1 /* $NetBSD: map_object.c,v 1.71 2026/01/18 19:19:09 jmcneill Exp $ */ 2 3 /* 4 * Copyright 1996 John D. Polstra. 5 * Copyright 1996 Matt Thomas <matt (at) 3am-software.com> 6 * Copyright 2002 Charles M. Hannum <root (at) ihack.net> 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed by John Polstra. 20 * 4. The name of the author may not be used to endorse or promote products 21 * derived from this software without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 24 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 25 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 26 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 27 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 28 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 32 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include <sys/cdefs.h> 36 #ifndef lint 37 __RCSID("$NetBSD: map_object.c,v 1.71 2026/01/18 19:19:09 jmcneill Exp $"); 38 #endif /* not lint */ 39 40 #include <errno.h> 41 #include <stddef.h> 42 #include <stdlib.h> 43 #include <string.h> 44 #include <unistd.h> 45 #include <sys/stat.h> 46 #include <sys/types.h> 47 #include <sys/mman.h> 48 49 #include "debug.h" 50 #include "rtld.h" 51 52 static int convert_prot(int); /* Elf flags -> mmap protection */ 53 static int convert_flags(int); /* Elf flags -> mmap flags */ 54 55 #define EA_UNDEF (~(Elf_Addr)0) 56 57 /* 58 * Map a shared object into memory. The argument is a file descriptor, 59 * which must be open on the object and positioned at its beginning. 60 * 61 * The return value is a pointer to a newly-allocated Obj_Entry structure 62 * for the shared object. Returns NULL on failure. 63 */ 64 Obj_Entry * 65 _rtld_map_object(const char *path, int fd, const struct stat *sb) 66 { 67 Obj_Entry *obj; 68 Elf_Ehdr *ehdr; 69 Elf_Phdr *phdr; 70 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 71 Elf_Phdr *phtls; 72 #endif 73 Elf_Phdr *phlimit; 74 Elf_Phdr **segs = NULL; 75 int nsegs; 76 caddr_t mapbase = MAP_FAILED; 77 size_t mapsize = 0; 78 int mapflags; 79 Elf_Addr base_alignment; 80 Elf_Addr base_vaddr; 81 Elf_Addr base_vlimit; 82 Elf_Addr text_vlimit; 83 Elf_Addr text_end; 84 void *base_addr; 85 Elf_Off data_offset; 86 Elf_Addr data_vaddr; 87 Elf_Addr data_vlimit; 88 int data_flags; 89 int data_prot; 90 caddr_t data_addr; 91 Elf_Addr bss_vaddr; 92 Elf_Addr bss_vlimit; 93 caddr_t bss_addr; 94 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 95 Elf_Addr tls_vaddr = 0; /* Noise GCC */ 96 #endif 97 Elf_Addr phdr_vaddr; 98 size_t phdr_memsz, phsize; 99 int i; 100 #ifdef RTLD_LOADER 101 Elf_Addr clear_vaddr; 102 caddr_t clear_page; 103 caddr_t clear_addr; 104 size_t nclear; 105 #endif 106 #ifdef GNU_RELRO 107 Elf_Addr relro_page; 108 size_t relro_size; 109 #endif 110 #ifdef notyet 111 int stack_flags; 112 #endif 113 114 if (sb != NULL && sb->st_size < (off_t)sizeof (Elf_Ehdr)) { 115 _rtld_error("%s: not ELF file (too short)", path); 116 return NULL; 117 } 118 119 obj = _rtld_obj_new(); 120 obj->path = xstrdup(path); 121 obj->pathlen = strlen(path); 122 if (sb != NULL) { 123 obj->dev = sb->st_dev; 124 obj->ino = sb->st_ino; 125 } 126 127 ehdr = mmap(NULL, _rtld_pagesz, PROT_READ, MAP_FILE | MAP_SHARED, fd, 128 (off_t)0); 129 obj->ehdr = ehdr; 130 if (ehdr == MAP_FAILED) { 131 _rtld_error("%s: read error: %s", path, xstrerror(errno)); 132 goto error; 133 } 134 /* Make sure the file is valid */ 135 if (memcmp(ELFMAG, ehdr->e_ident, SELFMAG) != 0) { 136 _rtld_error("%s: not ELF file (magic number bad)", path); 137 goto error; 138 } 139 if (ehdr->e_ident[EI_CLASS] != ELFCLASS) { 140 _rtld_error("%s: invalid ELF class %x; expected %x", path, 141 ehdr->e_ident[EI_CLASS], ELFCLASS); 142 goto error; 143 } 144 /* Elf_e_ident includes class */ 145 if (ehdr->e_ident[EI_VERSION] != EV_CURRENT || 146 ehdr->e_version != EV_CURRENT || 147 ehdr->e_ident[EI_DATA] != ELFDEFNNAME(MACHDEP_ENDIANNESS)) { 148 _rtld_error("%s: unsupported file version", path); 149 goto error; 150 } 151 if (ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) { 152 _rtld_error("%s: unsupported file type", path); 153 goto error; 154 } 155 switch (ehdr->e_machine) { 156 ELFDEFNNAME(MACHDEP_ID_CASES) 157 default: 158 _rtld_error("%s: unsupported machine", path); 159 goto error; 160 } 161 162 /* 163 * We rely on the program header being in the first page. This is 164 * not strictly required by the ABI specification, but it seems to 165 * always true in practice. And, it simplifies things considerably. 166 */ 167 assert(ehdr->e_phentsize == sizeof(Elf_Phdr)); 168 assert(ehdr->e_phoff + ehdr->e_phnum * sizeof(Elf_Phdr) <= 169 _rtld_pagesz); 170 171 /* 172 * Scan the program header entries, and save key information. 173 * 174 * We rely on there being exactly two load segments, text and data, 175 * in that order. 176 */ 177 phdr = (Elf_Phdr *) ((caddr_t)ehdr + ehdr->e_phoff); 178 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 179 phtls = NULL; 180 #endif 181 phsize = ehdr->e_phnum * sizeof(phdr[0]); 182 obj->phdr = NULL; 183 #ifdef GNU_RELRO 184 relro_page = 0; 185 relro_size = 0; 186 #endif 187 phdr_vaddr = EA_UNDEF; 188 phdr_memsz = 0; 189 phlimit = phdr + ehdr->e_phnum; 190 segs = xmalloc(sizeof(segs[0]) * ehdr->e_phnum); 191 if (segs == NULL) { 192 _rtld_error("No memory for segs"); 193 goto error; 194 } 195 #ifdef notyet 196 stack_flags = PF_R | PF_W; 197 #endif 198 nsegs = -1; 199 while (phdr < phlimit) { 200 switch (phdr->p_type) { 201 case PT_INTERP: 202 obj->interp = (void *)(uintptr_t)phdr->p_vaddr; 203 dbg(("%s: PT_INTERP %p", obj->path, obj->interp)); 204 break; 205 206 case PT_LOAD: 207 segs[++nsegs] = phdr; 208 if ((segs[nsegs]->p_align & (_rtld_pagesz - 1)) != 0) { 209 _rtld_error( 210 "%s: PT_LOAD segment %d not page-aligned", 211 path, nsegs); 212 goto error; 213 } 214 if ((segs[nsegs]->p_flags & PF_X) == PF_X) { 215 text_end = MAX(text_end, 216 round_up(segs[nsegs]->p_vaddr + 217 segs[nsegs]->p_memsz)); 218 } 219 220 dbg(("%s: %s %p phsize %" PRImemsz, obj->path, 221 "PT_LOAD", 222 (void *)(uintptr_t)phdr->p_vaddr, phdr->p_memsz)); 223 break; 224 225 case PT_PHDR: 226 phdr_vaddr = phdr->p_vaddr; 227 phdr_memsz = phdr->p_memsz; 228 dbg(("%s: %s %p phsize %" PRImemsz, obj->path, 229 "PT_PHDR", 230 (void *)(uintptr_t)phdr->p_vaddr, phdr->p_memsz)); 231 break; 232 233 #ifdef notyet 234 case PT_GNU_STACK: 235 stack_flags = phdr->p_flags; 236 break; 237 #endif 238 239 #ifdef GNU_RELRO 240 case PT_GNU_RELRO: 241 relro_page = phdr->p_vaddr; 242 relro_size = phdr->p_memsz; 243 break; 244 #endif 245 246 case PT_DYNAMIC: 247 obj->dynamic = (void *)(uintptr_t)phdr->p_vaddr; 248 dbg(("%s: %s %p phsize %" PRImemsz, obj->path, 249 "PT_DYNAMIC", 250 (void *)(uintptr_t)phdr->p_vaddr, phdr->p_memsz)); 251 break; 252 253 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 254 case PT_TLS: 255 phtls = phdr; 256 dbg(("%s: %s %p phsize %" PRImemsz, obj->path, "PT_TLS", 257 (void *)(uintptr_t)phdr->p_vaddr, phdr->p_memsz)); 258 break; 259 #endif 260 #ifdef __ARM_EABI__ 261 case PT_ARM_EXIDX: 262 obj->exidx_start = (void *)(uintptr_t)phdr->p_vaddr; 263 obj->exidx_sz = phdr->p_memsz; 264 break; 265 #endif 266 } 267 268 ++phdr; 269 } 270 phdr = (Elf_Phdr *) ((caddr_t)ehdr + ehdr->e_phoff); 271 obj->entry = (void *)(uintptr_t)ehdr->e_entry; 272 if (!obj->dynamic) { 273 _rtld_error("%s: not dynamically linked", path); 274 goto error; 275 } 276 277 /* 278 * Map the entire address space of the object as a file 279 * region to stake out our contiguous region and establish a 280 * base for relocation. We use a file mapping so that 281 * the kernel will give us whatever alignment is appropriate 282 * for the platform we're running on. 283 * 284 * We map it using the text protection, map the data segment 285 * into the right place, then map an anon segment for the bss 286 * and unmap the gaps left by padding to alignment. 287 */ 288 289 base_alignment = segs[0]->p_align; 290 base_vaddr = round_down(segs[0]->p_vaddr); 291 base_vlimit = round_up(segs[nsegs]->p_vaddr + segs[nsegs]->p_memsz); 292 text_vlimit = round_up(segs[0]->p_vaddr + segs[0]->p_memsz); 293 data_offset = round_down(segs[nsegs]->p_offset); 294 data_vaddr = round_down(segs[nsegs]->p_vaddr); 295 data_vlimit = round_up(segs[nsegs]->p_vaddr + segs[nsegs]->p_filesz); 296 data_flags = convert_prot(segs[nsegs]->p_flags); 297 #ifdef RTLD_LOADER 298 clear_vaddr = segs[nsegs]->p_vaddr + segs[nsegs]->p_filesz; 299 #endif 300 301 obj->textsize = text_vlimit - base_vaddr; 302 obj->vaddrbase = base_vaddr; 303 obj->isdynamic = ehdr->e_type == ET_DYN; 304 305 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 306 if (phtls != NULL) { 307 ++_rtld_tls_dtv_generation; 308 obj->tlsindex = ++_rtld_tls_max_index; 309 obj->tlssize = phtls->p_memsz; 310 obj->tlsalign = phtls->p_align; 311 obj->tlsinitsize = phtls->p_filesz; 312 tls_vaddr = phtls->p_vaddr; 313 dbg(("%s: tls index %zu size %zu align %zu initsize %zu", 314 obj->path, obj->tlsindex, obj->tlssize, obj->tlsalign, 315 obj->tlsinitsize)); 316 } 317 #endif 318 319 /* 320 * Calculate log2 of the base section alignment. 321 */ 322 mapflags = MAP_PRIVATE | MAP_ANON; 323 if (base_alignment > _rtld_pagesz) { 324 unsigned int log2 = 0; 325 for (; base_alignment > 1; base_alignment >>= 1) 326 log2++; 327 mapflags |= MAP_ALIGNED(log2); 328 } 329 330 base_addr = NULL; 331 #ifdef RTLD_LOADER 332 if (!obj->isdynamic) { 333 mapflags |= MAP_TRYFIXED; 334 base_addr = (void *)(uintptr_t)base_vaddr; 335 } 336 #endif 337 mapsize = base_vlimit - base_vaddr; 338 mapbase = mmap(base_addr, mapsize, PROT_NONE, mapflags, -1, 0); 339 if (mapbase == MAP_FAILED) { 340 _rtld_error("mmap of entire address space failed: %s", 341 xstrerror(errno)); 342 goto error; 343 } 344 #ifdef RTLD_LOADER 345 if (!obj->isdynamic && mapbase != base_addr) { 346 _rtld_error("mmap of executable at correct address failed"); 347 goto error; 348 } 349 #endif 350 351 obj->phdr_loaded = false; 352 for (i = 0; i <= nsegs; i++) { 353 /* Overlay the segment onto the proper region. */ 354 data_offset = round_down(segs[i]->p_offset); 355 data_vaddr = round_down(segs[i]->p_vaddr); 356 data_vlimit = round_up(segs[i]->p_vaddr 357 + segs[i]->p_filesz); 358 data_addr = mapbase + (data_vaddr - base_vaddr); 359 data_prot = convert_prot(segs[i]->p_flags); 360 data_flags = convert_flags(segs[i]->p_flags) | MAP_FIXED; 361 if (data_vlimit != data_vaddr && 362 mmap(data_addr, data_vlimit - data_vaddr, data_prot, 363 data_flags, fd, data_offset) == MAP_FAILED) { 364 _rtld_error("%s: mmap of data failed: %s", path, 365 xstrerror(errno)); 366 goto error; 367 } 368 369 #ifdef RTLD_MAP_OBJECT_FIXUP 370 if (_rtld_map_segment_fixup(path, fd, ehdr, segs[i], data_addr, 371 data_vlimit - data_vaddr, 372 data_prot) == -1) { 373 goto error; 374 } 375 #endif 376 /* Do BSS setup */ 377 if (segs[i]->p_filesz != segs[i]->p_memsz) { 378 #ifdef RTLD_LOADER 379 /* Clear any BSS in the last page of the segment. */ 380 clear_vaddr = segs[i]->p_vaddr + segs[i]->p_filesz; 381 clear_addr = mapbase + (clear_vaddr - base_vaddr); 382 clear_page = mapbase + (round_down(clear_vaddr) 383 - base_vaddr); 384 385 if ((nclear = data_vlimit - clear_vaddr) > 0) { 386 /* 387 * Make sure the end of the segment is 388 * writable. 389 */ 390 if ((data_prot & PROT_WRITE) == 0 && -1 == 391 mprotect(clear_page, _rtld_pagesz, 392 data_prot|PROT_WRITE)) { 393 _rtld_error("%s: mprotect failed: %s", 394 path, xstrerror(errno)); 395 goto error; 396 } 397 398 memset(clear_addr, 0, nclear); 399 400 /* Reset the data protection back */ 401 if ((data_prot & PROT_WRITE) == 0) 402 mprotect(clear_page, _rtld_pagesz, 403 data_prot); 404 } 405 #endif 406 407 /* Overlay the BSS segment onto the proper region. */ 408 bss_vaddr = data_vlimit; 409 bss_vlimit = round_up(segs[i]->p_vaddr + 410 segs[i]->p_memsz); 411 bss_addr = mapbase + (bss_vaddr - base_vaddr); 412 if (bss_vlimit > bss_vaddr) { 413 /* There is something to do */ 414 if (mmap(bss_addr, bss_vlimit - bss_vaddr, 415 data_prot, data_flags | MAP_ANON, -1, 0) 416 == MAP_FAILED) { 417 _rtld_error( 418 "%s: mmap of bss failed: %s", 419 path, xstrerror(errno)); 420 goto error; 421 } 422 } 423 } 424 425 if (phdr_vaddr != EA_UNDEF && 426 segs[i]->p_vaddr <= phdr_vaddr && 427 segs[i]->p_memsz >= phdr_memsz) { 428 obj->phdr_loaded = true; 429 } 430 if (segs[i]->p_offset <= ehdr->e_phoff && 431 segs[i]->p_memsz >= phsize) { 432 phdr_vaddr = segs[i]->p_vaddr + ehdr->e_phoff; 433 phdr_memsz = phsize; 434 obj->phdr_loaded = true; 435 } 436 } 437 if (obj->phdr_loaded) { 438 obj->phdr = (void *)(uintptr_t)phdr_vaddr; 439 obj->phsize = phdr_memsz; 440 } else { 441 Elf_Phdr *buf = xmalloc(phsize); 442 if (buf == NULL) { 443 _rtld_error("%s: cannot allocate program header", path); 444 goto error; 445 } 446 memcpy(buf, phdr, phsize); 447 obj->phdr = buf; 448 obj->phsize = phsize; 449 } 450 451 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 452 if (phtls != NULL) { 453 obj->tlsinit = mapbase + tls_vaddr; 454 dbg(("%s: tls init = %p + %"PRImemsz" = %p", obj->path, 455 mapbase, tls_vaddr, obj->tlsinit)); 456 } 457 #endif 458 459 obj->mapbase = mapbase; 460 obj->mapsize = mapsize; 461 obj->relocbase = mapbase - base_vaddr; 462 463 #ifdef GNU_RELRO 464 /* rounding happens later. */ 465 obj->relro_page = obj->relocbase + relro_page; 466 obj->relro_size = relro_size; 467 #endif 468 469 if (obj->dynamic) 470 obj->dynamic = (void *)(obj->relocbase + (Elf_Addr)(uintptr_t)obj->dynamic); 471 if (obj->entry) 472 obj->entry = (void *)(obj->relocbase + (Elf_Addr)(uintptr_t)obj->entry); 473 if (obj->interp) 474 obj->interp = (void *)(obj->relocbase + (Elf_Addr)(uintptr_t)obj->interp); 475 if (obj->phdr_loaded) 476 obj->phdr = (void *)(obj->relocbase + (Elf_Addr)(uintptr_t)obj->phdr); 477 #ifdef __ARM_EABI__ 478 if (obj->exidx_start) 479 obj->exidx_start = (void *)(obj->relocbase + (Elf_Addr)(uintptr_t)obj->exidx_start); 480 #endif 481 xfree(segs); 482 483 return obj; 484 485 error: 486 if (mapbase != MAP_FAILED) 487 munmap(mapbase, mapsize); 488 if (obj->ehdr != MAP_FAILED) 489 munmap(obj->ehdr, _rtld_pagesz); 490 _rtld_obj_free(obj); 491 xfree(segs); 492 return NULL; 493 } 494 495 void 496 _rtld_obj_free(Obj_Entry *obj) 497 { 498 Objlist_Entry *elm; 499 Name_Entry *entry; 500 501 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 502 if (obj->tls_static) 503 _rtld_tls_offset_free(obj); 504 #endif 505 xfree(obj->path); 506 while (obj->needed != NULL) { 507 Needed_Entry *needed = obj->needed; 508 obj->needed = needed->next; 509 xfree(needed); 510 } 511 while ((entry = SIMPLEQ_FIRST(&obj->names)) != NULL) { 512 SIMPLEQ_REMOVE_HEAD(&obj->names, link); 513 xfree(entry); 514 } 515 while ((elm = SIMPLEQ_FIRST(&obj->dldags)) != NULL) { 516 SIMPLEQ_REMOVE_HEAD(&obj->dldags, link); 517 xfree(elm); 518 } 519 while ((elm = SIMPLEQ_FIRST(&obj->dagmembers)) != NULL) { 520 SIMPLEQ_REMOVE_HEAD(&obj->dagmembers, link); 521 xfree(elm); 522 } 523 if (!obj->phdr_loaded) 524 xfree((void *)(uintptr_t)obj->phdr); 525 xfree(obj); 526 } 527 528 Obj_Entry * 529 _rtld_obj_new(void) 530 { 531 Obj_Entry *obj; 532 533 obj = CNEW(Obj_Entry); 534 SIMPLEQ_INIT(&obj->names); 535 SIMPLEQ_INIT(&obj->dldags); 536 SIMPLEQ_INIT(&obj->dagmembers); 537 return obj; 538 } 539 540 /* 541 * Given a set of ELF protection flags, return the corresponding protection 542 * flags for MMAP. 543 */ 544 static int 545 convert_prot(int elfflags) 546 { 547 int prot = 0; 548 549 if (elfflags & PF_R) 550 prot |= PROT_READ; 551 #ifdef RTLD_LOADER 552 if (elfflags & PF_W) 553 prot |= PROT_WRITE; 554 #endif 555 if (elfflags & PF_X) 556 prot |= PROT_EXEC; 557 return prot; 558 } 559 560 static int 561 convert_flags(int elfflags __unused) 562 { 563 int flags = MAP_PRIVATE; /* All mappings are private */ 564 565 #ifdef MAP_NOCORE 566 /* 567 * Readonly mappings are marked "MAP_NOCORE", because they can be 568 * reconstructed by a debugger. 569 */ 570 if (!(elfflags & PF_W)) 571 flags |= MAP_NOCORE; 572 #endif 573 return flags; 574 } 575
Indexes created Sat Feb 21 08:20:20 UTC 2026