plt.c revision b8deb4d589d57c49d510b1b463b3904cb4964557
1/* 2 * This file is part of ltrace. 3 * Copyright (C) 2012 Petr Machata, Red Hat Inc. 4 * Copyright (C) 2004,2008,2009 Juan Cespedes 5 * Copyright (C) 2006 Paul Gilliam 6 * 7 * This program is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU General Public License as 9 * published by the Free Software Foundation; either version 2 of the 10 * License, or (at your option) any later version. 11 * 12 * This program is distributed in the hope that it will be useful, but 13 * WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 15 * General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License 18 * along with this program; if not, write to the Free Software 19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 20 * 02110-1301 USA 21 */ 22 23#include <gelf.h> 24#include <sys/ptrace.h> 25#include <errno.h> 26#include <error.h> 27#include <inttypes.h> 28#include <assert.h> 29#include <string.h> 30 31#include "proc.h" 32#include "common.h" 33#include "library.h" 34#include "breakpoint.h" 35#include "linux-gnu/trace.h" 36#include "backend.h" 37 38/* There are two PLT types on 32-bit PPC: old-style, BSS PLT, and 39 * new-style "secure" PLT. We can tell one from the other by the 40 * flags on the .plt section. If it's +X (executable), it's BSS PLT, 41 * otherwise it's secure. 42 * 43 * BSS PLT works the same way as most architectures: the .plt section 44 * contains trampolines and we put breakpoints to those. If not 45 * prelinked, .plt contains zeroes, and dynamic linker fills in the 46 * initial set of trampolines, which means that we need to delay 47 * enabling breakpoints until after binary entry point is hit. 48 * Additionally, after first call, dynamic linker updates .plt with 49 * branch to resolved address. That means that on first hit, we must 50 * do something similar to the PPC64 gambit described below. 51 * 52 * With secure PLT, the .plt section doesn't contain instructions but 53 * addresses. The real PLT table is stored in .text. Addresses of 54 * those PLT entries can be computed, and apart from the fact that 55 * they are in .text, they are ordinary PLT entries. 56 * 57 * 64-bit PPC is more involved. Program linker creates for each 58 * library call a _stub_ symbol named xxxxxxxx.plt_call.<callee> 59 * (where xxxxxxxx is a hexadecimal number). That stub does the call 60 * dispatch: it loads an address of a function to call from the 61 * section .plt, and branches. PLT entries themselves are essentially 62 * a curried call to the resolver. When the symbol is resolved, the 63 * resolver updates the value stored in .plt, and the next time 64 * around, the stub calls the library function directly. So we make 65 * at most one trip (none if the binary is prelinked) through each PLT 66 * entry, and correspondingly that is useless as a breakpoint site. 67 * 68 * Note the three confusing terms: stubs (that play the role of PLT 69 * entries), PLT entries, .plt section. 70 * 71 * We first check symbol tables and see if we happen to have stub 72 * symbols available. If yes we just put breakpoints to those, and 73 * treat them as usual breakpoints. The only tricky part is realizing 74 * that there can be more than one breakpoint per symbol. 75 * 76 * The case that we don't have the stub symbols available is harder. 77 * The following scheme uses two kinds of PLT breakpoints: unresolved 78 * and resolved (to some address). When the process starts (or when 79 * we attach), we distribute unresolved PLT breakpoints to the PLT 80 * entries (not stubs). Then we look in .plt, and for each entry 81 * whose value is different than the corresponding PLT entry address, 82 * we assume it was already resolved, and convert the breakpoint to 83 * resolved. We also rewrite the resolved value in .plt back to the 84 * PLT address. 85 * 86 * When a PLT entry hits a resolved breakpoint (which happens because 87 * we rewrite .plt with the original unresolved addresses), we move 88 * the instruction pointer to the corresponding address and continue 89 * the process as if nothing happened. 90 * 91 * When unresolved PLT entry is called for the first time, we need to 92 * catch the new value that the resolver will write to a .plt slot. 93 * We also need to prevent another thread from racing through and 94 * taking the branch without ltrace noticing. So when unresolved PLT 95 * entry hits, we have to stop all threads. We then single-step 96 * through the resolver, until the .plt slot changes. When it does, 97 * we treat it the same way as above: convert the PLT breakpoint to 98 * resolved, and rewrite the .plt value back to PLT address. We then 99 * start all threads again. 100 * 101 * As an optimization, we remember the address where the address was 102 * resolved, and put a breakpoint there. The next time around (when 103 * the next PLT entry is to be resolved), instead of single-stepping 104 * through half the dynamic linker, we just let the thread run and hit 105 * this breakpoint. When it hits, we know the PLT entry was resolved. 106 * 107 * XXX TODO If we have hardware watch point, we might put a read watch 108 * on .plt slot, and discover the offenders this way. I don't know 109 * the details, but I assume at most a handful (like, one or two, if 110 * available at all) addresses may be watched at a time, and thus this 111 * would be used as an amendment of the above rather than full-on 112 * solution to PLT tracing on PPC. 113 */ 114 115#define PPC_PLT_STUB_SIZE 16 116#define PPC64_PLT_STUB_SIZE 8 //xxx 117 118static inline int 119host_powerpc64() 120{ 121#ifdef __powerpc64__ 122 return 1; 123#else 124 return 0; 125#endif 126} 127 128int 129read_target_4(struct Process *proc, arch_addr_t addr, uint32_t *lp) 130{ 131 unsigned long l = ptrace(PTRACE_PEEKTEXT, proc->pid, addr, 0); 132 if (l == -1UL && errno) 133 return -1; 134#ifdef __powerpc64__ 135 l >>= 32; 136#endif 137 *lp = l; 138 return 0; 139} 140 141static int 142read_target_8(struct Process *proc, arch_addr_t addr, uint64_t *lp) 143{ 144 unsigned long l = ptrace(PTRACE_PEEKTEXT, proc->pid, addr, 0); 145 if (l == -1UL && errno) 146 return -1; 147 if (host_powerpc64()) { 148 *lp = l; 149 } else { 150 unsigned long l2 = ptrace(PTRACE_PEEKTEXT, proc->pid, 151 addr + 4, 0); 152 if (l2 == -1UL && errno) 153 return -1; 154 *lp = ((uint64_t)l << 32) | l2; 155 } 156 return 0; 157} 158 159int 160read_target_long(struct Process *proc, arch_addr_t addr, uint64_t *lp) 161{ 162 if (proc->e_machine == EM_PPC) { 163 uint32_t w; 164 int ret = read_target_4(proc, addr, &w); 165 if (ret >= 0) 166 *lp = (uint64_t)w; 167 return ret; 168 } else { 169 return read_target_8(proc, addr, lp); 170 } 171} 172 173static enum callback_status 174activate_delayed(struct library_symbol *libsym, void *data) 175{ 176 struct Process *proc = data; 177 if (libsym->delayed) { 178 if (read_target_8(proc, libsym->enter_addr, 179 &libsym->arch.resolved_value) < 0) { 180 error(0, errno, "couldn't read PLT value for %s(%p)", 181 libsym->name, libsym->enter_addr); 182 return CBS_FAIL; 183 } 184 185 if (proc_activate_delayed_symbol(proc, libsym) < 0) 186 return CBS_FAIL; 187 /* XXX double cast */ 188 libsym->arch.plt_slot_addr 189 = (GElf_Addr)(uintptr_t)libsym->enter_addr; 190 } 191 return CBS_CONT; 192} 193 194void 195arch_dynlink_done(struct Process *proc) 196{ 197 proc_each_symbol(proc, NULL, activate_delayed, proc); 198} 199 200GElf_Addr 201arch_plt_sym_val(struct ltelf *lte, size_t ndx, GElf_Rela *rela) 202{ 203 if (lte->ehdr.e_machine == EM_PPC && lte->arch.secure_plt) { 204 assert(lte->arch.plt_stub_vma != 0); 205 return lte->arch.plt_stub_vma + PPC_PLT_STUB_SIZE * ndx; 206 207 } else if (lte->ehdr.e_machine == EM_PPC) { 208 return rela->r_offset; 209 210 } else { 211 /* If we get here, we don't have stub symbols. In 212 * that case we put brakpoints to PLT entries the same 213 * as the PPC32 secure PLT case does. */ 214 assert(lte->arch.plt_stub_vma != 0); 215 return lte->arch.plt_stub_vma + PPC64_PLT_STUB_SIZE * ndx; 216 } 217} 218 219/* This entry point is called when ltelf is not available 220 * anymore--during runtime. At that point we don't have to concern 221 * ourselves with bias, as the values in OPD have been resolved 222 * already. */ 223int 224arch_translate_address_dyn(struct Process *proc, 225 arch_addr_t addr, arch_addr_t *ret) 226{ 227 if (proc->e_machine == EM_PPC64) { 228 uint64_t value; 229 if (read_target_8(proc, addr, &value) < 0) { 230 error(0, errno, "dynamic .opd translation of %p", addr); 231 return -1; 232 } 233 /* XXX The double cast should be removed when 234 * arch_addr_t becomes integral type. */ 235 *ret = (arch_addr_t)(uintptr_t)value; 236 return 0; 237 } 238 239 *ret = addr; 240 return 0; 241} 242 243int 244arch_translate_address(struct ltelf *lte, 245 arch_addr_t addr, arch_addr_t *ret) 246{ 247 if (lte->ehdr.e_machine == EM_PPC64) { 248 /* XXX The double cast should be removed when 249 * arch_addr_t becomes integral type. */ 250 GElf_Xword offset 251 = (GElf_Addr)(uintptr_t)addr - lte->arch.opd_base; 252 uint64_t value; 253 if (elf_read_u64(lte->arch.opd_data, offset, &value) < 0) { 254 error(0, 0, "static .opd translation of %p: %s", addr, 255 elf_errmsg(-1)); 256 return -1; 257 } 258 *ret = (arch_addr_t)(uintptr_t)(value + lte->bias); 259 return 0; 260 } 261 262 *ret = addr; 263 return 0; 264} 265 266static int 267load_opd_data(struct ltelf *lte, struct library *lib) 268{ 269 Elf_Scn *sec; 270 GElf_Shdr shdr; 271 if (elf_get_section_named(lte, ".opd", &sec, &shdr) < 0) { 272 fail: 273 fprintf(stderr, "couldn't find .opd data\n"); 274 return -1; 275 } 276 277 lte->arch.opd_data = elf_rawdata(sec, NULL); 278 if (lte->arch.opd_data == NULL) 279 goto fail; 280 281 lte->arch.opd_base = shdr.sh_addr + lte->bias; 282 lte->arch.opd_size = shdr.sh_size; 283 284 return 0; 285} 286 287void * 288sym2addr(struct Process *proc, struct library_symbol *sym) 289{ 290 return sym->enter_addr; 291} 292 293static GElf_Addr 294get_glink_vma(struct ltelf *lte, GElf_Addr ppcgot, Elf_Data *plt_data) 295{ 296 Elf_Scn *ppcgot_sec = NULL; 297 GElf_Shdr ppcgot_shdr; 298 if (ppcgot != 0 299 && elf_get_section_covering(lte, ppcgot, 300 &ppcgot_sec, &ppcgot_shdr) < 0) 301 error(0, 0, "DT_PPC_GOT=%#"PRIx64", but no such section found", 302 ppcgot); 303 304 if (ppcgot_sec != NULL) { 305 Elf_Data *data = elf_loaddata(ppcgot_sec, &ppcgot_shdr); 306 if (data == NULL || data->d_size < 8 ) { 307 error(0, 0, "couldn't read GOT data"); 308 } else { 309 // where PPCGOT begins in .got 310 size_t offset = ppcgot - ppcgot_shdr.sh_addr; 311 assert(offset % 4 == 0); 312 uint32_t glink_vma; 313 if (elf_read_u32(data, offset + 4, &glink_vma) < 0) { 314 error(0, 0, "couldn't read glink VMA address" 315 " at %zd@GOT", offset); 316 return 0; 317 } 318 if (glink_vma != 0) { 319 debug(1, "PPC GOT glink_vma address: %#" PRIx32, 320 glink_vma); 321 return (GElf_Addr)glink_vma; 322 } 323 } 324 } 325 326 if (plt_data != NULL) { 327 uint32_t glink_vma; 328 if (elf_read_u32(plt_data, 0, &glink_vma) < 0) { 329 error(0, 0, "couldn't read glink VMA address"); 330 return 0; 331 } 332 debug(1, ".plt glink_vma address: %#" PRIx32, glink_vma); 333 return (GElf_Addr)glink_vma; 334 } 335 336 return 0; 337} 338 339static int 340load_dynamic_entry(struct ltelf *lte, int tag, GElf_Addr *valuep) 341{ 342 Elf_Scn *scn; 343 GElf_Shdr shdr; 344 if (elf_get_section_type(lte, SHT_DYNAMIC, &scn, &shdr) < 0 345 || scn == NULL) { 346 fail: 347 error(0, 0, "Couldn't get SHT_DYNAMIC: %s", 348 elf_errmsg(-1)); 349 return -1; 350 } 351 352 Elf_Data *data = elf_loaddata(scn, &shdr); 353 if (data == NULL) 354 goto fail; 355 356 size_t j; 357 for (j = 0; j < shdr.sh_size / shdr.sh_entsize; ++j) { 358 GElf_Dyn dyn; 359 if (gelf_getdyn(data, j, &dyn) == NULL) 360 goto fail; 361 362 if(dyn.d_tag == tag) { 363 *valuep = dyn.d_un.d_ptr; 364 return 0; 365 } 366 } 367 368 return -1; 369} 370 371static int 372load_ppcgot(struct ltelf *lte, GElf_Addr *ppcgotp) 373{ 374 return load_dynamic_entry(lte, DT_PPC_GOT, ppcgotp); 375} 376 377static int 378load_ppc64_glink(struct ltelf *lte, GElf_Addr *glinkp) 379{ 380 return load_dynamic_entry(lte, DT_PPC64_GLINK, glinkp); 381} 382 383static int 384nonzero_data(Elf_Data *data) 385{ 386 /* We are not supposed to get here if there's no PLT. */ 387 assert(data != NULL); 388 389 unsigned char *buf = data->d_buf; 390 if (buf == NULL) 391 return 0; 392 393 size_t i; 394 for (i = 0; i < data->d_size; ++i) 395 if (buf[i] != 0) 396 return 1; 397 return 0; 398} 399 400int 401arch_elf_init(struct ltelf *lte, struct library *lib) 402{ 403 if (lte->ehdr.e_machine == EM_PPC64 404 && load_opd_data(lte, lib) < 0) 405 return -1; 406 407 lte->arch.secure_plt = !(lte->plt_flags & SHF_EXECINSTR); 408 409 /* For PPC32 BSS, it is important whether the binary was 410 * prelinked. If .plt section is NODATA, or if it contains 411 * zeroes, then this library is not prelinked, and we need to 412 * delay breakpoints. */ 413 if (lte->ehdr.e_machine == EM_PPC && !lte->arch.secure_plt) 414 lib->arch.bss_plt_prelinked = nonzero_data(lte->plt_data); 415 else 416 /* For cases where it's irrelevant, initialize the 417 * value to something conspicuous. */ 418 lib->arch.bss_plt_prelinked = -1; 419 420 if (lte->ehdr.e_machine == EM_PPC && lte->arch.secure_plt) { 421 GElf_Addr ppcgot; 422 if (load_ppcgot(lte, &ppcgot) < 0) { 423 error(0, 0, "couldn't find DT_PPC_GOT"); 424 return -1; 425 } 426 GElf_Addr glink_vma = get_glink_vma(lte, ppcgot, lte->plt_data); 427 428 assert (lte->relplt_size % 12 == 0); 429 size_t count = lte->relplt_size / 12; // size of RELA entry 430 lte->arch.plt_stub_vma = glink_vma 431 - (GElf_Addr)count * PPC_PLT_STUB_SIZE; 432 debug(1, "stub_vma is %#" PRIx64, lte->arch.plt_stub_vma); 433 434 } else if (lte->ehdr.e_machine == EM_PPC64) { 435 GElf_Addr glink_vma; 436 if (load_ppc64_glink(lte, &glink_vma) < 0) { 437 error(0, 0, "couldn't find DT_PPC64_GLINK"); 438 return -1; 439 } 440 441 /* The first glink stub starts at offset 32. */ 442 lte->arch.plt_stub_vma = glink_vma + 32; 443 } 444 445 /* On PPC64, look for stub symbols in symbol table. These are 446 * called: xxxxxxxx.plt_call.callee_name@version+addend. */ 447 if (lte->ehdr.e_machine == EM_PPC64 448 && lte->symtab != NULL && lte->strtab != NULL) { 449 450 /* N.B. We can't simply skip the symbols that we fail 451 * to read or malloc. There may be more than one stub 452 * per symbol name, and if we failed in one but 453 * succeeded in another, the PLT enabling code would 454 * have no way to tell that something is missing. We 455 * could work around that, of course, but it doesn't 456 * seem worth the trouble. So if anything fails, we 457 * just pretend that we don't have stub symbols at 458 * all, as if the binary is stripped. */ 459 460 size_t i; 461 for (i = 0; i < lte->symtab_count; ++i) { 462 GElf_Sym sym; 463 if (gelf_getsym(lte->symtab, i, &sym) == NULL) { 464 struct library_symbol *sym, *next; 465 fail: 466 for (sym = lte->arch.stubs; sym != NULL; ) { 467 next = sym->next; 468 library_symbol_destroy(sym); 469 free(sym); 470 sym = next; 471 } 472 lte->arch.stubs = NULL; 473 break; 474 } 475 476 const char *name = lte->strtab + sym.st_name; 477 478#define STUBN ".plt_call." 479 if ((name = strstr(name, STUBN)) == NULL) 480 continue; 481 name += sizeof(STUBN) - 1; 482#undef STUBN 483 484 size_t len; 485 const char *ver = strchr(name, '@'); 486 if (ver != NULL) { 487 len = ver - name; 488 489 } else { 490 /* If there is "+" at all, check that 491 * the symbol name ends in "+0". */ 492 const char *add = strrchr(name, '+'); 493 if (add != NULL) { 494 assert(strcmp(add, "+0") == 0); 495 len = add - name; 496 } else { 497 len = strlen(name); 498 } 499 } 500 501 char *sym_name = strndup(name, len); 502 struct library_symbol *libsym = malloc(sizeof(*libsym)); 503 if (sym_name == NULL || libsym == NULL) { 504 fail2: 505 free(sym_name); 506 free(libsym); 507 goto fail; 508 } 509 510 /* XXX The double cast should be removed when 511 * arch_addr_t becomes integral type. */ 512 arch_addr_t addr = (arch_addr_t) 513 (uintptr_t)sym.st_value + lte->bias; 514 if (library_symbol_init(libsym, addr, sym_name, 1, 515 LS_TOPLT_EXEC) < 0) 516 goto fail2; 517 libsym->arch.type = PPC64_PLT_STUB; 518 libsym->next = lte->arch.stubs; 519 lte->arch.stubs = libsym; 520 } 521 } 522 523 return 0; 524} 525 526static int 527read_plt_slot_value(struct Process *proc, GElf_Addr addr, GElf_Addr *valp) 528{ 529 /* On PPC64, we read from .plt, which contains 8 byte 530 * addresses. On PPC32 we read from .plt, which contains 4 531 * byte instructions, but the PLT is two instructions, and 532 * either can change. */ 533 uint64_t l; 534 /* XXX double cast. */ 535 if (read_target_8(proc, (arch_addr_t)(uintptr_t)addr, &l) < 0) { 536 error(0, errno, "ptrace .plt slot value @%#" PRIx64, addr); 537 return -1; 538 } 539 540 *valp = (GElf_Addr)l; 541 return 0; 542} 543 544static int 545unresolve_plt_slot(struct Process *proc, GElf_Addr addr, GElf_Addr value) 546{ 547 /* We only modify plt_entry[0], which holds the resolved 548 * address of the routine. We keep the TOC and environment 549 * pointers intact. Hence the only adjustment that we need to 550 * do is to IP. */ 551 if (ptrace(PTRACE_POKETEXT, proc->pid, addr, value) < 0) { 552 error(0, errno, "unresolve .plt slot"); 553 return -1; 554 } 555 return 0; 556} 557 558static void 559mark_as_resolved(struct library_symbol *libsym, GElf_Addr value) 560{ 561 libsym->arch.type = PPC_PLT_RESOLVED; 562 libsym->arch.resolved_value = value; 563} 564 565enum plt_status 566arch_elf_add_plt_entry(struct Process *proc, struct ltelf *lte, 567 const char *a_name, GElf_Rela *rela, size_t ndx, 568 struct library_symbol **ret) 569{ 570 if (lte->ehdr.e_machine == EM_PPC) { 571 if (lte->arch.secure_plt) 572 return plt_default; 573 574 struct library_symbol *libsym = NULL; 575 if (default_elf_add_plt_entry(proc, lte, a_name, rela, ndx, 576 &libsym) < 0) 577 return plt_fail; 578 579 /* On PPC32 with BSS PLT, delay the symbol until 580 * dynamic linker is done. */ 581 assert(!libsym->delayed); 582 libsym->delayed = 1; 583 584 *ret = libsym; 585 return plt_ok; 586 } 587 588 /* PPC64. If we have stubs, we return a chain of breakpoint 589 * sites, one for each stub that corresponds to this PLT 590 * entry. */ 591 struct library_symbol *chain = NULL; 592 struct library_symbol **symp; 593 for (symp = <e->arch.stubs; *symp != NULL; ) { 594 struct library_symbol *sym = *symp; 595 if (strcmp(sym->name, a_name) != 0) { 596 symp = &(*symp)->next; 597 continue; 598 } 599 600 /* Re-chain the symbol from stubs to CHAIN. */ 601 *symp = sym->next; 602 sym->next = chain; 603 chain = sym; 604 } 605 606 if (chain != NULL) { 607 *ret = chain; 608 return plt_ok; 609 } 610 611 /* We don't have stub symbols. Find corresponding .plt slot, 612 * and check whether it contains the corresponding PLT address 613 * (or 0 if the dynamic linker hasn't run yet). N.B. we don't 614 * want read this from ELF file, but from process image. That 615 * makes a difference if we are attaching to a running 616 * process. */ 617 618 GElf_Addr plt_entry_addr = arch_plt_sym_val(lte, ndx, rela); 619 GElf_Addr plt_slot_addr = rela->r_offset; 620 assert(plt_slot_addr >= lte->plt_addr 621 || plt_slot_addr < lte->plt_addr + lte->plt_size); 622 623 GElf_Addr plt_slot_value; 624 if (read_plt_slot_value(proc, plt_slot_addr, &plt_slot_value) < 0) 625 return plt_fail; 626 627 char *name = strdup(a_name); 628 struct library_symbol *libsym = malloc(sizeof(*libsym)); 629 if (name == NULL || libsym == NULL) { 630 error(0, errno, "allocation for .plt slot"); 631 fail: 632 free(name); 633 free(libsym); 634 return plt_fail; 635 } 636 637 /* XXX The double cast should be removed when 638 * arch_addr_t becomes integral type. */ 639 if (library_symbol_init(libsym, 640 (arch_addr_t)(uintptr_t)plt_entry_addr, 641 name, 1, LS_TOPLT_EXEC) < 0) 642 goto fail; 643 libsym->arch.plt_slot_addr = plt_slot_addr; 644 645 if (plt_slot_value == plt_entry_addr || plt_slot_value == 0) { 646 libsym->arch.type = PPC_PLT_UNRESOLVED; 647 libsym->arch.resolved_value = plt_entry_addr; 648 649 } else { 650 /* Unresolve the .plt slot. If the binary was 651 * prelinked, this makes the code invalid, because in 652 * case of prelinked binary, the dynamic linker 653 * doesn't update .plt[0] and .plt[1] with addresses 654 * of the resover. But we don't care, we will never 655 * need to enter the resolver. That just means that 656 * we have to un-un-resolve this back before we 657 * detach. */ 658 659 if (unresolve_plt_slot(proc, plt_slot_addr, plt_entry_addr) < 0) { 660 library_symbol_destroy(libsym); 661 goto fail; 662 } 663 mark_as_resolved(libsym, plt_slot_value); 664 } 665 666 *ret = libsym; 667 return plt_ok; 668} 669 670void 671arch_elf_destroy(struct ltelf *lte) 672{ 673 struct library_symbol *sym; 674 for (sym = lte->arch.stubs; sym != NULL; ) { 675 struct library_symbol *next = sym->next; 676 library_symbol_destroy(sym); 677 free(sym); 678 sym = next; 679 } 680} 681 682static void 683dl_plt_update_bp_on_hit(struct breakpoint *bp, struct Process *proc) 684{ 685 debug(DEBUG_PROCESS, "pid=%d dl_plt_update_bp_on_hit %s(%p)", 686 proc->pid, breakpoint_name(bp), bp->addr); 687 struct process_stopping_handler *self = proc->arch.handler; 688 assert(self != NULL); 689 690 struct library_symbol *libsym = self->breakpoint_being_enabled->libsym; 691 GElf_Addr value; 692 if (read_plt_slot_value(proc, libsym->arch.plt_slot_addr, &value) < 0) 693 return; 694 695 /* On PPC64, we rewrite the slot value. */ 696 if (proc->e_machine == EM_PPC64) 697 unresolve_plt_slot(proc, libsym->arch.plt_slot_addr, 698 libsym->arch.resolved_value); 699 /* We mark the breakpoint as resolved on both arches. */ 700 mark_as_resolved(libsym, value); 701 702 /* cb_on_all_stopped looks if HANDLER is set to NULL as a way 703 * to check that this was run. It's an error if it 704 * wasn't. */ 705 proc->arch.handler = NULL; 706 707 breakpoint_turn_off(bp, proc); 708} 709 710static void 711cb_on_all_stopped(struct process_stopping_handler *self) 712{ 713 /* Put that in for dl_plt_update_bp_on_hit to see. */ 714 assert(self->task_enabling_breakpoint->arch.handler == NULL); 715 self->task_enabling_breakpoint->arch.handler = self; 716 717 linux_ptrace_disable_and_continue(self); 718} 719 720static enum callback_status 721cb_keep_stepping_p(struct process_stopping_handler *self) 722{ 723 struct Process *proc = self->task_enabling_breakpoint; 724 struct library_symbol *libsym = self->breakpoint_being_enabled->libsym; 725 726 GElf_Addr value; 727 if (read_plt_slot_value(proc, libsym->arch.plt_slot_addr, &value) < 0) 728 return CBS_FAIL; 729 730 /* In UNRESOLVED state, the RESOLVED_VALUE in fact contains 731 * the PLT entry value. */ 732 if (value == libsym->arch.resolved_value) 733 return CBS_CONT; 734 735 debug(DEBUG_PROCESS, "pid=%d PLT got resolved to value %#"PRIx64, 736 proc->pid, value); 737 738 /* The .plt slot got resolved! We can migrate the breakpoint 739 * to RESOLVED and stop single-stepping. */ 740 if (proc->e_machine == EM_PPC64 741 && unresolve_plt_slot(proc, libsym->arch.plt_slot_addr, 742 libsym->arch.resolved_value) < 0) 743 return CBS_FAIL; 744 745 /* Resolving on PPC64 consists of overwriting a doubleword in 746 * .plt. That doubleword is than read back by a stub, and 747 * jumped on. Hopefully we can assume that double word update 748 * is done on a single place only, as it contains a final 749 * address. We still need to look around for any sync 750 * instruction, but essentially it is safe to optimize away 751 * the single stepping next time and install a post-update 752 * breakpoint. 753 * 754 * The situation on PPC32 BSS is more complicated. The 755 * dynamic linker here updates potentially several 756 * instructions (XXX currently we assume two) and the rules 757 * are more complicated. Sometimes it's enough to adjust just 758 * one of the addresses--the logic for generating optimal 759 * dispatch depends on relative addresses of the .plt entry 760 * and the jump destination. We can't assume that the some 761 * instruction block does the update every time. So on PPC32, 762 * we turn the optimization off and just step through it each 763 * time. */ 764 if (proc->e_machine == EM_PPC) 765 goto done; 766 767 /* Install breakpoint to the address where the change takes 768 * place. If we fail, then that just means that we'll have to 769 * singlestep the next time around as well. */ 770 struct Process *leader = proc->leader; 771 if (leader == NULL || leader->arch.dl_plt_update_bp != NULL) 772 goto done; 773 774 /* We need to install to the next instruction. ADDR points to 775 * a store instruction, so moving the breakpoint one 776 * instruction forward is safe. */ 777 arch_addr_t addr = get_instruction_pointer(proc) + 4; 778 leader->arch.dl_plt_update_bp = insert_breakpoint(proc, addr, NULL); 779 if (leader->arch.dl_plt_update_bp == NULL) 780 goto done; 781 782 static struct bp_callbacks dl_plt_update_cbs = { 783 .on_hit = dl_plt_update_bp_on_hit, 784 }; 785 leader->arch.dl_plt_update_bp->cbs = &dl_plt_update_cbs; 786 787 /* Turn it off for now. We will turn it on again when we hit 788 * the PLT entry that needs this. */ 789 breakpoint_turn_off(leader->arch.dl_plt_update_bp, proc); 790 791done: 792 mark_as_resolved(libsym, value); 793 794 return CBS_STOP; 795} 796 797static void 798jump_to_entry_point(struct Process *proc, struct breakpoint *bp) 799{ 800 /* XXX The double cast should be removed when 801 * arch_addr_t becomes integral type. */ 802 arch_addr_t rv = (arch_addr_t) 803 (uintptr_t)bp->libsym->arch.resolved_value; 804 set_instruction_pointer(proc, rv); 805} 806 807static void 808ppc_plt_bp_continue(struct breakpoint *bp, struct Process *proc) 809{ 810 switch (bp->libsym->arch.type) { 811 struct Process *leader; 812 void (*on_all_stopped)(struct process_stopping_handler *); 813 enum callback_status (*keep_stepping_p) 814 (struct process_stopping_handler *); 815 816 case PPC_DEFAULT: 817 assert(proc->e_machine == EM_PPC); 818 assert(bp->libsym != NULL); 819 assert(bp->libsym->lib->arch.bss_plt_prelinked == 0); 820 /* Fall through. */ 821 822 case PPC_PLT_UNRESOLVED: 823 on_all_stopped = NULL; 824 keep_stepping_p = NULL; 825 leader = proc->leader; 826 827 if (leader != NULL && leader->arch.dl_plt_update_bp != NULL 828 && breakpoint_turn_on(leader->arch.dl_plt_update_bp, 829 proc) >= 0) 830 on_all_stopped = cb_on_all_stopped; 831 else 832 keep_stepping_p = cb_keep_stepping_p; 833 834 if (process_install_stopping_handler 835 (proc, bp, on_all_stopped, keep_stepping_p, NULL) < 0) { 836 error(0, 0, "ppc_plt_bp_continue: couldn't install" 837 " event handler"); 838 continue_after_breakpoint(proc, bp); 839 } 840 return; 841 842 case PPC_PLT_RESOLVED: 843 if (proc->e_machine == EM_PPC) { 844 continue_after_breakpoint(proc, bp); 845 return; 846 } 847 848 jump_to_entry_point(proc, bp); 849 continue_process(proc->pid); 850 return; 851 852 case PPC64_PLT_STUB: 853 /* These should never hit here. */ 854 break; 855 } 856 857 assert(bp->libsym->arch.type != bp->libsym->arch.type); 858 abort(); 859} 860 861/* When a process is in a PLT stub, it may have already read the data 862 * in .plt that we changed. If we detach now, it will jump to PLT 863 * entry and continue to the dynamic linker, where it will SIGSEGV, 864 * because zeroth .plt slot is not filled in prelinked binaries, and 865 * the dynamic linker needs that data. Moreover, the process may 866 * actually have hit the breakpoint already. This functions tries to 867 * detect both cases and do any fix-ups necessary to mend this 868 * situation. */ 869static enum callback_status 870detach_task_cb(struct Process *task, void *data) 871{ 872 struct breakpoint *bp = data; 873 874 if (get_instruction_pointer(task) == bp->addr) { 875 debug(DEBUG_PROCESS, "%d at %p, which is PLT slot", 876 task->pid, bp->addr); 877 jump_to_entry_point(task, bp); 878 return CBS_CONT; 879 } 880 881 /* XXX There's still a window of several instructions where we 882 * might catch the task inside a stub such that it has already 883 * read destination address from .plt, but hasn't jumped yet, 884 * thus avoiding the breakpoint. */ 885 886 return CBS_CONT; 887} 888 889static void 890ppc_plt_bp_retract(struct breakpoint *bp, struct Process *proc) 891{ 892 /* On PPC64, we rewrite .plt with PLT entry addresses. This 893 * needs to be undone. Unfortunately, the program may have 894 * made decisions based on that value */ 895 if (proc->e_machine == EM_PPC64 896 && bp->libsym != NULL 897 && bp->libsym->arch.type == PPC_PLT_RESOLVED) { 898 each_task(proc->leader, NULL, detach_task_cb, bp); 899 unresolve_plt_slot(proc, bp->libsym->arch.plt_slot_addr, 900 bp->libsym->arch.resolved_value); 901 } 902} 903 904void 905arch_library_init(struct library *lib) 906{ 907} 908 909void 910arch_library_destroy(struct library *lib) 911{ 912} 913 914void 915arch_library_clone(struct library *retp, struct library *lib) 916{ 917} 918 919int 920arch_library_symbol_init(struct library_symbol *libsym) 921{ 922 /* We set type explicitly in the code above, where we have the 923 * necessary context. This is for calls from ltrace-elf.c and 924 * such. */ 925 libsym->arch.type = PPC_DEFAULT; 926 return 0; 927} 928 929void 930arch_library_symbol_destroy(struct library_symbol *libsym) 931{ 932} 933 934int 935arch_library_symbol_clone(struct library_symbol *retp, 936 struct library_symbol *libsym) 937{ 938 retp->arch = libsym->arch; 939 return 0; 940} 941 942/* For some symbol types, we need to set up custom callbacks. XXX we 943 * don't need PROC here, we can store the data in BP if it is of 944 * interest to us. */ 945int 946arch_breakpoint_init(struct Process *proc, struct breakpoint *bp) 947{ 948 /* Artificial and entry-point breakpoints are plain. */ 949 if (bp->libsym == NULL || bp->libsym->plt_type != LS_TOPLT_EXEC) 950 return 0; 951 952 /* On PPC, secure PLT and prelinked BSS PLT are plain. */ 953 if (proc->e_machine == EM_PPC 954 && bp->libsym->lib->arch.bss_plt_prelinked != 0) 955 return 0; 956 957 /* On PPC64, stub PLT breakpoints are plain. */ 958 if (proc->e_machine == EM_PPC64 959 && bp->libsym->arch.type == PPC64_PLT_STUB) 960 return 0; 961 962 static struct bp_callbacks cbs = { 963 .on_continue = ppc_plt_bp_continue, 964 .on_retract = ppc_plt_bp_retract, 965 }; 966 breakpoint_set_callbacks(bp, &cbs); 967 return 0; 968} 969 970void 971arch_breakpoint_destroy(struct breakpoint *bp) 972{ 973} 974 975int 976arch_breakpoint_clone(struct breakpoint *retp, struct breakpoint *sbp) 977{ 978 retp->arch = sbp->arch; 979 return 0; 980} 981 982int 983arch_process_init(struct Process *proc) 984{ 985 proc->arch.dl_plt_update_bp = NULL; 986 proc->arch.handler = NULL; 987 return 0; 988} 989 990void 991arch_process_destroy(struct Process *proc) 992{ 993} 994 995int 996arch_process_clone(struct Process *retp, struct Process *proc) 997{ 998 retp->arch = proc->arch; 999 return 0; 1000} 1001 1002int 1003arch_process_exec(struct Process *proc) 1004{ 1005 return arch_process_init(proc); 1006} 1007