1 | /* On-demand PLT fixup for shared objects. |
2 | Copyright (C) 1995-2018 Free Software Foundation, Inc. |
3 | This file is part of the GNU C Library. |
4 | |
5 | The GNU C Library is free software; you can redistribute it and/or |
6 | modify it under the terms of the GNU Lesser General Public |
7 | License as published by the Free Software Foundation; either |
8 | version 2.1 of the License, or (at your option) any later version. |
9 | |
10 | The GNU C Library is distributed in the hope that it will be useful, |
11 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
13 | Lesser General Public License for more details. |
14 | |
15 | You should have received a copy of the GNU Lesser General Public |
16 | License along with the GNU C Library; if not, see |
17 | <http://www.gnu.org/licenses/>. */ |
18 | |
19 | #define IN_DL_RUNTIME 1 /* This can be tested in dl-machine.h. */ |
20 | |
21 | #include <alloca.h> |
22 | #include <stdlib.h> |
23 | #include <unistd.h> |
24 | #include <sys/param.h> |
25 | #include <ldsodefs.h> |
26 | #include <sysdep-cancel.h> |
27 | #include "dynamic-link.h" |
28 | #include <tls.h> |
29 | #include <dl-irel.h> |
30 | |
31 | |
32 | #if (!ELF_MACHINE_NO_RELA && !defined ELF_MACHINE_PLT_REL) \ |
33 | || ELF_MACHINE_NO_REL |
34 | # define PLTREL ElfW(Rela) |
35 | #else |
36 | # define PLTREL ElfW(Rel) |
37 | #endif |
38 | |
39 | /* The fixup functions might have need special attributes. If none |
40 | are provided define the macro as empty. */ |
41 | #ifndef ARCH_FIXUP_ATTRIBUTE |
42 | # define ARCH_FIXUP_ATTRIBUTE |
43 | #endif |
44 | |
45 | #ifndef reloc_offset |
46 | # define reloc_offset reloc_arg |
47 | # define reloc_index reloc_arg / sizeof (PLTREL) |
48 | #endif |
49 | |
50 | |
51 | |
52 | /* This function is called through a special trampoline from the PLT the |
53 | first time each PLT entry is called. We must perform the relocation |
54 | specified in the PLT of the given shared object, and return the resolved |
55 | function address to the trampoline, which will restart the original call |
56 | to that address. Future calls will bounce directly from the PLT to the |
57 | function. */ |
58 | |
59 | DL_FIXUP_VALUE_TYPE |
60 | attribute_hidden __attribute ((noinline)) ARCH_FIXUP_ATTRIBUTE |
61 | _dl_fixup ( |
62 | # ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS |
63 | ELF_MACHINE_RUNTIME_FIXUP_ARGS, |
64 | # endif |
65 | struct link_map *l, ElfW(Word) reloc_arg) |
66 | { |
67 | const ElfW(Sym) *const symtab |
68 | = (const void *) D_PTR (l, l_info[DT_SYMTAB]); |
69 | const char *strtab = (const void *) D_PTR (l, l_info[DT_STRTAB]); |
70 | |
71 | const PLTREL *const reloc |
72 | = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset); |
73 | const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)]; |
74 | const ElfW(Sym) *refsym = sym; |
75 | void *const rel_addr = (void *)(l->l_addr + reloc->r_offset); |
76 | lookup_t result; |
77 | DL_FIXUP_VALUE_TYPE value; |
78 | |
79 | /* Sanity check that we're really looking at a PLT relocation. */ |
80 | assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT); |
81 | |
82 | /* Look up the target symbol. If the normal lookup rules are not |
83 | used don't look in the global scope. */ |
84 | if (__builtin_expect (ELFW(ST_VISIBILITY) (sym->st_other), 0) == 0) |
85 | { |
86 | const struct r_found_version *version = NULL; |
87 | |
88 | if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL) |
89 | { |
90 | const ElfW(Half) *vernum = |
91 | (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]); |
92 | ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff; |
93 | version = &l->l_versions[ndx]; |
94 | if (version->hash == 0) |
95 | version = NULL; |
96 | } |
97 | |
98 | /* We need to keep the scope around so do some locking. This is |
99 | not necessary for objects which cannot be unloaded or when |
100 | we are not using any threads (yet). */ |
101 | int flags = DL_LOOKUP_ADD_DEPENDENCY; |
102 | if (!RTLD_SINGLE_THREAD_P) |
103 | { |
104 | THREAD_GSCOPE_SET_FLAG (); |
105 | flags |= DL_LOOKUP_GSCOPE_LOCK; |
106 | } |
107 | |
108 | #ifdef RTLD_ENABLE_FOREIGN_CALL |
109 | RTLD_ENABLE_FOREIGN_CALL; |
110 | #endif |
111 | |
112 | result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope, |
113 | version, ELF_RTYPE_CLASS_PLT, flags, NULL); |
114 | |
115 | /* We are done with the global scope. */ |
116 | if (!RTLD_SINGLE_THREAD_P) |
117 | THREAD_GSCOPE_RESET_FLAG (); |
118 | |
119 | #ifdef RTLD_FINALIZE_FOREIGN_CALL |
120 | RTLD_FINALIZE_FOREIGN_CALL; |
121 | #endif |
122 | |
123 | /* Currently result contains the base load address (or link map) |
124 | of the object that defines sym. Now add in the symbol |
125 | offset. */ |
126 | value = DL_FIXUP_MAKE_VALUE (result, |
127 | SYMBOL_ADDRESS (result, sym, false)); |
128 | } |
129 | else |
130 | { |
131 | /* We already found the symbol. The module (and therefore its load |
132 | address) is also known. */ |
133 | value = DL_FIXUP_MAKE_VALUE (l, SYMBOL_ADDRESS (l, sym, true)); |
134 | result = l; |
135 | } |
136 | |
137 | /* And now perhaps the relocation addend. */ |
138 | value = elf_machine_plt_value (l, reloc, value); |
139 | |
140 | if (sym != NULL |
141 | && __builtin_expect (ELFW(ST_TYPE) (sym->st_info) == STT_GNU_IFUNC, 0)) |
142 | value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value)); |
143 | |
144 | /* Finally, fix up the plt itself. */ |
145 | if (__glibc_unlikely (GLRO(dl_bind_not))) |
146 | return value; |
147 | |
148 | return elf_machine_fixup_plt (l, result, refsym, sym, reloc, rel_addr, value); |
149 | } |
150 | |
151 | #ifndef PROF |
152 | DL_FIXUP_VALUE_TYPE |
153 | __attribute ((noinline)) ARCH_FIXUP_ATTRIBUTE |
154 | _dl_profile_fixup ( |
155 | #ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS |
156 | ELF_MACHINE_RUNTIME_FIXUP_ARGS, |
157 | #endif |
158 | struct link_map *l, ElfW(Word) reloc_arg, |
159 | ElfW(Addr) retaddr, void *regs, long int *framesizep) |
160 | { |
161 | void (*mcount_fct) (ElfW(Addr), ElfW(Addr)) = _dl_mcount; |
162 | |
163 | if (l->l_reloc_result == NULL) |
164 | { |
165 | /* BZ #14843: ELF_DYNAMIC_RELOCATE is called before l_reloc_result |
166 | is allocated. We will get here if ELF_DYNAMIC_RELOCATE calls a |
167 | resolver function to resolve an IRELATIVE relocation and that |
168 | resolver calls a function that is not yet resolved (lazy). For |
169 | example, the resolver in x86-64 libm.so calls __get_cpu_features |
170 | defined in libc.so. Skip audit and resolve the external function |
171 | in this case. */ |
172 | *framesizep = -1; |
173 | return _dl_fixup ( |
174 | # ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS |
175 | # ifndef ELF_MACHINE_RUNTIME_FIXUP_PARAMS |
176 | # error Please define ELF_MACHINE_RUNTIME_FIXUP_PARAMS. |
177 | # endif |
178 | ELF_MACHINE_RUNTIME_FIXUP_PARAMS, |
179 | # endif |
180 | l, reloc_arg); |
181 | } |
182 | |
183 | /* This is the address in the array where we store the result of previous |
184 | relocations. */ |
185 | struct reloc_result *reloc_result = &l->l_reloc_result[reloc_index]; |
186 | DL_FIXUP_VALUE_TYPE *resultp = &reloc_result->addr; |
187 | |
188 | DL_FIXUP_VALUE_TYPE value = *resultp; |
189 | if (DL_FIXUP_VALUE_CODE_ADDR (value) == 0) |
190 | { |
191 | /* This is the first time we have to relocate this object. */ |
192 | const ElfW(Sym) *const symtab |
193 | = (const void *) D_PTR (l, l_info[DT_SYMTAB]); |
194 | const char *strtab = (const char *) D_PTR (l, l_info[DT_STRTAB]); |
195 | |
196 | const PLTREL *const reloc |
197 | = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset); |
198 | const ElfW(Sym) *refsym = &symtab[ELFW(R_SYM) (reloc->r_info)]; |
199 | const ElfW(Sym) *defsym = refsym; |
200 | lookup_t result; |
201 | |
202 | /* Sanity check that we're really looking at a PLT relocation. */ |
203 | assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT); |
204 | |
205 | /* Look up the target symbol. If the symbol is marked STV_PROTECTED |
206 | don't look in the global scope. */ |
207 | if (__builtin_expect (ELFW(ST_VISIBILITY) (refsym->st_other), 0) == 0) |
208 | { |
209 | const struct r_found_version *version = NULL; |
210 | |
211 | if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL) |
212 | { |
213 | const ElfW(Half) *vernum = |
214 | (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]); |
215 | ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff; |
216 | version = &l->l_versions[ndx]; |
217 | if (version->hash == 0) |
218 | version = NULL; |
219 | } |
220 | |
221 | /* We need to keep the scope around so do some locking. This is |
222 | not necessary for objects which cannot be unloaded or when |
223 | we are not using any threads (yet). */ |
224 | int flags = DL_LOOKUP_ADD_DEPENDENCY; |
225 | if (!RTLD_SINGLE_THREAD_P) |
226 | { |
227 | THREAD_GSCOPE_SET_FLAG (); |
228 | flags |= DL_LOOKUP_GSCOPE_LOCK; |
229 | } |
230 | |
231 | result = _dl_lookup_symbol_x (strtab + refsym->st_name, l, |
232 | &defsym, l->l_scope, version, |
233 | ELF_RTYPE_CLASS_PLT, flags, NULL); |
234 | |
235 | /* We are done with the global scope. */ |
236 | if (!RTLD_SINGLE_THREAD_P) |
237 | THREAD_GSCOPE_RESET_FLAG (); |
238 | |
239 | /* Currently result contains the base load address (or link map) |
240 | of the object that defines sym. Now add in the symbol |
241 | offset. */ |
242 | value = DL_FIXUP_MAKE_VALUE (result, |
243 | SYMBOL_ADDRESS (result, defsym, false)); |
244 | |
245 | if (defsym != NULL |
246 | && __builtin_expect (ELFW(ST_TYPE) (defsym->st_info) |
247 | == STT_GNU_IFUNC, 0)) |
248 | value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value)); |
249 | } |
250 | else |
251 | { |
252 | /* We already found the symbol. The module (and therefore its load |
253 | address) is also known. */ |
254 | value = DL_FIXUP_MAKE_VALUE (l, SYMBOL_ADDRESS (l, refsym, true)); |
255 | |
256 | if (__builtin_expect (ELFW(ST_TYPE) (refsym->st_info) |
257 | == STT_GNU_IFUNC, 0)) |
258 | value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value)); |
259 | |
260 | result = l; |
261 | } |
262 | /* And now perhaps the relocation addend. */ |
263 | value = elf_machine_plt_value (l, reloc, value); |
264 | |
265 | #ifdef SHARED |
266 | /* Auditing checkpoint: we have a new binding. Provide the |
267 | auditing libraries the possibility to change the value and |
268 | tell us whether further auditing is wanted. */ |
269 | if (defsym != NULL && GLRO(dl_naudit) > 0) |
270 | { |
271 | reloc_result->bound = result; |
272 | /* Compute index of the symbol entry in the symbol table of |
273 | the DSO with the definition. */ |
274 | reloc_result->boundndx = (defsym |
275 | - (ElfW(Sym) *) D_PTR (result, |
276 | l_info[DT_SYMTAB])); |
277 | |
278 | /* Determine whether any of the two participating DSOs is |
279 | interested in auditing. */ |
280 | if ((l->l_audit_any_plt | result->l_audit_any_plt) != 0) |
281 | { |
282 | unsigned int flags = 0; |
283 | struct audit_ifaces *afct = GLRO(dl_audit); |
284 | /* Synthesize a symbol record where the st_value field is |
285 | the result. */ |
286 | ElfW(Sym) sym = *defsym; |
287 | sym.st_value = DL_FIXUP_VALUE_ADDR (value); |
288 | |
289 | /* Keep track whether there is any interest in tracing |
290 | the call in the lower two bits. */ |
291 | assert (DL_NNS * 2 <= sizeof (reloc_result->flags) * 8); |
292 | assert ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT) == 3); |
293 | reloc_result->enterexit = LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT; |
294 | |
295 | const char *strtab2 = (const void *) D_PTR (result, |
296 | l_info[DT_STRTAB]); |
297 | |
298 | for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt) |
299 | { |
300 | /* XXX Check whether both DSOs must request action or |
301 | only one */ |
302 | if ((l->l_audit[cnt].bindflags & LA_FLG_BINDFROM) != 0 |
303 | && (result->l_audit[cnt].bindflags & LA_FLG_BINDTO) != 0) |
304 | { |
305 | if (afct->symbind != NULL) |
306 | { |
307 | uintptr_t new_value |
308 | = afct->symbind (&sym, reloc_result->boundndx, |
309 | &l->l_audit[cnt].cookie, |
310 | &result->l_audit[cnt].cookie, |
311 | &flags, |
312 | strtab2 + defsym->st_name); |
313 | if (new_value != (uintptr_t) sym.st_value) |
314 | { |
315 | flags |= LA_SYMB_ALTVALUE; |
316 | sym.st_value = new_value; |
317 | } |
318 | } |
319 | |
320 | /* Remember the results for every audit library and |
321 | store a summary in the first two bits. */ |
322 | reloc_result->enterexit |
323 | &= flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT); |
324 | reloc_result->enterexit |
325 | |= ((flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)) |
326 | << ((cnt + 1) * 2)); |
327 | } |
328 | else |
329 | /* If the bind flags say this auditor is not interested, |
330 | set the bits manually. */ |
331 | reloc_result->enterexit |
332 | |= ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT) |
333 | << ((cnt + 1) * 2)); |
334 | |
335 | afct = afct->next; |
336 | } |
337 | |
338 | reloc_result->flags = flags; |
339 | value = DL_FIXUP_ADDR_VALUE (sym.st_value); |
340 | } |
341 | else |
342 | /* Set all bits since this symbol binding is not interesting. */ |
343 | reloc_result->enterexit = (1u << DL_NNS) - 1; |
344 | } |
345 | #endif |
346 | |
347 | /* Store the result for later runs. */ |
348 | if (__glibc_likely (! GLRO(dl_bind_not))) |
349 | *resultp = value; |
350 | } |
351 | |
352 | /* By default we do not call the pltexit function. */ |
353 | long int framesize = -1; |
354 | |
355 | #ifdef SHARED |
356 | /* Auditing checkpoint: report the PLT entering and allow the |
357 | auditors to change the value. */ |
358 | if (DL_FIXUP_VALUE_CODE_ADDR (value) != 0 && GLRO(dl_naudit) > 0 |
359 | /* Don't do anything if no auditor wants to intercept this call. */ |
360 | && (reloc_result->enterexit & LA_SYMB_NOPLTENTER) == 0) |
361 | { |
362 | ElfW(Sym) *defsym = ((ElfW(Sym) *) D_PTR (reloc_result->bound, |
363 | l_info[DT_SYMTAB]) |
364 | + reloc_result->boundndx); |
365 | |
366 | /* Set up the sym parameter. */ |
367 | ElfW(Sym) sym = *defsym; |
368 | sym.st_value = DL_FIXUP_VALUE_ADDR (value); |
369 | |
370 | /* Get the symbol name. */ |
371 | const char *strtab = (const void *) D_PTR (reloc_result->bound, |
372 | l_info[DT_STRTAB]); |
373 | const char *symname = strtab + sym.st_name; |
374 | |
375 | /* Keep track of overwritten addresses. */ |
376 | unsigned int flags = reloc_result->flags; |
377 | |
378 | struct audit_ifaces *afct = GLRO(dl_audit); |
379 | for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt) |
380 | { |
381 | if (afct->ARCH_LA_PLTENTER != NULL |
382 | && (reloc_result->enterexit |
383 | & (LA_SYMB_NOPLTENTER << (2 * (cnt + 1)))) == 0) |
384 | { |
385 | long int new_framesize = -1; |
386 | uintptr_t new_value |
387 | = afct->ARCH_LA_PLTENTER (&sym, reloc_result->boundndx, |
388 | &l->l_audit[cnt].cookie, |
389 | &reloc_result->bound->l_audit[cnt].cookie, |
390 | regs, &flags, symname, |
391 | &new_framesize); |
392 | if (new_value != (uintptr_t) sym.st_value) |
393 | { |
394 | flags |= LA_SYMB_ALTVALUE; |
395 | sym.st_value = new_value; |
396 | } |
397 | |
398 | /* Remember the results for every audit library and |
399 | store a summary in the first two bits. */ |
400 | reloc_result->enterexit |
401 | |= ((flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)) |
402 | << (2 * (cnt + 1))); |
403 | |
404 | if ((reloc_result->enterexit & (LA_SYMB_NOPLTEXIT |
405 | << (2 * (cnt + 1)))) |
406 | == 0 && new_framesize != -1 && framesize != -2) |
407 | { |
408 | /* If this is the first call providing information, |
409 | use it. */ |
410 | if (framesize == -1) |
411 | framesize = new_framesize; |
412 | /* If two pltenter calls provide conflicting information, |
413 | use the larger value. */ |
414 | else if (new_framesize != framesize) |
415 | framesize = MAX (new_framesize, framesize); |
416 | } |
417 | } |
418 | |
419 | afct = afct->next; |
420 | } |
421 | |
422 | value = DL_FIXUP_ADDR_VALUE (sym.st_value); |
423 | } |
424 | #endif |
425 | |
426 | /* Store the frame size information. */ |
427 | *framesizep = framesize; |
428 | |
429 | (*mcount_fct) (retaddr, DL_FIXUP_VALUE_CODE_ADDR (value)); |
430 | |
431 | return value; |
432 | } |
433 | |
434 | #endif /* PROF */ |
435 | |
436 | |
437 | #include <stdio.h> |
438 | void |
439 | ARCH_FIXUP_ATTRIBUTE |
440 | _dl_call_pltexit (struct link_map *l, ElfW(Word) reloc_arg, |
441 | const void *inregs, void *outregs) |
442 | { |
443 | #ifdef SHARED |
444 | /* This is the address in the array where we store the result of previous |
445 | relocations. */ |
446 | // XXX Maybe the bound information must be stored on the stack since |
447 | // XXX with bind_not a new value could have been stored in the meantime. |
448 | struct reloc_result *reloc_result = &l->l_reloc_result[reloc_index]; |
449 | ElfW(Sym) *defsym = ((ElfW(Sym) *) D_PTR (reloc_result->bound, |
450 | l_info[DT_SYMTAB]) |
451 | + reloc_result->boundndx); |
452 | |
453 | /* Set up the sym parameter. */ |
454 | ElfW(Sym) sym = *defsym; |
455 | sym.st_value = DL_FIXUP_VALUE_ADDR (reloc_result->addr); |
456 | |
457 | /* Get the symbol name. */ |
458 | const char *strtab = (const void *) D_PTR (reloc_result->bound, |
459 | l_info[DT_STRTAB]); |
460 | const char *symname = strtab + sym.st_name; |
461 | |
462 | struct audit_ifaces *afct = GLRO(dl_audit); |
463 | for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt) |
464 | { |
465 | if (afct->ARCH_LA_PLTEXIT != NULL |
466 | && (reloc_result->enterexit |
467 | & (LA_SYMB_NOPLTEXIT >> (2 * cnt))) == 0) |
468 | { |
469 | afct->ARCH_LA_PLTEXIT (&sym, reloc_result->boundndx, |
470 | &l->l_audit[cnt].cookie, |
471 | &reloc_result->bound->l_audit[cnt].cookie, |
472 | inregs, outregs, symname); |
473 | } |
474 | |
475 | afct = afct->next; |
476 | } |
477 | #endif |
478 | } |
479 | |