2 * This file is part of ltrace.
3 * Copyright (C) 2012,2013,2014 Petr Machata, Red Hat Inc.
4 * Copyright (C) 2004,2008,2009 Juan Cespedes
5 * Copyright (C) 2006 Paul Gilliam
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 of the
10 * License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
24 #include <sys/ptrace.h>
35 #include "breakpoint.h"
36 #include "linux-gnu/trace.h"
39 /* There are two PLT types on 32-bit PPC: old-style, BSS PLT, and
40 * new-style "secure" PLT. We can tell one from the other by the
41 * flags on the .plt section. If it's +X (executable), it's BSS PLT,
42 * otherwise it's secure.
44 * BSS PLT works the same way as most architectures: the .plt section
45 * contains trampolines and we put breakpoints to those. If not
46 * prelinked, .plt contains zeroes, and dynamic linker fills in the
47 * initial set of trampolines, which means that we need to delay
48 * enabling breakpoints until after binary entry point is hit.
49 * Additionally, after first call, dynamic linker updates .plt with
50 * branch to resolved address. That means that on first hit, we must
51 * do something similar to the PPC64 gambit described below.
53 * With secure PLT, the .plt section doesn't contain instructions but
54 * addresses. The real PLT table is stored in .text. Addresses of
55 * those PLT entries can be computed, and apart from the fact that
56 * they are in .text, they are ordinary PLT entries.
58 * 64-bit PPC is more involved. Program linker creates for each
59 * library call a _stub_ symbol named xxxxxxxx.plt_call.<callee>
60 * (where xxxxxxxx is a hexadecimal number). That stub does the call
61 * dispatch: it loads an address of a function to call from the
62 * section .plt, and branches. PLT entries themselves are essentially
63 * a curried call to the resolver. When the symbol is resolved, the
64 * resolver updates the value stored in .plt, and the next time
65 * around, the stub calls the library function directly. So we make
66 * at most one trip (none if the binary is prelinked) through each PLT
67 * entry, and correspondingly that is useless as a breakpoint site.
69 * Note the three confusing terms: stubs (that play the role of PLT
70 * entries), PLT entries, .plt section.
72 * We first check symbol tables and see if we happen to have stub
73 * symbols available. If yes we just put breakpoints to those, and
74 * treat them as usual breakpoints. The only tricky part is realizing
75 * that there can be more than one breakpoint per symbol.
77 * The case that we don't have the stub symbols available is harder.
78 * The following scheme uses two kinds of PLT breakpoints: unresolved
79 * and resolved (to some address). When the process starts (or when
80 * we attach), we distribute unresolved PLT breakpoints to the PLT
81 * entries (not stubs). Then we look in .plt, and for each entry
82 * whose value is different than the corresponding PLT entry address,
83 * we assume it was already resolved, and convert the breakpoint to
84 * resolved. We also rewrite the resolved value in .plt back to the
87 * When a PLT entry hits a resolved breakpoint (which happens because
88 * we rewrite .plt with the original unresolved addresses), we move
89 * the instruction pointer to the corresponding address and continue
90 * the process as if nothing happened.
92 * When unresolved PLT entry is called for the first time, we need to
93 * catch the new value that the resolver will write to a .plt slot.
94 * We also need to prevent another thread from racing through and
95 * taking the branch without ltrace noticing. So when unresolved PLT
96 * entry hits, we have to stop all threads. We then single-step
97 * through the resolver, until the .plt slot changes. When it does,
98 * we treat it the same way as above: convert the PLT breakpoint to
99 * resolved, and rewrite the .plt value back to PLT address. We then
100 * start all threads again.
102 * As an optimization, we remember the address where the address was
103 * resolved, and put a breakpoint there. The next time around (when
104 * the next PLT entry is to be resolved), instead of single-stepping
105 * through half the dynamic linker, we just let the thread run and hit
106 * this breakpoint. When it hits, we know the PLT entry was resolved.
108 * Another twist comes from tracing slots corresponding to
109 * R_PPC64_JMP_IREL relocations. These have no dedicated PLT entry.
110 * The calls are done directly from stubs, and the .plt entry
111 * (actually .iplt entry, these live in a special section) is resolved
112 * in advance before the binary starts. Because there's no PLT entry,
113 * we put the PLT breakpoints directly to the IFUNC resolver code, and
114 * then would like them to behave like ordinary PLT slots, including
115 * catching the point where these get resolved to unresolve them. So
116 * for the first call (which is the actual resolver call), we pretend
117 * that this breakpoint is artificial and has no associated symbol,
118 * and turn it on fully only after the first hit. Ideally we would
119 * trace that first call as well, but then the stepper, which tries to
120 * catch the point where the slot is resolved, would hit the return
121 * breakpoint and that's not currently handled well.
123 * On PPC32 with secure PLT, the address of IFUNC symbols in main
124 * binary actually isn't of the resolver, but of a PLT slot. We
125 * therefore have to locate the corresponding PLT relocation (which is
126 * of type R_PPC_IRELATIVE) and request that it be traced. The addend
127 * of that relocation is an address of resolver, and we request
128 * tracing of the xyz.IFUNC symbol there.
130 * XXX TODO If we have hardware watch point, we might put a read watch
131 * on .plt slot, and discover the offenders this way. I don't know
132 * the details, but I assume at most a handful (like, one or two, if
133 * available at all) addresses may be watched at a time, and thus this
134 * would be used as an amendment of the above rather than full-on
135 * solution to PLT tracing on PPC.
138 #define PPC_PLT_STUB_SIZE 16
140 #define PPC64_PLT_STUB_SIZE 8
142 #define PPC64_PLT_STUB_SIZE 4
156 mark_as_resolved(struct library_symbol *libsym, GElf_Addr value)
158 libsym->arch.type = PPC_PLT_RESOLVED;
159 libsym->arch.resolved_value = value;
163 ppc32_delayed_symbol(struct library_symbol *libsym)
165 /* arch_dynlink_done is called on attach as well. In that
166 * case some slots will have been resolved already.
167 * Unresolved PLT looks like this:
169 * <sleep@plt>: li r11,0
170 * <sleep@plt+4>: b "resolve"
172 * "resolve" is another address in PLTGOT (the same block that
173 * all the PLT slots are it). When resolved, it looks either
176 * <sleep@plt>: b 0xfea88d0 <sleep>
178 * Which is easy to detect. It can also look this way:
180 * <sleep@plt>: li r11,0
181 * <sleep@plt+4>: b "dispatch"
183 * The "dispatch" address lies in PLTGOT as well. In current
184 * GNU toolchain, "dispatch" address is the same as PLTGOT
185 * address. We rely on this to figure out whether the address
186 * is resolved or not. */
188 uint32_t insn1 = libsym->arch.resolved_value >> 32;
189 uint32_t insn2 = (uint32_t) libsym->arch.resolved_value;
190 if ((insn1 & BRANCH_MASK) == B_INSN
191 || ((insn2 & BRANCH_MASK) == B_INSN
192 /* XXX double cast */
193 #ifdef __LITTLE_ENDIAN__
194 && (ppc_branch_dest(libsym->enter_addr + 4, insn1)
195 == (arch_addr_t) (long) libsym->lib->arch.pltgot_addr)))
197 && (ppc_branch_dest(libsym->enter_addr + 4, insn2)
198 == (arch_addr_t) (long) libsym->lib->arch.pltgot_addr)))
201 mark_as_resolved(libsym, libsym->arch.resolved_value);
206 arch_dynlink_done(struct process *proc)
208 /* We may need to activate delayed symbols. */
209 struct library_symbol *libsym = NULL;
210 while ((libsym = proc_each_symbol(proc, libsym,
211 library_symbol_delayed_cb, NULL))) {
212 if (proc_read_64(proc, libsym->enter_addr,
213 &libsym->arch.resolved_value) < 0) {
215 "couldn't read PLT value for %s(%p): %s\n",
216 libsym->name, libsym->enter_addr,
221 if (proc->e_machine == EM_PPC)
222 ppc32_delayed_symbol(libsym);
224 if (proc_activate_delayed_symbol(proc, libsym) < 0)
227 if (proc->e_machine == EM_PPC)
228 /* XXX double cast */
229 libsym->arch.plt_slot_addr
230 = (GElf_Addr) (uintptr_t) libsym->enter_addr;
235 reloc_is_irelative(int machine, GElf_Rela *rela)
237 bool irelative = false;
238 if (machine == EM_PPC64) {
239 #ifdef __LITTLE_ENDIAN__
240 # ifdef R_PPC64_IRELATIVE
241 irelative = GELF_R_TYPE(rela->r_info) == R_PPC64_IRELATIVE;
244 # ifdef R_PPC64_JMP_IREL
245 irelative = GELF_R_TYPE(rela->r_info) == R_PPC64_JMP_IREL;
249 assert(machine == EM_PPC);
250 #ifdef R_PPC_IRELATIVE
251 irelative = GELF_R_TYPE(rela->r_info) == R_PPC_IRELATIVE;
258 arch_plt_sym_val(struct ltelf *lte, size_t ndx, GElf_Rela *rela)
260 if (lte->ehdr.e_machine == EM_PPC && lte->arch.secure_plt) {
261 assert(lte->arch.plt_stub_vma != 0);
262 return lte->arch.plt_stub_vma + PPC_PLT_STUB_SIZE * ndx;
264 } else if (lte->ehdr.e_machine == EM_PPC) {
265 return rela->r_offset;
267 /* Beyond this point, we are on PPC64, but don't have stub
270 } else if (reloc_is_irelative(lte->ehdr.e_machine, rela)) {
272 /* Put JMP_IREL breakpoint to resolver, since there's
273 * no dedicated PLT entry. */
275 assert(rela->r_addend != 0);
276 /* XXX double cast */
277 arch_addr_t res_addr = (arch_addr_t) (uintptr_t) rela->r_addend;
278 if (arch_translate_address(lte, res_addr, &res_addr) < 0) {
279 fprintf(stderr, "Couldn't OPD-translate IRELATIVE "
280 "resolver address.\n");
283 /* XXX double cast */
284 return (GElf_Addr) (uintptr_t) res_addr;
287 /* We put brakpoints to PLT entries the same as the
288 * PPC32 secure PLT case does. */
289 assert(lte->arch.plt_stub_vma != 0);
290 return lte->arch.plt_stub_vma + PPC64_PLT_STUB_SIZE * ndx;
294 /* This entry point is called when ltelf is not available
295 * anymore--during runtime. At that point we don't have to concern
296 * ourselves with bias, as the values in OPD have been resolved
299 arch_translate_address_dyn(struct process *proc,
300 arch_addr_t addr, arch_addr_t *ret)
302 if (proc->e_machine == EM_PPC64) {
305 if (proc_read_64(proc, addr, &value) < 0) {
307 "dynamic .opd translation of %p: %s\n",
308 addr, strerror(errno));
311 /* XXX The double cast should be removed when
312 * arch_addr_t becomes integral type. */
313 *ret = (arch_addr_t)(uintptr_t)value;
323 arch_translate_address(struct ltelf *lte,
324 arch_addr_t addr, arch_addr_t *ret)
326 if (lte->ehdr.e_machine == EM_PPC64
327 && !lte->arch.elfv2_abi) {
328 /* XXX The double cast should be removed when
329 * arch_addr_t becomes integral type. */
331 = (GElf_Addr)(uintptr_t)addr - lte->arch.opd_base;
333 if (elf_read_u64(lte->arch.opd_data, offset, &value) < 0) {
334 fprintf(stderr, "static .opd translation of %p: %s\n",
335 addr, elf_errmsg(-1));
338 *ret = (arch_addr_t)(uintptr_t)(value + lte->bias);
347 load_opd_data(struct ltelf *lte, struct library *lib)
351 if (elf_get_section_named(lte, ".opd", &sec, &shdr) < 0
354 fprintf(stderr, "couldn't find .opd data\n");
358 lte->arch.opd_data = elf_rawdata(sec, NULL);
359 if (lte->arch.opd_data == NULL)
362 lte->arch.opd_base = shdr.sh_addr + lte->bias;
363 lte->arch.opd_size = shdr.sh_size;
369 sym2addr(struct process *proc, struct library_symbol *sym)
371 return sym->enter_addr;
375 get_glink_vma(struct ltelf *lte, GElf_Addr ppcgot, Elf_Data *plt_data)
377 Elf_Scn *ppcgot_sec = NULL;
378 GElf_Shdr ppcgot_shdr;
380 && (elf_get_section_covering(lte, ppcgot,
381 &ppcgot_sec, &ppcgot_shdr) < 0
382 || ppcgot_sec == NULL))
384 "DT_PPC_GOT=%#"PRIx64", but no such section found\n",
387 if (ppcgot_sec != NULL) {
388 Elf_Data *data = elf_loaddata(ppcgot_sec, &ppcgot_shdr);
389 if (data == NULL || data->d_size < 8 ) {
390 fprintf(stderr, "couldn't read GOT data\n");
392 // where PPCGOT begins in .got
393 size_t offset = ppcgot - ppcgot_shdr.sh_addr;
394 assert(offset % 4 == 0);
396 if (elf_read_u32(data, offset + 4, &glink_vma) < 0) {
397 fprintf(stderr, "couldn't read glink VMA"
398 " address at %zd@GOT\n", offset);
401 if (glink_vma != 0) {
402 debug(1, "PPC GOT glink_vma address: %#" PRIx32,
404 return (GElf_Addr)glink_vma;
409 if (plt_data != NULL) {
411 if (elf_read_u32(plt_data, 0, &glink_vma) < 0) {
412 fprintf(stderr, "couldn't read glink VMA address\n");
415 debug(1, ".plt glink_vma address: %#" PRIx32, glink_vma);
416 return (GElf_Addr)glink_vma;
423 nonzero_data(Elf_Data *data)
425 /* We are not supposed to get here if there's no PLT. */
426 assert(data != NULL);
428 unsigned char *buf = data->d_buf;
433 for (i = 0; i < data->d_size; ++i)
439 static enum callback_status
440 reloc_copy_if_irelative(GElf_Rela *rela, void *data)
442 struct ltelf *lte = data;
444 return CBS_STOP_IF(reloc_is_irelative(lte->ehdr.e_machine, rela)
445 && VECT_PUSHBACK(<e->plt_relocs, rela) < 0);
449 arch_elf_init(struct ltelf *lte, struct library *lib)
452 /* Check for ABIv2 in ELF header processor specific flag. */
454 assert (! (lte->ehdr.e_flags & 3 ) == 2)
456 lte->arch.elfv2_abi=((lte->ehdr.e_flags & EF_PPC64_ABI) == 2) ;
459 if (lte->ehdr.e_machine == EM_PPC64
460 && !lte->arch.elfv2_abi
461 && load_opd_data(lte, lib) < 0)
464 lte->arch.secure_plt = !(lte->plt_flags & SHF_EXECINSTR);
466 /* For PPC32 BSS, it is important whether the binary was
467 * prelinked. If .plt section is NODATA, or if it contains
468 * zeroes, then this library is not prelinked, and we need to
469 * delay breakpoints. */
470 if (lte->ehdr.e_machine == EM_PPC && !lte->arch.secure_plt)
471 lib->arch.bss_plt_prelinked = nonzero_data(lte->plt_data);
473 /* For cases where it's irrelevant, initialize the
474 * value to something conspicuous. */
475 lib->arch.bss_plt_prelinked = -1;
477 /* On PPC64 and PPC32 secure, IRELATIVE relocations actually
478 * relocate .iplt section, and as such are stored in .rela.dyn
479 * (where all non-PLT relocations are stored) instead of
480 * .rela.plt. Add these to lte->plt_relocs. */
482 GElf_Addr rela, relasz;
485 if ((lte->ehdr.e_machine == EM_PPC64 || lte->arch.secure_plt)
486 && elf_load_dynamic_entry(lte, DT_RELA, &rela) == 0
487 && elf_load_dynamic_entry(lte, DT_RELASZ, &relasz) == 0
488 && elf_get_section_covering(lte, rela, &rela_sec, &rela_shdr) == 0
489 && rela_sec != NULL) {
492 VECT_INIT(&v, GElf_Rela);
493 int ret = elf_read_relocs(lte, rela_sec, &rela_shdr, &v);
495 && VECT_EACH(&v, GElf_Rela, NULL,
496 reloc_copy_if_irelative, lte) != NULL)
499 VECT_DESTROY(&v, GElf_Rela, NULL, NULL);
505 if (lte->ehdr.e_machine == EM_PPC && lte->arch.secure_plt) {
507 if (elf_load_dynamic_entry(lte, DT_PPC_GOT, &ppcgot) < 0) {
508 fprintf(stderr, "couldn't find DT_PPC_GOT\n");
511 GElf_Addr glink_vma = get_glink_vma(lte, ppcgot, lte->plt_data);
513 size_t count = vect_size(<e->plt_relocs);
514 lte->arch.plt_stub_vma = glink_vma
515 - (GElf_Addr) count * PPC_PLT_STUB_SIZE;
516 debug(1, "stub_vma is %#" PRIx64, lte->arch.plt_stub_vma);
518 } else if (lte->ehdr.e_machine == EM_PPC64) {
520 if (elf_load_dynamic_entry(lte, DT_PPC64_GLINK,
522 fprintf(stderr, "couldn't find DT_PPC64_GLINK\n");
526 /* The first glink stub starts at offset 32. */
527 lte->arch.plt_stub_vma = glink_vma + 32;
530 /* By exhaustion--PPC32 BSS. */
531 if (elf_load_dynamic_entry(lte, DT_PLTGOT,
532 &lib->arch.pltgot_addr) < 0) {
533 fprintf(stderr, "couldn't find DT_PLTGOT\n");
538 /* On PPC64, look for stub symbols in symbol table. These are
539 * called: xxxxxxxx.plt_call.callee_name@version+addend. */
540 if (lte->ehdr.e_machine == EM_PPC64
541 && lte->symtab != NULL && lte->strtab != NULL) {
543 /* N.B. We can't simply skip the symbols that we fail
544 * to read or malloc. There may be more than one stub
545 * per symbol name, and if we failed in one but
546 * succeeded in another, the PLT enabling code would
547 * have no way to tell that something is missing. We
548 * could work around that, of course, but it doesn't
549 * seem worth the trouble. So if anything fails, we
550 * just pretend that we don't have stub symbols at
551 * all, as if the binary is stripped. */
554 for (i = 0; i < lte->symtab_count; ++i) {
556 if (gelf_getsym(lte->symtab, i, &sym) == NULL) {
557 struct library_symbol *sym, *next;
559 for (sym = lte->arch.stubs; sym != NULL; ) {
561 library_symbol_destroy(sym);
565 lte->arch.stubs = NULL;
569 const char *name = lte->strtab + sym.st_name;
571 #define STUBN ".plt_call."
572 if ((name = strstr(name, STUBN)) == NULL)
574 name += sizeof(STUBN) - 1;
578 const char *ver = strchr(name, '@');
583 /* If there is "+" at all, check that
584 * the symbol name ends in "+0". */
585 const char *add = strrchr(name, '+');
587 assert(strcmp(add, "+0") == 0);
594 char *sym_name = strndup(name, len);
595 struct library_symbol *libsym = malloc(sizeof(*libsym));
596 if (sym_name == NULL || libsym == NULL) {
603 /* XXX The double cast should be removed when
604 * arch_addr_t becomes integral type. */
605 arch_addr_t addr = (arch_addr_t)
606 (uintptr_t)sym.st_value + lte->bias;
607 if (library_symbol_init(libsym, addr, sym_name, 1,
610 libsym->arch.type = PPC64_PLT_STUB;
611 libsym->next = lte->arch.stubs;
612 lte->arch.stubs = libsym;
620 read_plt_slot_value(struct process *proc, GElf_Addr addr, GElf_Addr *valp)
622 /* On PPC64, we read from .plt, which contains 8 byte
623 * addresses. On PPC32 we read from .plt, which contains 4
624 * byte instructions, but the PLT is two instructions, and
625 * either can change. */
627 /* XXX double cast. */
628 if (proc_read_64(proc, (arch_addr_t)(uintptr_t)addr, &l) < 0) {
629 debug(DEBUG_EVENT, "ptrace .plt slot value @%#" PRIx64": %s",
630 addr, strerror(errno));
634 *valp = (GElf_Addr)l;
639 unresolve_plt_slot(struct process *proc, GElf_Addr addr, GElf_Addr value)
641 /* We only modify plt_entry[0], which holds the resolved
642 * address of the routine. We keep the TOC and environment
643 * pointers intact. Hence the only adjustment that we need to
645 if (ptrace(PTRACE_POKETEXT, proc->pid, addr, value) < 0) {
646 debug(DEBUG_EVENT, "failed to unresolve .plt slot: %s",
654 arch_elf_add_func_entry(struct process *proc, struct ltelf *lte,
656 arch_addr_t addr, const char *name,
657 struct library_symbol **ret)
659 #ifndef PPC64_LOCAL_ENTRY_OFFSET
660 assert(! lte->arch.elfv2_abi);
662 /* With ABIv2 st_other field contains an offset. */
663 if (lte->arch.elfv2_abi)
664 addr += PPC64_LOCAL_ENTRY_OFFSET(sym->st_other);
667 int st_info = GELF_ST_TYPE(sym->st_info);
669 if ((lte->ehdr.e_machine != EM_PPC && sym->st_other == 0)
670 || lte->ehdr.e_type == ET_DYN
671 || (st_info == STT_FUNC && ! sym->st_other))
674 if (st_info == STT_FUNC) {
675 /* Put the default symbol to the chain.
676 * The addr has already been updated with
678 char *full_name = strdup(name);
679 if (full_name == NULL) {
680 fprintf(stderr, "couldn't copy name of %s: %s\n",
681 name, strerror(errno));
685 struct library_symbol *libsym = malloc(sizeof *libsym);
687 || library_symbol_init(libsym, addr, full_name, 1,
688 LS_TOPLT_NONE) < 0) {
690 delete_symbol_chain(libsym);
692 fprintf(stderr, "Couldn't add symbol %s"
693 "for tracing.\n", name);
703 ifunc = GELF_ST_TYPE(sym->st_info) == STT_GNU_IFUNC;
708 size_t len = vect_size(<e->plt_relocs);
710 for (i = 0; i < len; ++i) {
711 GElf_Rela *rela = VECT_ELEMENT(<e->plt_relocs, GElf_Rela, i);
712 if (sym->st_value == arch_plt_sym_val(lte, i, rela)) {
714 char *tmp_name = linux_append_IFUNC_to_name(name);
715 struct library_symbol *libsym = malloc(sizeof *libsym);
717 /* XXX double cast. */
718 arch_addr_t resolver_addr
719 = (arch_addr_t) (uintptr_t) rela->r_addend;
721 if (tmp_name == NULL || libsym == NULL
722 || library_symbol_init(libsym, resolver_addr,
724 LS_TOPLT_EXEC) < 0) {
731 if (elf_add_plt_entry(proc, lte, name, rela,
733 library_symbol_destroy(libsym);
737 libsym->proto = linux_IFUNC_prototype();
748 struct ppc_unresolve_data {
749 struct ppc_unresolve_data *self; /* A canary. */
750 GElf_Addr plt_entry_addr;
751 GElf_Addr plt_slot_addr;
752 GElf_Addr plt_slot_value;
757 arch_elf_add_plt_entry(struct process *proc, struct ltelf *lte,
758 const char *a_name, GElf_Rela *rela, size_t ndx,
759 struct library_symbol **ret)
761 bool is_irelative = reloc_is_irelative(lte->ehdr.e_machine, rela);
763 if (! is_irelative) {
764 name = strdup(a_name);
766 GElf_Addr addr = lte->ehdr.e_machine == EM_PPC64
767 ? (GElf_Addr) rela->r_addend
768 : arch_plt_sym_val(lte, ndx, rela);
769 name = linux_elf_find_irelative_name(lte, addr);
778 struct library_symbol *chain = NULL;
779 if (lte->ehdr.e_machine == EM_PPC) {
780 if (default_elf_add_plt_entry(proc, lte, name, rela, ndx,
784 if (! lte->arch.secure_plt) {
785 /* On PPC32 with BSS PLT, delay the symbol
786 * until dynamic linker is done. */
787 assert(!chain->delayed);
797 /* PPC64. If we have stubs, we return a chain of breakpoint
798 * sites, one for each stub that corresponds to this PLT
800 struct library_symbol **symp;
801 for (symp = <e->arch.stubs; *symp != NULL; ) {
802 struct library_symbol *sym = *symp;
803 if (strcmp(sym->name, name) != 0) {
804 symp = &(*symp)->next;
808 /* Re-chain the symbol from stubs to CHAIN. */
817 /* We don't have stub symbols. Find corresponding .plt slot,
818 * and check whether it contains the corresponding PLT address
819 * (or 0 if the dynamic linker hasn't run yet). N.B. we don't
820 * want read this from ELF file, but from process image. That
821 * makes a difference if we are attaching to a running
824 GElf_Addr plt_entry_addr = arch_plt_sym_val(lte, ndx, rela);
825 GElf_Addr plt_slot_addr = rela->r_offset;
827 assert(plt_slot_addr >= lte->plt_addr
828 || plt_slot_addr < lte->plt_addr + lte->plt_size);
830 /* Should avoid to do read if dynamic linker hasn't run yet
831 * or allow -1 a valid return code. */
832 GElf_Addr plt_slot_value;
833 if (read_plt_slot_value(proc, plt_slot_addr, &plt_slot_value) < 0) {
834 if (!lte->arch.elfv2_abi)
837 return PPC_PLT_UNRESOLVED;
840 struct library_symbol *libsym = malloc(sizeof(*libsym));
841 if (libsym == NULL) {
842 fprintf(stderr, "allocation for .plt slot: %s\n",
849 /* XXX The double cast should be removed when
850 * arch_addr_t becomes integral type. */
851 if (library_symbol_init(libsym,
852 (arch_addr_t) (uintptr_t) plt_entry_addr,
853 name, 1, LS_TOPLT_EXEC) < 0)
855 libsym->arch.plt_slot_addr = plt_slot_addr;
858 && (plt_slot_value == plt_entry_addr || plt_slot_value == 0)) {
859 libsym->arch.type = PPC_PLT_UNRESOLVED;
860 libsym->arch.resolved_value = plt_entry_addr;
862 /* Mark the symbol for later unresolving. We may not
863 * do this right away, as this is called by ltrace
864 * core for all symbols, and only later filtered. We
865 * only unresolve the symbol before the breakpoint is
868 libsym->arch.type = PPC_PLT_NEED_UNRESOLVE;
869 libsym->arch.data = malloc(sizeof *libsym->arch.data);
870 if (libsym->arch.data == NULL)
873 libsym->arch.data->self = libsym->arch.data;
874 libsym->arch.data->plt_entry_addr = plt_entry_addr;
875 libsym->arch.data->plt_slot_addr = plt_slot_addr;
876 libsym->arch.data->plt_slot_value = plt_slot_value;
877 libsym->arch.data->is_irelative = is_irelative;
885 arch_elf_destroy(struct ltelf *lte)
887 struct library_symbol *sym;
888 for (sym = lte->arch.stubs; sym != NULL; ) {
889 struct library_symbol *next = sym->next;
890 library_symbol_destroy(sym);
897 dl_plt_update_bp_on_hit(struct breakpoint *bp, struct process *proc)
899 debug(DEBUG_PROCESS, "pid=%d dl_plt_update_bp_on_hit %s(%p)",
900 proc->pid, breakpoint_name(bp), bp->addr);
901 struct process_stopping_handler *self = proc->arch.handler;
902 assert(self != NULL);
904 struct library_symbol *libsym = self->breakpoint_being_enabled->libsym;
906 if (read_plt_slot_value(proc, libsym->arch.plt_slot_addr, &value) < 0)
909 /* On PPC64, we rewrite the slot value. */
910 if (proc->e_machine == EM_PPC64)
911 unresolve_plt_slot(proc, libsym->arch.plt_slot_addr,
912 libsym->arch.resolved_value);
913 /* We mark the breakpoint as resolved on both arches. */
914 mark_as_resolved(libsym, value);
916 /* cb_on_all_stopped looks if HANDLER is set to NULL as a way
917 * to check that this was run. It's an error if it
919 proc->arch.handler = NULL;
921 breakpoint_turn_off(bp, proc);
925 cb_on_all_stopped(struct process_stopping_handler *self)
927 /* Put that in for dl_plt_update_bp_on_hit to see. */
928 assert(self->task_enabling_breakpoint->arch.handler == NULL);
929 self->task_enabling_breakpoint->arch.handler = self;
931 linux_ptrace_disable_and_continue(self);
934 static enum callback_status
935 cb_keep_stepping_p(struct process_stopping_handler *self)
937 struct process *proc = self->task_enabling_breakpoint;
938 struct library_symbol *libsym = self->breakpoint_being_enabled->libsym;
941 if (read_plt_slot_value(proc, libsym->arch.plt_slot_addr, &value) < 0)
944 /* In UNRESOLVED state, the RESOLVED_VALUE in fact contains
945 * the PLT entry value. */
946 if (value == libsym->arch.resolved_value)
949 debug(DEBUG_PROCESS, "pid=%d PLT got resolved to value %#"PRIx64,
952 /* The .plt slot got resolved! We can migrate the breakpoint
953 * to RESOLVED and stop single-stepping. */
954 if (proc->e_machine == EM_PPC64
955 && unresolve_plt_slot(proc, libsym->arch.plt_slot_addr,
956 libsym->arch.resolved_value) < 0)
959 /* Resolving on PPC64 consists of overwriting a doubleword in
960 * .plt. That doubleword is than read back by a stub, and
961 * jumped on. Hopefully we can assume that double word update
962 * is done on a single place only, as it contains a final
963 * address. We still need to look around for any sync
964 * instruction, but essentially it is safe to optimize away
965 * the single stepping next time and install a post-update
968 * The situation on PPC32 BSS is more complicated. The
969 * dynamic linker here updates potentially several
970 * instructions (XXX currently we assume two) and the rules
971 * are more complicated. Sometimes it's enough to adjust just
972 * one of the addresses--the logic for generating optimal
973 * dispatch depends on relative addresses of the .plt entry
974 * and the jump destination. We can't assume that the some
975 * instruction block does the update every time. So on PPC32,
976 * we turn the optimization off and just step through it each
978 if (proc->e_machine == EM_PPC)
981 /* Install breakpoint to the address where the change takes
982 * place. If we fail, then that just means that we'll have to
983 * singlestep the next time around as well. */
984 struct process *leader = proc->leader;
985 if (leader == NULL || leader->arch.dl_plt_update_bp != NULL)
988 /* We need to install to the next instruction. ADDR points to
989 * a store instruction, so moving the breakpoint one
990 * instruction forward is safe. */
991 arch_addr_t addr = get_instruction_pointer(proc) + 4;
992 leader->arch.dl_plt_update_bp = insert_breakpoint_at(proc, addr, NULL);
993 if (leader->arch.dl_plt_update_bp == NULL)
996 static struct bp_callbacks dl_plt_update_cbs = {
997 .on_hit = dl_plt_update_bp_on_hit,
999 leader->arch.dl_plt_update_bp->cbs = &dl_plt_update_cbs;
1001 /* Turn it off for now. We will turn it on again when we hit
1002 * the PLT entry that needs this. */
1003 breakpoint_turn_off(leader->arch.dl_plt_update_bp, proc);
1006 mark_as_resolved(libsym, value);
1012 jump_to_entry_point(struct process *proc, struct breakpoint *bp)
1014 /* XXX The double cast should be removed when
1015 * arch_addr_t becomes integral type. */
1016 arch_addr_t rv = (arch_addr_t)
1017 (uintptr_t)bp->libsym->arch.resolved_value;
1018 set_instruction_pointer(proc, rv);
1022 ppc_plt_bp_continue(struct breakpoint *bp, struct process *proc)
1024 /* If this is a first call through IREL breakpoint, enable the
1025 * symbol so that it doesn't look like an artificial
1026 * breakpoint anymore. */
1027 if (bp->libsym == NULL) {
1028 assert(bp->arch.irel_libsym != NULL);
1029 bp->libsym = bp->arch.irel_libsym;
1030 bp->arch.irel_libsym = NULL;
1033 switch (bp->libsym->arch.type) {
1034 struct process *leader;
1035 void (*on_all_stopped)(struct process_stopping_handler *);
1036 enum callback_status (*keep_stepping_p)
1037 (struct process_stopping_handler *);
1040 assert(proc->e_machine == EM_PPC);
1041 assert(bp->libsym != NULL);
1042 assert(bp->libsym->lib->arch.bss_plt_prelinked == 0);
1045 case PPC_PLT_IRELATIVE:
1046 case PPC_PLT_UNRESOLVED:
1047 on_all_stopped = NULL;
1048 keep_stepping_p = NULL;
1049 leader = proc->leader;
1051 if (leader != NULL && leader->arch.dl_plt_update_bp != NULL
1052 && breakpoint_turn_on(leader->arch.dl_plt_update_bp,
1054 on_all_stopped = cb_on_all_stopped;
1056 keep_stepping_p = cb_keep_stepping_p;
1058 if (process_install_stopping_handler
1059 (proc, bp, on_all_stopped, keep_stepping_p, NULL) < 0) {
1060 fprintf(stderr, "ppc_plt_bp_continue: "
1061 "couldn't install event handler\n");
1062 continue_after_breakpoint(proc, bp);
1066 case PPC_PLT_RESOLVED:
1067 if (proc->e_machine == EM_PPC) {
1068 continue_after_breakpoint(proc, bp);
1073 continue_after_breakpoint(proc, bp);
1075 jump_to_entry_point(proc, bp);
1076 continue_process(proc->pid);
1080 case PPC64_PLT_STUB:
1081 case PPC_PLT_NEED_UNRESOLVE:
1082 /* These should never hit here. */
1086 assert(bp->libsym->arch.type != bp->libsym->arch.type);
1090 /* When a process is in a PLT stub, it may have already read the data
1091 * in .plt that we changed. If we detach now, it will jump to PLT
1092 * entry and continue to the dynamic linker, where it will SIGSEGV,
1093 * because zeroth .plt slot is not filled in prelinked binaries, and
1094 * the dynamic linker needs that data. Moreover, the process may
1095 * actually have hit the breakpoint already. This functions tries to
1096 * detect both cases and do any fix-ups necessary to mend this
1098 static enum callback_status
1099 detach_task_cb(struct process *task, void *data)
1101 struct breakpoint *bp = data;
1103 if (get_instruction_pointer(task) == bp->addr) {
1104 debug(DEBUG_PROCESS, "%d at %p, which is PLT slot",
1105 task->pid, bp->addr);
1106 jump_to_entry_point(task, bp);
1110 /* XXX There's still a window of several instructions where we
1111 * might catch the task inside a stub such that it has already
1112 * read destination address from .plt, but hasn't jumped yet,
1113 * thus avoiding the breakpoint. */
1119 ppc_plt_bp_retract(struct breakpoint *bp, struct process *proc)
1121 /* On PPC64, we rewrite .plt with PLT entry addresses. This
1122 * needs to be undone. Unfortunately, the program may have
1123 * made decisions based on that value */
1124 if (proc->e_machine == EM_PPC64
1125 && bp->libsym != NULL
1126 && bp->libsym->arch.type == PPC_PLT_RESOLVED) {
1127 each_task(proc->leader, NULL, detach_task_cb, bp);
1128 unresolve_plt_slot(proc, bp->libsym->arch.plt_slot_addr,
1129 bp->libsym->arch.resolved_value);
1134 ppc_plt_bp_install(struct breakpoint *bp, struct process *proc)
1136 /* This should not be an artificial breakpoint. */
1137 struct library_symbol *libsym = bp->libsym;
1139 libsym = bp->arch.irel_libsym;
1140 assert(libsym != NULL);
1142 if (libsym->arch.type == PPC_PLT_NEED_UNRESOLVE) {
1143 /* Unresolve the .plt slot. If the binary was
1144 * prelinked, this makes the code invalid, because in
1145 * case of prelinked binary, the dynamic linker
1146 * doesn't update .plt[0] and .plt[1] with addresses
1147 * of the resover. But we don't care, we will never
1148 * need to enter the resolver. That just means that
1149 * we have to un-un-resolve this back before we
1152 struct ppc_unresolve_data *data = libsym->arch.data;
1153 libsym->arch.data = NULL;
1154 assert(data->self == data);
1156 GElf_Addr plt_slot_addr = data->plt_slot_addr;
1157 GElf_Addr plt_slot_value = data->plt_slot_value;
1158 GElf_Addr plt_entry_addr = data->plt_entry_addr;
1160 if (unresolve_plt_slot(proc, plt_slot_addr,
1161 plt_entry_addr) == 0) {
1162 if (! data->is_irelative) {
1163 mark_as_resolved(libsym, plt_slot_value);
1165 libsym->arch.type = PPC_PLT_IRELATIVE;
1166 libsym->arch.resolved_value = plt_entry_addr;
1169 fprintf(stderr, "Couldn't unresolve %s@%p. Not tracing"
1171 breakpoint_name(bp), bp->addr);
1172 proc_remove_breakpoint(proc, bp);
1180 arch_library_init(struct library *lib)
1186 arch_library_destroy(struct library *lib)
1191 arch_library_clone(struct library *retp, struct library *lib)
1197 arch_library_symbol_init(struct library_symbol *libsym)
1199 /* We set type explicitly in the code above, where we have the
1200 * necessary context. This is for calls from ltrace-elf.c and
1203 libsym->arch.type = PPC_PLT_UNRESOLVED;
1205 libsym->arch.type = PPC_DEFAULT;
1211 arch_library_symbol_destroy(struct library_symbol *libsym)
1213 if (libsym->arch.type == PPC_PLT_NEED_UNRESOLVE) {
1214 assert(libsym->arch.data->self == libsym->arch.data);
1215 free(libsym->arch.data);
1216 libsym->arch.data = NULL;
1221 arch_library_symbol_clone(struct library_symbol *retp,
1222 struct library_symbol *libsym)
1224 retp->arch = libsym->arch;
1228 /* For some symbol types, we need to set up custom callbacks. XXX we
1229 * don't need PROC here, we can store the data in BP if it is of
1230 * interest to us. */
1232 arch_breakpoint_init(struct process *proc, struct breakpoint *bp)
1234 bp->arch.irel_libsym = NULL;
1236 /* Artificial and entry-point breakpoints are plain. */
1237 if (bp->libsym == NULL || bp->libsym->plt_type != LS_TOPLT_EXEC)
1240 /* On PPC, secure PLT and prelinked BSS PLT are plain. */
1241 if (proc->e_machine == EM_PPC
1242 && bp->libsym->lib->arch.bss_plt_prelinked != 0)
1245 /* On PPC64, stub PLT breakpoints are plain. */
1246 if (proc->e_machine == EM_PPC64
1247 && bp->libsym->arch.type == PPC64_PLT_STUB)
1250 static struct bp_callbacks cbs = {
1251 .on_continue = ppc_plt_bp_continue,
1252 .on_retract = ppc_plt_bp_retract,
1253 .on_install = ppc_plt_bp_install,
1255 breakpoint_set_callbacks(bp, &cbs);
1257 /* For JMP_IREL breakpoints, make the breakpoint look
1258 * artificial by hiding the symbol. */
1259 if (bp->libsym->arch.type == PPC_PLT_IRELATIVE) {
1260 bp->arch.irel_libsym = bp->libsym;
1268 arch_breakpoint_destroy(struct breakpoint *bp)
1273 arch_breakpoint_clone(struct breakpoint *retp, struct breakpoint *sbp)
1275 retp->arch = sbp->arch;
1280 arch_process_init(struct process *proc)
1282 proc->arch.dl_plt_update_bp = NULL;
1283 proc->arch.handler = NULL;
1288 arch_process_destroy(struct process *proc)
1293 arch_process_clone(struct process *retp, struct process *proc)
1295 retp->arch = proc->arch;
1297 if (retp->arch.dl_plt_update_bp != NULL) {
1298 /* Point it to the corresponding breakpoint in RETP.
1299 * It must be there, this part of PROC has already
1300 * been cloned to RETP. */
1301 retp->arch.dl_plt_update_bp
1302 = address2bpstruct(retp,
1303 retp->arch.dl_plt_update_bp->addr);
1305 assert(retp->arch.dl_plt_update_bp != NULL);
1312 arch_process_exec(struct process *proc)
1314 return arch_process_init(proc);