1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 
5 // Implementation notes:
6 //
7 // We need to remove a piece from the ELF shared library.  However, we also
8 // want to avoid fixing DWARF cfi data and relative relocation addresses.
9 // So after packing we shift offets and starting address of the RX segment
10 // while preserving code/data vaddrs location.
11 // This requires some fixups for symtab/hash/gnu_hash dynamic section addresses.
12 
13 #include "elf_file.h"
14 
15 #include <stdlib.h>
16 #include <sys/types.h>
17 #include <unistd.h>
18 #include <algorithm>
19 #include <string>
20 #include <vector>
21 
22 #include "debug.h"
23 #include "elf_traits.h"
24 #include "libelf.h"
25 #include "packer.h"
26 
27 namespace relocation_packer {
28 
29 // Out-of-band dynamic tags used to indicate the offset and size of the
30 // android packed relocations section.
31 static constexpr int32_t DT_ANDROID_REL = DT_LOOS + 2;
32 static constexpr int32_t DT_ANDROID_RELSZ = DT_LOOS + 3;
33 
34 static constexpr int32_t DT_ANDROID_RELA = DT_LOOS + 4;
35 static constexpr int32_t DT_ANDROID_RELASZ = DT_LOOS + 5;
36 
37 static constexpr uint32_t SHT_ANDROID_REL = SHT_LOOS + 1;
38 static constexpr uint32_t SHT_ANDROID_RELA = SHT_LOOS + 2;
39 
40 static const size_t kPageSize = 4096;
41 
42 // Alignment to preserve, in bytes.  This must be at least as large as the
43 // largest d_align and sh_addralign values found in the loaded file.
44 // Out of caution for RELRO page alignment, we preserve to a complete target
45 // page.  See http://www.airs.com/blog/archives/189.
46 static const size_t kPreserveAlignment = kPageSize;
47 
48 // Get section data.  Checks that the section has exactly one data entry,
49 // so that the section size and the data size are the same.  True in
50 // practice for all sections we resize when packing or unpacking.  Done
51 // by ensuring that a call to elf_getdata(section, data) returns NULL as
52 // the next data entry.
GetSectionData(Elf_Scn * section)53 static Elf_Data* GetSectionData(Elf_Scn* section) {
54   Elf_Data* data = elf_getdata(section, NULL);
55   CHECK(data && elf_getdata(section, data) == NULL);
56   return data;
57 }
58 
59 // Rewrite section data.  Allocates new data and makes it the data element's
60 // buffer.  Relies on program exit to free allocated data.
RewriteSectionData(Elf_Scn * section,const void * section_data,size_t size)61 static void RewriteSectionData(Elf_Scn* section,
62                                const void* section_data,
63                                size_t size) {
64   Elf_Data* data = GetSectionData(section);
65   CHECK(size == data->d_size);
66   uint8_t* area = new uint8_t[size];
67   memcpy(area, section_data, size);
68   data->d_buf = area;
69 }
70 
71 // Verbose ELF header logging.
72 template <typename Ehdr>
VerboseLogElfHeader(const Ehdr * elf_header)73 static void VerboseLogElfHeader(const Ehdr* elf_header) {
74   VLOG(1) << "e_phoff = " << elf_header->e_phoff;
75   VLOG(1) << "e_shoff = " << elf_header->e_shoff;
76   VLOG(1) << "e_ehsize = " << elf_header->e_ehsize;
77   VLOG(1) << "e_phentsize = " << elf_header->e_phentsize;
78   VLOG(1) << "e_phnum = " << elf_header->e_phnum;
79   VLOG(1) << "e_shnum = " << elf_header->e_shnum;
80   VLOG(1) << "e_shstrndx = " << elf_header->e_shstrndx;
81 }
82 
83 // Verbose ELF program header logging.
84 template <typename Phdr>
VerboseLogProgramHeader(size_t program_header_index,const Phdr * program_header)85 static void VerboseLogProgramHeader(size_t program_header_index,
86                              const Phdr* program_header) {
87   std::string type;
88   switch (program_header->p_type) {
89     case PT_NULL: type = "NULL"; break;
90     case PT_LOAD: type = "LOAD"; break;
91     case PT_DYNAMIC: type = "DYNAMIC"; break;
92     case PT_INTERP: type = "INTERP"; break;
93     case PT_PHDR: type = "PHDR"; break;
94     case PT_GNU_RELRO: type = "GNU_RELRO"; break;
95     case PT_GNU_STACK: type = "GNU_STACK"; break;
96     case PT_ARM_EXIDX: type = "EXIDX"; break;
97     default: type = "(OTHER)"; break;
98   }
99   VLOG(1) << "phdr[" << program_header_index << "] : " << type;
100   VLOG(1) << "  p_offset = " << program_header->p_offset;
101   VLOG(1) << "  p_vaddr = " << program_header->p_vaddr;
102   VLOG(1) << "  p_paddr = " << program_header->p_paddr;
103   VLOG(1) << "  p_filesz = " << program_header->p_filesz;
104   VLOG(1) << "  p_memsz = " << program_header->p_memsz;
105   VLOG(1) << "  p_flags = " << program_header->p_flags;
106   VLOG(1) << "  p_align = " << program_header->p_align;
107 }
108 
109 // Verbose ELF section header logging.
110 template <typename Shdr>
VerboseLogSectionHeader(const std::string & section_name,const Shdr * section_header)111 static void VerboseLogSectionHeader(const std::string& section_name,
112                              const Shdr* section_header) {
113   VLOG(1) << "section " << section_name;
114   VLOG(1) << "  sh_addr = " << section_header->sh_addr;
115   VLOG(1) << "  sh_offset = " << section_header->sh_offset;
116   VLOG(1) << "  sh_size = " << section_header->sh_size;
117   VLOG(1) << "  sh_entsize = " << section_header->sh_entsize;
118   VLOG(1) << "  sh_addralign = " << section_header->sh_addralign;
119 }
120 
121 // Verbose ELF section data logging.
VerboseLogSectionData(const Elf_Data * data)122 static void VerboseLogSectionData(const Elf_Data* data) {
123   VLOG(1) << "  data";
124   VLOG(1) << "    d_buf = " << data->d_buf;
125   VLOG(1) << "    d_off = " << data->d_off;
126   VLOG(1) << "    d_size = " << data->d_size;
127   VLOG(1) << "    d_align = " << data->d_align;
128 }
129 
130 // Load the complete ELF file into a memory image in libelf, and identify
131 // the .rel.dyn or .rela.dyn, .dynamic, and .android.rel.dyn or
132 // .android.rela.dyn sections.  No-op if the ELF file has already been loaded.
133 template <typename ELF>
Load()134 bool ElfFile<ELF>::Load() {
135   if (elf_)
136     return true;
137 
138   Elf* elf = elf_begin(fd_, ELF_C_RDWR, NULL);
139   CHECK(elf);
140 
141   if (elf_kind(elf) != ELF_K_ELF) {
142     LOG(ERROR) << "File not in ELF format";
143     return false;
144   }
145 
146   auto elf_header = ELF::getehdr(elf);
147   if (!elf_header) {
148     LOG(ERROR) << "Failed to load ELF header: " << elf_errmsg(elf_errno());
149     return false;
150   }
151 
152   if (elf_header->e_type != ET_DYN) {
153     LOG(ERROR) << "ELF file is not a shared object";
154     return false;
155   }
156 
157   // Require that our endianness matches that of the target, and that both
158   // are little-endian.  Safe for all current build/target combinations.
159   const int endian = elf_header->e_ident[EI_DATA];
160   CHECK(endian == ELFDATA2LSB);
161   CHECK(__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__);
162 
163   const int file_class = elf_header->e_ident[EI_CLASS];
164   VLOG(1) << "endian = " << endian << ", file class = " << file_class;
165   VerboseLogElfHeader(elf_header);
166 
167   auto elf_program_header = ELF::getphdr(elf);
168   CHECK(elf_program_header != nullptr);
169 
170   const typename ELF::Phdr* dynamic_program_header = NULL;
171   for (size_t i = 0; i < elf_header->e_phnum; ++i) {
172     auto program_header = &elf_program_header[i];
173     VerboseLogProgramHeader(i, program_header);
174 
175     if (program_header->p_type == PT_DYNAMIC) {
176       CHECK(dynamic_program_header == NULL);
177       dynamic_program_header = program_header;
178     }
179   }
180   CHECK(dynamic_program_header != nullptr);
181 
182   size_t string_index;
183   elf_getshdrstrndx(elf, &string_index);
184 
185   // Notes of the dynamic relocations, packed relocations, and .dynamic
186   // sections.  Found while iterating sections, and later stored in class
187   // attributes.
188   Elf_Scn* found_relocations_section = nullptr;
189   Elf_Scn* found_dynamic_section = nullptr;
190 
191   // Notes of relocation section types seen.  We require one or the other of
192   // these; both is unsupported.
193   bool has_rel_relocations = false;
194   bool has_rela_relocations = false;
195   bool has_android_relocations = false;
196 
197   Elf_Scn* section = NULL;
198   while ((section = elf_nextscn(elf, section)) != nullptr) {
199     auto section_header = ELF::getshdr(section);
200     std::string name = elf_strptr(elf, string_index, section_header->sh_name);
201     VerboseLogSectionHeader(name, section_header);
202 
203     // Note relocation section types.
204     if (section_header->sh_type == SHT_REL || section_header->sh_type == SHT_ANDROID_REL) {
205       has_rel_relocations = true;
206     }
207     if (section_header->sh_type == SHT_RELA || section_header->sh_type == SHT_ANDROID_RELA) {
208       has_rela_relocations = true;
209     }
210 
211     // Note special sections as we encounter them.
212     if ((name == ".rel.dyn" || name == ".rela.dyn") &&
213         section_header->sh_size > 0) {
214       found_relocations_section = section;
215 
216       // Note if relocation section is already packed
217       has_android_relocations =
218           section_header->sh_type == SHT_ANDROID_REL ||
219           section_header->sh_type == SHT_ANDROID_RELA;
220     }
221 
222     if (section_header->sh_offset == dynamic_program_header->p_offset) {
223       found_dynamic_section = section;
224     }
225 
226     // Ensure we preserve alignment, repeated later for the data block(s).
227     CHECK(section_header->sh_addralign <= kPreserveAlignment);
228 
229     Elf_Data* data = NULL;
230     while ((data = elf_getdata(section, data)) != NULL) {
231       CHECK(data->d_align <= kPreserveAlignment);
232       VerboseLogSectionData(data);
233     }
234   }
235 
236   // Loading failed if we did not find the required special sections.
237   if (!found_relocations_section) {
238     LOG(ERROR) << "Missing or empty .rel.dyn or .rela.dyn section";
239     return false;
240   }
241   if (!found_dynamic_section) {
242     LOG(ERROR) << "Missing .dynamic section";
243     return false;
244   }
245 
246   // Loading failed if we could not identify the relocations type.
247   if (!has_rel_relocations && !has_rela_relocations) {
248     LOG(ERROR) << "No relocations sections found";
249     return false;
250   }
251   if (has_rel_relocations && has_rela_relocations) {
252     LOG(ERROR) << "Multiple relocations sections with different types found, "
253                << "not currently supported";
254     return false;
255   }
256 
257   elf_ = elf;
258   relocations_section_ = found_relocations_section;
259   dynamic_section_ = found_dynamic_section;
260   relocations_type_ = has_rel_relocations ? REL : RELA;
261   has_android_relocations_ = has_android_relocations;
262   return true;
263 }
264 
265 // Helper for ResizeSection().  Adjust the main ELF header for the hole.
266 template <typename ELF>
AdjustElfHeaderForHole(typename ELF::Ehdr * elf_header,typename ELF::Off hole_start,ssize_t hole_size)267 static void AdjustElfHeaderForHole(typename ELF::Ehdr* elf_header,
268                                    typename ELF::Off hole_start,
269                                    ssize_t hole_size) {
270   if (elf_header->e_phoff > hole_start) {
271     elf_header->e_phoff += hole_size;
272     VLOG(1) << "e_phoff adjusted to " << elf_header->e_phoff;
273   }
274   if (elf_header->e_shoff > hole_start) {
275     elf_header->e_shoff += hole_size;
276     VLOG(1) << "e_shoff adjusted to " << elf_header->e_shoff;
277   }
278 }
279 
280 // Helper for ResizeSection().  Adjust all section headers for the hole.
281 template <typename ELF>
AdjustSectionHeadersForHole(Elf * elf,typename ELF::Off hole_start,ssize_t hole_size)282 static void AdjustSectionHeadersForHole(Elf* elf,
283                                         typename ELF::Off hole_start,
284                                         ssize_t hole_size) {
285   size_t string_index;
286   elf_getshdrstrndx(elf, &string_index);
287 
288   Elf_Scn* section = NULL;
289   while ((section = elf_nextscn(elf, section)) != NULL) {
290     auto section_header = ELF::getshdr(section);
291     std::string name = elf_strptr(elf, string_index, section_header->sh_name);
292 
293     if (section_header->sh_offset > hole_start) {
294       section_header->sh_offset += hole_size;
295       VLOG(1) << "section " << name
296               << " sh_offset adjusted to " << section_header->sh_offset;
297     } else {
298       section_header->sh_addr -= hole_size;
299       VLOG(1) << "section " << name
300               << " sh_addr adjusted to " << section_header->sh_addr;
301     }
302   }
303 }
304 
305 // Helper for ResizeSection().  Adjust the offsets of any program headers
306 // that have offsets currently beyond the hole start.
307 template <typename ELF>
AdjustProgramHeaderOffsets(typename ELF::Phdr * program_headers,size_t count,typename ELF::Off hole_start,ssize_t hole_size)308 static void AdjustProgramHeaderOffsets(typename ELF::Phdr* program_headers,
309                                        size_t count,
310                                        typename ELF::Off hole_start,
311                                        ssize_t hole_size) {
312   for (size_t i = 0; i < count; ++i) {
313     typename ELF::Phdr* program_header = &program_headers[i];
314 
315     // Do not adjust PT_GNU_STACK - it confuses gdb and results
316     // in incorrect unwinding if the executable is stripped after
317     // packing.
318     if (program_header->p_type == PT_GNU_STACK) {
319       continue;
320     }
321 
322     if (program_header->p_offset > hole_start) {
323       // The hole start is past this segment, so adjust offset.
324       program_header->p_offset += hole_size;
325       VLOG(1) << "phdr[" << i
326               << "] p_offset adjusted to "<< program_header->p_offset;
327     } else {
328       program_header->p_vaddr -= hole_size;
329       program_header->p_paddr -= hole_size;
330       if (program_header->p_align > kPageSize) {
331         program_header->p_align = kPageSize;
332       }
333       VLOG(1) << "phdr[" << i
334               << "] p_vaddr adjusted to "<< program_header->p_vaddr
335               << "; p_paddr adjusted to "<< program_header->p_paddr
336               << "; p_align adjusted to "<< program_header->p_align;
337     }
338   }
339 }
340 
341 // Helper for ResizeSection().  Find the first loadable segment in the
342 // file.  We expect it to map from file offset zero.
343 template <typename ELF>
FindLoadSegmentForHole(typename ELF::Phdr * program_headers,size_t count,typename ELF::Off hole_start)344 static typename ELF::Phdr* FindLoadSegmentForHole(typename ELF::Phdr* program_headers,
345                                                   size_t count,
346                                                   typename ELF::Off hole_start) {
347   for (size_t i = 0; i < count; ++i) {
348     typename ELF::Phdr* program_header = &program_headers[i];
349 
350     if (program_header->p_type == PT_LOAD &&
351         program_header->p_offset <= hole_start &&
352         (program_header->p_offset + program_header->p_filesz) >= hole_start ) {
353       return program_header;
354     }
355   }
356   LOG(FATAL) << "Cannot locate a LOAD segment with hole_start=0x" << std::hex << hole_start;
357   NOTREACHED();
358 
359   return nullptr;
360 }
361 
362 // Helper for ResizeSection().  Rewrite program headers.
363 template <typename ELF>
RewriteProgramHeadersForHole(Elf * elf,typename ELF::Off hole_start,ssize_t hole_size)364 static void RewriteProgramHeadersForHole(Elf* elf,
365                                          typename ELF::Off hole_start,
366                                          ssize_t hole_size) {
367   const typename ELF::Ehdr* elf_header = ELF::getehdr(elf);
368   CHECK(elf_header);
369 
370   typename ELF::Phdr* elf_program_header = ELF::getphdr(elf);
371   CHECK(elf_program_header);
372 
373   const size_t program_header_count = elf_header->e_phnum;
374 
375   // Locate the segment that we can overwrite to form the new LOAD entry,
376   // and the segment that we are going to split into two parts.
377   typename ELF::Phdr* target_load_header =
378       FindLoadSegmentForHole<ELF>(elf_program_header, program_header_count, hole_start);
379 
380   VLOG(1) << "phdr[" << target_load_header - elf_program_header << "] adjust";
381   // Adjust PT_LOAD program header memsz and filesz
382   target_load_header->p_filesz += hole_size;
383   target_load_header->p_memsz += hole_size;
384 
385   // Adjust the offsets and p_vaddrs
386   AdjustProgramHeaderOffsets<ELF>(elf_program_header,
387                                   program_header_count,
388                                   hole_start,
389                                   hole_size);
390 }
391 
392 // Helper for ResizeSection().  Locate and return the dynamic section.
393 template <typename ELF>
GetDynamicSection(Elf * elf)394 static Elf_Scn* GetDynamicSection(Elf* elf) {
395   const typename ELF::Ehdr* elf_header = ELF::getehdr(elf);
396   CHECK(elf_header);
397 
398   const typename ELF::Phdr* elf_program_header = ELF::getphdr(elf);
399   CHECK(elf_program_header);
400 
401   // Find the program header that describes the dynamic section.
402   const typename ELF::Phdr* dynamic_program_header = NULL;
403   for (size_t i = 0; i < elf_header->e_phnum; ++i) {
404     const typename ELF::Phdr* program_header = &elf_program_header[i];
405 
406     if (program_header->p_type == PT_DYNAMIC) {
407       dynamic_program_header = program_header;
408     }
409   }
410   CHECK(dynamic_program_header);
411 
412   // Now find the section with the same offset as this program header.
413   Elf_Scn* dynamic_section = NULL;
414   Elf_Scn* section = NULL;
415   while ((section = elf_nextscn(elf, section)) != NULL) {
416     typename ELF::Shdr* section_header = ELF::getshdr(section);
417 
418     if (section_header->sh_offset == dynamic_program_header->p_offset) {
419       dynamic_section = section;
420     }
421   }
422   CHECK(dynamic_section != NULL);
423 
424   return dynamic_section;
425 }
426 
427 // Helper for ResizeSection().  Adjust the .dynamic section for the hole.
428 template <typename ELF>
AdjustDynamicSectionForHole(Elf_Scn * dynamic_section,typename ELF::Off hole_start,ssize_t hole_size,relocations_type_t relocations_type)429 void ElfFile<ELF>::AdjustDynamicSectionForHole(Elf_Scn* dynamic_section,
430                                                typename ELF::Off hole_start,
431                                                ssize_t hole_size,
432                                                relocations_type_t relocations_type) {
433   CHECK(relocations_type != NONE);
434   Elf_Data* data = GetSectionData(dynamic_section);
435 
436   auto dynamic_base = reinterpret_cast<typename ELF::Dyn*>(data->d_buf);
437   std::vector<typename ELF::Dyn> dynamics(
438       dynamic_base,
439       dynamic_base + data->d_size / sizeof(dynamics[0]));
440 
441   if (hole_size > 0) { // expanding
442     hole_start += hole_size;
443   }
444 
445   for (size_t i = 0; i < dynamics.size(); ++i) {
446     typename ELF::Dyn* dynamic = &dynamics[i];
447     const typename ELF::Sword tag = dynamic->d_tag;
448 
449     // Any tags that hold offsets are adjustment candidates.
450     const bool is_adjustable = (tag == DT_PLTGOT ||
451                                 tag == DT_HASH ||
452                                 tag == DT_GNU_HASH ||
453                                 tag == DT_STRTAB ||
454                                 tag == DT_SYMTAB ||
455                                 tag == DT_RELA ||
456                                 tag == DT_INIT ||
457                                 tag == DT_FINI ||
458                                 tag == DT_REL ||
459                                 tag == DT_JMPREL ||
460                                 tag == DT_INIT_ARRAY ||
461                                 tag == DT_FINI_ARRAY ||
462                                 tag == DT_VERSYM ||
463                                 tag == DT_VERNEED ||
464                                 tag == DT_VERDEF ||
465                                 tag == DT_ANDROID_REL||
466                                 tag == DT_ANDROID_RELA);
467 
468     if (is_adjustable && dynamic->d_un.d_ptr <= hole_start) {
469       dynamic->d_un.d_ptr -= hole_size;
470       VLOG(1) << "dynamic[" << i << "] " << dynamic->d_tag
471               << " d_ptr adjusted to " << dynamic->d_un.d_ptr;
472     }
473 
474     // DT_RELSZ or DT_RELASZ indicate the overall size of relocations.
475     // Only one will be present.  Adjust by hole size.
476     if (tag == DT_RELSZ || tag == DT_RELASZ || tag == DT_ANDROID_RELSZ || tag == DT_ANDROID_RELASZ) {
477       dynamic->d_un.d_val += hole_size;
478       VLOG(1) << "dynamic[" << i << "] " << dynamic->d_tag
479               << " d_val adjusted to " << dynamic->d_un.d_val;
480     }
481 
482     // Special case: DT_MIPS_RLD_MAP2 stores the difference between dynamic
483     // entry address and the address of the _r_debug (used by GDB)
484     // since the dynamic section and target address are on the
485     // different sides of the hole it needs to be adjusted accordingly
486     if (tag == DT_MIPS_RLD_MAP2) {
487       dynamic->d_un.d_val += hole_size;
488       VLOG(1) << "dynamic[" << i << "] " << dynamic->d_tag
489               << " d_val adjusted to " << dynamic->d_un.d_val;
490     }
491 
492     // Ignore DT_RELCOUNT and DT_RELACOUNT: (1) nobody uses them and
493     // technically (2) the relative relocation count is not changed.
494 
495     // DT_RELENT and DT_RELAENT don't change, ignore them as well.
496   }
497 
498   void* section_data = &dynamics[0];
499   size_t bytes = dynamics.size() * sizeof(dynamics[0]);
500   RewriteSectionData(dynamic_section, section_data, bytes);
501 }
502 
503 // Resize a section.  If the new size is larger than the current size, open
504 // up a hole by increasing file offsets that come after the hole.  If smaller
505 // than the current size, remove the hole by decreasing those offsets.
506 template <typename ELF>
ResizeSection(Elf * elf,Elf_Scn * section,size_t new_size,typename ELF::Word new_sh_type,relocations_type_t relocations_type)507 void ElfFile<ELF>::ResizeSection(Elf* elf, Elf_Scn* section, size_t new_size,
508                                  typename ELF::Word new_sh_type,
509                                  relocations_type_t relocations_type) {
510 
511   size_t string_index;
512   elf_getshdrstrndx(elf, &string_index);
513   auto section_header = ELF::getshdr(section);
514   std::string name = elf_strptr(elf, string_index, section_header->sh_name);
515 
516   if (section_header->sh_size == new_size) {
517     return;
518   }
519 
520   // Require that the section size and the data size are the same.  True
521   // in practice for all sections we resize when packing or unpacking.
522   Elf_Data* data = GetSectionData(section);
523   CHECK(data->d_off == 0 && data->d_size == section_header->sh_size);
524 
525   // Require that the section is not zero-length (that is, has allocated
526   // data that we can validly expand).
527   CHECK(data->d_size && data->d_buf);
528 
529   const auto hole_start = section_header->sh_offset;
530   const ssize_t hole_size = new_size - data->d_size;
531 
532   VLOG_IF(1, (hole_size > 0)) << "expand section (" << name << ") size: " <<
533       data->d_size << " -> " << (data->d_size + hole_size);
534   VLOG_IF(1, (hole_size < 0)) << "shrink section (" << name << ") size: " <<
535       data->d_size << " -> " << (data->d_size + hole_size);
536 
537   // libelf overrides sh_entsize for known sh_types, so it does not matter what we set
538   // for SHT_REL/SHT_RELA.
539   typename ELF::Xword new_entsize =
540       (new_sh_type == SHT_ANDROID_REL || new_sh_type == SHT_ANDROID_RELA) ? 1 : 0;
541 
542   VLOG(1) << "Update section (" << name << ") entry size: " <<
543       section_header->sh_entsize << " -> " << new_entsize;
544 
545   // Resize the data and the section header.
546   data->d_size += hole_size;
547   section_header->sh_size += hole_size;
548   section_header->sh_entsize = new_entsize;
549   section_header->sh_type = new_sh_type;
550 
551   // Add the hole size to all offsets in the ELF file that are after the
552   // start of the hole.  If the hole size is positive we are expanding the
553   // section to create a new hole; if negative, we are closing up a hole.
554 
555   // Start with the main ELF header.
556   typename ELF::Ehdr* elf_header = ELF::getehdr(elf);
557   AdjustElfHeaderForHole<ELF>(elf_header, hole_start, hole_size);
558 
559   // Adjust all section headers.
560   AdjustSectionHeadersForHole<ELF>(elf, hole_start, hole_size);
561 
562   // Rewrite the program headers to either split or coalesce segments,
563   // and adjust dynamic entries to match.
564   RewriteProgramHeadersForHole<ELF>(elf, hole_start, hole_size);
565 
566   Elf_Scn* dynamic_section = GetDynamicSection<ELF>(elf);
567   AdjustDynamicSectionForHole(dynamic_section, hole_start, hole_size, relocations_type);
568 }
569 
570 // Find the first slot in a dynamics array with the given tag.  The array
571 // always ends with a free (unused) element, and which we exclude from the
572 // search.  Returns dynamics->size() if not found.
573 template <typename ELF>
FindDynamicEntry(typename ELF::Sword tag,std::vector<typename ELF::Dyn> * dynamics)574 static size_t FindDynamicEntry(typename ELF::Sword tag,
575                                std::vector<typename ELF::Dyn>* dynamics) {
576   // Loop until the penultimate entry.  We exclude the end sentinel.
577   for (size_t i = 0; i < dynamics->size() - 1; ++i) {
578     if (dynamics->at(i).d_tag == tag) {
579       return i;
580     }
581   }
582 
583   // The tag was not found.
584   return dynamics->size();
585 }
586 
587 // Replace dynamic entry.
588 template <typename ELF>
ReplaceDynamicEntry(typename ELF::Sword tag,const typename ELF::Dyn & dyn,std::vector<typename ELF::Dyn> * dynamics)589 static void ReplaceDynamicEntry(typename ELF::Sword tag,
590                                 const typename ELF::Dyn& dyn,
591                                 std::vector<typename ELF::Dyn>* dynamics) {
592   const size_t slot = FindDynamicEntry<ELF>(tag, dynamics);
593   if (slot == dynamics->size()) {
594     LOG(FATAL) << "Dynamic slot is not found for tag=" << tag;
595   }
596 
597   // Replace this entry with the one supplied.
598   dynamics->at(slot) = dyn;
599   VLOG(1) << "dynamic[" << slot << "] overwritten with " << dyn.d_tag;
600 }
601 
602 // Remove relative entries from dynamic relocations and write as packed
603 // data into android packed relocations.
604 template <typename ELF>
PackRelocations()605 bool ElfFile<ELF>::PackRelocations() {
606   // Load the ELF file into libelf.
607   if (!Load()) {
608     LOG(ERROR) << "Failed to load as ELF";
609     return false;
610   }
611 
612   // Retrieve the current dynamic relocations section data.
613   Elf_Data* data = GetSectionData(relocations_section_);
614   // we always pack rela, because packed format is pretty much the same
615   std::vector<typename ELF::Rela> relocations;
616 
617   if (relocations_type_ == REL) {
618     // Convert data to a vector of relocations.
619     const typename ELF::Rel* relocations_base = reinterpret_cast<typename ELF::Rel*>(data->d_buf);
620     ConvertRelArrayToRelaVector(relocations_base,
621         data->d_size / sizeof(typename ELF::Rel), &relocations);
622     VLOG(1) << "Relocations   : REL";
623   } else if (relocations_type_ == RELA) {
624     // Convert data to a vector of relocations with addends.
625     const typename ELF::Rela* relocations_base = reinterpret_cast<typename ELF::Rela*>(data->d_buf);
626     relocations = std::vector<typename ELF::Rela>(
627         relocations_base,
628         relocations_base + data->d_size / sizeof(relocations[0]));
629 
630     VLOG(1) << "Relocations   : RELA";
631   } else {
632     NOTREACHED();
633   }
634 
635   return PackTypedRelocations(&relocations);
636 }
637 
638 // Helper for PackRelocations().  Rel type is one of ELF::Rel or ELF::Rela.
639 template <typename ELF>
PackTypedRelocations(std::vector<typename ELF::Rela> * relocations)640 bool ElfFile<ELF>::PackTypedRelocations(std::vector<typename ELF::Rela>* relocations) {
641   typedef typename ELF::Rela Rela;
642 
643   if (has_android_relocations_) {
644     LOG(INFO) << "Relocation table is already packed";
645     return true;
646   }
647 
648   // If no relocations then we have nothing packable.  Perhaps
649   // the shared object has already been packed?
650   if (relocations->empty()) {
651     LOG(ERROR) << "No relocations found";
652     return false;
653   }
654 
655   const size_t rel_size =
656       relocations_type_ == RELA ? sizeof(typename ELF::Rela) : sizeof(typename ELF::Rel);
657   const size_t initial_bytes = relocations->size() * rel_size;
658 
659   VLOG(1) << "Unpacked                   : " << initial_bytes << " bytes";
660   std::vector<uint8_t> packed;
661   RelocationPacker<ELF> packer;
662 
663   // Pack relocations: dry run to estimate memory savings.
664   packer.PackRelocations(*relocations, &packed);
665   const size_t packed_bytes_estimate = packed.size() * sizeof(packed[0]);
666   VLOG(1) << "Packed         (no padding): " << packed_bytes_estimate << " bytes";
667 
668   if (packed.empty()) {
669     LOG(INFO) << "Too few relocations to pack";
670     return true;
671   }
672 
673   // Pre-calculate the size of the hole we will close up when we rewrite
674   // dynamic relocations.  We have to adjust relocation addresses to
675   // account for this.
676   typename ELF::Shdr* section_header = ELF::getshdr(relocations_section_);
677   ssize_t hole_size = initial_bytes - packed_bytes_estimate;
678 
679   // hole_size needs to be page_aligned.
680   hole_size -= hole_size % kPreserveAlignment;
681 
682   LOG(INFO) << "Compaction                 : " << hole_size << " bytes";
683 
684   // Adjusting for alignment may have removed any packing benefit.
685   if (hole_size == 0) {
686     LOG(INFO) << "Too few relocations to pack after alignment";
687     return true;
688   }
689 
690   if (hole_size <= 0) {
691     LOG(INFO) << "Packing relocations saves no space";
692     return true;
693   }
694 
695   size_t data_padding_bytes = is_padding_relocations_ ?
696       initial_bytes - packed_bytes_estimate :
697       initial_bytes - hole_size - packed_bytes_estimate;
698 
699   // pad data
700   std::vector<uint8_t> padding(data_padding_bytes, 0);
701   packed.insert(packed.end(), padding.begin(), padding.end());
702 
703   const void* packed_data = &packed[0];
704 
705   // Run a loopback self-test as a check that packing is lossless.
706   std::vector<Rela> unpacked;
707   packer.UnpackRelocations(packed, &unpacked);
708   CHECK(unpacked.size() == relocations->size());
709   CHECK(!memcmp(&unpacked[0],
710                 &relocations->at(0),
711                 unpacked.size() * sizeof(unpacked[0])));
712 
713   // Rewrite the current dynamic relocations section with packed one then shrink it to size.
714   const size_t bytes = packed.size() * sizeof(packed[0]);
715   ResizeSection(elf_, relocations_section_, bytes,
716       relocations_type_ == REL ? SHT_ANDROID_REL : SHT_ANDROID_RELA, relocations_type_);
717   RewriteSectionData(relocations_section_, packed_data, bytes);
718 
719   // TODO (dimitry): fix string table and replace .rel.dyn/plt with .android.rel.dyn/plt
720 
721   // Rewrite .dynamic and rename relocation tags describing the packed android
722   // relocations.
723   Elf_Data* data = GetSectionData(dynamic_section_);
724   const typename ELF::Dyn* dynamic_base = reinterpret_cast<typename ELF::Dyn*>(data->d_buf);
725   std::vector<typename ELF::Dyn> dynamics(
726       dynamic_base,
727       dynamic_base + data->d_size / sizeof(dynamics[0]));
728   section_header = ELF::getshdr(relocations_section_);
729   {
730     typename ELF::Dyn dyn;
731     dyn.d_tag = relocations_type_ == REL ? DT_ANDROID_REL : DT_ANDROID_RELA;
732     dyn.d_un.d_ptr = section_header->sh_addr;
733     ReplaceDynamicEntry<ELF>(relocations_type_ == REL ? DT_REL : DT_RELA, dyn, &dynamics);
734   }
735   {
736     typename ELF::Dyn dyn;
737     dyn.d_tag = relocations_type_ == REL ? DT_ANDROID_RELSZ : DT_ANDROID_RELASZ;
738     dyn.d_un.d_val = section_header->sh_size;
739     ReplaceDynamicEntry<ELF>(relocations_type_ == REL ? DT_RELSZ : DT_RELASZ, dyn, &dynamics);
740   }
741 
742   const void* dynamics_data = &dynamics[0];
743   const size_t dynamics_bytes = dynamics.size() * sizeof(dynamics[0]);
744   RewriteSectionData(dynamic_section_, dynamics_data, dynamics_bytes);
745 
746   Flush();
747   return true;
748 }
749 
750 // Find packed relative relocations in the packed android relocations
751 // section, unpack them, and rewrite the dynamic relocations section to
752 // contain unpacked data.
753 template <typename ELF>
UnpackRelocations()754 bool ElfFile<ELF>::UnpackRelocations() {
755   // Load the ELF file into libelf.
756   if (!Load()) {
757     LOG(ERROR) << "Failed to load as ELF";
758     return false;
759   }
760 
761   typename ELF::Shdr* section_header = ELF::getshdr(relocations_section_);
762   // Retrieve the current packed android relocations section data.
763   Elf_Data* data = GetSectionData(relocations_section_);
764 
765   // Convert data to a vector of bytes.
766   const uint8_t* packed_base = reinterpret_cast<uint8_t*>(data->d_buf);
767   std::vector<uint8_t> packed(
768       packed_base,
769       packed_base + data->d_size / sizeof(packed[0]));
770 
771   if ((section_header->sh_type == SHT_ANDROID_RELA || section_header->sh_type == SHT_ANDROID_REL) &&
772       packed.size() > 3 &&
773       packed[0] == 'A' &&
774       packed[1] == 'P' &&
775       packed[2] == 'S' &&
776       packed[3] == '2') {
777     LOG(INFO) << "Relocations   : " << (relocations_type_ == REL ? "REL" : "RELA");
778   } else {
779     LOG(ERROR) << "Packed relocations not found (not packed?)";
780     return false;
781   }
782 
783   return UnpackTypedRelocations(packed);
784 }
785 
786 // Helper for UnpackRelocations().  Rel type is one of ELF::Rel or ELF::Rela.
787 template <typename ELF>
UnpackTypedRelocations(const std::vector<uint8_t> & packed)788 bool ElfFile<ELF>::UnpackTypedRelocations(const std::vector<uint8_t>& packed) {
789   // Unpack the data to re-materialize the relative relocations.
790   const size_t packed_bytes = packed.size() * sizeof(packed[0]);
791   LOG(INFO) << "Packed           : " << packed_bytes << " bytes";
792   std::vector<typename ELF::Rela> unpacked_relocations;
793   RelocationPacker<ELF> packer;
794   packer.UnpackRelocations(packed, &unpacked_relocations);
795 
796   const size_t relocation_entry_size =
797       relocations_type_ == REL ? sizeof(typename ELF::Rel) : sizeof(typename ELF::Rela);
798   const size_t unpacked_bytes = unpacked_relocations.size() * relocation_entry_size;
799   LOG(INFO) << "Unpacked         : " << unpacked_bytes << " bytes";
800 
801   // Retrieve the current dynamic relocations section data.
802   Elf_Data* data = GetSectionData(relocations_section_);
803 
804   LOG(INFO) << "Relocations      : " << unpacked_relocations.size() << " entries";
805 
806   // If we found the same number of null relocation entries in the dynamic
807   // relocations section as we hold as unpacked relative relocations, then
808   // this is a padded file.
809 
810   const bool is_padded = packed_bytes == unpacked_bytes;
811 
812   // Unless padded, pre-apply relative relocations to account for the
813   // hole, and pre-adjust all relocation offsets accordingly.
814   typename ELF::Shdr* section_header = ELF::getshdr(relocations_section_);
815 
816   if (!is_padded) {
817     LOG(INFO) << "Expansion     : " << unpacked_bytes - packed_bytes << " bytes";
818   }
819 
820   // Rewrite the current dynamic relocations section with unpacked version of
821   // relocations.
822   const void* section_data = nullptr;
823   std::vector<typename ELF::Rel> unpacked_rel_relocations;
824   if (relocations_type_ == RELA) {
825     section_data = &unpacked_relocations[0];
826   } else if (relocations_type_ == REL) {
827     ConvertRelaVectorToRelVector(unpacked_relocations, &unpacked_rel_relocations);
828     section_data = &unpacked_rel_relocations[0];
829   } else {
830     NOTREACHED();
831   }
832 
833   ResizeSection(elf_, relocations_section_, unpacked_bytes,
834       relocations_type_ == REL ? SHT_REL : SHT_RELA, relocations_type_);
835   RewriteSectionData(relocations_section_, section_data, unpacked_bytes);
836 
837   // Rewrite .dynamic to remove two tags describing packed android relocations.
838   data = GetSectionData(dynamic_section_);
839   const typename ELF::Dyn* dynamic_base = reinterpret_cast<typename ELF::Dyn*>(data->d_buf);
840   std::vector<typename ELF::Dyn> dynamics(
841       dynamic_base,
842       dynamic_base + data->d_size / sizeof(dynamics[0]));
843   {
844     typename ELF::Dyn dyn;
845     dyn.d_tag = relocations_type_ == REL ? DT_REL : DT_RELA;
846     dyn.d_un.d_ptr = section_header->sh_addr;
847     ReplaceDynamicEntry<ELF>(relocations_type_ == REL ? DT_ANDROID_REL : DT_ANDROID_RELA,
848         dyn, &dynamics);
849   }
850 
851   {
852     typename ELF::Dyn dyn;
853     dyn.d_tag = relocations_type_ == REL ? DT_RELSZ : DT_RELASZ;
854     dyn.d_un.d_val = section_header->sh_size;
855     ReplaceDynamicEntry<ELF>(relocations_type_ == REL ? DT_ANDROID_RELSZ : DT_ANDROID_RELASZ,
856         dyn, &dynamics);
857   }
858 
859   const void* dynamics_data = &dynamics[0];
860   const size_t dynamics_bytes = dynamics.size() * sizeof(dynamics[0]);
861   RewriteSectionData(dynamic_section_, dynamics_data, dynamics_bytes);
862 
863   Flush();
864   return true;
865 }
866 
867 // Flush rewritten shared object file data.
868 template <typename ELF>
Flush()869 void ElfFile<ELF>::Flush() {
870   // Flag all ELF data held in memory as needing to be written back to the
871   // file, and tell libelf that we have controlled the file layout.
872   elf_flagelf(elf_, ELF_C_SET, ELF_F_DIRTY);
873   elf_flagelf(elf_, ELF_C_SET, ELF_F_LAYOUT);
874 
875   // Write ELF data back to disk.
876   const off_t file_bytes = elf_update(elf_, ELF_C_WRITE);
877   if (file_bytes == -1) {
878     LOG(ERROR) << "elf_update failed: " << elf_errmsg(elf_errno());
879   }
880 
881   CHECK(file_bytes > 0);
882   VLOG(1) << "elf_update returned: " << file_bytes;
883 
884   // Clean up libelf, and truncate the output file to the number of bytes
885   // written by elf_update().
886   elf_end(elf_);
887   elf_ = NULL;
888   const int truncate = ftruncate(fd_, file_bytes);
889   CHECK(truncate == 0);
890 }
891 
892 template <typename ELF>
ConvertRelArrayToRelaVector(const typename ELF::Rel * rel_array,size_t rel_array_size,std::vector<typename ELF::Rela> * rela_vector)893 void ElfFile<ELF>::ConvertRelArrayToRelaVector(const typename ELF::Rel* rel_array,
894                                                size_t rel_array_size,
895                                                std::vector<typename ELF::Rela>* rela_vector) {
896   for (size_t i = 0; i<rel_array_size; ++i) {
897     typename ELF::Rela rela;
898     rela.r_offset = rel_array[i].r_offset;
899     rela.r_info = rel_array[i].r_info;
900     rela.r_addend = 0;
901     rela_vector->push_back(rela);
902   }
903 }
904 
905 template <typename ELF>
ConvertRelaVectorToRelVector(const std::vector<typename ELF::Rela> & rela_vector,std::vector<typename ELF::Rel> * rel_vector)906 void ElfFile<ELF>::ConvertRelaVectorToRelVector(const std::vector<typename ELF::Rela>& rela_vector,
907                                                 std::vector<typename ELF::Rel>* rel_vector) {
908   for (auto rela : rela_vector) {
909     typename ELF::Rel rel;
910     rel.r_offset = rela.r_offset;
911     rel.r_info = rela.r_info;
912     CHECK(rela.r_addend == 0);
913     rel_vector->push_back(rel);
914   }
915 }
916 
917 template class ElfFile<ELF32_traits>;
918 template class ElfFile<ELF64_traits>;
919 
920 }  // namespace relocation_packer
921