1 // Copyright 2014 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 /* 6 * Copyright (C) 2012 The Android Open Source Project 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * * Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * * Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in 16 * the documentation and/or other materials provided with the 17 * distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 26 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 27 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 28 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 29 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 #include "linker_phdr.h" 34 35 #include <errno.h> 36 #include <fcntl.h> 37 #include <sys/mman.h> 38 #include <unistd.h> 39 40 #define PAGE_START(x) ((x) & PAGE_MASK) 41 #define PAGE_OFFSET(x) ((x) & ~PAGE_MASK) 42 #define PAGE_END(x) PAGE_START((x) + (PAGE_SIZE - 1)) 43 44 // Missing exec_elf.h definitions. 45 #ifndef PT_GNU_RELRO 46 #define PT_GNU_RELRO 0x6474e552 47 #endif 48 49 /** 50 TECHNICAL NOTE ON ELF LOADING. 51 52 An ELF file's program header table contains one or more PT_LOAD 53 segments, which corresponds to portions of the file that need to 54 be mapped into the process' address space. 55 56 Each loadable segment has the following important properties: 57 58 p_offset -> segment file offset 59 p_filesz -> segment file size 60 p_memsz -> segment memory size (always >= p_filesz) 61 p_vaddr -> segment's virtual address 62 p_flags -> segment flags (e.g. readable, writable, executable) 63 64 We will ignore the p_paddr and p_align fields of ELF::Phdr for now. 65 66 The loadable segments can be seen as a list of [p_vaddr ... p_vaddr+p_memsz) 67 ranges of virtual addresses. A few rules apply: 68 69 - the virtual address ranges should not overlap. 70 71 - if a segment's p_filesz is smaller than its p_memsz, the extra bytes 72 between them should always be initialized to 0. 73 74 - ranges do not necessarily start or end at page boundaries. Two distinct 75 segments can have their start and end on the same page. In this case, the 76 page inherits the mapping flags of the latter segment. 77 78 Finally, the real load addrs of each segment is not p_vaddr. Instead the 79 loader decides where to load the first segment, then will load all others 80 relative to the first one to respect the initial range layout. 81 82 For example, consider the following list: 83 84 [ offset:0, filesz:0x4000, memsz:0x4000, vaddr:0x30000 ], 85 [ offset:0x4000, filesz:0x2000, memsz:0x8000, vaddr:0x40000 ], 86 87 This corresponds to two segments that cover these virtual address ranges: 88 89 0x30000...0x34000 90 0x40000...0x48000 91 92 If the loader decides to load the first segment at address 0xa0000000 93 then the segments' load address ranges will be: 94 95 0xa0030000...0xa0034000 96 0xa0040000...0xa0048000 97 98 In other words, all segments must be loaded at an address that has the same 99 constant offset from their p_vaddr value. This offset is computed as the 100 difference between the first segment's load address, and its p_vaddr value. 101 102 However, in practice, segments do _not_ start at page boundaries. Since we 103 can only memory-map at page boundaries, this means that the bias is 104 computed as: 105 106 load_bias = phdr0_load_address - PAGE_START(phdr0->p_vaddr) 107 108 (NOTE: The value must be used as a 32-bit unsigned integer, to deal with 109 possible wrap around UINT32_MAX for possible large p_vaddr values). 110 111 And that the phdr0_load_address must start at a page boundary, with 112 the segment's real content starting at: 113 114 phdr0_load_address + PAGE_OFFSET(phdr0->p_vaddr) 115 116 Note that ELF requires the following condition to make the mmap()-ing work: 117 118 PAGE_OFFSET(phdr0->p_vaddr) == PAGE_OFFSET(phdr0->p_offset) 119 120 The load_bias must be added to any p_vaddr value read from the ELF file to 121 determine the corresponding memory address. 122 123 **/ 124 125 #define MAYBE_MAP_FLAG(x, from, to) (((x) & (from)) ? (to) : 0) 126 #define PFLAGS_TO_PROT(x) \ 127 (MAYBE_MAP_FLAG((x), PF_X, PROT_EXEC) | \ 128 MAYBE_MAP_FLAG((x), PF_R, PROT_READ) | \ 129 MAYBE_MAP_FLAG((x), PF_W, PROT_WRITE)) 130 131 /* Returns the size of the extent of all the possibly non-contiguous 132 * loadable segments in an ELF program header table. This corresponds 133 * to the page-aligned size in bytes that needs to be reserved in the 134 * process' address space. If there are no loadable segments, 0 is 135 * returned. 136 * 137 * If out_min_vaddr or out_max_vaddr are non-NULL, they will be 138 * set to the minimum and maximum addresses of pages to be reserved, 139 * or 0 if there is nothing to load. 140 */ 141 size_t phdr_table_get_load_size(const ELF::Phdr* phdr_table, 142 size_t phdr_count, 143 ELF::Addr* out_min_vaddr, 144 ELF::Addr* out_max_vaddr) { 145 ELF::Addr min_vaddr = ~static_cast<ELF::Addr>(0); 146 ELF::Addr max_vaddr = 0x00000000U; 147 148 bool found_pt_load = false; 149 for (size_t i = 0; i < phdr_count; ++i) { 150 const ELF::Phdr* phdr = &phdr_table[i]; 151 152 if (phdr->p_type != PT_LOAD) { 153 continue; 154 } 155 found_pt_load = true; 156 157 if (phdr->p_vaddr < min_vaddr) { 158 min_vaddr = phdr->p_vaddr; 159 } 160 161 if (phdr->p_vaddr + phdr->p_memsz > max_vaddr) { 162 max_vaddr = phdr->p_vaddr + phdr->p_memsz; 163 } 164 } 165 if (!found_pt_load) { 166 min_vaddr = 0x00000000U; 167 } 168 169 min_vaddr = PAGE_START(min_vaddr); 170 max_vaddr = PAGE_END(max_vaddr); 171 172 if (out_min_vaddr != NULL) { 173 *out_min_vaddr = min_vaddr; 174 } 175 if (out_max_vaddr != NULL) { 176 *out_max_vaddr = max_vaddr; 177 } 178 return max_vaddr - min_vaddr; 179 } 180 181 /* Used internally. Used to set the protection bits of all loaded segments 182 * with optional extra flags (i.e. really PROT_WRITE). Used by 183 * phdr_table_protect_segments and phdr_table_unprotect_segments. 184 */ 185 static int _phdr_table_set_load_prot(const ELF::Phdr* phdr_table, 186 int phdr_count, 187 ELF::Addr load_bias, 188 int extra_prot_flags) { 189 const ELF::Phdr* phdr = phdr_table; 190 const ELF::Phdr* phdr_limit = phdr + phdr_count; 191 192 for (; phdr < phdr_limit; phdr++) { 193 if (phdr->p_type != PT_LOAD || (phdr->p_flags & PF_W) != 0) 194 continue; 195 196 ELF::Addr seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias; 197 ELF::Addr seg_page_end = 198 PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias; 199 200 int ret = mprotect((void*)seg_page_start, 201 seg_page_end - seg_page_start, 202 PFLAGS_TO_PROT(phdr->p_flags) | extra_prot_flags); 203 if (ret < 0) { 204 return -1; 205 } 206 } 207 return 0; 208 } 209 210 /* Restore the original protection modes for all loadable segments. 211 * You should only call this after phdr_table_unprotect_segments and 212 * applying all relocations. 213 * 214 * Input: 215 * phdr_table -> program header table 216 * phdr_count -> number of entries in tables 217 * load_bias -> load bias 218 * Return: 219 * 0 on error, -1 on failure (error code in errno). 220 */ 221 int phdr_table_protect_segments(const ELF::Phdr* phdr_table, 222 int phdr_count, 223 ELF::Addr load_bias) { 224 return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, 0); 225 } 226 227 /* Change the protection of all loaded segments in memory to writable. 228 * This is useful before performing relocations. Once completed, you 229 * will have to call phdr_table_protect_segments to restore the original 230 * protection flags on all segments. 231 * 232 * Note that some writable segments can also have their content turned 233 * to read-only by calling phdr_table_protect_gnu_relro. This is no 234 * performed here. 235 * 236 * Input: 237 * phdr_table -> program header table 238 * phdr_count -> number of entries in tables 239 * load_bias -> load bias 240 * Return: 241 * 0 on error, -1 on failure (error code in errno). 242 */ 243 int phdr_table_unprotect_segments(const ELF::Phdr* phdr_table, 244 int phdr_count, 245 ELF::Addr load_bias) { 246 return _phdr_table_set_load_prot( 247 phdr_table, phdr_count, load_bias, PROT_WRITE); 248 } 249 250 /* Return the extend of the GNU RELRO segment in a program header. 251 * On success, return 0 and sets |*relro_start| and |*relro_end| 252 * to the page-aligned extents of the RELRO section. 253 * On failure, return -1. 254 * 255 * NOTE: This assumes there is a single PT_GNU_RELRO segment in the 256 * program header, i.e. it will return the extents of the first entry. 257 */ 258 int phdr_table_get_relro_info(const ELF::Phdr* phdr_table, 259 int phdr_count, 260 ELF::Addr load_bias, 261 ELF::Addr* relro_start, 262 ELF::Addr* relro_size) { 263 const ELF::Phdr* phdr; 264 const ELF::Phdr* phdr_limit = phdr_table + phdr_count; 265 266 for (phdr = phdr_table; phdr < phdr_limit; ++phdr) { 267 if (phdr->p_type != PT_GNU_RELRO) 268 continue; 269 270 /* Tricky: what happens when the relro segment does not start 271 * or end at page boundaries?. We're going to be over-protective 272 * here and put every page touched by the segment as read-only. 273 * 274 * This seems to match Ian Lance Taylor's description of the 275 * feature at http://www.airs.com/blog/archives/189. 276 * 277 * Extract: 278 * Note that the current dynamic linker code will only work 279 * correctly if the PT_GNU_RELRO segment starts on a page 280 * boundary. This is because the dynamic linker rounds the 281 * p_vaddr field down to the previous page boundary. If 282 * there is anything on the page which should not be read-only, 283 * the program is likely to fail at runtime. So in effect the 284 * linker must only emit a PT_GNU_RELRO segment if it ensures 285 * that it starts on a page boundary. 286 */ 287 *relro_start = PAGE_START(phdr->p_vaddr) + load_bias; 288 *relro_size = 289 PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias - *relro_start; 290 return 0; 291 } 292 293 return -1; 294 } 295 296 /* Apply GNU relro protection if specified by the program header. This will 297 * turn some of the pages of a writable PT_LOAD segment to read-only, as 298 * specified by one or more PT_GNU_RELRO segments. This must be always 299 * performed after relocations. 300 * 301 * The areas typically covered are .got and .data.rel.ro, these are 302 * read-only from the program's POV, but contain absolute addresses 303 * that need to be relocated before use. 304 * 305 * Input: 306 * phdr_table -> program header table 307 * phdr_count -> number of entries in tables 308 * load_bias -> load bias 309 * Return: 310 * 0 on error, -1 on failure (error code in errno). 311 */ 312 int phdr_table_protect_gnu_relro(const ELF::Phdr* phdr_table, 313 int phdr_count, 314 ELF::Addr load_bias) { 315 ELF::Addr relro_start, relro_size; 316 317 if (phdr_table_get_relro_info( 318 phdr_table, phdr_count, load_bias, &relro_start, &relro_size) < 0) { 319 return -1; 320 } 321 322 return mprotect((void*)relro_start, relro_size, PROT_READ); 323 } 324 325 #ifdef __arm__ 326 327 #ifndef PT_ARM_EXIDX 328 #define PT_ARM_EXIDX 0x70000001 /* .ARM.exidx segment */ 329 #endif 330 331 /* Return the address and size of the .ARM.exidx section in memory, 332 * if present. 333 * 334 * Input: 335 * phdr_table -> program header table 336 * phdr_count -> number of entries in tables 337 * load_bias -> load bias 338 * Output: 339 * arm_exidx -> address of table in memory (NULL on failure). 340 * arm_exidx_count -> number of items in table (0 on failure). 341 * Return: 342 * 0 on error, -1 on failure (_no_ error code in errno) 343 */ 344 int phdr_table_get_arm_exidx(const ELF::Phdr* phdr_table, 345 int phdr_count, 346 ELF::Addr load_bias, 347 ELF::Addr** arm_exidx, 348 unsigned* arm_exidx_count) { 349 const ELF::Phdr* phdr = phdr_table; 350 const ELF::Phdr* phdr_limit = phdr + phdr_count; 351 352 for (phdr = phdr_table; phdr < phdr_limit; phdr++) { 353 if (phdr->p_type != PT_ARM_EXIDX) 354 continue; 355 356 *arm_exidx = (ELF::Addr*)(load_bias + phdr->p_vaddr); 357 *arm_exidx_count = (unsigned)(phdr->p_memsz / 8); 358 return 0; 359 } 360 *arm_exidx = NULL; 361 *arm_exidx_count = 0; 362 return -1; 363 } 364 #endif // __arm__ 365 366 /* Return the address and size of the ELF file's .dynamic section in memory, 367 * or NULL if missing. 368 * 369 * Input: 370 * phdr_table -> program header table 371 * phdr_count -> number of entries in tables 372 * load_bias -> load bias 373 * Output: 374 * dynamic -> address of table in memory (NULL on failure). 375 * dynamic_count -> number of items in table (0 on failure). 376 * dynamic_flags -> protection flags for section (unset on failure) 377 * Return: 378 * void 379 */ 380 void phdr_table_get_dynamic_section(const ELF::Phdr* phdr_table, 381 int phdr_count, 382 ELF::Addr load_bias, 383 const ELF::Dyn** dynamic, 384 size_t* dynamic_count, 385 ELF::Word* dynamic_flags) { 386 const ELF::Phdr* phdr = phdr_table; 387 const ELF::Phdr* phdr_limit = phdr + phdr_count; 388 389 for (phdr = phdr_table; phdr < phdr_limit; phdr++) { 390 if (phdr->p_type != PT_DYNAMIC) { 391 continue; 392 } 393 394 *dynamic = reinterpret_cast<const ELF::Dyn*>(load_bias + phdr->p_vaddr); 395 if (dynamic_count) { 396 *dynamic_count = (unsigned)(phdr->p_memsz / sizeof(ELF::Dyn)); 397 } 398 if (dynamic_flags) { 399 *dynamic_flags = phdr->p_flags; 400 } 401 return; 402 } 403 *dynamic = NULL; 404 if (dynamic_count) { 405 *dynamic_count = 0; 406 } 407 } 408
