1 /* Core file handling.
2 Copyright (C) 2008-2010, 2013, 2015 Red Hat, Inc.
3 This file is part of elfutils.
4
5 This file is free software; you can redistribute it and/or modify
6 it under the terms of either
7
8 * the GNU Lesser General Public License as published by the Free
9 Software Foundation; either version 3 of the License, or (at
10 your option) any later version
11
12 or
13
14 * the GNU General Public License as published by the Free
15 Software Foundation; either version 2 of the License, or (at
16 your option) any later version
17
18 or both in parallel, as here.
19
20 elfutils is distributed in the hope that it will be useful, but
21 WITHOUT ANY WARRANTY; without even the implied warranty of
22 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23 General Public License for more details.
24
25 You should have received copies of the GNU General Public License and
26 the GNU Lesser General Public License along with this program. If
27 not, see <http://www.gnu.org/licenses/>. */
28
29 #include <config.h>
30 #include "../libelf/libelfP.h" /* For NOTE_ALIGN. */
31 #undef _
32 #include "libdwflP.h"
33 #include <gelf.h>
34
35 #include <unistd.h>
36 #include <endian.h>
37 #include <byteswap.h>
38 #include "system.h"
39
40
41 /* On failure return, we update *NEXT to point back at OFFSET. */
42 static inline Elf *
do_fail(int error,off_t * next,off_t offset)43 do_fail (int error, off_t *next, off_t offset)
44 {
45 if (next != NULL)
46 *next = offset;
47 //__libelf_seterrno (error);
48 __libdwfl_seterrno (DWFL_E (LIBELF, error));
49 return NULL;
50 }
51
52 #define fail(error) do_fail (error, next, offset)
53
54 /* This is a prototype of what a new libelf interface might be.
55 This implementation is pessimal for non-mmap cases and should
56 be replaced by more diddling inside libelf internals. */
57 static Elf *
elf_begin_rand(Elf * parent,off_t offset,off_t size,off_t * next)58 elf_begin_rand (Elf *parent, off_t offset, off_t size, off_t *next)
59 {
60 if (parent == NULL)
61 return NULL;
62
63 off_t min = (parent->kind == ELF_K_ELF ?
64 (parent->class == ELFCLASS32
65 ? sizeof (Elf32_Ehdr) : sizeof (Elf64_Ehdr))
66 : parent->kind == ELF_K_AR ? SARMAG
67 : 0);
68
69 if (unlikely (offset < min)
70 || unlikely (offset >= (off_t) parent->maximum_size))
71 return fail (ELF_E_RANGE);
72
73 /* For an archive, fetch just the size field
74 from the archive header to override SIZE. */
75 if (parent->kind == ELF_K_AR)
76 {
77 struct ar_hdr h = { .ar_size = "" };
78
79 if (unlikely (parent->maximum_size - offset < sizeof h))
80 return fail (ELF_E_RANGE);
81
82 if (parent->map_address != NULL)
83 memcpy (h.ar_size, parent->map_address + parent->start_offset + offset,
84 sizeof h.ar_size);
85 else if (unlikely (pread_retry (parent->fildes,
86 h.ar_size, sizeof (h.ar_size),
87 parent->start_offset + offset
88 + offsetof (struct ar_hdr, ar_size))
89 != sizeof (h.ar_size)))
90 return fail (ELF_E_READ_ERROR);
91
92 offset += sizeof h;
93
94 char *endp;
95 size = strtoll (h.ar_size, &endp, 10);
96 if (unlikely (endp == h.ar_size)
97 || unlikely ((off_t) parent->maximum_size - offset < size))
98 return fail (ELF_E_INVALID_ARCHIVE);
99 }
100
101 if (unlikely ((off_t) parent->maximum_size - offset < size))
102 return fail (ELF_E_RANGE);
103
104 /* Even if we fail at this point, update *NEXT to point past the file. */
105 if (next != NULL)
106 *next = offset + size;
107
108 if (unlikely (offset == 0)
109 && unlikely (size == (off_t) parent->maximum_size))
110 return elf_clone (parent, parent->cmd);
111
112 /* Note the image is guaranteed live only as long as PARENT
113 lives. Using elf_memory is quite suboptimal if the whole
114 file is not mmap'd. We really should have something like
115 a generalization of the archive support. */
116 Elf_Data *data = elf_getdata_rawchunk (parent, offset, size, ELF_T_BYTE);
117 if (data == NULL)
118 return NULL;
119 assert ((off_t) data->d_size == size);
120 return elf_memory (data->d_buf, size);
121 }
122
123
124 int
dwfl_report_core_segments(Dwfl * dwfl,Elf * elf,size_t phnum,GElf_Phdr * notes)125 dwfl_report_core_segments (Dwfl *dwfl, Elf *elf, size_t phnum, GElf_Phdr *notes)
126 {
127 if (unlikely (dwfl == NULL))
128 return -1;
129
130 int result = 0;
131
132 if (notes != NULL)
133 notes->p_type = PT_NULL;
134
135 for (size_t ndx = 0; result >= 0 && ndx < phnum; ++ndx)
136 {
137 GElf_Phdr phdr_mem;
138 GElf_Phdr *phdr = gelf_getphdr (elf, ndx, &phdr_mem);
139 if (unlikely (phdr == NULL))
140 {
141 __libdwfl_seterrno (DWFL_E_LIBELF);
142 return -1;
143 }
144 switch (phdr->p_type)
145 {
146 case PT_LOAD:
147 result = dwfl_report_segment (dwfl, ndx, phdr, 0, NULL);
148 break;
149
150 case PT_NOTE:
151 if (notes != NULL)
152 {
153 *notes = *phdr;
154 notes = NULL;
155 }
156 break;
157 }
158 }
159
160 return result;
161 }
162
163 /* Never read more than this much without mmap. */
164 #define MAX_EAGER_COST 8192
165
166 /* Dwfl_Module_Callback passed to and called by dwfl_segment_report_module
167 to read in a segment as ELF image directly if possible or indicate an
168 attempt must be made to read in the while segment right now. */
169 static bool
core_file_read_eagerly(Dwfl_Module * mod,void ** userdata,const char * name,Dwarf_Addr start,void ** buffer,size_t * buffer_available,GElf_Off cost,GElf_Off worthwhile,GElf_Off whole,GElf_Off contiguous,void * arg,Elf ** elfp)170 core_file_read_eagerly (Dwfl_Module *mod,
171 void **userdata __attribute__ ((unused)),
172 const char *name __attribute__ ((unused)),
173 Dwarf_Addr start __attribute__ ((unused)),
174 void **buffer, size_t *buffer_available,
175 GElf_Off cost, GElf_Off worthwhile,
176 GElf_Off whole,
177 GElf_Off contiguous __attribute__ ((unused)),
178 void *arg, Elf **elfp)
179 {
180 Elf *core = arg;
181
182 /* The available buffer is often the whole segment when the core file
183 was mmap'd if used together with the dwfl_elf_phdr_memory_callback.
184 Which means that if it is complete we can just construct the whole
185 ELF image right now without having to read in anything more. */
186 if (whole <= *buffer_available)
187 {
188 /* All there ever was, we already have on hand. */
189
190 if (core->map_address == NULL)
191 {
192 /* We already malloc'd the buffer. */
193 *elfp = elf_memory (*buffer, whole);
194 if (unlikely (*elfp == NULL))
195 return false;
196
197 (*elfp)->flags |= ELF_F_MALLOCED;
198 *buffer = NULL;
199 *buffer_available = 0;
200 return true;
201 }
202
203 /* We can use the image inside the core file directly. */
204 *elfp = elf_begin_rand (core, *buffer - core->map_address, whole, NULL);
205 *buffer = NULL;
206 *buffer_available = 0;
207 return *elfp != NULL;
208 }
209
210 /* We don't have the whole file. Which either means the core file
211 wasn't mmap'd, but needs to still be read in, or that the segment
212 is truncated. Figure out if this is better than nothing. */
213
214 if (worthwhile == 0)
215 /* Caller doesn't think so. */
216 return false;
217
218 /*
219 XXX would like to fall back to partial file via memory
220 when build id find_elf fails
221 also, link_map name may give file name from disk better than partial here
222 requires find_elf hook re-doing the magic to fall back if no file found
223 */
224
225 if (whole > MAX_EAGER_COST && mod->build_id_len > 0)
226 /* We can't cheaply read the whole file here, so we'd
227 be using a partial file. But there is a build ID that could
228 help us find the whole file, which might be more useful than
229 what we have. We'll just rely on that. */
230 return false;
231
232 /* The file is either small (most likely the vdso) or big and incomplete,
233 but we don't have a build-id. */
234
235 if (core->map_address != NULL)
236 /* It's cheap to get, so get it. */
237 return true;
238
239 /* Only use it if there isn't too much to be read. */
240 return cost <= MAX_EAGER_COST;
241 }
242
243 static inline void
update_end(GElf_Phdr * pphdr,const GElf_Off align,GElf_Off * pend,GElf_Addr * pend_vaddr)244 update_end (GElf_Phdr *pphdr, const GElf_Off align,
245 GElf_Off *pend, GElf_Addr *pend_vaddr)
246 {
247 *pend = (pphdr->p_offset + pphdr->p_filesz + align - 1) & -align;
248 *pend_vaddr = (pphdr->p_vaddr + pphdr->p_memsz + align - 1) & -align;
249 }
250
251 /* Use following contiguous segments to get towards SIZE. */
252 static inline bool
do_more(size_t size,GElf_Phdr * pphdr,const GElf_Off align,Elf * elf,GElf_Off start,int * pndx,GElf_Off * pend,GElf_Addr * pend_vaddr)253 do_more (size_t size, GElf_Phdr *pphdr, const GElf_Off align,
254 Elf *elf, GElf_Off start, int *pndx,
255 GElf_Off *pend, GElf_Addr *pend_vaddr)
256 {
257 while (*pend <= start || *pend - start < size)
258 {
259 if (pphdr->p_filesz < pphdr->p_memsz)
260 /* This segment is truncated, so no following one helps us. */
261 return false;
262
263 if (unlikely (gelf_getphdr (elf, (*pndx)++, pphdr) == NULL))
264 return false;
265
266 if (pphdr->p_type == PT_LOAD)
267 {
268 if (pphdr->p_offset > *pend
269 || pphdr->p_vaddr > *pend_vaddr)
270 /* It's discontiguous! */
271 return false;
272
273 update_end (pphdr, align, pend, pend_vaddr);
274 }
275 }
276 return true;
277 }
278
279 #define more(size) do_more (size, &phdr, align, elf, start, &ndx, &end, &end_vaddr)
280
281 bool
dwfl_elf_phdr_memory_callback(Dwfl * dwfl,int ndx,void ** buffer,size_t * buffer_available,GElf_Addr vaddr,size_t minread,void * arg)282 dwfl_elf_phdr_memory_callback (Dwfl *dwfl, int ndx,
283 void **buffer, size_t *buffer_available,
284 GElf_Addr vaddr,
285 size_t minread,
286 void *arg)
287 {
288 Elf *elf = arg;
289
290 if (ndx == -1)
291 {
292 /* Called for cleanup. */
293 if (elf->map_address == NULL)
294 free (*buffer);
295 *buffer = NULL;
296 *buffer_available = 0;
297 return false;
298 }
299
300 const GElf_Off align = dwfl->segment_align ?: 1;
301 GElf_Phdr phdr;
302
303 do
304 if (unlikely (gelf_getphdr (elf, ndx++, &phdr) == NULL))
305 return false;
306 while (phdr.p_type != PT_LOAD
307 || ((phdr.p_vaddr + phdr.p_memsz + align - 1) & -align) <= vaddr);
308
309 GElf_Off start = vaddr - phdr.p_vaddr + phdr.p_offset;
310 GElf_Off end;
311 GElf_Addr end_vaddr;
312
313 update_end (&phdr, align, &end, &end_vaddr);
314
315 /* We need at least this much. */
316 if (! more (minread))
317 return false;
318
319 /* See how much more we can get of what the caller wants. */
320 (void) more (*buffer_available);
321
322 /* If it's already on hand anyway, use as much as there is. */
323 if (elf->map_address != NULL)
324 (void) more (elf->maximum_size - start);
325
326 /* Make sure we don't look past the end of the actual file,
327 even if the headers tell us to. */
328 if (unlikely (end > elf->maximum_size))
329 end = elf->maximum_size;
330
331 /* If the file is too small, there is nothing at all to get. */
332 if (unlikely (start >= end))
333 return false;
334
335 if (elf->map_address != NULL)
336 {
337 void *contents = elf->map_address + elf->start_offset + start;
338 size_t size = end - start;
339
340 if (minread == 0) /* String mode. */
341 {
342 const void *eos = memchr (contents, '\0', size);
343 if (unlikely (eos == NULL) || unlikely (eos == contents))
344 return false;
345 size = eos + 1 - contents;
346 }
347
348 if (*buffer == NULL)
349 {
350 *buffer = contents;
351 *buffer_available = size;
352 }
353 else
354 {
355 *buffer_available = MIN (size, *buffer_available);
356 memcpy (*buffer, contents, *buffer_available);
357 }
358 }
359 else
360 {
361 void *into = *buffer;
362 if (*buffer == NULL)
363 {
364 *buffer_available = MIN (minread ?: 512,
365 MAX (4096, MIN (end - start,
366 *buffer_available)));
367 into = malloc (*buffer_available);
368 if (unlikely (into == NULL))
369 {
370 __libdwfl_seterrno (DWFL_E_NOMEM);
371 return false;
372 }
373 }
374
375 ssize_t nread = pread_retry (elf->fildes, into, *buffer_available, start);
376 if (nread < (ssize_t) minread)
377 {
378 if (into != *buffer)
379 free (into);
380 if (nread < 0)
381 __libdwfl_seterrno (DWFL_E_ERRNO);
382 return false;
383 }
384
385 if (minread == 0) /* String mode. */
386 {
387 const void *eos = memchr (into, '\0', nread);
388 if (unlikely (eos == NULL) || unlikely (eos == into))
389 {
390 if (*buffer == NULL)
391 free (into);
392 return false;
393 }
394 nread = eos + 1 - into;
395 }
396
397 if (*buffer == NULL)
398 *buffer = into;
399 *buffer_available = nread;
400 }
401
402 return true;
403 }
404
405 /* Free the contents of R_DEBUG_INFO without the R_DEBUG_INFO memory itself. */
406
407 static void
clear_r_debug_info(struct r_debug_info * r_debug_info)408 clear_r_debug_info (struct r_debug_info *r_debug_info)
409 {
410 while (r_debug_info->module != NULL)
411 {
412 struct r_debug_info_module *module = r_debug_info->module;
413 r_debug_info->module = module->next;
414 elf_end (module->elf);
415 if (module->fd != -1)
416 close (module->fd);
417 free (module);
418 }
419 }
420
421 bool
422 internal_function
__libdwfl_dynamic_vaddr_get(Elf * elf,GElf_Addr * vaddrp)423 __libdwfl_dynamic_vaddr_get (Elf *elf, GElf_Addr *vaddrp)
424 {
425 size_t phnum;
426 if (unlikely (elf_getphdrnum (elf, &phnum) != 0))
427 return false;
428 for (size_t i = 0; i < phnum; ++i)
429 {
430 GElf_Phdr phdr_mem;
431 GElf_Phdr *phdr = gelf_getphdr (elf, i, &phdr_mem);
432 if (unlikely (phdr == NULL))
433 return false;
434 if (phdr->p_type == PT_DYNAMIC)
435 {
436 *vaddrp = phdr->p_vaddr;
437 return true;
438 }
439 }
440 return false;
441 }
442
443 int
dwfl_core_file_report(Dwfl * dwfl,Elf * elf,const char * executable)444 dwfl_core_file_report (Dwfl *dwfl, Elf *elf, const char *executable)
445 {
446 size_t phnum;
447 if (unlikely (elf_getphdrnum (elf, &phnum) != 0))
448 {
449 __libdwfl_seterrno (DWFL_E_LIBELF);
450 return -1;
451 }
452
453 bool cleanup_user_core = false;
454 if (dwfl->user_core != NULL)
455 free (dwfl->user_core->executable_for_core);
456 if (executable == NULL)
457 {
458 if (dwfl->user_core != NULL)
459 dwfl->user_core->executable_for_core = NULL;
460 }
461 else
462 {
463 if (dwfl->user_core == NULL)
464 {
465 cleanup_user_core = true;
466 dwfl->user_core = calloc (1, sizeof (struct Dwfl_User_Core));
467 if (dwfl->user_core == NULL)
468 {
469 __libdwfl_seterrno (DWFL_E_NOMEM);
470 return -1;
471 }
472 dwfl->user_core->fd = -1;
473 }
474 dwfl->user_core->executable_for_core = strdup (executable);
475 if (dwfl->user_core->executable_for_core == NULL)
476 {
477 if (cleanup_user_core)
478 {
479 free (dwfl->user_core);
480 dwfl->user_core = NULL;
481 }
482 __libdwfl_seterrno (DWFL_E_NOMEM);
483 return -1;
484 }
485 }
486
487 /* First report each PT_LOAD segment. */
488 GElf_Phdr notes_phdr;
489 int ndx = dwfl_report_core_segments (dwfl, elf, phnum, ¬es_phdr);
490 if (unlikely (ndx <= 0))
491 {
492 if (cleanup_user_core)
493 {
494 free (dwfl->user_core->executable_for_core);
495 free (dwfl->user_core);
496 dwfl->user_core = NULL;
497 }
498 return ndx;
499 }
500
501 /* Next, we should follow the chain from DT_DEBUG. */
502
503 const void *auxv = NULL;
504 const void *note_file = NULL;
505 size_t auxv_size = 0;
506 size_t note_file_size = 0;
507 if (likely (notes_phdr.p_type == PT_NOTE))
508 {
509 /* PT_NOTE -> NT_AUXV -> AT_PHDR -> PT_DYNAMIC -> DT_DEBUG */
510
511 Elf_Data *notes = elf_getdata_rawchunk (elf,
512 notes_phdr.p_offset,
513 notes_phdr.p_filesz,
514 (notes_phdr.p_align == 8
515 ? ELF_T_NHDR8
516 : ELF_T_NHDR));
517 if (likely (notes != NULL))
518 {
519 size_t pos = 0;
520 GElf_Nhdr nhdr;
521 size_t name_pos;
522 size_t desc_pos;
523 while ((pos = gelf_getnote (notes, pos, &nhdr,
524 &name_pos, &desc_pos)) > 0)
525 if (nhdr.n_namesz == sizeof "CORE"
526 && !memcmp (notes->d_buf + name_pos, "CORE", sizeof "CORE"))
527 {
528 if (nhdr.n_type == NT_AUXV)
529 {
530 auxv = notes->d_buf + desc_pos;
531 auxv_size = nhdr.n_descsz;
532 }
533 if (nhdr.n_type == NT_FILE)
534 {
535 note_file = notes->d_buf + desc_pos;
536 note_file_size = nhdr.n_descsz;
537 }
538 }
539 }
540 }
541
542 /* Now we have NT_AUXV contents. From here on this processing could be
543 used for a live process with auxv read from /proc. */
544
545 struct r_debug_info r_debug_info;
546 memset (&r_debug_info, 0, sizeof r_debug_info);
547 int retval = dwfl_link_map_report (dwfl, auxv, auxv_size,
548 dwfl_elf_phdr_memory_callback, elf,
549 &r_debug_info);
550 int listed = retval > 0 ? retval : 0;
551
552 /* Now sniff segment contents for modules hinted by information gathered
553 from DT_DEBUG. */
554
555 ndx = 0;
556 do
557 {
558 int seg = dwfl_segment_report_module (dwfl, ndx, NULL,
559 &dwfl_elf_phdr_memory_callback, elf,
560 core_file_read_eagerly, elf,
561 note_file, note_file_size,
562 &r_debug_info);
563 if (unlikely (seg < 0))
564 {
565 clear_r_debug_info (&r_debug_info);
566 return seg;
567 }
568 if (seg > ndx)
569 {
570 ndx = seg;
571 ++listed;
572 }
573 else
574 ++ndx;
575 }
576 while (ndx < (int) phnum);
577
578 /* Now report the modules from dwfl_link_map_report which were not filtered
579 out by dwfl_segment_report_module. */
580
581 Dwfl_Module **lastmodp = &dwfl->modulelist;
582 while (*lastmodp != NULL)
583 lastmodp = &(*lastmodp)->next;
584 for (struct r_debug_info_module *module = r_debug_info.module;
585 module != NULL; module = module->next)
586 {
587 if (module->elf == NULL)
588 continue;
589 GElf_Addr file_dynamic_vaddr;
590 if (! __libdwfl_dynamic_vaddr_get (module->elf, &file_dynamic_vaddr))
591 continue;
592 Dwfl_Module *mod;
593 mod = __libdwfl_report_elf (dwfl, basename (module->name), module->name,
594 module->fd, module->elf,
595 module->l_ld - file_dynamic_vaddr,
596 true, true);
597 if (mod == NULL)
598 continue;
599 ++listed;
600 module->elf = NULL;
601 module->fd = -1;
602 /* Move this module to the end of the list, so that we end
603 up with a list in the same order as the link_map chain. */
604 if (mod->next != NULL)
605 {
606 if (*lastmodp != mod)
607 {
608 lastmodp = &dwfl->modulelist;
609 while (*lastmodp != mod)
610 lastmodp = &(*lastmodp)->next;
611 }
612 *lastmodp = mod->next;
613 mod->next = NULL;
614 while (*lastmodp != NULL)
615 lastmodp = &(*lastmodp)->next;
616 *lastmodp = mod;
617 }
618 lastmodp = &mod->next;
619 }
620
621 clear_r_debug_info (&r_debug_info);
622
623 /* We return the number of modules we found if we found any.
624 If we found none, we return -1 instead of 0 if there was an
625 error rather than just nothing found. */
626 return listed > 0 ? listed : retval;
627 }
628 INTDEF (dwfl_core_file_report)
629 NEW_VERSION (dwfl_core_file_report, ELFUTILS_0.158)
630
631 #ifdef SYMBOL_VERSIONING
632 int _compat_without_executable_dwfl_core_file_report (Dwfl *dwfl, Elf *elf);
633 COMPAT_VERSION_NEWPROTO (dwfl_core_file_report, ELFUTILS_0.146,
634 without_executable)
635
636 int
_compat_without_executable_dwfl_core_file_report(Dwfl * dwfl,Elf * elf)637 _compat_without_executable_dwfl_core_file_report (Dwfl *dwfl, Elf *elf)
638 {
639 return dwfl_core_file_report (dwfl, elf, NULL);
640 }
641 #endif
642