plt.c revision 653085a32cdc89f5215c2d70249b58c9fe6aebb7
1/* 2 * This file is part of ltrace. 3 * Copyright (C) 2012,2013 Petr Machata, Red Hat Inc. 4 * Copyright (C) 2004,2008,2009 Juan Cespedes 5 * Copyright (C) 2006 Paul Gilliam 6 * 7 * This program is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU General Public License as 9 * published by the Free Software Foundation; either version 2 of the 10 * License, or (at your option) any later version. 11 * 12 * This program is distributed in the hope that it will be useful, but 13 * WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 15 * General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License 18 * along with this program; if not, write to the Free Software 19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 20 * 02110-1301 USA 21 */ 22 23#include <gelf.h> 24#include <sys/ptrace.h> 25#include <errno.h> 26#include <inttypes.h> 27#include <assert.h> 28#include <string.h> 29 30#include "proc.h" 31#include "common.h" 32#include "insn.h" 33#include "library.h" 34#include "breakpoint.h" 35#include "linux-gnu/trace.h" 36#include "backend.h" 37 38/* There are two PLT types on 32-bit PPC: old-style, BSS PLT, and 39 * new-style "secure" PLT. We can tell one from the other by the 40 * flags on the .plt section. If it's +X (executable), it's BSS PLT, 41 * otherwise it's secure. 42 * 43 * BSS PLT works the same way as most architectures: the .plt section 44 * contains trampolines and we put breakpoints to those. If not 45 * prelinked, .plt contains zeroes, and dynamic linker fills in the 46 * initial set of trampolines, which means that we need to delay 47 * enabling breakpoints until after binary entry point is hit. 48 * Additionally, after first call, dynamic linker updates .plt with 49 * branch to resolved address. That means that on first hit, we must 50 * do something similar to the PPC64 gambit described below. 51 * 52 * With secure PLT, the .plt section doesn't contain instructions but 53 * addresses. The real PLT table is stored in .text. Addresses of 54 * those PLT entries can be computed, and apart from the fact that 55 * they are in .text, they are ordinary PLT entries. 56 * 57 * 64-bit PPC is more involved. Program linker creates for each 58 * library call a _stub_ symbol named xxxxxxxx.plt_call.<callee> 59 * (where xxxxxxxx is a hexadecimal number). That stub does the call 60 * dispatch: it loads an address of a function to call from the 61 * section .plt, and branches. PLT entries themselves are essentially 62 * a curried call to the resolver. When the symbol is resolved, the 63 * resolver updates the value stored in .plt, and the next time 64 * around, the stub calls the library function directly. So we make 65 * at most one trip (none if the binary is prelinked) through each PLT 66 * entry, and correspondingly that is useless as a breakpoint site. 67 * 68 * Note the three confusing terms: stubs (that play the role of PLT 69 * entries), PLT entries, .plt section. 70 * 71 * We first check symbol tables and see if we happen to have stub 72 * symbols available. If yes we just put breakpoints to those, and 73 * treat them as usual breakpoints. The only tricky part is realizing 74 * that there can be more than one breakpoint per symbol. 75 * 76 * The case that we don't have the stub symbols available is harder. 77 * The following scheme uses two kinds of PLT breakpoints: unresolved 78 * and resolved (to some address). When the process starts (or when 79 * we attach), we distribute unresolved PLT breakpoints to the PLT 80 * entries (not stubs). Then we look in .plt, and for each entry 81 * whose value is different than the corresponding PLT entry address, 82 * we assume it was already resolved, and convert the breakpoint to 83 * resolved. We also rewrite the resolved value in .plt back to the 84 * PLT address. 85 * 86 * When a PLT entry hits a resolved breakpoint (which happens because 87 * we rewrite .plt with the original unresolved addresses), we move 88 * the instruction pointer to the corresponding address and continue 89 * the process as if nothing happened. 90 * 91 * When unresolved PLT entry is called for the first time, we need to 92 * catch the new value that the resolver will write to a .plt slot. 93 * We also need to prevent another thread from racing through and 94 * taking the branch without ltrace noticing. So when unresolved PLT 95 * entry hits, we have to stop all threads. We then single-step 96 * through the resolver, until the .plt slot changes. When it does, 97 * we treat it the same way as above: convert the PLT breakpoint to 98 * resolved, and rewrite the .plt value back to PLT address. We then 99 * start all threads again. 100 * 101 * As an optimization, we remember the address where the address was 102 * resolved, and put a breakpoint there. The next time around (when 103 * the next PLT entry is to be resolved), instead of single-stepping 104 * through half the dynamic linker, we just let the thread run and hit 105 * this breakpoint. When it hits, we know the PLT entry was resolved. 106 * 107 * XXX TODO If we have hardware watch point, we might put a read watch 108 * on .plt slot, and discover the offenders this way. I don't know 109 * the details, but I assume at most a handful (like, one or two, if 110 * available at all) addresses may be watched at a time, and thus this 111 * would be used as an amendment of the above rather than full-on 112 * solution to PLT tracing on PPC. 113 */ 114 115#define PPC_PLT_STUB_SIZE 16 116#define PPC64_PLT_STUB_SIZE 8 //xxx 117 118static inline int 119host_powerpc64() 120{ 121#ifdef __powerpc64__ 122 return 1; 123#else 124 return 0; 125#endif 126} 127 128static void 129mark_as_resolved(struct library_symbol *libsym, GElf_Addr value) 130{ 131 libsym->arch.type = PPC_PLT_RESOLVED; 132 libsym->arch.resolved_value = value; 133} 134 135void 136arch_dynlink_done(struct process *proc) 137{ 138 /* On PPC32 with BSS PLT, we need to enable delayed symbols. */ 139 struct library_symbol *libsym = NULL; 140 while ((libsym = proc_each_symbol(proc, libsym, 141 library_symbol_delayed_cb, NULL))) { 142 if (proc_read_64(proc, libsym->enter_addr, 143 &libsym->arch.resolved_value) < 0) { 144 fprintf(stderr, 145 "couldn't read PLT value for %s(%p): %s\n", 146 libsym->name, libsym->enter_addr, 147 strerror(errno)); 148 return; 149 } 150 151 /* arch_dynlink_done is called on attach as well. In 152 * that case some slots will have been resolved 153 * already. Unresolved PLT looks like this: 154 * 155 * <sleep@plt>: li r11,0 156 * <sleep@plt+4>: b "resolve" 157 * 158 * "resolve" is another address in PLTGOT (the same 159 * block that all the PLT slots are it). When 160 * resolved, it looks either this way: 161 * 162 * <sleep@plt>: b 0xfea88d0 <sleep> 163 * 164 * Which is easy to detect. It can also look this 165 * way: 166 * 167 * <sleep@plt>: li r11,0 168 * <sleep@plt+4>: b "dispatch" 169 * 170 * The "dispatch" address lies in PLTGOT as well. In 171 * current GNU toolchain, "dispatch" address is the 172 * same as PLTGOT address. We rely on this to figure 173 * out whether the address is resolved or not. */ 174 uint32_t insn1 = libsym->arch.resolved_value >> 32; 175 uint32_t insn2 = (uint32_t)libsym->arch.resolved_value; 176 if ((insn1 & BRANCH_MASK) == B_INSN 177 || ((insn2 & BRANCH_MASK) == B_INSN 178 /* XXX double cast */ 179 && (ppc_branch_dest(libsym->enter_addr + 4, insn2) 180 == (void*)(long)libsym->lib->arch.pltgot_addr))) 181 mark_as_resolved(libsym, libsym->arch.resolved_value); 182 183 if (proc_activate_delayed_symbol(proc, libsym) < 0) 184 return; 185 186 /* XXX double cast */ 187 libsym->arch.plt_slot_addr 188 = (GElf_Addr)(uintptr_t)libsym->enter_addr; 189 } 190} 191 192GElf_Addr 193arch_plt_sym_val(struct ltelf *lte, size_t ndx, GElf_Rela *rela) 194{ 195 if (lte->ehdr.e_machine == EM_PPC && lte->arch.secure_plt) { 196 assert(lte->arch.plt_stub_vma != 0); 197 return lte->arch.plt_stub_vma + PPC_PLT_STUB_SIZE * ndx; 198 199 } else if (lte->ehdr.e_machine == EM_PPC) { 200 return rela->r_offset; 201 202 } else { 203 /* If we get here, we don't have stub symbols. In 204 * that case we put brakpoints to PLT entries the same 205 * as the PPC32 secure PLT case does. */ 206 assert(lte->arch.plt_stub_vma != 0); 207 return lte->arch.plt_stub_vma + PPC64_PLT_STUB_SIZE * ndx; 208 } 209} 210 211/* This entry point is called when ltelf is not available 212 * anymore--during runtime. At that point we don't have to concern 213 * ourselves with bias, as the values in OPD have been resolved 214 * already. */ 215int 216arch_translate_address_dyn(struct process *proc, 217 arch_addr_t addr, arch_addr_t *ret) 218{ 219 if (proc->e_machine == EM_PPC64) { 220 uint64_t value; 221 if (proc_read_64(proc, addr, &value) < 0) { 222 fprintf(stderr, 223 "dynamic .opd translation of %p: %s\n", 224 addr, strerror(errno)); 225 return -1; 226 } 227 /* XXX The double cast should be removed when 228 * arch_addr_t becomes integral type. */ 229 *ret = (arch_addr_t)(uintptr_t)value; 230 return 0; 231 } 232 233 *ret = addr; 234 return 0; 235} 236 237int 238arch_translate_address(struct ltelf *lte, 239 arch_addr_t addr, arch_addr_t *ret) 240{ 241 if (lte->ehdr.e_machine == EM_PPC64) { 242 /* XXX The double cast should be removed when 243 * arch_addr_t becomes integral type. */ 244 GElf_Xword offset 245 = (GElf_Addr)(uintptr_t)addr - lte->arch.opd_base; 246 uint64_t value; 247 if (elf_read_u64(lte->arch.opd_data, offset, &value) < 0) { 248 fprintf(stderr, "static .opd translation of %p: %s\n", 249 addr, elf_errmsg(-1)); 250 return -1; 251 } 252 *ret = (arch_addr_t)(uintptr_t)(value + lte->bias); 253 return 0; 254 } 255 256 *ret = addr; 257 return 0; 258} 259 260static int 261load_opd_data(struct ltelf *lte, struct library *lib) 262{ 263 Elf_Scn *sec; 264 GElf_Shdr shdr; 265 if (elf_get_section_named(lte, ".opd", &sec, &shdr) < 0) { 266 fail: 267 fprintf(stderr, "couldn't find .opd data\n"); 268 return -1; 269 } 270 271 lte->arch.opd_data = elf_rawdata(sec, NULL); 272 if (lte->arch.opd_data == NULL) 273 goto fail; 274 275 lte->arch.opd_base = shdr.sh_addr + lte->bias; 276 lte->arch.opd_size = shdr.sh_size; 277 278 return 0; 279} 280 281void * 282sym2addr(struct process *proc, struct library_symbol *sym) 283{ 284 return sym->enter_addr; 285} 286 287static GElf_Addr 288get_glink_vma(struct ltelf *lte, GElf_Addr ppcgot, Elf_Data *plt_data) 289{ 290 Elf_Scn *ppcgot_sec = NULL; 291 GElf_Shdr ppcgot_shdr; 292 if (ppcgot != 0 293 && elf_get_section_covering(lte, ppcgot, 294 &ppcgot_sec, &ppcgot_shdr) < 0) 295 fprintf(stderr, 296 "DT_PPC_GOT=%#"PRIx64", but no such section found\n", 297 ppcgot); 298 299 if (ppcgot_sec != NULL) { 300 Elf_Data *data = elf_loaddata(ppcgot_sec, &ppcgot_shdr); 301 if (data == NULL || data->d_size < 8 ) { 302 fprintf(stderr, "couldn't read GOT data\n"); 303 } else { 304 // where PPCGOT begins in .got 305 size_t offset = ppcgot - ppcgot_shdr.sh_addr; 306 assert(offset % 4 == 0); 307 uint32_t glink_vma; 308 if (elf_read_u32(data, offset + 4, &glink_vma) < 0) { 309 fprintf(stderr, "couldn't read glink VMA" 310 " address at %zd@GOT\n", offset); 311 return 0; 312 } 313 if (glink_vma != 0) { 314 debug(1, "PPC GOT glink_vma address: %#" PRIx32, 315 glink_vma); 316 return (GElf_Addr)glink_vma; 317 } 318 } 319 } 320 321 if (plt_data != NULL) { 322 uint32_t glink_vma; 323 if (elf_read_u32(plt_data, 0, &glink_vma) < 0) { 324 fprintf(stderr, "couldn't read glink VMA address\n"); 325 return 0; 326 } 327 debug(1, ".plt glink_vma address: %#" PRIx32, glink_vma); 328 return (GElf_Addr)glink_vma; 329 } 330 331 return 0; 332} 333 334static int 335load_dynamic_entry(struct ltelf *lte, int tag, GElf_Addr *valuep) 336{ 337 Elf_Scn *scn; 338 GElf_Shdr shdr; 339 if (elf_get_section_type(lte, SHT_DYNAMIC, &scn, &shdr) < 0 340 || scn == NULL) { 341 fail: 342 fprintf(stderr, "Couldn't get SHT_DYNAMIC: %s\n", 343 elf_errmsg(-1)); 344 return -1; 345 } 346 347 Elf_Data *data = elf_loaddata(scn, &shdr); 348 if (data == NULL) 349 goto fail; 350 351 size_t j; 352 for (j = 0; j < shdr.sh_size / shdr.sh_entsize; ++j) { 353 GElf_Dyn dyn; 354 if (gelf_getdyn(data, j, &dyn) == NULL) 355 goto fail; 356 357 if(dyn.d_tag == tag) { 358 *valuep = dyn.d_un.d_ptr; 359 return 0; 360 } 361 } 362 363 return -1; 364} 365 366static int 367nonzero_data(Elf_Data *data) 368{ 369 /* We are not supposed to get here if there's no PLT. */ 370 assert(data != NULL); 371 372 unsigned char *buf = data->d_buf; 373 if (buf == NULL) 374 return 0; 375 376 size_t i; 377 for (i = 0; i < data->d_size; ++i) 378 if (buf[i] != 0) 379 return 1; 380 return 0; 381} 382 383int 384arch_elf_init(struct ltelf *lte, struct library *lib) 385{ 386 if (lte->ehdr.e_machine == EM_PPC64 387 && load_opd_data(lte, lib) < 0) 388 return -1; 389 390 lte->arch.secure_plt = !(lte->plt_flags & SHF_EXECINSTR); 391 392 /* For PPC32 BSS, it is important whether the binary was 393 * prelinked. If .plt section is NODATA, or if it contains 394 * zeroes, then this library is not prelinked, and we need to 395 * delay breakpoints. */ 396 if (lte->ehdr.e_machine == EM_PPC && !lte->arch.secure_plt) 397 lib->arch.bss_plt_prelinked = nonzero_data(lte->plt_data); 398 else 399 /* For cases where it's irrelevant, initialize the 400 * value to something conspicuous. */ 401 lib->arch.bss_plt_prelinked = -1; 402 403 if (lte->ehdr.e_machine == EM_PPC && lte->arch.secure_plt) { 404 GElf_Addr ppcgot; 405 if (load_dynamic_entry(lte, DT_PPC_GOT, &ppcgot) < 0) { 406 fprintf(stderr, "couldn't find DT_PPC_GOT\n"); 407 return -1; 408 } 409 GElf_Addr glink_vma = get_glink_vma(lte, ppcgot, lte->plt_data); 410 411 assert(lte->relplt_size % 12 == 0); 412 size_t count = lte->relplt_size / 12; // size of RELA entry 413 lte->arch.plt_stub_vma = glink_vma 414 - (GElf_Addr)count * PPC_PLT_STUB_SIZE; 415 debug(1, "stub_vma is %#" PRIx64, lte->arch.plt_stub_vma); 416 417 } else if (lte->ehdr.e_machine == EM_PPC64) { 418 GElf_Addr glink_vma; 419 if (load_dynamic_entry(lte, DT_PPC64_GLINK, &glink_vma) < 0) { 420 fprintf(stderr, "couldn't find DT_PPC64_GLINK\n"); 421 return -1; 422 } 423 424 /* The first glink stub starts at offset 32. */ 425 lte->arch.plt_stub_vma = glink_vma + 32; 426 427 } else { 428 /* By exhaustion--PPC32 BSS. */ 429 if (load_dynamic_entry(lte, DT_PLTGOT, 430 &lib->arch.pltgot_addr) < 0) { 431 fprintf(stderr, "couldn't find DT_PLTGOT\n"); 432 return -1; 433 } 434 } 435 436 /* On PPC64, look for stub symbols in symbol table. These are 437 * called: xxxxxxxx.plt_call.callee_name@version+addend. */ 438 if (lte->ehdr.e_machine == EM_PPC64 439 && lte->symtab != NULL && lte->strtab != NULL) { 440 441 /* N.B. We can't simply skip the symbols that we fail 442 * to read or malloc. There may be more than one stub 443 * per symbol name, and if we failed in one but 444 * succeeded in another, the PLT enabling code would 445 * have no way to tell that something is missing. We 446 * could work around that, of course, but it doesn't 447 * seem worth the trouble. So if anything fails, we 448 * just pretend that we don't have stub symbols at 449 * all, as if the binary is stripped. */ 450 451 size_t i; 452 for (i = 0; i < lte->symtab_count; ++i) { 453 GElf_Sym sym; 454 if (gelf_getsym(lte->symtab, i, &sym) == NULL) { 455 struct library_symbol *sym, *next; 456 fail: 457 for (sym = lte->arch.stubs; sym != NULL; ) { 458 next = sym->next; 459 library_symbol_destroy(sym); 460 free(sym); 461 sym = next; 462 } 463 lte->arch.stubs = NULL; 464 break; 465 } 466 467 const char *name = lte->strtab + sym.st_name; 468 469#define STUBN ".plt_call." 470 if ((name = strstr(name, STUBN)) == NULL) 471 continue; 472 name += sizeof(STUBN) - 1; 473#undef STUBN 474 475 size_t len; 476 const char *ver = strchr(name, '@'); 477 if (ver != NULL) { 478 len = ver - name; 479 480 } else { 481 /* If there is "+" at all, check that 482 * the symbol name ends in "+0". */ 483 const char *add = strrchr(name, '+'); 484 if (add != NULL) { 485 assert(strcmp(add, "+0") == 0); 486 len = add - name; 487 } else { 488 len = strlen(name); 489 } 490 } 491 492 char *sym_name = strndup(name, len); 493 struct library_symbol *libsym = malloc(sizeof(*libsym)); 494 if (sym_name == NULL || libsym == NULL) { 495 fail2: 496 free(sym_name); 497 free(libsym); 498 goto fail; 499 } 500 501 /* XXX The double cast should be removed when 502 * arch_addr_t becomes integral type. */ 503 arch_addr_t addr = (arch_addr_t) 504 (uintptr_t)sym.st_value + lte->bias; 505 if (library_symbol_init(libsym, addr, sym_name, 1, 506 LS_TOPLT_EXEC) < 0) 507 goto fail2; 508 libsym->arch.type = PPC64_PLT_STUB; 509 libsym->next = lte->arch.stubs; 510 lte->arch.stubs = libsym; 511 } 512 } 513 514 return 0; 515} 516 517static int 518read_plt_slot_value(struct process *proc, GElf_Addr addr, GElf_Addr *valp) 519{ 520 /* On PPC64, we read from .plt, which contains 8 byte 521 * addresses. On PPC32 we read from .plt, which contains 4 522 * byte instructions, but the PLT is two instructions, and 523 * either can change. */ 524 uint64_t l; 525 /* XXX double cast. */ 526 if (proc_read_64(proc, (arch_addr_t)(uintptr_t)addr, &l) < 0) { 527 fprintf(stderr, "ptrace .plt slot value @%#" PRIx64": %s\n", 528 addr, strerror(errno)); 529 return -1; 530 } 531 532 *valp = (GElf_Addr)l; 533 return 0; 534} 535 536static int 537unresolve_plt_slot(struct process *proc, GElf_Addr addr, GElf_Addr value) 538{ 539 /* We only modify plt_entry[0], which holds the resolved 540 * address of the routine. We keep the TOC and environment 541 * pointers intact. Hence the only adjustment that we need to 542 * do is to IP. */ 543 if (ptrace(PTRACE_POKETEXT, proc->pid, addr, value) < 0) { 544 fprintf(stderr, "failed to unresolve .plt slot: %s\n", 545 strerror(errno)); 546 return -1; 547 } 548 return 0; 549} 550 551enum plt_status 552arch_elf_add_plt_entry(struct process *proc, struct ltelf *lte, 553 const char *a_name, GElf_Rela *rela, size_t ndx, 554 struct library_symbol **ret) 555{ 556 if (lte->ehdr.e_machine == EM_PPC) { 557 if (lte->arch.secure_plt) 558 return PLT_DEFAULT; 559 560 struct library_symbol *libsym = NULL; 561 if (default_elf_add_plt_entry(proc, lte, a_name, rela, ndx, 562 &libsym) < 0) 563 return PLT_FAIL; 564 565 /* On PPC32 with BSS PLT, delay the symbol until 566 * dynamic linker is done. */ 567 assert(!libsym->delayed); 568 libsym->delayed = 1; 569 570 *ret = libsym; 571 return PLT_OK; 572 } 573 574 /* PPC64. If we have stubs, we return a chain of breakpoint 575 * sites, one for each stub that corresponds to this PLT 576 * entry. */ 577 struct library_symbol *chain = NULL; 578 struct library_symbol **symp; 579 for (symp = <e->arch.stubs; *symp != NULL; ) { 580 struct library_symbol *sym = *symp; 581 if (strcmp(sym->name, a_name) != 0) { 582 symp = &(*symp)->next; 583 continue; 584 } 585 586 /* Re-chain the symbol from stubs to CHAIN. */ 587 *symp = sym->next; 588 sym->next = chain; 589 chain = sym; 590 } 591 592 if (chain != NULL) { 593 *ret = chain; 594 return PLT_OK; 595 } 596 597 /* We don't have stub symbols. Find corresponding .plt slot, 598 * and check whether it contains the corresponding PLT address 599 * (or 0 if the dynamic linker hasn't run yet). N.B. we don't 600 * want read this from ELF file, but from process image. That 601 * makes a difference if we are attaching to a running 602 * process. */ 603 604 GElf_Addr plt_entry_addr = arch_plt_sym_val(lte, ndx, rela); 605 GElf_Addr plt_slot_addr = rela->r_offset; 606 assert(plt_slot_addr >= lte->plt_addr 607 || plt_slot_addr < lte->plt_addr + lte->plt_size); 608 609 GElf_Addr plt_slot_value; 610 if (read_plt_slot_value(proc, plt_slot_addr, &plt_slot_value) < 0) 611 return PLT_FAIL; 612 613 char *name = strdup(a_name); 614 struct library_symbol *libsym = malloc(sizeof(*libsym)); 615 if (name == NULL || libsym == NULL) { 616 fprintf(stderr, "allocation for .plt slot: %s\n", 617 strerror(errno)); 618 fail: 619 free(name); 620 free(libsym); 621 return PLT_FAIL; 622 } 623 624 /* XXX The double cast should be removed when 625 * arch_addr_t becomes integral type. */ 626 if (library_symbol_init(libsym, 627 (arch_addr_t)(uintptr_t)plt_entry_addr, 628 name, 1, LS_TOPLT_EXEC) < 0) 629 goto fail; 630 libsym->arch.plt_slot_addr = plt_slot_addr; 631 632 if (plt_slot_value == plt_entry_addr || plt_slot_value == 0) { 633 libsym->arch.type = PPC_PLT_UNRESOLVED; 634 libsym->arch.resolved_value = plt_entry_addr; 635 636 } else { 637 /* Unresolve the .plt slot. If the binary was 638 * prelinked, this makes the code invalid, because in 639 * case of prelinked binary, the dynamic linker 640 * doesn't update .plt[0] and .plt[1] with addresses 641 * of the resover. But we don't care, we will never 642 * need to enter the resolver. That just means that 643 * we have to un-un-resolve this back before we 644 * detach. */ 645 646 if (unresolve_plt_slot(proc, plt_slot_addr, plt_entry_addr) < 0) { 647 library_symbol_destroy(libsym); 648 goto fail; 649 } 650 mark_as_resolved(libsym, plt_slot_value); 651 } 652 653 *ret = libsym; 654 return PLT_OK; 655} 656 657void 658arch_elf_destroy(struct ltelf *lte) 659{ 660 struct library_symbol *sym; 661 for (sym = lte->arch.stubs; sym != NULL; ) { 662 struct library_symbol *next = sym->next; 663 library_symbol_destroy(sym); 664 free(sym); 665 sym = next; 666 } 667} 668 669static void 670dl_plt_update_bp_on_hit(struct breakpoint *bp, struct process *proc) 671{ 672 debug(DEBUG_PROCESS, "pid=%d dl_plt_update_bp_on_hit %s(%p)", 673 proc->pid, breakpoint_name(bp), bp->addr); 674 struct process_stopping_handler *self = proc->arch.handler; 675 assert(self != NULL); 676 677 struct library_symbol *libsym = self->breakpoint_being_enabled->libsym; 678 GElf_Addr value; 679 if (read_plt_slot_value(proc, libsym->arch.plt_slot_addr, &value) < 0) 680 return; 681 682 /* On PPC64, we rewrite the slot value. */ 683 if (proc->e_machine == EM_PPC64) 684 unresolve_plt_slot(proc, libsym->arch.plt_slot_addr, 685 libsym->arch.resolved_value); 686 /* We mark the breakpoint as resolved on both arches. */ 687 mark_as_resolved(libsym, value); 688 689 /* cb_on_all_stopped looks if HANDLER is set to NULL as a way 690 * to check that this was run. It's an error if it 691 * wasn't. */ 692 proc->arch.handler = NULL; 693 694 breakpoint_turn_off(bp, proc); 695} 696 697static void 698cb_on_all_stopped(struct process_stopping_handler *self) 699{ 700 /* Put that in for dl_plt_update_bp_on_hit to see. */ 701 assert(self->task_enabling_breakpoint->arch.handler == NULL); 702 self->task_enabling_breakpoint->arch.handler = self; 703 704 linux_ptrace_disable_and_continue(self); 705} 706 707static enum callback_status 708cb_keep_stepping_p(struct process_stopping_handler *self) 709{ 710 struct process *proc = self->task_enabling_breakpoint; 711 struct library_symbol *libsym = self->breakpoint_being_enabled->libsym; 712 713 GElf_Addr value; 714 if (read_plt_slot_value(proc, libsym->arch.plt_slot_addr, &value) < 0) 715 return CBS_FAIL; 716 717 /* In UNRESOLVED state, the RESOLVED_VALUE in fact contains 718 * the PLT entry value. */ 719 if (value == libsym->arch.resolved_value) 720 return CBS_CONT; 721 722 debug(DEBUG_PROCESS, "pid=%d PLT got resolved to value %#"PRIx64, 723 proc->pid, value); 724 725 /* The .plt slot got resolved! We can migrate the breakpoint 726 * to RESOLVED and stop single-stepping. */ 727 if (proc->e_machine == EM_PPC64 728 && unresolve_plt_slot(proc, libsym->arch.plt_slot_addr, 729 libsym->arch.resolved_value) < 0) 730 return CBS_FAIL; 731 732 /* Resolving on PPC64 consists of overwriting a doubleword in 733 * .plt. That doubleword is than read back by a stub, and 734 * jumped on. Hopefully we can assume that double word update 735 * is done on a single place only, as it contains a final 736 * address. We still need to look around for any sync 737 * instruction, but essentially it is safe to optimize away 738 * the single stepping next time and install a post-update 739 * breakpoint. 740 * 741 * The situation on PPC32 BSS is more complicated. The 742 * dynamic linker here updates potentially several 743 * instructions (XXX currently we assume two) and the rules 744 * are more complicated. Sometimes it's enough to adjust just 745 * one of the addresses--the logic for generating optimal 746 * dispatch depends on relative addresses of the .plt entry 747 * and the jump destination. We can't assume that the some 748 * instruction block does the update every time. So on PPC32, 749 * we turn the optimization off and just step through it each 750 * time. */ 751 if (proc->e_machine == EM_PPC) 752 goto done; 753 754 /* Install breakpoint to the address where the change takes 755 * place. If we fail, then that just means that we'll have to 756 * singlestep the next time around as well. */ 757 struct process *leader = proc->leader; 758 if (leader == NULL || leader->arch.dl_plt_update_bp != NULL) 759 goto done; 760 761 /* We need to install to the next instruction. ADDR points to 762 * a store instruction, so moving the breakpoint one 763 * instruction forward is safe. */ 764 arch_addr_t addr = get_instruction_pointer(proc) + 4; 765 leader->arch.dl_plt_update_bp = insert_breakpoint(proc, addr, NULL); 766 if (leader->arch.dl_plt_update_bp == NULL) 767 goto done; 768 769 static struct bp_callbacks dl_plt_update_cbs = { 770 .on_hit = dl_plt_update_bp_on_hit, 771 }; 772 leader->arch.dl_plt_update_bp->cbs = &dl_plt_update_cbs; 773 774 /* Turn it off for now. We will turn it on again when we hit 775 * the PLT entry that needs this. */ 776 breakpoint_turn_off(leader->arch.dl_plt_update_bp, proc); 777 778done: 779 mark_as_resolved(libsym, value); 780 781 return CBS_STOP; 782} 783 784static void 785jump_to_entry_point(struct process *proc, struct breakpoint *bp) 786{ 787 /* XXX The double cast should be removed when 788 * arch_addr_t becomes integral type. */ 789 arch_addr_t rv = (arch_addr_t) 790 (uintptr_t)bp->libsym->arch.resolved_value; 791 set_instruction_pointer(proc, rv); 792} 793 794static void 795ppc_plt_bp_continue(struct breakpoint *bp, struct process *proc) 796{ 797 switch (bp->libsym->arch.type) { 798 struct process *leader; 799 void (*on_all_stopped)(struct process_stopping_handler *); 800 enum callback_status (*keep_stepping_p) 801 (struct process_stopping_handler *); 802 803 case PPC_DEFAULT: 804 assert(proc->e_machine == EM_PPC); 805 assert(bp->libsym != NULL); 806 assert(bp->libsym->lib->arch.bss_plt_prelinked == 0); 807 /* Fall through. */ 808 809 case PPC_PLT_UNRESOLVED: 810 on_all_stopped = NULL; 811 keep_stepping_p = NULL; 812 leader = proc->leader; 813 814 if (leader != NULL && leader->arch.dl_plt_update_bp != NULL 815 && breakpoint_turn_on(leader->arch.dl_plt_update_bp, 816 proc) >= 0) 817 on_all_stopped = cb_on_all_stopped; 818 else 819 keep_stepping_p = cb_keep_stepping_p; 820 821 if (process_install_stopping_handler 822 (proc, bp, on_all_stopped, keep_stepping_p, NULL) < 0) { 823 fprintf(stderr, "ppc_plt_bp_continue: " 824 "couldn't install event handler\n"); 825 continue_after_breakpoint(proc, bp); 826 } 827 return; 828 829 case PPC_PLT_RESOLVED: 830 if (proc->e_machine == EM_PPC) { 831 continue_after_breakpoint(proc, bp); 832 return; 833 } 834 835 jump_to_entry_point(proc, bp); 836 continue_process(proc->pid); 837 return; 838 839 case PPC64_PLT_STUB: 840 /* These should never hit here. */ 841 break; 842 } 843 844 assert(bp->libsym->arch.type != bp->libsym->arch.type); 845 abort(); 846} 847 848/* When a process is in a PLT stub, it may have already read the data 849 * in .plt that we changed. If we detach now, it will jump to PLT 850 * entry and continue to the dynamic linker, where it will SIGSEGV, 851 * because zeroth .plt slot is not filled in prelinked binaries, and 852 * the dynamic linker needs that data. Moreover, the process may 853 * actually have hit the breakpoint already. This functions tries to 854 * detect both cases and do any fix-ups necessary to mend this 855 * situation. */ 856static enum callback_status 857detach_task_cb(struct process *task, void *data) 858{ 859 struct breakpoint *bp = data; 860 861 if (get_instruction_pointer(task) == bp->addr) { 862 debug(DEBUG_PROCESS, "%d at %p, which is PLT slot", 863 task->pid, bp->addr); 864 jump_to_entry_point(task, bp); 865 return CBS_CONT; 866 } 867 868 /* XXX There's still a window of several instructions where we 869 * might catch the task inside a stub such that it has already 870 * read destination address from .plt, but hasn't jumped yet, 871 * thus avoiding the breakpoint. */ 872 873 return CBS_CONT; 874} 875 876static void 877ppc_plt_bp_retract(struct breakpoint *bp, struct process *proc) 878{ 879 /* On PPC64, we rewrite .plt with PLT entry addresses. This 880 * needs to be undone. Unfortunately, the program may have 881 * made decisions based on that value */ 882 if (proc->e_machine == EM_PPC64 883 && bp->libsym != NULL 884 && bp->libsym->arch.type == PPC_PLT_RESOLVED) { 885 each_task(proc->leader, NULL, detach_task_cb, bp); 886 unresolve_plt_slot(proc, bp->libsym->arch.plt_slot_addr, 887 bp->libsym->arch.resolved_value); 888 } 889} 890 891void 892arch_library_init(struct library *lib) 893{ 894} 895 896void 897arch_library_destroy(struct library *lib) 898{ 899} 900 901void 902arch_library_clone(struct library *retp, struct library *lib) 903{ 904} 905 906int 907arch_library_symbol_init(struct library_symbol *libsym) 908{ 909 /* We set type explicitly in the code above, where we have the 910 * necessary context. This is for calls from ltrace-elf.c and 911 * such. */ 912 libsym->arch.type = PPC_DEFAULT; 913 return 0; 914} 915 916void 917arch_library_symbol_destroy(struct library_symbol *libsym) 918{ 919} 920 921int 922arch_library_symbol_clone(struct library_symbol *retp, 923 struct library_symbol *libsym) 924{ 925 retp->arch = libsym->arch; 926 return 0; 927} 928 929/* For some symbol types, we need to set up custom callbacks. XXX we 930 * don't need PROC here, we can store the data in BP if it is of 931 * interest to us. */ 932int 933arch_breakpoint_init(struct process *proc, struct breakpoint *bp) 934{ 935 /* Artificial and entry-point breakpoints are plain. */ 936 if (bp->libsym == NULL || bp->libsym->plt_type != LS_TOPLT_EXEC) 937 return 0; 938 939 /* On PPC, secure PLT and prelinked BSS PLT are plain. */ 940 if (proc->e_machine == EM_PPC 941 && bp->libsym->lib->arch.bss_plt_prelinked != 0) 942 return 0; 943 944 /* On PPC64, stub PLT breakpoints are plain. */ 945 if (proc->e_machine == EM_PPC64 946 && bp->libsym->arch.type == PPC64_PLT_STUB) 947 return 0; 948 949 static struct bp_callbacks cbs = { 950 .on_continue = ppc_plt_bp_continue, 951 .on_retract = ppc_plt_bp_retract, 952 }; 953 breakpoint_set_callbacks(bp, &cbs); 954 return 0; 955} 956 957void 958arch_breakpoint_destroy(struct breakpoint *bp) 959{ 960} 961 962int 963arch_breakpoint_clone(struct breakpoint *retp, struct breakpoint *sbp) 964{ 965 retp->arch = sbp->arch; 966 return 0; 967} 968 969int 970arch_process_init(struct process *proc) 971{ 972 proc->arch.dl_plt_update_bp = NULL; 973 proc->arch.handler = NULL; 974 return 0; 975} 976 977void 978arch_process_destroy(struct process *proc) 979{ 980} 981 982int 983arch_process_clone(struct process *retp, struct process *proc) 984{ 985 retp->arch = proc->arch; 986 return 0; 987} 988 989int 990arch_process_exec(struct process *proc) 991{ 992 return arch_process_init(proc); 993} 994