1 /* $OpenBSD: rtld_machine.c,v 1.41 2020/03/13 09:31:26 deraadt Exp $ */ 2 3 /* 4 * Copyright (c) 2004 Dale Rahn 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS 16 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 17 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 19 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 * 27 */ 28 29 #define _DYN_LOADER 30 31 #include <sys/types.h> 32 #include <sys/mman.h> 33 #include <sys/syscall.h> 34 #include <sys/unistd.h> 35 36 #include <nlist.h> 37 #include <link.h> 38 39 #include "syscall.h" 40 #include "archdep.h" 41 #include "resolve.h" 42 43 int64_t pcookie __attribute__((section(".openbsd.randomdata"))) __dso_hidden; 44 45 void _dl_bind_start(void); /* XXX */ 46 Elf_Addr _dl_bind(elf_object_t *object, int reloff); 47 #define _RF_S 0x80000000 /* Resolve symbol */ 48 #define _RF_A 0x40000000 /* Use addend */ 49 #define _RF_P 0x20000000 /* Location relative */ 50 #define _RF_G 0x10000000 /* GOT offset */ 51 #define _RF_B 0x08000000 /* Load address relative */ 52 #define _RF_E 0x02000000 /* ERROR */ 53 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 54 #define _RF_RS(s) ((s) & 0xff) /* right shift */ 55 static const int reloc_target_flags[] = { 56 0, /* 0 NONE */ 57 _RF_S|_RF_P|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 1 PC24 */ 58 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 2 ABS32 */ 59 _RF_S|_RF_P|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 3 REL32 */ 60 _RF_S|_RF_P|_RF_A| _RF_E, /* 4 REL13 */ 61 _RF_S|_RF_A| _RF_E, /* 5 ABS16 */ 62 _RF_S|_RF_A| _RF_E, /* 6 ABS12 */ 63 _RF_S|_RF_A| _RF_E, /* 7 T_ABS5 */ 64 _RF_S|_RF_A| _RF_E, /* 8 ABS8 */ 65 _RF_S|_RF_B|_RF_A| _RF_E, /* 9 SBREL32 */ 66 _RF_S|_RF_P|_RF_A| _RF_E, /* 10 T_PC22 */ 67 _RF_S|_RF_P|_RF_A| _RF_E, /* 11 T_PC8 */ 68 _RF_E, /* 12 Reserved */ 69 _RF_S|_RF_A| _RF_E, /* 13 SWI24 */ 70 _RF_S|_RF_A| _RF_E, /* 14 T_SWI8 */ 71 _RF_E, /* 15 OBSL */ 72 _RF_E, /* 16 OBSL */ 73 _RF_E, /* 17 UNUSED */ 74 _RF_E, /* 18 UNUSED */ 75 _RF_E, /* 19 UNUSED */ 76 _RF_S| _RF_SZ(32) | _RF_RS(0), /* 20 COPY */ 77 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 21 GLOB_DAT */ 78 _RF_S| _RF_SZ(32) | _RF_RS(0), /* 22 JUMP_SLOT */ 79 _RF_A| _RF_B| _RF_SZ(32) | _RF_RS(0), /* 23 RELATIVE */ 80 _RF_E, /* 24 GOTOFF */ 81 _RF_E, /* 25 GOTPC */ 82 _RF_E, /* 26 GOT32 */ 83 _RF_E, /* 27 PLT32 */ 84 _RF_E, /* 28 UNUSED */ 85 _RF_E, /* 29 UNUSED */ 86 _RF_E, /* 30 UNUSED */ 87 _RF_E, /* 31 UNUSED */ 88 _RF_E, /* 32 A_PCR 0 */ 89 _RF_E, /* 33 A_PCR 8 */ 90 _RF_E, /* 34 A_PCR 16 */ 91 _RF_E, /* 35 B_PCR 0 */ 92 _RF_E, /* 36 B_PCR 12 */ 93 _RF_E, /* 37 B_PCR 20 */ 94 _RF_E, /* 38 RELAB32 */ 95 _RF_E, /* 39 ROSGREL32 */ 96 _RF_E, /* 40 V4BX */ 97 _RF_E, /* 41 STKCHK */ 98 _RF_E /* 42 TSTKCHK */ 99 }; 100 101 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 102 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 103 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 104 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 105 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 106 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 107 108 static const long reloc_target_bitmask[] = { 109 #define _BM(x) (~(-(1ULL << (x)))) 110 _BM(0), /* 0 NONE */ 111 _BM(24), /* 1 PC24 */ 112 _BM(32), /* 2 ABS32 */ 113 _BM(32), /* 3 REL32 */ 114 _BM(0), /* 4 REL13 */ 115 _BM(0), /* 5 ABS16 */ 116 _BM(0), /* 6 ABS12 */ 117 _BM(0), /* 7 T_ABS5 */ 118 _BM(0), /* 8 ABS8 */ 119 _BM(32), /* 9 SBREL32 */ 120 _BM(0), /* 10 T_PC22 */ 121 _BM(0), /* 11 T_PC8 */ 122 _BM(0), /* 12 Reserved */ 123 _BM(0), /* 13 SWI24 */ 124 _BM(0), /* 14 T_SWI8 */ 125 _BM(0), /* 15 OBSL */ 126 _BM(0), /* 16 OBSL */ 127 _BM(0), /* 17 UNUSED */ 128 _BM(0), /* 18 UNUSED */ 129 _BM(0), /* 19 UNUSED */ 130 _BM(32), /* 20 COPY */ 131 _BM(32), /* 21 GLOB_DAT */ 132 _BM(32), /* 22 JUMP_SLOT */ 133 _BM(32), /* 23 RELATIVE */ 134 _BM(0), /* 24 GOTOFF */ 135 _BM(0), /* 25 GOTPC */ 136 _BM(0), /* 26 GOT32 */ 137 _BM(0), /* 27 PLT32 */ 138 _BM(0), /* 28 UNUSED */ 139 _BM(0), /* 29 UNUSED */ 140 _BM(0), /* 30 UNUSED */ 141 _BM(0), /* 31 UNUSED */ 142 _BM(0), /* 32 A_PCR 0 */ 143 _BM(0), /* 33 A_PCR 8 */ 144 _BM(0), /* 34 A_PCR 16 */ 145 _BM(0), /* 35 B_PCR 0 */ 146 _BM(0), /* 36 B_PCR 12 */ 147 _BM(0), /* 37 B_PCR 20 */ 148 _BM(0), /* 38 RELAB32 */ 149 _BM(0), /* 39 ROSGREL32 */ 150 _BM(0), /* 40 V4BX */ 151 _BM(0), /* 41 STKCHK */ 152 _BM(0) /* 42 TSTKCHK */ 153 #undef _BM 154 }; 155 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 156 157 #define R_TYPE(x) R_ARM_ ## x 158 159 void _dl_reloc_plt(Elf_Word *where, Elf_Addr value, Elf_Rel *rel); 160 161 int 162 _dl_md_reloc(elf_object_t *object, int rel, int relsz) 163 { 164 long i; 165 long numrel; 166 long relrel; 167 int fails = 0; 168 Elf_Addr loff; 169 Elf_Addr prev_value = 0; 170 const Elf_Sym *prev_sym = NULL; 171 Elf_Rel *rels; 172 173 loff = object->obj_base; 174 numrel = object->Dyn.info[relsz] / sizeof(Elf_Rel); 175 relrel = rel == DT_REL ? object->relcount : 0; 176 rels = (Elf_Rel *)(object->Dyn.info[rel]); 177 178 if (rels == NULL) 179 return 0; 180 181 if (relrel > numrel) 182 _dl_die("relcount > numrel: %ld > %ld", relrel, numrel); 183 184 /* tight loop for leading RELATIVE relocs */ 185 for (i = 0; i < relrel; i++, rels++) { 186 Elf_Addr *where; 187 188 where = (Elf_Addr *)(rels->r_offset + loff); 189 *where += loff; 190 } 191 for (; i < numrel; i++, rels++) { 192 Elf_Addr *where, value, mask; 193 Elf_Word type; 194 const Elf_Sym *sym; 195 const char *symn; 196 197 type = ELF_R_TYPE(rels->r_info); 198 199 if (reloc_target_flags[type] & _RF_E) 200 _dl_die("bad relocation %ld %d", i, type); 201 if (type == R_TYPE(NONE)) 202 continue; 203 204 if (type == R_TYPE(JUMP_SLOT) && rel != DT_JMPREL) 205 continue; 206 207 where = (Elf_Addr *)(rels->r_offset + loff); 208 209 if (RELOC_USE_ADDEND(type)) 210 #ifdef LDSO_ARCH_IS_RELA_ 211 value = rels->r_addend; 212 #else 213 value = *where & RELOC_VALUE_BITMASK(type); 214 #endif 215 else 216 value = 0; 217 218 sym = NULL; 219 symn = NULL; 220 if (RELOC_RESOLVE_SYMBOL(type)) { 221 sym = object->dyn.symtab; 222 sym += ELF_R_SYM(rels->r_info); 223 symn = object->dyn.strtab + sym->st_name; 224 225 if (sym->st_shndx != SHN_UNDEF && 226 ELF_ST_BIND(sym->st_info) == STB_LOCAL) { 227 value += loff; 228 } else if (sym == prev_sym) { 229 value += prev_value; 230 } else { 231 struct sym_res sr; 232 233 sr = _dl_find_symbol(symn, 234 SYM_SEARCH_ALL|SYM_WARNNOTFOUND| 235 ((type == R_TYPE(JUMP_SLOT)) ? 236 SYM_PLT : SYM_NOTPLT), sym, object); 237 if (sr.sym == NULL) { 238 resolve_failed: 239 if (ELF_ST_BIND(sym->st_info) != 240 STB_WEAK) 241 fails++; 242 continue; 243 } 244 prev_sym = sym; 245 prev_value = (Elf_Addr)(sr.obj->obj_base + 246 sr.sym->st_value); 247 value += prev_value; 248 } 249 } 250 251 if (type == R_TYPE(JUMP_SLOT)) { 252 /* 253 _dl_reloc_plt((Elf_Word *)where, value, rels); 254 */ 255 *where = value; 256 continue; 257 } 258 259 if (type == R_TYPE(COPY)) { 260 void *dstaddr = where; 261 const void *srcaddr; 262 const Elf_Sym *dstsym = sym; 263 struct sym_res sr; 264 265 sr = _dl_find_symbol(symn, 266 SYM_SEARCH_OTHER|SYM_WARNNOTFOUND|SYM_NOTPLT, 267 dstsym, object); 268 if (sr.sym == NULL) 269 goto resolve_failed; 270 271 srcaddr = (void *)(sr.obj->obj_base + sr.sym->st_value); 272 _dl_bcopy(srcaddr, dstaddr, dstsym->st_size); 273 continue; 274 } 275 276 if (RELOC_PC_RELATIVE(type)) 277 value -= (Elf_Addr)where; 278 if (RELOC_BASE_RELATIVE(type)) 279 value += loff; 280 281 mask = RELOC_VALUE_BITMASK(type); 282 value >>= RELOC_VALUE_RIGHTSHIFT(type); 283 value &= mask; 284 285 *where &= ~mask; 286 *where |= value; 287 } 288 289 return fails; 290 } 291 292 /* 293 * Relocate the Global Offset Table (GOT). 294 * This is done by calling _dl_md_reloc on DT_JMPREL for DL_BIND_NOW, 295 * otherwise the lazy binding plt initialization is performed. 296 */ 297 int 298 _dl_md_reloc_got(elf_object_t *object, int lazy) 299 { 300 int fails = 0; 301 Elf_Addr *pltgot = (Elf_Addr *)object->Dyn.info[DT_PLTGOT]; 302 int i, num; 303 Elf_Rel *rel; 304 305 if (object->Dyn.info[DT_PLTREL] != DT_REL) 306 return 0; 307 308 if (!lazy) { 309 fails = _dl_md_reloc(object, DT_JMPREL, DT_PLTRELSZ); 310 } else { 311 rel = (Elf_Rel *)(object->Dyn.info[DT_JMPREL]); 312 num = (object->Dyn.info[DT_PLTRELSZ]); 313 314 for (i = 0; i < num/sizeof(Elf_Rel); i++, rel++) { 315 Elf_Addr *where; 316 where = (Elf_Addr *)(rel->r_offset + object->obj_base); 317 *where += object->obj_base; 318 } 319 320 pltgot[1] = (Elf_Addr)object; 321 pltgot[2] = (Elf_Addr)_dl_bind_start; 322 } 323 324 return fails; 325 } 326 327 Elf_Addr 328 _dl_bind(elf_object_t *object, int relidx) 329 { 330 Elf_Rel *rel; 331 const Elf_Sym *sym; 332 const char *symn; 333 struct sym_res sr; 334 int64_t cookie = pcookie; 335 struct { 336 struct __kbind param; 337 Elf_Word newval; 338 } buf; 339 340 rel = ((Elf_Rel *)object->Dyn.info[DT_JMPREL]) + (relidx); 341 342 sym = object->dyn.symtab; 343 sym += ELF_R_SYM(rel->r_info); 344 symn = object->dyn.strtab + sym->st_name; 345 346 sr = _dl_find_symbol(symn, SYM_SEARCH_ALL|SYM_WARNNOTFOUND|SYM_PLT, 347 sym, object); 348 if (sr.sym == NULL) 349 _dl_die("lazy binding failed!"); 350 351 buf.newval = sr.obj->obj_base + sr.sym->st_value; 352 353 if (__predict_false(sr.obj->traced) && _dl_trace_plt(sr.obj, symn)) 354 return buf.newval; 355 356 buf.param.kb_addr = (Elf_Addr *)(object->obj_base + rel->r_offset); 357 buf.param.kb_size = sizeof(Elf_Word); 358 359 /* directly code the syscall, so that it's actually inline here */ 360 { 361 register long syscall_num __asm("r12") = SYS_kbind; 362 register void *arg1 __asm("r0") = &buf; 363 register long arg2 __asm("r1") = sizeof(buf); 364 register long arg3 __asm("r2") = 0xffffffff & cookie; 365 register long arg4 __asm("r3") = 0xffffffff & (cookie >> 32); 366 367 __asm volatile("swi 0; dsb nsh; isb" : "+r" (arg1), "+r" (arg2) 368 : "r" (syscall_num), "r" (arg3), "r" (arg4) 369 : "cc", "memory"); 370 } 371 372 return buf.newval; 373 } 374