1 /*-
2  * Copyright 1996-1998 John D. Polstra.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  *
25  * $FreeBSD$
26  */
27 
28 #include <sys/param.h>
29 #include <sys/mman.h>
30 #include <sys/stat.h>
31 
32 #include <errno.h>
33 #include <stddef.h>
34 #include <stdlib.h>
35 #include <string.h>
36 #include <unistd.h>
37 
38 #include "debug.h"
39 #include "rtld.h"
40 
41 static Elf_Ehdr *get_elf_header (int, const char *);
42 static int convert_prot(int);	/* Elf flags -> mmap protection */
43 static int convert_flags(int); /* Elf flags -> mmap flags */
44 
45 /*
46  * Map a shared object into memory.  The "fd" argument is a file descriptor,
47  * which must be open on the object and positioned at its beginning.
48  * The "path" argument is a pathname that is used only for error messages.
49  *
50  * The return value is a pointer to a newly-allocated Obj_Entry structure
51  * for the shared object.  Returns NULL on failure.
52  */
53 Obj_Entry *
54 map_object(int fd, const char *path, const struct stat *sb)
55 {
56     Obj_Entry *obj;
57     Elf_Ehdr *hdr;
58     int i;
59     Elf_Phdr *phdr;
60     Elf_Phdr *phlimit;
61     Elf_Phdr **segs;
62     int nsegs;
63     Elf_Phdr *phdyn;
64     Elf_Phdr *phinterp;
65     Elf_Phdr *phtls;
66     caddr_t mapbase;
67     size_t mapsize;
68     Elf_Off base_offset;
69     Elf_Addr base_vaddr;
70     Elf_Addr base_vlimit;
71     caddr_t base_addr;
72     Elf_Off data_offset;
73     Elf_Addr data_vaddr;
74     Elf_Addr data_vlimit;
75     caddr_t data_addr;
76     int data_prot;
77     int data_flags;
78     Elf_Addr clear_vaddr;
79     caddr_t clear_addr;
80     caddr_t clear_page;
81     Elf_Addr phdr_vaddr;
82     size_t nclear, phsize;
83     Elf_Addr bss_vaddr;
84     Elf_Addr bss_vlimit;
85     caddr_t bss_addr;
86     Elf_Word stack_flags;
87     Elf_Addr relro_page;
88     size_t relro_size;
89     Elf_Addr note_start;
90     Elf_Addr note_end;
91 
92     hdr = get_elf_header(fd, path);
93     if (hdr == NULL)
94 	return (NULL);
95 
96     /*
97      * Scan the program header entries, and save key information.
98      *
99      * We expect that the loadable segments are ordered by load address.
100      */
101     phdr = (Elf_Phdr *) ((char *)hdr + hdr->e_phoff);
102     phsize  = hdr->e_phnum * sizeof (phdr[0]);
103     phlimit = phdr + hdr->e_phnum;
104     nsegs = -1;
105     phdyn = phinterp = phtls = NULL;
106     phdr_vaddr = 0;
107     relro_page = 0;
108     relro_size = 0;
109     note_start = 0;
110     note_end = 0;
111     segs = alloca(sizeof(segs[0]) * hdr->e_phnum);
112     stack_flags = RTLD_DEFAULT_STACK_PF_EXEC | PF_R | PF_W;
113     while (phdr < phlimit) {
114 	switch (phdr->p_type) {
115 
116 	case PT_INTERP:
117 	    phinterp = phdr;
118 	    break;
119 
120 	case PT_LOAD:
121 	    segs[++nsegs] = phdr;
122     	    if ((segs[nsegs]->p_align & (PAGE_SIZE - 1)) != 0) {
123 		_rtld_error("%s: PT_LOAD segment %d not page-aligned",
124 		    path, nsegs);
125 		return NULL;
126 	    }
127 	    break;
128 
129 	case PT_PHDR:
130 	    phdr_vaddr = phdr->p_vaddr;
131 	    phsize = phdr->p_memsz;
132 	    break;
133 
134 	case PT_DYNAMIC:
135 	    phdyn = phdr;
136 	    break;
137 
138 	case PT_TLS:
139 	    phtls = phdr;
140 	    break;
141 
142 	case PT_GNU_STACK:
143 	    stack_flags = phdr->p_flags;
144 	    break;
145 
146 	case PT_GNU_RELRO:
147 	    relro_page = phdr->p_vaddr;
148 	    relro_size = phdr->p_memsz;
149 	    break;
150 
151 	case PT_NOTE:
152 	    note_start = (Elf_Addr)obj->relocbase + phdr->p_offset;
153 	    note_end = note_start + phdr->p_filesz;
154 	    digest_notes(obj, note_start, note_end);
155 	    break;
156 	}
157 
158 	++phdr;
159     }
160     if (phdyn == NULL) {
161 	_rtld_error("%s: object is not dynamically-linked", path);
162 	return NULL;
163     }
164 
165     if (nsegs < 0) {
166 	_rtld_error("%s: too few PT_LOAD segments", path);
167 	return NULL;
168     }
169 
170     /*
171      * Map the entire address space of the object, to stake out our
172      * contiguous region, and to establish the base address for relocation.
173      */
174     base_offset = trunc_page(segs[0]->p_offset);
175     base_vaddr = trunc_page(segs[0]->p_vaddr);
176     base_vlimit = round_page(segs[nsegs]->p_vaddr + segs[nsegs]->p_memsz);
177     mapsize = base_vlimit - base_vaddr;
178     base_addr = hdr->e_type == ET_EXEC ? (caddr_t) base_vaddr : NULL;
179 
180     mapbase = mmap(base_addr, mapsize, PROT_NONE, MAP_ANON | MAP_PRIVATE |
181       MAP_NOCORE, -1, 0);
182     if (mapbase == (caddr_t) -1) {
183 	_rtld_error("%s: mmap of entire address space failed: %s",
184 	  path, strerror(errno));
185 	return NULL;
186     }
187     if (base_addr != NULL && mapbase != base_addr) {
188 	_rtld_error("%s: mmap returned wrong address: wanted %p, got %p",
189 	  path, base_addr, mapbase);
190 	munmap(mapbase, mapsize);
191 	return NULL;
192     }
193 
194     for (i = 0; i <= nsegs; i++) {
195 	/* Overlay the segment onto the proper region. */
196 	data_offset = trunc_page(segs[i]->p_offset);
197 	data_vaddr = trunc_page(segs[i]->p_vaddr);
198 	data_vlimit = round_page(segs[i]->p_vaddr + segs[i]->p_filesz);
199 	data_addr = mapbase + (data_vaddr - base_vaddr);
200 	data_prot = convert_prot(segs[i]->p_flags);
201 	data_flags = convert_flags(segs[i]->p_flags) | MAP_FIXED;
202 	if (mmap(data_addr, data_vlimit - data_vaddr, data_prot,
203 	  data_flags, fd, data_offset) == (caddr_t) -1) {
204 	    _rtld_error("%s: mmap of data failed: %s", path, strerror(errno));
205 	    return NULL;
206 	}
207 
208 	/* Do BSS setup */
209 	if (segs[i]->p_filesz != segs[i]->p_memsz) {
210 
211 	    /* Clear any BSS in the last page of the segment. */
212 	    clear_vaddr = segs[i]->p_vaddr + segs[i]->p_filesz;
213 	    clear_addr = mapbase + (clear_vaddr - base_vaddr);
214 	    clear_page = mapbase + (trunc_page(clear_vaddr) - base_vaddr);
215 
216 	    if ((nclear = data_vlimit - clear_vaddr) > 0) {
217 		/* Make sure the end of the segment is writable */
218 		if ((data_prot & PROT_WRITE) == 0 && -1 ==
219 		     mprotect(clear_page, PAGE_SIZE, data_prot|PROT_WRITE)) {
220 			_rtld_error("%s: mprotect failed: %s", path,
221 			    strerror(errno));
222 			return NULL;
223 		}
224 
225 		memset(clear_addr, 0, nclear);
226 
227 		/* Reset the data protection back */
228 		if ((data_prot & PROT_WRITE) == 0)
229 		    mprotect(clear_page, PAGE_SIZE, data_prot);
230 	    }
231 
232 	    /* Overlay the BSS segment onto the proper region. */
233 	    bss_vaddr = data_vlimit;
234 	    bss_vlimit = round_page(segs[i]->p_vaddr + segs[i]->p_memsz);
235 	    bss_addr = mapbase +  (bss_vaddr - base_vaddr);
236 	    if (bss_vlimit > bss_vaddr) {	/* There is something to do */
237 		if (mmap(bss_addr, bss_vlimit - bss_vaddr, data_prot,
238 		    data_flags | MAP_ANON, -1, 0) == (caddr_t)-1) {
239 		    _rtld_error("%s: mmap of bss failed: %s", path,
240 			strerror(errno));
241 		    return NULL;
242 		}
243 	    }
244 	}
245 
246 	if (phdr_vaddr == 0 && data_offset <= hdr->e_phoff &&
247 	  (data_vlimit - data_vaddr + data_offset) >=
248 	  (hdr->e_phoff + hdr->e_phnum * sizeof (Elf_Phdr))) {
249 	    phdr_vaddr = data_vaddr + hdr->e_phoff - data_offset;
250 	}
251     }
252 
253     obj = obj_new();
254     if (sb != NULL) {
255 	obj->dev = sb->st_dev;
256 	obj->ino = sb->st_ino;
257     }
258     obj->mapbase = mapbase;
259     obj->mapsize = mapsize;
260     obj->textsize = round_page(segs[0]->p_vaddr + segs[0]->p_memsz) -
261       base_vaddr;
262     obj->vaddrbase = base_vaddr;
263     obj->relocbase = mapbase - base_vaddr;
264     obj->dynamic = (const Elf_Dyn *) (obj->relocbase + phdyn->p_vaddr);
265     if (hdr->e_entry != 0)
266 	obj->entry = (caddr_t) (obj->relocbase + hdr->e_entry);
267     if (phdr_vaddr != 0) {
268 	obj->phdr = (const Elf_Phdr *) (obj->relocbase + phdr_vaddr);
269     } else {
270 	obj->phdr = malloc(phsize);
271 	if (obj->phdr == NULL) {
272 	    obj_free(obj);
273 	    _rtld_error("%s: cannot allocate program header", path);
274 	     return NULL;
275 	}
276 	memcpy((char *)obj->phdr, (char *)hdr + hdr->e_phoff, phsize);
277 	obj->phdr_alloc = true;
278     }
279     obj->phsize = phsize;
280     if (phinterp != NULL)
281 	obj->interp = (const char *) (obj->relocbase + phinterp->p_vaddr);
282     if (phtls != NULL) {
283 	tls_dtv_generation++;
284 	obj->tlsindex = ++tls_max_index;
285 	obj->tlssize = phtls->p_memsz;
286 	obj->tlsalign = phtls->p_align;
287 	obj->tlsinitsize = phtls->p_filesz;
288 	obj->tlsinit = mapbase + phtls->p_vaddr;
289     }
290     obj->stack_flags = stack_flags;
291     obj->relro_page = obj->relocbase + trunc_page(relro_page);
292     obj->relro_size = round_page(relro_size);
293 
294     return obj;
295 }
296 
297 static Elf_Ehdr *
298 get_elf_header (int fd, const char *path)
299 {
300     static union {
301 	Elf_Ehdr hdr;
302 	char buf[PAGE_SIZE];
303     } u;
304     ssize_t nbytes;
305 
306     if ((nbytes = pread(fd, u.buf, PAGE_SIZE, 0)) == -1) {
307 	_rtld_error("%s: read error: %s", path, strerror(errno));
308 	return NULL;
309     }
310 
311     /* Make sure the file is valid */
312     if (nbytes < (ssize_t)sizeof(Elf_Ehdr) || !IS_ELF(u.hdr)) {
313 	_rtld_error("%s: invalid file format", path);
314 	return NULL;
315     }
316     if (u.hdr.e_ident[EI_CLASS] != ELF_TARG_CLASS
317       || u.hdr.e_ident[EI_DATA] != ELF_TARG_DATA) {
318 	_rtld_error("%s: unsupported file layout", path);
319 	return NULL;
320     }
321     if (u.hdr.e_ident[EI_VERSION] != EV_CURRENT
322       || u.hdr.e_version != EV_CURRENT) {
323 	_rtld_error("%s: unsupported file version", path);
324 	return NULL;
325     }
326     if (u.hdr.e_type != ET_EXEC && u.hdr.e_type != ET_DYN) {
327 	_rtld_error("%s: unsupported file type", path);
328 	return NULL;
329     }
330     if (u.hdr.e_machine != ELF_TARG_MACH) {
331 	_rtld_error("%s: unsupported machine", path);
332 	return NULL;
333     }
334 
335     /*
336      * We rely on the program header being in the first page.  This is
337      * not strictly required by the ABI specification, but it seems to
338      * always true in practice.  And, it simplifies things considerably.
339      */
340     if (u.hdr.e_phentsize != sizeof(Elf_Phdr)) {
341 	_rtld_error(
342 	  "%s: invalid shared object: e_phentsize != sizeof(Elf_Phdr)", path);
343 	return NULL;
344     }
345     if (u.hdr.e_phoff + u.hdr.e_phnum * sizeof(Elf_Phdr) > (size_t)nbytes) {
346 	_rtld_error("%s: program header too large", path);
347 	return NULL;
348     }
349 
350     return (&u.hdr);
351 }
352 
353 void
354 obj_free(Obj_Entry *obj)
355 {
356     Objlist_Entry *elm;
357 
358     if (obj->tls_done)
359 	free_tls_offset(obj);
360     while (obj->needed != NULL) {
361 	Needed_Entry *needed = obj->needed;
362 	obj->needed = needed->next;
363 	free(needed);
364     }
365     while (!STAILQ_EMPTY(&obj->names)) {
366 	Name_Entry *entry = STAILQ_FIRST(&obj->names);
367 	STAILQ_REMOVE_HEAD(&obj->names, link);
368 	free(entry);
369     }
370     while (!STAILQ_EMPTY(&obj->dldags)) {
371 	elm = STAILQ_FIRST(&obj->dldags);
372 	STAILQ_REMOVE_HEAD(&obj->dldags, link);
373 	free(elm);
374     }
375     while (!STAILQ_EMPTY(&obj->dagmembers)) {
376 	elm = STAILQ_FIRST(&obj->dagmembers);
377 	STAILQ_REMOVE_HEAD(&obj->dagmembers, link);
378 	free(elm);
379     }
380     if (obj->vertab)
381 	free(obj->vertab);
382     if (obj->origin_path)
383 	free(obj->origin_path);
384     if (obj->z_origin)
385 	free(obj->rpath);
386     if (obj->priv)
387 	free(obj->priv);
388     if (obj->path)
389 	free(obj->path);
390     if (obj->phdr_alloc)
391 	free((void *)obj->phdr);
392     free(obj);
393 }
394 
395 Obj_Entry *
396 obj_new(void)
397 {
398     Obj_Entry *obj;
399 
400     obj = CNEW(Obj_Entry);
401     STAILQ_INIT(&obj->dldags);
402     STAILQ_INIT(&obj->dagmembers);
403     STAILQ_INIT(&obj->names);
404     return obj;
405 }
406 
407 /*
408  * Given a set of ELF protection flags, return the corresponding protection
409  * flags for MMAP.
410  */
411 static int
412 convert_prot(int elfflags)
413 {
414     int prot = 0;
415     if (elfflags & PF_R)
416 	prot |= PROT_READ;
417     if (elfflags & PF_W)
418 	prot |= PROT_WRITE;
419     if (elfflags & PF_X)
420 	prot |= PROT_EXEC;
421     return prot;
422 }
423 
424 static int
425 convert_flags(int elfflags)
426 {
427     int flags = MAP_PRIVATE; /* All mappings are private */
428 
429     /*
430      * Readonly mappings are marked "MAP_NOCORE", because they can be
431      * reconstructed by a debugger.
432      */
433     if (!(elfflags & PF_W))
434 	flags |= MAP_NOCORE;
435     return flags;
436 }
437