plt.c revision 8bfb5734dfc5a82addc9db9d4c7642173bb4206b
1#include <gelf.h> 2#include <sys/ptrace.h> 3#include <errno.h> 4#include <error.h> 5#include <inttypes.h> 6#include <assert.h> 7#include <string.h> 8 9#include "proc.h" 10#include "common.h" 11#include "library.h" 12#include "breakpoint.h" 13#include "linux-gnu/trace.h" 14 15/* There are two PLT types on 32-bit PPC: old-style, BSS PLT, and 16 * new-style "secure" PLT. We can tell one from the other by the 17 * flags on the .plt section. If it's +X (executable), it's BSS PLT, 18 * otherwise it's secure. 19 * 20 * BSS PLT works the same way as most architectures: the .plt section 21 * contains trampolines and we put breakpoints to those. If not 22 * prelinked, .plt contains zeroes, and dynamic linker fills in the 23 * initial set of trampolines, which means that we need to delay 24 * enabling breakpoints until after binary entry point is hit. 25 * Additionally, after first call, dynamic linker updates .plt with 26 * branch to resolved address. That means that on first hit, we must 27 * do something similar to the PPC64 gambit described below. 28 * 29 * With secure PLT, the .plt section doesn't contain instructions but 30 * addresses. The real PLT table is stored in .text. Addresses of 31 * those PLT entries can be computed, and apart from the fact that 32 * they are in .text, they are ordinary PLT entries. 33 * 34 * 64-bit PPC is more involved. Program linker creates for each 35 * library call a _stub_ symbol named xxxxxxxx.plt_call.<callee> 36 * (where xxxxxxxx is a hexadecimal number). That stub does the call 37 * dispatch: it loads an address of a function to call from the 38 * section .plt, and branches. PLT entries themselves are essentially 39 * a curried call to the resolver. When the symbol is resolved, the 40 * resolver updates the value stored in .plt, and the next time 41 * around, the stub calls the library function directly. So we make 42 * at most one trip (none if the binary is prelinked) through each PLT 43 * entry, and correspondingly that is useless as a breakpoint site. 44 * 45 * Note the three confusing terms: stubs (that play the role of PLT 46 * entries), PLT entries, .plt section. 47 * 48 * We first check symbol tables and see if we happen to have stub 49 * symbols available. If yes we just put breakpoints to those, and 50 * treat them as usual breakpoints. The only tricky part is realizing 51 * that there can be more than one breakpoint per symbol. 52 * 53 * The case that we don't have the stub symbols available is harder. 54 * The following scheme uses two kinds of PLT breakpoints: unresolved 55 * and resolved (to some address). When the process starts (or when 56 * we attach), we distribute unresolved PLT breakpoints to the PLT 57 * entries (not stubs). Then we look in .plt, and for each entry 58 * whose value is different than the corresponding PLT entry address, 59 * we assume it was already resolved, and convert the breakpoint to 60 * resolved. We also rewrite the resolved value in .plt back to the 61 * PLT address. 62 * 63 * When a PLT entry hits a resolved breakpoint (which happens because 64 * we rewrite .plt with the original unresolved addresses), we move 65 * the instruction pointer to the corresponding address and continue 66 * the process as if nothing happened. 67 * 68 * When unresolved PLT entry is called for the first time, we need to 69 * catch the new value that the resolver will write to a .plt slot. 70 * We also need to prevent another thread from racing through and 71 * taking the branch without ltrace noticing. So when unresolved PLT 72 * entry hits, we have to stop all threads. We then single-step 73 * through the resolver, until the .plt slot changes. When it does, 74 * we treat it the same way as above: convert the PLT breakpoint to 75 * resolved, and rewrite the .plt value back to PLT address. We then 76 * start all threads again. 77 * 78 * As an optimization, we remember the address where the address was 79 * resolved, and put a breakpoint there. The next time around (when 80 * the next PLT entry is to be resolved), instead of single-stepping 81 * through half the dynamic linker, we just let the thread run and hit 82 * this breakpoint. When it hits, we know the PLT entry was resolved. 83 * 84 * XXX TODO If we have hardware watch point, we might put a read watch 85 * on .plt slot, and discover the offenders this way. I don't know 86 * the details, but I assume at most a handful (like, one or two, if 87 * available at all) addresses may be watched at a time, and thus this 88 * would be used as an amendment of the above rather than full-on 89 * solution to PLT tracing on PPC. 90 */ 91 92#define PPC_PLT_STUB_SIZE 16 93#define PPC64_PLT_STUB_SIZE 8 //xxx 94 95static inline int 96host_powerpc64() 97{ 98#ifdef __powerpc64__ 99 return 1; 100#else 101 return 0; 102#endif 103} 104 105int 106read_target_4(struct Process *proc, target_address_t addr, uint32_t *lp) 107{ 108 unsigned long l = ptrace(PTRACE_PEEKTEXT, proc->pid, addr, 0); 109 if (l == -1UL && errno) 110 return -1; 111#ifdef __powerpc64__ 112 l >>= 32; 113#endif 114 *lp = l; 115 return 0; 116} 117 118static int 119read_target_8(struct Process *proc, target_address_t addr, uint64_t *lp) 120{ 121 unsigned long l = ptrace(PTRACE_PEEKTEXT, proc->pid, addr, 0); 122 if (l == -1UL && errno) 123 return -1; 124 if (host_powerpc64()) { 125 *lp = l; 126 } else { 127 unsigned long l2 = ptrace(PTRACE_PEEKTEXT, proc->pid, 128 addr + 4, 0); 129 if (l2 == -1UL && errno) 130 return -1; 131 *lp = ((uint64_t)l << 32) | l2; 132 } 133 return 0; 134} 135 136int 137read_target_long(struct Process *proc, target_address_t addr, uint64_t *lp) 138{ 139 if (proc->e_machine == EM_PPC) { 140 uint32_t w; 141 int ret = read_target_4(proc, addr, &w); 142 if (ret >= 0) 143 *lp = (uint64_t)w; 144 return ret; 145 } else { 146 return read_target_8(proc, addr, lp); 147 } 148} 149 150static enum callback_status 151reenable_breakpoint(struct Process *proc, struct breakpoint *bp, void *data) 152{ 153 /* We don't need to re-enable non-PLT breakpoints and 154 * breakpoints that are not PPC32 BSS unprelinked. */ 155 if (bp->libsym == NULL 156 || bp->libsym->plt_type == LS_TOPLT_NONE 157 || bp->libsym->lib->arch.bss_plt_prelinked != 0) 158 return CBS_CONT; 159 160 debug(DEBUG_PROCESS, "pid=%d reenable_breakpoint %s", 161 proc->pid, breakpoint_name(bp)); 162 163 assert(proc->e_machine == EM_PPC); 164 uint64_t l; 165 if (read_target_8(proc, bp->addr, &l) < 0) { 166 error(0, errno, "couldn't read PLT value for %s(%p)", 167 breakpoint_name(bp), bp->addr); 168 return CBS_CONT; 169 } 170 171 /* XXX double cast */ 172 bp->libsym->arch.plt_slot_addr = (GElf_Addr)(uintptr_t)bp->addr; 173 174 /* If necessary, re-enable the breakpoint if it was 175 * overwritten by the dynamic linker. */ 176 union { 177 uint32_t insn; 178 char buf[4]; 179 } u = { .buf = BREAKPOINT_VALUE }; 180 if (l >> 32 == u.insn) 181 debug(DEBUG_PROCESS, "pid=%d, breakpoint still present" 182 " at %p, avoiding reenable", proc->pid, bp->addr); 183 else 184 enable_breakpoint(proc, bp); 185 186 bp->libsym->arch.resolved_value = l; 187 188 return CBS_CONT; 189} 190 191void 192arch_dynlink_done(struct Process *proc) 193{ 194 /* On PPC32, .plt of objects that use BSS PLT are overwritten 195 * by the dynamic linker (unless that object was prelinked). 196 * We need to re-enable breakpoints in those objects. */ 197 proc_each_breakpoint(proc, NULL, reenable_breakpoint, NULL); 198} 199 200GElf_Addr 201arch_plt_sym_val(struct ltelf *lte, size_t ndx, GElf_Rela *rela) 202{ 203 if (lte->ehdr.e_machine == EM_PPC && lte->arch.secure_plt) { 204 assert(lte->arch.plt_stub_vma != 0); 205 return lte->arch.plt_stub_vma + PPC_PLT_STUB_SIZE * ndx; 206 207 } else if (lte->ehdr.e_machine == EM_PPC) { 208 return rela->r_offset; 209 210 } else { 211 /* If we get here, we don't have stub symbols. In 212 * that case we put brakpoints to PLT entries the same 213 * as the PPC32 secure PLT case does. */ 214 assert(lte->arch.plt_stub_vma != 0); 215 return lte->arch.plt_stub_vma + PPC64_PLT_STUB_SIZE * ndx; 216 } 217} 218 219/* This entry point is called when ltelf is not available 220 * anymore--during runtime. At that point we don't have to concern 221 * ourselves with bias, as the values in OPD have been resolved 222 * already. */ 223int 224arch_translate_address_dyn(struct Process *proc, 225 target_address_t addr, target_address_t *ret) 226{ 227 if (proc->e_machine == EM_PPC64) { 228 assert(host_powerpc64()); 229 long l = ptrace(PTRACE_PEEKTEXT, proc->pid, addr, 0); 230 if (l == -1 && errno) { 231 error(0, errno, ".opd translation of %p", addr); 232 return -1; 233 } 234 *ret = (target_address_t)l; 235 fprintf(stderr, "arch_translate_address_dyn: %p->%p\n", 236 addr, *ret); 237 return 0; 238 } 239 240 *ret = addr; 241 return 0; 242} 243 244int 245arch_translate_address(struct ltelf *lte, 246 target_address_t addr, target_address_t *ret) 247{ 248 if (lte->ehdr.e_machine == EM_PPC64) { 249 GElf_Xword offset = (GElf_Addr)addr - lte->arch.opd_base; 250 uint64_t value; 251 if (elf_read_u64(lte->arch.opd_data, offset, &value) < 0) { 252 error(0, 0, "static .opd translation of %p: %s", addr, 253 elf_errmsg(-1)); 254 return -1; 255 } 256 *ret = (target_address_t)(value + lte->bias); 257 return 0; 258 } 259 260 *ret = addr; 261 return 0; 262} 263 264static int 265load_opd_data(struct ltelf *lte, struct library *lib) 266{ 267 Elf_Scn *sec; 268 GElf_Shdr shdr; 269 if (elf_get_section_named(lte, ".opd", &sec, &shdr) < 0) { 270 fail: 271 fprintf(stderr, "couldn't find .opd data\n"); 272 return -1; 273 } 274 275 lte->arch.opd_data = elf_rawdata(sec, NULL); 276 if (lte->arch.opd_data == NULL) 277 goto fail; 278 279 lte->arch.opd_base = shdr.sh_addr + lte->bias; 280 lte->arch.opd_size = shdr.sh_size; 281 282 return 0; 283} 284 285void * 286sym2addr(struct Process *proc, struct library_symbol *sym) 287{ 288 return sym->enter_addr; 289} 290 291static GElf_Addr 292get_glink_vma(struct ltelf *lte, GElf_Addr ppcgot, Elf_Data *plt_data) 293{ 294 Elf_Scn *ppcgot_sec = NULL; 295 GElf_Shdr ppcgot_shdr; 296 if (ppcgot != 0 297 && elf_get_section_covering(lte, ppcgot, 298 &ppcgot_sec, &ppcgot_shdr) < 0) 299 error(0, 0, "DT_PPC_GOT=%#"PRIx64", but no such section found", 300 ppcgot); 301 302 if (ppcgot_sec != NULL) { 303 Elf_Data *data = elf_loaddata(ppcgot_sec, &ppcgot_shdr); 304 if (data == NULL || data->d_size < 8 ) { 305 error(0, 0, "couldn't read GOT data"); 306 } else { 307 // where PPCGOT begins in .got 308 size_t offset = ppcgot - ppcgot_shdr.sh_addr; 309 assert(offset % 4 == 0); 310 uint32_t glink_vma; 311 if (elf_read_u32(data, offset + 4, &glink_vma) < 0) { 312 error(0, 0, "couldn't read glink VMA address" 313 " at %zd@GOT", offset); 314 return 0; 315 } 316 if (glink_vma != 0) { 317 debug(1, "PPC GOT glink_vma address: %#" PRIx32, 318 glink_vma); 319 return (GElf_Addr)glink_vma; 320 } 321 } 322 } 323 324 if (plt_data != NULL) { 325 uint32_t glink_vma; 326 if (elf_read_u32(plt_data, 0, &glink_vma) < 0) { 327 error(0, 0, "couldn't read glink VMA address"); 328 return 0; 329 } 330 debug(1, ".plt glink_vma address: %#" PRIx32, glink_vma); 331 return (GElf_Addr)glink_vma; 332 } 333 334 return 0; 335} 336 337static int 338load_dynamic_entry(struct ltelf *lte, int tag, GElf_Addr *valuep) 339{ 340 Elf_Scn *scn; 341 GElf_Shdr shdr; 342 if (elf_get_section_type(lte, SHT_DYNAMIC, &scn, &shdr) < 0 343 || scn == NULL) { 344 fail: 345 error(0, 0, "Couldn't get SHT_DYNAMIC: %s", 346 elf_errmsg(-1)); 347 return -1; 348 } 349 350 Elf_Data *data = elf_loaddata(scn, &shdr); 351 if (data == NULL) 352 goto fail; 353 354 size_t j; 355 for (j = 0; j < shdr.sh_size / shdr.sh_entsize; ++j) { 356 GElf_Dyn dyn; 357 if (gelf_getdyn(data, j, &dyn) == NULL) 358 goto fail; 359 360 if(dyn.d_tag == tag) { 361 *valuep = dyn.d_un.d_ptr; 362 return 0; 363 } 364 } 365 366 return -1; 367} 368 369static int 370load_ppcgot(struct ltelf *lte, GElf_Addr *ppcgotp) 371{ 372 return load_dynamic_entry(lte, DT_PPC_GOT, ppcgotp); 373} 374 375static int 376load_ppc64_glink(struct ltelf *lte, GElf_Addr *glinkp) 377{ 378 return load_dynamic_entry(lte, DT_PPC64_GLINK, glinkp); 379} 380 381static int 382nonzero_data(Elf_Data *data) 383{ 384 /* We are not supposed to get here if there's no PLT. */ 385 assert(data != NULL); 386 387 unsigned char *buf = data->d_buf; 388 if (buf == NULL) 389 return 0; 390 391 size_t i; 392 for (i = 0; i < data->d_size; ++i) 393 if (buf[i] != 0) 394 return 1; 395 return 0; 396} 397 398int 399arch_elf_init(struct ltelf *lte, struct library *lib) 400{ 401 if (lte->ehdr.e_machine == EM_PPC64 402 && load_opd_data(lte, lib) < 0) 403 return -1; 404 405 lte->arch.secure_plt = !(lte->plt_flags & SHF_EXECINSTR); 406 407 /* For PPC32 BSS, it is important whether the binary was 408 * prelinked. If .plt section is NODATA, or if it contains 409 * zeroes, then this library is not prelinked, and we need to 410 * delay breakpoints. */ 411 if (lte->ehdr.e_machine == EM_PPC && !lte->arch.secure_plt) 412 lib->arch.bss_plt_prelinked = nonzero_data(lte->plt_data); 413 else 414 /* For cases where it's irrelevant, initialize the 415 * value to something conspicuous. */ 416 lib->arch.bss_plt_prelinked = -1; 417 418 if (lte->ehdr.e_machine == EM_PPC && lte->arch.secure_plt) { 419 GElf_Addr ppcgot; 420 if (load_ppcgot(lte, &ppcgot) < 0) { 421 error(0, 0, "couldn't find DT_PPC_GOT"); 422 return -1; 423 } 424 GElf_Addr glink_vma = get_glink_vma(lte, ppcgot, lte->plt_data); 425 426 assert (lte->relplt_size % 12 == 0); 427 size_t count = lte->relplt_size / 12; // size of RELA entry 428 lte->arch.plt_stub_vma = glink_vma 429 - (GElf_Addr)count * PPC_PLT_STUB_SIZE; 430 debug(1, "stub_vma is %#" PRIx64, lte->arch.plt_stub_vma); 431 432 } else if (lte->ehdr.e_machine == EM_PPC64) { 433 GElf_Addr glink_vma; 434 if (load_ppc64_glink(lte, &glink_vma) < 0) { 435 error(0, 0, "couldn't find DT_PPC64_GLINK"); 436 return -1; 437 } 438 439 /* The first glink stub starts at offset 32. */ 440 lte->arch.plt_stub_vma = glink_vma + 32; 441 } 442 443 /* On PPC64, look for stub symbols in symbol table. These are 444 * called: xxxxxxxx.plt_call.callee_name@version+addend. */ 445 if (lte->ehdr.e_machine == EM_PPC64 446 && lte->symtab != NULL && lte->strtab != NULL) { 447 448 /* N.B. We can't simply skip the symbols that we fail 449 * to read or malloc. There may be more than one stub 450 * per symbol name, and if we failed in one but 451 * succeeded in another, the PLT enabling code would 452 * have no way to tell that something is missing. We 453 * could work around that, of course, but it doesn't 454 * seem worth the trouble. So if anything fails, we 455 * just pretend that we don't have stub symbols at 456 * all, as if the binary is stripped. */ 457 458 size_t i; 459 for (i = 0; i < lte->symtab_count; ++i) { 460 GElf_Sym sym; 461 if (gelf_getsym(lte->symtab, i, &sym) == NULL) { 462 struct library_symbol *sym, *next; 463 fail: 464 for (sym = lte->arch.stubs; sym != NULL; ) { 465 next = sym->next; 466 library_symbol_destroy(sym); 467 free(sym); 468 sym = next; 469 } 470 lte->arch.stubs = NULL; 471 break; 472 } 473 474 const char *name = lte->strtab + sym.st_name; 475 476#define STUBN ".plt_call." 477 if ((name = strstr(name, STUBN)) == NULL) 478 continue; 479 name += sizeof(STUBN) - 1; 480#undef STUBN 481 482 size_t len; 483 const char *ver = strchr(name, '@'); 484 if (ver != NULL) { 485 len = ver - name; 486 487 } else { 488 /* If there is "+" at all, check that 489 * the symbol name ends in "+0". */ 490 const char *add = strrchr(name, '+'); 491 if (add != NULL) { 492 assert(strcmp(add, "+0") == 0); 493 len = add - name; 494 } else { 495 len = strlen(name); 496 } 497 } 498 499 char *sym_name = strndup(name, len); 500 struct library_symbol *libsym = malloc(sizeof(*libsym)); 501 if (sym_name == NULL || libsym == NULL) { 502 fail2: 503 free(sym_name); 504 free(libsym); 505 goto fail; 506 } 507 508 /* XXX The double cast should be removed when 509 * target_address_t becomes integral type. */ 510 target_address_t addr = (target_address_t) 511 (uintptr_t)sym.st_value + lte->bias; 512 if (library_symbol_init(libsym, addr, sym_name, 1, 513 LS_TOPLT_EXEC) < 0) 514 goto fail2; 515 libsym->arch.type = PPC64_PLT_STUB; 516 libsym->next = lte->arch.stubs; 517 lte->arch.stubs = libsym; 518 } 519 } 520 521 return 0; 522} 523 524static int 525read_plt_slot_value(struct Process *proc, GElf_Addr addr, GElf_Addr *valp) 526{ 527 /* On PPC64, we read from .plt, which contains 8 byte 528 * addresses. On PPC32 we read from .plt, which contains 4 529 * byte instructions, but the PLT is two instructions, and 530 * either can change. */ 531 uint64_t l; 532 /* XXX double cast. */ 533 if (read_target_8(proc, (target_address_t)(uintptr_t)addr, &l) < 0) { 534 error(0, errno, "ptrace .plt slot value @%#" PRIx64, addr); 535 return -1; 536 } 537 538 *valp = (GElf_Addr)l; 539 return 0; 540} 541 542static int 543unresolve_plt_slot(struct Process *proc, GElf_Addr addr, GElf_Addr value) 544{ 545 /* We only modify plt_entry[0], which holds the resolved 546 * address of the routine. We keep the TOC and environment 547 * pointers intact. Hence the only adjustment that we need to 548 * do is to IP. */ 549 if (ptrace(PTRACE_POKETEXT, proc->pid, addr, value) < 0) { 550 error(0, errno, "unresolve .plt slot"); 551 return -1; 552 } 553 return 0; 554} 555 556static void 557mark_as_resolved(struct library_symbol *libsym, GElf_Addr value) 558{ 559 libsym->arch.type = PPC_PLT_RESOLVED; 560 libsym->arch.resolved_value = value; 561} 562 563enum plt_status 564arch_elf_add_plt_entry(struct Process *proc, struct ltelf *lte, 565 const char *a_name, GElf_Rela *rela, size_t ndx, 566 struct library_symbol **ret) 567{ 568 if (lte->ehdr.e_machine == EM_PPC) 569 return plt_default; 570 571 /* PPC64. If we have stubs, we return a chain of breakpoint 572 * sites, one for each stub that corresponds to this PLT 573 * entry. */ 574 struct library_symbol *chain = NULL; 575 struct library_symbol **symp; 576 for (symp = <e->arch.stubs; *symp != NULL; ) { 577 struct library_symbol *sym = *symp; 578 if (strcmp(sym->name, a_name) != 0) { 579 symp = &(*symp)->next; 580 continue; 581 } 582 583 /* Re-chain the symbol from stubs to CHAIN. */ 584 *symp = sym->next; 585 sym->next = chain; 586 chain = sym; 587 } 588 589 if (chain != NULL) { 590 *ret = chain; 591 return plt_ok; 592 } 593 594 /* We don't have stub symbols. Find corresponding .plt slot, 595 * and check whether it contains the corresponding PLT address 596 * (or 0 if the dynamic linker hasn't run yet). N.B. we don't 597 * want read this from ELF file, but from process image. That 598 * makes a difference if we are attaching to a running 599 * process. */ 600 601 GElf_Addr plt_entry_addr = arch_plt_sym_val(lte, ndx, rela); 602 GElf_Addr plt_slot_addr = rela->r_offset; 603 assert(plt_slot_addr >= lte->plt_addr 604 || plt_slot_addr < lte->plt_addr + lte->plt_size); 605 606 GElf_Addr plt_slot_value; 607 if (read_plt_slot_value(proc, plt_slot_addr, &plt_slot_value) < 0) 608 return plt_fail; 609 610 char *name = strdup(a_name); 611 struct library_symbol *libsym = malloc(sizeof(*libsym)); 612 if (name == NULL || libsym == NULL) { 613 error(0, errno, "allocation for .plt slot"); 614 fail: 615 free(name); 616 free(libsym); 617 return plt_fail; 618 } 619 620 /* XXX The double cast should be removed when 621 * target_address_t becomes integral type. */ 622 if (library_symbol_init(libsym, 623 (target_address_t)(uintptr_t)plt_entry_addr, 624 name, 1, LS_TOPLT_EXEC) < 0) 625 goto fail; 626 libsym->arch.plt_slot_addr = plt_slot_addr; 627 628 if (plt_slot_value == plt_entry_addr || plt_slot_value == 0) { 629 libsym->arch.type = PPC_PLT_UNRESOLVED; 630 libsym->arch.resolved_value = plt_entry_addr; 631 632 } else { 633 /* Unresolve the .plt slot. If the binary was 634 * prelinked, this makes the code invalid, because in 635 * case of prelinked binary, the dynamic linker 636 * doesn't update .plt[0] and .plt[1] with addresses 637 * of the resover. But we don't care, we will never 638 * need to enter the resolver. That just means that 639 * we have to un-un-resolve this back before we 640 * detach. */ 641 642 if (unresolve_plt_slot(proc, plt_slot_addr, plt_entry_addr) < 0) { 643 library_symbol_destroy(libsym); 644 goto fail; 645 } 646 mark_as_resolved(libsym, plt_slot_value); 647 } 648 649 *ret = libsym; 650 return plt_ok; 651} 652 653void 654arch_elf_destroy(struct ltelf *lte) 655{ 656 struct library_symbol *sym; 657 for (sym = lte->arch.stubs; sym != NULL; ) { 658 struct library_symbol *next = sym->next; 659 library_symbol_destroy(sym); 660 free(sym); 661 sym = next; 662 } 663} 664 665static void 666dl_plt_update_bp_on_hit(struct breakpoint *bp, struct Process *proc) 667{ 668 debug(DEBUG_PROCESS, "pid=%d dl_plt_update_bp_on_hit %s(%p)", 669 proc->pid, breakpoint_name(bp), bp->addr); 670 struct process_stopping_handler *self = proc->arch.handler; 671 assert(self != NULL); 672 673 struct library_symbol *libsym = self->breakpoint_being_enabled->libsym; 674 GElf_Addr value; 675 if (read_plt_slot_value(proc, libsym->arch.plt_slot_addr, &value) < 0) 676 return; 677 678 /* On PPC64, we rewrite the slot value. */ 679 if (proc->e_machine == EM_PPC64) 680 unresolve_plt_slot(proc, libsym->arch.plt_slot_addr, 681 libsym->arch.resolved_value); 682 /* We mark the breakpoint as resolved on both arches. */ 683 mark_as_resolved(libsym, value); 684 685 /* cb_on_all_stopped looks if HANDLER is set to NULL as a way 686 * to check that this was run. It's an error if it 687 * wasn't. */ 688 proc->arch.handler = NULL; 689 690 breakpoint_turn_off(bp, proc); 691} 692 693static void 694cb_on_all_stopped(struct process_stopping_handler *self) 695{ 696 /* Put that in for dl_plt_update_bp_on_hit to see. */ 697 assert(self->task_enabling_breakpoint->arch.handler == NULL); 698 self->task_enabling_breakpoint->arch.handler = self; 699 700 linux_ptrace_disable_and_continue(self); 701} 702 703static enum callback_status 704cb_keep_stepping_p(struct process_stopping_handler *self) 705{ 706 struct Process *proc = self->task_enabling_breakpoint; 707 struct library_symbol *libsym = self->breakpoint_being_enabled->libsym; 708 709 GElf_Addr value; 710 if (read_plt_slot_value(proc, libsym->arch.plt_slot_addr, &value) < 0) 711 return CBS_FAIL; 712 713 /* In UNRESOLVED state, the RESOLVED_VALUE in fact contains 714 * the PLT entry value. */ 715 if (value == libsym->arch.resolved_value) 716 return CBS_CONT; 717 718 debug(DEBUG_PROCESS, "pid=%d PLT got resolved to value %#"PRIx64, 719 proc->pid, value); 720 721 /* The .plt slot got resolved! We can migrate the breakpoint 722 * to RESOLVED and stop single-stepping. */ 723 if (proc->e_machine == EM_PPC64 724 && unresolve_plt_slot(proc, libsym->arch.plt_slot_addr, 725 libsym->arch.resolved_value) < 0) 726 return CBS_FAIL; 727 728 /* Resolving on PPC64 consists of overwriting a doubleword in 729 * .plt. That doubleword is than read back by a stub, and 730 * jumped on. Hopefully we can assume that double word update 731 * is done on a single place only, as it contains a final 732 * address. We still need to look around for any sync 733 * instruction, but essentially it is safe to optimize away 734 * the single stepping next time and install a post-update 735 * breakpoint. 736 * 737 * The situation on PPC32 BSS is more complicated. The 738 * dynamic linker here updates potentially several 739 * instructions (XXX currently we assume two) and the rules 740 * are more complicated. Sometimes it's enough to adjust just 741 * one of the addresses--the logic for generating optimal 742 * dispatch depends on relative addresses of the .plt entry 743 * and the jump destination. We can't assume that the some 744 * instruction block does the update every time. So on PPC32, 745 * we turn the optimization off and just step through it each 746 * time. */ 747 if (proc->e_machine == EM_PPC) 748 goto done; 749 750 /* Install breakpoint to the address where the change takes 751 * place. If we fail, then that just means that we'll have to 752 * singlestep the next time around as well. */ 753 struct Process *leader = proc->leader; 754 if (leader == NULL || leader->arch.dl_plt_update_bp != NULL) 755 goto done; 756 757 /* We need to install to the next instruction. ADDR points to 758 * a store instruction, so moving the breakpoint one 759 * instruction forward is safe. */ 760 target_address_t addr = get_instruction_pointer(proc) + 4; 761 leader->arch.dl_plt_update_bp = insert_breakpoint(proc, addr, NULL); 762 if (leader->arch.dl_plt_update_bp == NULL) 763 goto done; 764 765 static struct bp_callbacks dl_plt_update_cbs = { 766 .on_hit = dl_plt_update_bp_on_hit, 767 }; 768 leader->arch.dl_plt_update_bp->cbs = &dl_plt_update_cbs; 769 770 /* Turn it off for now. We will turn it on again when we hit 771 * the PLT entry that needs this. */ 772 breakpoint_turn_off(leader->arch.dl_plt_update_bp, proc); 773 774done: 775 mark_as_resolved(libsym, value); 776 777 return CBS_STOP; 778} 779 780static void 781jump_to_entry_point(struct Process *proc, struct breakpoint *bp) 782{ 783 /* XXX The double cast should be removed when 784 * target_address_t becomes integral type. */ 785 target_address_t rv = (target_address_t) 786 (uintptr_t)bp->libsym->arch.resolved_value; 787 set_instruction_pointer(proc, rv); 788} 789 790static void 791ppc_plt_bp_continue(struct breakpoint *bp, struct Process *proc) 792{ 793 switch (bp->libsym->arch.type) { 794 struct Process *leader; 795 void (*on_all_stopped)(struct process_stopping_handler *); 796 enum callback_status (*keep_stepping_p) 797 (struct process_stopping_handler *); 798 799 case PPC_DEFAULT: 800 assert(proc->e_machine == EM_PPC); 801 assert(bp->libsym != NULL); 802 assert(bp->libsym->lib->arch.bss_plt_prelinked == 0); 803 /* fall-through */ 804 805 case PPC_PLT_UNRESOLVED: 806 on_all_stopped = NULL; 807 keep_stepping_p = NULL; 808 leader = proc->leader; 809 810 if (leader != NULL && leader->arch.dl_plt_update_bp != NULL 811 && breakpoint_turn_on(leader->arch.dl_plt_update_bp, 812 proc) >= 0) 813 on_all_stopped = cb_on_all_stopped; 814 else 815 keep_stepping_p = cb_keep_stepping_p; 816 817 if (process_install_stopping_handler 818 (proc, bp, on_all_stopped, keep_stepping_p, NULL) < 0) { 819 error(0, 0, "ppc_plt_bp_continue: couldn't install" 820 " event handler"); 821 continue_after_breakpoint(proc, bp); 822 } 823 return; 824 825 case PPC_PLT_RESOLVED: 826 if (proc->e_machine == EM_PPC) { 827 continue_after_breakpoint(proc, bp); 828 return; 829 } 830 831 jump_to_entry_point(proc, bp); 832 continue_process(proc->pid); 833 return; 834 835 case PPC64_PLT_STUB: 836 /* These should never hit here. */ 837 break; 838 } 839 840 assert(bp->libsym->arch.type != bp->libsym->arch.type); 841 abort(); 842} 843 844/* When a process is in a PLT stub, it may have already read the data 845 * in .plt that we changed. If we detach now, it will jump to PLT 846 * entry and continue to the dynamic linker, where it will SIGSEGV, 847 * because zeroth .plt slot is not filled in prelinked binaries, and 848 * the dynamic linker needs that data. Moreover, the process may 849 * actually have hit the breakpoint already. This functions tries to 850 * detect both cases and do any fix-ups necessary to mend this 851 * situation. */ 852static enum callback_status 853detach_task_cb(struct Process *task, void *data) 854{ 855 struct breakpoint *bp = data; 856 857 if (get_instruction_pointer(task) == bp->addr) { 858 debug(DEBUG_PROCESS, "%d at %p, which is PLT slot", 859 task->pid, bp->addr); 860 jump_to_entry_point(task, bp); 861 return CBS_CONT; 862 } 863 864 /* XXX There's still a window of several instructions where we 865 * might catch the task inside a stub such that it has already 866 * read destination address from .plt, but hasn't jumped yet, 867 * thus avoiding the breakpoint. */ 868 869 return CBS_CONT; 870} 871 872static void 873ppc_plt_bp_retract(struct breakpoint *bp, struct Process *proc) 874{ 875 /* On PPC64, we rewrite .plt with PLT entry addresses. This 876 * needs to be undone. Unfortunately, the program may have 877 * made decisions based on that value */ 878 if (proc->e_machine == EM_PPC64 879 && bp->libsym != NULL 880 && bp->libsym->arch.type == PPC_PLT_RESOLVED) { 881 each_task(proc->leader, NULL, detach_task_cb, bp); 882 unresolve_plt_slot(proc, bp->libsym->arch.plt_slot_addr, 883 bp->libsym->arch.resolved_value); 884 } 885} 886 887void 888arch_library_init(struct library *lib) 889{ 890} 891 892void 893arch_library_destroy(struct library *lib) 894{ 895} 896 897void 898arch_library_clone(struct library *retp, struct library *lib) 899{ 900} 901 902int 903arch_library_symbol_init(struct library_symbol *libsym) 904{ 905 /* We set type explicitly in the code above, where we have the 906 * necessary context. This is for calls from ltrace-elf.c and 907 * such. */ 908 libsym->arch.type = PPC_DEFAULT; 909 return 0; 910} 911 912void 913arch_library_symbol_destroy(struct library_symbol *libsym) 914{ 915} 916 917int 918arch_library_symbol_clone(struct library_symbol *retp, 919 struct library_symbol *libsym) 920{ 921 retp->arch = libsym->arch; 922 return 0; 923} 924 925/* For some symbol types, we need to set up custom callbacks. XXX we 926 * don't need PROC here, we can store the data in BP if it is of 927 * interest to us. */ 928int 929arch_breakpoint_init(struct Process *proc, struct breakpoint *bp) 930{ 931 /* Artificial and entry-point breakpoints are plain. */ 932 if (bp->libsym == NULL || bp->libsym->plt_type != LS_TOPLT_EXEC) 933 return 0; 934 935 /* On PPC, secure PLT and prelinked BSS PLT are plain. */ 936 if (proc->e_machine == EM_PPC 937 && bp->libsym->lib->arch.bss_plt_prelinked != 0) 938 return 0; 939 940 /* On PPC64, stub PLT breakpoints are plain. */ 941 if (proc->e_machine == EM_PPC64 942 && bp->libsym->arch.type == PPC64_PLT_STUB) 943 return 0; 944 945 static struct bp_callbacks cbs = { 946 .on_continue = ppc_plt_bp_continue, 947 .on_retract = ppc_plt_bp_retract, 948 }; 949 breakpoint_set_callbacks(bp, &cbs); 950 return 0; 951} 952 953void 954arch_breakpoint_destroy(struct breakpoint *bp) 955{ 956} 957 958int 959arch_breakpoint_clone(struct breakpoint *retp, struct breakpoint *sbp) 960{ 961 retp->arch = sbp->arch; 962 return 0; 963} 964 965int 966arch_process_init(struct Process *proc) 967{ 968 proc->arch.dl_plt_update_bp = NULL; 969 proc->arch.handler = NULL; 970 return 0; 971} 972 973void 974arch_process_destroy(struct Process *proc) 975{ 976} 977 978int 979arch_process_clone(struct Process *retp, struct Process *proc) 980{ 981 retp->arch = proc->arch; 982 return 0; 983} 984 985int 986arch_process_exec(struct Process *proc) 987{ 988 return arch_process_init(proc); 989} 990