1/* On-demand PLT fixup for shared objects.
2 Copyright (C) 1995-2019 Free Software Foundation, Inc.
3 This file is part of the GNU C Library.
4
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
9
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
14
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, see
17 <http://www.gnu.org/licenses/>. */
18
19#define IN_DL_RUNTIME 1 /* This can be tested in dl-machine.h. */
20
21#include <alloca.h>
22#include <stdlib.h>
23#include <unistd.h>
24#include <sys/param.h>
25#include <ldsodefs.h>
26#include <sysdep-cancel.h>
27#include "dynamic-link.h"
28#include <tls.h>
29#include <dl-irel.h>
30
31
32#if (!ELF_MACHINE_NO_RELA && !defined ELF_MACHINE_PLT_REL) \
33 || ELF_MACHINE_NO_REL
34# define PLTREL ElfW(Rela)
35#else
36# define PLTREL ElfW(Rel)
37#endif
38
39/* The fixup functions might have need special attributes. If none
40 are provided define the macro as empty. */
41#ifndef ARCH_FIXUP_ATTRIBUTE
42# define ARCH_FIXUP_ATTRIBUTE
43#endif
44
45#ifndef reloc_offset
46# define reloc_offset reloc_arg
47# define reloc_index reloc_arg / sizeof (PLTREL)
48#endif
49
50
51
52/* This function is called through a special trampoline from the PLT the
53 first time each PLT entry is called. We must perform the relocation
54 specified in the PLT of the given shared object, and return the resolved
55 function address to the trampoline, which will restart the original call
56 to that address. Future calls will bounce directly from the PLT to the
57 function. */
58
59DL_FIXUP_VALUE_TYPE
60attribute_hidden __attribute ((noinline)) ARCH_FIXUP_ATTRIBUTE
61_dl_fixup (
62# ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS
63 ELF_MACHINE_RUNTIME_FIXUP_ARGS,
64# endif
65 struct link_map *l, ElfW(Word) reloc_arg)
66{
67 const ElfW(Sym) *const symtab
68 = (const void *) D_PTR (l, l_info[DT_SYMTAB]);
69 const char *strtab = (const void *) D_PTR (l, l_info[DT_STRTAB]);
70
71 const PLTREL *const reloc
72 = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset);
73 const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)];
74 const ElfW(Sym) *refsym = sym;
75 void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);
76 lookup_t result;
77 DL_FIXUP_VALUE_TYPE value;
78
79 /* Sanity check that we're really looking at a PLT relocation. */
80 assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT);
81
82 /* Look up the target symbol. If the normal lookup rules are not
83 used don't look in the global scope. */
84 if (__builtin_expect (ELFW(ST_VISIBILITY) (sym->st_other), 0) == 0)
85 {
86 const struct r_found_version *version = NULL;
87
88 if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
89 {
90 const ElfW(Half) *vernum =
91 (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]);
92 ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
93 version = &l->l_versions[ndx];
94 if (version->hash == 0)
95 version = NULL;
96 }
97
98 /* We need to keep the scope around so do some locking. This is
99 not necessary for objects which cannot be unloaded or when
100 we are not using any threads (yet). */
101 int flags = DL_LOOKUP_ADD_DEPENDENCY;
102 if (!RTLD_SINGLE_THREAD_P)
103 {
104 THREAD_GSCOPE_SET_FLAG ();
105 flags |= DL_LOOKUP_GSCOPE_LOCK;
106 }
107
108#ifdef RTLD_ENABLE_FOREIGN_CALL
109 RTLD_ENABLE_FOREIGN_CALL;
110#endif
111
112 result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope,
113 version, ELF_RTYPE_CLASS_PLT, flags, NULL);
114
115 /* We are done with the global scope. */
116 if (!RTLD_SINGLE_THREAD_P)
117 THREAD_GSCOPE_RESET_FLAG ();
118
119#ifdef RTLD_FINALIZE_FOREIGN_CALL
120 RTLD_FINALIZE_FOREIGN_CALL;
121#endif
122
123 /* Currently result contains the base load address (or link map)
124 of the object that defines sym. Now add in the symbol
125 offset. */
126 value = DL_FIXUP_MAKE_VALUE (result,
127 SYMBOL_ADDRESS (result, sym, false));
128 }
129 else
130 {
131 /* We already found the symbol. The module (and therefore its load
132 address) is also known. */
133 value = DL_FIXUP_MAKE_VALUE (l, SYMBOL_ADDRESS (l, sym, true));
134 result = l;
135 }
136
137 /* And now perhaps the relocation addend. */
138 value = elf_machine_plt_value (l, reloc, value);
139
140 if (sym != NULL
141 && __builtin_expect (ELFW(ST_TYPE) (sym->st_info) == STT_GNU_IFUNC, 0))
142 value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));
143
144 /* Finally, fix up the plt itself. */
145 if (__glibc_unlikely (GLRO(dl_bind_not)))
146 return value;
147
148 return elf_machine_fixup_plt (l, result, refsym, sym, reloc, rel_addr, value);
149}
150
151#ifndef PROF
152DL_FIXUP_VALUE_TYPE
153__attribute ((noinline)) ARCH_FIXUP_ATTRIBUTE
154_dl_profile_fixup (
155#ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS
156 ELF_MACHINE_RUNTIME_FIXUP_ARGS,
157#endif
158 struct link_map *l, ElfW(Word) reloc_arg,
159 ElfW(Addr) retaddr, void *regs, long int *framesizep)
160{
161 void (*mcount_fct) (ElfW(Addr), ElfW(Addr)) = _dl_mcount;
162
163 if (l->l_reloc_result == NULL)
164 {
165 /* BZ #14843: ELF_DYNAMIC_RELOCATE is called before l_reloc_result
166 is allocated. We will get here if ELF_DYNAMIC_RELOCATE calls a
167 resolver function to resolve an IRELATIVE relocation and that
168 resolver calls a function that is not yet resolved (lazy). For
169 example, the resolver in x86-64 libm.so calls __get_cpu_features
170 defined in libc.so. Skip audit and resolve the external function
171 in this case. */
172 *framesizep = -1;
173 return _dl_fixup (
174# ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS
175# ifndef ELF_MACHINE_RUNTIME_FIXUP_PARAMS
176# error Please define ELF_MACHINE_RUNTIME_FIXUP_PARAMS.
177# endif
178 ELF_MACHINE_RUNTIME_FIXUP_PARAMS,
179# endif
180 l, reloc_arg);
181 }
182
183 /* This is the address in the array where we store the result of previous
184 relocations. */
185 struct reloc_result *reloc_result = &l->l_reloc_result[reloc_index];
186
187 /* CONCURRENCY NOTES:
188
189 Multiple threads may be calling the same PLT sequence and with
190 LD_AUDIT enabled they will be calling into _dl_profile_fixup to
191 update the reloc_result with the result of the lazy resolution.
192 The reloc_result guard variable is reloc_init, and we use
193 acquire/release loads and store to it to ensure that the results of
194 the structure are consistent with the loaded value of the guard.
195 This does not fix all of the data races that occur when two or more
196 threads read reloc_result->reloc_init with a value of zero and read
197 and write to that reloc_result concurrently. The expectation is
198 generally that while this is a data race it works because the
199 threads write the same values. Until the data races are fixed
200 there is a potential for problems to arise from these data races.
201 The reloc result updates should happen in parallel but there should
202 be an atomic RMW which does the final update to the real result
203 entry (see bug 23790).
204
205 The following code uses reloc_result->init set to 0 to indicate if it is
206 the first time this object is being relocated, otherwise 1 which
207 indicates the object has already been relocated.
208
209 Reading/Writing from/to reloc_result->reloc_init must not happen
210 before previous writes to reloc_result complete as they could
211 end-up with an incomplete struct. */
212 DL_FIXUP_VALUE_TYPE value;
213 unsigned int init = atomic_load_acquire (&reloc_result->init);
214
215 if (init == 0)
216 {
217 /* This is the first time we have to relocate this object. */
218 const ElfW(Sym) *const symtab
219 = (const void *) D_PTR (l, l_info[DT_SYMTAB]);
220 const char *strtab = (const char *) D_PTR (l, l_info[DT_STRTAB]);
221
222 const PLTREL *const reloc
223 = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset);
224 const ElfW(Sym) *refsym = &symtab[ELFW(R_SYM) (reloc->r_info)];
225 const ElfW(Sym) *defsym = refsym;
226 lookup_t result;
227
228 /* Sanity check that we're really looking at a PLT relocation. */
229 assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT);
230
231 /* Look up the target symbol. If the symbol is marked STV_PROTECTED
232 don't look in the global scope. */
233 if (__builtin_expect (ELFW(ST_VISIBILITY) (refsym->st_other), 0) == 0)
234 {
235 const struct r_found_version *version = NULL;
236
237 if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
238 {
239 const ElfW(Half) *vernum =
240 (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]);
241 ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
242 version = &l->l_versions[ndx];
243 if (version->hash == 0)
244 version = NULL;
245 }
246
247 /* We need to keep the scope around so do some locking. This is
248 not necessary for objects which cannot be unloaded or when
249 we are not using any threads (yet). */
250 int flags = DL_LOOKUP_ADD_DEPENDENCY;
251 if (!RTLD_SINGLE_THREAD_P)
252 {
253 THREAD_GSCOPE_SET_FLAG ();
254 flags |= DL_LOOKUP_GSCOPE_LOCK;
255 }
256
257 result = _dl_lookup_symbol_x (strtab + refsym->st_name, l,
258 &defsym, l->l_scope, version,
259 ELF_RTYPE_CLASS_PLT, flags, NULL);
260
261 /* We are done with the global scope. */
262 if (!RTLD_SINGLE_THREAD_P)
263 THREAD_GSCOPE_RESET_FLAG ();
264
265 /* Currently result contains the base load address (or link map)
266 of the object that defines sym. Now add in the symbol
267 offset. */
268 value = DL_FIXUP_MAKE_VALUE (result,
269 SYMBOL_ADDRESS (result, defsym, false));
270
271 if (defsym != NULL
272 && __builtin_expect (ELFW(ST_TYPE) (defsym->st_info)
273 == STT_GNU_IFUNC, 0))
274 value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));
275 }
276 else
277 {
278 /* We already found the symbol. The module (and therefore its load
279 address) is also known. */
280 value = DL_FIXUP_MAKE_VALUE (l, SYMBOL_ADDRESS (l, refsym, true));
281
282 if (__builtin_expect (ELFW(ST_TYPE) (refsym->st_info)
283 == STT_GNU_IFUNC, 0))
284 value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));
285
286 result = l;
287 }
288 /* And now perhaps the relocation addend. */
289 value = elf_machine_plt_value (l, reloc, value);
290
291#ifdef SHARED
292 /* Auditing checkpoint: we have a new binding. Provide the
293 auditing libraries the possibility to change the value and
294 tell us whether further auditing is wanted. */
295 if (defsym != NULL && GLRO(dl_naudit) > 0)
296 {
297 reloc_result->bound = result;
298 /* Compute index of the symbol entry in the symbol table of
299 the DSO with the definition. */
300 reloc_result->boundndx = (defsym
301 - (ElfW(Sym) *) D_PTR (result,
302 l_info[DT_SYMTAB]));
303
304 /* Determine whether any of the two participating DSOs is
305 interested in auditing. */
306 if ((l->l_audit_any_plt | result->l_audit_any_plt) != 0)
307 {
308 unsigned int flags = 0;
309 struct audit_ifaces *afct = GLRO(dl_audit);
310 /* Synthesize a symbol record where the st_value field is
311 the result. */
312 ElfW(Sym) sym = *defsym;
313 sym.st_value = DL_FIXUP_VALUE_ADDR (value);
314
315 /* Keep track whether there is any interest in tracing
316 the call in the lower two bits. */
317 assert (DL_NNS * 2 <= sizeof (reloc_result->flags) * 8);
318 assert ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT) == 3);
319 reloc_result->enterexit = LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT;
320
321 const char *strtab2 = (const void *) D_PTR (result,
322 l_info[DT_STRTAB]);
323
324 for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
325 {
326 /* XXX Check whether both DSOs must request action or
327 only one */
328 if ((l->l_audit[cnt].bindflags & LA_FLG_BINDFROM) != 0
329 && (result->l_audit[cnt].bindflags & LA_FLG_BINDTO) != 0)
330 {
331 if (afct->symbind != NULL)
332 {
333 uintptr_t new_value
334 = afct->symbind (&sym, reloc_result->boundndx,
335 &l->l_audit[cnt].cookie,
336 &result->l_audit[cnt].cookie,
337 &flags,
338 strtab2 + defsym->st_name);
339 if (new_value != (uintptr_t) sym.st_value)
340 {
341 flags |= LA_SYMB_ALTVALUE;
342 sym.st_value = new_value;
343 }
344 }
345
346 /* Remember the results for every audit library and
347 store a summary in the first two bits. */
348 reloc_result->enterexit
349 &= flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT);
350 reloc_result->enterexit
351 |= ((flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT))
352 << ((cnt + 1) * 2));
353 }
354 else
355 /* If the bind flags say this auditor is not interested,
356 set the bits manually. */
357 reloc_result->enterexit
358 |= ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)
359 << ((cnt + 1) * 2));
360
361 afct = afct->next;
362 }
363
364 reloc_result->flags = flags;
365 value = DL_FIXUP_ADDR_VALUE (sym.st_value);
366 }
367 else
368 /* Set all bits since this symbol binding is not interesting. */
369 reloc_result->enterexit = (1u << DL_NNS) - 1;
370 }
371#endif
372
373 /* Store the result for later runs. */
374 if (__glibc_likely (! GLRO(dl_bind_not)))
375 {
376 reloc_result->addr = value;
377 /* Guarantee all previous writes complete before
378 init is updated. See CONCURRENCY NOTES earlier */
379 atomic_store_release (&reloc_result->init, 1);
380 }
381 init = 1;
382 }
383 else
384 value = reloc_result->addr;
385
386 /* By default we do not call the pltexit function. */
387 long int framesize = -1;
388
389
390#ifdef SHARED
391 /* Auditing checkpoint: report the PLT entering and allow the
392 auditors to change the value. */
393 if (GLRO(dl_naudit) > 0
394 /* Don't do anything if no auditor wants to intercept this call. */
395 && (reloc_result->enterexit & LA_SYMB_NOPLTENTER) == 0)
396 {
397 /* Sanity check: DL_FIXUP_VALUE_CODE_ADDR (value) should have been
398 initialized earlier in this function or in another thread. */
399 assert (DL_FIXUP_VALUE_CODE_ADDR (value) != 0);
400 ElfW(Sym) *defsym = ((ElfW(Sym) *) D_PTR (reloc_result->bound,
401 l_info[DT_SYMTAB])
402 + reloc_result->boundndx);
403
404 /* Set up the sym parameter. */
405 ElfW(Sym) sym = *defsym;
406 sym.st_value = DL_FIXUP_VALUE_ADDR (value);
407
408 /* Get the symbol name. */
409 const char *strtab = (const void *) D_PTR (reloc_result->bound,
410 l_info[DT_STRTAB]);
411 const char *symname = strtab + sym.st_name;
412
413 /* Keep track of overwritten addresses. */
414 unsigned int flags = reloc_result->flags;
415
416 struct audit_ifaces *afct = GLRO(dl_audit);
417 for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
418 {
419 if (afct->ARCH_LA_PLTENTER != NULL
420 && (reloc_result->enterexit
421 & (LA_SYMB_NOPLTENTER << (2 * (cnt + 1)))) == 0)
422 {
423 long int new_framesize = -1;
424 uintptr_t new_value
425 = afct->ARCH_LA_PLTENTER (&sym, reloc_result->boundndx,
426 &l->l_audit[cnt].cookie,
427 &reloc_result->bound->l_audit[cnt].cookie,
428 regs, &flags, symname,
429 &new_framesize);
430 if (new_value != (uintptr_t) sym.st_value)
431 {
432 flags |= LA_SYMB_ALTVALUE;
433 sym.st_value = new_value;
434 }
435
436 /* Remember the results for every audit library and
437 store a summary in the first two bits. */
438 reloc_result->enterexit
439 |= ((flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT))
440 << (2 * (cnt + 1)));
441
442 if ((reloc_result->enterexit & (LA_SYMB_NOPLTEXIT
443 << (2 * (cnt + 1))))
444 == 0 && new_framesize != -1 && framesize != -2)
445 {
446 /* If this is the first call providing information,
447 use it. */
448 if (framesize == -1)
449 framesize = new_framesize;
450 /* If two pltenter calls provide conflicting information,
451 use the larger value. */
452 else if (new_framesize != framesize)
453 framesize = MAX (new_framesize, framesize);
454 }
455 }
456
457 afct = afct->next;
458 }
459
460 value = DL_FIXUP_ADDR_VALUE (sym.st_value);
461 }
462#endif
463
464 /* Store the frame size information. */
465 *framesizep = framesize;
466
467 (*mcount_fct) (retaddr, DL_FIXUP_VALUE_CODE_ADDR (value));
468
469 return value;
470}
471
472#endif /* PROF */
473
474
475#include <stdio.h>
476void
477ARCH_FIXUP_ATTRIBUTE
478_dl_call_pltexit (struct link_map *l, ElfW(Word) reloc_arg,
479 const void *inregs, void *outregs)
480{
481#ifdef SHARED
482 /* This is the address in the array where we store the result of previous
483 relocations. */
484 // XXX Maybe the bound information must be stored on the stack since
485 // XXX with bind_not a new value could have been stored in the meantime.
486 struct reloc_result *reloc_result = &l->l_reloc_result[reloc_index];
487 ElfW(Sym) *defsym = ((ElfW(Sym) *) D_PTR (reloc_result->bound,
488 l_info[DT_SYMTAB])
489 + reloc_result->boundndx);
490
491 /* Set up the sym parameter. */
492 ElfW(Sym) sym = *defsym;
493 sym.st_value = DL_FIXUP_VALUE_ADDR (reloc_result->addr);
494
495 /* Get the symbol name. */
496 const char *strtab = (const void *) D_PTR (reloc_result->bound,
497 l_info[DT_STRTAB]);
498 const char *symname = strtab + sym.st_name;
499
500 struct audit_ifaces *afct = GLRO(dl_audit);
501 for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
502 {
503 if (afct->ARCH_LA_PLTEXIT != NULL
504 && (reloc_result->enterexit
505 & (LA_SYMB_NOPLTEXIT >> (2 * cnt))) == 0)
506 {
507 afct->ARCH_LA_PLTEXIT (&sym, reloc_result->boundndx,
508 &l->l_audit[cnt].cookie,
509 &reloc_result->bound->l_audit[cnt].cookie,
510 inregs, outregs, symname);
511 }
512
513 afct = afct->next;
514 }
515#endif
516}
517