1 /* $OpenBSD: rtld_machine.c,v 1.39 2019/12/07 22:57:47 guenther Exp $ */ 2 3 /* 4 * Copyright (c) 2002,2004 Dale Rahn 5 * Copyright (c) 2001 Niklas Hallqvist 6 * Copyright (c) 2001 Artur Grabowski 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS 18 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 19 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 /*- 30 * Copyright (c) 2000 Eduardo Horvath. 31 * Copyright (c) 1999 The NetBSD Foundation, Inc. 32 * All rights reserved. 33 * 34 * This code is derived from software contributed to The NetBSD Foundation 35 * by Paul Kranenburg. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 3. All advertising materials mentioning features or use of this software 46 * must display the following acknowledgement: 47 * This product includes software developed by the NetBSD 48 * Foundation, Inc. and its contributors. 49 * 4. Neither the name of The NetBSD Foundation nor the names of its 50 * contributors may be used to endorse or promote products derived 51 * from this software without specific prior written permission. 52 * 53 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 54 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 56 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 57 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 58 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 59 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 60 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 61 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 62 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 63 * POSSIBILITY OF SUCH DAMAGE. 64 */ 65 66 #define _DYN_LOADER 67 68 #include <sys/types.h> 69 #include <sys/mman.h> 70 #include <sys/syscall.h> 71 #include <sys/unistd.h> 72 73 #include <nlist.h> 74 #include <link.h> 75 76 #include "syscall.h" 77 #include "archdep.h" 78 #include "resolve.h" 79 80 int64_t pcookie __attribute__((section(".openbsd.randomdata"))) __dso_hidden; 81 82 /* 83 * The following table holds for each relocation type: 84 * - the width in bits of the memory location the relocation 85 * applies to 86 * - the number of bits the relocation value must be shifted to the 87 * right (i.e. discard least significant bits) to fit into 88 * the appropriate field in the instruction word. 89 * - flags indicating whether 90 * * the relocation involves a symbol 91 * * the relocation is relative to the current position 92 * * the relocation is for a GOT entry 93 * * the relocation is relative to the load address 94 * 95 */ 96 #define _RF_S 0x80000000 /* Resolve symbol */ 97 #define _RF_A 0x40000000 /* Use addend */ 98 #define _RF_P 0x20000000 /* Location relative */ 99 #define _RF_G 0x10000000 /* GOT offset */ 100 #define _RF_B 0x08000000 /* Load address relative */ 101 #define _RF_E 0x02000000 /* ERROR */ 102 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 103 #define _RF_RS(s) ((s) & 0xff) /* right shift */ 104 static const int reloc_target_flags[] = { 105 0, /* 0 NONE */ 106 _RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* 1 _64*/ 107 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* 2 PC32 */ 108 _RF_G|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 3 GOT32 */ 109 _RF_E|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 4 PLT32 */ 110 _RF_S| _RF_SZ(32) | _RF_RS(0), /* 5 COPY */ 111 _RF_S| _RF_SZ(64) | _RF_RS(0), /* 6 GLOB_DAT*/ 112 _RF_S| _RF_SZ(64) | _RF_RS(0), /* 7 JUMP_SLOT*/ 113 _RF_A| _RF_B| _RF_SZ(64) | _RF_RS(0), /* 8 RELATIVE*/ 114 _RF_E, /* 9 GOTPCREL*/ 115 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 10 32 */ 116 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 11 32S */ 117 _RF_S|_RF_A| _RF_SZ(16) | _RF_RS(0), /* 12 16 */ 118 _RF_S|_RF_A|_RF_P| _RF_SZ(16) | _RF_RS(0), /* 13 PC16 */ 119 _RF_S|_RF_A| _RF_SZ(8) | _RF_RS(0), /* 14 8 */ 120 _RF_S|_RF_A|_RF_P| _RF_SZ(8) | _RF_RS(0), /* 15 PC8 */ 121 _RF_E, /* 16 DTPMOD64*/ 122 _RF_E, /* 17 DTPOFF64*/ 123 _RF_E, /* 18 TPOFF64 */ 124 _RF_E, /* 19 TLSGD */ 125 _RF_E, /* 20 TLSLD */ 126 _RF_E, /* 21 DTPOFF32*/ 127 _RF_E, /* 22 GOTTPOFF*/ 128 _RF_E /* 23 TPOFF32*/ 129 }; 130 131 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 132 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 133 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 134 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 135 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 136 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 137 #define RELOC_ERROR(t) (reloc_target_flags[t] & _RF_E) 138 139 static const Elf_Addr reloc_target_bitmask[] = { 140 #define _BM(x) (~(Elf_Addr)0 >> ((8*sizeof(reloc_target_bitmask[0])) - (x))) 141 0, /* 0 NONE */ 142 _BM(64), /* 1 _64*/ 143 _BM(32), /* 2 PC32 */ 144 _BM(32), /* 3 GOT32 */ 145 _BM(32), /* 4 PLT32 */ 146 0, /* 5 COPY */ 147 _BM(64), /* 6 GLOB_DAT*/ 148 _BM(64), /* 7 JUMP_SLOT*/ 149 _BM(64), /* 8 RELATIVE*/ 150 _BM(32), /* 9 GOTPCREL*/ 151 _BM(32), /* 10 32 */ 152 _BM(32), /* 11 32S */ 153 _BM(16), /* 12 16 */ 154 _BM(16), /* 13 PC16 */ 155 _BM(8), /* 14 8 */ 156 _BM(8), /* 15 PC8 */ 157 0, /* 16 DTPMOD64*/ 158 0, /* 17 DTPOFF64*/ 159 0, /* 18 TPOFF64 */ 160 0, /* 19 TLSGD */ 161 0, /* 20 TLSLD */ 162 0, /* 21 DTPOFF32*/ 163 0, /* 22 GOTTPOFF*/ 164 0 /* 23 TPOFF32*/ 165 #undef _BM 166 }; 167 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 168 169 void _dl_reloc_plt(Elf_Addr *where, Elf_Addr value); 170 171 int 172 _dl_md_reloc(elf_object_t *object, int rel, int relsz) 173 { 174 long i; 175 long numrel; 176 long relrel; 177 int fails = 0; 178 Elf_Addr loff; 179 Elf_Addr prev_value = 0; 180 const Elf_Sym *prev_sym = NULL; 181 Elf_RelA *rels; 182 183 loff = object->obj_base; 184 numrel = object->Dyn.info[relsz] / sizeof(Elf_RelA); 185 relrel = rel == DT_RELA ? object->relacount : 0; 186 rels = (Elf_RelA *)(object->Dyn.info[rel]); 187 if (rels == NULL) 188 return 0; 189 190 if (relrel > numrel) 191 _dl_die("relacount > numrel: %ld > %ld", relrel, numrel); 192 193 /* tight loop for leading RELATIVE relocs */ 194 for (i = 0; i < relrel; i++, rels++) { 195 Elf_Addr *where; 196 197 where = (Elf_Addr *)(rels->r_offset + loff); 198 *where = rels->r_addend + loff; 199 } 200 for (; i < numrel; i++, rels++) { 201 Elf_Addr *where, value, mask; 202 Elf_Word type; 203 const Elf_Sym *sym; 204 const char *symn; 205 206 type = ELF_R_TYPE(rels->r_info); 207 208 if (RELOC_ERROR(type)) 209 _dl_die("relocation error %d idx %ld", type, i); 210 211 if (type == R_TYPE(NONE)) 212 continue; 213 214 if (type == R_TYPE(JUMP_SLOT) && rel != DT_JMPREL) 215 continue; 216 217 where = (Elf_Addr *)(rels->r_offset + loff); 218 219 if (RELOC_USE_ADDEND(type)) 220 value = rels->r_addend; 221 else 222 value = 0; 223 224 sym = NULL; 225 symn = NULL; 226 if (RELOC_RESOLVE_SYMBOL(type)) { 227 sym = object->dyn.symtab; 228 sym += ELF_R_SYM(rels->r_info); 229 symn = object->dyn.strtab + sym->st_name; 230 231 if (sym->st_shndx != SHN_UNDEF && 232 ELF_ST_BIND(sym->st_info) == STB_LOCAL) { 233 value += loff; 234 } else if (sym == prev_sym) { 235 value += prev_value; 236 } else { 237 struct sym_res sr; 238 239 sr = _dl_find_symbol(symn, 240 SYM_SEARCH_ALL|SYM_WARNNOTFOUND| 241 ((type == R_TYPE(JUMP_SLOT))? 242 SYM_PLT:SYM_NOTPLT), sym, object); 243 if (sr.sym == NULL) { 244 resolve_failed: 245 if (ELF_ST_BIND(sym->st_info) != 246 STB_WEAK) 247 fails++; 248 continue; 249 } 250 prev_sym = sym; 251 prev_value = (Elf_Addr)(sr.obj->obj_base + 252 sr.sym->st_value); 253 value += prev_value; 254 } 255 } 256 257 if (type == R_TYPE(JUMP_SLOT)) { 258 _dl_reloc_plt(where, value); 259 continue; 260 } 261 262 if (type == R_TYPE(COPY)) { 263 void *dstaddr = where; 264 const void *srcaddr; 265 const Elf_Sym *dstsym = sym; 266 struct sym_res sr; 267 268 sr = _dl_find_symbol(symn, 269 SYM_SEARCH_OTHER|SYM_WARNNOTFOUND|SYM_NOTPLT, 270 dstsym, object); 271 if (sr.sym == NULL) 272 goto resolve_failed; 273 274 srcaddr = (void *)(sr.obj->obj_base + sr.sym->st_value); 275 _dl_bcopy(srcaddr, dstaddr, dstsym->st_size); 276 continue; 277 } 278 279 if (RELOC_PC_RELATIVE(type)) 280 value -= (Elf_Addr)where; 281 if (RELOC_BASE_RELATIVE(type)) 282 value += loff; 283 284 mask = RELOC_VALUE_BITMASK(type); 285 value >>= RELOC_VALUE_RIGHTSHIFT(type); 286 value &= mask; 287 288 if (RELOC_TARGET_SIZE(type) > 32) { 289 *where &= ~mask; 290 *where |= value; 291 } else { 292 Elf32_Addr *where32 = (Elf32_Addr *)where; 293 294 *where32 &= ~mask; 295 *where32 |= value; 296 } 297 } 298 299 return fails; 300 } 301 302 void 303 _dl_reloc_plt(Elf_Addr *where, Elf_Addr value) 304 { 305 *where = value; 306 } 307 308 /* 309 * Resolve a symbol at run-time. 310 */ 311 Elf_Addr 312 _dl_bind(elf_object_t *object, int index) 313 { 314 Elf_RelA *rel; 315 const Elf_Sym *sym; 316 const char *symn; 317 struct sym_res sr; 318 int64_t cookie = pcookie; 319 struct { 320 struct __kbind param; 321 Elf_Addr newval; 322 } buf; 323 324 rel = (Elf_RelA *)(object->Dyn.info[DT_JMPREL]) + index; 325 326 sym = object->dyn.symtab; 327 sym += ELF_R_SYM(rel->r_info); 328 symn = object->dyn.strtab + sym->st_name; 329 330 sr = _dl_find_symbol(symn, SYM_SEARCH_ALL|SYM_WARNNOTFOUND|SYM_PLT, 331 sym, object); 332 if (sr.sym == NULL) 333 _dl_die("lazy binding failed!"); 334 335 buf.newval = sr.obj->obj_base + sr.sym->st_value; 336 337 if (__predict_false(sr.obj->traced) && _dl_trace_plt(sr.obj, symn)) 338 return buf.newval; 339 340 buf.param.kb_addr = (Elf_Word *)(object->obj_base + rel->r_offset); 341 buf.param.kb_size = sizeof(Elf_Addr); 342 343 /* directly code the syscall, so that it's actually inline here */ 344 { 345 register long syscall_num __asm("rax") = SYS_kbind; 346 register void *arg1 __asm("rdi") = &buf; 347 register long arg2 __asm("rsi") = sizeof(buf); 348 register long arg3 __asm("rdx") = cookie; 349 350 __asm volatile("syscall" : "+r" (syscall_num), "+r" (arg3) : 351 "r" (arg1), "r" (arg2) : "cc", "rcx", "r11", "memory"); 352 } 353 return buf.newval; 354 } 355 356 int 357 _dl_md_reloc_got(elf_object_t *object, int lazy) 358 { 359 extern void _dl_bind_start(void); /* XXX */ 360 int fails = 0; 361 Elf_Addr *pltgot = (Elf_Addr *)object->Dyn.info[DT_PLTGOT]; 362 int i, num; 363 Elf_RelA *rel; 364 365 if (pltgot == NULL) 366 return 0; /* it is possible to have no PLT/GOT relocations */ 367 368 if (object->Dyn.info[DT_PLTREL] != DT_RELA) 369 return 0; 370 371 if (__predict_false(!lazy)) { 372 fails = _dl_md_reloc(object, DT_JMPREL, DT_PLTRELSZ); 373 } else { 374 pltgot[1] = (Elf_Addr)object; 375 pltgot[2] = (Elf_Addr)&_dl_bind_start; 376 377 rel = (Elf_RelA *)(object->Dyn.info[DT_JMPREL]); 378 num = (object->Dyn.info[DT_PLTRELSZ]); 379 for (i = 0; i < num/sizeof(Elf_RelA); i++, rel++) { 380 Elf_Addr *where; 381 where = (Elf_Addr *)(rel->r_offset + object->obj_base); 382 *where += object->obj_base; 383 } 384 } 385 386 return fails; 387 } 388