1/* On-demand PLT fixup for shared objects.
2 Copyright (C) 1995-2018 Free Software Foundation, Inc.
3 This file is part of the GNU C Library.
4
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
9
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
14
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, see
17 <http://www.gnu.org/licenses/>. */
18
19#define IN_DL_RUNTIME 1 /* This can be tested in dl-machine.h. */
20
21#include <alloca.h>
22#include <stdlib.h>
23#include <unistd.h>
24#include <sys/param.h>
25#include <ldsodefs.h>
26#include <sysdep-cancel.h>
27#include "dynamic-link.h"
28#include <tls.h>
29#include <dl-irel.h>
30
31
32#if (!ELF_MACHINE_NO_RELA && !defined ELF_MACHINE_PLT_REL) \
33 || ELF_MACHINE_NO_REL
34# define PLTREL ElfW(Rela)
35#else
36# define PLTREL ElfW(Rel)
37#endif
38
39/* The fixup functions might have need special attributes. If none
40 are provided define the macro as empty. */
41#ifndef ARCH_FIXUP_ATTRIBUTE
42# define ARCH_FIXUP_ATTRIBUTE
43#endif
44
45#ifndef reloc_offset
46# define reloc_offset reloc_arg
47# define reloc_index reloc_arg / sizeof (PLTREL)
48#endif
49
50
51
52/* This function is called through a special trampoline from the PLT the
53 first time each PLT entry is called. We must perform the relocation
54 specified in the PLT of the given shared object, and return the resolved
55 function address to the trampoline, which will restart the original call
56 to that address. Future calls will bounce directly from the PLT to the
57 function. */
58
59DL_FIXUP_VALUE_TYPE
60attribute_hidden __attribute ((noinline)) ARCH_FIXUP_ATTRIBUTE
61_dl_fixup (
62# ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS
63 ELF_MACHINE_RUNTIME_FIXUP_ARGS,
64# endif
65 struct link_map *l, ElfW(Word) reloc_arg)
66{
67 const ElfW(Sym) *const symtab
68 = (const void *) D_PTR (l, l_info[DT_SYMTAB]);
69 const char *strtab = (const void *) D_PTR (l, l_info[DT_STRTAB]);
70
71 const PLTREL *const reloc
72 = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset);
73 const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)];
74 const ElfW(Sym) *refsym = sym;
75 void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);
76 lookup_t result;
77 DL_FIXUP_VALUE_TYPE value;
78
79 /* Sanity check that we're really looking at a PLT relocation. */
80 assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT);
81
82 /* Look up the target symbol. If the normal lookup rules are not
83 used don't look in the global scope. */
84 if (__builtin_expect (ELFW(ST_VISIBILITY) (sym->st_other), 0) == 0)
85 {
86 const struct r_found_version *version = NULL;
87
88 if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
89 {
90 const ElfW(Half) *vernum =
91 (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]);
92 ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
93 version = &l->l_versions[ndx];
94 if (version->hash == 0)
95 version = NULL;
96 }
97
98 /* We need to keep the scope around so do some locking. This is
99 not necessary for objects which cannot be unloaded or when
100 we are not using any threads (yet). */
101 int flags = DL_LOOKUP_ADD_DEPENDENCY;
102 if (!RTLD_SINGLE_THREAD_P)
103 {
104 THREAD_GSCOPE_SET_FLAG ();
105 flags |= DL_LOOKUP_GSCOPE_LOCK;
106 }
107
108#ifdef RTLD_ENABLE_FOREIGN_CALL
109 RTLD_ENABLE_FOREIGN_CALL;
110#endif
111
112 result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope,
113 version, ELF_RTYPE_CLASS_PLT, flags, NULL);
114
115 /* We are done with the global scope. */
116 if (!RTLD_SINGLE_THREAD_P)
117 THREAD_GSCOPE_RESET_FLAG ();
118
119#ifdef RTLD_FINALIZE_FOREIGN_CALL
120 RTLD_FINALIZE_FOREIGN_CALL;
121#endif
122
123 /* Currently result contains the base load address (or link map)
124 of the object that defines sym. Now add in the symbol
125 offset. */
126 value = DL_FIXUP_MAKE_VALUE (result,
127 sym ? (LOOKUP_VALUE_ADDRESS (result)
128 + sym->st_value) : 0);
129 }
130 else
131 {
132 /* We already found the symbol. The module (and therefore its load
133 address) is also known. */
134 value = DL_FIXUP_MAKE_VALUE (l, l->l_addr + sym->st_value);
135 result = l;
136 }
137
138 /* And now perhaps the relocation addend. */
139 value = elf_machine_plt_value (l, reloc, value);
140
141 if (sym != NULL
142 && __builtin_expect (ELFW(ST_TYPE) (sym->st_info) == STT_GNU_IFUNC, 0))
143 value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));
144
145 /* Finally, fix up the plt itself. */
146 if (__glibc_unlikely (GLRO(dl_bind_not)))
147 return value;
148
149 return elf_machine_fixup_plt (l, result, refsym, sym, reloc, rel_addr, value);
150}
151
152#ifndef PROF
153DL_FIXUP_VALUE_TYPE
154__attribute ((noinline)) ARCH_FIXUP_ATTRIBUTE
155_dl_profile_fixup (
156#ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS
157 ELF_MACHINE_RUNTIME_FIXUP_ARGS,
158#endif
159 struct link_map *l, ElfW(Word) reloc_arg,
160 ElfW(Addr) retaddr, void *regs, long int *framesizep)
161{
162 void (*mcount_fct) (ElfW(Addr), ElfW(Addr)) = _dl_mcount;
163
164 if (l->l_reloc_result == NULL)
165 {
166 /* BZ #14843: ELF_DYNAMIC_RELOCATE is called before l_reloc_result
167 is allocated. We will get here if ELF_DYNAMIC_RELOCATE calls a
168 resolver function to resolve an IRELATIVE relocation and that
169 resolver calls a function that is not yet resolved (lazy). For
170 example, the resolver in x86-64 libm.so calls __get_cpu_features
171 defined in libc.so. Skip audit and resolve the external function
172 in this case. */
173 *framesizep = -1;
174 return _dl_fixup (
175# ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS
176# ifndef ELF_MACHINE_RUNTIME_FIXUP_PARAMS
177# error Please define ELF_MACHINE_RUNTIME_FIXUP_PARAMS.
178# endif
179 ELF_MACHINE_RUNTIME_FIXUP_PARAMS,
180# endif
181 l, reloc_arg);
182 }
183
184 /* This is the address in the array where we store the result of previous
185 relocations. */
186 struct reloc_result *reloc_result = &l->l_reloc_result[reloc_index];
187 DL_FIXUP_VALUE_TYPE *resultp = &reloc_result->addr;
188
189 DL_FIXUP_VALUE_TYPE value = *resultp;
190 if (DL_FIXUP_VALUE_CODE_ADDR (value) == 0)
191 {
192 /* This is the first time we have to relocate this object. */
193 const ElfW(Sym) *const symtab
194 = (const void *) D_PTR (l, l_info[DT_SYMTAB]);
195 const char *strtab = (const char *) D_PTR (l, l_info[DT_STRTAB]);
196
197 const PLTREL *const reloc
198 = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset);
199 const ElfW(Sym) *refsym = &symtab[ELFW(R_SYM) (reloc->r_info)];
200 const ElfW(Sym) *defsym = refsym;
201 lookup_t result;
202
203 /* Sanity check that we're really looking at a PLT relocation. */
204 assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT);
205
206 /* Look up the target symbol. If the symbol is marked STV_PROTECTED
207 don't look in the global scope. */
208 if (__builtin_expect (ELFW(ST_VISIBILITY) (refsym->st_other), 0) == 0)
209 {
210 const struct r_found_version *version = NULL;
211
212 if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
213 {
214 const ElfW(Half) *vernum =
215 (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]);
216 ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
217 version = &l->l_versions[ndx];
218 if (version->hash == 0)
219 version = NULL;
220 }
221
222 /* We need to keep the scope around so do some locking. This is
223 not necessary for objects which cannot be unloaded or when
224 we are not using any threads (yet). */
225 int flags = DL_LOOKUP_ADD_DEPENDENCY;
226 if (!RTLD_SINGLE_THREAD_P)
227 {
228 THREAD_GSCOPE_SET_FLAG ();
229 flags |= DL_LOOKUP_GSCOPE_LOCK;
230 }
231
232 result = _dl_lookup_symbol_x (strtab + refsym->st_name, l,
233 &defsym, l->l_scope, version,
234 ELF_RTYPE_CLASS_PLT, flags, NULL);
235
236 /* We are done with the global scope. */
237 if (!RTLD_SINGLE_THREAD_P)
238 THREAD_GSCOPE_RESET_FLAG ();
239
240 /* Currently result contains the base load address (or link map)
241 of the object that defines sym. Now add in the symbol
242 offset. */
243 value = DL_FIXUP_MAKE_VALUE (result,
244 defsym != NULL
245 ? LOOKUP_VALUE_ADDRESS (result)
246 + defsym->st_value : 0);
247
248 if (defsym != NULL
249 && __builtin_expect (ELFW(ST_TYPE) (defsym->st_info)
250 == STT_GNU_IFUNC, 0))
251 value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));
252 }
253 else
254 {
255 /* We already found the symbol. The module (and therefore its load
256 address) is also known. */
257 value = DL_FIXUP_MAKE_VALUE (l, l->l_addr + refsym->st_value);
258
259 if (__builtin_expect (ELFW(ST_TYPE) (refsym->st_info)
260 == STT_GNU_IFUNC, 0))
261 value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));
262
263 result = l;
264 }
265 /* And now perhaps the relocation addend. */
266 value = elf_machine_plt_value (l, reloc, value);
267
268#ifdef SHARED
269 /* Auditing checkpoint: we have a new binding. Provide the
270 auditing libraries the possibility to change the value and
271 tell us whether further auditing is wanted. */
272 if (defsym != NULL && GLRO(dl_naudit) > 0)
273 {
274 reloc_result->bound = result;
275 /* Compute index of the symbol entry in the symbol table of
276 the DSO with the definition. */
277 reloc_result->boundndx = (defsym
278 - (ElfW(Sym) *) D_PTR (result,
279 l_info[DT_SYMTAB]));
280
281 /* Determine whether any of the two participating DSOs is
282 interested in auditing. */
283 if ((l->l_audit_any_plt | result->l_audit_any_plt) != 0)
284 {
285 unsigned int flags = 0;
286 struct audit_ifaces *afct = GLRO(dl_audit);
287 /* Synthesize a symbol record where the st_value field is
288 the result. */
289 ElfW(Sym) sym = *defsym;
290 sym.st_value = DL_FIXUP_VALUE_ADDR (value);
291
292 /* Keep track whether there is any interest in tracing
293 the call in the lower two bits. */
294 assert (DL_NNS * 2 <= sizeof (reloc_result->flags) * 8);
295 assert ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT) == 3);
296 reloc_result->enterexit = LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT;
297
298 const char *strtab2 = (const void *) D_PTR (result,
299 l_info[DT_STRTAB]);
300
301 for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
302 {
303 /* XXX Check whether both DSOs must request action or
304 only one */
305 if ((l->l_audit[cnt].bindflags & LA_FLG_BINDFROM) != 0
306 && (result->l_audit[cnt].bindflags & LA_FLG_BINDTO) != 0)
307 {
308 if (afct->symbind != NULL)
309 {
310 uintptr_t new_value
311 = afct->symbind (&sym, reloc_result->boundndx,
312 &l->l_audit[cnt].cookie,
313 &result->l_audit[cnt].cookie,
314 &flags,
315 strtab2 + defsym->st_name);
316 if (new_value != (uintptr_t) sym.st_value)
317 {
318 flags |= LA_SYMB_ALTVALUE;
319 sym.st_value = new_value;
320 }
321 }
322
323 /* Remember the results for every audit library and
324 store a summary in the first two bits. */
325 reloc_result->enterexit
326 &= flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT);
327 reloc_result->enterexit
328 |= ((flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT))
329 << ((cnt + 1) * 2));
330 }
331 else
332 /* If the bind flags say this auditor is not interested,
333 set the bits manually. */
334 reloc_result->enterexit
335 |= ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)
336 << ((cnt + 1) * 2));
337
338 afct = afct->next;
339 }
340
341 reloc_result->flags = flags;
342 value = DL_FIXUP_ADDR_VALUE (sym.st_value);
343 }
344 else
345 /* Set all bits since this symbol binding is not interesting. */
346 reloc_result->enterexit = (1u << DL_NNS) - 1;
347 }
348#endif
349
350 /* Store the result for later runs. */
351 if (__glibc_likely (! GLRO(dl_bind_not)))
352 *resultp = value;
353 }
354
355 /* By default we do not call the pltexit function. */
356 long int framesize = -1;
357
358#ifdef SHARED
359 /* Auditing checkpoint: report the PLT entering and allow the
360 auditors to change the value. */
361 if (DL_FIXUP_VALUE_CODE_ADDR (value) != 0 && GLRO(dl_naudit) > 0
362 /* Don't do anything if no auditor wants to intercept this call. */
363 && (reloc_result->enterexit & LA_SYMB_NOPLTENTER) == 0)
364 {
365 ElfW(Sym) *defsym = ((ElfW(Sym) *) D_PTR (reloc_result->bound,
366 l_info[DT_SYMTAB])
367 + reloc_result->boundndx);
368
369 /* Set up the sym parameter. */
370 ElfW(Sym) sym = *defsym;
371 sym.st_value = DL_FIXUP_VALUE_ADDR (value);
372
373 /* Get the symbol name. */
374 const char *strtab = (const void *) D_PTR (reloc_result->bound,
375 l_info[DT_STRTAB]);
376 const char *symname = strtab + sym.st_name;
377
378 /* Keep track of overwritten addresses. */
379 unsigned int flags = reloc_result->flags;
380
381 struct audit_ifaces *afct = GLRO(dl_audit);
382 for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
383 {
384 if (afct->ARCH_LA_PLTENTER != NULL
385 && (reloc_result->enterexit
386 & (LA_SYMB_NOPLTENTER << (2 * (cnt + 1)))) == 0)
387 {
388 long int new_framesize = -1;
389 uintptr_t new_value
390 = afct->ARCH_LA_PLTENTER (&sym, reloc_result->boundndx,
391 &l->l_audit[cnt].cookie,
392 &reloc_result->bound->l_audit[cnt].cookie,
393 regs, &flags, symname,
394 &new_framesize);
395 if (new_value != (uintptr_t) sym.st_value)
396 {
397 flags |= LA_SYMB_ALTVALUE;
398 sym.st_value = new_value;
399 }
400
401 /* Remember the results for every audit library and
402 store a summary in the first two bits. */
403 reloc_result->enterexit
404 |= ((flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT))
405 << (2 * (cnt + 1)));
406
407 if ((reloc_result->enterexit & (LA_SYMB_NOPLTEXIT
408 << (2 * (cnt + 1))))
409 == 0 && new_framesize != -1 && framesize != -2)
410 {
411 /* If this is the first call providing information,
412 use it. */
413 if (framesize == -1)
414 framesize = new_framesize;
415 /* If two pltenter calls provide conflicting information,
416 use the larger value. */
417 else if (new_framesize != framesize)
418 framesize = MAX (new_framesize, framesize);
419 }
420 }
421
422 afct = afct->next;
423 }
424
425 value = DL_FIXUP_ADDR_VALUE (sym.st_value);
426 }
427#endif
428
429 /* Store the frame size information. */
430 *framesizep = framesize;
431
432 (*mcount_fct) (retaddr, DL_FIXUP_VALUE_CODE_ADDR (value));
433
434 return value;
435}
436
437#endif /* PROF */
438
439
440#include <stdio.h>
441void
442ARCH_FIXUP_ATTRIBUTE
443_dl_call_pltexit (struct link_map *l, ElfW(Word) reloc_arg,
444 const void *inregs, void *outregs)
445{
446#ifdef SHARED
447 /* This is the address in the array where we store the result of previous
448 relocations. */
449 // XXX Maybe the bound information must be stored on the stack since
450 // XXX with bind_not a new value could have been stored in the meantime.
451 struct reloc_result *reloc_result = &l->l_reloc_result[reloc_index];
452 ElfW(Sym) *defsym = ((ElfW(Sym) *) D_PTR (reloc_result->bound,
453 l_info[DT_SYMTAB])
454 + reloc_result->boundndx);
455
456 /* Set up the sym parameter. */
457 ElfW(Sym) sym = *defsym;
458 sym.st_value = DL_FIXUP_VALUE_ADDR (reloc_result->addr);
459
460 /* Get the symbol name. */
461 const char *strtab = (const void *) D_PTR (reloc_result->bound,
462 l_info[DT_STRTAB]);
463 const char *symname = strtab + sym.st_name;
464
465 struct audit_ifaces *afct = GLRO(dl_audit);
466 for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
467 {
468 if (afct->ARCH_LA_PLTEXIT != NULL
469 && (reloc_result->enterexit
470 & (LA_SYMB_NOPLTEXIT >> (2 * cnt))) == 0)
471 {
472 afct->ARCH_LA_PLTEXIT (&sym, reloc_result->boundndx,
473 &l->l_audit[cnt].cookie,
474 &reloc_result->bound->l_audit[cnt].cookie,
475 inregs, outregs, symname);
476 }
477
478 afct = afct->next;
479 }
480#endif
481}
482