• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /* Core file handling.
2    Copyright (C) 2008-2010, 2013, 2015 Red Hat, Inc.
3    This file is part of elfutils.
4 
5    This file is free software; you can redistribute it and/or modify
6    it under the terms of either
7 
8      * the GNU Lesser General Public License as published by the Free
9        Software Foundation; either version 3 of the License, or (at
10        your option) any later version
11 
12    or
13 
14      * the GNU General Public License as published by the Free
15        Software Foundation; either version 2 of the License, or (at
16        your option) any later version
17 
18    or both in parallel, as here.
19 
20    elfutils is distributed in the hope that it will be useful, but
21    WITHOUT ANY WARRANTY; without even the implied warranty of
22    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
23    General Public License for more details.
24 
25    You should have received copies of the GNU General Public License and
26    the GNU Lesser General Public License along with this program.  If
27    not, see <http://www.gnu.org/licenses/>.  */
28 
29 #include <config.h>
30 #include "../libelf/libelfP.h"	/* For NOTE_ALIGN.  */
31 #undef	_
32 #include "libdwflP.h"
33 #include <gelf.h>
34 
35 #include <unistd.h>
36 #include <endian.h>
37 #include <byteswap.h>
38 #include "system.h"
39 
40 
41 /* On failure return, we update *NEXT to point back at OFFSET.  */
42 static inline Elf *
do_fail(int error,off_t * next,off_t offset)43 do_fail (int error, off_t *next, off_t offset)
44 {
45     if (next != NULL)
46       *next = offset;
47     //__libelf_seterrno (error);
48     __libdwfl_seterrno (DWFL_E (LIBELF, error));
49     return NULL;
50 }
51 
52 #define fail(error) do_fail (error, next, offset)
53 
54 /* This is a prototype of what a new libelf interface might be.
55    This implementation is pessimal for non-mmap cases and should
56    be replaced by more diddling inside libelf internals.  */
57 static Elf *
elf_begin_rand(Elf * parent,off_t offset,off_t size,off_t * next)58 elf_begin_rand (Elf *parent, off_t offset, off_t size, off_t *next)
59 {
60   if (parent == NULL)
61     return NULL;
62 
63   off_t min = (parent->kind == ELF_K_ELF ?
64 		(parent->class == ELFCLASS32
65 		 ? sizeof (Elf32_Ehdr) : sizeof (Elf64_Ehdr))
66 		: parent->kind == ELF_K_AR ? SARMAG
67 		: 0);
68 
69   if (unlikely (offset < min)
70       || unlikely (offset >= (off_t) parent->maximum_size))
71     return fail (ELF_E_RANGE);
72 
73   /* For an archive, fetch just the size field
74      from the archive header to override SIZE.  */
75   if (parent->kind == ELF_K_AR)
76     {
77       struct ar_hdr h = { .ar_size = "" };
78 
79       if (unlikely (parent->maximum_size - offset < sizeof h))
80 	return fail (ELF_E_RANGE);
81 
82       if (parent->map_address != NULL)
83 	memcpy (h.ar_size, parent->map_address + parent->start_offset + offset,
84 		sizeof h.ar_size);
85       else if (unlikely (pread_retry (parent->fildes,
86 				      h.ar_size, sizeof (h.ar_size),
87 				      parent->start_offset + offset
88 				      + offsetof (struct ar_hdr, ar_size))
89 			 != sizeof (h.ar_size)))
90 	return fail (ELF_E_READ_ERROR);
91 
92       offset += sizeof h;
93 
94       char *endp;
95       size = strtoll (h.ar_size, &endp, 10);
96       if (unlikely (endp == h.ar_size)
97 	  || unlikely ((off_t) parent->maximum_size - offset < size))
98 	return fail (ELF_E_INVALID_ARCHIVE);
99     }
100 
101   if (unlikely ((off_t) parent->maximum_size - offset < size))
102     return fail (ELF_E_RANGE);
103 
104   /* Even if we fail at this point, update *NEXT to point past the file.  */
105   if (next != NULL)
106     *next = offset + size;
107 
108   if (unlikely (offset == 0)
109       && unlikely (size == (off_t) parent->maximum_size))
110     return elf_clone (parent, parent->cmd);
111 
112   /* Note the image is guaranteed live only as long as PARENT
113      lives.  Using elf_memory is quite suboptimal if the whole
114      file is not mmap'd.  We really should have something like
115      a generalization of the archive support.  */
116   Elf_Data *data = elf_getdata_rawchunk (parent, offset, size, ELF_T_BYTE);
117   if (data == NULL)
118     return NULL;
119   assert ((off_t) data->d_size == size);
120   return elf_memory (data->d_buf, size);
121 }
122 
123 
124 int
dwfl_report_core_segments(Dwfl * dwfl,Elf * elf,size_t phnum,GElf_Phdr * notes)125 dwfl_report_core_segments (Dwfl *dwfl, Elf *elf, size_t phnum, GElf_Phdr *notes)
126 {
127   if (unlikely (dwfl == NULL))
128     return -1;
129 
130   int result = 0;
131 
132   if (notes != NULL)
133     notes->p_type = PT_NULL;
134 
135   for (size_t ndx = 0; result >= 0 && ndx < phnum; ++ndx)
136     {
137       GElf_Phdr phdr_mem;
138       GElf_Phdr *phdr = gelf_getphdr (elf, ndx, &phdr_mem);
139       if (unlikely (phdr == NULL))
140 	{
141 	  __libdwfl_seterrno (DWFL_E_LIBELF);
142 	  return -1;
143 	}
144       switch (phdr->p_type)
145 	{
146 	case PT_LOAD:
147 	  result = dwfl_report_segment (dwfl, ndx, phdr, 0, NULL);
148 	  break;
149 
150 	case PT_NOTE:
151 	  if (notes != NULL)
152 	    {
153 	      *notes = *phdr;
154 	      notes = NULL;
155 	    }
156 	  break;
157 	}
158     }
159 
160   return result;
161 }
162 
163 /* Never read more than this much without mmap.  */
164 #define MAX_EAGER_COST	8192
165 
166 /* Dwfl_Module_Callback passed to and called by dwfl_segment_report_module
167    to read in a segment as ELF image directly if possible or indicate an
168    attempt must be made to read in the while segment right now.  */
169 static bool
core_file_read_eagerly(Dwfl_Module * mod,void ** userdata,const char * name,Dwarf_Addr start,void ** buffer,size_t * buffer_available,GElf_Off cost,GElf_Off worthwhile,GElf_Off whole,GElf_Off contiguous,void * arg,Elf ** elfp)170 core_file_read_eagerly (Dwfl_Module *mod,
171 			void **userdata __attribute__ ((unused)),
172 			const char *name __attribute__ ((unused)),
173 			Dwarf_Addr start __attribute__ ((unused)),
174 			void **buffer, size_t *buffer_available,
175 			GElf_Off cost, GElf_Off worthwhile,
176 			GElf_Off whole,
177 			GElf_Off contiguous __attribute__ ((unused)),
178 			void *arg, Elf **elfp)
179 {
180   Elf *core = arg;
181 
182   /* The available buffer is often the whole segment when the core file
183      was mmap'd if used together with the dwfl_elf_phdr_memory_callback.
184      Which means that if it is complete we can just construct the whole
185      ELF image right now without having to read in anything more.  */
186   if (whole <= *buffer_available)
187     {
188       /* All there ever was, we already have on hand.  */
189 
190       if (core->map_address == NULL)
191 	{
192 	  /* We already malloc'd the buffer.  */
193 	  *elfp = elf_memory (*buffer, whole);
194 	  if (unlikely (*elfp == NULL))
195 	    return false;
196 
197 	  (*elfp)->flags |= ELF_F_MALLOCED;
198 	  *buffer = NULL;
199 	  *buffer_available = 0;
200 	  return true;
201 	}
202 
203       /* We can use the image inside the core file directly.  */
204       *elfp = elf_begin_rand (core, *buffer - core->map_address, whole, NULL);
205       *buffer = NULL;
206       *buffer_available = 0;
207       return *elfp != NULL;
208     }
209 
210   /* We don't have the whole file.  Which either means the core file
211      wasn't mmap'd, but needs to still be read in, or that the segment
212      is truncated.  Figure out if this is better than nothing.  */
213 
214   if (worthwhile == 0)
215     /* Caller doesn't think so.  */
216     return false;
217 
218   /*
219     XXX would like to fall back to partial file via memory
220     when build id find_elf fails
221     also, link_map name may give file name from disk better than partial here
222     requires find_elf hook re-doing the magic to fall back if no file found
223   */
224 
225   if (whole > MAX_EAGER_COST && mod->build_id_len > 0)
226     /* We can't cheaply read the whole file here, so we'd
227        be using a partial file.  But there is a build ID that could
228        help us find the whole file, which might be more useful than
229        what we have.  We'll just rely on that.  */
230     return false;
231 
232   /* The file is either small (most likely the vdso) or big and incomplete,
233      but we don't have a build-id.  */
234 
235   if (core->map_address != NULL)
236     /* It's cheap to get, so get it.  */
237     return true;
238 
239   /* Only use it if there isn't too much to be read.  */
240   return cost <= MAX_EAGER_COST;
241 }
242 
243 static inline void
update_end(GElf_Phdr * pphdr,const GElf_Off align,GElf_Off * pend,GElf_Addr * pend_vaddr)244 update_end (GElf_Phdr *pphdr, const GElf_Off align,
245             GElf_Off *pend, GElf_Addr *pend_vaddr)
246 {
247   *pend = (pphdr->p_offset + pphdr->p_filesz + align - 1) & -align;
248   *pend_vaddr = (pphdr->p_vaddr + pphdr->p_memsz + align - 1) & -align;
249 }
250 
251 /* Use following contiguous segments to get towards SIZE.  */
252 static inline bool
do_more(size_t size,GElf_Phdr * pphdr,const GElf_Off align,Elf * elf,GElf_Off start,int * pndx,GElf_Off * pend,GElf_Addr * pend_vaddr)253 do_more (size_t size, GElf_Phdr *pphdr, const GElf_Off align,
254          Elf *elf, GElf_Off start, int *pndx,
255          GElf_Off *pend, GElf_Addr *pend_vaddr)
256 {
257   while (*pend <= start || *pend - start < size)
258     {
259       if (pphdr->p_filesz < pphdr->p_memsz)
260 	/* This segment is truncated, so no following one helps us.  */
261 	return false;
262 
263       if (unlikely (gelf_getphdr (elf, (*pndx)++, pphdr) == NULL))
264 	return false;
265 
266       if (pphdr->p_type == PT_LOAD)
267 	{
268 	  if (pphdr->p_offset > *pend
269 	      || pphdr->p_vaddr > *pend_vaddr)
270 	    /* It's discontiguous!  */
271 	    return false;
272 
273 	  update_end (pphdr, align, pend, pend_vaddr);
274 	}
275     }
276   return true;
277 }
278 
279 #define more(size) do_more (size, &phdr, align, elf, start, &ndx, &end, &end_vaddr)
280 
281 bool
dwfl_elf_phdr_memory_callback(Dwfl * dwfl,int ndx,void ** buffer,size_t * buffer_available,GElf_Addr vaddr,size_t minread,void * arg)282 dwfl_elf_phdr_memory_callback (Dwfl *dwfl, int ndx,
283 			       void **buffer, size_t *buffer_available,
284 			       GElf_Addr vaddr,
285 			       size_t minread,
286 			       void *arg)
287 {
288   Elf *elf = arg;
289 
290   if (ndx == -1)
291     {
292       /* Called for cleanup.  */
293       if (elf->map_address == NULL)
294 	free (*buffer);
295       *buffer = NULL;
296       *buffer_available = 0;
297       return false;
298     }
299 
300   const GElf_Off align = dwfl->segment_align ?: 1;
301   GElf_Phdr phdr;
302 
303   do
304     if (unlikely (gelf_getphdr (elf, ndx++, &phdr) == NULL))
305       return false;
306   while (phdr.p_type != PT_LOAD
307 	 || ((phdr.p_vaddr + phdr.p_memsz + align - 1) & -align) <= vaddr);
308 
309   GElf_Off start = vaddr - phdr.p_vaddr + phdr.p_offset;
310   GElf_Off end;
311   GElf_Addr end_vaddr;
312 
313   update_end (&phdr, align, &end, &end_vaddr);
314 
315   /* We need at least this much.  */
316   if (! more (minread))
317     return false;
318 
319   /* See how much more we can get of what the caller wants.  */
320   (void) more (*buffer_available);
321 
322   /* If it's already on hand anyway, use as much as there is.  */
323   if (elf->map_address != NULL)
324     (void) more (elf->maximum_size - start);
325 
326   /* Make sure we don't look past the end of the actual file,
327      even if the headers tell us to.  */
328   if (unlikely (end > elf->maximum_size))
329     end = elf->maximum_size;
330 
331   /* If the file is too small, there is nothing at all to get.  */
332   if (unlikely (start >= end))
333     return false;
334 
335   if (elf->map_address != NULL)
336     {
337       void *contents = elf->map_address + elf->start_offset + start;
338       size_t size = end - start;
339 
340       if (minread == 0)		/* String mode.  */
341 	{
342 	  const void *eos = memchr (contents, '\0', size);
343 	  if (unlikely (eos == NULL) || unlikely (eos == contents))
344 	    return false;
345 	  size = eos + 1 - contents;
346 	}
347 
348       if (*buffer == NULL)
349 	{
350 	  *buffer = contents;
351 	  *buffer_available = size;
352 	}
353       else
354 	{
355 	  *buffer_available = MIN (size, *buffer_available);
356 	  memcpy (*buffer, contents, *buffer_available);
357 	}
358     }
359   else
360     {
361       void *into = *buffer;
362       if (*buffer == NULL)
363 	{
364 	  *buffer_available = MIN (minread ?: 512,
365 				   MAX (4096, MIN (end - start,
366 						   *buffer_available)));
367 	  into = malloc (*buffer_available);
368 	  if (unlikely (into == NULL))
369 	    {
370 	      __libdwfl_seterrno (DWFL_E_NOMEM);
371 	      return false;
372 	    }
373 	}
374 
375       ssize_t nread = pread_retry (elf->fildes, into, *buffer_available, start);
376       if (nread < (ssize_t) minread)
377 	{
378 	  if (into != *buffer)
379 	    free (into);
380 	  if (nread < 0)
381 	    __libdwfl_seterrno (DWFL_E_ERRNO);
382 	  return false;
383 	}
384 
385       if (minread == 0)		/* String mode.  */
386 	{
387 	  const void *eos = memchr (into, '\0', nread);
388 	  if (unlikely (eos == NULL) || unlikely (eos == into))
389 	    {
390 	      if (*buffer == NULL)
391 		free (into);
392 	      return false;
393 	    }
394 	  nread = eos + 1 - into;
395 	}
396 
397       if (*buffer == NULL)
398 	*buffer = into;
399       *buffer_available = nread;
400     }
401 
402   return true;
403 }
404 
405 /* Free the contents of R_DEBUG_INFO without the R_DEBUG_INFO memory itself.  */
406 
407 static void
clear_r_debug_info(struct r_debug_info * r_debug_info)408 clear_r_debug_info (struct r_debug_info *r_debug_info)
409 {
410   while (r_debug_info->module != NULL)
411     {
412       struct r_debug_info_module *module = r_debug_info->module;
413       r_debug_info->module = module->next;
414       elf_end (module->elf);
415       if (module->fd != -1)
416 	close (module->fd);
417       free (module);
418     }
419 }
420 
421 bool
422 internal_function
__libdwfl_dynamic_vaddr_get(Elf * elf,GElf_Addr * vaddrp)423 __libdwfl_dynamic_vaddr_get (Elf *elf, GElf_Addr *vaddrp)
424 {
425   size_t phnum;
426   if (unlikely (elf_getphdrnum (elf, &phnum) != 0))
427     return false;
428   for (size_t i = 0; i < phnum; ++i)
429     {
430       GElf_Phdr phdr_mem;
431       GElf_Phdr *phdr = gelf_getphdr (elf, i, &phdr_mem);
432       if (unlikely (phdr == NULL))
433 	return false;
434       if (phdr->p_type == PT_DYNAMIC)
435 	{
436 	  *vaddrp = phdr->p_vaddr;
437 	  return true;
438 	}
439     }
440   return false;
441 }
442 
443 int
dwfl_core_file_report(Dwfl * dwfl,Elf * elf,const char * executable)444 dwfl_core_file_report (Dwfl *dwfl, Elf *elf, const char *executable)
445 {
446   size_t phnum;
447   if (unlikely (elf_getphdrnum (elf, &phnum) != 0))
448     {
449       __libdwfl_seterrno (DWFL_E_LIBELF);
450       return -1;
451     }
452 
453   bool cleanup_user_core = false;
454   if (dwfl->user_core != NULL)
455     free (dwfl->user_core->executable_for_core);
456   if (executable == NULL)
457     {
458       if (dwfl->user_core != NULL)
459 	dwfl->user_core->executable_for_core = NULL;
460     }
461   else
462     {
463       if (dwfl->user_core == NULL)
464 	{
465 	  cleanup_user_core = true;
466 	  dwfl->user_core = calloc (1, sizeof (struct Dwfl_User_Core));
467 	  if (dwfl->user_core == NULL)
468 	    {
469 	      __libdwfl_seterrno (DWFL_E_NOMEM);
470 	      return -1;
471 	    }
472 	  dwfl->user_core->fd = -1;
473 	}
474       dwfl->user_core->executable_for_core = strdup (executable);
475       if (dwfl->user_core->executable_for_core == NULL)
476 	{
477 	  if (cleanup_user_core)
478 	    {
479 	      free (dwfl->user_core);
480 	      dwfl->user_core = NULL;
481 	    }
482 	  __libdwfl_seterrno (DWFL_E_NOMEM);
483 	  return -1;
484 	}
485     }
486 
487   /* First report each PT_LOAD segment.  */
488   GElf_Phdr notes_phdr;
489   int ndx = dwfl_report_core_segments (dwfl, elf, phnum, &notes_phdr);
490   if (unlikely (ndx <= 0))
491     {
492       if (cleanup_user_core)
493 	{
494 	  free (dwfl->user_core->executable_for_core);
495 	  free (dwfl->user_core);
496 	  dwfl->user_core = NULL;
497 	}
498       return ndx;
499     }
500 
501   /* Next, we should follow the chain from DT_DEBUG.  */
502 
503   const void *auxv = NULL;
504   const void *note_file = NULL;
505   size_t auxv_size = 0;
506   size_t note_file_size = 0;
507   if (likely (notes_phdr.p_type == PT_NOTE))
508     {
509       /* PT_NOTE -> NT_AUXV -> AT_PHDR -> PT_DYNAMIC -> DT_DEBUG */
510 
511       Elf_Data *notes = elf_getdata_rawchunk (elf,
512 					      notes_phdr.p_offset,
513 					      notes_phdr.p_filesz,
514 					      (notes_phdr.p_align == 8
515 					       ? ELF_T_NHDR8
516 					       : ELF_T_NHDR));
517       if (likely (notes != NULL))
518 	{
519 	  size_t pos = 0;
520 	  GElf_Nhdr nhdr;
521 	  size_t name_pos;
522 	  size_t desc_pos;
523 	  while ((pos = gelf_getnote (notes, pos, &nhdr,
524 				      &name_pos, &desc_pos)) > 0)
525 	    if (nhdr.n_namesz == sizeof "CORE"
526 		&& !memcmp (notes->d_buf + name_pos, "CORE", sizeof "CORE"))
527 	      {
528 		if (nhdr.n_type == NT_AUXV)
529 		  {
530 		    auxv = notes->d_buf + desc_pos;
531 		    auxv_size = nhdr.n_descsz;
532 		  }
533 		if (nhdr.n_type == NT_FILE)
534 		  {
535 		    note_file = notes->d_buf + desc_pos;
536 		    note_file_size = nhdr.n_descsz;
537 		  }
538 	      }
539 	}
540     }
541 
542   /* Now we have NT_AUXV contents.  From here on this processing could be
543      used for a live process with auxv read from /proc.  */
544 
545   struct r_debug_info r_debug_info;
546   memset (&r_debug_info, 0, sizeof r_debug_info);
547   int retval = dwfl_link_map_report (dwfl, auxv, auxv_size,
548 				     dwfl_elf_phdr_memory_callback, elf,
549 				     &r_debug_info);
550   int listed = retval > 0 ? retval : 0;
551 
552   /* Now sniff segment contents for modules hinted by information gathered
553      from DT_DEBUG.  */
554 
555   ndx = 0;
556   do
557     {
558       int seg = dwfl_segment_report_module (dwfl, ndx, NULL,
559 					    &dwfl_elf_phdr_memory_callback, elf,
560 					    core_file_read_eagerly, elf,
561 					    note_file, note_file_size,
562 					    &r_debug_info);
563       if (unlikely (seg < 0))
564 	{
565 	  clear_r_debug_info (&r_debug_info);
566 	  return seg;
567 	}
568       if (seg > ndx)
569 	{
570 	  ndx = seg;
571 	  ++listed;
572 	}
573       else
574 	++ndx;
575     }
576   while (ndx < (int) phnum);
577 
578   /* Now report the modules from dwfl_link_map_report which were not filtered
579      out by dwfl_segment_report_module.  */
580 
581   Dwfl_Module **lastmodp = &dwfl->modulelist;
582   while (*lastmodp != NULL)
583     lastmodp = &(*lastmodp)->next;
584   for (struct r_debug_info_module *module = r_debug_info.module;
585        module != NULL; module = module->next)
586     {
587       if (module->elf == NULL)
588 	continue;
589       GElf_Addr file_dynamic_vaddr;
590       if (! __libdwfl_dynamic_vaddr_get (module->elf, &file_dynamic_vaddr))
591 	continue;
592       Dwfl_Module *mod;
593       mod = __libdwfl_report_elf (dwfl, basename (module->name), module->name,
594 				  module->fd, module->elf,
595 				  module->l_ld - file_dynamic_vaddr,
596 				  true, true);
597       if (mod == NULL)
598 	continue;
599       ++listed;
600       module->elf = NULL;
601       module->fd = -1;
602       /* Move this module to the end of the list, so that we end
603 	 up with a list in the same order as the link_map chain.  */
604       if (mod->next != NULL)
605 	{
606 	  if (*lastmodp != mod)
607 	    {
608 	      lastmodp = &dwfl->modulelist;
609 	      while (*lastmodp != mod)
610 		lastmodp = &(*lastmodp)->next;
611 	    }
612 	  *lastmodp = mod->next;
613 	  mod->next = NULL;
614 	  while (*lastmodp != NULL)
615 	    lastmodp = &(*lastmodp)->next;
616 	  *lastmodp = mod;
617 	}
618       lastmodp = &mod->next;
619     }
620 
621   clear_r_debug_info (&r_debug_info);
622 
623   /* We return the number of modules we found if we found any.
624      If we found none, we return -1 instead of 0 if there was an
625      error rather than just nothing found.  */
626   return listed > 0 ? listed : retval;
627 }
628 INTDEF (dwfl_core_file_report)
629 NEW_VERSION (dwfl_core_file_report, ELFUTILS_0.158)
630 
631 #ifdef SYMBOL_VERSIONING
632 int _compat_without_executable_dwfl_core_file_report (Dwfl *dwfl, Elf *elf);
633 COMPAT_VERSION_NEWPROTO (dwfl_core_file_report, ELFUTILS_0.146,
634 			 without_executable)
635 
636 int
_compat_without_executable_dwfl_core_file_report(Dwfl * dwfl,Elf * elf)637 _compat_without_executable_dwfl_core_file_report (Dwfl *dwfl, Elf *elf)
638 {
639   return dwfl_core_file_report (dwfl, elf, NULL);
640 }
641 #endif
642