1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 // Implementation notes:
6 //
7 // We need to remove a piece from the ELF shared library. However, we also
8 // want to avoid fixing DWARF cfi data and relative relocation addresses.
9 // So after packing we shift offets and starting address of the RX segment
10 // while preserving code/data vaddrs location.
11 // This requires some fixups for symtab/hash/gnu_hash dynamic section addresses.
12
13 #include "elf_file.h"
14
15 #include <stdlib.h>
16 #include <sys/types.h>
17 #include <unistd.h>
18 #include <algorithm>
19 #include <string>
20 #include <vector>
21
22 #include "debug.h"
23 #include "elf_traits.h"
24 #include "libelf.h"
25 #include "packer.h"
26
27 namespace relocation_packer {
28
29 // Out-of-band dynamic tags used to indicate the offset and size of the
30 // android packed relocations section.
31 static constexpr int32_t DT_ANDROID_REL = DT_LOOS + 2;
32 static constexpr int32_t DT_ANDROID_RELSZ = DT_LOOS + 3;
33
34 static constexpr int32_t DT_ANDROID_RELA = DT_LOOS + 4;
35 static constexpr int32_t DT_ANDROID_RELASZ = DT_LOOS + 5;
36
37 static constexpr uint32_t SHT_ANDROID_REL = SHT_LOOS + 1;
38 static constexpr uint32_t SHT_ANDROID_RELA = SHT_LOOS + 2;
39
40 static const size_t kPageSize = 4096;
41
42 // Alignment to preserve, in bytes. This must be at least as large as the
43 // largest d_align and sh_addralign values found in the loaded file.
44 // Out of caution for RELRO page alignment, we preserve to a complete target
45 // page. See http://www.airs.com/blog/archives/189.
46 static const size_t kPreserveAlignment = kPageSize;
47
48 // Get section data. Checks that the section has exactly one data entry,
49 // so that the section size and the data size are the same. True in
50 // practice for all sections we resize when packing or unpacking. Done
51 // by ensuring that a call to elf_getdata(section, data) returns NULL as
52 // the next data entry.
GetSectionData(Elf_Scn * section)53 static Elf_Data* GetSectionData(Elf_Scn* section) {
54 Elf_Data* data = elf_getdata(section, NULL);
55 CHECK(data && elf_getdata(section, data) == NULL);
56 return data;
57 }
58
59 // Rewrite section data. Allocates new data and makes it the data element's
60 // buffer. Relies on program exit to free allocated data.
RewriteSectionData(Elf_Scn * section,const void * section_data,size_t size)61 static void RewriteSectionData(Elf_Scn* section,
62 const void* section_data,
63 size_t size) {
64 Elf_Data* data = GetSectionData(section);
65 CHECK(size == data->d_size);
66 uint8_t* area = new uint8_t[size];
67 memcpy(area, section_data, size);
68 data->d_buf = area;
69 }
70
71 // Verbose ELF header logging.
72 template <typename Ehdr>
VerboseLogElfHeader(const Ehdr * elf_header)73 static void VerboseLogElfHeader(const Ehdr* elf_header) {
74 VLOG(1) << "e_phoff = " << elf_header->e_phoff;
75 VLOG(1) << "e_shoff = " << elf_header->e_shoff;
76 VLOG(1) << "e_ehsize = " << elf_header->e_ehsize;
77 VLOG(1) << "e_phentsize = " << elf_header->e_phentsize;
78 VLOG(1) << "e_phnum = " << elf_header->e_phnum;
79 VLOG(1) << "e_shnum = " << elf_header->e_shnum;
80 VLOG(1) << "e_shstrndx = " << elf_header->e_shstrndx;
81 }
82
83 // Verbose ELF program header logging.
84 template <typename Phdr>
VerboseLogProgramHeader(size_t program_header_index,const Phdr * program_header)85 static void VerboseLogProgramHeader(size_t program_header_index,
86 const Phdr* program_header) {
87 std::string type;
88 switch (program_header->p_type) {
89 case PT_NULL: type = "NULL"; break;
90 case PT_LOAD: type = "LOAD"; break;
91 case PT_DYNAMIC: type = "DYNAMIC"; break;
92 case PT_INTERP: type = "INTERP"; break;
93 case PT_PHDR: type = "PHDR"; break;
94 case PT_GNU_RELRO: type = "GNU_RELRO"; break;
95 case PT_GNU_STACK: type = "GNU_STACK"; break;
96 case PT_ARM_EXIDX: type = "EXIDX"; break;
97 default: type = "(OTHER)"; break;
98 }
99 VLOG(1) << "phdr[" << program_header_index << "] : " << type;
100 VLOG(1) << " p_offset = " << program_header->p_offset;
101 VLOG(1) << " p_vaddr = " << program_header->p_vaddr;
102 VLOG(1) << " p_paddr = " << program_header->p_paddr;
103 VLOG(1) << " p_filesz = " << program_header->p_filesz;
104 VLOG(1) << " p_memsz = " << program_header->p_memsz;
105 VLOG(1) << " p_flags = " << program_header->p_flags;
106 VLOG(1) << " p_align = " << program_header->p_align;
107 }
108
109 // Verbose ELF section header logging.
110 template <typename Shdr>
VerboseLogSectionHeader(const std::string & section_name,const Shdr * section_header)111 static void VerboseLogSectionHeader(const std::string& section_name,
112 const Shdr* section_header) {
113 VLOG(1) << "section " << section_name;
114 VLOG(1) << " sh_addr = " << section_header->sh_addr;
115 VLOG(1) << " sh_offset = " << section_header->sh_offset;
116 VLOG(1) << " sh_size = " << section_header->sh_size;
117 VLOG(1) << " sh_entsize = " << section_header->sh_entsize;
118 VLOG(1) << " sh_addralign = " << section_header->sh_addralign;
119 }
120
121 // Verbose ELF section data logging.
VerboseLogSectionData(const Elf_Data * data)122 static void VerboseLogSectionData(const Elf_Data* data) {
123 VLOG(1) << " data";
124 VLOG(1) << " d_buf = " << data->d_buf;
125 VLOG(1) << " d_off = " << data->d_off;
126 VLOG(1) << " d_size = " << data->d_size;
127 VLOG(1) << " d_align = " << data->d_align;
128 }
129
130 // Load the complete ELF file into a memory image in libelf, and identify
131 // the .rel.dyn or .rela.dyn, .dynamic, and .android.rel.dyn or
132 // .android.rela.dyn sections. No-op if the ELF file has already been loaded.
133 template <typename ELF>
Load()134 bool ElfFile<ELF>::Load() {
135 if (elf_)
136 return true;
137
138 Elf* elf = elf_begin(fd_, ELF_C_RDWR, NULL);
139 CHECK(elf);
140
141 if (elf_kind(elf) != ELF_K_ELF) {
142 LOG(ERROR) << "File not in ELF format";
143 return false;
144 }
145
146 auto elf_header = ELF::getehdr(elf);
147 if (!elf_header) {
148 LOG(ERROR) << "Failed to load ELF header: " << elf_errmsg(elf_errno());
149 return false;
150 }
151
152 if (elf_header->e_type != ET_DYN) {
153 LOG(ERROR) << "ELF file is not a shared object";
154 return false;
155 }
156
157 // Require that our endianness matches that of the target, and that both
158 // are little-endian. Safe for all current build/target combinations.
159 const int endian = elf_header->e_ident[EI_DATA];
160 CHECK(endian == ELFDATA2LSB);
161 CHECK(__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__);
162
163 const int file_class = elf_header->e_ident[EI_CLASS];
164 VLOG(1) << "endian = " << endian << ", file class = " << file_class;
165 VerboseLogElfHeader(elf_header);
166
167 auto elf_program_header = ELF::getphdr(elf);
168 CHECK(elf_program_header != nullptr);
169
170 const typename ELF::Phdr* dynamic_program_header = NULL;
171 for (size_t i = 0; i < elf_header->e_phnum; ++i) {
172 auto program_header = &elf_program_header[i];
173 VerboseLogProgramHeader(i, program_header);
174
175 if (program_header->p_type == PT_DYNAMIC) {
176 CHECK(dynamic_program_header == NULL);
177 dynamic_program_header = program_header;
178 }
179 }
180 CHECK(dynamic_program_header != nullptr);
181
182 size_t string_index;
183 elf_getshdrstrndx(elf, &string_index);
184
185 // Notes of the dynamic relocations, packed relocations, and .dynamic
186 // sections. Found while iterating sections, and later stored in class
187 // attributes.
188 Elf_Scn* found_relocations_section = nullptr;
189 Elf_Scn* found_dynamic_section = nullptr;
190
191 // Notes of relocation section types seen. We require one or the other of
192 // these; both is unsupported.
193 bool has_rel_relocations = false;
194 bool has_rela_relocations = false;
195 bool has_android_relocations = false;
196
197 Elf_Scn* section = NULL;
198 while ((section = elf_nextscn(elf, section)) != nullptr) {
199 auto section_header = ELF::getshdr(section);
200 std::string name = elf_strptr(elf, string_index, section_header->sh_name);
201 VerboseLogSectionHeader(name, section_header);
202
203 // Note relocation section types.
204 if (section_header->sh_type == SHT_REL || section_header->sh_type == SHT_ANDROID_REL) {
205 has_rel_relocations = true;
206 }
207 if (section_header->sh_type == SHT_RELA || section_header->sh_type == SHT_ANDROID_RELA) {
208 has_rela_relocations = true;
209 }
210
211 // Note special sections as we encounter them.
212 if ((name == ".rel.dyn" || name == ".rela.dyn") &&
213 section_header->sh_size > 0) {
214 found_relocations_section = section;
215
216 // Note if relocation section is already packed
217 has_android_relocations =
218 section_header->sh_type == SHT_ANDROID_REL ||
219 section_header->sh_type == SHT_ANDROID_RELA;
220 }
221
222 if (section_header->sh_offset == dynamic_program_header->p_offset) {
223 found_dynamic_section = section;
224 }
225
226 // Ensure we preserve alignment, repeated later for the data block(s).
227 CHECK(section_header->sh_addralign <= kPreserveAlignment);
228
229 Elf_Data* data = NULL;
230 while ((data = elf_getdata(section, data)) != NULL) {
231 CHECK(data->d_align <= kPreserveAlignment);
232 VerboseLogSectionData(data);
233 }
234 }
235
236 // Loading failed if we did not find the required special sections.
237 if (!found_relocations_section) {
238 LOG(ERROR) << "Missing or empty .rel.dyn or .rela.dyn section";
239 return false;
240 }
241 if (!found_dynamic_section) {
242 LOG(ERROR) << "Missing .dynamic section";
243 return false;
244 }
245
246 // Loading failed if we could not identify the relocations type.
247 if (!has_rel_relocations && !has_rela_relocations) {
248 LOG(ERROR) << "No relocations sections found";
249 return false;
250 }
251 if (has_rel_relocations && has_rela_relocations) {
252 LOG(ERROR) << "Multiple relocations sections with different types found, "
253 << "not currently supported";
254 return false;
255 }
256
257 elf_ = elf;
258 relocations_section_ = found_relocations_section;
259 dynamic_section_ = found_dynamic_section;
260 relocations_type_ = has_rel_relocations ? REL : RELA;
261 has_android_relocations_ = has_android_relocations;
262 return true;
263 }
264
265 // Helper for ResizeSection(). Adjust the main ELF header for the hole.
266 template <typename ELF>
AdjustElfHeaderForHole(typename ELF::Ehdr * elf_header,typename ELF::Off hole_start,ssize_t hole_size)267 static void AdjustElfHeaderForHole(typename ELF::Ehdr* elf_header,
268 typename ELF::Off hole_start,
269 ssize_t hole_size) {
270 if (elf_header->e_phoff > hole_start) {
271 elf_header->e_phoff += hole_size;
272 VLOG(1) << "e_phoff adjusted to " << elf_header->e_phoff;
273 }
274 if (elf_header->e_shoff > hole_start) {
275 elf_header->e_shoff += hole_size;
276 VLOG(1) << "e_shoff adjusted to " << elf_header->e_shoff;
277 }
278 }
279
280 // Helper for ResizeSection(). Adjust all section headers for the hole.
281 template <typename ELF>
AdjustSectionHeadersForHole(Elf * elf,typename ELF::Off hole_start,ssize_t hole_size)282 static void AdjustSectionHeadersForHole(Elf* elf,
283 typename ELF::Off hole_start,
284 ssize_t hole_size) {
285 size_t string_index;
286 elf_getshdrstrndx(elf, &string_index);
287
288 Elf_Scn* section = NULL;
289 while ((section = elf_nextscn(elf, section)) != NULL) {
290 auto section_header = ELF::getshdr(section);
291 std::string name = elf_strptr(elf, string_index, section_header->sh_name);
292
293 if (section_header->sh_offset > hole_start) {
294 section_header->sh_offset += hole_size;
295 VLOG(1) << "section " << name
296 << " sh_offset adjusted to " << section_header->sh_offset;
297 } else {
298 section_header->sh_addr -= hole_size;
299 VLOG(1) << "section " << name
300 << " sh_addr adjusted to " << section_header->sh_addr;
301 }
302 }
303 }
304
305 // Helper for ResizeSection(). Adjust the offsets of any program headers
306 // that have offsets currently beyond the hole start.
307 template <typename ELF>
AdjustProgramHeaderOffsets(typename ELF::Phdr * program_headers,size_t count,typename ELF::Off hole_start,ssize_t hole_size)308 static void AdjustProgramHeaderOffsets(typename ELF::Phdr* program_headers,
309 size_t count,
310 typename ELF::Off hole_start,
311 ssize_t hole_size) {
312 for (size_t i = 0; i < count; ++i) {
313 typename ELF::Phdr* program_header = &program_headers[i];
314
315 // Do not adjust PT_GNU_STACK - it confuses gdb and results
316 // in incorrect unwinding if the executable is stripped after
317 // packing.
318 if (program_header->p_type == PT_GNU_STACK) {
319 continue;
320 }
321
322 if (program_header->p_offset > hole_start) {
323 // The hole start is past this segment, so adjust offset.
324 program_header->p_offset += hole_size;
325 VLOG(1) << "phdr[" << i
326 << "] p_offset adjusted to "<< program_header->p_offset;
327 } else {
328 program_header->p_vaddr -= hole_size;
329 program_header->p_paddr -= hole_size;
330 if (program_header->p_align > kPageSize) {
331 program_header->p_align = kPageSize;
332 }
333 VLOG(1) << "phdr[" << i
334 << "] p_vaddr adjusted to "<< program_header->p_vaddr
335 << "; p_paddr adjusted to "<< program_header->p_paddr
336 << "; p_align adjusted to "<< program_header->p_align;
337 }
338 }
339 }
340
341 // Helper for ResizeSection(). Find the first loadable segment in the
342 // file. We expect it to map from file offset zero.
343 template <typename ELF>
FindLoadSegmentForHole(typename ELF::Phdr * program_headers,size_t count,typename ELF::Off hole_start)344 static typename ELF::Phdr* FindLoadSegmentForHole(typename ELF::Phdr* program_headers,
345 size_t count,
346 typename ELF::Off hole_start) {
347 for (size_t i = 0; i < count; ++i) {
348 typename ELF::Phdr* program_header = &program_headers[i];
349
350 if (program_header->p_type == PT_LOAD &&
351 program_header->p_offset <= hole_start &&
352 (program_header->p_offset + program_header->p_filesz) >= hole_start ) {
353 return program_header;
354 }
355 }
356 LOG(FATAL) << "Cannot locate a LOAD segment with hole_start=0x" << std::hex << hole_start;
357 NOTREACHED();
358
359 return nullptr;
360 }
361
362 // Helper for ResizeSection(). Rewrite program headers.
363 template <typename ELF>
RewriteProgramHeadersForHole(Elf * elf,typename ELF::Off hole_start,ssize_t hole_size)364 static void RewriteProgramHeadersForHole(Elf* elf,
365 typename ELF::Off hole_start,
366 ssize_t hole_size) {
367 const typename ELF::Ehdr* elf_header = ELF::getehdr(elf);
368 CHECK(elf_header);
369
370 typename ELF::Phdr* elf_program_header = ELF::getphdr(elf);
371 CHECK(elf_program_header);
372
373 const size_t program_header_count = elf_header->e_phnum;
374
375 // Locate the segment that we can overwrite to form the new LOAD entry,
376 // and the segment that we are going to split into two parts.
377 typename ELF::Phdr* target_load_header =
378 FindLoadSegmentForHole<ELF>(elf_program_header, program_header_count, hole_start);
379
380 VLOG(1) << "phdr[" << target_load_header - elf_program_header << "] adjust";
381 // Adjust PT_LOAD program header memsz and filesz
382 target_load_header->p_filesz += hole_size;
383 target_load_header->p_memsz += hole_size;
384
385 // Adjust the offsets and p_vaddrs
386 AdjustProgramHeaderOffsets<ELF>(elf_program_header,
387 program_header_count,
388 hole_start,
389 hole_size);
390 }
391
392 // Helper for ResizeSection(). Locate and return the dynamic section.
393 template <typename ELF>
GetDynamicSection(Elf * elf)394 static Elf_Scn* GetDynamicSection(Elf* elf) {
395 const typename ELF::Ehdr* elf_header = ELF::getehdr(elf);
396 CHECK(elf_header);
397
398 const typename ELF::Phdr* elf_program_header = ELF::getphdr(elf);
399 CHECK(elf_program_header);
400
401 // Find the program header that describes the dynamic section.
402 const typename ELF::Phdr* dynamic_program_header = NULL;
403 for (size_t i = 0; i < elf_header->e_phnum; ++i) {
404 const typename ELF::Phdr* program_header = &elf_program_header[i];
405
406 if (program_header->p_type == PT_DYNAMIC) {
407 dynamic_program_header = program_header;
408 }
409 }
410 CHECK(dynamic_program_header);
411
412 // Now find the section with the same offset as this program header.
413 Elf_Scn* dynamic_section = NULL;
414 Elf_Scn* section = NULL;
415 while ((section = elf_nextscn(elf, section)) != NULL) {
416 typename ELF::Shdr* section_header = ELF::getshdr(section);
417
418 if (section_header->sh_offset == dynamic_program_header->p_offset) {
419 dynamic_section = section;
420 }
421 }
422 CHECK(dynamic_section != NULL);
423
424 return dynamic_section;
425 }
426
427 // Helper for ResizeSection(). Adjust the .dynamic section for the hole.
428 template <typename ELF>
AdjustDynamicSectionForHole(Elf_Scn * dynamic_section,typename ELF::Off hole_start,ssize_t hole_size,relocations_type_t relocations_type)429 void ElfFile<ELF>::AdjustDynamicSectionForHole(Elf_Scn* dynamic_section,
430 typename ELF::Off hole_start,
431 ssize_t hole_size,
432 relocations_type_t relocations_type) {
433 CHECK(relocations_type != NONE);
434 Elf_Data* data = GetSectionData(dynamic_section);
435
436 auto dynamic_base = reinterpret_cast<typename ELF::Dyn*>(data->d_buf);
437 std::vector<typename ELF::Dyn> dynamics(
438 dynamic_base,
439 dynamic_base + data->d_size / sizeof(dynamics[0]));
440
441 if (hole_size > 0) { // expanding
442 hole_start += hole_size;
443 }
444
445 for (size_t i = 0; i < dynamics.size(); ++i) {
446 typename ELF::Dyn* dynamic = &dynamics[i];
447 const typename ELF::Sword tag = dynamic->d_tag;
448
449 // Any tags that hold offsets are adjustment candidates.
450 const bool is_adjustable = (tag == DT_PLTGOT ||
451 tag == DT_HASH ||
452 tag == DT_GNU_HASH ||
453 tag == DT_STRTAB ||
454 tag == DT_SYMTAB ||
455 tag == DT_RELA ||
456 tag == DT_INIT ||
457 tag == DT_FINI ||
458 tag == DT_REL ||
459 tag == DT_JMPREL ||
460 tag == DT_INIT_ARRAY ||
461 tag == DT_FINI_ARRAY ||
462 tag == DT_VERSYM ||
463 tag == DT_VERNEED ||
464 tag == DT_VERDEF ||
465 tag == DT_ANDROID_REL||
466 tag == DT_ANDROID_RELA);
467
468 if (is_adjustable && dynamic->d_un.d_ptr <= hole_start) {
469 dynamic->d_un.d_ptr -= hole_size;
470 VLOG(1) << "dynamic[" << i << "] " << dynamic->d_tag
471 << " d_ptr adjusted to " << dynamic->d_un.d_ptr;
472 }
473
474 // DT_RELSZ or DT_RELASZ indicate the overall size of relocations.
475 // Only one will be present. Adjust by hole size.
476 if (tag == DT_RELSZ || tag == DT_RELASZ || tag == DT_ANDROID_RELSZ || tag == DT_ANDROID_RELASZ) {
477 dynamic->d_un.d_val += hole_size;
478 VLOG(1) << "dynamic[" << i << "] " << dynamic->d_tag
479 << " d_val adjusted to " << dynamic->d_un.d_val;
480 }
481
482 // Special case: DT_MIPS_RLD_MAP2 stores the difference between dynamic
483 // entry address and the address of the _r_debug (used by GDB)
484 // since the dynamic section and target address are on the
485 // different sides of the hole it needs to be adjusted accordingly
486 if (tag == DT_MIPS_RLD_MAP2) {
487 dynamic->d_un.d_val += hole_size;
488 VLOG(1) << "dynamic[" << i << "] " << dynamic->d_tag
489 << " d_val adjusted to " << dynamic->d_un.d_val;
490 }
491
492 // Ignore DT_RELCOUNT and DT_RELACOUNT: (1) nobody uses them and
493 // technically (2) the relative relocation count is not changed.
494
495 // DT_RELENT and DT_RELAENT don't change, ignore them as well.
496 }
497
498 void* section_data = &dynamics[0];
499 size_t bytes = dynamics.size() * sizeof(dynamics[0]);
500 RewriteSectionData(dynamic_section, section_data, bytes);
501 }
502
503 // Resize a section. If the new size is larger than the current size, open
504 // up a hole by increasing file offsets that come after the hole. If smaller
505 // than the current size, remove the hole by decreasing those offsets.
506 template <typename ELF>
ResizeSection(Elf * elf,Elf_Scn * section,size_t new_size,typename ELF::Word new_sh_type,relocations_type_t relocations_type)507 void ElfFile<ELF>::ResizeSection(Elf* elf, Elf_Scn* section, size_t new_size,
508 typename ELF::Word new_sh_type,
509 relocations_type_t relocations_type) {
510
511 size_t string_index;
512 elf_getshdrstrndx(elf, &string_index);
513 auto section_header = ELF::getshdr(section);
514 std::string name = elf_strptr(elf, string_index, section_header->sh_name);
515
516 if (section_header->sh_size == new_size) {
517 return;
518 }
519
520 // Require that the section size and the data size are the same. True
521 // in practice for all sections we resize when packing or unpacking.
522 Elf_Data* data = GetSectionData(section);
523 CHECK(data->d_off == 0 && data->d_size == section_header->sh_size);
524
525 // Require that the section is not zero-length (that is, has allocated
526 // data that we can validly expand).
527 CHECK(data->d_size && data->d_buf);
528
529 const auto hole_start = section_header->sh_offset;
530 const ssize_t hole_size = new_size - data->d_size;
531
532 VLOG_IF(1, (hole_size > 0)) << "expand section (" << name << ") size: " <<
533 data->d_size << " -> " << (data->d_size + hole_size);
534 VLOG_IF(1, (hole_size < 0)) << "shrink section (" << name << ") size: " <<
535 data->d_size << " -> " << (data->d_size + hole_size);
536
537 // libelf overrides sh_entsize for known sh_types, so it does not matter what we set
538 // for SHT_REL/SHT_RELA.
539 typename ELF::Xword new_entsize =
540 (new_sh_type == SHT_ANDROID_REL || new_sh_type == SHT_ANDROID_RELA) ? 1 : 0;
541
542 VLOG(1) << "Update section (" << name << ") entry size: " <<
543 section_header->sh_entsize << " -> " << new_entsize;
544
545 // Resize the data and the section header.
546 data->d_size += hole_size;
547 section_header->sh_size += hole_size;
548 section_header->sh_entsize = new_entsize;
549 section_header->sh_type = new_sh_type;
550
551 // Add the hole size to all offsets in the ELF file that are after the
552 // start of the hole. If the hole size is positive we are expanding the
553 // section to create a new hole; if negative, we are closing up a hole.
554
555 // Start with the main ELF header.
556 typename ELF::Ehdr* elf_header = ELF::getehdr(elf);
557 AdjustElfHeaderForHole<ELF>(elf_header, hole_start, hole_size);
558
559 // Adjust all section headers.
560 AdjustSectionHeadersForHole<ELF>(elf, hole_start, hole_size);
561
562 // Rewrite the program headers to either split or coalesce segments,
563 // and adjust dynamic entries to match.
564 RewriteProgramHeadersForHole<ELF>(elf, hole_start, hole_size);
565
566 Elf_Scn* dynamic_section = GetDynamicSection<ELF>(elf);
567 AdjustDynamicSectionForHole(dynamic_section, hole_start, hole_size, relocations_type);
568 }
569
570 // Find the first slot in a dynamics array with the given tag. The array
571 // always ends with a free (unused) element, and which we exclude from the
572 // search. Returns dynamics->size() if not found.
573 template <typename ELF>
FindDynamicEntry(typename ELF::Sword tag,std::vector<typename ELF::Dyn> * dynamics)574 static size_t FindDynamicEntry(typename ELF::Sword tag,
575 std::vector<typename ELF::Dyn>* dynamics) {
576 // Loop until the penultimate entry. We exclude the end sentinel.
577 for (size_t i = 0; i < dynamics->size() - 1; ++i) {
578 if (dynamics->at(i).d_tag == tag) {
579 return i;
580 }
581 }
582
583 // The tag was not found.
584 return dynamics->size();
585 }
586
587 // Replace dynamic entry.
588 template <typename ELF>
ReplaceDynamicEntry(typename ELF::Sword tag,const typename ELF::Dyn & dyn,std::vector<typename ELF::Dyn> * dynamics)589 static void ReplaceDynamicEntry(typename ELF::Sword tag,
590 const typename ELF::Dyn& dyn,
591 std::vector<typename ELF::Dyn>* dynamics) {
592 const size_t slot = FindDynamicEntry<ELF>(tag, dynamics);
593 if (slot == dynamics->size()) {
594 LOG(FATAL) << "Dynamic slot is not found for tag=" << tag;
595 }
596
597 // Replace this entry with the one supplied.
598 dynamics->at(slot) = dyn;
599 VLOG(1) << "dynamic[" << slot << "] overwritten with " << dyn.d_tag;
600 }
601
602 // Remove relative entries from dynamic relocations and write as packed
603 // data into android packed relocations.
604 template <typename ELF>
PackRelocations()605 bool ElfFile<ELF>::PackRelocations() {
606 // Load the ELF file into libelf.
607 if (!Load()) {
608 LOG(ERROR) << "Failed to load as ELF";
609 return false;
610 }
611
612 // Retrieve the current dynamic relocations section data.
613 Elf_Data* data = GetSectionData(relocations_section_);
614 // we always pack rela, because packed format is pretty much the same
615 std::vector<typename ELF::Rela> relocations;
616
617 if (relocations_type_ == REL) {
618 // Convert data to a vector of relocations.
619 const typename ELF::Rel* relocations_base = reinterpret_cast<typename ELF::Rel*>(data->d_buf);
620 ConvertRelArrayToRelaVector(relocations_base,
621 data->d_size / sizeof(typename ELF::Rel), &relocations);
622 VLOG(1) << "Relocations : REL";
623 } else if (relocations_type_ == RELA) {
624 // Convert data to a vector of relocations with addends.
625 const typename ELF::Rela* relocations_base = reinterpret_cast<typename ELF::Rela*>(data->d_buf);
626 relocations = std::vector<typename ELF::Rela>(
627 relocations_base,
628 relocations_base + data->d_size / sizeof(relocations[0]));
629
630 VLOG(1) << "Relocations : RELA";
631 } else {
632 NOTREACHED();
633 }
634
635 return PackTypedRelocations(&relocations);
636 }
637
638 // Helper for PackRelocations(). Rel type is one of ELF::Rel or ELF::Rela.
639 template <typename ELF>
PackTypedRelocations(std::vector<typename ELF::Rela> * relocations)640 bool ElfFile<ELF>::PackTypedRelocations(std::vector<typename ELF::Rela>* relocations) {
641 typedef typename ELF::Rela Rela;
642
643 if (has_android_relocations_) {
644 LOG(INFO) << "Relocation table is already packed";
645 return true;
646 }
647
648 // If no relocations then we have nothing packable. Perhaps
649 // the shared object has already been packed?
650 if (relocations->empty()) {
651 LOG(ERROR) << "No relocations found";
652 return false;
653 }
654
655 const size_t rel_size =
656 relocations_type_ == RELA ? sizeof(typename ELF::Rela) : sizeof(typename ELF::Rel);
657 const size_t initial_bytes = relocations->size() * rel_size;
658
659 VLOG(1) << "Unpacked : " << initial_bytes << " bytes";
660 std::vector<uint8_t> packed;
661 RelocationPacker<ELF> packer;
662
663 // Pack relocations: dry run to estimate memory savings.
664 packer.PackRelocations(*relocations, &packed);
665 const size_t packed_bytes_estimate = packed.size() * sizeof(packed[0]);
666 VLOG(1) << "Packed (no padding): " << packed_bytes_estimate << " bytes";
667
668 if (packed.empty()) {
669 LOG(INFO) << "Too few relocations to pack";
670 return true;
671 }
672
673 // Pre-calculate the size of the hole we will close up when we rewrite
674 // dynamic relocations. We have to adjust relocation addresses to
675 // account for this.
676 typename ELF::Shdr* section_header = ELF::getshdr(relocations_section_);
677 ssize_t hole_size = initial_bytes - packed_bytes_estimate;
678
679 // hole_size needs to be page_aligned.
680 hole_size -= hole_size % kPreserveAlignment;
681
682 LOG(INFO) << "Compaction : " << hole_size << " bytes";
683
684 // Adjusting for alignment may have removed any packing benefit.
685 if (hole_size == 0) {
686 LOG(INFO) << "Too few relocations to pack after alignment";
687 return true;
688 }
689
690 if (hole_size <= 0) {
691 LOG(INFO) << "Packing relocations saves no space";
692 return true;
693 }
694
695 size_t data_padding_bytes = is_padding_relocations_ ?
696 initial_bytes - packed_bytes_estimate :
697 initial_bytes - hole_size - packed_bytes_estimate;
698
699 // pad data
700 std::vector<uint8_t> padding(data_padding_bytes, 0);
701 packed.insert(packed.end(), padding.begin(), padding.end());
702
703 const void* packed_data = &packed[0];
704
705 // Run a loopback self-test as a check that packing is lossless.
706 std::vector<Rela> unpacked;
707 packer.UnpackRelocations(packed, &unpacked);
708 CHECK(unpacked.size() == relocations->size());
709 CHECK(!memcmp(&unpacked[0],
710 &relocations->at(0),
711 unpacked.size() * sizeof(unpacked[0])));
712
713 // Rewrite the current dynamic relocations section with packed one then shrink it to size.
714 const size_t bytes = packed.size() * sizeof(packed[0]);
715 ResizeSection(elf_, relocations_section_, bytes,
716 relocations_type_ == REL ? SHT_ANDROID_REL : SHT_ANDROID_RELA, relocations_type_);
717 RewriteSectionData(relocations_section_, packed_data, bytes);
718
719 // TODO (dimitry): fix string table and replace .rel.dyn/plt with .android.rel.dyn/plt
720
721 // Rewrite .dynamic and rename relocation tags describing the packed android
722 // relocations.
723 Elf_Data* data = GetSectionData(dynamic_section_);
724 const typename ELF::Dyn* dynamic_base = reinterpret_cast<typename ELF::Dyn*>(data->d_buf);
725 std::vector<typename ELF::Dyn> dynamics(
726 dynamic_base,
727 dynamic_base + data->d_size / sizeof(dynamics[0]));
728 section_header = ELF::getshdr(relocations_section_);
729 {
730 typename ELF::Dyn dyn;
731 dyn.d_tag = relocations_type_ == REL ? DT_ANDROID_REL : DT_ANDROID_RELA;
732 dyn.d_un.d_ptr = section_header->sh_addr;
733 ReplaceDynamicEntry<ELF>(relocations_type_ == REL ? DT_REL : DT_RELA, dyn, &dynamics);
734 }
735 {
736 typename ELF::Dyn dyn;
737 dyn.d_tag = relocations_type_ == REL ? DT_ANDROID_RELSZ : DT_ANDROID_RELASZ;
738 dyn.d_un.d_val = section_header->sh_size;
739 ReplaceDynamicEntry<ELF>(relocations_type_ == REL ? DT_RELSZ : DT_RELASZ, dyn, &dynamics);
740 }
741
742 const void* dynamics_data = &dynamics[0];
743 const size_t dynamics_bytes = dynamics.size() * sizeof(dynamics[0]);
744 RewriteSectionData(dynamic_section_, dynamics_data, dynamics_bytes);
745
746 Flush();
747 return true;
748 }
749
750 // Find packed relative relocations in the packed android relocations
751 // section, unpack them, and rewrite the dynamic relocations section to
752 // contain unpacked data.
753 template <typename ELF>
UnpackRelocations()754 bool ElfFile<ELF>::UnpackRelocations() {
755 // Load the ELF file into libelf.
756 if (!Load()) {
757 LOG(ERROR) << "Failed to load as ELF";
758 return false;
759 }
760
761 typename ELF::Shdr* section_header = ELF::getshdr(relocations_section_);
762 // Retrieve the current packed android relocations section data.
763 Elf_Data* data = GetSectionData(relocations_section_);
764
765 // Convert data to a vector of bytes.
766 const uint8_t* packed_base = reinterpret_cast<uint8_t*>(data->d_buf);
767 std::vector<uint8_t> packed(
768 packed_base,
769 packed_base + data->d_size / sizeof(packed[0]));
770
771 if ((section_header->sh_type == SHT_ANDROID_RELA || section_header->sh_type == SHT_ANDROID_REL) &&
772 packed.size() > 3 &&
773 packed[0] == 'A' &&
774 packed[1] == 'P' &&
775 packed[2] == 'S' &&
776 packed[3] == '2') {
777 LOG(INFO) << "Relocations : " << (relocations_type_ == REL ? "REL" : "RELA");
778 } else {
779 LOG(ERROR) << "Packed relocations not found (not packed?)";
780 return false;
781 }
782
783 return UnpackTypedRelocations(packed);
784 }
785
786 // Helper for UnpackRelocations(). Rel type is one of ELF::Rel or ELF::Rela.
787 template <typename ELF>
UnpackTypedRelocations(const std::vector<uint8_t> & packed)788 bool ElfFile<ELF>::UnpackTypedRelocations(const std::vector<uint8_t>& packed) {
789 // Unpack the data to re-materialize the relative relocations.
790 const size_t packed_bytes = packed.size() * sizeof(packed[0]);
791 LOG(INFO) << "Packed : " << packed_bytes << " bytes";
792 std::vector<typename ELF::Rela> unpacked_relocations;
793 RelocationPacker<ELF> packer;
794 packer.UnpackRelocations(packed, &unpacked_relocations);
795
796 const size_t relocation_entry_size =
797 relocations_type_ == REL ? sizeof(typename ELF::Rel) : sizeof(typename ELF::Rela);
798 const size_t unpacked_bytes = unpacked_relocations.size() * relocation_entry_size;
799 LOG(INFO) << "Unpacked : " << unpacked_bytes << " bytes";
800
801 // Retrieve the current dynamic relocations section data.
802 Elf_Data* data = GetSectionData(relocations_section_);
803
804 LOG(INFO) << "Relocations : " << unpacked_relocations.size() << " entries";
805
806 // If we found the same number of null relocation entries in the dynamic
807 // relocations section as we hold as unpacked relative relocations, then
808 // this is a padded file.
809
810 const bool is_padded = packed_bytes == unpacked_bytes;
811
812 // Unless padded, pre-apply relative relocations to account for the
813 // hole, and pre-adjust all relocation offsets accordingly.
814 typename ELF::Shdr* section_header = ELF::getshdr(relocations_section_);
815
816 if (!is_padded) {
817 LOG(INFO) << "Expansion : " << unpacked_bytes - packed_bytes << " bytes";
818 }
819
820 // Rewrite the current dynamic relocations section with unpacked version of
821 // relocations.
822 const void* section_data = nullptr;
823 std::vector<typename ELF::Rel> unpacked_rel_relocations;
824 if (relocations_type_ == RELA) {
825 section_data = &unpacked_relocations[0];
826 } else if (relocations_type_ == REL) {
827 ConvertRelaVectorToRelVector(unpacked_relocations, &unpacked_rel_relocations);
828 section_data = &unpacked_rel_relocations[0];
829 } else {
830 NOTREACHED();
831 }
832
833 ResizeSection(elf_, relocations_section_, unpacked_bytes,
834 relocations_type_ == REL ? SHT_REL : SHT_RELA, relocations_type_);
835 RewriteSectionData(relocations_section_, section_data, unpacked_bytes);
836
837 // Rewrite .dynamic to remove two tags describing packed android relocations.
838 data = GetSectionData(dynamic_section_);
839 const typename ELF::Dyn* dynamic_base = reinterpret_cast<typename ELF::Dyn*>(data->d_buf);
840 std::vector<typename ELF::Dyn> dynamics(
841 dynamic_base,
842 dynamic_base + data->d_size / sizeof(dynamics[0]));
843 {
844 typename ELF::Dyn dyn;
845 dyn.d_tag = relocations_type_ == REL ? DT_REL : DT_RELA;
846 dyn.d_un.d_ptr = section_header->sh_addr;
847 ReplaceDynamicEntry<ELF>(relocations_type_ == REL ? DT_ANDROID_REL : DT_ANDROID_RELA,
848 dyn, &dynamics);
849 }
850
851 {
852 typename ELF::Dyn dyn;
853 dyn.d_tag = relocations_type_ == REL ? DT_RELSZ : DT_RELASZ;
854 dyn.d_un.d_val = section_header->sh_size;
855 ReplaceDynamicEntry<ELF>(relocations_type_ == REL ? DT_ANDROID_RELSZ : DT_ANDROID_RELASZ,
856 dyn, &dynamics);
857 }
858
859 const void* dynamics_data = &dynamics[0];
860 const size_t dynamics_bytes = dynamics.size() * sizeof(dynamics[0]);
861 RewriteSectionData(dynamic_section_, dynamics_data, dynamics_bytes);
862
863 Flush();
864 return true;
865 }
866
867 // Flush rewritten shared object file data.
868 template <typename ELF>
Flush()869 void ElfFile<ELF>::Flush() {
870 // Flag all ELF data held in memory as needing to be written back to the
871 // file, and tell libelf that we have controlled the file layout.
872 elf_flagelf(elf_, ELF_C_SET, ELF_F_DIRTY);
873 elf_flagelf(elf_, ELF_C_SET, ELF_F_LAYOUT);
874
875 // Write ELF data back to disk.
876 const off_t file_bytes = elf_update(elf_, ELF_C_WRITE);
877 if (file_bytes == -1) {
878 LOG(ERROR) << "elf_update failed: " << elf_errmsg(elf_errno());
879 }
880
881 CHECK(file_bytes > 0);
882 VLOG(1) << "elf_update returned: " << file_bytes;
883
884 // Clean up libelf, and truncate the output file to the number of bytes
885 // written by elf_update().
886 elf_end(elf_);
887 elf_ = NULL;
888 const int truncate = ftruncate(fd_, file_bytes);
889 CHECK(truncate == 0);
890 }
891
892 template <typename ELF>
ConvertRelArrayToRelaVector(const typename ELF::Rel * rel_array,size_t rel_array_size,std::vector<typename ELF::Rela> * rela_vector)893 void ElfFile<ELF>::ConvertRelArrayToRelaVector(const typename ELF::Rel* rel_array,
894 size_t rel_array_size,
895 std::vector<typename ELF::Rela>* rela_vector) {
896 for (size_t i = 0; i<rel_array_size; ++i) {
897 typename ELF::Rela rela;
898 rela.r_offset = rel_array[i].r_offset;
899 rela.r_info = rel_array[i].r_info;
900 rela.r_addend = 0;
901 rela_vector->push_back(rela);
902 }
903 }
904
905 template <typename ELF>
ConvertRelaVectorToRelVector(const std::vector<typename ELF::Rela> & rela_vector,std::vector<typename ELF::Rel> * rel_vector)906 void ElfFile<ELF>::ConvertRelaVectorToRelVector(const std::vector<typename ELF::Rela>& rela_vector,
907 std::vector<typename ELF::Rel>* rel_vector) {
908 for (auto rela : rela_vector) {
909 typename ELF::Rel rel;
910 rel.r_offset = rela.r_offset;
911 rel.r_info = rela.r_info;
912 CHECK(rela.r_addend == 0);
913 rel_vector->push_back(rel);
914 }
915 }
916
917 template class ElfFile<ELF32_traits>;
918 template class ElfFile<ELF64_traits>;
919
920 } // namespace relocation_packer
921