1// Copyright (c) 2013 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5/*
6 * Copyright (C) 2012 The Android Open Source Project
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *  * Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 *  * Redistributions in binary form must reproduce the above copyright
15 *    notice, this list of conditions and the following disclaimer in
16 *    the documentation and/or other materials provided with the
17 *    distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
26 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
27 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
29 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33#include "linker_phdr.h"
34
35#include <errno.h>
36#include <fcntl.h>
37#include <sys/mman.h>
38#include <unistd.h>
39
40#define PAGE_START(x) ((x) & PAGE_MASK)
41#define PAGE_OFFSET(x) ((x) & ~PAGE_MASK)
42#define PAGE_END(x) PAGE_START((x) + (PAGE_SIZE - 1))
43
44// Missing exec_elf.h definitions.
45#ifndef PT_GNU_RELRO
46#define PT_GNU_RELRO 0x6474e552
47#endif
48
49/**
50  TECHNICAL NOTE ON ELF LOADING.
51
52  An ELF file's program header table contains one or more PT_LOAD
53  segments, which corresponds to portions of the file that need to
54  be mapped into the process' address space.
55
56  Each loadable segment has the following important properties:
57
58    p_offset  -> segment file offset
59    p_filesz  -> segment file size
60    p_memsz   -> segment memory size (always >= p_filesz)
61    p_vaddr   -> segment's virtual address
62    p_flags   -> segment flags (e.g. readable, writable, executable)
63
64  We will ignore the p_paddr and p_align fields of ELF::Phdr for now.
65
66  The loadable segments can be seen as a list of [p_vaddr ... p_vaddr+p_memsz)
67  ranges of virtual addresses. A few rules apply:
68
69  - the virtual address ranges should not overlap.
70
71  - if a segment's p_filesz is smaller than its p_memsz, the extra bytes
72    between them should always be initialized to 0.
73
74  - ranges do not necessarily start or end at page boundaries. Two distinct
75    segments can have their start and end on the same page. In this case, the
76    page inherits the mapping flags of the latter segment.
77
78  Finally, the real load addrs of each segment is not p_vaddr. Instead the
79  loader decides where to load the first segment, then will load all others
80  relative to the first one to respect the initial range layout.
81
82  For example, consider the following list:
83
84    [ offset:0,      filesz:0x4000, memsz:0x4000, vaddr:0x30000 ],
85    [ offset:0x4000, filesz:0x2000, memsz:0x8000, vaddr:0x40000 ],
86
87  This corresponds to two segments that cover these virtual address ranges:
88
89       0x30000...0x34000
90       0x40000...0x48000
91
92  If the loader decides to load the first segment at address 0xa0000000
93  then the segments' load address ranges will be:
94
95       0xa0030000...0xa0034000
96       0xa0040000...0xa0048000
97
98  In other words, all segments must be loaded at an address that has the same
99  constant offset from their p_vaddr value. This offset is computed as the
100  difference between the first segment's load address, and its p_vaddr value.
101
102  However, in practice, segments do _not_ start at page boundaries. Since we
103  can only memory-map at page boundaries, this means that the bias is
104  computed as:
105
106       load_bias = phdr0_load_address - PAGE_START(phdr0->p_vaddr)
107
108  (NOTE: The value must be used as a 32-bit unsigned integer, to deal with
109          possible wrap around UINT32_MAX for possible large p_vaddr values).
110
111  And that the phdr0_load_address must start at a page boundary, with
112  the segment's real content starting at:
113
114       phdr0_load_address + PAGE_OFFSET(phdr0->p_vaddr)
115
116  Note that ELF requires the following condition to make the mmap()-ing work:
117
118      PAGE_OFFSET(phdr0->p_vaddr) == PAGE_OFFSET(phdr0->p_offset)
119
120  The load_bias must be added to any p_vaddr value read from the ELF file to
121  determine the corresponding memory address.
122
123 **/
124
125#define MAYBE_MAP_FLAG(x, from, to) (((x) & (from)) ? (to) : 0)
126#define PFLAGS_TO_PROT(x)                 \
127  (MAYBE_MAP_FLAG((x), PF_X, PROT_EXEC) | \
128   MAYBE_MAP_FLAG((x), PF_R, PROT_READ) | \
129   MAYBE_MAP_FLAG((x), PF_W, PROT_WRITE))
130
131/* Returns the size of the extent of all the possibly non-contiguous
132 * loadable segments in an ELF program header table. This corresponds
133 * to the page-aligned size in bytes that needs to be reserved in the
134 * process' address space. If there are no loadable segments, 0 is
135 * returned.
136 *
137 * If out_min_vaddr or out_max_vaddr are non-NULL, they will be
138 * set to the minimum and maximum addresses of pages to be reserved,
139 * or 0 if there is nothing to load.
140 */
141size_t phdr_table_get_load_size(const ELF::Phdr* phdr_table,
142                                size_t phdr_count,
143                                ELF::Addr* out_min_vaddr,
144                                ELF::Addr* out_max_vaddr) {
145  ELF::Addr min_vaddr = ~static_cast<ELF::Addr>(0);
146  ELF::Addr max_vaddr = 0x00000000U;
147
148  bool found_pt_load = false;
149  for (size_t i = 0; i < phdr_count; ++i) {
150    const ELF::Phdr* phdr = &phdr_table[i];
151
152    if (phdr->p_type != PT_LOAD) {
153      continue;
154    }
155    found_pt_load = true;
156
157    if (phdr->p_vaddr < min_vaddr) {
158      min_vaddr = phdr->p_vaddr;
159    }
160
161    if (phdr->p_vaddr + phdr->p_memsz > max_vaddr) {
162      max_vaddr = phdr->p_vaddr + phdr->p_memsz;
163    }
164  }
165  if (!found_pt_load) {
166    min_vaddr = 0x00000000U;
167  }
168
169  min_vaddr = PAGE_START(min_vaddr);
170  max_vaddr = PAGE_END(max_vaddr);
171
172  if (out_min_vaddr != NULL) {
173    *out_min_vaddr = min_vaddr;
174  }
175  if (out_max_vaddr != NULL) {
176    *out_max_vaddr = max_vaddr;
177  }
178  return max_vaddr - min_vaddr;
179}
180
181/* Used internally. Used to set the protection bits of all loaded segments
182 * with optional extra flags (i.e. really PROT_WRITE). Used by
183 * phdr_table_protect_segments and phdr_table_unprotect_segments.
184 */
185static int _phdr_table_set_load_prot(const ELF::Phdr* phdr_table,
186                                     int phdr_count,
187                                     ELF::Addr load_bias,
188                                     int extra_prot_flags) {
189  const ELF::Phdr* phdr = phdr_table;
190  const ELF::Phdr* phdr_limit = phdr + phdr_count;
191
192  for (; phdr < phdr_limit; phdr++) {
193    if (phdr->p_type != PT_LOAD || (phdr->p_flags & PF_W) != 0)
194      continue;
195
196    ELF::Addr seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
197    ELF::Addr seg_page_end =
198        PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
199
200    int ret = mprotect((void*)seg_page_start,
201                       seg_page_end - seg_page_start,
202                       PFLAGS_TO_PROT(phdr->p_flags) | extra_prot_flags);
203    if (ret < 0) {
204      return -1;
205    }
206  }
207  return 0;
208}
209
210/* Restore the original protection modes for all loadable segments.
211 * You should only call this after phdr_table_unprotect_segments and
212 * applying all relocations.
213 *
214 * Input:
215 *   phdr_table  -> program header table
216 *   phdr_count  -> number of entries in tables
217 *   load_bias   -> load bias
218 * Return:
219 *   0 on error, -1 on failure (error code in errno).
220 */
221int phdr_table_protect_segments(const ELF::Phdr* phdr_table,
222                                int phdr_count,
223                                ELF::Addr load_bias) {
224  return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, 0);
225}
226
227/* Change the protection of all loaded segments in memory to writable.
228 * This is useful before performing relocations. Once completed, you
229 * will have to call phdr_table_protect_segments to restore the original
230 * protection flags on all segments.
231 *
232 * Note that some writable segments can also have their content turned
233 * to read-only by calling phdr_table_protect_gnu_relro. This is no
234 * performed here.
235 *
236 * Input:
237 *   phdr_table  -> program header table
238 *   phdr_count  -> number of entries in tables
239 *   load_bias   -> load bias
240 * Return:
241 *   0 on error, -1 on failure (error code in errno).
242 */
243int phdr_table_unprotect_segments(const ELF::Phdr* phdr_table,
244                                  int phdr_count,
245                                  ELF::Addr load_bias) {
246  return _phdr_table_set_load_prot(
247      phdr_table, phdr_count, load_bias, PROT_WRITE);
248}
249
250/* Return the extend of the GNU RELRO segment in a program header.
251 * On success, return 0 and sets |*relro_start| and |*relro_end|
252 * to the page-aligned extents of the RELRO section.
253 * On failure, return -1.
254 *
255 * NOTE: This assumes there is a single PT_GNU_RELRO segment in the
256 * program header, i.e. it will return the extents of the first entry.
257 */
258int phdr_table_get_relro_info(const ELF::Phdr* phdr_table,
259                              int phdr_count,
260                              ELF::Addr load_bias,
261                              ELF::Addr* relro_start,
262                              ELF::Addr* relro_size) {
263  const ELF::Phdr* phdr;
264  const ELF::Phdr* phdr_limit = phdr_table + phdr_count;
265
266  for (phdr = phdr_table; phdr < phdr_limit; ++phdr) {
267    if (phdr->p_type != PT_GNU_RELRO)
268      continue;
269
270    /* Tricky: what happens when the relro segment does not start
271     * or end at page boundaries?. We're going to be over-protective
272     * here and put every page touched by the segment as read-only.
273     *
274     * This seems to match Ian Lance Taylor's description of the
275     * feature at http://www.airs.com/blog/archives/189.
276     *
277     * Extract:
278     *    Note that the current dynamic linker code will only work
279     *    correctly if the PT_GNU_RELRO segment starts on a page
280     *    boundary. This is because the dynamic linker rounds the
281     *    p_vaddr field down to the previous page boundary. If
282     *    there is anything on the page which should not be read-only,
283     *    the program is likely to fail at runtime. So in effect the
284     *    linker must only emit a PT_GNU_RELRO segment if it ensures
285     *    that it starts on a page boundary.
286     */
287    *relro_start = PAGE_START(phdr->p_vaddr) + load_bias;
288    *relro_size =
289        PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias - *relro_start;
290    return 0;
291  }
292
293  return -1;
294}
295
296/* Apply GNU relro protection if specified by the program header. This will
297 * turn some of the pages of a writable PT_LOAD segment to read-only, as
298 * specified by one or more PT_GNU_RELRO segments. This must be always
299 * performed after relocations.
300 *
301 * The areas typically covered are .got and .data.rel.ro, these are
302 * read-only from the program's POV, but contain absolute addresses
303 * that need to be relocated before use.
304 *
305 * Input:
306 *   phdr_table  -> program header table
307 *   phdr_count  -> number of entries in tables
308 *   load_bias   -> load bias
309 * Return:
310 *   0 on error, -1 on failure (error code in errno).
311 */
312int phdr_table_protect_gnu_relro(const ELF::Phdr* phdr_table,
313                                 int phdr_count,
314                                 ELF::Addr load_bias) {
315  ELF::Addr relro_start, relro_size;
316
317  if (phdr_table_get_relro_info(
318          phdr_table, phdr_count, load_bias, &relro_start, &relro_size) < 0) {
319    return -1;
320  }
321
322  return mprotect((void*)relro_start, relro_size, PROT_READ);
323}
324
325#ifdef __arm__
326
327#ifndef PT_ARM_EXIDX
328#define PT_ARM_EXIDX 0x70000001 /* .ARM.exidx segment */
329#endif
330
331/* Return the address and size of the .ARM.exidx section in memory,
332 * if present.
333 *
334 * Input:
335 *   phdr_table  -> program header table
336 *   phdr_count  -> number of entries in tables
337 *   load_bias   -> load bias
338 * Output:
339 *   arm_exidx       -> address of table in memory (NULL on failure).
340 *   arm_exidx_count -> number of items in table (0 on failure).
341 * Return:
342 *   0 on error, -1 on failure (_no_ error code in errno)
343 */
344int phdr_table_get_arm_exidx(const ELF::Phdr* phdr_table,
345                             int phdr_count,
346                             ELF::Addr load_bias,
347                             ELF::Addr** arm_exidx,
348                             unsigned* arm_exidx_count) {
349  const ELF::Phdr* phdr = phdr_table;
350  const ELF::Phdr* phdr_limit = phdr + phdr_count;
351
352  for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
353    if (phdr->p_type != PT_ARM_EXIDX)
354      continue;
355
356    *arm_exidx = (ELF::Addr*)(load_bias + phdr->p_vaddr);
357    *arm_exidx_count = (unsigned)(phdr->p_memsz / 8);
358    return 0;
359  }
360  *arm_exidx = NULL;
361  *arm_exidx_count = 0;
362  return -1;
363}
364#endif  // __arm__
365
366/* Return the address and size of the ELF file's .dynamic section in memory,
367 * or NULL if missing.
368 *
369 * Input:
370 *   phdr_table  -> program header table
371 *   phdr_count  -> number of entries in tables
372 *   load_bias   -> load bias
373 * Output:
374 *   dynamic       -> address of table in memory (NULL on failure).
375 *   dynamic_count -> number of items in table (0 on failure).
376 *   dynamic_flags -> protection flags for section (unset on failure)
377 * Return:
378 *   void
379 */
380void phdr_table_get_dynamic_section(const ELF::Phdr* phdr_table,
381                                    int phdr_count,
382                                    ELF::Addr load_bias,
383                                    const ELF::Dyn** dynamic,
384                                    size_t* dynamic_count,
385                                    ELF::Word* dynamic_flags) {
386  const ELF::Phdr* phdr = phdr_table;
387  const ELF::Phdr* phdr_limit = phdr + phdr_count;
388
389  for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
390    if (phdr->p_type != PT_DYNAMIC) {
391      continue;
392    }
393
394    *dynamic = reinterpret_cast<const ELF::Dyn*>(load_bias + phdr->p_vaddr);
395    if (dynamic_count) {
396      *dynamic_count = (unsigned)(phdr->p_memsz / sizeof(ELF::Dyn));
397    }
398    if (dynamic_flags) {
399      *dynamic_flags = phdr->p_flags;
400    }
401    return;
402  }
403  *dynamic = NULL;
404  if (dynamic_count) {
405    *dynamic_count = 0;
406  }
407}
408