plt.c revision 052b5f191ec00b7677c43278cb2ce886af1d0ef1
1d914a206a11cc1011a45f00674b1e16988fae77fJuan Cespedes#include <gelf.h> 2a7af00db2231e99a4506e4f5587f9dd00b9d1175Juan Cespedes#include <sys/ptrace.h> 3e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata#include <errno.h> 4e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata#include <error.h> 5e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata#include <inttypes.h> 6e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata#include <assert.h> 737d368e49f2d757484252a060d3021de96998e0dPetr Machata#include <string.h> 8e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 9366c2f46d844f040458df9b7e35fc3b8527ed2d3Petr Machata#include "proc.h" 10f728123bd75a65a6a1536e198c3c30719e494e71Juan Cespedes#include "common.h" 11e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata#include "library.h" 12b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata#include "breakpoint.h" 1358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata#include "linux-gnu/trace.h" 14e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 1537d368e49f2d757484252a060d3021de96998e0dPetr Machata/* There are two PLT types on 32-bit PPC: old-style, BSS PLT, and 1637d368e49f2d757484252a060d3021de96998e0dPetr Machata * new-style "secure" PLT. We can tell one from the other by the 1737d368e49f2d757484252a060d3021de96998e0dPetr Machata * flags on the .plt section. If it's +X (executable), it's BSS PLT, 1837d368e49f2d757484252a060d3021de96998e0dPetr Machata * otherwise it's secure. 1937d368e49f2d757484252a060d3021de96998e0dPetr Machata * 2037d368e49f2d757484252a060d3021de96998e0dPetr Machata * BSS PLT works the same way as most architectures: the .plt section 2137d368e49f2d757484252a060d3021de96998e0dPetr Machata * contains trampolines and we put breakpoints to those. With secure 2237d368e49f2d757484252a060d3021de96998e0dPetr Machata * PLT, the .plt section doesn't contain instructions but addresses. 2337d368e49f2d757484252a060d3021de96998e0dPetr Machata * The real PLT table is stored in .text. Addresses of those PLT 2437d368e49f2d757484252a060d3021de96998e0dPetr Machata * entries can be computed, and it fact that's what the glink deal 2537d368e49f2d757484252a060d3021de96998e0dPetr Machata * below does. 2637d368e49f2d757484252a060d3021de96998e0dPetr Machata * 2737d368e49f2d757484252a060d3021de96998e0dPetr Machata * If not prelinked, BSS PLT entries in the .plt section contain 2837d368e49f2d757484252a060d3021de96998e0dPetr Machata * zeroes that are overwritten by the dynamic linker during start-up. 2937d368e49f2d757484252a060d3021de96998e0dPetr Machata * For that reason, ltrace realizes those breakpoints only after 3037d368e49f2d757484252a060d3021de96998e0dPetr Machata * .start is hit. 3137d368e49f2d757484252a060d3021de96998e0dPetr Machata * 3237d368e49f2d757484252a060d3021de96998e0dPetr Machata * 64-bit PPC is more involved. Program linker creates for each 3337d368e49f2d757484252a060d3021de96998e0dPetr Machata * library call a _stub_ symbol named xxxxxxxx.plt_call.<callee> 3437d368e49f2d757484252a060d3021de96998e0dPetr Machata * (where xxxxxxxx is a hexadecimal number). That stub does the call 3537d368e49f2d757484252a060d3021de96998e0dPetr Machata * dispatch: it loads an address of a function to call from the 3637d368e49f2d757484252a060d3021de96998e0dPetr Machata * section .plt, and branches. PLT entries themselves are essentially 3737d368e49f2d757484252a060d3021de96998e0dPetr Machata * a curried call to the resolver. When the symbol is resolved, the 3837d368e49f2d757484252a060d3021de96998e0dPetr Machata * resolver updates the value stored in .plt, and the next time 3937d368e49f2d757484252a060d3021de96998e0dPetr Machata * around, the stub calls the library function directly. So we make 4037d368e49f2d757484252a060d3021de96998e0dPetr Machata * at most one trip (none if the binary is prelinked) through each PLT 4137d368e49f2d757484252a060d3021de96998e0dPetr Machata * entry, and correspondingly that is useless as a breakpoint site. 4237d368e49f2d757484252a060d3021de96998e0dPetr Machata * 4337d368e49f2d757484252a060d3021de96998e0dPetr Machata * Note the three confusing terms: stubs (that play the role of PLT 4437d368e49f2d757484252a060d3021de96998e0dPetr Machata * entries), PLT entries, .plt section. 4537d368e49f2d757484252a060d3021de96998e0dPetr Machata * 4637d368e49f2d757484252a060d3021de96998e0dPetr Machata * We first check symbol tables and see if we happen to have stub 4737d368e49f2d757484252a060d3021de96998e0dPetr Machata * symbols available. If yes we just put breakpoints to those, and 4837d368e49f2d757484252a060d3021de96998e0dPetr Machata * treat them as usual breakpoints. The only tricky part is realizing 4937d368e49f2d757484252a060d3021de96998e0dPetr Machata * that there can be more than one breakpoint per symbol. 5037d368e49f2d757484252a060d3021de96998e0dPetr Machata * 5137d368e49f2d757484252a060d3021de96998e0dPetr Machata * The case that we don't have the stub symbols available is harder. 5237d368e49f2d757484252a060d3021de96998e0dPetr Machata * The following scheme uses two kinds of PLT breakpoints: unresolved 5337d368e49f2d757484252a060d3021de96998e0dPetr Machata * and resolved (to some address). When the process starts (or when 5437d368e49f2d757484252a060d3021de96998e0dPetr Machata * we attach), we distribute unresolved PLT breakpoints to the PLT 5537d368e49f2d757484252a060d3021de96998e0dPetr Machata * entries (not stubs). Then we look in .plt, and for each entry 5637d368e49f2d757484252a060d3021de96998e0dPetr Machata * whose value is different than the corresponding PLT entry address, 5737d368e49f2d757484252a060d3021de96998e0dPetr Machata * we assume it was already resolved, and convert the breakpoint to 5837d368e49f2d757484252a060d3021de96998e0dPetr Machata * resolved. We also rewrite the resolved value in .plt back to the 5937d368e49f2d757484252a060d3021de96998e0dPetr Machata * PLT address. 6037d368e49f2d757484252a060d3021de96998e0dPetr Machata * 6137d368e49f2d757484252a060d3021de96998e0dPetr Machata * When a PLT entry hits a resolved breakpoint (which happens because 6237d368e49f2d757484252a060d3021de96998e0dPetr Machata * we put back the unresolved addresses to .plt), we move the 6337d368e49f2d757484252a060d3021de96998e0dPetr Machata * instruction pointer to the corresponding address and continue the 6437d368e49f2d757484252a060d3021de96998e0dPetr Machata * process as if nothing happened. 6537d368e49f2d757484252a060d3021de96998e0dPetr Machata * 6637d368e49f2d757484252a060d3021de96998e0dPetr Machata * When unresolved PLT entry is called for the first time, we need to 6737d368e49f2d757484252a060d3021de96998e0dPetr Machata * catch the new value that the resolver will write to a .plt slot. 6837d368e49f2d757484252a060d3021de96998e0dPetr Machata * We also need to prevent another thread from racing through and 6937d368e49f2d757484252a060d3021de96998e0dPetr Machata * taking the branch without ltrace noticing. So when unresolved PLT 7037d368e49f2d757484252a060d3021de96998e0dPetr Machata * entry hits, we have to stop all threads. We then single-step 7137d368e49f2d757484252a060d3021de96998e0dPetr Machata * through the resolver, until the .plt slot changes. When it does, 7237d368e49f2d757484252a060d3021de96998e0dPetr Machata * we treat it the same way as above: convert the PLT breakpoint to 7337d368e49f2d757484252a060d3021de96998e0dPetr Machata * resolved, and rewrite the .plt value back to PLT address. We then 7437d368e49f2d757484252a060d3021de96998e0dPetr Machata * start all threads again. 7537d368e49f2d757484252a060d3021de96998e0dPetr Machata * 7637d368e49f2d757484252a060d3021de96998e0dPetr Machata * In theory we might find the exact instruction that will update the 7737d368e49f2d757484252a060d3021de96998e0dPetr Machata * .plt slot, and emulate it, updating the PLT breakpoint immediately, 7837d368e49f2d757484252a060d3021de96998e0dPetr Machata * and then just skip it. But that's even messier than the thread 7937d368e49f2d757484252a060d3021de96998e0dPetr Machata * stopping business and single stepping that needs to be done. 8058b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata * 8158b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata * Short of doing this we really have to stop everyone. There is no 8258b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata * way around that. Unless we know where the stubs are, we don't have 8358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata * a way to catch a thread that would use the window of opportunity 8458b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata * between updating .plt and notifying ltrace about the singlestep. 8537d368e49f2d757484252a060d3021de96998e0dPetr Machata */ 8637d368e49f2d757484252a060d3021de96998e0dPetr Machata 87e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata#define PPC_PLT_STUB_SIZE 16 88b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata#define PPC64_PLT_STUB_SIZE 8 //xxx 89e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 90e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machatastatic inline int 914e2073f64f9db2974d89064dcdc49b2ed7aa9006Petr Machatahost_powerpc64() 92e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata{ 93e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata#ifdef __powerpc64__ 94e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return 1; 95e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata#else 96e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return 0; 97e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata#endif 98e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata} 99e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 100f13505251e6402460f6cc7ec84e0d8ca91607b4fJuan CespedesGElf_Addr 1014e2073f64f9db2974d89064dcdc49b2ed7aa9006Petr Machataarch_plt_sym_val(struct ltelf *lte, size_t ndx, GElf_Rela *rela) 1024e2073f64f9db2974d89064dcdc49b2ed7aa9006Petr Machata{ 1034e2073f64f9db2974d89064dcdc49b2ed7aa9006Petr Machata if (lte->ehdr.e_machine == EM_PPC && lte->arch.secure_plt) { 1044e2073f64f9db2974d89064dcdc49b2ed7aa9006Petr Machata assert(lte->arch.plt_stub_vma != 0); 105e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return lte->arch.plt_stub_vma + PPC_PLT_STUB_SIZE * ndx; 1064e2073f64f9db2974d89064dcdc49b2ed7aa9006Petr Machata 1074e2073f64f9db2974d89064dcdc49b2ed7aa9006Petr Machata } else if (lte->ehdr.e_machine == EM_PPC) { 108e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return rela->r_offset; 1094e2073f64f9db2974d89064dcdc49b2ed7aa9006Petr Machata 1104e2073f64f9db2974d89064dcdc49b2ed7aa9006Petr Machata } else { 111b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata /* If we get here, we don't have stub symbols. In 112b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * that case we put brakpoints to PLT entries the same 113b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * as the PPC32 secure PLT case does. */ 114b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata assert(lte->arch.plt_stub_vma != 0); 115b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata return lte->arch.plt_stub_vma + PPC64_PLT_STUB_SIZE * ndx; 1164e2073f64f9db2974d89064dcdc49b2ed7aa9006Petr Machata } 117e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata} 118e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 119e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machataint 120e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machataarch_translate_address(struct Process *proc, 121e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata target_address_t addr, target_address_t *ret) 122e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata{ 123b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata if (proc->e_machine == EM_PPC64) { 124b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata assert(host_powerpc64()); 125e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata long l = ptrace(PTRACE_PEEKTEXT, proc->pid, addr, 0); 126e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata fprintf(stderr, "arch_translate_address %p->%#lx\n", 127e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata addr, l); 128e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata if (l == -1 && errno) { 129e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata error(0, errno, ".opd translation of %p", addr); 130e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return -1; 131e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata } 132e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata *ret = (target_address_t)l; 133e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return 0; 134e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata } 135e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 136e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata *ret = addr; 137e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return 0; 138d914a206a11cc1011a45f00674b1e16988fae77fJuan Cespedes} 1399a2ad351a1c3215dc596ff3e2e3fd4bc24445a6bIan Wienand 1402b46cfc1127d390eddd9593fe5ce5399c1f68130Petr Machata/* XXX Apparently PPC64 doesn't support PLT breakpoints. */ 141f13505251e6402460f6cc7ec84e0d8ca91607b4fJuan Cespedesvoid * 142a8909f71e1421949c960f287217be6c42c286c0fJuan Cespedessym2addr(Process *proc, struct library_symbol *sym) { 143a841f6592e75d78620ee9e645af22a58c9e3bbf9Olaf Hering void *addr = sym->enter_addr; 14476c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam long pt_ret; 1459a2ad351a1c3215dc596ff3e2e3fd4bc24445a6bIan Wienand 1462d45b1a8e26a36a9f85dc49e721c4390ca93dc40Ian Wienand debug(3, 0); 1479a2ad351a1c3215dc596ff3e2e3fd4bc24445a6bIan Wienand 14876c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam if (sym->plt_type != LS_TOPLT_POINT) { 14976c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam return addr; 15076c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam } 1519a2ad351a1c3215dc596ff3e2e3fd4bc24445a6bIan Wienand 15276c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam if (proc->pid == 0) { 15376c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam return 0; 15476c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam } 1559a2ad351a1c3215dc596ff3e2e3fd4bc24445a6bIan Wienand 156da9b953284966b8c52de43713ebb5b503756e468Juan Cespedes if (options.debug >= 3) { 15776c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam xinfdump(proc->pid, (void *)(((long)addr-32)&0xfffffff0), 15876c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam sizeof(void*)*8); 15976c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam } 16076c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam 16176c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // On a PowerPC-64 system, a plt is three 64-bit words: the first is the 16276c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // 64-bit address of the routine. Before the PLT has been initialized, 16376c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // this will be 0x0. In fact, the symbol table won't have the plt's 16476c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // address even. Ater the PLT has been initialized, but before it has 16576c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // been resolved, the first word will be the address of the function in 16676c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // the dynamic linker that will reslove the PLT. After the PLT is 16776c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // resolved, this will will be the address of the routine whose symbol 16876c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // is in the symbol table. 16976c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam 17076c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // On a PowerPC-32 system, there are two types of PLTs: secure (new) and 17176c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // non-secure (old). For the secure case, the PLT is simply a pointer 17276c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // and we can treat it much as we do for the PowerPC-64 case. For the 17376c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // non-secure case, the PLT is executable code and we can put the 17476c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // break-point right in the PLT. 17576c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam 17676c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam pt_ret = ptrace(PTRACE_PEEKTEXT, proc->pid, addr, 0); 17776c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam 1789bc4a9b46340209f774181f7e55ece1c47bd59d6Michael K. Edwards#if SIZEOF_LONG == 8 17976c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam if (proc->mask_32bit) { 18076c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam // Assume big-endian. 18176c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam addr = (void *)((pt_ret >> 32) & 0xffffffff); 18276c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam } else { 18376c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam addr = (void *)pt_ret; 1842d45b1a8e26a36a9f85dc49e721c4390ca93dc40Ian Wienand } 1859bc4a9b46340209f774181f7e55ece1c47bd59d6Michael K. Edwards#else 1862b46cfc1127d390eddd9593fe5ce5399c1f68130Petr Machata /* XXX Um, so where exactly are we dealing with the non-secure 1872b46cfc1127d390eddd9593fe5ce5399c1f68130Petr Machata PLT thing? */ 1889bc4a9b46340209f774181f7e55ece1c47bd59d6Michael K. Edwards addr = (void *)pt_ret; 1899bc4a9b46340209f774181f7e55ece1c47bd59d6Michael K. Edwards#endif 1909a2ad351a1c3215dc596ff3e2e3fd4bc24445a6bIan Wienand 19176c61f15d7989bf7adffed2e46a44c34a80bd927Paul Gilliam return addr; 1929a2ad351a1c3215dc596ff3e2e3fd4bc24445a6bIan Wienand} 193e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 194e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machatastatic GElf_Addr 195e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machataget_glink_vma(struct ltelf *lte, GElf_Addr ppcgot, Elf_Data *plt_data) 196e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata{ 197e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata Elf_Scn *ppcgot_sec = NULL; 198e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata GElf_Shdr ppcgot_shdr; 199e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata if (ppcgot != 0 200e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata && elf_get_section_covering(lte, ppcgot, 201e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata &ppcgot_sec, &ppcgot_shdr) < 0) 202e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata // xxx should be the log out 203e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata fprintf(stderr, 204e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata "DT_PPC_GOT=%#" PRIx64 ", but no such section found.\n", 205e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata ppcgot); 206e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 207e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata if (ppcgot_sec != NULL) { 208e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata Elf_Data *data = elf_loaddata(ppcgot_sec, &ppcgot_shdr); 209e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata if (data == NULL || data->d_size < 8 ) { 210e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata fprintf(stderr, "Couldn't read GOT data.\n"); 211e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata } else { 212e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata // where PPCGOT begins in .got 213e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata size_t offset = ppcgot - ppcgot_shdr.sh_addr; 214e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata assert(offset % 4 == 0); 215e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata uint32_t glink_vma; 216e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata if (elf_read_u32(data, offset + 4, &glink_vma) < 0) { 217e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata fprintf(stderr, 218e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata "Couldn't read glink VMA address" 219e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata " at %zd@GOT\n", offset); 220e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return 0; 221e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata } 222e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata if (glink_vma != 0) { 223e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata debug(1, "PPC GOT glink_vma address: %#" PRIx32, 224e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata glink_vma); 225e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata fprintf(stderr, "PPC GOT glink_vma " 226e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata "address: %#"PRIx32"\n", glink_vma); 227e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return (GElf_Addr)glink_vma; 228e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata } 229e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata } 230e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata } 231e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 232e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata if (plt_data != NULL) { 233e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata uint32_t glink_vma; 234e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata if (elf_read_u32(plt_data, 0, &glink_vma) < 0) { 235e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata fprintf(stderr, 236e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata "Couldn't read glink VMA address at 0@.plt\n"); 237e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return 0; 238e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata } 239e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata debug(1, ".plt glink_vma address: %#" PRIx32, glink_vma); 240e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata fprintf(stderr, ".plt glink_vma address: " 241e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata "%#"PRIx32"\n", glink_vma); 242e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return (GElf_Addr)glink_vma; 243e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata } 244e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 245e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return 0; 246e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata} 247e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 248644d669f96c0fe261fe938cecda41938e804c7d9Petr Machatastatic int 249d1746d17eda0c4d2c1004c9deb8b229eb6fb1c78Petr Machataload_dynamic_entry(struct ltelf *lte, int tag, GElf_Addr *valuep) 250e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata{ 251644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata Elf_Scn *scn; 252644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata GElf_Shdr shdr; 253644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata if (elf_get_section_type(lte, SHT_DYNAMIC, &scn, &shdr) < 0 254644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata || scn == NULL) { 255644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata fail: 256644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata error(0, 0, "Couldn't get SHT_DYNAMIC: %s", 257644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata elf_errmsg(-1)); 258644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata return -1; 259e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata } 260644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata 261644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata Elf_Data *data = elf_loaddata(scn, &shdr); 262644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata if (data == NULL) 263644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata goto fail; 264644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata 265644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata size_t j; 266644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata for (j = 0; j < shdr.sh_size / shdr.sh_entsize; ++j) { 267644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata GElf_Dyn dyn; 268644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata if (gelf_getdyn(data, j, &dyn) == NULL) 269644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata goto fail; 270644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata 271d1746d17eda0c4d2c1004c9deb8b229eb6fb1c78Petr Machata if(dyn.d_tag == tag) { 272d1746d17eda0c4d2c1004c9deb8b229eb6fb1c78Petr Machata *valuep = dyn.d_un.d_ptr; 273644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata return 0; 274644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata } 275644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata } 276644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata 277644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata return -1; 278e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata} 279e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 280d1746d17eda0c4d2c1004c9deb8b229eb6fb1c78Petr Machatastatic int 281d1746d17eda0c4d2c1004c9deb8b229eb6fb1c78Petr Machataload_ppcgot(struct ltelf *lte, GElf_Addr *ppcgotp) 282d1746d17eda0c4d2c1004c9deb8b229eb6fb1c78Petr Machata{ 283d1746d17eda0c4d2c1004c9deb8b229eb6fb1c78Petr Machata return load_dynamic_entry(lte, DT_PPC_GOT, ppcgotp); 284d1746d17eda0c4d2c1004c9deb8b229eb6fb1c78Petr Machata} 285d1746d17eda0c4d2c1004c9deb8b229eb6fb1c78Petr Machata 286b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machatastatic int 287b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machataload_ppc64_glink(struct ltelf *lte, GElf_Addr *glinkp) 288b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata{ 289b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata return load_dynamic_entry(lte, DT_PPC64_GLINK, glinkp); 290b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata} 291b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata 292e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machataint 293e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machataarch_elf_init(struct ltelf *lte) 294e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata{ 2954e2073f64f9db2974d89064dcdc49b2ed7aa9006Petr Machata lte->arch.secure_plt = !(lte->lte_flags & LTE_PLT_EXECUTABLE); 2964e2073f64f9db2974d89064dcdc49b2ed7aa9006Petr Machata if (lte->ehdr.e_machine == EM_PPC && lte->arch.secure_plt) { 297644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata GElf_Addr ppcgot; 298644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata if (load_ppcgot(lte, &ppcgot) < 0) { 299644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata fprintf(stderr, "Couldn't find DT_PPC_GOT.\n"); 300644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata return -1; 301644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata } 302644d669f96c0fe261fe938cecda41938e804c7d9Petr Machata GElf_Addr glink_vma = get_glink_vma(lte, ppcgot, lte->plt_data); 303e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 304e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata assert (lte->relplt_size % 12 == 0); 305e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata size_t count = lte->relplt_size / 12; // size of RELA entry 306e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata lte->arch.plt_stub_vma = glink_vma 307e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata - (GElf_Addr)count * PPC_PLT_STUB_SIZE; 308e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata debug(1, "stub_vma is %#" PRIx64, lte->arch.plt_stub_vma); 309b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata 310b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata } else if (lte->ehdr.e_machine == EM_PPC64) { 311b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata GElf_Addr glink_vma; 312b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata if (load_ppc64_glink(lte, &glink_vma) < 0) { 313b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata fprintf(stderr, "Couldn't find DT_PPC64_GLINK.\n"); 314b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata return -1; 315b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata } 316b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata 317b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata /* The first glink stub starts at offset 32. */ 318b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata lte->arch.plt_stub_vma = glink_vma + 32; 319e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata } 320e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata 321e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata /* Override the value that we gleaned from flags on the .plt 322e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata * section. The PLT entries are in fact executable, they are 323e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata * just not in .plt. */ 324e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata lte->lte_flags |= LTE_PLT_EXECUTABLE; 32537d368e49f2d757484252a060d3021de96998e0dPetr Machata 32637d368e49f2d757484252a060d3021de96998e0dPetr Machata /* On PPC64, look for stub symbols in symbol table. These are 32737d368e49f2d757484252a060d3021de96998e0dPetr Machata * called: xxxxxxxx.plt_call.callee_name@version+addend. */ 32837d368e49f2d757484252a060d3021de96998e0dPetr Machata if (lte->ehdr.e_machine == EM_PPC64 32937d368e49f2d757484252a060d3021de96998e0dPetr Machata && lte->symtab != NULL && lte->strtab != NULL) { 33037d368e49f2d757484252a060d3021de96998e0dPetr Machata 33137d368e49f2d757484252a060d3021de96998e0dPetr Machata /* N.B. We can't simply skip the symbols that we fail 33237d368e49f2d757484252a060d3021de96998e0dPetr Machata * to read or malloc. There may be more than one stub 33337d368e49f2d757484252a060d3021de96998e0dPetr Machata * per symbol name, and if we failed in one but 33437d368e49f2d757484252a060d3021de96998e0dPetr Machata * succeeded in another, the PLT enabling code would 33537d368e49f2d757484252a060d3021de96998e0dPetr Machata * have no way to tell that something is missing. We 33637d368e49f2d757484252a060d3021de96998e0dPetr Machata * could work around that, of course, but it doesn't 3377b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata * seem worth the trouble. So if anything fails, we 3387b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata * just pretend that we don't have stub symbols at 3397b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata * all, as if the binary is stripped. */ 34037d368e49f2d757484252a060d3021de96998e0dPetr Machata 34137d368e49f2d757484252a060d3021de96998e0dPetr Machata size_t i; 34237d368e49f2d757484252a060d3021de96998e0dPetr Machata for (i = 0; i < lte->symtab_count; ++i) { 34337d368e49f2d757484252a060d3021de96998e0dPetr Machata GElf_Sym sym; 3447b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata if (gelf_getsym(lte->symtab, i, &sym) == NULL) { 3457b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata struct library_symbol *sym, *next; 3467b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata fail: 3477b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata for (sym = lte->arch.stubs; sym != NULL; ) { 3487b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata next = sym->next; 3497b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata library_symbol_destroy(sym); 3507b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata free(sym); 3517b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata sym = next; 3527b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata } 3537b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata lte->arch.stubs = NULL; 35437d368e49f2d757484252a060d3021de96998e0dPetr Machata break; 3557b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata } 35637d368e49f2d757484252a060d3021de96998e0dPetr Machata 35737d368e49f2d757484252a060d3021de96998e0dPetr Machata const char *name = lte->strtab + sym.st_name; 35837d368e49f2d757484252a060d3021de96998e0dPetr Machata 35937d368e49f2d757484252a060d3021de96998e0dPetr Machata#define STUBN ".plt_call." 36037d368e49f2d757484252a060d3021de96998e0dPetr Machata if ((name = strstr(name, STUBN)) == NULL) 36137d368e49f2d757484252a060d3021de96998e0dPetr Machata continue; 36237d368e49f2d757484252a060d3021de96998e0dPetr Machata name += sizeof(STUBN) - 1; 36337d368e49f2d757484252a060d3021de96998e0dPetr Machata#undef STUBN 36437d368e49f2d757484252a060d3021de96998e0dPetr Machata 36537d368e49f2d757484252a060d3021de96998e0dPetr Machata size_t len; 36637d368e49f2d757484252a060d3021de96998e0dPetr Machata const char *ver = strchr(name, '@'); 36737d368e49f2d757484252a060d3021de96998e0dPetr Machata if (ver != NULL) { 36837d368e49f2d757484252a060d3021de96998e0dPetr Machata len = ver - name; 36937d368e49f2d757484252a060d3021de96998e0dPetr Machata 37037d368e49f2d757484252a060d3021de96998e0dPetr Machata } else { 37137d368e49f2d757484252a060d3021de96998e0dPetr Machata /* If there is "+" at all, check that 37237d368e49f2d757484252a060d3021de96998e0dPetr Machata * the symbol name ends in "+0". */ 37337d368e49f2d757484252a060d3021de96998e0dPetr Machata const char *add = strrchr(name, '+'); 37437d368e49f2d757484252a060d3021de96998e0dPetr Machata if (add != NULL) { 37537d368e49f2d757484252a060d3021de96998e0dPetr Machata assert(strcmp(add, "+0") == 0); 37637d368e49f2d757484252a060d3021de96998e0dPetr Machata len = add - name; 37737d368e49f2d757484252a060d3021de96998e0dPetr Machata } else { 37837d368e49f2d757484252a060d3021de96998e0dPetr Machata len = strlen(name); 37937d368e49f2d757484252a060d3021de96998e0dPetr Machata } 38037d368e49f2d757484252a060d3021de96998e0dPetr Machata } 38137d368e49f2d757484252a060d3021de96998e0dPetr Machata 38237d368e49f2d757484252a060d3021de96998e0dPetr Machata char *sym_name = strndup(name, len); 3837b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata struct library_symbol *libsym = malloc(sizeof(*libsym)); 3847b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata if (sym_name == NULL || libsym == NULL) { 38537d368e49f2d757484252a060d3021de96998e0dPetr Machata free(sym_name); 3867b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata free(libsym); 3877b36114b46cf93aa2828de055e71ec57a801dfc1Petr Machata goto fail; 38837d368e49f2d757484252a060d3021de96998e0dPetr Machata } 38937d368e49f2d757484252a060d3021de96998e0dPetr Machata 39037d368e49f2d757484252a060d3021de96998e0dPetr Machata target_address_t addr 39137d368e49f2d757484252a060d3021de96998e0dPetr Machata = (target_address_t)sym.st_value + lte->bias; 39237d368e49f2d757484252a060d3021de96998e0dPetr Machata library_symbol_init(libsym, addr, sym_name, 1, 39337d368e49f2d757484252a060d3021de96998e0dPetr Machata LS_TOPLT_EXEC); 394b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata libsym->arch.type = PPC64PLT_STUB; 39537d368e49f2d757484252a060d3021de96998e0dPetr Machata libsym->next = lte->arch.stubs; 39637d368e49f2d757484252a060d3021de96998e0dPetr Machata lte->arch.stubs = libsym; 39737d368e49f2d757484252a060d3021de96998e0dPetr Machata } 39837d368e49f2d757484252a060d3021de96998e0dPetr Machata } 39937d368e49f2d757484252a060d3021de96998e0dPetr Machata 400e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata return 0; 401e67635d6dcecb0f44448a5329d69fd0de74ebabaPetr Machata} 40237d368e49f2d757484252a060d3021de96998e0dPetr Machata 40358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machatastatic int 40458b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machataread_plt_slot_value(struct Process *proc, GElf_Addr addr, GElf_Addr *valp) 40558b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata{ 40658b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata /* on PPC32 we need to do things differently, but PPC64/PPC32 40758b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata * is currently not supported anyway. */ 40858b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata assert(host_powerpc64()); 40958b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 41058b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata long l = ptrace(PTRACE_PEEKTEXT, proc->pid, addr, 0); 41158b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata if (l == -1 && errno != 0) { 41258b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata error(0, errno, "ptrace .plt slot value @%#" PRIx64, addr); 41358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata return -1; 41458b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata } 41558b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 41658b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata *valp = (GElf_Addr)l; 41758b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata return 0; 41858b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata} 41958b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 42058b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machatastatic int 42158b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machataunresolve_plt_slot(struct Process *proc, GElf_Addr addr, GElf_Addr value) 42258b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata{ 42358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata /* We only modify plt_entry[0], which holds the resolved 42458b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata * address of the routine. We keep the TOC and environment 42558b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata * pointers intact. Hence the only adjustment that we need to 42658b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata * do is to IP. */ 42758b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata if (ptrace(PTRACE_POKETEXT, proc->pid, addr, value) < 0) { 42858b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata error(0, errno, "unresolve .plt slot"); 42958b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata return -1; 43058b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata } 43158b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata return 0; 43258b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata} 43358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 43437d368e49f2d757484252a060d3021de96998e0dPetr Machataenum plt_status 43537d368e49f2d757484252a060d3021de96998e0dPetr Machataarch_elf_add_plt_entry(struct Process *proc, struct ltelf *lte, 436d1746d17eda0c4d2c1004c9deb8b229eb6fb1c78Petr Machata const char *a_name, GElf_Rela *rela, size_t ndx, 43737d368e49f2d757484252a060d3021de96998e0dPetr Machata struct library_symbol **ret) 43837d368e49f2d757484252a060d3021de96998e0dPetr Machata{ 43937d368e49f2d757484252a060d3021de96998e0dPetr Machata if (lte->ehdr.e_machine == EM_PPC) 44037d368e49f2d757484252a060d3021de96998e0dPetr Machata return plt_default; 44137d368e49f2d757484252a060d3021de96998e0dPetr Machata 44237d368e49f2d757484252a060d3021de96998e0dPetr Machata /* PPC64. If we have stubs, we return a chain of breakpoint 44337d368e49f2d757484252a060d3021de96998e0dPetr Machata * sites, one for each stub that corresponds to this PLT 44437d368e49f2d757484252a060d3021de96998e0dPetr Machata * entry. */ 44537d368e49f2d757484252a060d3021de96998e0dPetr Machata struct library_symbol *chain = NULL; 44637d368e49f2d757484252a060d3021de96998e0dPetr Machata struct library_symbol **symp; 44737d368e49f2d757484252a060d3021de96998e0dPetr Machata for (symp = <e->arch.stubs; *symp != NULL; ) { 44837d368e49f2d757484252a060d3021de96998e0dPetr Machata struct library_symbol *sym = *symp; 44937d368e49f2d757484252a060d3021de96998e0dPetr Machata if (strcmp(sym->name, a_name) != 0) { 45037d368e49f2d757484252a060d3021de96998e0dPetr Machata symp = &(*symp)->next; 45137d368e49f2d757484252a060d3021de96998e0dPetr Machata continue; 45237d368e49f2d757484252a060d3021de96998e0dPetr Machata } 45337d368e49f2d757484252a060d3021de96998e0dPetr Machata 45437d368e49f2d757484252a060d3021de96998e0dPetr Machata /* Re-chain the symbol from stubs to CHAIN. */ 45537d368e49f2d757484252a060d3021de96998e0dPetr Machata *symp = sym->next; 45637d368e49f2d757484252a060d3021de96998e0dPetr Machata sym->next = chain; 45737d368e49f2d757484252a060d3021de96998e0dPetr Machata chain = sym; 45837d368e49f2d757484252a060d3021de96998e0dPetr Machata } 45937d368e49f2d757484252a060d3021de96998e0dPetr Machata 46037d368e49f2d757484252a060d3021de96998e0dPetr Machata if (chain != NULL) { 46137d368e49f2d757484252a060d3021de96998e0dPetr Machata *ret = chain; 46237d368e49f2d757484252a060d3021de96998e0dPetr Machata return plt_ok; 46337d368e49f2d757484252a060d3021de96998e0dPetr Machata } 46437d368e49f2d757484252a060d3021de96998e0dPetr Machata 465b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata /* We don't have stub symbols. Find corresponding .plt slot, 466b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * and check whether it contains the corresponding PLT address 467b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * (or 0 if the dynamic linker hasn't run yet). N.B. we don't 468b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * want read this from ELF file, but from process image. That 469b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * makes a difference if we are attaching to a running 470b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * process. */ 471b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata 472b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata GElf_Addr plt_entry_addr = arch_plt_sym_val(lte, ndx, rela); 473b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata GElf_Addr plt_slot_addr = rela->r_offset; 474b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata assert(plt_slot_addr >= lte->plt_addr 475b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata || plt_slot_addr < lte->plt_addr + lte->plt_size); 476b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata 47758b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata GElf_Addr plt_slot_value; 47858b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata if (read_plt_slot_value(proc, plt_slot_addr, &plt_slot_value) < 0) 479b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata return plt_fail; 480b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata 481b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata char *name = strdup(a_name); 482b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata struct library_symbol *libsym = malloc(sizeof(*libsym)); 483b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata if (name == NULL || libsym == NULL) { 484b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata error(0, errno, "allocation for .plt slot"); 485b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata fail: 486b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata free(name); 487b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata free(libsym); 488b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata return plt_fail; 489b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata } 490b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata 491b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata library_symbol_init(libsym, (target_address_t)plt_entry_addr, 492b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata name, 1, LS_TOPLT_EXEC); 49358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata libsym->arch.plt_slot_addr = plt_slot_addr; 49458b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 49558b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata if (plt_slot_value == plt_entry_addr || plt_slot_value == 0) { 496b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata libsym->arch.type = PPC64PLT_UNRESOLVED; 49758b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata libsym->arch.resolved_value = plt_entry_addr; 49858b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 499b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata } else { 500b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata /* Unresolve the .plt slot. If the binary was 501b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * prelinked, this makes the code invalid, because in 502b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * case of prelinked binary, the dynamic linker 503b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * doesn't update .plt[0] and .plt[1] with addresses 504b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * of the resover. But we don't care, we will never 505b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * need to enter the resolver. That just means that 506b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * we have to un-un-resolve this back before we 507b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * detach, which is nothing new: we already need to 508b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata * retract breakpoints. */ 50958b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 51058b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata if (unresolve_plt_slot(proc, plt_slot_addr, plt_entry_addr) < 0) 511b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata goto fail; 512b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata libsym->arch.type = PPC64PLT_RESOLVED; 51358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata libsym->arch.resolved_value = plt_slot_value; 514b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata } 515b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata 516b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata *ret = libsym; 517b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata return plt_ok; 51837d368e49f2d757484252a060d3021de96998e0dPetr Machata} 51937d368e49f2d757484252a060d3021de96998e0dPetr Machata 5204d9a91c5c677d6a6b2db21f00385bce5167373c4Petr Machatavoid 5214d9a91c5c677d6a6b2db21f00385bce5167373c4Petr Machataarch_elf_destroy(struct ltelf *lte) 5224d9a91c5c677d6a6b2db21f00385bce5167373c4Petr Machata{ 52337d368e49f2d757484252a060d3021de96998e0dPetr Machata struct library_symbol *sym; 52437d368e49f2d757484252a060d3021de96998e0dPetr Machata for (sym = lte->arch.stubs; sym != NULL; ) { 52537d368e49f2d757484252a060d3021de96998e0dPetr Machata struct library_symbol *next = sym->next; 52637d368e49f2d757484252a060d3021de96998e0dPetr Machata library_symbol_destroy(sym); 52737d368e49f2d757484252a060d3021de96998e0dPetr Machata free(sym); 52837d368e49f2d757484252a060d3021de96998e0dPetr Machata sym = next; 52937d368e49f2d757484252a060d3021de96998e0dPetr Machata } 5304d9a91c5c677d6a6b2db21f00385bce5167373c4Petr Machata} 531b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata 53258b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machatastatic enum callback_status 53358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machatakeep_stepping_p(struct process_stopping_handler *self) 53458b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata{ 53558b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata struct Process *proc = self->task_enabling_breakpoint; 53658b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata struct library_symbol *libsym = self->breakpoint_being_enabled->libsym; 53758b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata GElf_Addr value; 53858b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata if (read_plt_slot_value(proc, libsym->arch.plt_slot_addr, &value) < 0) 53958b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata return CBS_FAIL; 54058b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 54158b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata /* In UNRESOLVED state, the RESOLVED_VALUE in fact contains 54258b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata * the PLT entry value. */ 54358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata if (value == libsym->arch.resolved_value) 54458b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata return CBS_CONT; 54558b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 54658b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata /* The .plt slot got resolved! We can migrate the breakpoint 54758b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata * to RESOLVED and stop single-stepping. */ 54858b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata if (unresolve_plt_slot(proc, libsym->arch.plt_slot_addr, 54958b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata libsym->arch.resolved_value) < 0) 55058b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata return CBS_FAIL; 55158b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata libsym->arch.type = PPC64PLT_RESOLVED; 55258b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata libsym->arch.resolved_value = value; 55358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 55458b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata return CBS_STOP; 55558b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata} 55658b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 557b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machatastatic void 55858b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machatappc64_plt_bp_continue(struct breakpoint *bp, struct Process *proc) 559b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata{ 56058b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata switch (bp->libsym->arch.type) { 56158b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata target_address_t rv; 56258b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 56358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata case PPC64PLT_STUB: 56458b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata /* We should never get here. */ 56558b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata abort(); 56658b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 56758b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata case PPC64PLT_UNRESOLVED: 56858b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata if (process_install_stopping_handler(proc, bp, NULL, 569cb9a28da448439eab4bf554810fd1004fbc00885Petr Machata &keep_stepping_p, 570949a56a0e1d4a13dc437621a991e993d6623aef5Petr Machata NULL) < 0) { 57158b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata perror("ppc64_unresolved_bp_continue: couldn't install" 57258b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata " event handler"); 57358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata continue_after_breakpoint(proc, bp); 57458b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata } 57558b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata return; 57658b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata 57758b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata case PPC64PLT_RESOLVED: 57858b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata rv = (target_address_t)bp->libsym->arch.resolved_value; 57958b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata set_instruction_pointer(proc, rv); 58058b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata continue_process(proc->pid); 58158b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata } 582b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata} 583b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata 58452dbfb161efeab85bddc880966db2f7af9b9cf9aPetr Machata/* For some symbol types, we need to set up custom callbacks. XXX we 58552dbfb161efeab85bddc880966db2f7af9b9cf9aPetr Machata * don't need PROC here, we can store the data in BP if it is of 58652dbfb161efeab85bddc880966db2f7af9b9cf9aPetr Machata * interest to us. */ 587b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machataint 588b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machataarch_breakpoint_init(struct Process *proc, struct breakpoint *bp) 589b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata{ 590b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata if (proc->e_machine == EM_PPC 591052b5f191ec00b7677c43278cb2ce886af1d0ef1Petr Machata || bp->libsym == NULL) 592052b5f191ec00b7677c43278cb2ce886af1d0ef1Petr Machata return 0; 593052b5f191ec00b7677c43278cb2ce886af1d0ef1Petr Machata 594052b5f191ec00b7677c43278cb2ce886af1d0ef1Petr Machata /* We could see LS_TOPLT_EXEC or LS_TOPLT_NONE (the latter 595052b5f191ec00b7677c43278cb2ce886af1d0ef1Petr Machata * when we trace entry points), but not LS_TOPLT_POINT 596052b5f191ec00b7677c43278cb2ce886af1d0ef1Petr Machata * anywhere on PPC. */ 597052b5f191ec00b7677c43278cb2ce886af1d0ef1Petr Machata assert(bp->libsym->plt_type != LS_TOPLT_POINT); 598052b5f191ec00b7677c43278cb2ce886af1d0ef1Petr Machata if (bp->libsym->plt_type != LS_TOPLT_EXEC 599b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata || bp->libsym->arch.type == PPC64PLT_STUB) 600b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata return 0; 601b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata 60258b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata static struct bp_callbacks cbs = { 60358b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata .on_continue = ppc64_plt_bp_continue, 60458b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata }; 60558b2d0fd5deed5f33fbd47a6b6e5c109f43908b5Petr Machata breakpoint_set_callbacks(bp, &cbs); 606b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata return 0; 607b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata} 608b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata 609b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machatavoid 610b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machataarch_breakpoint_destroy(struct breakpoint *bp) 611b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata{ 612b64b5c7b6f4a368ccaf60507090192845221a3bePetr Machata} 613