1 /*
2 * parse_vdso.c: Linux reference vDSO parser
3 * Written by Andrew Lutomirski, 2011-2014.
4 *
5 * This code is meant to be linked in to various programs that run on Linux.
6 * As such, it is available with as few restrictions as possible. This file
7 * is licensed under the Creative Commons Zero License, version 1.0,
8 * available at http://creativecommons.org/publicdomain/zero/1.0/legalcode
9 *
10 * The vDSO is a regular ELF DSO that the kernel maps into user space when
11 * it starts a program. It works equally well in statically and dynamically
12 * linked binaries.
13 *
14 * This code is tested on x86. In principle it should work on any
15 * architecture that has a vDSO.
16 */
17
18 #include <stdbool.h>
19 #include <stdint.h>
20 #include <string.h>
21 #include <limits.h>
22 #include <elf.h>
23
24 /* And here's the code. */
25 #ifndef ELF_BITS
26 # if ULONG_MAX > 0xffffffffUL
27 # define ELF_BITS 64
28 # else
29 # define ELF_BITS 32
30 # endif
31 #endif
32
33 #define ELF_BITS_XFORM2(bits, x) Elf##bits##_##x
34 #define ELF_BITS_XFORM(bits, x) ELF_BITS_XFORM2(bits, x)
35 #define ELF(x) ELF_BITS_XFORM(ELF_BITS, x)
36
37 static struct vdso_info
38 {
39 bool valid;
40
41 /* Load information */
42 uintptr_t load_addr;
43 uintptr_t load_offset; /* load_addr - recorded vaddr */
44
45 /* Symbol table */
46 ELF(Sym) *symtab;
47 const char *symstrings;
48 void *bucket, *chain;
49 ELF(Word) nbucket, nchain;
50 bool hash_ent_is_dword;
51
52 /* Version table */
53 ELF(Versym) *versym;
54 ELF(Verdef) *verdef;
55 } vdso_info;
56
57 /* Straight from the ELF specification. */
elf_hash(const unsigned char * name)58 static unsigned long elf_hash(const unsigned char *name)
59 {
60 unsigned long h = 0, g;
61 while (*name)
62 {
63 h = (h << 4) + *name++;
64 if ((g = h & 0xf0000000))
65 h ^= g >> 24;
66 h &= ~g;
67 }
68 return h;
69 }
70
71 /* return value of hash table entry */
get_hash_val(void * ptr,ELF (Word)idx)72 ELF(Word) get_hash_val(void *ptr, ELF(Word) idx)
73 {
74 if (vdso_info.hash_ent_is_dword) {
75 ELF(Xword) *table = ptr;
76 /* for vdso assume all values fit in Elf Word */
77 return (ELF(Word)) table[idx];
78 }
79
80 ELF(Word) *table = ptr;
81 return table[idx];
82 }
83
84 /* return pointer to hash table entry */
get_hash_ptr(void * ptr,ELF (Word)idx)85 void *get_hash_ptr(void *ptr, ELF(Word) idx)
86 {
87 if (vdso_info.hash_ent_is_dword)
88 return &((ELF(Xword) *) ptr)[idx];
89
90 return &((ELF(Word) *) ptr)[idx];
91 }
92
vdso_init_from_sysinfo_ehdr(uintptr_t base)93 void vdso_init_from_sysinfo_ehdr(uintptr_t base)
94 {
95 size_t i;
96 bool found_vaddr = false;
97
98 vdso_info.valid = false;
99
100 vdso_info.load_addr = base;
101
102 ELF(Ehdr) *hdr = (ELF(Ehdr)*)base;
103 if (hdr->e_ident[EI_CLASS] !=
104 (ELF_BITS == 32 ? ELFCLASS32 : ELFCLASS64)) {
105 return; /* Wrong ELF class -- check ELF_BITS */
106 }
107
108 /* 64bit s390 and alpha have hash entry size of 8 bytes */
109 if ((hdr->e_machine == EM_ALPHA
110 || hdr->e_machine == EM_S390)
111 && hdr->e_ident[EI_CLASS] == ELFCLASS64)
112 vdso_info.hash_ent_is_dword = true;
113 else
114 vdso_info.hash_ent_is_dword = false;
115
116 ELF(Phdr) *pt = (ELF(Phdr)*)(vdso_info.load_addr + hdr->e_phoff);
117 ELF(Dyn) *dyn = 0;
118
119 /*
120 * We need two things from the segment table: the load offset
121 * and the dynamic table.
122 */
123 for (i = 0; i < hdr->e_phnum; i++)
124 {
125 if (pt[i].p_type == PT_LOAD && !found_vaddr) {
126 found_vaddr = true;
127 vdso_info.load_offset = base
128 + (uintptr_t)pt[i].p_offset
129 - (uintptr_t)pt[i].p_vaddr;
130 } else if (pt[i].p_type == PT_DYNAMIC) {
131 dyn = (ELF(Dyn)*)(base + pt[i].p_offset);
132 }
133 }
134
135 if (!found_vaddr || !dyn)
136 return; /* Failed */
137
138 /*
139 * Fish out the useful bits of the dynamic table.
140 */
141 ELF(Word) *hash = 0;
142 vdso_info.symstrings = 0;
143 vdso_info.symtab = 0;
144 vdso_info.versym = 0;
145 vdso_info.verdef = 0;
146 for (i = 0; dyn[i].d_tag != DT_NULL; i++) {
147 switch (dyn[i].d_tag) {
148 case DT_STRTAB:
149 vdso_info.symstrings = (const char *)
150 ((uintptr_t)dyn[i].d_un.d_ptr
151 + vdso_info.load_offset);
152 break;
153 case DT_SYMTAB:
154 vdso_info.symtab = (ELF(Sym) *)
155 ((uintptr_t)dyn[i].d_un.d_ptr
156 + vdso_info.load_offset);
157 break;
158 case DT_HASH:
159 hash = (ELF(Word) *)
160 ((uintptr_t)dyn[i].d_un.d_ptr
161 + vdso_info.load_offset);
162 break;
163 case DT_VERSYM:
164 vdso_info.versym = (ELF(Versym) *)
165 ((uintptr_t)dyn[i].d_un.d_ptr
166 + vdso_info.load_offset);
167 break;
168 case DT_VERDEF:
169 vdso_info.verdef = (ELF(Verdef) *)
170 ((uintptr_t)dyn[i].d_un.d_ptr
171 + vdso_info.load_offset);
172 break;
173 }
174 }
175 if (!vdso_info.symstrings || !vdso_info.symtab || !hash)
176 return; /* Failed */
177
178 if (!vdso_info.verdef)
179 vdso_info.versym = 0;
180
181
182 vdso_info.nbucket = get_hash_val(hash, 0);
183 vdso_info.nchain = get_hash_val(hash, 1);
184 vdso_info.bucket = get_hash_ptr(hash, 2);
185 vdso_info.chain = get_hash_ptr(hash, vdso_info.nbucket + 2);
186
187 /* That's all we need. */
188 vdso_info.valid = true;
189 }
190
vdso_match_version(ELF (Versym)ver,const char * name,ELF (Word)hash)191 static bool vdso_match_version(ELF(Versym) ver,
192 const char *name, ELF(Word) hash)
193 {
194 /*
195 * This is a helper function to check if the version indexed by
196 * ver matches name (which hashes to hash).
197 *
198 * The version definition table is a mess, and I don't know how
199 * to do this in better than linear time without allocating memory
200 * to build an index. I also don't know why the table has
201 * variable size entries in the first place.
202 *
203 * For added fun, I can't find a comprehensible specification of how
204 * to parse all the weird flags in the table.
205 *
206 * So I just parse the whole table every time.
207 */
208
209 /* First step: find the version definition */
210 ver &= 0x7fff; /* Apparently bit 15 means "hidden" */
211 ELF(Verdef) *def = vdso_info.verdef;
212 while(true) {
213 if ((def->vd_flags & VER_FLG_BASE) == 0
214 && (def->vd_ndx & 0x7fff) == ver)
215 break;
216
217 if (def->vd_next == 0)
218 return false; /* No definition. */
219
220 def = (ELF(Verdef) *)((char *)def + def->vd_next);
221 }
222
223 /* Now figure out whether it matches. */
224 ELF(Verdaux) *aux = (ELF(Verdaux)*)((char *)def + def->vd_aux);
225 return def->vd_hash == hash
226 && !strcmp(name, vdso_info.symstrings + aux->vda_name);
227 }
228
vdso_sym(const char * version,const char * name)229 void *vdso_sym(const char *version, const char *name)
230 {
231 unsigned long ver_hash;
232 if (!vdso_info.valid)
233 return 0;
234
235 ver_hash = elf_hash((const void*)version);
236 ELF(Word) chain = get_hash_val(vdso_info.bucket,
237 elf_hash((const void*)name) % vdso_info.nbucket);
238
239 for (; chain != STN_UNDEF; chain = get_hash_val(vdso_info.chain, chain)) {
240 ELF(Sym) *sym = &vdso_info.symtab[chain];
241
242 /* Check for a defined global or weak function w/ right name. */
243 if (ELF64_ST_TYPE(sym->st_info) != STT_FUNC)
244 continue;
245 if (ELF64_ST_BIND(sym->st_info) != STB_GLOBAL &&
246 ELF64_ST_BIND(sym->st_info) != STB_WEAK)
247 continue;
248 if (sym->st_shndx == SHN_UNDEF)
249 continue;
250 if (strcmp(name, vdso_info.symstrings + sym->st_name))
251 continue;
252
253 /* Check symbol version. */
254 if (vdso_info.versym
255 && !vdso_match_version(vdso_info.versym[chain],
256 version, ver_hash))
257 continue;
258
259 return (void *)(vdso_info.load_offset + sym->st_value);
260 }
261
262 return 0;
263 }
264
vdso_init_from_auxv(void * auxv)265 void vdso_init_from_auxv(void *auxv)
266 {
267 int i;
268
269 ELF(auxv_t) *elf_auxv = auxv;
270 for (i = 0; elf_auxv[i].a_type != AT_NULL; i++) {
271 if (elf_auxv[i].a_type == AT_SYSINFO_EHDR) {
272 vdso_init_from_sysinfo_ehdr(elf_auxv[i].a_un.a_val);
273 return;
274 }
275 }
276
277 vdso_info.valid = false;
278 }
279