DynamicLoader.cpp 25 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689
  1. /*
  2. * Copyright (c) 2019-2020, Andrew Kaster <akaster@serenityos.org>
  3. * Copyright (c) 2020, Itamar S. <itamar8910@gmail.com>
  4. * Copyright (c) 2021, Andreas Kling <kling@serenityos.org>
  5. * Copyright (c) 2022, Daniel Bertalan <dani@danielbertalan.dev>
  6. *
  7. * SPDX-License-Identifier: BSD-2-Clause
  8. */
  9. #include <AK/Debug.h>
  10. #include <AK/Optional.h>
  11. #include <AK/QuickSort.h>
  12. #include <AK/StringBuilder.h>
  13. #include <LibDl/dlfcn.h>
  14. #include <LibDl/dlfcn_integration.h>
  15. #include <LibELF/DynamicLinker.h>
  16. #include <LibELF/DynamicLoader.h>
  17. #include <LibELF/Hashes.h>
  18. #include <LibELF/Validation.h>
  19. #include <assert.h>
  20. #include <errno.h>
  21. #include <stdio.h>
  22. #include <stdlib.h>
  23. #include <string.h>
  24. #include <sys/mman.h>
  25. #include <sys/stat.h>
  26. #include <unistd.h>
  27. #ifndef __serenity__
  28. static void* mmap_with_name(void* addr, size_t length, int prot, int flags, int fd, off_t offset, char const*)
  29. {
  30. return mmap(addr, length, prot, flags, fd, offset);
  31. }
  32. # define MAP_RANDOMIZED 0
  33. #endif
  34. namespace ELF {
  35. Result<NonnullRefPtr<DynamicLoader>, DlErrorMessage> DynamicLoader::try_create(int fd, String filename)
  36. {
  37. struct stat stat;
  38. if (fstat(fd, &stat) < 0) {
  39. return DlErrorMessage { "DynamicLoader::try_create fstat" };
  40. }
  41. VERIFY(stat.st_size >= 0);
  42. auto size = static_cast<size_t>(stat.st_size);
  43. if (size < sizeof(ElfW(Ehdr)))
  44. return DlErrorMessage { String::formatted("File {} has invalid ELF header", filename) };
  45. String file_mmap_name = String::formatted("ELF_DYN: {}", filename);
  46. auto* data = mmap_with_name(nullptr, size, PROT_READ, MAP_SHARED, fd, 0, file_mmap_name.characters());
  47. if (data == MAP_FAILED) {
  48. return DlErrorMessage { "DynamicLoader::try_create mmap" };
  49. }
  50. auto loader = adopt_ref(*new DynamicLoader(fd, move(filename), data, size));
  51. if (!loader->is_valid())
  52. return DlErrorMessage { "ELF image validation failed" };
  53. return loader;
  54. }
  55. DynamicLoader::DynamicLoader(int fd, String filename, void* data, size_t size)
  56. : m_filename(move(filename))
  57. , m_file_size(size)
  58. , m_image_fd(fd)
  59. , m_file_data(data)
  60. , m_elf_image((u8*)m_file_data, m_file_size)
  61. {
  62. m_valid = validate();
  63. if (m_valid)
  64. m_tls_size_of_current_object = calculate_tls_size();
  65. else
  66. dbgln("Image validation failed for file {}", m_filename);
  67. }
  68. DynamicLoader::~DynamicLoader()
  69. {
  70. if (munmap(m_file_data, m_file_size) < 0) {
  71. perror("munmap");
  72. VERIFY_NOT_REACHED();
  73. }
  74. if (close(m_image_fd) < 0) {
  75. perror("close");
  76. VERIFY_NOT_REACHED();
  77. }
  78. }
  79. DynamicObject const& DynamicLoader::dynamic_object() const
  80. {
  81. if (!m_cached_dynamic_object) {
  82. VirtualAddress dynamic_section_address;
  83. m_elf_image.for_each_program_header([&dynamic_section_address](auto program_header) {
  84. if (program_header.type() == PT_DYNAMIC) {
  85. dynamic_section_address = VirtualAddress(program_header.raw_data());
  86. }
  87. });
  88. VERIFY(!dynamic_section_address.is_null());
  89. m_cached_dynamic_object = ELF::DynamicObject::create(m_filename, VirtualAddress(m_elf_image.base_address()), dynamic_section_address);
  90. }
  91. return *m_cached_dynamic_object;
  92. }
  93. size_t DynamicLoader::calculate_tls_size() const
  94. {
  95. size_t tls_size = 0;
  96. m_elf_image.for_each_program_header([&tls_size](auto program_header) {
  97. if (program_header.type() == PT_TLS) {
  98. tls_size = program_header.size_in_memory();
  99. }
  100. });
  101. return tls_size;
  102. }
  103. bool DynamicLoader::validate()
  104. {
  105. if (!m_elf_image.is_valid())
  106. return false;
  107. auto* elf_header = (ElfW(Ehdr)*)m_file_data;
  108. if (!validate_elf_header(*elf_header, m_file_size))
  109. return false;
  110. auto result_or_error = validate_program_headers(*elf_header, m_file_size, { m_file_data, m_file_size });
  111. if (result_or_error.is_error() || !result_or_error.value())
  112. return false;
  113. return true;
  114. }
  115. RefPtr<DynamicObject> DynamicLoader::map()
  116. {
  117. if (m_dynamic_object) {
  118. // Already mapped.
  119. return nullptr;
  120. }
  121. if (!m_valid) {
  122. dbgln("DynamicLoader::map failed: image is invalid");
  123. return nullptr;
  124. }
  125. load_program_headers();
  126. VERIFY(!m_base_address.is_null());
  127. m_dynamic_object = DynamicObject::create(m_filename, m_base_address, m_dynamic_section_address);
  128. m_dynamic_object->set_tls_offset(m_tls_offset);
  129. m_dynamic_object->set_tls_size(m_tls_size_of_current_object);
  130. return m_dynamic_object;
  131. }
  132. bool DynamicLoader::link(unsigned flags)
  133. {
  134. return load_stage_2(flags);
  135. }
  136. bool DynamicLoader::load_stage_2(unsigned flags)
  137. {
  138. VERIFY(flags & RTLD_GLOBAL);
  139. if (m_dynamic_object->has_text_relocations()) {
  140. dbgln("\033[33mWarning:\033[0m Dynamic object {} has text relocations", m_dynamic_object->filename());
  141. for (auto& text_segment : m_text_segments) {
  142. VERIFY(text_segment.address().get() != 0);
  143. #ifndef AK_OS_MACOS
  144. // Remap this text region as private.
  145. if (mremap(text_segment.address().as_ptr(), text_segment.size(), text_segment.size(), MAP_PRIVATE) == MAP_FAILED) {
  146. perror("mremap .text: MAP_PRIVATE");
  147. return false;
  148. }
  149. #endif
  150. if (0 > mprotect(text_segment.address().as_ptr(), text_segment.size(), PROT_READ | PROT_WRITE)) {
  151. perror("mprotect .text: PROT_READ | PROT_WRITE"); // FIXME: dlerror?
  152. return false;
  153. }
  154. }
  155. } else {
  156. // .text needs to be executable while we process relocations because it might contain IFUNC resolvers.
  157. // We don't allow IFUNC resolvers in objects with textrels.
  158. for (auto& text_segment : m_text_segments) {
  159. if (mprotect(text_segment.address().as_ptr(), text_segment.size(), PROT_READ | PROT_EXEC) < 0) {
  160. perror("mprotect .text: PROT_READ | PROT_EXEC");
  161. return false;
  162. }
  163. }
  164. }
  165. do_main_relocations();
  166. return true;
  167. }
  168. void DynamicLoader::do_main_relocations()
  169. {
  170. auto do_single_relocation = [&](const ELF::DynamicObject::Relocation& relocation) {
  171. switch (do_relocation(relocation, ShouldInitializeWeak::No)) {
  172. case RelocationResult::Failed:
  173. dbgln("Loader.so: {} unresolved symbol '{}'", m_filename, relocation.symbol().name());
  174. VERIFY_NOT_REACHED();
  175. case RelocationResult::ResolveLater:
  176. m_unresolved_relocations.append(relocation);
  177. break;
  178. case RelocationResult::Success:
  179. break;
  180. }
  181. };
  182. do_relr_relocations();
  183. m_dynamic_object->relocation_section().for_each_relocation(do_single_relocation);
  184. m_dynamic_object->plt_relocation_section().for_each_relocation(do_single_relocation);
  185. }
  186. Result<NonnullRefPtr<DynamicObject>, DlErrorMessage> DynamicLoader::load_stage_3(unsigned flags)
  187. {
  188. do_lazy_relocations();
  189. if (flags & RTLD_LAZY) {
  190. if (m_dynamic_object->has_plt())
  191. setup_plt_trampoline();
  192. }
  193. if (m_dynamic_object->has_text_relocations()) {
  194. // If we don't have textrels, .text has already been made executable by this point in load_stage_2.
  195. for (auto& text_segment : m_text_segments) {
  196. if (mprotect(text_segment.address().as_ptr(), text_segment.size(), PROT_READ | PROT_EXEC) < 0) {
  197. return DlErrorMessage { String::formatted("mprotect .text: PROT_READ | PROT_EXEC: {}", strerror(errno)) };
  198. }
  199. }
  200. }
  201. if (m_relro_segment_size) {
  202. if (mprotect(m_relro_segment_address.as_ptr(), m_relro_segment_size, PROT_READ) < 0) {
  203. return DlErrorMessage { String::formatted("mprotect .relro: PROT_READ: {}", strerror(errno)) };
  204. }
  205. #ifdef __serenity__
  206. if (set_mmap_name(m_relro_segment_address.as_ptr(), m_relro_segment_size, String::formatted("{}: .relro", m_filename).characters()) < 0) {
  207. return DlErrorMessage { String::formatted("set_mmap_name .relro: {}", strerror(errno)) };
  208. }
  209. #endif
  210. }
  211. return NonnullRefPtr<DynamicObject> { *m_dynamic_object };
  212. }
  213. void DynamicLoader::load_stage_4()
  214. {
  215. call_object_init_functions();
  216. }
  217. void DynamicLoader::do_lazy_relocations()
  218. {
  219. for (auto const& relocation : m_unresolved_relocations) {
  220. if (auto res = do_relocation(relocation, ShouldInitializeWeak::Yes); res != RelocationResult::Success) {
  221. dbgln("Loader.so: {} unresolved symbol '{}'", m_filename, relocation.symbol().name());
  222. VERIFY_NOT_REACHED();
  223. }
  224. }
  225. }
  226. void DynamicLoader::load_program_headers()
  227. {
  228. Vector<ProgramHeaderRegion> load_regions;
  229. Vector<ProgramHeaderRegion> map_regions;
  230. Vector<ProgramHeaderRegion> copy_regions;
  231. Optional<ProgramHeaderRegion> tls_region;
  232. Optional<ProgramHeaderRegion> relro_region;
  233. VirtualAddress dynamic_region_desired_vaddr;
  234. m_elf_image.for_each_program_header([&](Image::ProgramHeader const& program_header) {
  235. ProgramHeaderRegion region {};
  236. region.set_program_header(program_header.raw_header());
  237. if (region.is_tls_template()) {
  238. VERIFY(!tls_region.has_value());
  239. tls_region = region;
  240. } else if (region.is_load()) {
  241. if (region.size_in_memory() == 0)
  242. return;
  243. load_regions.append(region);
  244. if (region.is_writable()) {
  245. copy_regions.append(region);
  246. } else {
  247. map_regions.append(region);
  248. }
  249. } else if (region.is_dynamic()) {
  250. dynamic_region_desired_vaddr = region.desired_load_address();
  251. } else if (region.is_relro()) {
  252. VERIFY(!relro_region.has_value());
  253. relro_region = region;
  254. }
  255. });
  256. VERIFY(!map_regions.is_empty() || !copy_regions.is_empty());
  257. auto compare_load_address = [](ProgramHeaderRegion& a, ProgramHeaderRegion& b) {
  258. return a.desired_load_address().as_ptr() < b.desired_load_address().as_ptr();
  259. };
  260. quick_sort(load_regions, compare_load_address);
  261. quick_sort(map_regions, compare_load_address);
  262. quick_sort(copy_regions, compare_load_address);
  263. // Process regions in order: .text, .data, .tls
  264. void* requested_load_address = m_elf_image.is_dynamic() ? nullptr : load_regions.first().desired_load_address().as_ptr();
  265. int reservation_mmap_flags = MAP_ANON | MAP_PRIVATE | MAP_NORESERVE;
  266. if (m_elf_image.is_dynamic())
  267. reservation_mmap_flags |= MAP_RANDOMIZED;
  268. #ifdef MAP_FIXED_NOREPLACE
  269. else
  270. reservation_mmap_flags |= MAP_FIXED_NOREPLACE;
  271. #endif
  272. // First, we make a dummy reservation mapping, in order to allocate enough VM
  273. // to hold all regions contiguously in the address space.
  274. FlatPtr ph_load_base = load_regions.first().desired_load_address().page_base().get();
  275. FlatPtr ph_load_end = round_up_to_power_of_two(load_regions.last().desired_load_address().offset(load_regions.last().size_in_memory()).get(), PAGE_SIZE);
  276. size_t total_mapping_size = ph_load_end - ph_load_base;
  277. auto* reservation = mmap(requested_load_address, total_mapping_size, PROT_NONE, reservation_mmap_flags, 0, 0);
  278. if (reservation == MAP_FAILED) {
  279. perror("mmap reservation");
  280. VERIFY_NOT_REACHED();
  281. }
  282. VERIFY(requested_load_address == nullptr || reservation == requested_load_address);
  283. m_base_address = VirtualAddress { reservation };
  284. // Then we unmap the reservation.
  285. if (munmap(reservation, total_mapping_size) < 0) {
  286. perror("munmap reservation");
  287. VERIFY_NOT_REACHED();
  288. }
  289. for (auto& region : map_regions) {
  290. FlatPtr ph_desired_base = region.desired_load_address().get();
  291. FlatPtr ph_base = region.desired_load_address().page_base().get();
  292. FlatPtr ph_end = ph_base + round_up_to_power_of_two(region.size_in_memory() + region.desired_load_address().get() - ph_base, PAGE_SIZE);
  293. StringBuilder builder;
  294. builder.append(m_filename);
  295. if (region.is_executable())
  296. builder.append(": .text");
  297. else
  298. builder.append(": .rodata");
  299. // Now we can map the text segment at the reserved address.
  300. auto* segment_base = (u8*)mmap_with_name(
  301. (u8*)reservation + ph_base - ph_load_base,
  302. ph_desired_base - ph_base + region.size_in_image(),
  303. PROT_READ,
  304. MAP_FILE | MAP_SHARED | MAP_FIXED,
  305. m_image_fd,
  306. VirtualAddress { region.offset() }.page_base().get(),
  307. builder.to_string().characters());
  308. if (segment_base == MAP_FAILED) {
  309. perror("mmap non-writable");
  310. VERIFY_NOT_REACHED();
  311. }
  312. if (region.is_executable())
  313. m_text_segments.append({ VirtualAddress { segment_base }, ph_end - ph_base });
  314. }
  315. VERIFY(requested_load_address == nullptr || requested_load_address == reservation);
  316. if (relro_region.has_value()) {
  317. m_relro_segment_size = relro_region->size_in_memory();
  318. m_relro_segment_address = VirtualAddress { (u8*)reservation + relro_region->desired_load_address().get() - ph_load_base };
  319. }
  320. if (m_elf_image.is_dynamic())
  321. m_dynamic_section_address = VirtualAddress { (u8*)reservation + dynamic_region_desired_vaddr.get() - ph_load_base };
  322. else
  323. m_dynamic_section_address = dynamic_region_desired_vaddr;
  324. for (auto& region : copy_regions) {
  325. FlatPtr ph_data_base = region.desired_load_address().page_base().get();
  326. FlatPtr ph_data_end = ph_data_base + round_up_to_power_of_two(region.size_in_memory() + region.desired_load_address().get() - ph_data_base, PAGE_SIZE);
  327. auto* data_segment_address = (u8*)reservation + ph_data_base - ph_load_base;
  328. size_t data_segment_size = ph_data_end - ph_data_base;
  329. // Finally, we make an anonymous mapping for the data segment. Contents are then copied from the file.
  330. auto* data_segment = (u8*)mmap_with_name(
  331. data_segment_address,
  332. data_segment_size,
  333. PROT_READ | PROT_WRITE,
  334. MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED,
  335. 0,
  336. 0,
  337. String::formatted("{}: .data", m_filename).characters());
  338. if (MAP_FAILED == data_segment) {
  339. perror("mmap writable");
  340. VERIFY_NOT_REACHED();
  341. }
  342. VirtualAddress data_segment_start;
  343. if (m_elf_image.is_dynamic())
  344. data_segment_start = VirtualAddress { (u8*)reservation + region.desired_load_address().get() };
  345. else
  346. data_segment_start = region.desired_load_address();
  347. VERIFY(data_segment_start.as_ptr() + region.size_in_memory() <= data_segment + data_segment_size);
  348. memcpy(data_segment_start.as_ptr(), (u8*)m_file_data + region.offset(), region.size_in_image());
  349. }
  350. // FIXME: Initialize the values in the TLS section. Currently, it is zeroed.
  351. }
  352. DynamicLoader::RelocationResult DynamicLoader::do_relocation(const ELF::DynamicObject::Relocation& relocation, ShouldInitializeWeak should_initialize_weak)
  353. {
  354. FlatPtr* patch_ptr = nullptr;
  355. if (is_dynamic())
  356. patch_ptr = (FlatPtr*)(m_dynamic_object->base_address().as_ptr() + relocation.offset());
  357. else
  358. patch_ptr = (FlatPtr*)(FlatPtr)relocation.offset();
  359. auto call_ifunc_resolver = [](VirtualAddress address) {
  360. return VirtualAddress { reinterpret_cast<DynamicObject::IfuncResolver>(address.get())() };
  361. };
  362. switch (relocation.type()) {
  363. #if ARCH(I386)
  364. case R_386_NONE:
  365. #else
  366. case R_X86_64_NONE:
  367. #endif
  368. // Apparently most loaders will just skip these?
  369. // Seems if the 'link editor' generates one something is funky with your code
  370. break;
  371. #if ARCH(I386)
  372. case R_386_32: {
  373. #else
  374. case R_X86_64_64: {
  375. #endif
  376. auto symbol = relocation.symbol();
  377. auto res = lookup_symbol(symbol);
  378. if (!res.has_value()) {
  379. if (symbol.bind() == STB_WEAK)
  380. return RelocationResult::ResolveLater;
  381. dbgln("ERROR: symbol not found: {}.", symbol.name());
  382. return RelocationResult::Failed;
  383. }
  384. auto symbol_address = res.value().address;
  385. if (relocation.addend_used())
  386. *patch_ptr = symbol_address.get() + relocation.addend();
  387. else
  388. *patch_ptr += symbol_address.get();
  389. if (res.value().type == STT_GNU_IFUNC)
  390. *patch_ptr = call_ifunc_resolver(VirtualAddress { *patch_ptr }).get();
  391. break;
  392. }
  393. #if ARCH(I386)
  394. case R_386_PC32: {
  395. auto symbol = relocation.symbol();
  396. auto result = lookup_symbol(symbol);
  397. if (!result.has_value())
  398. return RelocationResult::Failed;
  399. auto relative_offset = result.value().address - m_dynamic_object->base_address().offset(relocation.offset());
  400. *patch_ptr += relative_offset.get();
  401. break;
  402. }
  403. case R_386_GLOB_DAT: {
  404. #else
  405. case R_X86_64_GLOB_DAT: {
  406. #endif
  407. auto symbol = relocation.symbol();
  408. auto res = lookup_symbol(symbol);
  409. VirtualAddress symbol_location;
  410. if (!res.has_value()) {
  411. if (symbol.bind() == STB_WEAK) {
  412. if (should_initialize_weak == ShouldInitializeWeak::No)
  413. return RelocationResult::ResolveLater;
  414. } else {
  415. // Symbol not found
  416. return RelocationResult::Failed;
  417. }
  418. symbol_location = VirtualAddress { (FlatPtr)0 };
  419. } else {
  420. symbol_location = res.value().address;
  421. if (res.value().type == STT_GNU_IFUNC) {
  422. if (res.value().dynamic_object != nullptr && res.value().dynamic_object->has_text_relocations()) {
  423. dbgln("\033[31mError:\033[0m Refusing to call IFUNC resolver defined in an object with text relocations.");
  424. return RelocationResult::Failed;
  425. }
  426. symbol_location = call_ifunc_resolver(symbol_location);
  427. }
  428. }
  429. VERIFY(symbol_location != m_dynamic_object->base_address());
  430. *patch_ptr = symbol_location.get();
  431. break;
  432. }
  433. #if ARCH(I386)
  434. case R_386_RELATIVE: {
  435. #else
  436. case R_X86_64_RELATIVE: {
  437. #endif
  438. // FIXME: According to the spec, R_386_relative ones must be done first.
  439. // We could explicitly do them first using m_number_of_relocations from DT_RELCOUNT
  440. // However, our compiler is nice enough to put them at the front of the relocations for us :)
  441. if (relocation.addend_used())
  442. *patch_ptr = m_dynamic_object->base_address().offset(relocation.addend()).get();
  443. else
  444. *patch_ptr += m_dynamic_object->base_address().get();
  445. break;
  446. }
  447. #if ARCH(I386)
  448. case R_386_TLS_TPOFF32:
  449. case R_386_TLS_TPOFF: {
  450. #else
  451. case R_X86_64_TPOFF64: {
  452. #endif
  453. auto symbol = relocation.symbol();
  454. FlatPtr symbol_value;
  455. DynamicObject const* dynamic_object_of_symbol;
  456. if (relocation.symbol_index() != 0) {
  457. auto res = lookup_symbol(symbol);
  458. if (!res.has_value())
  459. break;
  460. VERIFY(symbol.type() != STT_GNU_IFUNC);
  461. symbol_value = res.value().value;
  462. dynamic_object_of_symbol = res.value().dynamic_object;
  463. } else {
  464. symbol_value = 0;
  465. dynamic_object_of_symbol = &relocation.dynamic_object();
  466. }
  467. VERIFY(dynamic_object_of_symbol);
  468. size_t addend = relocation.addend_used() ? relocation.addend() : *patch_ptr;
  469. *patch_ptr = negative_offset_from_tls_block_end(dynamic_object_of_symbol->tls_offset().value(), symbol_value + addend);
  470. break;
  471. }
  472. #if ARCH(I386)
  473. case R_386_JMP_SLOT: {
  474. #else
  475. case R_X86_64_JUMP_SLOT: {
  476. #endif
  477. // FIXME: Or BIND_NOW flag passed in?
  478. if (m_dynamic_object->must_bind_now()) {
  479. // Eagerly BIND_NOW the PLT entries, doing all the symbol looking goodness
  480. // The patch method returns the address for the LAZY fixup path, but we don't need it here
  481. m_dynamic_object->patch_plt_entry(relocation.offset_in_section());
  482. } else {
  483. auto relocation_address = (FlatPtr*)relocation.address().as_ptr();
  484. if (m_elf_image.is_dynamic())
  485. *relocation_address += m_dynamic_object->base_address().get();
  486. }
  487. break;
  488. }
  489. #if ARCH(I386)
  490. case R_386_IRELATIVE: {
  491. #else
  492. case R_X86_64_IRELATIVE: {
  493. #endif
  494. VirtualAddress resolver;
  495. if (relocation.addend_used())
  496. resolver = m_dynamic_object->base_address().offset(relocation.addend());
  497. else
  498. resolver = m_dynamic_object->base_address().offset(*patch_ptr);
  499. if (m_dynamic_object->has_text_relocations()) {
  500. dbgln("\033[31mError:\033[0m Refusing to call IFUNC resolver defined in an object with text relocations.");
  501. return RelocationResult::Failed;
  502. }
  503. *patch_ptr = call_ifunc_resolver(resolver).get();
  504. break;
  505. }
  506. default:
  507. // Raise the alarm! Someone needs to implement this relocation type
  508. dbgln("Found a new exciting relocation type {}", relocation.type());
  509. VERIFY_NOT_REACHED();
  510. }
  511. return RelocationResult::Success;
  512. }
  513. void DynamicLoader::do_relr_relocations()
  514. {
  515. auto base_address = m_dynamic_object->base_address().get();
  516. m_dynamic_object->for_each_relr_relocation([base_address](FlatPtr address) {
  517. *(FlatPtr*)address += base_address;
  518. });
  519. }
  520. ssize_t DynamicLoader::negative_offset_from_tls_block_end(ssize_t tls_offset, size_t value_of_symbol) const
  521. {
  522. ssize_t offset = static_cast<ssize_t>(tls_offset + value_of_symbol);
  523. // At offset 0 there's the thread's ThreadSpecificData structure, we don't want to collide with it.
  524. VERIFY(offset < 0);
  525. return offset;
  526. }
  527. void DynamicLoader::copy_initial_tls_data_into(ByteBuffer& buffer) const
  528. {
  529. u8 const* tls_data = nullptr;
  530. size_t tls_size_in_image = 0;
  531. m_elf_image.for_each_program_header([this, &tls_data, &tls_size_in_image](ELF::Image::ProgramHeader program_header) {
  532. if (program_header.type() != PT_TLS)
  533. return IterationDecision::Continue;
  534. tls_data = (const u8*)m_file_data + program_header.offset();
  535. tls_size_in_image = program_header.size_in_image();
  536. return IterationDecision::Break;
  537. });
  538. if (!tls_data || !tls_size_in_image)
  539. return;
  540. m_elf_image.for_each_symbol([this, &buffer, tls_data](ELF::Image::Symbol symbol) {
  541. if (symbol.type() != STT_TLS)
  542. return IterationDecision::Continue;
  543. ssize_t negative_offset = negative_offset_from_tls_block_end(m_tls_offset, symbol.value());
  544. VERIFY(symbol.size() != 0);
  545. VERIFY(buffer.size() + negative_offset + symbol.size() <= buffer.size());
  546. memcpy(buffer.data() + buffer.size() + negative_offset, tls_data + symbol.value(), symbol.size());
  547. return IterationDecision::Continue;
  548. });
  549. }
  550. // Defined in <arch>/plt_trampoline.S
  551. extern "C" void _plt_trampoline(void) __attribute__((visibility("hidden")));
  552. void DynamicLoader::setup_plt_trampoline()
  553. {
  554. VERIFY(m_dynamic_object);
  555. VERIFY(m_dynamic_object->has_plt());
  556. VirtualAddress got_address = m_dynamic_object->plt_got_base_address();
  557. auto* got_ptr = (FlatPtr*)got_address.as_ptr();
  558. got_ptr[1] = (FlatPtr)m_dynamic_object.ptr();
  559. got_ptr[2] = (FlatPtr)&_plt_trampoline;
  560. }
  561. // Called from our ASM routine _plt_trampoline.
  562. // Tell the compiler that it might be called from other places:
  563. extern "C" FlatPtr _fixup_plt_entry(DynamicObject* object, u32 relocation_offset);
  564. extern "C" FlatPtr _fixup_plt_entry(DynamicObject* object, u32 relocation_offset)
  565. {
  566. return object->patch_plt_entry(relocation_offset).get();
  567. }
  568. void DynamicLoader::call_object_init_functions()
  569. {
  570. typedef void (*InitFunc)();
  571. if (m_dynamic_object->has_init_section()) {
  572. auto init_function = (InitFunc)(m_dynamic_object->init_section().address().as_ptr());
  573. (init_function)();
  574. }
  575. if (m_dynamic_object->has_init_array_section()) {
  576. auto init_array_section = m_dynamic_object->init_array_section();
  577. InitFunc* init_begin = (InitFunc*)(init_array_section.address().as_ptr());
  578. InitFunc* init_end = init_begin + init_array_section.entry_count();
  579. while (init_begin != init_end) {
  580. // Android sources claim that these can be -1, to be ignored.
  581. // 0 definitely shows up. Apparently 0/-1 are valid? Confusing.
  582. if (!*init_begin || ((FlatPtr)*init_begin == (FlatPtr)-1))
  583. continue;
  584. (*init_begin)();
  585. ++init_begin;
  586. }
  587. }
  588. }
  589. Optional<DynamicObject::SymbolLookupResult> DynamicLoader::lookup_symbol(const ELF::DynamicObject::Symbol& symbol)
  590. {
  591. if (symbol.is_undefined() || symbol.bind() == STB_WEAK)
  592. return DynamicLinker::lookup_global_symbol(symbol.name());
  593. return DynamicObject::SymbolLookupResult { symbol.value(), symbol.size(), symbol.address(), symbol.bind(), symbol.type(), &symbol.object() };
  594. }
  595. } // end namespace ELF