src/dyldInitialization.cpp

   1 /* -*- mode: C++; c-basic-offset: 4; tab-width: 4 -*-
   2  *
   3  * Copyright (c) 2004-2008 Apple Inc. All rights reserved.
   4  *
   5  * @APPLE_LICENSE_HEADER_START@
   6  *
   7  * This file contains Original Code and/or Modifications of Original Code
   8  * as defined in and that are subject to the Apple Public Source License
   9  * Version 2.0 (the 'License'). You may not use this file except in
  10  * compliance with the License. Please obtain a copy of the License at
  11  * http://www.opensource.apple.com/apsl/ and read it before using this
  12  * file.
  13  *
  14  * The Original Code and all software distributed under the License are
  15  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  16  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  17  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  19  * Please see the License for the specific language governing rights and
  20  * limitations under the License.
  21  *
  22  * @APPLE_LICENSE_HEADER_END@
  23  */
  24
  25 #define __STDC_LIMIT_MACROS
  26 #include <stdint.h>
  27 #include <stddef.h>
  28 #include <string.h>
  29 #include <stdlib.h>
  30 #include <Availability.h>
  31 #include <mach/mach.h>
  32 #include <mach-o/loader.h>
  33 #include <mach-o/ldsyms.h>
  34 #include <mach-o/reloc.h>
  35 #if __x86_64__
  36         #include <mach-o/x86_64/reloc.h>
  37 #endif
  38 #include "dyld.h"
  39 #include "dyldSyscallInterface.h"
  40
  41 // from dyld_gdb.cpp
  42 extern void addImagesToAllImages(uint32_t infoCount, const dyld_image_info info[]);
  43 extern void syncProcessInfo();
  44
  45 #ifndef MH_PIE
  46         #define MH_PIE 0x200000
  47 #endif
  48
  49 // currently dyld has no initializers, but if some come back, set this to non-zero
  50 #define DYLD_INITIALIZER_SUPPORT  0
  51
  52 #if __LP64__
  53         #define LC_SEGMENT_COMMAND              LC_SEGMENT_64
  54         #define macho_segment_command   segment_command_64
  55         #define macho_section                   section_64
  56         #define RELOC_SIZE                              3
  57 #else
  58         #define LC_SEGMENT_COMMAND              LC_SEGMENT
  59         #define macho_segment_command   segment_command
  60         #define macho_section                   section
  61         #define RELOC_SIZE                              2
  62 #endif
  63
  64 #if __x86_64__
  65         #define POINTER_RELOC X86_64_RELOC_UNSIGNED
  66 #else
  67         #define POINTER_RELOC GENERIC_RELOC_VANILLA
  68 #endif
  69
  70 #ifndef BIND_OPCODE_THREADED
  71 #define BIND_OPCODE_THREADED    0xD0
  72 #endif
  73
  74 #ifndef BIND_SUBOPCODE_THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB
  75 #define BIND_SUBOPCODE_THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB    0x00
  76 #endif
  77
  78 #ifndef BIND_SUBOPCODE_THREADED_APPLY
  79 #define BIND_SUBOPCODE_THREADED_APPLY                                0x01
  80 #endif
  81
  82
  83 #if __has_feature(ptrauth_calls)
  84 #include <ptrauth.h>
  85 #endif
  86
  87
  88 #if TARGET_IPHONE_SIMULATOR
  89 const dyld::SyscallHelpers* gSyscallHelpers = NULL;
  90 #endif
  91
  92
  93 //
  94 //  Code to bootstrap dyld into a runnable state
  95 //
  96 //
  97
  98 namespace dyldbootstrap {
  99
 100
 101
 102 #if DYLD_INITIALIZER_SUPPORT
 103
 104 typedef void (*Initializer)(int argc, const char* argv[], const char* envp[], const char* apple[]);
 105
 106 extern const Initializer  inits_start  __asm("section$start$__DATA$__mod_init_func");
 107 extern const Initializer  inits_end    __asm("section$end$__DATA$__mod_init_func");
 108
 109 //
 110 // For a regular executable, the crt code calls dyld to run the executables initializers.
 111 // For a static executable, crt directly runs the initializers.
 112 // dyld (should be static) but is a dynamic executable and needs this hack to run its own initializers.
 113 // We pass argc, argv, etc in case libc.a uses those arguments
 114 //
 115 static void runDyldInitializers(const struct macho_header* mh, intptr_t slide, int argc, const char* argv[], const char* envp[], const char* apple[])
 116 {
 117         for (const Initializer* p = &inits_start; p < &inits_end; ++p) {
 118                 (*p)(argc, argv, envp, apple);
 119         }
 120 }
 121 #endif // DYLD_INITIALIZER_SUPPORT
 122
 123
 124 //
 125 //  The kernel may have slid a Position Independent Executable
 126 //
 127 static uintptr_t slideOfMainExecutable(const struct macho_header* mh)
 128 {
 129         const uint32_t cmd_count = mh->ncmds;
 130         const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header));
 131         const struct load_command* cmd = cmds;
 132         for (uint32_t i = 0; i < cmd_count; ++i) {
 133                 if ( cmd->cmd == LC_SEGMENT_COMMAND ) {
 134                         const struct macho_segment_command* segCmd = (struct macho_segment_command*)cmd;
 135                         if ( (segCmd->fileoff == 0) && (segCmd->filesize != 0)) {
 136                                 return (uintptr_t)mh - segCmd->vmaddr;
 137                         }
 138                 }
 139                 cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
 140         }
 141         return 0;
 142 }
 143
 144 inline uint64_t read_uleb128(const uint8_t*& p, const uint8_t* end) {
 145     uint64_t result = 0;
 146     int         bit = 0;
 147     do {
 148         if (p == end)
 149             throw "malformed uleb128 extends beyond trie";
 150         uint64_t slice = *p & 0x7f;
 151
 152         if (bit >= 64 || slice << bit >> bit != slice)
 153             throw "uleb128 too big for 64-bits";
 154         else {
 155             result |= (slice << bit);
 156             bit += 7;
 157         }
 158     }
 159     while (*p++ & 0x80);
 160     return result;
 161 }
 162
 163 inline int64_t read_sleb128(const uint8_t*& p, const uint8_t* end)
 164 {
 165     int64_t result = 0;
 166     int bit = 0;
 167     uint8_t byte;
 168     do {
 169         if (p == end)
 170             throw "malformed sleb128";
 171         byte = *p++;
 172         result |= (((int64_t)(byte & 0x7f)) << bit);
 173         bit += 7;
 174     } while (byte & 0x80);
 175     // sign extend negative numbers
 176     if ( (byte & 0x40) != 0 )
 177         result |= (~0ULL) << bit;
 178     return result;
 179 }
 180
 181
 182 //
 183 // If the kernel does not load dyld at its preferred address, we need to apply
 184 // fixups to various initialized parts of the __DATA segment
 185 //
 186 static void rebaseDyld(const struct macho_header* mh, intptr_t slide)
 187 {
 188         // rebase non-lazy pointers (which all point internal to dyld, since dyld uses no shared libraries)
 189         // and get interesting pointers into dyld
 190         const uint32_t cmd_count = mh->ncmds;
 191         const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header));
 192         const struct load_command* cmd = cmds;
 193
 194     // First look for compressed info and use it if it exists.
 195     const struct macho_segment_command* linkEditSeg = NULL;
 196     const dyld_info_command* dyldInfoCmd = NULL;
 197     for (uint32_t i = 0; i < cmd_count; ++i) {
 198         switch (cmd->cmd) {
 199             case LC_SEGMENT_COMMAND:
 200             {
 201                 const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
 202                 if ( strcmp(seg->segname, "__LINKEDIT") == 0 )
 203                     linkEditSeg = seg;
 204                 break;
 205             }
 206             case LC_DYLD_INFO_ONLY:
 207                 dyldInfoCmd = (struct dyld_info_command*)cmd;
 208                 break;
 209         }
 210         if (dyldInfoCmd && linkEditSeg)
 211             break;
 212         cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
 213     }
 214     if ( linkEditSeg == NULL )
 215         throw "dyld missing LINKEDIT";
 216
 217     // Reset the iterator.
 218     cmd = cmds;
 219
 220     auto getSegmentAtIndex = [cmd_count, cmds](unsigned segIndex) -> const struct macho_segment_command* {
 221         const struct load_command* cmd = cmds;
 222         for (uint32_t i = 0; i < cmd_count; ++i) {
 223             switch (cmd->cmd) {
 224                 case LC_SEGMENT_COMMAND:
 225                     if (!segIndex) {
 226                         const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
 227                         return seg;
 228                     }
 229                     --segIndex;
 230                     break;
 231             }
 232             cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
 233         }
 234         throw "out of bounds command";
 235         return 0;
 236     };
 237
 238     auto segActualLoadAddress = [&](unsigned segIndex) -> uintptr_t {
 239         const struct macho_segment_command* seg = getSegmentAtIndex(segIndex);
 240         return seg->vmaddr + slide;
 241     };
 242
 243 #if __has_feature(ptrauth_calls)
 244     auto imageBaseAddress = [cmds, cmd_count]() -> uintptr_t {
 245         const struct load_command* cmd = cmds;
 246         for (uint32_t i = 0; i < cmd_count; ++i) {
 247             switch (cmd->cmd) {
 248                 case LC_SEGMENT_COMMAND: {
 249                     const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
 250                     if ( (seg->fileoff == 0) && (seg->filesize != 0) )
 251                         return seg->vmaddr;
 252                     break;
 253                 }
 254             }
 255             cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
 256         }
 257         return 0;
 258     };
 259 #endif
 260
 261     if (dyldInfoCmd && (dyldInfoCmd->bind_size != 0) ) {
 262         if ( dyldInfoCmd->rebase_size != 0 )
 263             throw "unthreaded rebases are not supported";
 264
 265         const uint8_t* linkEditBase = (uint8_t*)(linkEditSeg->vmaddr + slide - linkEditSeg->fileoff);
 266
 267         const uint8_t* const start = linkEditBase + dyldInfoCmd->bind_off;
 268         const uint8_t* const end = &start[dyldInfoCmd->bind_size];
 269         const uint8_t* p = start;
 270
 271         uintptr_t segmentStartAddress = 0;
 272         uint64_t segOffset = 0;
 273         int segIndex = 0;
 274 #if __has_feature(ptrauth_calls)
 275         uintptr_t fBaseAddress = imageBaseAddress();
 276 #endif
 277         bool done = false;
 278
 279         while ( !done && (p < end) ) {
 280             uint8_t immediate = *p & BIND_IMMEDIATE_MASK;
 281             uint8_t opcode = *p & BIND_OPCODE_MASK;
 282             ++p;
 283             switch (opcode) {
 284                 case BIND_OPCODE_DONE:
 285                     done = true;
 286                     break;
 287                 case BIND_OPCODE_SET_DYLIB_ORDINAL_IMM:
 288                     break;
 289                 case BIND_OPCODE_SET_DYLIB_ORDINAL_ULEB:
 290                     break;
 291                 case BIND_OPCODE_SET_DYLIB_SPECIAL_IMM:
 292                     break;
 293                 case BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM:
 294                     while (*p != '\0')
 295                         ++p;
 296                     ++p;
 297                     break;
 298                 case BIND_OPCODE_SET_TYPE_IMM:
 299                     break;
 300                 case BIND_OPCODE_SET_ADDEND_SLEB:
 301                     read_sleb128(p, end);
 302                     break;
 303                 case BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
 304                     segIndex = immediate;
 305                     segmentStartAddress = segActualLoadAddress(segIndex);
 306                     segOffset = read_uleb128(p, end);
 307                     break;
 308                 case BIND_OPCODE_ADD_ADDR_ULEB:
 309                     segOffset += read_uleb128(p, end);
 310                     break;
 311                 case BIND_OPCODE_DO_BIND:
 312                     break;
 313                 case BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB:
 314                     break;
 315                 case BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED:
 316                     break;
 317                 case BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB:
 318                     read_uleb128(p, end);
 319                     read_uleb128(p, end);
 320                     break;
 321                 case BIND_OPCODE_THREADED:
 322                     // Note the immediate is a sub opcode
 323                     switch (immediate) {
 324                         case BIND_SUBOPCODE_THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB:
 325                             read_uleb128(p, end);
 326                             break;
 327                         case BIND_SUBOPCODE_THREADED_APPLY: {
 328                             uint64_t delta = 0;
 329                             do {
 330                                 uintptr_t address = segmentStartAddress + (uintptr_t)segOffset;
 331                                 uint64_t value = *(uint64_t*)address;
 332
 333 #if __has_feature(ptrauth_calls)
 334                                 uint16_t diversity = (uint16_t)(value >> 32);
 335                                 bool hasAddressDiversity = (value & (1ULL << 48)) != 0;
 336                                 ptrauth_key key = (ptrauth_key)((value >> 49) & 0x3);
 337                                 bool isAuthenticated = (value & (1ULL << 63)) != 0;
 338 #endif
 339                                 bool isRebase = (value & (1ULL << 62)) == 0;
 340                                 if (isRebase) {
 341
 342 #if __has_feature(ptrauth_calls)
 343                                     if (isAuthenticated) {
 344                                         // The new value for a rebase is the low 32-bits of the threaded value plus the slide.
 345                                         uint64_t newValue = (value & 0xFFFFFFFF) + slide;
 346                                         // Add in the offset from the mach_header
 347                                         newValue += fBaseAddress;
 348                                         // We have bits to merge in to the discriminator
 349                                         uintptr_t discriminator = diversity;
 350                                         if (hasAddressDiversity) {
 351                                             // First calculate a new discriminator using the address of where we are trying to store the value
 352                                             discriminator = __builtin_ptrauth_blend_discriminator((void*)address, discriminator);
 353                                         }
 354                                         switch (key) {
 355                                             case ptrauth_key_asia:
 356                                                 newValue = (uintptr_t)__builtin_ptrauth_sign_unauthenticated((void*)newValue, ptrauth_key_asia, discriminator);
 357                                                 break;
 358                                             case ptrauth_key_asib:
 359                                                 newValue = (uintptr_t)__builtin_ptrauth_sign_unauthenticated((void*)newValue, ptrauth_key_asib, discriminator);
 360                                                 break;
 361                                             case ptrauth_key_asda:
 362                                                 newValue = (uintptr_t)__builtin_ptrauth_sign_unauthenticated((void*)newValue, ptrauth_key_asda, discriminator);
 363                                                 break;
 364                                             case ptrauth_key_asdb:
 365                                                 newValue = (uintptr_t)__builtin_ptrauth_sign_unauthenticated((void*)newValue, ptrauth_key_asdb, discriminator);
 366                                                 break;
 367                                         }
 368                                         *(uint64_t*)address = newValue;
 369                                     } else
 370 #endif
 371                                     {
 372                                         // Regular pointer which needs to fit in 51-bits of value.
 373                                         // C++ RTTI uses the top bit, so we'll allow the whole top-byte
 374                                         // and the signed-extended bottom 43-bits to be fit in to 51-bits.
 375                                         uint64_t top8Bits = value & 0x0007F80000000000ULL;
 376                                         uint64_t bottom43Bits = value & 0x000007FFFFFFFFFFULL;
 377                                         uint64_t targetValue = ( top8Bits << 13 ) | (((intptr_t)(bottom43Bits << 21) >> 21) & 0x00FFFFFFFFFFFFFF);
 378                                         targetValue = targetValue + slide;
 379                                         *(uint64_t*)address = targetValue;
 380                                     }
 381                                 }
 382
 383                                 // The delta is bits [51..61]
 384                                 // And bit 62 is to tell us if we are a rebase (0) or bind (1)
 385                                 value &= ~(1ULL << 62);
 386                                 delta = ( value & 0x3FF8000000000000 ) >> 51;
 387                                 segOffset += delta * sizeof(uintptr_t);
 388                             } while ( delta != 0 );
 389                             break;
 390                         }
 391                         default:
 392                             throw "unknown threaded bind subopcode";
 393                     }
 394                     break;
 395                 default:
 396                     throw "unknown bind opcode";
 397             }
 398         }
 399         return;
 400     }
 401
 402 #if __x86_64__
 403         const struct macho_segment_command* firstWritableSeg = NULL;
 404 #endif
 405         const struct dysymtab_command* dynamicSymbolTable = NULL;
 406         for (uint32_t i = 0; i < cmd_count; ++i) {
 407                 switch (cmd->cmd) {
 408                         case LC_SEGMENT_COMMAND:
 409                                 {
 410                                         const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
 411                                         const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command));
 412                                         const struct macho_section* const sectionsEnd = &sectionsStart[seg->nsects];
 413                                         for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
 414                                                 const uint8_t type = sect->flags & SECTION_TYPE;
 415                                                 if ( type == S_NON_LAZY_SYMBOL_POINTERS ) {
 416                                                         // rebase non-lazy pointers (which all point internal to dyld, since dyld uses no shared libraries)
 417                                                         const uint32_t pointerCount = (uint32_t)(sect->size / sizeof(uintptr_t));
 418                                                         uintptr_t* const symbolPointers = (uintptr_t*)(sect->addr + slide);
 419                                                         for (uint32_t j=0; j < pointerCount; ++j) {
 420                                                                 symbolPointers[j] += slide;
 421                                                         }
 422                                                 }
 423                                         }
 424 #if __x86_64__
 425                                         if ( (firstWritableSeg == NULL) && (seg->initprot & VM_PROT_WRITE) )
 426                                                 firstWritableSeg = seg;
 427 #endif
 428                                 }
 429                                 break;
 430                         case LC_DYSYMTAB:
 431                                 dynamicSymbolTable = (struct dysymtab_command *)cmd;
 432                                 break;
 433                 }
 434                 cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
 435         }
 436
 437         // use reloc's to rebase all random data pointers
 438 #if __x86_64__
 439     if ( firstWritableSeg == NULL )
 440         throw "no writable segment in dyld";
 441         const uintptr_t relocBase = firstWritableSeg->vmaddr + slide;
 442 #else
 443         const uintptr_t relocBase = (uintptr_t)mh;
 444 #endif
 445         const relocation_info* const relocsStart = (struct relocation_info*)(linkEditSeg->vmaddr + slide + dynamicSymbolTable->locreloff - linkEditSeg->fileoff);
 446         const relocation_info* const relocsEnd = &relocsStart[dynamicSymbolTable->nlocrel];
 447         for (const relocation_info* reloc=relocsStart; reloc < relocsEnd; ++reloc) {
 448                 if ( reloc->r_length != RELOC_SIZE )
 449                         throw "relocation in dyld has wrong size";
 450
 451                 if ( reloc->r_type != POINTER_RELOC )
 452                         throw "relocation in dyld has wrong type";
 453
 454                 // update pointer by amount dyld slid
 455                 *((uintptr_t*)(reloc->r_address + relocBase)) += slide;
 456         }
 457 }
 458
 459
 460 extern "C" void mach_init();
 461 extern "C" void __guard_setup(const char* apple[]);
 462
 463
 464 //
 465 //  This is code to bootstrap dyld.  This work in normally done for a program by dyld and crt.
 466 //  In dyld we have to do this manually.
 467 //
 468 uintptr_t start(const struct macho_header* appsMachHeader, int argc, const char* argv[],
 469                                 intptr_t slide, const struct macho_header* dyldsMachHeader,
 470                                 uintptr_t* startGlue)
 471 {
 472         // if kernel had to slide dyld, we need to fix up load sensitive locations
 473         // we have to do this before using any global variables
 474     slide = slideOfMainExecutable(dyldsMachHeader);
 475     bool shouldRebase = slide != 0;
 476 #if __has_feature(ptrauth_calls)
 477     shouldRebase = true;
 478 #endif
 479     if ( shouldRebase ) {
 480         rebaseDyld(dyldsMachHeader, slide);
 481     }
 482
 483         // allow dyld to use mach messaging
 484         mach_init();
 485
 486         // kernel sets up env pointer to be just past end of agv array
 487         const char** envp = &argv[argc+1];
 488
 489         // kernel sets up apple pointer to be just past end of envp array
 490         const char** apple = envp;
 491         while(*apple != NULL) { ++apple; }
 492         ++apple;
 493
 494         // set up random value for stack canary
 495         __guard_setup(apple);
 496
 497 #if DYLD_INITIALIZER_SUPPORT
 498         // run all C++ initializers inside dyld
 499         runDyldInitializers(dyldsMachHeader, slide, argc, argv, envp, apple);
 500 #endif
 501
 502         // now that we are done bootstrapping dyld, call dyld's main
 503         uintptr_t appsSlide = slideOfMainExecutable(appsMachHeader);
 504         return dyld::_main(appsMachHeader, appsSlide, argc, argv, envp, apple, startGlue);
 505 }
 506
 507
 508 #if TARGET_IPHONE_SIMULATOR
 509
 510 extern "C" uintptr_t start_sim(int argc, const char* argv[], const char* envp[], const char* apple[],
 511                                                         const macho_header* mainExecutableMH, const macho_header* dyldMH, uintptr_t dyldSlide,
 512                                                         const dyld::SyscallHelpers*, uintptr_t* startGlue);
 513
 514
 515 uintptr_t start_sim(int argc, const char* argv[], const char* envp[], const char* apple[],
 516                                         const macho_header* mainExecutableMH, const macho_header* dyldMH, uintptr_t dyldSlide,
 517                                         const dyld::SyscallHelpers* sc, uintptr_t* startGlue)
 518 {
 519         // if simulator dyld loaded slid, it needs to rebase itself
 520         // we have to do this before using any global variables
 521         if ( dyldSlide != 0 ) {
 522                 rebaseDyld(dyldMH, dyldSlide);
 523         }
 524
 525         // save table of syscall pointers
 526         gSyscallHelpers = sc;
 527
 528         // allow dyld to use mach messaging
 529         mach_init();
 530
 531         // set up random value for stack canary
 532         __guard_setup(apple);
 533
 534         // setup gProcessInfo to point to host dyld's struct
 535         dyld::gProcessInfo = (struct dyld_all_image_infos*)(sc->getProcessInfo());
 536         syncProcessInfo();
 537
 538         // now that we are done bootstrapping dyld, call dyld's main
 539         uintptr_t appsSlide = slideOfMainExecutable(mainExecutableMH);
 540         return dyld::_main(mainExecutableMH, appsSlide, argc, argv, envp, apple, startGlue);
 541 }
 542 #endif
 543
 544
 545 } // end of namespace
 546
 547
 548
 549