Runtime handling of thread-specific data in ELFs. March 14, 2017

Transcription

1 handling of thread-specific data in ELFs EPITA Systems/Security Laboratory (LSE) March 14, / 21

2 2 / 21

3 TLS? GCC/G++ thread int i; extern thread struct state s; static thread char *p; Visual C++: declspec( thread ) int i = 0; Since C++11: thread_local 3 / 21

4 Support needed Linker Standard C library Thread library Dynamic linker 4 / 21

5 Example (1/4) int main(void) { pthread_t thread_one; pthread_t thread_two; // [...] if (pthread_create(&thread_one, NULL, do_stuff, &count) pthread_create(&thread_two, NULL, do_other_stuff, &count)) { printf("error while creating threads\n"); return 1; } if (pthread_join(thread_one, NULL) pthread_join(thread_two, NULL)) { printf("error while joining threads\n"); return 1; } // [...] 5 / 21

6 Example (2/4) static thread int tls_var; void *do_stuff(void *arg) { tls_var = 63; read(-1, NULL, 1); int *cnt = (int*)arg; while(*cnt < 2000) { pthread_mutex_lock(&mutex); printf("in first thread %d\n", (*cnt)++); pthread_mutex_unlock(&mutex); } printf(" === TLS VAR [1] : %d, errno : %d === \n", tls_var, errno); return NULL; } 6 / 21

7 Example (3/4) void *do_other_stuff(void *arg) { tls_var = 36; int *cnt = (int*)arg; while(*cnt < 2000) { pthread_mutex_lock(&mutex); printf("in second thread %d\n", (*cnt)++); pthread_mutex_unlock(&mutex); } } printf(" === TLS VAR [2] : %d, errno : %d === \n", tls_var, errno); return NULL; 7 / 21

8 Example (4/4) $./test In first thread 1977 In first thread 1978 [...] In second thread 1984 In second thread 1985 In second thread 1986 In second thread 1987 [...] In first thread 1997 In first thread 1998 In first thread 1999 === TLS VAR [1] : 63, errno : 9 === In second thread 2000 === TLS VAR [2] : 36, errno : 0 === Errno Main Thread: 12 8 / 21

9 9 / 21

10 Relocations 101 Relocation table DT RELA (or DT REL).plt calls DT JMPREL Find symbols Relocate.data,.bss 10 / 21

11 Thread-local variables.tdata,.tbss sections Program header PT TLS Initialization image man elf(5) 11 / 21

12 Data structures Figure: TLS data structures (Variant 1) 12 / 21

13 Data structures Figure: TLS data structures (Variant 2) 13 / 21

14 Startup Static or lazy allocation check DT FLAGS Might be optimized $ readelf -r./test fc R_X86_64_DTPMOD tls_lib_var fd R_X86_64_DTPOFF tls_lib_var / 21

15 tls get addr void * tls_get_addr (size_t m, size_t offset) { char *tls_block = dtv[thread_id][m]; } return tls_block + offset; $ readelf -r./test R_X86_64_JUMP_SLO 0000 tls_get_addr@glibc_ / 21

16 Figure: Optimization needed 16 / 21

17 tls get addr void * tls_get_addr (size_t m, size_t offset) { char *tls_block = dtv[thread_id][m]; if (tls_block == UNALLOC_BLK) tls_block = dtv[thread_id][m] = tls_allocation(m); } return tls_block + offset; Allocate tls : cf. TLS initialization image set to zero 17 / 21

18 Acces thread vector Architecture dependant Example : x86 General purpose segment registers %fs, %gs Useful syscalls: modify ldt(2) set thread area(2) arch prctl(2) 18 / 21

19 Misc Linker optimizations Pthread library Windows (TlsAlloc, TlsGetValue,... ) Etc. 19 / 21

20 References 1 ELF Handling For Thread-Local 2 musl C standard library 3 GNU C Library 20 / 21

21 Questions? Contact: Figure: And suddenly / 21