1/* $OpenBSD: rtld_machine.c,v 1.51 2023/01/29 20:30:21 gnezdo Exp $ */ 2 3/* 4 * Copyright (c) 2002 Dale Rahn 5 * Copyright (c) 2001 Niklas Hallqvist 6 * Copyright (c) 2001 Artur Grabowski 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS 18 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 19 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29/*- 30 * Copyright (c) 2000 Eduardo Horvath. 31 * Copyright (c) 1999 The NetBSD Foundation, Inc. 32 * All rights reserved. 33 * 34 * This code is derived from software contributed to The NetBSD Foundation 35 * by Paul Kranenburg. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 3. All advertising materials mentioning features or use of this software 46 * must display the following acknowledgement: 47 * This product includes software developed by the NetBSD 48 * Foundation, Inc. and its contributors. 49 * 4. Neither the name of The NetBSD Foundation nor the names of its 50 * contributors may be used to endorse or promote products derived 51 * from this software without specific prior written permission. 52 * 53 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 54 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 56 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 57 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 58 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 59 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 60 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 61 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 62 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 63 * POSSIBILITY OF SUCH DAMAGE. 64 */ 65 66#define _DYN_LOADER 67 68#include <sys/types.h> 69#include <sys/exec_elf.h> 70#include <sys/syscall.h> 71#include <sys/unistd.h> 72 73#include <machine/reloc.h> 74 75#include "util.h" 76#include "resolve.h" 77 78int64_t pcookie __attribute__((section(".openbsd.randomdata"))) __dso_hidden; 79 80/* 81 * The following table holds for each relocation type: 82 * - the width in bits of the memory location the relocation 83 * applies to (not currently used) 84 * - the number of bits the relocation value must be shifted to the 85 * right (i.e. discard least significant bits) to fit into 86 * the appropriate field in the instruction word. 87 * - flags indicating whether 88 * * the relocation involves a symbol 89 * * the relocation is relative to the current position 90 * * the relocation is for a GOT entry 91 * * the relocation is relative to the load address 92 * 93 */ 94#define _RF_S 0x80000000 /* Resolve symbol */ 95#define _RF_A 0x40000000 /* Use addend */ 96#define _RF_P 0x20000000 /* Location relative */ 97#define _RF_G 0x10000000 /* GOT offset */ 98#define _RF_B 0x08000000 /* Load address relative */ 99#define _RF_E 0x02000000 /* ERROR */ 100#define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */ 101#define _RF_RS(s) ((s) & 0xff) /* right shift */ 102static const int reloc_target_flags[] = { 103 0, /* NONE */ 104 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* 32 */ 105 _RF_S|_RF_A|_RF_P| _RF_SZ(32) | _RF_RS(0), /* PC32 */ 106 _RF_G| _RF_SZ(32) | _RF_RS(00), /* GOT32 */ 107 _RF_A| _RF_SZ(32) | _RF_RS(0), /* PLT32 */ 108 _RF_S| _RF_SZ(32) | _RF_RS(0), /* COPY */ 109 _RF_S|_RF_A| _RF_SZ(32) | _RF_RS(0), /* GLOB_DAT */ 110 _RF_S| _RF_SZ(32) | _RF_RS(0), /* JUMP_SLOT */ 111 _RF_A| _RF_B| _RF_SZ(32) | _RF_RS(0), /* RELATIVE */ 112 _RF_E, /* GOTOFF */ 113 _RF_E, /* GOTPC */ 114 _RF_E, /* 32PLT */ 115 _RF_E, /* DUMMY 12 */ 116 _RF_E, /* DUMMY 13 */ 117 _RF_E, /* TLS_TPOFF */ 118 _RF_E, /* TLS_IE */ 119 _RF_E, /* TLS_GITIE */ 120 _RF_E, /* TLS_LE */ 121 _RF_E, /* TLS_GD */ 122 _RF_E, /* TLS_LDM */ 123 _RF_S|_RF_A| _RF_SZ(16) | _RF_RS(0), /* 16 */ 124 _RF_S|_RF_A|_RF_P| _RF_SZ(16) | _RF_RS(0), /* PC16 */ 125 _RF_S|_RF_A| _RF_SZ(8) | _RF_RS(0), /* 8 */ 126 _RF_S|_RF_A|_RF_P| _RF_SZ(8) | _RF_RS(0), /* PC8 */ 127}; 128 129#define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0) 130#define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0) 131#define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0) 132#define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0) 133#define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff) 134#define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff) 135#define RELOC_ERROR(t) \ 136 ((t) >= nitems(reloc_target_flags) || (reloc_target_flags[t] & _RF_E)) 137 138static const long reloc_target_bitmask[] = { 139#define _BM(x) (~(-(1ULL << (x)))) 140 0, /* NONE */ 141 _BM(32), /* RELOC_32*/ 142 _BM(32), /* PC32 */ 143 _BM(32), /* GOT32 */ 144 _BM(32), /* PLT32 */ 145 0, /* COPY */ 146 _BM(32), /* GLOB_DAT */ 147 _BM(32), /* JUMP_SLOT */ 148 _BM(32), /* RELATIVE */ 149 0, /* GOTOFF XXX */ 150 0, /* GOTPC XXX */ 151 0, /* DUMMY 11 */ 152 0, /* DUMMY 12 */ 153 0, /* DUMMY 13 */ 154 0, /* DUMMY 14 */ 155 0, /* DUMMY 15 */ 156 0, /* DUMMY 16 */ 157 0, /* DUMMY 17 */ 158 0, /* DUMMY 18 */ 159 0, /* DUMMY 19 */ 160 _BM(16), /* RELOC_16 */ 161 _BM(8), /* PC_16 */ 162 _BM(8), /* RELOC_8 */ 163 _BM(8), /* RELOC_PC8 */ 164#undef _BM 165}; 166#define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t]) 167 168void _dl_reloc_plt(Elf_Addr *where, Elf_Addr value); 169 170int 171_dl_md_reloc(elf_object_t *object, int rel, int relsz) 172{ 173 long i; 174 long numrel; 175 long relrel; 176 int fails = 0; 177 Elf_Addr loff; 178 Elf_Addr prev_value = 0; 179 const Elf_Sym *prev_sym = NULL; 180 Elf_Rel *rels; 181 182 loff = object->obj_base; 183 numrel = object->Dyn.info[relsz] / sizeof(Elf_Rel); 184 relrel = rel == DT_REL ? object->relcount : 0; 185 rels = (Elf_Rel *)(object->Dyn.info[rel]); 186 if (rels == NULL) 187 return 0; 188 189 if (relrel > numrel) 190 _dl_die("relcount > numrel: %ld > %ld", relrel, numrel); 191 192 /* tight loop for leading RELATIVE relocs */ 193 for (i = 0; i < relrel; i++, rels++) { 194 Elf_Addr *where; 195 196 where = (Elf_Addr *)(rels->r_offset + loff); 197 *where += loff; 198 } 199 for (; i < numrel; i++, rels++) { 200 Elf_Addr *where, value, mask; 201 Elf_Word type; 202 const Elf_Sym *sym; 203 const char *symn; 204 205 type = ELF_R_TYPE(rels->r_info); 206 207 if (RELOC_ERROR(type)) 208 _dl_die("relocation error %d idx %ld", type, i); 209 210 if (type == R_TYPE(NONE)) 211 continue; 212 213 if (type == R_TYPE(JUMP_SLOT) && rel != DT_JMPREL) 214 continue; 215 216 where = (Elf_Addr *)(rels->r_offset + loff); 217 218 if (RELOC_USE_ADDEND(type)) 219 value = *where & RELOC_VALUE_BITMASK(type); 220 else 221 value = 0; 222 223 sym = NULL; 224 symn = NULL; 225 if (RELOC_RESOLVE_SYMBOL(type)) { 226 sym = object->dyn.symtab; 227 sym += ELF_R_SYM(rels->r_info); 228 symn = object->dyn.strtab + sym->st_name; 229 230 if (sym->st_shndx != SHN_UNDEF && 231 ELF_ST_BIND(sym->st_info) == STB_LOCAL) { 232 value += loff; 233 } else if (sym == prev_sym) { 234 value += prev_value; 235 } else { 236 struct sym_res sr; 237 238 sr = _dl_find_symbol(symn, 239 SYM_SEARCH_ALL|SYM_WARNNOTFOUND| 240 ((type == R_TYPE(JUMP_SLOT))? 241 SYM_PLT:SYM_NOTPLT), sym, object); 242 if (sr.sym == NULL) { 243resolve_failed: 244 if (ELF_ST_BIND(sym->st_info) != 245 STB_WEAK) 246 fails++; 247 continue; 248 } 249 prev_sym = sym; 250 prev_value = (Elf_Addr)(sr.obj->obj_base + 251 sr.sym->st_value); 252 value += prev_value; 253 } 254 } 255 256 if (type == R_TYPE(JUMP_SLOT)) { 257 _dl_reloc_plt((Elf_Word *)where, value); 258 continue; 259 } 260 261 if (type == R_TYPE(COPY)) { 262 void *dstaddr = where; 263 const void *srcaddr; 264 const Elf_Sym *dstsym = sym; 265 struct sym_res sr; 266 267 sr = _dl_find_symbol(symn, 268 SYM_SEARCH_OTHER|SYM_WARNNOTFOUND|SYM_NOTPLT, 269 dstsym, object); 270 if (sr.sym == NULL) 271 goto resolve_failed; 272 273 srcaddr = (void *)(sr.obj->obj_base + sr.sym->st_value); 274 _dl_bcopy(srcaddr, dstaddr, dstsym->st_size); 275 continue; 276 } 277 278 if (RELOC_PC_RELATIVE(type)) 279 value -= (Elf_Addr)where; 280 if (RELOC_BASE_RELATIVE(type)) 281 value += loff; 282 283 mask = RELOC_VALUE_BITMASK(type); 284 value >>= RELOC_VALUE_RIGHTSHIFT(type); 285 value &= mask; 286 287 *where &= ~mask; 288 *where |= value; 289 } 290 291 return fails; 292} 293 294#if 0 295struct jmpslot { 296 u_short opcode; 297 u_short addr[2]; 298 u_short reloc_index; 299#define JMPSLOT_RELOC_MASK 0xffff 300}; 301#define JUMP 0xe990 /* NOP + JMP opcode */ 302#endif 303 304void 305_dl_reloc_plt(Elf_Addr *where, Elf_Addr value) 306{ 307 *where = value; 308} 309 310/* 311 * Resolve a symbol at run-time. 312 */ 313Elf_Addr 314_dl_bind(elf_object_t *object, int index) 315{ 316 Elf_Rel *rel; 317 const Elf_Sym *sym; 318 const char *symn; 319 struct sym_res sr; 320 uint64_t cookie = pcookie; 321 struct { 322 struct __kbind param; 323 Elf_Addr newval; 324 } buf; 325 326 rel = (Elf_Rel *)(object->Dyn.info[DT_JMPREL]); 327 328 rel += index/sizeof(Elf_Rel); 329 330 sym = object->dyn.symtab; 331 sym += ELF_R_SYM(rel->r_info); 332 symn = object->dyn.strtab + sym->st_name; 333 334 sr = _dl_find_symbol(symn, SYM_SEARCH_ALL|SYM_WARNNOTFOUND|SYM_PLT, 335 sym, object); 336 if (sr.sym == NULL) 337 _dl_die("lazy binding failed!"); 338 339 buf.newval = sr.obj->obj_base + sr.sym->st_value; 340 341 if (__predict_false(sr.obj->traced) && _dl_trace_plt(sr.obj, symn)) 342 return buf.newval; 343 344 buf.param.kb_addr = (Elf_Word *)(object->obj_base + rel->r_offset); 345 buf.param.kb_size = sizeof(Elf_Addr); 346 347 /* directly code the syscall, so that it's actually inline here */ 348 { 349 register long syscall_num __asm("eax") = SYS_kbind; 350 351 __asm volatile("lea %3, %%edx; pushl 4(%%edx);" 352 " pushl (%%edx); pushl %2; pushl %1;" 353 " push %%eax; int $0x80; addl $20, %%esp" : 354 "+a" (syscall_num) : "r" (&buf), "i" (sizeof(buf)), 355 "m" (cookie) : "edx", "cc", "memory"); 356 } 357 358 return buf.newval; 359} 360 361int 362_dl_md_reloc_got(elf_object_t *object, int lazy) 363{ 364 extern void _dl_bind_start(void); /* XXX */ 365 int fails = 0; 366 Elf_Addr *pltgot = (Elf_Addr *)object->Dyn.info[DT_PLTGOT]; 367 int i, num; 368 Elf_Rel *rel; 369 370 if (pltgot == NULL) 371 return 0; /* it is possible to have no PLT/GOT relocations */ 372 373 if (object->Dyn.info[DT_PLTREL] != DT_REL) 374 return 0; 375 376 if (!lazy) { 377 fails = _dl_md_reloc(object, DT_JMPREL, DT_PLTRELSZ); 378 } else { 379 pltgot[1] = (Elf_Addr)object; 380 pltgot[2] = (Elf_Addr)&_dl_bind_start; 381 382 rel = (Elf_Rel *)(object->Dyn.info[DT_JMPREL]); 383 num = (object->Dyn.info[DT_PLTRELSZ]); 384 for (i = 0; i < num/sizeof(Elf_Rel); i++, rel++) { 385 Elf_Addr *where; 386 where = (Elf_Addr *)(rel->r_offset + object->obj_base); 387 *where += object->obj_base; 388 } 389 } 390 391 return fails; 392} 393