find_symbol(symn, &srcsym, 287 SYM_SEARCH_OTHER|SYM_WARNNOTFOUND|SYM_NOTPLT, 288 sym, object, NULL); 289 if (srcsym == NULL) 290 goto resolve_failed; 291 292 srcaddr = (void *)(soff + srcsym->st_value); 293 _dl_bcopy(srcaddr, dstaddr, size); 294 continue; 295 } 296 297 if (RELOC_PC_RELATIVE(type)) 298 value -= (Elf_Addr)where; 299 if (RELOC_BASE_RELATIVE(type)) 300 value += loff; 301 302 mask = RELOC_VALUE_BITMASK(type); 303 value >>= RELOC_VALUE_RIGHTSHIFT(type); 304 value &= mask; 305 306 if (RELOC_UNALIGNED(type)) { 307 /* Handle unaligned relocations. */ 308 Elf_Addr tmp = 0; 309 char *ptr = (char *)where; 310 int i, size = RELOC_TARGET_SIZE(type)/8; 311 312 /* Read it in one byte at a time. */ 313 for (i=0; i<size; i++) 314 tmp = (tmp << 8) | ptr[i]; 315 316 tmp &= ~mask; 317 tmp |= value; 318 319 /* Write it back out. */ 320 for (i=0; i<size; i++) 321 ptr[i] = ((tmp >> (8*i)) & 0xff); 322 } else if (RELOC_TARGET_SIZE(type) > 32) { 323 *where &= ~mask; 324 *where |= value; 325 } else { 326 Elf32_Addr *where32 = (Elf32_Addr *)where; 327 328 *where32 &= ~mask; 329 *where32 |= value; 330 } 331 } 332 333 /* reprotect the unprotected segments */ 334 if ((object->dyn.textrel == 1) && (rel == DT_REL || rel == DT_RELA)) { 335 for (llist = object->load_list; llist != NULL; llist = llist->next) { 336 if (!(llist->prot & PROT_WRITE)) 337 _dl_mprotect(llist->start, llist->size, 338 llist->prot); 339 } 340 } 341 342 return (fails); 343 } 344 345 #if 0 346 struct jmpslot { 347 u_short opcode; 348 u_short addr[2]; 349 u_short reloc_index; 350 #define JMPSLOT_RELOC_MASK 0xffff 351 }; 352 #define JUMP 0xe990 /* NOP + JMP opcode */ 353 #endif 354 355 void 356 _dl_reloc_plt(Elf_Addr *where, Elf_Addr value) 357 { 358 *where = value; 359 } 360 361 /* 362 * Resolve a symbol at run-time. 363 */ 364 Elf_Addr 365 _dl_bind(elf_object_t *object, int index) 366 { 367 Elf_Rel *rel; 368 const Elf_Sym *sym, *this; 369 const char *symn; 370 const elf_object_t *sobj; 371 Elf_Addr ooff; 372 uint64_t cookie = pcookie; 373 struct { 374 struct __kbind param; 375 Elf_Addr newval; 376 } buf; 377 378 rel = (Elf_Rel *)(object->Dyn.info[DT_JMPREL]); 379 380 rel += index/sizeof(Elf_Rel); 381 382 sym = object->dyn.symtab; 383 sym += ELF_R_SYM(rel->r_info); 384 symn = object->dyn.strtab + sym->st_name; 385 386 this = NULL; 387 ooff = _dl_find_symbol(symn, &this, 388 SYM_SEARCH_ALL|SYM_WARNNOTFOUND|SYM_PLT, sym, object, &sobj); 389 if (this == NULL) { 390 _dl_printf("lazy binding failed!\n"); 391 *(volatile int *)0 = 0; /* XXX */ 392 } 393 394 buf.newval = ooff + this->st_value; 395 396 if (__predict_false(sobj->traced) && _dl_trace_plt(sobj, symn)) 397 return (buf.newval); 398 399 buf.param.kb_addr = (Elf_Word *)(object->obj_base + rel->r_offset); 400 buf.param.kb_size = sizeof(Elf_Addr); 401 402 /* directly code the syscall, so that it's actually inline here */ 403 { 404 register long syscall_num __asm("eax") = SYS_kbind; 405 406 __asm volatile("pushl 4 %3; pushl %3; pushl %2; pushl %1;" 407 " push %%eax; int $0x80; addl $20, %%esp" : 408 "+a" (syscall_num) : "r" (&buf), "i" (sizeof(buf)), 409 "m" (cookie) : "edx", "cc", "memory"); 410 } 411 412 return (buf.newval); 413 } 414 415 int 416 _dl_md_reloc_got(elf_object_t *object, int lazy) 417 { 418 extern void _dl_bind_start(void); /* XXX */ 419 int fails = 0; 420 Elf_Addr *pltgot = (Elf_Addr *)object->Dyn.info[DT_PLTGOT]; 421 int i, num; 422 Elf_Rel *rel; 423 424 if (pltgot == NULL) 425 return (0); /* it is possible to have no PLT/GOT relocations */ 426 427 if (object->Dyn.info[DT_PLTREL] != DT_REL) 428 return (0); 429 430 if (object->traced) 431 lazy = 1; 432 433 if (!lazy) { 434 fails = _dl_md_reloc(object, DT_JMPREL, DT_PLTRELSZ); 435 } else { 436 pltgot[1] = (Elf_Addr)object; 437 pltgot[2] = (Elf_Addr)&_dl_bind_start; 438 439 rel = (Elf_Rel *)(object->Dyn.info[DT_JMPREL]); 440 num = (object->Dyn.info[DT_PLTRELSZ]); 441 for (i = 0; i < num/sizeof(Elf_Rel); i++, rel++) { 442 Elf_Addr *where; 443 where = (Elf_Addr *)(rel->r_offset + object->obj_base); 444 *where += object->obj_base; 445 } 446 } 447 448 /* mprotect the GOT */ 449 _dl_protect_segment(object, 0, "__got_start", "__got_end", PROT_READ); 450 451 return (fails); 452 } 453