1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright 1996-1998 John D. Polstra.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28#define _WANT_P_OSREL
29#include <sys/param.h>
30#include <sys/mman.h>
31#include <sys/stat.h>
32
33#include <errno.h>
34#include <stddef.h>
35#include <stdlib.h>
36#include <string.h>
37#include <unistd.h>
38
39#include "debug.h"
40#include "rtld.h"
41
42static Elf_Ehdr *get_elf_header(int, const char *, const struct stat *,
43    Elf_Phdr **phdr);
44static int convert_flags(int); /* Elf flags -> mmap flags */
45
46int __getosreldate(void);
47
48static bool
49phdr_in_zero_page(const Elf_Ehdr *hdr)
50{
51	return (hdr->e_phoff + hdr->e_phnum * sizeof(Elf_Phdr) <= page_size);
52}
53
54/*
55 * Map a shared object into memory.  The "fd" argument is a file descriptor,
56 * which must be open on the object and positioned at its beginning.
57 * The "path" argument is a pathname that is used only for error messages.
58 *
59 * The return value is a pointer to a newly-allocated Obj_Entry structure
60 * for the shared object.  Returns NULL on failure.
61 */
62Obj_Entry *
63map_object(int fd, const char *path, const struct stat *sb)
64{
65    Obj_Entry *obj;
66    Elf_Ehdr *hdr;
67    int i;
68    Elf_Phdr *phdr;
69    Elf_Phdr *phlimit;
70    Elf_Phdr **segs;
71    int nsegs;
72    Elf_Phdr *phdyn;
73    Elf_Phdr *phinterp;
74    Elf_Phdr *phtls;
75    caddr_t mapbase;
76    size_t mapsize;
77    Elf_Addr base_vaddr;
78    Elf_Addr base_vlimit;
79    caddr_t base_addr;
80    int base_flags;
81    Elf_Off data_offset;
82    Elf_Addr data_vaddr;
83    Elf_Addr data_vlimit;
84    caddr_t data_addr;
85    int data_prot;
86    int data_flags;
87    Elf_Addr clear_vaddr;
88    caddr_t clear_addr;
89    caddr_t clear_page;
90    Elf_Addr phdr_vaddr;
91    size_t nclear, phsize;
92    Elf_Addr bss_vaddr;
93    Elf_Addr bss_vlimit;
94    caddr_t bss_addr;
95    Elf_Word stack_flags;
96    Elf_Addr relro_page;
97    size_t relro_size;
98    Elf_Addr note_start;
99    Elf_Addr note_end;
100    char *note_map;
101    size_t note_map_len;
102    Elf_Addr text_end;
103
104    hdr = get_elf_header(fd, path, sb, &phdr);
105    if (hdr == NULL)
106	return (NULL);
107
108    /*
109     * Scan the program header entries, and save key information.
110     * We expect that the loadable segments are ordered by load address.
111     */
112    phsize  = hdr->e_phnum * sizeof(phdr[0]);
113    phlimit = phdr + hdr->e_phnum;
114    nsegs = -1;
115    phdyn = phinterp = phtls = NULL;
116    phdr_vaddr = 0;
117    relro_page = 0;
118    relro_size = 0;
119    note_start = 0;
120    note_end = 0;
121    note_map = NULL;
122    note_map_len = 0;
123    segs = alloca(sizeof(segs[0]) * hdr->e_phnum);
124    stack_flags = PF_X | PF_R | PF_W;
125    text_end = 0;
126    while (phdr < phlimit) {
127	switch (phdr->p_type) {
128
129	case PT_INTERP:
130	    phinterp = phdr;
131	    break;
132
133	case PT_LOAD:
134	    segs[++nsegs] = phdr;
135	    if ((segs[nsegs]->p_align & (page_size - 1)) != 0) {
136		_rtld_error("%s: PT_LOAD segment %d not page-aligned",
137		    path, nsegs);
138		goto error;
139	    }
140	    if ((segs[nsegs]->p_flags & PF_X) == PF_X) {
141		text_end = MAX(text_end,
142		    rtld_round_page(segs[nsegs]->p_vaddr +
143		    segs[nsegs]->p_memsz));
144	    }
145	    break;
146
147	case PT_PHDR:
148	    phdr_vaddr = phdr->p_vaddr;
149	    phsize = phdr->p_memsz;
150	    break;
151
152	case PT_DYNAMIC:
153	    phdyn = phdr;
154	    break;
155
156	case PT_TLS:
157	    phtls = phdr;
158	    break;
159
160	case PT_GNU_STACK:
161	    stack_flags = phdr->p_flags;
162	    break;
163
164	case PT_GNU_RELRO:
165	    relro_page = phdr->p_vaddr;
166	    relro_size = phdr->p_memsz;
167	    break;
168
169	case PT_NOTE:
170	    if (phdr->p_offset > page_size ||
171	      phdr->p_offset + phdr->p_filesz > page_size) {
172		note_map_len = rtld_round_page(phdr->p_offset +
173		  phdr->p_filesz) - rtld_trunc_page(phdr->p_offset);
174		note_map = mmap(NULL, note_map_len, PROT_READ,
175		  MAP_PRIVATE, fd, rtld_trunc_page(phdr->p_offset));
176		if (note_map == MAP_FAILED) {
177		    _rtld_error("%s: error mapping PT_NOTE (%d)", path, errno);
178		    goto error;
179		}
180		note_start = (Elf_Addr)(note_map + phdr->p_offset -
181		  rtld_trunc_page(phdr->p_offset));
182	    } else {
183		note_start = (Elf_Addr)(char *)hdr + phdr->p_offset;
184	    }
185	    note_end = note_start + phdr->p_filesz;
186	    break;
187	}
188
189	++phdr;
190    }
191    if (phdyn == NULL) {
192	_rtld_error("%s: object is not dynamically-linked", path);
193	goto error;
194    }
195
196    if (nsegs < 0) {
197	_rtld_error("%s: too few PT_LOAD segments", path);
198	goto error;
199    }
200
201    /*
202     * Map the entire address space of the object, to stake out our
203     * contiguous region, and to establish the base address for relocation.
204     */
205    base_vaddr = rtld_trunc_page(segs[0]->p_vaddr);
206    base_vlimit = rtld_round_page(segs[nsegs]->p_vaddr + segs[nsegs]->p_memsz);
207    mapsize = base_vlimit - base_vaddr;
208    base_addr = (caddr_t) base_vaddr;
209    base_flags = __getosreldate() >= P_OSREL_MAP_GUARD ? MAP_GUARD :
210	MAP_PRIVATE | MAP_ANON | MAP_NOCORE;
211    if (npagesizes > 1 && rtld_round_page(segs[0]->p_filesz) >= pagesizes[1])
212	base_flags |= MAP_ALIGNED_SUPER;
213    if (base_vaddr != 0)
214	base_flags |= MAP_FIXED | MAP_EXCL;
215
216    mapbase = mmap(base_addr, mapsize, PROT_NONE, base_flags, -1, 0);
217    if (mapbase == MAP_FAILED) {
218	_rtld_error("%s: mmap of entire address space failed: %s",
219	  path, rtld_strerror(errno));
220	goto error;
221    }
222    if (base_addr != NULL && mapbase != base_addr) {
223	_rtld_error("%s: mmap returned wrong address: wanted %p, got %p",
224	  path, base_addr, mapbase);
225	goto error1;
226    }
227
228    for (i = 0; i <= nsegs; i++) {
229	/* Overlay the segment onto the proper region. */
230	data_offset = rtld_trunc_page(segs[i]->p_offset);
231	data_vaddr = rtld_trunc_page(segs[i]->p_vaddr);
232	data_vlimit = rtld_round_page(segs[i]->p_vaddr + segs[i]->p_filesz);
233	data_addr = mapbase + (data_vaddr - base_vaddr);
234	data_prot = convert_prot(segs[i]->p_flags);
235	data_flags = convert_flags(segs[i]->p_flags) | MAP_FIXED;
236	if (data_vlimit != data_vaddr &&
237	    mmap(data_addr, data_vlimit - data_vaddr, data_prot,
238	    data_flags | MAP_PREFAULT_READ, fd, data_offset) == MAP_FAILED) {
239		_rtld_error("%s: mmap of data failed: %s", path,
240		    rtld_strerror(errno));
241		goto error1;
242	}
243
244	/* Do BSS setup */
245	if (segs[i]->p_filesz != segs[i]->p_memsz) {
246
247	    /* Clear any BSS in the last page of the segment. */
248	    clear_vaddr = segs[i]->p_vaddr + segs[i]->p_filesz;
249	    clear_addr = mapbase + (clear_vaddr - base_vaddr);
250	    clear_page = mapbase + (rtld_trunc_page(clear_vaddr) - base_vaddr);
251
252	    if ((nclear = data_vlimit - clear_vaddr) > 0) {
253		/* Make sure the end of the segment is writable */
254		if ((data_prot & PROT_WRITE) == 0 && -1 ==
255		     mprotect(clear_page, page_size, data_prot|PROT_WRITE)) {
256			_rtld_error("%s: mprotect failed: %s", path,
257			    rtld_strerror(errno));
258			goto error1;
259		}
260
261		memset(clear_addr, 0, nclear);
262
263		/* Reset the data protection back */
264		if ((data_prot & PROT_WRITE) == 0)
265		    mprotect(clear_page, page_size, data_prot);
266	    }
267
268	    /* Overlay the BSS segment onto the proper region. */
269	    bss_vaddr = data_vlimit;
270	    bss_vlimit = rtld_round_page(segs[i]->p_vaddr + segs[i]->p_memsz);
271	    bss_addr = mapbase +  (bss_vaddr - base_vaddr);
272	    if (bss_vlimit > bss_vaddr) {	/* There is something to do */
273		if (mmap(bss_addr, bss_vlimit - bss_vaddr, data_prot,
274		    data_flags | MAP_ANON, -1, 0) == MAP_FAILED) {
275		    _rtld_error("%s: mmap of bss failed: %s", path,
276			rtld_strerror(errno));
277		    goto error1;
278		}
279	    }
280	}
281
282	if (phdr_vaddr == 0 && data_offset <= hdr->e_phoff &&
283	  (data_vlimit - data_vaddr + data_offset) >=
284	  (hdr->e_phoff + hdr->e_phnum * sizeof (Elf_Phdr))) {
285	    phdr_vaddr = data_vaddr + hdr->e_phoff - data_offset;
286	}
287    }
288
289    obj = obj_new();
290    if (sb != NULL) {
291	obj->dev = sb->st_dev;
292	obj->ino = sb->st_ino;
293    }
294    obj->mapbase = mapbase;
295    obj->mapsize = mapsize;
296    obj->vaddrbase = base_vaddr;
297    obj->relocbase = mapbase - base_vaddr;
298    obj->dynamic = (const Elf_Dyn *)(obj->relocbase + phdyn->p_vaddr);
299    if (hdr->e_entry != 0)
300	obj->entry = (caddr_t)(obj->relocbase + hdr->e_entry);
301    if (phdr_vaddr != 0) {
302	obj->phdr = (const Elf_Phdr *)(obj->relocbase + phdr_vaddr);
303    } else {
304	obj->phdr = malloc(phsize);
305	if (obj->phdr == NULL) {
306	    obj_free(obj);
307	    _rtld_error("%s: cannot allocate program header", path);
308	    goto error1;
309	}
310	memcpy(__DECONST(char *, obj->phdr), (char *)hdr + hdr->e_phoff, phsize);
311	obj->phdr_alloc = true;
312    }
313    obj->phsize = phsize;
314    if (phinterp != NULL)
315	obj->interp = (const char *)(obj->relocbase + phinterp->p_vaddr);
316    if (phtls != NULL) {
317	tls_dtv_generation++;
318	obj->tlsindex = ++tls_max_index;
319	obj->tlssize = phtls->p_memsz;
320	obj->tlsalign = phtls->p_align;
321	obj->tlspoffset = phtls->p_offset;
322	obj->tlsinitsize = phtls->p_filesz;
323	obj->tlsinit = mapbase + phtls->p_vaddr;
324    }
325    obj->stack_flags = stack_flags;
326    obj->relro_page = obj->relocbase + rtld_trunc_page(relro_page);
327    obj->relro_size = rtld_trunc_page(relro_page + relro_size) -
328      rtld_trunc_page(relro_page);
329    if (note_start < note_end)
330	digest_notes(obj, note_start, note_end);
331    if (note_map != NULL)
332	munmap(note_map, note_map_len);
333    munmap(hdr, page_size);
334    return (obj);
335
336error1:
337    munmap(mapbase, mapsize);
338error:
339    if (note_map != NULL && note_map != MAP_FAILED)
340	munmap(note_map, note_map_len);
341    if (!phdr_in_zero_page(hdr))
342	munmap(phdr, hdr->e_phnum * sizeof(phdr[0]));
343    munmap(hdr, page_size);
344    return (NULL);
345}
346
347bool
348check_elf_headers(const Elf_Ehdr *hdr, const char *path)
349{
350	if (!IS_ELF(*hdr)) {
351		_rtld_error("%s: invalid file format", path);
352		return (false);
353	}
354	if (hdr->e_ident[EI_CLASS] != ELF_TARG_CLASS ||
355	    hdr->e_ident[EI_DATA] != ELF_TARG_DATA) {
356		_rtld_error("%s: unsupported file layout", path);
357		return (false);
358	}
359	if (hdr->e_ident[EI_VERSION] != EV_CURRENT ||
360	    hdr->e_version != EV_CURRENT) {
361		_rtld_error("%s: unsupported file version", path);
362		return (false);
363	}
364	if (hdr->e_type != ET_EXEC && hdr->e_type != ET_DYN) {
365		_rtld_error("%s: unsupported file type", path);
366		return (false);
367	}
368	if (hdr->e_machine != ELF_TARG_MACH) {
369		_rtld_error("%s: unsupported machine", path);
370		return (false);
371	}
372	if (hdr->e_phentsize != sizeof(Elf_Phdr)) {
373		_rtld_error(
374	    "%s: invalid shared object: e_phentsize != sizeof(Elf_Phdr)", path);
375		return (false);
376	}
377	return (true);
378}
379
380static Elf_Ehdr *
381get_elf_header(int fd, const char *path, const struct stat *sbp,
382    Elf_Phdr **phdr_p)
383{
384	Elf_Ehdr *hdr;
385	Elf_Phdr *phdr;
386
387	/* Make sure file has enough data for the ELF header */
388	if (sbp != NULL && sbp->st_size < (off_t)sizeof(Elf_Ehdr)) {
389		_rtld_error("%s: invalid file format", path);
390		return (NULL);
391	}
392
393	hdr = mmap(NULL, page_size, PROT_READ, MAP_PRIVATE | MAP_PREFAULT_READ,
394	    fd, 0);
395	if (hdr == MAP_FAILED) {
396		_rtld_error("%s: read error: %s", path, rtld_strerror(errno));
397		return (NULL);
398	}
399
400	/* Make sure the file is valid */
401	if (!check_elf_headers(hdr, path))
402		goto error;
403
404	/*
405	 * We rely on the program header being in the first page.  This is
406	 * not strictly required by the ABI specification, but it seems to
407	 * always true in practice.  And, it simplifies things considerably.
408	 */
409	if (phdr_in_zero_page(hdr)) {
410		phdr = (Elf_Phdr *)((char *)hdr + hdr->e_phoff);
411	} else {
412		phdr = mmap(NULL, hdr->e_phnum * sizeof(phdr[0]),
413		    PROT_READ, MAP_PRIVATE | MAP_PREFAULT_READ, fd,
414		    hdr->e_phoff);
415		if (phdr == MAP_FAILED) {
416			_rtld_error("%s: error mapping phdr: %s", path,
417			    rtld_strerror(errno));
418			goto error;
419		}
420	}
421	*phdr_p = phdr;
422	return (hdr);
423
424error:
425	munmap(hdr, page_size);
426	return (NULL);
427}
428
429void
430obj_free(Obj_Entry *obj)
431{
432    Objlist_Entry *elm;
433
434    if (obj->tls_static)
435	free_tls_offset(obj);
436    while (obj->needed != NULL) {
437	Needed_Entry *needed = obj->needed;
438	obj->needed = needed->next;
439	free(needed);
440    }
441    while (!STAILQ_EMPTY(&obj->names)) {
442	Name_Entry *entry = STAILQ_FIRST(&obj->names);
443	STAILQ_REMOVE_HEAD(&obj->names, link);
444	free(entry);
445    }
446    while (!STAILQ_EMPTY(&obj->dldags)) {
447	elm = STAILQ_FIRST(&obj->dldags);
448	STAILQ_REMOVE_HEAD(&obj->dldags, link);
449	free(elm);
450    }
451    while (!STAILQ_EMPTY(&obj->dagmembers)) {
452	elm = STAILQ_FIRST(&obj->dagmembers);
453	STAILQ_REMOVE_HEAD(&obj->dagmembers, link);
454	free(elm);
455    }
456    if (obj->vertab)
457	free(obj->vertab);
458    if (obj->origin_path)
459	free(obj->origin_path);
460    if (obj->z_origin)
461	free(__DECONST(void*, obj->rpath));
462    if (obj->priv)
463	free(obj->priv);
464    if (obj->path)
465	free(obj->path);
466    if (obj->phdr_alloc)
467	free(__DECONST(void *, obj->phdr));
468    free(obj);
469}
470
471Obj_Entry *
472obj_new(void)
473{
474    Obj_Entry *obj;
475
476    obj = CNEW(Obj_Entry);
477    STAILQ_INIT(&obj->dldags);
478    STAILQ_INIT(&obj->dagmembers);
479    STAILQ_INIT(&obj->names);
480    return obj;
481}
482
483/*
484 * Given a set of ELF protection flags, return the corresponding protection
485 * flags for MMAP.
486 */
487int
488convert_prot(int elfflags)
489{
490    int prot = 0;
491    if (elfflags & PF_R)
492	prot |= PROT_READ;
493    if (elfflags & PF_W)
494	prot |= PROT_WRITE;
495    if (elfflags & PF_X)
496	prot |= PROT_EXEC;
497    return prot;
498}
499
500static int
501convert_flags(int elfflags)
502{
503    int flags = MAP_PRIVATE; /* All mappings are private */
504
505    /*
506     * Readonly mappings are marked "MAP_NOCORE", because they can be
507     * reconstructed by a debugger.
508     */
509    if (!(elfflags & PF_W))
510	flags |= MAP_NOCORE;
511    return flags;
512}
513