ld.so分析之7 _dl_sysdep_start

ld.so分析之7 _dl_sysdep_start

 (sysdeps/generic/dl-sysdep.c)

1.获取内核传递过来的信息

Elf32_Addr//ElfW(Addr)
_dl_sysdep_start (void **start_argptr,
          void (*dl_main) (const ElfW(Phdr) *phdr, ElfW(Word) phnum,
                   ElfW(Addr) *user_entry))
{
  const ElfW(Phdr) *phdr = NULL;
  ElfW(Word) phnum = 0;
  ElfW(Addr) user_entry;
  ElfW(auxv_t) *av;
  uid_t uid = 0;
  gid_t gid = 0;
//#ifdef HAVE_AUX_XID
//# define set_seen(tag) (tag) /* Evaluate for the side effects.  */
//#else
  unsigned int seen = 0;
# define M(type) (1 << (type))
# define set_seen(tag) seen |= M ((tag)->a_type)
//#endif

  DL_FIND_ARG_COMPONENTS (start_argptr, _dl_argc, INTUSE(_dl_argv), _environ,
              _dl_auxv);

2.DL_FIND_ARG_COMPONENTS

# define DL_FIND_ARG_COMPONENTS(cookie, argc, argv, envp, auxp)    \
  do {                                          \
    void **_tmp;                                  \
    (argc) = *(long int *) cookie;                          \
    (argv) = (char **) ((long int *) cookie + 1);                  \
    (envp) = (argv) + (argc) + 1;                          \
    for (_tmp = (void **) (envp); *_tmp; ++_tmp)                  \
      continue;                                      \
    (auxp) = (void *) ++_tmp;                              \
  } while (0)

start_argptr指向argc在栈上的地址，因此这个宏的目的很简单，取得argc,argv,envp,auxp变量值。现在再次把内核传递信息贴出

注意前面的实参
start_argptr, 是局部变量
_dl_argc,  有hidden属性
INTUSE(_dl_argv),即_dl_argv_internal 有hidden属性,是_dl_argv的alias,_dl_argv是全局变量
_environ, 有hidden属性，但是最终的符号属性是
  307: 00012524     4 OBJECT  LOCAL  DEFAULT   14 _environ
有点不一样，不知道什么原因？
_dl_auxv 是局部变量
因此会使用GOFOFF访问他们而不需要重定位



/*
内存布局如下
  position            content                     size (bytes) + comment
  ------------------------------------------------------------------------
  stack pointer ->  [ argc = number of args ]     4
                    [ argv[0] (pointer) ]         4   (program name)
                    [ argv[1] (pointer) ]         4
                    [ argv[..] (pointer) ]        4 * x
                    [ argv[n - 1] (pointer) ]     4
                    [ argv[n] (pointer) ]         4   (= NULL)

                    [ envp[0] (pointer) ]         4
                    [ envp[1] (pointer) ]         4
                    [ envp[..] (pointer) ]        4
                    [ envp[term] (pointer) ]      4   (= NULL)

                    [ auxv[0] AT_PHDR (Elf32_auxv_t) ]    8
                    [ auxv[1] AT_PHENT (Elf32_auxv_t) ]    8
                    [ auxv[2] AT_PHNUM (Elf32_auxv_t) ]   8
                    [ auxv[3] AT_BASE (Elf32_auxv_t) ]   8
                    [ auxv[4] AT_FLAGS (Elf32_auxv_t) ]   8
                    [ auxv[5] AT_ENTRY (Elf32_auxv_t) ]   8
                    [ auxv[6] AT_UID (Elf32_auxv_t) ]   8
                    [ auxv[7] AT_EUID (Elf32_auxv_t) ]   8
                    [ auxv[8] AT_GID (Elf32_auxv_t) ]   8
                    [ auxv[9] AT_EGID (Elf32_auxv_t) ]   8
                    [ auxv[10] AT_HWCAP (Elf32_auxv_t) ]   8
                    [ auxv[11] AT_PAGESZ (Elf32_auxv_t) ]   8
                    [ auxv[12] AT_CLKTCK (Elf32_auxv_t) ]   8
                    [ auxv[13] AT_PLATFORM (Elf32_auxv_t) ]   8
                    [ auxv[14] (Elf32_auxv_t) ] 8   (= AT_NULL vector)

         [ padding ]                   0 - 15                    
                    [ padding ]                   16                    
                    [ padding ]                   0 - 15                    

         [k_platform]                  0 - 65
                    [ argument ASCIIZ strings ]   >= 0
                    [ environment ASCIIZ str. ]   >= 0
                       [filename] >=0

  (0xbffffffc)      [ end marker ]                4   (= NULL)

  (0xc0000000)      < top of stack >              0   (virtual)
*/

3.解析auxv

  user_entry = (ElfW(Addr)) ENTRY_POINT;//_start，默认为ld.so的_start，_start有属性hidden
  GL(dl_platform) = NULL; /* Default to nothing known about the platform.  */

  for (av = _dl_auxv; av->a_type != AT_NULL; set_seen (av++))
    switch (av->a_type)
      {
      case AT_PHDR:
    phdr = av->a_un.a_ptr;
    break;
      case AT_PHNUM:
    phnum = av->a_un.a_val;
    break;
      case AT_PAGESZ:
    GL(dl_pagesize) = av->a_un.a_val;//4k
    break;
      case AT_ENTRY:
    user_entry = av->a_un.a_val;//用户入口
    break;
//#ifdef NEED_DL_BASE_ADDR
//      case AT_BASE:
//    _dl_base_addr = av->a_un.a_val;
//    break;
//#endif
      case AT_UID:
      case AT_EUID:
    uid ^= av->a_un.a_val;//等价于uid=0^AT_UID^AT_EUID=AT_UID^AT_EUID,即判断AT_UID和AT_EUID是否相等
    break;
      case AT_GID:
      case AT_EGID:
    gid ^= av->a_un.a_val;//同理判断AT_GID和AT_EGID是否相等
    break;
      case AT_PLATFORM:
    GL(dl_platform) = av->a_un.a_ptr;
    break;
      case AT_HWCAP:
    GL(dl_hwcap) = av->a_un.a_val;
    break;
      case AT_CLKTCK:
    GL(dl_clktck) = av->a_un.a_val;
    break;
      case AT_FPUCW:
    GL(dl_fpu_control) = av->a_un.a_val;
    break;
      }

//#ifdef DL_SYSDEP_OSCHECK
  DL_SYSDEP_OSCHECK (dl_fatal);//编译时为空
//#endif

  /* Fill in the values we have not gotten from the kernel through the
     auxiliary vector.  */
//#ifndef HAVE_AUX_XID
# define SEE(UID, var, uid) \
   if ((seen & M (AT_##UID)) == 0) var ^= __get##uid ()/就如果没有该属性，就调用系统调用取得
  SEE (UID, uid, uid);//if ((seen & (1 << (AT_UID))) == 0) uid ^= __getuid ();
  SEE (EUID, uid, euid);//if ((seen & (1 << (AT_EUID))) == 0) uid ^= __geteuid ();
  SEE (GID, gid, gid);//if ((seen & (1 << (AT_GID))) == 0) gid ^= __getgid ();
  SEE (EGID, gid, egid);//if ((seen & (1 << (AT_EGID))) == 0) gid ^= __getegid ();
//#endif

  /* If one of the two pairs of IDs does not mattch this is a setuid
如果两对id中有一个不等，则这是一个setuid和setgid程序
     or setgid run.  */
  INTUSE(__libc_enable_secure) = uid | gid;

//#ifndef HAVE_AUX_PAGESIZE
  if (GL(dl_pagesize) == 0)
    GL(dl_pagesize) = __getpagesize ();
//#endif

//#ifdef DL_SYSDEP_INIT
  DL_SYSDEP_INIT;
//#endif

//#ifdef DL_PLATFORM_INIT
  DL_PLATFORM_INIT;
//#endif

4.DL_SYSDEP_INIT(sysdeps/unix/sysv/linux/dl-sysdep.c)

#define DL_SYSDEP_INIT frob_brk ()

static inline void
frob_brk (void)
{
  __brk (0);            /* Initialize the break.  取得brk起始地址*/
}


5.DL_SYSDEP_INIT->frob_brk ->__brk(sysdeps/unix/sysv/linux/i386/brk.c)

/* This must be initialized data because commons can't have aliases.  */
void *__curbrk = 0;

/* Old braindamage in GCC's crtstuff.c requires this symbol in an attempt
   to work around different old braindamage in the old Linux ELF dynamic
   linker.  */
weak_alias (__curbrk, ___brk_addr)

int
__brk (void *addr)
{
  void *__unbounded newbrk, *__unbounded scratch;

  asm ("movl %%ebx, %1\n"    /* Save %ebx in scratch register.  保存%ebx,这是GOT地址*/
       "movl %3, %%ebx\n"    /* Put ADDR in %ebx to be syscall arg.  将addr值存入%ebx*/
       "int $0x80 # %2\n"    /* Perform the system call.  执行系统调用*/
       "movl %1, %%ebx\n"    /* Restore %ebx from scratch register. 还原%ebx */
       : "=a" (newbrk), "=r" (scratch)
       : "0" (SYS_ify (brk)), "g" (__ptrvalue (addr)));//SYS_ify(brk)等价于__NR_brk,即系统调用sys_brk

  __curbrk = newbrk;//返回新地址

  if (newbrk < addr)
    {
      __set_errno (ENOMEM);
      return -1;
    }

  return 0;
}

weak_alias (__brk, brk)//brk是__brk的alias且weak


6.DL_SYSDEP_INIT->frob_brk ->__brk->sys_brk(内核中 2.4.0)

asmlinkage unsigned long sys_brk(unsigned long brk)
{
    unsigned long rlim, retval;
    unsigned long newbrk, oldbrk;
    struct mm_struct *mm = current->mm;

    down(&mm->mmap_sem);

    if (brk < mm->end_code)
        goto out;

由于前面的调用参数是0,因此直接out
out:
    retval = mm->brk;
    up(&mm->mmap_sem);
    return retval;
}

返回mm->brk,由于到目前为止还没有调用sys_brk,应该返回的是mm->start_brk，即紧随bss后的地址.

验证
[zws@mail ~/glibc-2.3/build/elf]$strace -e brk ls
brk(0)                                  = 0x80586c8
...
[zws@mail ~]$readelf -S /bin/ls
  [23] .bss              NOBITS          08058360 010360 000368 00  WA  0   0 32

0x8058360+0x368=0x80586c8

7.DL_PLATFORM_INIT(sysdeps/i386/dl-machine.h)

/* We define an initialization functions.  This is called very early in
   _dl_sysdep_start.  */
#define DL_PLATFORM_INIT dl_platform_init ()

static inline void //__attribute__ ((unused))
dl_platform_init (void)//这个函数没什么可说的
{
  if (GL(dl_platform) != NULL && *GL(dl_platform) == '\0')
    /* Avoid an empty string which would disturb us.  */
    GL(dl_platform) = NULL;
}

8.调用__sbrk

  /* Determine the length of the platform name.  */
  if (GL(dl_platform) != NULL)
    GL(dl_platformlen) = strlen (GL(dl_platform));

  if (__sbrk (0) == &_end)
    /* The dynamic linker was run as a program, and so the initial break
动态链接器本身直接运行,所有起始break就紧随bss，在&_end处
       starts just after our bss, at &_end.  The malloc in dl-minimal.c
       will consume the rest of this page, so tell the kernel to move the
在dl-minimal.c中的malloc将消耗掉该页剩下部分,所有告诉内核移动break跳过该部分
       break up that far.  When the user program examines its break, it
       will see this new value and not clobber our data.  
当用户程序检查它的break,它将会看到新值，而不会破坏我们的数据.

不太明白这里的意思?
*/
    __sbrk (GL(dl_pagesize) - ((&_end - (void *) 0) & (GL(dl_pagesize) - 1)));


9.__sbrk(sysdeps/generic/sbrk.c)
/* Extend the process's data space by INCREMENT.
根据INCREMENT扩展进程数据空间
   If INCREMENT is negative, shrink data space by - INCREMENT.
如果INCREMENT是负数，缩减数据空间INCREMENT大小
   Return start of new space allocated, or -1 for errors.
返回新分配空间的起始地址
 */
void *
__sbrk (intptr_t increment)
{
  void *oldbrk;

  /* If this is not part of the dynamic library or the library is used
     via dynamic loading in a statically linked program update
     __curbrk from the kernel's brk value.  That way two separate
     instances of __brk and __sbrk can share the heap, returning
     interleaved pieces of it.  */
  if (__curbrk == NULL || __libc_multiple_libcs)//__libc_multiple_libcs=0,因此本条件为假，不会调用__brk
    if (__brk (0) < 0)        /* Initialize the break.  */
      return (void *) -1;

  if (increment == 0)//为0，直接返回__curbrk
    return __curbrk;

  oldbrk = __curbrk;
  if (__brk (oldbrk + increment) < 0)//扩展到oldbrk+increment
    return (void *) -1;

  return oldbrk;
}


10.返回_dl_sysdep_start

  /* If this is a SUID program we make sure that FDs 0, 1, and 2 are
     allocated.  If necessary we are doing it ourself.  If it is not
如果是SUID程序，确保FD 0,1,2都被分配,如果必须，我们自己分配它们。
     possible we stop the program.  
否则停止程序
*/
  if (__builtin_expect (INTUSE(__libc_enable_secure), 0))
    __libc_check_standard_fds ();

11.__libc_check_standard_fds (sysdeps/generic/check_fds.c)

void
__libc_check_standard_fds (void)
{
  /* This is really paranoid but some people actually are.  If /dev/null
这确实有点偏执
     should happen to be a symlink to somewhere else and not the device
如果/dev/null碰巧被符号链接到某处，而不是我们通常认为的那个/dev/null设备，我们退出
     commonly known as "/dev/null" we bail out.  We can detect this with
     the O_NOFOLLOW flag for open() but only on some system.  
我们能使用O_NOFOLLOW标识调用open来测试这种情况,仅对某些系统可以.
*/
//#ifndef O_NOFOLLOW //已定义，是0400000
//# define O_NOFOLLOW    0
//#endif
  /* Check all three standard file descriptors.  */
  check_one_fd (STDIN_FILENO, O_RDONLY | O_NOFOLLOW);
  check_one_fd (STDOUT_FILENO, O_RDWR | O_NOFOLLOW);
  check_one_fd (STDERR_FILENO, O_RDWR | O_NOFOLLOW);
}

12.__libc_check_standard_fds->check_one_fd  (sysdeps/generic/check_fds.c)

/* Should other OSes (e.g., Hurd) have different versions which can
   be written in a better way?  */
static void
check_one_fd (int fd, int mode)
{
  if (__builtin_expect (__libc_fcntl (fd, F_GETFD), 0) == -1
      && errno == EBADF)//该fd不存在
    {
      struct stat64 st;

      /* Something is wrong with this descriptor, it's probably not
该描述符出错，可能是未打开
     opened.  Open /dev/null so that the SUID program we are
打开/dev/null以便SUID程序能使用它
     about to start does not accidently use this descriptor.  */
      int nullfd = __libc_open (_PATH_DEVNULL, mode);
      /* We are very paranoid here.  With all means we try to ensure
     that we are actually opening the /dev/null device and nothing
     else.

     Note that the following code assumes that STDIN_FILENO,
     STDOUT_FILENO, STDERR_FILENO are the three lowest file
     decsriptor numbers, in this order.  */
      if (__builtin_expect (nullfd != fd, 0)//安装的fd不是想要的
      || __builtin_expect (__fxstat64 (_STAT_VER, fd, &st), 0) != 0//不能stat该fd
      || __builtin_expect (S_ISCHR (st.st_mode), 1) == 0//该fd不是字符设备
#if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
      || st.st_rdev != makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)//该设备不是空设备
#endif
      )
    /* We cannot even give an error message here since it would
       run into the same problems.  
                不能给出错误消息，因为可能会碰到同样的问题
*/
    while (1)
      /* Try for ever and ever.  */
      ABORT_INSTRUCTION;//asm ("hlt");
    }
}

13.一且都准备好了，调用dl_main

  (*dl_main) (phdr, phnum, &user_entry);
  return user_entry;
}