Feodor2
/
Mypal
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Mypal/mozglue/linker/ElfLoader.cpp

1311 lines
40 KiB
C++
Raw Permalink Blame History

/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/. */
#include <string>
#include <cstring>
#include <cstdlib>
#include <cstdio>
#include <dlfcn.h>
#include <unistd.h>
#include <errno.h>
#include <algorithm>
#include <fcntl.h>
#include "ElfLoader.h"
#include "BaseElf.h"
#include "CustomElf.h"
#include "Mappable.h"
#include "Logging.h"
#include <inttypes.h>
#if defined(ANDROID)
#include <sys/syscall.h>
#include <android/api-level.h>
#if __ANDROID_API__ < 8
/* Android API < 8 doesn't provide sigaltstack */
extern "C" {
inline int sigaltstack(const stack_t *ss, stack_t *oss) {
return syscall(__NR_sigaltstack, ss, oss);
}
} /* extern "C" */
#endif /* __ANDROID_API__ */
#endif /* ANDROID */
#ifdef __ARM_EABI__
extern "C" MOZ_EXPORT const void *
__gnu_Unwind_Find_exidx(void *pc, int *pcount) __attribute__((weak));
#endif
/* Pointer to the PT_DYNAMIC section of the executable or library
* containing this code. */
extern "C" Elf::Dyn _DYNAMIC[];
using namespace mozilla;
/**
* dlfcn.h replacements functions
*/
void *
__wrap_dlopen(const char *path, int flags)
{
RefPtr<LibHandle> handle = ElfLoader::Singleton.Load(path, flags);
if (handle)
handle->AddDirectRef();
return handle;
}
const char *
__wrap_dlerror(void)
{
const char *error = ElfLoader::Singleton.lastError;
ElfLoader::Singleton.lastError = nullptr;
return error;
}
void *
__wrap_dlsym(void *handle, const char *symbol)
{
if (!handle) {
ElfLoader::Singleton.lastError = "dlsym(NULL, sym) unsupported";
return nullptr;
}
if (handle != RTLD_DEFAULT && handle != RTLD_NEXT) {
LibHandle *h = reinterpret_cast<LibHandle *>(handle);
return h->GetSymbolPtr(symbol);
}
return dlsym(handle, symbol);
}
int
__wrap_dlclose(void *handle)
{
if (!handle) {
ElfLoader::Singleton.lastError = "No handle given to dlclose()";
return -1;
}
reinterpret_cast<LibHandle *>(handle)->ReleaseDirectRef();
return 0;
}
int
__wrap_dladdr(void *addr, Dl_info *info)
{
RefPtr<LibHandle> handle = ElfLoader::Singleton.GetHandleByPtr(addr);
if (!handle) {
return dladdr(addr, info);
}
info->dli_fname = handle->GetPath();
info->dli_fbase = handle->GetBase();
return 1;
}
int
__wrap_dl_iterate_phdr(dl_phdr_cb callback, void *data)
{
if (!ElfLoader::Singleton.dbg)
return -1;
int pipefd[2];
bool valid_pipe = (pipe(pipefd) == 0);
AutoCloseFD read_fd(pipefd[0]);
AutoCloseFD write_fd(pipefd[1]);
for (ElfLoader::DebuggerHelper::iterator it = ElfLoader::Singleton.dbg.begin();
it < ElfLoader::Singleton.dbg.end(); ++it) {
dl_phdr_info info;
info.dlpi_addr = reinterpret_cast<Elf::Addr>(it->l_addr);
info.dlpi_name = it->l_name;
info.dlpi_phdr = nullptr;
info.dlpi_phnum = 0;
// Assuming l_addr points to Elf headers (in most cases, this is true),
// get the Phdr location from there.
// Unfortunately, when l_addr doesn't point to Elf headers, it may point
// to unmapped memory, or worse, unreadable memory. The only way to detect
// the latter without causing a SIGSEGV is to use the pointer in a system
// call that will try to read from there, and return an EFAULT error if
// it can't. One such system call is write(). It used to be possible to
// use a file descriptor on /dev/null for these kind of things, but recent
// Linux kernels never return an EFAULT error when using /dev/null.
// So instead, we use a self pipe. We do however need to read() from the
// read end of the pipe as well so as to not fill up the pipe buffer and
// block on subsequent writes.
// In the unlikely event reads from or write to the pipe fail for some
// other reason than EFAULT, we don't try any further and just skip setting
// the Phdr location for all subsequent libraries, rather than trying to
// start over with a new pipe.
int can_read = true;
if (valid_pipe) {
int ret;
char raw_ehdr[sizeof(Elf::Ehdr)];
static_assert(sizeof(raw_ehdr) < PIPE_BUF, "PIPE_BUF is too small");
do {
// writes are atomic when smaller than PIPE_BUF, per POSIX.1-2008.
ret = write(write_fd, it->l_addr, sizeof(raw_ehdr));
} while (ret == -1 && errno == EINTR);
if (ret != sizeof(raw_ehdr)) {
if (ret == -1 && errno == EFAULT) {
can_read = false;
} else {
valid_pipe = false;
}
} else {
size_t nbytes = 0;
do {
// Per POSIX.1-2008, interrupted reads can return a length smaller
// than the given one instead of failing with errno EINTR.
ret = read(read_fd, raw_ehdr + nbytes, sizeof(raw_ehdr) - nbytes);
if (ret > 0)
nbytes += ret;
} while ((nbytes != sizeof(raw_ehdr) && ret > 0) ||
(ret == -1 && errno == EINTR));
if (nbytes != sizeof(raw_ehdr)) {
valid_pipe = false;
}
}
}
if (valid_pipe && can_read) {
const Elf::Ehdr *ehdr = Elf::Ehdr::validate(it->l_addr);
if (ehdr) {
info.dlpi_phdr = reinterpret_cast<const Elf::Phdr *>(
reinterpret_cast<const char *>(ehdr) + ehdr->e_phoff);
info.dlpi_phnum = ehdr->e_phnum;
}
}
int ret = callback(&info, sizeof(dl_phdr_info), data);
if (ret)
return ret;
}
return 0;
}
#ifdef __ARM_EABI__
const void *
__wrap___gnu_Unwind_Find_exidx(void *pc, int *pcount)
{
RefPtr<LibHandle> handle = ElfLoader::Singleton.GetHandleByPtr(pc);
if (handle)
return handle->FindExidx(pcount);
if (__gnu_Unwind_Find_exidx)
return __gnu_Unwind_Find_exidx(pc, pcount);
*pcount = 0;
return nullptr;
}
#endif
/**
* faulty.lib public API
*/
MFBT_API size_t
__dl_get_mappable_length(void *handle) {
if (!handle)
return 0;
return reinterpret_cast<LibHandle *>(handle)->GetMappableLength();
}
MFBT_API void *
__dl_mmap(void *handle, void *addr, size_t length, off_t offset)
{
if (!handle)
return nullptr;
return reinterpret_cast<LibHandle *>(handle)->MappableMMap(addr, length,
offset);
}
MFBT_API void
__dl_munmap(void *handle, void *addr, size_t length)
{
if (!handle)
return;
return reinterpret_cast<LibHandle *>(handle)->MappableMUnmap(addr, length);
}
MFBT_API bool
IsSignalHandlingBroken()
{
return ElfLoader::Singleton.isSignalHandlingBroken();
}
namespace {
/**
* Returns the part after the last '/' for the given path
*/
const char *
LeafName(const char *path)
{
const char *lastSlash = strrchr(path, '/');
if (lastSlash)
return lastSlash + 1;
return path;
}
} /* Anonymous namespace */
/**
* LibHandle
*/
LibHandle::~LibHandle()
{
free(path);
}
const char *
LibHandle::GetName() const
{
return path ? LeafName(path) : nullptr;
}
size_t
LibHandle::GetMappableLength() const
{
if (!mappable)
mappable = GetMappable();
if (!mappable)
return 0;
return mappable->GetLength();
}
void *
LibHandle::MappableMMap(void *addr, size_t length, off_t offset) const
{
if (!mappable)
mappable = GetMappable();
if (!mappable)
return MAP_FAILED;
void* mapped = mappable->mmap(addr, length, PROT_READ, MAP_PRIVATE, offset);
if (mapped != MAP_FAILED) {
/* Ensure the availability of all pages within the mapping */
for (size_t off = 0; off < length; off += PageSize()) {
mappable->ensure(reinterpret_cast<char *>(mapped) + off);
}
}
return mapped;
}
void
LibHandle::MappableMUnmap(void *addr, size_t length) const
{
if (mappable)
mappable->munmap(addr, length);
}
/**
* SystemElf
*/
already_AddRefed<LibHandle>
SystemElf::Load(const char *path, int flags)
{
/* The Android linker returns a handle when the file name matches an
* already loaded library, even when the full path doesn't exist */
if (path && path[0] == '/' && (access(path, F_OK) == -1)){
DEBUG_LOG("dlopen(\"%s\", 0x%x) = %p", path, flags, (void *)nullptr);
return nullptr;
}
void *handle = dlopen(path, flags);
DEBUG_LOG("dlopen(\"%s\", 0x%x) = %p", path, flags, handle);
ElfLoader::Singleton.lastError = dlerror();
if (handle) {
SystemElf *elf = new SystemElf(path, handle);
ElfLoader::Singleton.Register(elf);
RefPtr<LibHandle> lib(elf);
return lib.forget();
}
return nullptr;
}
SystemElf::~SystemElf()
{
if (!dlhandle)
return;
DEBUG_LOG("dlclose(%p [\"%s\"])", dlhandle, GetPath());
dlclose(dlhandle);
ElfLoader::Singleton.lastError = dlerror();
ElfLoader::Singleton.Forget(this);
}
void *
SystemElf::GetSymbolPtr(const char *symbol) const
{
void *sym = dlsym(dlhandle, symbol);
DEBUG_LOG("dlsym(%p [\"%s\"], \"%s\") = %p", dlhandle, GetPath(), symbol, sym);
ElfLoader::Singleton.lastError = dlerror();
return sym;
}
Mappable *
SystemElf::GetMappable() const
{
const char *path = GetPath();
if (!path)
return nullptr;
#ifdef ANDROID
/* On Android, if we don't have the full path, try in /system/lib */
const char *name = LeafName(path);
std::string systemPath;
if (name == path) {
systemPath = "/system/lib/";
systemPath += path;
path = systemPath.c_str();
}
#endif
return MappableFile::Create(path);
}
#ifdef __ARM_EABI__
const void *
SystemElf::FindExidx(int *pcount) const
{
/* TODO: properly implement when ElfLoader::GetHandleByPtr
does return SystemElf handles */
*pcount = 0;
return nullptr;
}
#endif
/**
* ElfLoader
*/
/* Unique ElfLoader instance */
ElfLoader ElfLoader::Singleton;
already_AddRefed<LibHandle>
ElfLoader::Load(const char *path, int flags, LibHandle *parent)
{
/* Ensure logging is initialized or refresh if environment changed. */
Logging::Init();
/* Ensure self_elf initialization. */
if (!self_elf)
Init();
RefPtr<LibHandle> handle;
/* Handle dlopen(nullptr) directly. */
if (!path) {
handle = SystemElf::Load(nullptr, flags);
return handle.forget();
}
/* TODO: Handle relative paths correctly */
const char *name = LeafName(path);
/* Search the list of handles we already have for a match. When the given
* path is not absolute, compare file names, otherwise compare full paths. */
if (name == path) {
for (LibHandleList::iterator it = handles.begin(); it < handles.end(); ++it)
if ((*it)->GetName() && (strcmp((*it)->GetName(), name) == 0)) {
handle = *it;
return handle.forget();
}
} else {
for (LibHandleList::iterator it = handles.begin(); it < handles.end(); ++it)
if ((*it)->GetPath() && (strcmp((*it)->GetPath(), path) == 0)) {
handle = *it;
return handle.forget();
}
}
char *abs_path = nullptr;
const char *requested_path = path;
/* When the path is not absolute and the library is being loaded for
* another, first try to load the library from the directory containing
* that parent library. */
if ((name == path) && parent) {
const char *parentPath = parent->GetPath();
abs_path = new char[strlen(parentPath) + strlen(path)];
strcpy(abs_path, parentPath);
char *slash = strrchr(abs_path, '/');
strcpy(slash + 1, path);
path = abs_path;
}
Mappable *mappable = GetMappableFromPath(path);
/* Try loading with the custom linker if we have a Mappable */
if (mappable)
handle = CustomElf::Load(mappable, path, flags);
/* Try loading with the system linker if everything above failed */
if (!handle)
handle = SystemElf::Load(path, flags);
/* If we didn't have an absolute path and haven't been able to load
* a library yet, try in the system search path */
if (!handle && abs_path)
handle = SystemElf::Load(name, flags);
delete [] abs_path;
DEBUG_LOG("ElfLoader::Load(\"%s\", 0x%x, %p [\"%s\"]) = %p", requested_path, flags,
reinterpret_cast<void *>(parent), parent ? parent->GetPath() : "",
static_cast<void *>(handle));
return handle.forget();
}
already_AddRefed<LibHandle>
ElfLoader::GetHandleByPtr(void *addr)
{
/* Scan the list of handles we already have for a match */
for (LibHandleList::iterator it = handles.begin(); it < handles.end(); ++it) {
if ((*it)->Contains(addr)) {
RefPtr<LibHandle> lib = *it;
return lib.forget();
}
}
return nullptr;
}
Mappable *
ElfLoader::GetMappableFromPath(const char *path)
{
const char *name = LeafName(path);
Mappable *mappable = nullptr;
RefPtr<Zip> zip;
const char *subpath;
if ((subpath = strchr(path, '!'))) {
char *zip_path = strndup(path, subpath - path);
while (*(++subpath) == '/') { }
zip = ZipCollection::GetZip(zip_path);
free(zip_path);
Zip::Stream s;
if (zip && zip->GetStream(subpath, &s)) {
/* When the MOZ_LINKER_EXTRACT environment variable is set to "1",
* compressed libraries are going to be (temporarily) extracted as
* files, in the directory pointed by the MOZ_LINKER_CACHE
* environment variable. */
const char *extract = getenv("MOZ_LINKER_EXTRACT");
if (extract && !strncmp(extract, "1", 2 /* Including '\0' */))
mappable = MappableExtractFile::Create(name, zip, &s);
if (!mappable) {
if (s.GetType() == Zip::Stream::DEFLATE) {
mappable = MappableDeflate::Create(name, zip, &s);
} else if (s.GetType() == Zip::Stream::STORE) {
mappable = MappableSeekableZStream::Create(name, zip, &s);
}
}
}
}
/* If we couldn't load above, try with a MappableFile */
if (!mappable && !zip)
mappable = MappableFile::Create(path);
return mappable;
}
void
ElfLoader::Register(LibHandle *handle)
{
handles.push_back(handle);
}
void
ElfLoader::Register(CustomElf *handle)
{
Register(static_cast<LibHandle *>(handle));
if (dbg) {
dbg.Add(handle);
}
}
void
ElfLoader::Forget(LibHandle *handle)
{
/* Ensure logging is initialized or refresh if environment changed. */
Logging::Init();
LibHandleList::iterator it = std::find(handles.begin(), handles.end(), handle);
if (it != handles.end()) {
DEBUG_LOG("ElfLoader::Forget(%p [\"%s\"])", reinterpret_cast<void *>(handle),
handle->GetPath());
handles.erase(it);
} else {
DEBUG_LOG("ElfLoader::Forget(%p [\"%s\"]): Handle not found",
reinterpret_cast<void *>(handle), handle->GetPath());
}
}
void
ElfLoader::Forget(CustomElf *handle)
{
Forget(static_cast<LibHandle *>(handle));
if (dbg) {
dbg.Remove(handle);
}
}
void
ElfLoader::Init()
{
Dl_info info;
/* On Android < 4.1 can't reenter dl* functions. So when the library
* containing this code is dlopen()ed, it can't call dladdr from a
* static initializer. */
if (dladdr(_DYNAMIC, &info) != 0) {
self_elf = LoadedElf::Create(info.dli_fname, info.dli_fbase);
}
#if defined(ANDROID)
if (dladdr(FunctionPtr(syscall), &info) != 0) {
libc = LoadedElf::Create(info.dli_fname, info.dli_fbase);
}
#endif
}
ElfLoader::~ElfLoader()
{
LibHandleList list;
if (!Singleton.IsShutdownExpected()) {
MOZ_CRASH("Unexpected shutdown");
}
/* Release self_elf and libc */
self_elf = nullptr;
#if defined(ANDROID)
libc = nullptr;
#endif
/* Build up a list of all library handles with direct (external) references.
* We actually skip system library handles because we want to keep at least
* some of these open. Most notably, Mozilla codebase keeps a few libgnome
* libraries deliberately open because of the mess that libORBit destruction
* is. dlclose()ing these libraries actually leads to problems. */
for (LibHandleList::reverse_iterator it = handles.rbegin();
it < handles.rend(); ++it) {
if ((*it)->DirectRefCount()) {
if (SystemElf *se = (*it)->AsSystemElf()) {
se->Forget();
} else {
list.push_back(*it);
}
}
}
/* Force release all external references to the handles collected above */
for (LibHandleList::iterator it = list.begin(); it < list.end(); ++it) {
while ((*it)->ReleaseDirectRef()) { }
}
/* Remove the remaining system handles. */
if (handles.size()) {
list = handles;
for (LibHandleList::reverse_iterator it = list.rbegin();
it < list.rend(); ++it) {
if ((*it)->AsSystemElf()) {
DEBUG_LOG("ElfLoader::~ElfLoader(): Remaining handle for \"%s\" "
"[%d direct refs, %d refs total]", (*it)->GetPath(),
(*it)->DirectRefCount(), (*it)->refCount());
} else {
DEBUG_LOG("ElfLoader::~ElfLoader(): Unexpected remaining handle for \"%s\" "
"[%d direct refs, %d refs total]", (*it)->GetPath(),
(*it)->DirectRefCount(), (*it)->refCount());
/* Not removing, since it could have references to other libraries,
* destroying them as a side effect, and possibly leaving dangling
* pointers in the handle list we're scanning */
}
}
}
}
void
ElfLoader::stats(const char *when)
{
if (MOZ_LIKELY(!Logging::isVerbose()))
return;
for (LibHandleList::iterator it = Singleton.handles.begin();
it < Singleton.handles.end(); ++it)
(*it)->stats(when);
}
#ifdef __ARM_EABI__
int
ElfLoader::__wrap_aeabi_atexit(void *that, ElfLoader::Destructor destructor,
void *dso_handle)
{
Singleton.destructors.push_back(
DestructorCaller(destructor, that, dso_handle));
return 0;
}
#else
int
ElfLoader::__wrap_cxa_atexit(ElfLoader::Destructor destructor, void *that,
void *dso_handle)
{
Singleton.destructors.push_back(
DestructorCaller(destructor, that, dso_handle));
return 0;
}
#endif
void
ElfLoader::__wrap_cxa_finalize(void *dso_handle)
{
/* Call all destructors for the given DSO handle in reverse order they were
* registered. */
std::vector<DestructorCaller>::reverse_iterator it;
for (it = Singleton.destructors.rbegin();
it < Singleton.destructors.rend(); ++it) {
if (it->IsForHandle(dso_handle)) {
it->Call();
}
}
}
void
ElfLoader::DestructorCaller::Call()
{
if (destructor) {
DEBUG_LOG("ElfLoader::DestructorCaller::Call(%p, %p, %p)",
FunctionPtr(destructor), object, dso_handle);
destructor(object);
destructor = nullptr;
}
}
ElfLoader::DebuggerHelper::DebuggerHelper(): dbg(nullptr), firstAdded(nullptr)
{
/* Find ELF auxiliary vectors.
*
* The kernel stores the following data on the stack when starting a
* program:
* argc
* argv[0] (pointer into argv strings defined below)
* argv[1] (likewise)
* ...
* argv[argc - 1] (likewise)
* nullptr
* envp[0] (pointer into environment strings defined below)
* envp[1] (likewise)
* ...
* envp[n] (likewise)
* nullptr
* ... (more NULLs on some platforms such as Android 4.3)
* auxv[0] (first ELF auxiliary vector)
* auxv[1] (second ELF auxiliary vector)
* ...
* auxv[p] (last ELF auxiliary vector)
* (AT_NULL, nullptr)
* padding
* argv strings, separated with '\0'
* environment strings, separated with '\0'
* nullptr
*
* What we are after are the auxv values defined by the following struct.
*/
struct AuxVector {
Elf::Addr type;
Elf::Addr value;
};
/* Pointer to the environment variables list */
extern char **environ;
/* The environment may have changed since the program started, in which
* case the environ variables list isn't the list the kernel put on stack
* anymore. But in this new list, variables that didn't change still point
* to the strings the kernel put on stack. It is quite unlikely that two
* modified environment variables point to two consecutive strings in memory,
* so we assume that if two consecutive environment variables point to two
* consecutive strings, we found strings the kernel put on stack. */
char **env;
for (env = environ; *env; env++)
if (*env + strlen(*env) + 1 == env[1])
break;
if (!*env)
return;
/* Next, we scan the stack backwards to find a pointer to one of those
* strings we found above, which will give us the location of the original
* envp list. As we are looking for pointers, we need to look at 32-bits or
* 64-bits aligned values, depening on the architecture. */
char **scan = reinterpret_cast<char **>(
reinterpret_cast<uintptr_t>(*env) & ~(sizeof(void *) - 1));
while (*env != *scan)
scan--;
/* Finally, scan forward to find the last environment variable pointer and
* thus the first auxiliary vector. */
while (*scan++);
/* Some platforms have more NULLs here, so skip them if we encounter them */
while (!*scan)
scan++;
AuxVector *auxv = reinterpret_cast<AuxVector *>(scan);
/* The two values of interest in the auxiliary vectors are AT_PHDR and
* AT_PHNUM, which gives us the the location and size of the ELF program
* headers. */
Array<Elf::Phdr> phdrs;
char *base = nullptr;
while (auxv->type) {
if (auxv->type == AT_PHDR) {
phdrs.Init(reinterpret_cast<Elf::Phdr*>(auxv->value));
/* Assume the base address is the first byte of the same page */
base = reinterpret_cast<char *>(PageAlignedPtr(auxv->value));
}
if (auxv->type == AT_PHNUM)
phdrs.Init(auxv->value);
auxv++;
}
if (!phdrs) {
DEBUG_LOG("Couldn't find program headers");
return;
}
/* In some cases, the address for the program headers we get from the
* auxiliary vectors is not mapped, because of the PT_LOAD segments
* definitions in the program executable. Trying to map anonymous memory
* with a hint giving the base address will return a different address
* if something is mapped there, and the base address otherwise. */
MappedPtr mem(MemoryRange::mmap(base, PageSize(), PROT_NONE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
if (mem == base) {
/* If program headers aren't mapped, try to map them */
int fd = open("/proc/self/exe", O_RDONLY);
if (fd == -1) {
DEBUG_LOG("Failed to open /proc/self/exe");
return;
}
mem.Assign(MemoryRange::mmap(base, PageSize(), PROT_READ, MAP_PRIVATE,
fd, 0));
/* If we don't manage to map at the right address, just give up. */
if (mem != base) {
DEBUG_LOG("Couldn't read program headers");
return;
}
}
/* Sanity check: the first bytes at the base address should be an ELF
* header. */
if (!Elf::Ehdr::validate(base)) {
DEBUG_LOG("Couldn't find program base");
return;
}
/* Search for the program PT_DYNAMIC segment */
Array<Elf::Dyn> dyns;
for (Array<Elf::Phdr>::iterator phdr = phdrs.begin(); phdr < phdrs.end();
++phdr) {
/* While the program headers are expected within the first mapped page of
* the program executable, the executable PT_LOADs may actually make them
* loaded at an address that is not the wanted base address of the
* library. We thus need to adjust the base address, compensating for the
* virtual address of the PT_LOAD segment corresponding to offset 0. */
if (phdr->p_type == PT_LOAD && phdr->p_offset == 0)
base -= phdr->p_vaddr;
if (phdr->p_type == PT_DYNAMIC)
dyns.Init(base + phdr->p_vaddr, phdr->p_filesz);
}
if (!dyns) {
DEBUG_LOG("Failed to find PT_DYNAMIC section in program");
return;
}
/* Search for the DT_DEBUG information */
for (Array<Elf::Dyn>::iterator dyn = dyns.begin(); dyn < dyns.end(); ++dyn) {
if (dyn->d_tag == DT_DEBUG) {
dbg = reinterpret_cast<r_debug *>(dyn->d_un.d_ptr);
break;
}
}
DEBUG_LOG("DT_DEBUG points at %p", static_cast<void *>(dbg));
}
/**
* Helper class to ensure the given pointer is writable within the scope of
* an instance. Permissions to the memory page where the pointer lies are
* restored to their original value when the instance is destroyed.
*/
class EnsureWritable
{
public:
template <typename T>
EnsureWritable(T *ptr, size_t length_ = sizeof(T))
{
MOZ_ASSERT(length_ < PageSize());
prot = -1;
page = MAP_FAILED;
char *firstPage = PageAlignedPtr(reinterpret_cast<char *>(ptr));
char *lastPageEnd = PageAlignedEndPtr(reinterpret_cast<char *>(ptr) + length_);
length = lastPageEnd - firstPage;
uintptr_t start = reinterpret_cast<uintptr_t>(firstPage);
uintptr_t end;
prot = getProt(start, &end);
if (prot == -1 || (start + length) > end)
MOZ_CRASH();
if (prot & PROT_WRITE)
return;
page = firstPage;
mprotect(page, length, prot | PROT_WRITE);
}
~EnsureWritable()
{
if (page != MAP_FAILED) {
mprotect(page, length, prot);
}
}
private:
int getProt(uintptr_t addr, uintptr_t *end)
{
/* The interesting part of the /proc/self/maps format looks like:
* startAddr-endAddr rwxp */
int result = 0;
AutoCloseFILE f(fopen("/proc/self/maps", "r"));
while (f) {
unsigned long long startAddr, endAddr;
char perms[5];
if (fscanf(f, "%llx-%llx %4s %*1024[^\n] ", &startAddr, &endAddr, perms) != 3)
return -1;
if (addr < startAddr || addr >= endAddr)
continue;
if (perms[0] == 'r')
result |= PROT_READ;
else if (perms[0] != '-')
return -1;
if (perms[1] == 'w')
result |= PROT_WRITE;
else if (perms[1] != '-')
return -1;
if (perms[2] == 'x')
result |= PROT_EXEC;
else if (perms[2] != '-')
return -1;
*end = endAddr;
return result;
}
return -1;
}
int prot;
void *page;
size_t length;
};
/**
* The system linker maintains a doubly linked list of library it loads
* for use by the debugger. Unfortunately, it also uses the list pointers
* in a lot of operations and adding our data in the list is likely to
* trigger crashes when the linker tries to use data we don't provide or
* that fall off the amount data we allocated. Fortunately, the linker only
* traverses the list forward and accesses the head of the list from a
* private pointer instead of using the value in the r_debug structure.
* This means we can safely add members at the beginning of the list.
* Unfortunately, gdb checks the coherency of l_prev values, so we have
* to adjust the l_prev value for the first element the system linker
* knows about. Fortunately, it doesn't use l_prev, and the first element
* is not ever going to be released before our elements, since it is the
* program executable, so the system linker should not be changing
* r_debug::r_map.
*/
void
ElfLoader::DebuggerHelper::Add(ElfLoader::link_map *map)
{
if (!dbg->r_brk)
return;
dbg->r_state = r_debug::RT_ADD;
dbg->r_brk();
map->l_prev = nullptr;
map->l_next = dbg->r_map;
if (!firstAdded) {
firstAdded = map;
/* When adding a library for the first time, r_map points to data
* handled by the system linker, and that data may be read-only */
EnsureWritable w(&dbg->r_map->l_prev);
dbg->r_map->l_prev = map;
} else
dbg->r_map->l_prev = map;
dbg->r_map = map;
dbg->r_state = r_debug::RT_CONSISTENT;
dbg->r_brk();
}
void
ElfLoader::DebuggerHelper::Remove(ElfLoader::link_map *map)
{
if (!dbg->r_brk)
return;
dbg->r_state = r_debug::RT_DELETE;
dbg->r_brk();
if (dbg->r_map == map)
dbg->r_map = map->l_next;
else if (map->l_prev) {
map->l_prev->l_next = map->l_next;
}
if (map == firstAdded) {
firstAdded = map->l_prev;
/* When removing the first added library, its l_next is going to be
* data handled by the system linker, and that data may be read-only */
EnsureWritable w(&map->l_next->l_prev);
map->l_next->l_prev = map->l_prev;
} else if (map->l_next) {
map->l_next->l_prev = map->l_prev;
}
dbg->r_state = r_debug::RT_CONSISTENT;
dbg->r_brk();
}
#if defined(ANDROID)
/* As some system libraries may be calling signal() or sigaction() to
* set a SIGSEGV handler, effectively breaking MappableSeekableZStream,
* or worse, restore our SIGSEGV handler with wrong flags (which using
* signal() will do), we want to hook into the system's sigaction() to
* replace it with our own wrapper instead, so that our handler is never
* replaced. We used to only do that with libraries this linker loads,
* but it turns out at least one system library does call signal() and
* breaks us (libsc-a3xx.so on the Samsung Galaxy S4).
* As libc's signal (bsd_signal/sysv_signal, really) calls sigaction
* under the hood, instead of calling the signal system call directly,
* we only need to hook sigaction. This is true for both bionic and
* glibc.
*/
/* libc's sigaction */
extern "C" int
sigaction(int signum, const struct sigaction *act,
struct sigaction *oldact);
/* Simple reimplementation of sigaction. This is roughly equivalent
* to the assembly that comes in bionic, but not quite equivalent to
* glibc's implementation, so we only use this on Android. */
int
sys_sigaction(int signum, const struct sigaction *act,
struct sigaction *oldact)
{
return syscall(__NR_sigaction, signum, act, oldact);
}
/* Replace the first instructions of the given function with a jump
* to the given new function. */
template <typename T>
static bool
Divert(T func, T new_func)
{
void *ptr = FunctionPtr(func);
uintptr_t addr = reinterpret_cast<uintptr_t>(ptr);
#if defined(__i386__)
// A 32-bit jump is a 5 bytes instruction.
EnsureWritable w(ptr, 5);
*reinterpret_cast<unsigned char *>(addr) = 0xe9; // jmp
*reinterpret_cast<intptr_t *>(addr + 1) =
reinterpret_cast<uintptr_t>(new_func) - addr - 5; // target displacement
return true;
#elif defined(__arm__)
const unsigned char trampoline[] = {
// .thumb
0x46, 0x04, // nop
0x78, 0x47, // bx pc
0x46, 0x04, // nop
// .arm
0x04, 0xf0, 0x1f, 0xe5, // ldr pc, [pc, #-4]
// .word <new_func>
};
const unsigned char *start;
if (addr & 0x01) {
/* Function is thumb, the actual address of the code is without the
* least significant bit. */
addr--;
/* The arm part of the trampoline needs to be 32-bit aligned */
if (addr & 0x02)
start = trampoline;
else
start = trampoline + 2;
} else {
/* Function is arm, we only need the arm part of the trampoline */
start = trampoline + 6;
}
size_t len = sizeof(trampoline) - (start - trampoline);
EnsureWritable w(reinterpret_cast<void *>(addr), len + sizeof(void *));
memcpy(reinterpret_cast<void *>(addr), start, len);
*reinterpret_cast<void **>(addr + len) = FunctionPtr(new_func);
cacheflush(addr, addr + len + sizeof(void *), 0);
return true;
#else
return false;
#endif
}
#else
#define sys_sigaction sigaction
template <typename T>
static bool
Divert(T func, T new_func)
{
return false;
}
#endif
namespace {
/* Clock that only accounts for time spent in the current process. */
static uint64_t ProcessTimeStamp_Now()
{
struct timespec ts;
int rv = clock_gettime(CLOCK_PROCESS_CPUTIME_ID, &ts);
if (rv != 0) {
return 0;
}
uint64_t baseNs = (uint64_t)ts.tv_sec * 1000000000;
return baseNs + (uint64_t)ts.tv_nsec;
}
}
/* Data structure used to pass data to the temporary signal handler,
* as well as triggering a test crash. */
struct TmpData {
volatile int crash_int;
volatile uint64_t crash_timestamp;
};
SEGVHandler::SEGVHandler()
: initialized(false), registeredHandler(false), signalHandlingBroken(true)
, signalHandlingSlow(true)
{
/* Ensure logging is initialized before the DEBUG_LOG in the test_handler.
* As this constructor runs before the ElfLoader constructor (by effect
* of ElfLoader inheriting from this class), this also initializes on behalf
* of ElfLoader and DebuggerHelper. */
Logging::Init();
/* Initialize oldStack.ss_flags to an invalid value when used to set
* an alternative stack, meaning we haven't got information about the
* original alternative stack and thus don't mean to restore it in
* the destructor. */
oldStack.ss_flags = SS_ONSTACK;
/* Get the current segfault signal handler. */
struct sigaction old_action;
sys_sigaction(SIGSEGV, nullptr, &old_action);
/* Some devices don't provide useful information to their SIGSEGV handlers,
* making it impossible for on-demand decompression to work. To check if
* we're on such a device, setup a temporary handler and deliberately
* trigger a segfault. The handler will set signalHandlingBroken if the
* provided information is bogus.
* Some other devices have a kernel option enabled that makes SIGSEGV handler
* have an overhead so high that it affects how on-demand decompression
* performs. The handler will also set signalHandlingSlow if the triggered
* SIGSEGV took too much time. */
struct sigaction action;
action.sa_sigaction = &SEGVHandler::test_handler;
sigemptyset(&action.sa_mask);
action.sa_flags = SA_SIGINFO | SA_NODEFER;
action.sa_restorer = nullptr;
stackPtr.Assign(MemoryRange::mmap(nullptr, PageSize(),
PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
if (stackPtr.get() == MAP_FAILED)
return;
if (sys_sigaction(SIGSEGV, &action, nullptr))
return;
TmpData *data = reinterpret_cast<TmpData*>(stackPtr.get());
data->crash_timestamp = ProcessTimeStamp_Now();
mprotect(stackPtr, stackPtr.GetLength(), PROT_NONE);
data->crash_int = 123;
/* Restore the original segfault signal handler. */
sys_sigaction(SIGSEGV, &old_action, nullptr);
stackPtr.Assign(MAP_FAILED, 0);
}
void
SEGVHandler::FinishInitialization()
{
/* Ideally, we'd need some locking here, but in practice, we're not
* going to race with another thread. */
initialized = true;
if (signalHandlingBroken || signalHandlingSlow)
return;
typedef int (*sigaction_func)(int, const struct sigaction *,
struct sigaction *);
sigaction_func libc_sigaction;
#if defined(ANDROID)
/* Android > 4.4 comes with a sigaction wrapper in a LD_PRELOADed library
* (libsigchain) for ART. That wrapper kind of does the same trick as we
* do, so we need extra care in handling it.
* - Divert the libc's sigaction, assuming the LD_PRELOADed library uses
* it under the hood (which is more or less true according to the source
* of that library, since it's doing a lookup in RTLD_NEXT)
* - With the LD_PRELOADed library in place, all calls to sigaction from
* from system libraries will go to the LD_PRELOADed library.
* - The LD_PRELOADed library calls to sigaction go to our __wrap_sigaction.
* - The calls to sigaction from libraries faulty.lib loads are sent to
* the LD_PRELOADed library.
* In practice, for signal handling, this means:
* - The signal handler registered to the kernel is ours.
* - Our handler redispatches to the LD_PRELOADed library's if there's a
* segfault we don't handle.
* - The LD_PRELOADed library redispatches according to whatever system
* library or faulty.lib-loaded library set with sigaction.
*
* When there is no sigaction wrapper in place:
* - Divert the libc's sigaction.
* - Calls to sigaction from system library and faulty.lib-loaded libraries
* all go to the libc's sigaction, which end up in our __wrap_sigaction.
* - The signal handler registered to the kernel is ours.
* - Our handler redispatches according to whatever system library or
* faulty.lib-loaded library set with sigaction.
*/
void *libc = dlopen("libc.so", RTLD_GLOBAL | RTLD_LAZY);
if (libc) {
/*
* Lollipop bionic only has a small trampoline in sigaction, with the real
* work happening in __sigaction. Divert there instead of sigaction if it exists.
* Bug 1154803
*/
libc_sigaction = reinterpret_cast<sigaction_func>(dlsym(libc, "__sigaction"));
if (!libc_sigaction) {
libc_sigaction =
reinterpret_cast<sigaction_func>(dlsym(libc, "sigaction"));
}
} else
#endif
{
libc_sigaction = sigaction;
}
if (!Divert(libc_sigaction, __wrap_sigaction))
return;
/* Setup an alternative stack if the already existing one is not big
* enough, or if there is none. */
if (sigaltstack(nullptr, &oldStack) == 0) {
if (oldStack.ss_flags == SS_ONSTACK)
oldStack.ss_flags = 0;
if (!oldStack.ss_sp || oldStack.ss_size < stackSize) {
stackPtr.Assign(MemoryRange::mmap(nullptr, stackSize,
PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
if (stackPtr.get() == MAP_FAILED)
return;
stack_t stack;
stack.ss_sp = stackPtr;
stack.ss_size = stackSize;
stack.ss_flags = 0;
if (sigaltstack(&stack, nullptr) != 0)
return;
}
}
/* Register our own handler, and store the already registered one in
* SEGVHandler's struct sigaction member */
action.sa_sigaction = &SEGVHandler::handler;
action.sa_flags = SA_SIGINFO | SA_NODEFER | SA_ONSTACK;
registeredHandler = !sys_sigaction(SIGSEGV, &action, &this->action);
}
SEGVHandler::~SEGVHandler()
{
/* Restore alternative stack for signals */
if (oldStack.ss_flags != SS_ONSTACK)
sigaltstack(&oldStack, nullptr);
/* Restore original signal handler */
if (registeredHandler)
sys_sigaction(SIGSEGV, &this->action, nullptr);
}
/* Test handler for a deliberately triggered SIGSEGV that determines whether
* useful information is provided to signal handlers, particularly whether
* si_addr is filled in properly, and whether the segfault handler is called
* quickly enough. */
void SEGVHandler::test_handler(int signum, siginfo_t *info, void *context)
{
SEGVHandler &that = ElfLoader::Singleton;
if (signum == SIGSEGV && info &&
info->si_addr == that.stackPtr.get())
that.signalHandlingBroken = false;
mprotect(that.stackPtr, that.stackPtr.GetLength(), PROT_READ | PROT_WRITE);
TmpData *data = reinterpret_cast<TmpData*>(that.stackPtr.get());
uint64_t latency = ProcessTimeStamp_Now() - data->crash_timestamp;
DEBUG_LOG("SEGVHandler latency: %" PRIu64, latency);
/* See bug 886736 for timings on different devices, 150 µs is reasonably above
* the latency on "working" devices and seems to be short enough to not incur
* a huge overhead to on-demand decompression. */
if (latency <= 150000)
that.signalHandlingSlow = false;
}
/* TODO: "properly" handle signal masks and flags */
void SEGVHandler::handler(int signum, siginfo_t *info, void *context)
{
//ASSERT(signum == SIGSEGV);
DEBUG_LOG("Caught segmentation fault @%p", info->si_addr);
/* Check whether we segfaulted in the address space of a CustomElf. We're
* only expecting that to happen as an access error. */
if (info->si_code == SEGV_ACCERR) {
RefPtr<LibHandle> handle =
ElfLoader::Singleton.GetHandleByPtr(info->si_addr);
BaseElf *elf;
if (handle && (elf = handle->AsBaseElf())) {
DEBUG_LOG("Within the address space of %s", handle->GetPath());
if (elf->mappable && elf->mappable->ensure(info->si_addr)) {
return;
}
}
}
/* Redispatch to the registered handler */
SEGVHandler &that = ElfLoader::Singleton;
if (that.action.sa_flags & SA_SIGINFO) {
DEBUG_LOG("Redispatching to registered handler @%p",
FunctionPtr(that.action.sa_sigaction));
that.action.sa_sigaction(signum, info, context);
} else if (that.action.sa_handler == SIG_DFL) {
DEBUG_LOG("Redispatching to default handler");
/* Reset the handler to the default one, and trigger it. */
sys_sigaction(signum, &that.action, nullptr);
raise(signum);
} else if (that.action.sa_handler != SIG_IGN) {
DEBUG_LOG("Redispatching to registered handler @%p",
FunctionPtr(that.action.sa_handler));
that.action.sa_handler(signum);
} else {
DEBUG_LOG("Ignoring");
}
}
int
SEGVHandler::__wrap_sigaction(int signum, const struct sigaction *act,
struct sigaction *oldact)
{
SEGVHandler &that = ElfLoader::Singleton;
/* Use system sigaction() function for all but SIGSEGV signals. */
if (!that.registeredHandler || (signum != SIGSEGV))
return sys_sigaction(signum, act, oldact);
if (oldact)
*oldact = that.action;
if (act)
that.action = *act;
return 0;
}
Logging Logging::Singleton;
Reference in New Issue View Git Blame Copy Permalink