2 * This file is part of ltrace.
3 * Copyright (C) 2012 Petr Machata, Red Hat Inc.
4 * Copyright (C) 2004,2008,2009 Juan Cespedes
5 * Copyright (C) 2006 Paul Gilliam
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 of the
10 * License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
24 #include <sys/ptrace.h>
34 #include "breakpoint.h"
35 #include "linux-gnu/trace.h"
38 /* There are two PLT types on 32-bit PPC: old-style, BSS PLT, and
39 * new-style "secure" PLT. We can tell one from the other by the
40 * flags on the .plt section. If it's +X (executable), it's BSS PLT,
41 * otherwise it's secure.
43 * BSS PLT works the same way as most architectures: the .plt section
44 * contains trampolines and we put breakpoints to those. If not
45 * prelinked, .plt contains zeroes, and dynamic linker fills in the
46 * initial set of trampolines, which means that we need to delay
47 * enabling breakpoints until after binary entry point is hit.
48 * Additionally, after first call, dynamic linker updates .plt with
49 * branch to resolved address. That means that on first hit, we must
50 * do something similar to the PPC64 gambit described below.
52 * With secure PLT, the .plt section doesn't contain instructions but
53 * addresses. The real PLT table is stored in .text. Addresses of
54 * those PLT entries can be computed, and apart from the fact that
55 * they are in .text, they are ordinary PLT entries.
57 * 64-bit PPC is more involved. Program linker creates for each
58 * library call a _stub_ symbol named xxxxxxxx.plt_call.<callee>
59 * (where xxxxxxxx is a hexadecimal number). That stub does the call
60 * dispatch: it loads an address of a function to call from the
61 * section .plt, and branches. PLT entries themselves are essentially
62 * a curried call to the resolver. When the symbol is resolved, the
63 * resolver updates the value stored in .plt, and the next time
64 * around, the stub calls the library function directly. So we make
65 * at most one trip (none if the binary is prelinked) through each PLT
66 * entry, and correspondingly that is useless as a breakpoint site.
68 * Note the three confusing terms: stubs (that play the role of PLT
69 * entries), PLT entries, .plt section.
71 * We first check symbol tables and see if we happen to have stub
72 * symbols available. If yes we just put breakpoints to those, and
73 * treat them as usual breakpoints. The only tricky part is realizing
74 * that there can be more than one breakpoint per symbol.
76 * The case that we don't have the stub symbols available is harder.
77 * The following scheme uses two kinds of PLT breakpoints: unresolved
78 * and resolved (to some address). When the process starts (or when
79 * we attach), we distribute unresolved PLT breakpoints to the PLT
80 * entries (not stubs). Then we look in .plt, and for each entry
81 * whose value is different than the corresponding PLT entry address,
82 * we assume it was already resolved, and convert the breakpoint to
83 * resolved. We also rewrite the resolved value in .plt back to the
86 * When a PLT entry hits a resolved breakpoint (which happens because
87 * we rewrite .plt with the original unresolved addresses), we move
88 * the instruction pointer to the corresponding address and continue
89 * the process as if nothing happened.
91 * When unresolved PLT entry is called for the first time, we need to
92 * catch the new value that the resolver will write to a .plt slot.
93 * We also need to prevent another thread from racing through and
94 * taking the branch without ltrace noticing. So when unresolved PLT
95 * entry hits, we have to stop all threads. We then single-step
96 * through the resolver, until the .plt slot changes. When it does,
97 * we treat it the same way as above: convert the PLT breakpoint to
98 * resolved, and rewrite the .plt value back to PLT address. We then
99 * start all threads again.
101 * As an optimization, we remember the address where the address was
102 * resolved, and put a breakpoint there. The next time around (when
103 * the next PLT entry is to be resolved), instead of single-stepping
104 * through half the dynamic linker, we just let the thread run and hit
105 * this breakpoint. When it hits, we know the PLT entry was resolved.
107 * XXX TODO If we have hardware watch point, we might put a read watch
108 * on .plt slot, and discover the offenders this way. I don't know
109 * the details, but I assume at most a handful (like, one or two, if
110 * available at all) addresses may be watched at a time, and thus this
111 * would be used as an amendment of the above rather than full-on
112 * solution to PLT tracing on PPC.
115 #define PPC_PLT_STUB_SIZE 16
116 #define PPC64_PLT_STUB_SIZE 8 //xxx
129 read_target_4(struct Process *proc, arch_addr_t addr, uint32_t *lp)
131 unsigned long l = ptrace(PTRACE_PEEKTEXT, proc->pid, addr, 0);
132 if (l == -1UL && errno)
142 read_target_8(struct Process *proc, arch_addr_t addr, uint64_t *lp)
144 unsigned long l = ptrace(PTRACE_PEEKTEXT, proc->pid, addr, 0);
145 if (l == -1UL && errno)
147 if (host_powerpc64()) {
150 unsigned long l2 = ptrace(PTRACE_PEEKTEXT, proc->pid,
152 if (l2 == -1UL && errno)
154 *lp = ((uint64_t)l << 32) | l2;
160 read_target_long(struct Process *proc, arch_addr_t addr, uint64_t *lp)
162 if (proc->e_machine == EM_PPC) {
164 int ret = read_target_4(proc, addr, &w);
169 return read_target_8(proc, addr, lp);
174 mark_as_resolved(struct library_symbol *libsym, GElf_Addr value)
176 libsym->arch.type = PPC_PLT_RESOLVED;
177 libsym->arch.resolved_value = value;
181 arch_dynlink_done(struct Process *proc)
183 /* On PPC32 with BSS PLT, we need to enable delayed symbols. */
184 struct library_symbol *libsym = NULL;
185 while ((libsym = proc_each_symbol(proc, libsym,
186 library_symbol_delayed_cb, NULL))) {
187 if (read_target_8(proc, libsym->enter_addr,
188 &libsym->arch.resolved_value) < 0) {
190 "couldn't read PLT value for %s(%p): %s\n",
191 libsym->name, libsym->enter_addr,
196 /* arch_dynlink_done is called on attach as well. In
197 * that case some slots will have been resolved
198 * already. Unresolved PLT looks like this:
200 * <sleep@plt>: li r11,0
201 * <sleep@plt+4>: b "resolve"
203 * "resolve" is another address in PLTGOT (the same
204 * block that all the PLT slots are it). When
205 * resolved, it looks either this way:
207 * <sleep@plt>: b 0xfea88d0 <sleep>
209 * Which is easy to detect. It can also look this
212 * <sleep@plt>: li r11,0
213 * <sleep@plt+4>: b "dispatch"
215 * The "dispatch" address lies in PLTGOT as well. In
216 * current GNU toolchain, "dispatch" address is the
217 * same as PLTGOT address. We rely on this to figure
218 * out whether the address is resolved or not. */
219 uint32_t insn1 = libsym->arch.resolved_value >> 32;
220 uint32_t insn2 = (uint32_t)libsym->arch.resolved_value;
221 if ((insn1 & BRANCH_MASK) == B_INSN
222 || ((insn2 & BRANCH_MASK) == B_INSN
223 /* XXX double cast */
224 && (ppc_branch_dest(libsym->enter_addr + 4, insn2)
225 == (void*)(long)libsym->lib->arch.pltgot_addr)))
226 mark_as_resolved(libsym, libsym->arch.resolved_value);
228 if (proc_activate_delayed_symbol(proc, libsym) < 0)
231 /* XXX double cast */
232 libsym->arch.plt_slot_addr
233 = (GElf_Addr)(uintptr_t)libsym->enter_addr;
238 arch_plt_sym_val(struct ltelf *lte, size_t ndx, GElf_Rela *rela)
240 if (lte->ehdr.e_machine == EM_PPC && lte->arch.secure_plt) {
241 assert(lte->arch.plt_stub_vma != 0);
242 return lte->arch.plt_stub_vma + PPC_PLT_STUB_SIZE * ndx;
244 } else if (lte->ehdr.e_machine == EM_PPC) {
245 return rela->r_offset;
248 /* If we get here, we don't have stub symbols. In
249 * that case we put brakpoints to PLT entries the same
250 * as the PPC32 secure PLT case does. */
251 assert(lte->arch.plt_stub_vma != 0);
252 return lte->arch.plt_stub_vma + PPC64_PLT_STUB_SIZE * ndx;
256 /* This entry point is called when ltelf is not available
257 * anymore--during runtime. At that point we don't have to concern
258 * ourselves with bias, as the values in OPD have been resolved
261 arch_translate_address_dyn(struct Process *proc,
262 arch_addr_t addr, arch_addr_t *ret)
264 if (proc->e_machine == EM_PPC64) {
266 if (read_target_8(proc, addr, &value) < 0) {
268 "dynamic .opd translation of %p: %s\n",
269 addr, strerror(errno));
272 /* XXX The double cast should be removed when
273 * arch_addr_t becomes integral type. */
274 *ret = (arch_addr_t)(uintptr_t)value;
283 arch_translate_address(struct ltelf *lte,
284 arch_addr_t addr, arch_addr_t *ret)
286 if (lte->ehdr.e_machine == EM_PPC64) {
287 /* XXX The double cast should be removed when
288 * arch_addr_t becomes integral type. */
290 = (GElf_Addr)(uintptr_t)addr - lte->arch.opd_base;
292 if (elf_read_u64(lte->arch.opd_data, offset, &value) < 0) {
293 fprintf(stderr, "static .opd translation of %p: %s\n",
294 addr, elf_errmsg(-1));
297 *ret = (arch_addr_t)(uintptr_t)(value + lte->bias);
306 load_opd_data(struct ltelf *lte, struct library *lib)
310 if (elf_get_section_named(lte, ".opd", &sec, &shdr) < 0) {
312 fprintf(stderr, "couldn't find .opd data\n");
316 lte->arch.opd_data = elf_rawdata(sec, NULL);
317 if (lte->arch.opd_data == NULL)
320 lte->arch.opd_base = shdr.sh_addr + lte->bias;
321 lte->arch.opd_size = shdr.sh_size;
327 sym2addr(struct Process *proc, struct library_symbol *sym)
329 return sym->enter_addr;
333 get_glink_vma(struct ltelf *lte, GElf_Addr ppcgot, Elf_Data *plt_data)
335 Elf_Scn *ppcgot_sec = NULL;
336 GElf_Shdr ppcgot_shdr;
338 && elf_get_section_covering(lte, ppcgot,
339 &ppcgot_sec, &ppcgot_shdr) < 0)
341 "DT_PPC_GOT=%#"PRIx64", but no such section found\n",
344 if (ppcgot_sec != NULL) {
345 Elf_Data *data = elf_loaddata(ppcgot_sec, &ppcgot_shdr);
346 if (data == NULL || data->d_size < 8 ) {
347 fprintf(stderr, "couldn't read GOT data\n");
349 // where PPCGOT begins in .got
350 size_t offset = ppcgot - ppcgot_shdr.sh_addr;
351 assert(offset % 4 == 0);
353 if (elf_read_u32(data, offset + 4, &glink_vma) < 0) {
354 fprintf(stderr, "couldn't read glink VMA"
355 " address at %zd@GOT\n", offset);
358 if (glink_vma != 0) {
359 debug(1, "PPC GOT glink_vma address: %#" PRIx32,
361 return (GElf_Addr)glink_vma;
366 if (plt_data != NULL) {
368 if (elf_read_u32(plt_data, 0, &glink_vma) < 0) {
369 fprintf(stderr, "couldn't read glink VMA address\n");
372 debug(1, ".plt glink_vma address: %#" PRIx32, glink_vma);
373 return (GElf_Addr)glink_vma;
380 load_dynamic_entry(struct ltelf *lte, int tag, GElf_Addr *valuep)
384 if (elf_get_section_type(lte, SHT_DYNAMIC, &scn, &shdr) < 0
387 fprintf(stderr, "Couldn't get SHT_DYNAMIC: %s\n",
392 Elf_Data *data = elf_loaddata(scn, &shdr);
397 for (j = 0; j < shdr.sh_size / shdr.sh_entsize; ++j) {
399 if (gelf_getdyn(data, j, &dyn) == NULL)
402 if(dyn.d_tag == tag) {
403 *valuep = dyn.d_un.d_ptr;
412 nonzero_data(Elf_Data *data)
414 /* We are not supposed to get here if there's no PLT. */
415 assert(data != NULL);
417 unsigned char *buf = data->d_buf;
422 for (i = 0; i < data->d_size; ++i)
429 arch_elf_init(struct ltelf *lte, struct library *lib)
431 if (lte->ehdr.e_machine == EM_PPC64
432 && load_opd_data(lte, lib) < 0)
435 lte->arch.secure_plt = !(lte->plt_flags & SHF_EXECINSTR);
437 /* For PPC32 BSS, it is important whether the binary was
438 * prelinked. If .plt section is NODATA, or if it contains
439 * zeroes, then this library is not prelinked, and we need to
440 * delay breakpoints. */
441 if (lte->ehdr.e_machine == EM_PPC && !lte->arch.secure_plt)
442 lib->arch.bss_plt_prelinked = nonzero_data(lte->plt_data);
444 /* For cases where it's irrelevant, initialize the
445 * value to something conspicuous. */
446 lib->arch.bss_plt_prelinked = -1;
448 if (lte->ehdr.e_machine == EM_PPC && lte->arch.secure_plt) {
450 if (load_dynamic_entry(lte, DT_PPC_GOT, &ppcgot) < 0) {
451 fprintf(stderr, "couldn't find DT_PPC_GOT\n");
454 GElf_Addr glink_vma = get_glink_vma(lte, ppcgot, lte->plt_data);
456 assert(lte->relplt_size % 12 == 0);
457 size_t count = lte->relplt_size / 12; // size of RELA entry
458 lte->arch.plt_stub_vma = glink_vma
459 - (GElf_Addr)count * PPC_PLT_STUB_SIZE;
460 debug(1, "stub_vma is %#" PRIx64, lte->arch.plt_stub_vma);
462 } else if (lte->ehdr.e_machine == EM_PPC64) {
464 if (load_dynamic_entry(lte, DT_PPC64_GLINK, &glink_vma) < 0) {
465 fprintf(stderr, "couldn't find DT_PPC64_GLINK\n");
469 /* The first glink stub starts at offset 32. */
470 lte->arch.plt_stub_vma = glink_vma + 32;
473 /* By exhaustion--PPC32 BSS. */
474 if (load_dynamic_entry(lte, DT_PLTGOT,
475 &lib->arch.pltgot_addr) < 0) {
476 fprintf(stderr, "couldn't find DT_PLTGOT\n");
481 /* On PPC64, look for stub symbols in symbol table. These are
482 * called: xxxxxxxx.plt_call.callee_name@version+addend. */
483 if (lte->ehdr.e_machine == EM_PPC64
484 && lte->symtab != NULL && lte->strtab != NULL) {
486 /* N.B. We can't simply skip the symbols that we fail
487 * to read or malloc. There may be more than one stub
488 * per symbol name, and if we failed in one but
489 * succeeded in another, the PLT enabling code would
490 * have no way to tell that something is missing. We
491 * could work around that, of course, but it doesn't
492 * seem worth the trouble. So if anything fails, we
493 * just pretend that we don't have stub symbols at
494 * all, as if the binary is stripped. */
497 for (i = 0; i < lte->symtab_count; ++i) {
499 if (gelf_getsym(lte->symtab, i, &sym) == NULL) {
500 struct library_symbol *sym, *next;
502 for (sym = lte->arch.stubs; sym != NULL; ) {
504 library_symbol_destroy(sym);
508 lte->arch.stubs = NULL;
512 const char *name = lte->strtab + sym.st_name;
514 #define STUBN ".plt_call."
515 if ((name = strstr(name, STUBN)) == NULL)
517 name += sizeof(STUBN) - 1;
521 const char *ver = strchr(name, '@');
526 /* If there is "+" at all, check that
527 * the symbol name ends in "+0". */
528 const char *add = strrchr(name, '+');
530 assert(strcmp(add, "+0") == 0);
537 char *sym_name = strndup(name, len);
538 struct library_symbol *libsym = malloc(sizeof(*libsym));
539 if (sym_name == NULL || libsym == NULL) {
546 /* XXX The double cast should be removed when
547 * arch_addr_t becomes integral type. */
548 arch_addr_t addr = (arch_addr_t)
549 (uintptr_t)sym.st_value + lte->bias;
550 if (library_symbol_init(libsym, addr, sym_name, 1,
553 libsym->arch.type = PPC64_PLT_STUB;
554 libsym->next = lte->arch.stubs;
555 lte->arch.stubs = libsym;
563 read_plt_slot_value(struct Process *proc, GElf_Addr addr, GElf_Addr *valp)
565 /* On PPC64, we read from .plt, which contains 8 byte
566 * addresses. On PPC32 we read from .plt, which contains 4
567 * byte instructions, but the PLT is two instructions, and
568 * either can change. */
570 /* XXX double cast. */
571 if (read_target_8(proc, (arch_addr_t)(uintptr_t)addr, &l) < 0) {
572 fprintf(stderr, "ptrace .plt slot value @%#" PRIx64": %s\n",
573 addr, strerror(errno));
577 *valp = (GElf_Addr)l;
582 unresolve_plt_slot(struct Process *proc, GElf_Addr addr, GElf_Addr value)
584 /* We only modify plt_entry[0], which holds the resolved
585 * address of the routine. We keep the TOC and environment
586 * pointers intact. Hence the only adjustment that we need to
588 if (ptrace(PTRACE_POKETEXT, proc->pid, addr, value) < 0) {
589 fprintf(stderr, "failed to unresolve .plt slot: %s\n",
597 arch_elf_add_plt_entry(struct Process *proc, struct ltelf *lte,
598 const char *a_name, GElf_Rela *rela, size_t ndx,
599 struct library_symbol **ret)
601 if (lte->ehdr.e_machine == EM_PPC) {
602 if (lte->arch.secure_plt)
605 struct library_symbol *libsym = NULL;
606 if (default_elf_add_plt_entry(proc, lte, a_name, rela, ndx,
610 /* On PPC32 with BSS PLT, delay the symbol until
611 * dynamic linker is done. */
612 assert(!libsym->delayed);
619 /* PPC64. If we have stubs, we return a chain of breakpoint
620 * sites, one for each stub that corresponds to this PLT
622 struct library_symbol *chain = NULL;
623 struct library_symbol **symp;
624 for (symp = <e->arch.stubs; *symp != NULL; ) {
625 struct library_symbol *sym = *symp;
626 if (strcmp(sym->name, a_name) != 0) {
627 symp = &(*symp)->next;
631 /* Re-chain the symbol from stubs to CHAIN. */
642 /* We don't have stub symbols. Find corresponding .plt slot,
643 * and check whether it contains the corresponding PLT address
644 * (or 0 if the dynamic linker hasn't run yet). N.B. we don't
645 * want read this from ELF file, but from process image. That
646 * makes a difference if we are attaching to a running
649 GElf_Addr plt_entry_addr = arch_plt_sym_val(lte, ndx, rela);
650 GElf_Addr plt_slot_addr = rela->r_offset;
651 assert(plt_slot_addr >= lte->plt_addr
652 || plt_slot_addr < lte->plt_addr + lte->plt_size);
654 GElf_Addr plt_slot_value;
655 if (read_plt_slot_value(proc, plt_slot_addr, &plt_slot_value) < 0)
658 char *name = strdup(a_name);
659 struct library_symbol *libsym = malloc(sizeof(*libsym));
660 if (name == NULL || libsym == NULL) {
661 fprintf(stderr, "allocation for .plt slot: %s\n",
669 /* XXX The double cast should be removed when
670 * arch_addr_t becomes integral type. */
671 if (library_symbol_init(libsym,
672 (arch_addr_t)(uintptr_t)plt_entry_addr,
673 name, 1, LS_TOPLT_EXEC) < 0)
675 libsym->arch.plt_slot_addr = plt_slot_addr;
677 if (plt_slot_value == plt_entry_addr || plt_slot_value == 0) {
678 libsym->arch.type = PPC_PLT_UNRESOLVED;
679 libsym->arch.resolved_value = plt_entry_addr;
682 /* Unresolve the .plt slot. If the binary was
683 * prelinked, this makes the code invalid, because in
684 * case of prelinked binary, the dynamic linker
685 * doesn't update .plt[0] and .plt[1] with addresses
686 * of the resover. But we don't care, we will never
687 * need to enter the resolver. That just means that
688 * we have to un-un-resolve this back before we
691 if (unresolve_plt_slot(proc, plt_slot_addr, plt_entry_addr) < 0) {
692 library_symbol_destroy(libsym);
695 mark_as_resolved(libsym, plt_slot_value);
703 arch_elf_destroy(struct ltelf *lte)
705 struct library_symbol *sym;
706 for (sym = lte->arch.stubs; sym != NULL; ) {
707 struct library_symbol *next = sym->next;
708 library_symbol_destroy(sym);
715 dl_plt_update_bp_on_hit(struct breakpoint *bp, struct Process *proc)
717 debug(DEBUG_PROCESS, "pid=%d dl_plt_update_bp_on_hit %s(%p)",
718 proc->pid, breakpoint_name(bp), bp->addr);
719 struct process_stopping_handler *self = proc->arch.handler;
720 assert(self != NULL);
722 struct library_symbol *libsym = self->breakpoint_being_enabled->libsym;
724 if (read_plt_slot_value(proc, libsym->arch.plt_slot_addr, &value) < 0)
727 /* On PPC64, we rewrite the slot value. */
728 if (proc->e_machine == EM_PPC64)
729 unresolve_plt_slot(proc, libsym->arch.plt_slot_addr,
730 libsym->arch.resolved_value);
731 /* We mark the breakpoint as resolved on both arches. */
732 mark_as_resolved(libsym, value);
734 /* cb_on_all_stopped looks if HANDLER is set to NULL as a way
735 * to check that this was run. It's an error if it
737 proc->arch.handler = NULL;
739 breakpoint_turn_off(bp, proc);
743 cb_on_all_stopped(struct process_stopping_handler *self)
745 /* Put that in for dl_plt_update_bp_on_hit to see. */
746 assert(self->task_enabling_breakpoint->arch.handler == NULL);
747 self->task_enabling_breakpoint->arch.handler = self;
749 linux_ptrace_disable_and_continue(self);
752 static enum callback_status
753 cb_keep_stepping_p(struct process_stopping_handler *self)
755 struct Process *proc = self->task_enabling_breakpoint;
756 struct library_symbol *libsym = self->breakpoint_being_enabled->libsym;
759 if (read_plt_slot_value(proc, libsym->arch.plt_slot_addr, &value) < 0)
762 /* In UNRESOLVED state, the RESOLVED_VALUE in fact contains
763 * the PLT entry value. */
764 if (value == libsym->arch.resolved_value)
767 debug(DEBUG_PROCESS, "pid=%d PLT got resolved to value %#"PRIx64,
770 /* The .plt slot got resolved! We can migrate the breakpoint
771 * to RESOLVED and stop single-stepping. */
772 if (proc->e_machine == EM_PPC64
773 && unresolve_plt_slot(proc, libsym->arch.plt_slot_addr,
774 libsym->arch.resolved_value) < 0)
777 /* Resolving on PPC64 consists of overwriting a doubleword in
778 * .plt. That doubleword is than read back by a stub, and
779 * jumped on. Hopefully we can assume that double word update
780 * is done on a single place only, as it contains a final
781 * address. We still need to look around for any sync
782 * instruction, but essentially it is safe to optimize away
783 * the single stepping next time and install a post-update
786 * The situation on PPC32 BSS is more complicated. The
787 * dynamic linker here updates potentially several
788 * instructions (XXX currently we assume two) and the rules
789 * are more complicated. Sometimes it's enough to adjust just
790 * one of the addresses--the logic for generating optimal
791 * dispatch depends on relative addresses of the .plt entry
792 * and the jump destination. We can't assume that the some
793 * instruction block does the update every time. So on PPC32,
794 * we turn the optimization off and just step through it each
796 if (proc->e_machine == EM_PPC)
799 /* Install breakpoint to the address where the change takes
800 * place. If we fail, then that just means that we'll have to
801 * singlestep the next time around as well. */
802 struct Process *leader = proc->leader;
803 if (leader == NULL || leader->arch.dl_plt_update_bp != NULL)
806 /* We need to install to the next instruction. ADDR points to
807 * a store instruction, so moving the breakpoint one
808 * instruction forward is safe. */
809 arch_addr_t addr = get_instruction_pointer(proc) + 4;
810 leader->arch.dl_plt_update_bp = insert_breakpoint(proc, addr, NULL);
811 if (leader->arch.dl_plt_update_bp == NULL)
814 static struct bp_callbacks dl_plt_update_cbs = {
815 .on_hit = dl_plt_update_bp_on_hit,
817 leader->arch.dl_plt_update_bp->cbs = &dl_plt_update_cbs;
819 /* Turn it off for now. We will turn it on again when we hit
820 * the PLT entry that needs this. */
821 breakpoint_turn_off(leader->arch.dl_plt_update_bp, proc);
824 mark_as_resolved(libsym, value);
830 jump_to_entry_point(struct Process *proc, struct breakpoint *bp)
832 /* XXX The double cast should be removed when
833 * arch_addr_t becomes integral type. */
834 arch_addr_t rv = (arch_addr_t)
835 (uintptr_t)bp->libsym->arch.resolved_value;
836 set_instruction_pointer(proc, rv);
840 ppc_plt_bp_continue(struct breakpoint *bp, struct Process *proc)
842 switch (bp->libsym->arch.type) {
843 struct Process *leader;
844 void (*on_all_stopped)(struct process_stopping_handler *);
845 enum callback_status (*keep_stepping_p)
846 (struct process_stopping_handler *);
849 assert(proc->e_machine == EM_PPC);
850 assert(bp->libsym != NULL);
851 assert(bp->libsym->lib->arch.bss_plt_prelinked == 0);
854 case PPC_PLT_UNRESOLVED:
855 on_all_stopped = NULL;
856 keep_stepping_p = NULL;
857 leader = proc->leader;
859 if (leader != NULL && leader->arch.dl_plt_update_bp != NULL
860 && breakpoint_turn_on(leader->arch.dl_plt_update_bp,
862 on_all_stopped = cb_on_all_stopped;
864 keep_stepping_p = cb_keep_stepping_p;
866 if (process_install_stopping_handler
867 (proc, bp, on_all_stopped, keep_stepping_p, NULL) < 0) {
868 fprintf(stderr, "ppc_plt_bp_continue: "
869 "couldn't install event handler\n");
870 continue_after_breakpoint(proc, bp);
874 case PPC_PLT_RESOLVED:
875 if (proc->e_machine == EM_PPC) {
876 continue_after_breakpoint(proc, bp);
880 jump_to_entry_point(proc, bp);
881 continue_process(proc->pid);
885 /* These should never hit here. */
889 assert(bp->libsym->arch.type != bp->libsym->arch.type);
893 /* When a process is in a PLT stub, it may have already read the data
894 * in .plt that we changed. If we detach now, it will jump to PLT
895 * entry and continue to the dynamic linker, where it will SIGSEGV,
896 * because zeroth .plt slot is not filled in prelinked binaries, and
897 * the dynamic linker needs that data. Moreover, the process may
898 * actually have hit the breakpoint already. This functions tries to
899 * detect both cases and do any fix-ups necessary to mend this
901 static enum callback_status
902 detach_task_cb(struct Process *task, void *data)
904 struct breakpoint *bp = data;
906 if (get_instruction_pointer(task) == bp->addr) {
907 debug(DEBUG_PROCESS, "%d at %p, which is PLT slot",
908 task->pid, bp->addr);
909 jump_to_entry_point(task, bp);
913 /* XXX There's still a window of several instructions where we
914 * might catch the task inside a stub such that it has already
915 * read destination address from .plt, but hasn't jumped yet,
916 * thus avoiding the breakpoint. */
922 ppc_plt_bp_retract(struct breakpoint *bp, struct Process *proc)
924 /* On PPC64, we rewrite .plt with PLT entry addresses. This
925 * needs to be undone. Unfortunately, the program may have
926 * made decisions based on that value */
927 if (proc->e_machine == EM_PPC64
928 && bp->libsym != NULL
929 && bp->libsym->arch.type == PPC_PLT_RESOLVED) {
930 each_task(proc->leader, NULL, detach_task_cb, bp);
931 unresolve_plt_slot(proc, bp->libsym->arch.plt_slot_addr,
932 bp->libsym->arch.resolved_value);
937 arch_library_init(struct library *lib)
942 arch_library_destroy(struct library *lib)
947 arch_library_clone(struct library *retp, struct library *lib)
952 arch_library_symbol_init(struct library_symbol *libsym)
954 /* We set type explicitly in the code above, where we have the
955 * necessary context. This is for calls from ltrace-elf.c and
957 libsym->arch.type = PPC_DEFAULT;
962 arch_library_symbol_destroy(struct library_symbol *libsym)
967 arch_library_symbol_clone(struct library_symbol *retp,
968 struct library_symbol *libsym)
970 retp->arch = libsym->arch;
974 /* For some symbol types, we need to set up custom callbacks. XXX we
975 * don't need PROC here, we can store the data in BP if it is of
978 arch_breakpoint_init(struct Process *proc, struct breakpoint *bp)
980 /* Artificial and entry-point breakpoints are plain. */
981 if (bp->libsym == NULL || bp->libsym->plt_type != LS_TOPLT_EXEC)
984 /* On PPC, secure PLT and prelinked BSS PLT are plain. */
985 if (proc->e_machine == EM_PPC
986 && bp->libsym->lib->arch.bss_plt_prelinked != 0)
989 /* On PPC64, stub PLT breakpoints are plain. */
990 if (proc->e_machine == EM_PPC64
991 && bp->libsym->arch.type == PPC64_PLT_STUB)
994 static struct bp_callbacks cbs = {
995 .on_continue = ppc_plt_bp_continue,
996 .on_retract = ppc_plt_bp_retract,
998 breakpoint_set_callbacks(bp, &cbs);
1003 arch_breakpoint_destroy(struct breakpoint *bp)
1008 arch_breakpoint_clone(struct breakpoint *retp, struct breakpoint *sbp)
1010 retp->arch = sbp->arch;
1015 arch_process_init(struct Process *proc)
1017 proc->arch.dl_plt_update_bp = NULL;
1018 proc->arch.handler = NULL;
1023 arch_process_destroy(struct Process *proc)
1028 arch_process_clone(struct Process *retp, struct Process *proc)
1030 retp->arch = proc->arch;
1035 arch_process_exec(struct Process *proc)
1037 return arch_process_init(proc);