1/* $OpenBSD: rtld_machine.c,v 1.22 2023/01/29 20:30:21 gnezdo Exp $ */ 2 3/* 4 * Copyright (c) 2004 Dale Rahn 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS 16 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 17 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 19 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 * 27 */ 28 29#define _DYN_LOADER 30 31#include <sys/types.h> 32#include <sys/exec_elf.h> 33#include <sys/syscall.h> 34#include <sys/unistd.h> 35 36#include <machine/reloc.h> 37 38#include "util.h" 39#include "resolve.h" 40 41int64_t pcookie __attribute__((section(".openbsd.randomdata"))) __dso_hidden; 42 43void _dl_bind_start(void); /* XXX */ 44Elf_Addr _dl_bind(elf_object_t *object, int index); 45#define _RF_S 0x80000000 /* Resolve symbol */ 46#define _RF_A 0x40000000 /* Use addend */ 47#define _RF_P 0x20000000 /* Location relative */ 48#define _RF_G 0x10000000 /* GOT offset */ 49#define _RF_B 0x08000000 /* Load address relative */ 50#define _RF_V 0x02000000 /* ERROR */ 51#define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 52#define _RF_RS(s) ((s) & 0xff) /* right shift */ 53static const int reloc_target_flags[] = { 54 [ R_AARCH64_NONE ] = 0, 55 [ R_AARCH64_ABS64 ] = 56 _RF_V|_RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* ABS64 */ 57 [ R_AARCH64_GLOB_DAT ] = 58 _RF_V|_RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* GLOB_DAT */ 59 [ R_AARCH64_JUMP_SLOT ] = 60 _RF_V|_RF_S| _RF_SZ(64) | _RF_RS(0), /* JUMP_SLOT */ 61 [ R_AARCH64_RELATIVE ] = 62 _RF_V|_RF_B|_RF_A| _RF_SZ(64) | _RF_RS(0), /* REL64 */ 63 [ R_AARCH64_TLSDESC ] = 64 _RF_V|_RF_S, 65 [ R_AARCH64_TLS_TPREL64 ] = 66 _RF_V|_RF_S, 67 [ R_AARCH64_COPY ] = 68 _RF_V|_RF_S| _RF_SZ(32) | _RF_RS(0), /* 20 COPY */ 69 70}; 71 72#define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 73#define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 74#define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 75#define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 76#define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 77#define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 78static const Elf_Addr reloc_target_bitmask[] = { 79#define _BM(x) (~(Elf_Addr)0 >> ((8*sizeof(reloc_target_bitmask[0])) - (x))) 80 [ R_AARCH64_NONE ] = 0, 81 [ R_AARCH64_ABS64 ] = _BM(64), 82 [ R_AARCH64_GLOB_DAT ] = _BM(64), 83 [ R_AARCH64_JUMP_SLOT ] = _BM(64), 84 [ R_AARCH64_RELATIVE ] = _BM(64), 85 [ R_AARCH64_TLSDESC ] = _BM(64), 86 [ R_AARCH64_TLS_TPREL64 ] = _BM(64), 87 [ R_AARCH64_COPY ] = _BM(64), 88#undef _BM 89}; 90#define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 91 92#define R_TYPE(x) R_AARCH64_ ## x 93 94void _dl_reloc_plt(Elf_Word *where, Elf_Addr value, Elf_RelA *rel); 95 96int 97_dl_md_reloc(elf_object_t *object, int rel, int relsz) 98{ 99 long i; 100 long numrel; 101 long relrel; 102 int fails = 0; 103 Elf_Addr loff; 104 Elf_Addr prev_value = 0; 105 const Elf_Sym *prev_sym = NULL; 106 Elf_RelA *rels; 107 108 loff = object->obj_base; 109 numrel = object->Dyn.info[relsz] / sizeof(Elf_RelA); 110 relrel = rel == DT_RELA ? object->relcount : 0; 111 rels = (Elf_RelA *)(object->Dyn.info[rel]); 112 113 if (rels == NULL) 114 return 0; 115 116 if (relrel > numrel) 117 _dl_die("relcount > numrel: %ld > %ld", relrel, numrel); 118 119 /* tight loop for leading RELATIVE relocs */ 120 for (i = 0; i < relrel; i++, rels++) { 121 Elf_Addr *where; 122 123 where = (Elf_Addr *)(rels->r_offset + loff); 124 *where += loff; 125 } 126 for (; i < numrel; i++, rels++) { 127 Elf_Addr *where, value, mask; 128 Elf_Word type; 129 const Elf_Sym *sym; 130 const char *symn; 131 132 type = ELF_R_TYPE(rels->r_info); 133 134 if (type >= nitems(reloc_target_flags) || 135 (reloc_target_flags[type] & _RF_V) == 0) 136 _dl_die("bad relocation %ld %d", i, type); 137 138 if (type == R_TYPE(NONE)) 139 continue; 140 141 if (type == R_TYPE(JUMP_SLOT) && rel != DT_JMPREL) 142 continue; 143 144 where = (Elf_Addr *)(rels->r_offset + loff); 145 146 if (RELOC_USE_ADDEND(type)) 147 value = rels->r_addend; 148 else 149 value = 0; 150 151 sym = NULL; 152 symn = NULL; 153 if (RELOC_RESOLVE_SYMBOL(type)) { 154 sym = object->dyn.symtab; 155 sym += ELF_R_SYM(rels->r_info); 156 symn = object->dyn.strtab + sym->st_name; 157 158 if (sym->st_shndx != SHN_UNDEF && 159 ELF_ST_BIND(sym->st_info) == STB_LOCAL) { 160 value += loff; 161 } else if (sym == prev_sym) { 162 value += prev_value; 163 } else { 164 struct sym_res sr; 165 166 sr = _dl_find_symbol(symn, 167 SYM_SEARCH_ALL|SYM_WARNNOTFOUND| 168 ((type == R_TYPE(JUMP_SLOT)) ? 169 SYM_PLT : SYM_NOTPLT), sym, object); 170 if (sr.sym == NULL) { 171resolve_failed: 172 if (ELF_ST_BIND(sym->st_info) != 173 STB_WEAK) 174 fails++; 175 continue; 176 } 177 prev_sym = sym; 178 prev_value = (Elf_Addr)(sr.obj->obj_base + 179 sr.sym->st_value); 180 value += prev_value; 181 } 182 } 183 184 if (type == R_TYPE(JUMP_SLOT)) { 185 /* 186 _dl_reloc_plt((Elf_Word *)where, value, rels); 187 */ 188 *where = value; 189 continue; 190 } 191 192 if (type == R_TYPE(COPY)) { 193 void *dstaddr = where; 194 const void *srcaddr; 195 const Elf_Sym *dstsym = sym; 196 struct sym_res sr; 197 198 sr = _dl_find_symbol(symn, 199 SYM_SEARCH_OTHER|SYM_WARNNOTFOUND|SYM_NOTPLT, 200 dstsym, object); 201 if (sr.sym == NULL) 202 goto resolve_failed; 203 204 srcaddr = (void *)(sr.obj->obj_base + sr.sym->st_value); 205 _dl_bcopy(srcaddr, dstaddr, dstsym->st_size); 206 continue; 207 } 208 209 if (RELOC_PC_RELATIVE(type)) 210 value -= (Elf_Addr)where; 211 if (RELOC_BASE_RELATIVE(type)) 212 value += loff; 213 214 mask = RELOC_VALUE_BITMASK(type); 215 value >>= RELOC_VALUE_RIGHTSHIFT(type); 216 value &= mask; 217 218 *where &= ~mask; 219 *where |= value; 220 } 221 222 return fails; 223} 224 225/* 226 * Relocate the Global Offset Table (GOT). 227 * This is done by calling _dl_md_reloc on DT_JMPREL for DL_BIND_NOW, 228 * otherwise the lazy binding plt initialization is performed. 229 */ 230int 231_dl_md_reloc_got(elf_object_t *object, int lazy) 232{ 233 int fails = 0; 234 Elf_Addr *pltgot = (Elf_Addr *)object->Dyn.info[DT_PLTGOT]; 235 int i, num; 236 Elf_RelA *rel; 237 238 if (object->Dyn.info[DT_PLTREL] != DT_RELA) 239 return 0; 240 241 if (!lazy) { 242 fails = _dl_md_reloc(object, DT_JMPREL, DT_PLTRELSZ); 243 } else { 244 rel = (Elf_RelA *)(object->Dyn.info[DT_JMPREL]); 245 num = (object->Dyn.info[DT_PLTRELSZ]); 246 247 for (i = 0; i < num/sizeof(Elf_RelA); i++, rel++) { 248 Elf_Addr *where; 249 where = (Elf_Addr *)(rel->r_offset + object->obj_base); 250 *where += object->obj_base; 251 } 252 253 pltgot[1] = (Elf_Addr)object; 254 pltgot[2] = (Elf_Addr)_dl_bind_start; 255 } 256 257 return fails; 258} 259 260Elf_Addr 261_dl_bind(elf_object_t *object, int relidx) 262{ 263 Elf_RelA *rel; 264 const Elf_Sym *sym; 265 const char *symn; 266 struct sym_res sr; 267 int64_t cookie = pcookie; 268 struct { 269 struct __kbind param; 270 Elf_Addr newval; 271 } buf; 272 273 rel = ((Elf_RelA *)object->Dyn.info[DT_JMPREL]) + (relidx); 274 275 sym = object->dyn.symtab; 276 sym += ELF_R_SYM(rel->r_info); 277 symn = object->dyn.strtab + sym->st_name; 278 279 sr = _dl_find_symbol(symn, SYM_SEARCH_ALL|SYM_WARNNOTFOUND|SYM_PLT, 280 sym, object); 281 if (sr.sym == NULL) 282 _dl_die("lazy binding failed!"); 283 284 buf.newval = sr.obj->obj_base + sr.sym->st_value; 285 286 if (sr.obj->traced && _dl_trace_plt(sr.obj, symn)) 287 return buf.newval; 288 289 buf.param.kb_addr = (Elf_Word *)(object->obj_base + rel->r_offset); 290 buf.param.kb_size = sizeof(Elf_Addr); 291 292 /* directly code the syscall, so that it's actually inline here */ 293 { 294 register long syscall_num __asm("x8") = SYS_kbind; 295 register void *arg1 __asm("x0") = &buf; 296 register long arg2 __asm("x1") = sizeof(buf); 297 register long arg3 __asm("x2") = cookie; 298 299 __asm volatile("svc 0; dsb nsh; isb" : "+r" (arg1), "+r" (arg2) 300 : "r" (syscall_num), "r" (arg3) 301 : "cc", "memory"); 302 } 303 304 return buf.newval; 305} 306