1 /* $OpenBSD: rtld_machine.c,v 1.22 2023/01/29 20:30:21 gnezdo Exp $ */
2
3 /*
4 * Copyright (c) 2004 Dale Rahn
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
16 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
17 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
19 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 *
27 */
28
29 #define _DYN_LOADER
30
31 #include <sys/types.h>
32 #include <sys/exec_elf.h>
33 #include <sys/syscall.h>
34 #include <sys/unistd.h>
35
36 #include <machine/reloc.h>
37
38 #include "util.h"
39 #include "resolve.h"
40
41 int64_t pcookie __attribute__((section(".openbsd.randomdata"))) __dso_hidden;
42
43 void _dl_bind_start(void); /* XXX */
44 Elf_Addr _dl_bind(elf_object_t *object, int index);
45 #define _RF_S 0x80000000 /* Resolve symbol */
46 #define _RF_A 0x40000000 /* Use addend */
47 #define _RF_P 0x20000000 /* Location relative */
48 #define _RF_G 0x10000000 /* GOT offset */
49 #define _RF_B 0x08000000 /* Load address relative */
50 #define _RF_V 0x02000000 /* ERROR */
51 #define _RF_SZ(s) (((s) & 0xff) << 8) /* memory target size */
52 #define _RF_RS(s) ((s) & 0xff) /* right shift */
53 static const int reloc_target_flags[] = {
54 [ R_AARCH64_NONE ] = 0,
55 [ R_AARCH64_ABS64 ] =
56 _RF_V|_RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* ABS64 */
57 [ R_AARCH64_GLOB_DAT ] =
58 _RF_V|_RF_S|_RF_A| _RF_SZ(64) | _RF_RS(0), /* GLOB_DAT */
59 [ R_AARCH64_JUMP_SLOT ] =
60 _RF_V|_RF_S| _RF_SZ(64) | _RF_RS(0), /* JUMP_SLOT */
61 [ R_AARCH64_RELATIVE ] =
62 _RF_V|_RF_B|_RF_A| _RF_SZ(64) | _RF_RS(0), /* REL64 */
63 [ R_AARCH64_TLSDESC ] =
64 _RF_V|_RF_S,
65 [ R_AARCH64_TLS_TPREL64 ] =
66 _RF_V|_RF_S,
67 [ R_AARCH64_COPY ] =
68 _RF_V|_RF_S| _RF_SZ(32) | _RF_RS(0), /* 20 COPY */
69
70 };
71
72 #define RELOC_RESOLVE_SYMBOL(t) ((reloc_target_flags[t] & _RF_S) != 0)
73 #define RELOC_PC_RELATIVE(t) ((reloc_target_flags[t] & _RF_P) != 0)
74 #define RELOC_BASE_RELATIVE(t) ((reloc_target_flags[t] & _RF_B) != 0)
75 #define RELOC_USE_ADDEND(t) ((reloc_target_flags[t] & _RF_A) != 0)
76 #define RELOC_TARGET_SIZE(t) ((reloc_target_flags[t] >> 8) & 0xff)
77 #define RELOC_VALUE_RIGHTSHIFT(t) (reloc_target_flags[t] & 0xff)
78 static const Elf_Addr reloc_target_bitmask[] = {
79 #define _BM(x) (~(Elf_Addr)0 >> ((8*sizeof(reloc_target_bitmask[0])) - (x)))
80 [ R_AARCH64_NONE ] = 0,
81 [ R_AARCH64_ABS64 ] = _BM(64),
82 [ R_AARCH64_GLOB_DAT ] = _BM(64),
83 [ R_AARCH64_JUMP_SLOT ] = _BM(64),
84 [ R_AARCH64_RELATIVE ] = _BM(64),
85 [ R_AARCH64_TLSDESC ] = _BM(64),
86 [ R_AARCH64_TLS_TPREL64 ] = _BM(64),
87 [ R_AARCH64_COPY ] = _BM(64),
88 #undef _BM
89 };
90 #define RELOC_VALUE_BITMASK(t) (reloc_target_bitmask[t])
91
92 #define R_TYPE(x) R_AARCH64_ ## x
93
94 void _dl_reloc_plt(Elf_Word *where, Elf_Addr value, Elf_RelA *rel);
95
96 int
_dl_md_reloc(elf_object_t * object,int rel,int relsz)97 _dl_md_reloc(elf_object_t *object, int rel, int relsz)
98 {
99 long i;
100 long numrel;
101 long relrel;
102 int fails = 0;
103 Elf_Addr loff;
104 Elf_Addr prev_value = 0;
105 const Elf_Sym *prev_sym = NULL;
106 Elf_RelA *rels;
107
108 loff = object->obj_base;
109 numrel = object->Dyn.info[relsz] / sizeof(Elf_RelA);
110 relrel = rel == DT_RELA ? object->relcount : 0;
111 rels = (Elf_RelA *)(object->Dyn.info[rel]);
112
113 if (rels == NULL)
114 return 0;
115
116 if (relrel > numrel)
117 _dl_die("relcount > numrel: %ld > %ld", relrel, numrel);
118
119 /* tight loop for leading RELATIVE relocs */
120 for (i = 0; i < relrel; i++, rels++) {
121 Elf_Addr *where;
122
123 where = (Elf_Addr *)(rels->r_offset + loff);
124 *where += loff;
125 }
126 for (; i < numrel; i++, rels++) {
127 Elf_Addr *where, value, mask;
128 Elf_Word type;
129 const Elf_Sym *sym;
130 const char *symn;
131
132 type = ELF_R_TYPE(rels->r_info);
133
134 if (type >= nitems(reloc_target_flags) ||
135 (reloc_target_flags[type] & _RF_V) == 0)
136 _dl_die("bad relocation %ld %d", i, type);
137
138 if (type == R_TYPE(NONE))
139 continue;
140
141 if (type == R_TYPE(JUMP_SLOT) && rel != DT_JMPREL)
142 continue;
143
144 where = (Elf_Addr *)(rels->r_offset + loff);
145
146 if (RELOC_USE_ADDEND(type))
147 value = rels->r_addend;
148 else
149 value = 0;
150
151 sym = NULL;
152 symn = NULL;
153 if (RELOC_RESOLVE_SYMBOL(type)) {
154 sym = object->dyn.symtab;
155 sym += ELF_R_SYM(rels->r_info);
156 symn = object->dyn.strtab + sym->st_name;
157
158 if (sym->st_shndx != SHN_UNDEF &&
159 ELF_ST_BIND(sym->st_info) == STB_LOCAL) {
160 value += loff;
161 } else if (sym == prev_sym) {
162 value += prev_value;
163 } else {
164 struct sym_res sr;
165
166 sr = _dl_find_symbol(symn,
167 SYM_SEARCH_ALL|SYM_WARNNOTFOUND|
168 ((type == R_TYPE(JUMP_SLOT)) ?
169 SYM_PLT : SYM_NOTPLT), sym, object);
170 if (sr.sym == NULL) {
171 resolve_failed:
172 if (ELF_ST_BIND(sym->st_info) !=
173 STB_WEAK)
174 fails++;
175 continue;
176 }
177 prev_sym = sym;
178 prev_value = (Elf_Addr)(sr.obj->obj_base +
179 sr.sym->st_value);
180 value += prev_value;
181 }
182 }
183
184 if (type == R_TYPE(JUMP_SLOT)) {
185 /*
186 _dl_reloc_plt((Elf_Word *)where, value, rels);
187 */
188 *where = value;
189 continue;
190 }
191
192 if (type == R_TYPE(COPY)) {
193 void *dstaddr = where;
194 const void *srcaddr;
195 const Elf_Sym *dstsym = sym;
196 struct sym_res sr;
197
198 sr = _dl_find_symbol(symn,
199 SYM_SEARCH_OTHER|SYM_WARNNOTFOUND|SYM_NOTPLT,
200 dstsym, object);
201 if (sr.sym == NULL)
202 goto resolve_failed;
203
204 srcaddr = (void *)(sr.obj->obj_base + sr.sym->st_value);
205 _dl_bcopy(srcaddr, dstaddr, dstsym->st_size);
206 continue;
207 }
208
209 if (RELOC_PC_RELATIVE(type))
210 value -= (Elf_Addr)where;
211 if (RELOC_BASE_RELATIVE(type))
212 value += loff;
213
214 mask = RELOC_VALUE_BITMASK(type);
215 value >>= RELOC_VALUE_RIGHTSHIFT(type);
216 value &= mask;
217
218 *where &= ~mask;
219 *where |= value;
220 }
221
222 return fails;
223 }
224
225 /*
226 * Relocate the Global Offset Table (GOT).
227 * This is done by calling _dl_md_reloc on DT_JMPREL for DL_BIND_NOW,
228 * otherwise the lazy binding plt initialization is performed.
229 */
230 int
_dl_md_reloc_got(elf_object_t * object,int lazy)231 _dl_md_reloc_got(elf_object_t *object, int lazy)
232 {
233 int fails = 0;
234 Elf_Addr *pltgot = (Elf_Addr *)object->Dyn.info[DT_PLTGOT];
235 int i, num;
236 Elf_RelA *rel;
237
238 if (object->Dyn.info[DT_PLTREL] != DT_RELA)
239 return 0;
240
241 if (!lazy) {
242 fails = _dl_md_reloc(object, DT_JMPREL, DT_PLTRELSZ);
243 } else {
244 rel = (Elf_RelA *)(object->Dyn.info[DT_JMPREL]);
245 num = (object->Dyn.info[DT_PLTRELSZ]);
246
247 for (i = 0; i < num/sizeof(Elf_RelA); i++, rel++) {
248 Elf_Addr *where;
249 where = (Elf_Addr *)(rel->r_offset + object->obj_base);
250 *where += object->obj_base;
251 }
252
253 pltgot[1] = (Elf_Addr)object;
254 pltgot[2] = (Elf_Addr)_dl_bind_start;
255 }
256
257 return fails;
258 }
259
260 Elf_Addr
_dl_bind(elf_object_t * object,int relidx)261 _dl_bind(elf_object_t *object, int relidx)
262 {
263 Elf_RelA *rel;
264 const Elf_Sym *sym;
265 const char *symn;
266 struct sym_res sr;
267 int64_t cookie = pcookie;
268 struct {
269 struct __kbind param;
270 Elf_Addr newval;
271 } buf;
272
273 rel = ((Elf_RelA *)object->Dyn.info[DT_JMPREL]) + (relidx);
274
275 sym = object->dyn.symtab;
276 sym += ELF_R_SYM(rel->r_info);
277 symn = object->dyn.strtab + sym->st_name;
278
279 sr = _dl_find_symbol(symn, SYM_SEARCH_ALL|SYM_WARNNOTFOUND|SYM_PLT,
280 sym, object);
281 if (sr.sym == NULL)
282 _dl_die("lazy binding failed!");
283
284 buf.newval = sr.obj->obj_base + sr.sym->st_value;
285
286 if (sr.obj->traced && _dl_trace_plt(sr.obj, symn))
287 return buf.newval;
288
289 buf.param.kb_addr = (Elf_Word *)(object->obj_base + rel->r_offset);
290 buf.param.kb_size = sizeof(Elf_Addr);
291
292 /* directly code the syscall, so that it's actually inline here */
293 {
294 register long syscall_num __asm("x8") = SYS_kbind;
295 register void *arg1 __asm("x0") = &buf;
296 register long arg2 __asm("x1") = sizeof(buf);
297 register long arg3 __asm("x2") = cookie;
298
299 __asm volatile("svc 0; dsb nsh; isb" : "+r" (arg1), "+r" (arg2)
300 : "r" (syscall_num), "r" (arg3)
301 : "cc", "memory");
302 }
303
304 return buf.newval;
305 }
306