DynamicLinker.cpp 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569
  1. /*
  2. * Copyright (c) 2020, Itamar S. <itamar8910@gmail.com>
  3. * Copyright (c) 2021, Andreas Kling <kling@serenityos.org>
  4. * Copyright (c) 2021, the SerenityOS developers.
  5. *
  6. * SPDX-License-Identifier: BSD-2-Clause
  7. */
  8. #include <AK/ByteBuffer.h>
  9. #include <AK/Debug.h>
  10. #include <AK/HashMap.h>
  11. #include <AK/HashTable.h>
  12. #include <AK/LexicalPath.h>
  13. #include <AK/NonnullRefPtrVector.h>
  14. #include <AK/ScopeGuard.h>
  15. #include <AK/Vector.h>
  16. #include <LibC/bits/pthread_integration.h>
  17. #include <LibC/link.h>
  18. #include <LibC/sys/mman.h>
  19. #include <LibC/unistd.h>
  20. #include <LibDl/dlfcn.h>
  21. #include <LibDl/dlfcn_integration.h>
  22. #include <LibELF/AuxiliaryVector.h>
  23. #include <LibELF/DynamicLinker.h>
  24. #include <LibELF/DynamicLoader.h>
  25. #include <LibELF/DynamicObject.h>
  26. #include <LibELF/Hashes.h>
  27. #include <fcntl.h>
  28. #include <string.h>
  29. #include <sys/types.h>
  30. #include <syscall.h>
  31. namespace ELF {
  32. static HashMap<String, NonnullRefPtr<ELF::DynamicLoader>> s_loaders;
  33. static String s_main_program_name;
  34. static OrderedHashMap<String, NonnullRefPtr<ELF::DynamicObject>> s_global_objects;
  35. using EntryPointFunction = int (*)(int, char**, char**);
  36. using LibCExitFunction = void (*)(int);
  37. using DlIteratePhdrCallbackFunction = int (*)(struct dl_phdr_info*, size_t, void*);
  38. using DlIteratePhdrFunction = int (*)(DlIteratePhdrCallbackFunction, void*);
  39. extern "C" [[noreturn]] void _invoke_entry(int argc, char** argv, char** envp, EntryPointFunction entry);
  40. static size_t s_current_tls_offset = 0;
  41. static size_t s_total_tls_size = 0;
  42. static size_t s_allocated_tls_block_size = 0;
  43. static char** s_envp = nullptr;
  44. static LibCExitFunction s_libc_exit = nullptr;
  45. static __pthread_mutex_t s_loader_lock = __PTHREAD_MUTEX_INITIALIZER;
  46. static bool s_allowed_to_check_environment_variables { false };
  47. static bool s_do_breakpoint_trap_before_entry { false };
  48. static Result<void, DlErrorMessage> __dlclose(void* handle);
  49. static Result<void*, DlErrorMessage> __dlopen(const char* filename, int flags);
  50. static Result<void*, DlErrorMessage> __dlsym(void* handle, const char* symbol_name);
  51. static Result<void, DlErrorMessage> __dladdr(void* addr, Dl_info* info);
  52. Optional<DynamicObject::SymbolLookupResult> DynamicLinker::lookup_global_symbol(const StringView& name)
  53. {
  54. Optional<DynamicObject::SymbolLookupResult> weak_result;
  55. auto symbol = DynamicObject::HashSymbol { name };
  56. for (auto& lib : s_global_objects) {
  57. auto res = lib.value->lookup_symbol(symbol);
  58. if (!res.has_value())
  59. continue;
  60. if (res.value().bind == STB_GLOBAL)
  61. return res;
  62. if (res.value().bind == STB_WEAK && !weak_result.has_value())
  63. weak_result = res;
  64. // We don't want to allow local symbols to be pulled in to other modules
  65. }
  66. return weak_result;
  67. }
  68. static String get_library_name(String path)
  69. {
  70. return LexicalPath::basename(move(path));
  71. }
  72. static Result<NonnullRefPtr<DynamicLoader>, DlErrorMessage> map_library(const String& filename, int fd)
  73. {
  74. auto result = ELF::DynamicLoader::try_create(fd, filename);
  75. if (result.is_error()) {
  76. return result;
  77. }
  78. auto& loader = result.value();
  79. s_loaders.set(get_library_name(filename), *loader);
  80. s_current_tls_offset -= loader->tls_size_of_current_object();
  81. loader->set_tls_offset(s_current_tls_offset);
  82. return loader;
  83. }
  84. static Result<NonnullRefPtr<DynamicLoader>, DlErrorMessage> map_library(const String& name)
  85. {
  86. if (name.contains("/"sv)) {
  87. int fd = open(name.characters(), O_RDONLY);
  88. if (fd < 0)
  89. return DlErrorMessage { String::formatted("Could not open shared library: {}", name) };
  90. return map_library(name, fd);
  91. }
  92. // TODO: Do we want to also look for libs in other paths too?
  93. const char* search_paths[] = { "/usr/lib/{}", "/usr/local/lib/{}" };
  94. for (auto& search_path : search_paths) {
  95. auto path = String::formatted(search_path, name);
  96. int fd = open(path.characters(), O_RDONLY);
  97. if (fd < 0)
  98. continue;
  99. return map_library(name, fd);
  100. }
  101. return DlErrorMessage { String::formatted("Could not find required shared library: {}", name) };
  102. }
  103. static Vector<String> get_dependencies(const String& name)
  104. {
  105. auto lib = s_loaders.get(name).value();
  106. Vector<String> dependencies;
  107. lib->for_each_needed_library([&dependencies, &name](auto needed_name) {
  108. if (name == needed_name)
  109. return;
  110. dependencies.append(needed_name);
  111. });
  112. return dependencies;
  113. }
  114. static Result<void, DlErrorMessage> map_dependencies(const String& name)
  115. {
  116. dbgln_if(DYNAMIC_LOAD_DEBUG, "mapping dependencies for: {}", name);
  117. for (const auto& needed_name : get_dependencies(name)) {
  118. dbgln_if(DYNAMIC_LOAD_DEBUG, "needed library: {}", needed_name.characters());
  119. String library_name = get_library_name(needed_name);
  120. if (!s_loaders.contains(library_name) && !s_global_objects.contains(library_name)) {
  121. auto result1 = map_library(needed_name);
  122. if (result1.is_error()) {
  123. return result1.error();
  124. }
  125. auto result2 = map_dependencies(library_name);
  126. if (result2.is_error()) {
  127. return result2.error();
  128. }
  129. }
  130. }
  131. dbgln_if(DYNAMIC_LOAD_DEBUG, "mapped dependencies for {}", name);
  132. return {};
  133. }
  134. static void allocate_tls()
  135. {
  136. s_total_tls_size = 0;
  137. for (const auto& data : s_loaders) {
  138. dbgln_if(DYNAMIC_LOAD_DEBUG, "{}: TLS Size: {}", data.key, data.value->tls_size_of_current_object());
  139. s_total_tls_size += data.value->tls_size_of_current_object();
  140. }
  141. if (!s_total_tls_size)
  142. return;
  143. auto page_aligned_size = align_up_to(s_total_tls_size, PAGE_SIZE);
  144. auto initial_tls_data_result = ByteBuffer::create_zeroed(page_aligned_size);
  145. if (!initial_tls_data_result.has_value()) {
  146. dbgln("Failed to allocate initial TLS data");
  147. VERIFY_NOT_REACHED();
  148. }
  149. auto& initial_tls_data = initial_tls_data_result.value();
  150. // Initialize TLS data
  151. for (const auto& entry : s_loaders) {
  152. entry.value->copy_initial_tls_data_into(initial_tls_data);
  153. }
  154. void* master_tls = ::allocate_tls((char*)initial_tls_data.data(), initial_tls_data.size());
  155. VERIFY(master_tls != (void*)-1);
  156. dbgln_if(DYNAMIC_LOAD_DEBUG, "from userspace, master_tls: {:p}", master_tls);
  157. s_allocated_tls_block_size = initial_tls_data.size();
  158. }
  159. static int __dl_iterate_phdr(DlIteratePhdrCallbackFunction callback, void* data)
  160. {
  161. __pthread_mutex_lock(&s_loader_lock);
  162. ScopeGuard unlock_guard = [] { __pthread_mutex_unlock(&s_loader_lock); };
  163. for (auto& it : s_global_objects) {
  164. auto& object = it.value;
  165. auto info = dl_phdr_info {
  166. .dlpi_addr = (ElfW(Addr))object->base_address().as_ptr(),
  167. .dlpi_name = object->filename().characters(),
  168. .dlpi_phdr = object->program_headers(),
  169. .dlpi_phnum = object->program_header_count()
  170. };
  171. auto res = callback(&info, sizeof(info), data);
  172. if (res != 0)
  173. return res;
  174. }
  175. return 0;
  176. }
  177. static void initialize_libc(DynamicObject& libc)
  178. {
  179. // Traditionally, `_start` of the main program initializes libc.
  180. // However, since some libs use malloc() and getenv() in global constructors,
  181. // we have to initialize libc just after it is loaded.
  182. // Also, we can't just mark `__libc_init` with "__attribute__((constructor))"
  183. // because it uses getenv() internally, so `environ` has to be initialized before we call `__libc_init`.
  184. auto res = libc.lookup_symbol("environ"sv);
  185. VERIFY(res.has_value());
  186. *((char***)res.value().address.as_ptr()) = s_envp;
  187. res = libc.lookup_symbol("__environ_is_malloced"sv);
  188. VERIFY(res.has_value());
  189. *((bool*)res.value().address.as_ptr()) = false;
  190. res = libc.lookup_symbol("exit"sv);
  191. VERIFY(res.has_value());
  192. s_libc_exit = (LibCExitFunction)res.value().address.as_ptr();
  193. res = libc.lookup_symbol("__dl_iterate_phdr"sv);
  194. VERIFY(res.has_value());
  195. *((DlIteratePhdrFunction*)res.value().address.as_ptr()) = __dl_iterate_phdr;
  196. res = libc.lookup_symbol("__dlclose"sv);
  197. VERIFY(res.has_value());
  198. *((DlCloseFunction*)res.value().address.as_ptr()) = __dlclose;
  199. res = libc.lookup_symbol("__dlopen"sv);
  200. VERIFY(res.has_value());
  201. *((DlOpenFunction*)res.value().address.as_ptr()) = __dlopen;
  202. res = libc.lookup_symbol("__dlsym"sv);
  203. VERIFY(res.has_value());
  204. *((DlSymFunction*)res.value().address.as_ptr()) = __dlsym;
  205. res = libc.lookup_symbol("__dladdr"sv);
  206. VERIFY(res.has_value());
  207. *((DlAddrFunction*)res.value().address.as_ptr()) = __dladdr;
  208. res = libc.lookup_symbol("__libc_init"sv);
  209. VERIFY(res.has_value());
  210. typedef void libc_init_func();
  211. ((libc_init_func*)res.value().address.as_ptr())();
  212. }
  213. template<typename Callback>
  214. static void for_each_unfinished_dependency_of(const String& name, HashTable<String>& seen_names, bool first, bool skip_global_objects, Callback callback)
  215. {
  216. if (!s_loaders.contains(name))
  217. return;
  218. if (!first && skip_global_objects && s_global_objects.contains(name))
  219. return;
  220. if (seen_names.contains(name))
  221. return;
  222. seen_names.set(name);
  223. for (const auto& needed_name : get_dependencies(name))
  224. for_each_unfinished_dependency_of(get_library_name(needed_name), seen_names, false, skip_global_objects, callback);
  225. callback(*s_loaders.get(name).value());
  226. }
  227. static NonnullRefPtrVector<DynamicLoader> collect_loaders_for_library(const String& name, bool skip_global_objects)
  228. {
  229. HashTable<String> seen_names;
  230. NonnullRefPtrVector<DynamicLoader> loaders;
  231. for_each_unfinished_dependency_of(name, seen_names, true, skip_global_objects, [&](auto& loader) {
  232. loaders.append(loader);
  233. });
  234. return loaders;
  235. }
  236. static Result<NonnullRefPtr<DynamicLoader>, DlErrorMessage> load_main_library(const String& name, int flags, bool skip_global_objects)
  237. {
  238. auto main_library_loader = *s_loaders.get(name);
  239. auto main_library_object = main_library_loader->map();
  240. s_global_objects.set(name, *main_library_object);
  241. auto loaders = collect_loaders_for_library(name, skip_global_objects);
  242. for (auto& loader : loaders) {
  243. auto dynamic_object = loader.map();
  244. if (dynamic_object)
  245. s_global_objects.set(dynamic_object->filename(), *dynamic_object);
  246. }
  247. for (auto& loader : loaders) {
  248. bool success = loader.link(flags);
  249. if (!success) {
  250. return DlErrorMessage { String::formatted("Failed to link library {}", loader.filename()) };
  251. }
  252. }
  253. for (auto& loader : loaders) {
  254. auto result = loader.load_stage_3(flags);
  255. VERIFY(!result.is_error());
  256. auto& object = result.value();
  257. if (loader.filename() == "libsystem.so"sv) {
  258. VERIFY(!loader.text_segments().is_empty());
  259. for (const auto& segment : loader.text_segments()) {
  260. if (syscall(SC_msyscall, segment.address().get())) {
  261. VERIFY_NOT_REACHED();
  262. }
  263. }
  264. }
  265. if (loader.filename() == "libc.so"sv) {
  266. initialize_libc(*object);
  267. }
  268. }
  269. for (auto& loader : loaders) {
  270. loader.load_stage_4();
  271. }
  272. return NonnullRefPtr<DynamicLoader>(*main_library_loader);
  273. }
  274. static Result<void, DlErrorMessage> __dlclose(void* handle)
  275. {
  276. dbgln_if(DYNAMIC_LOAD_DEBUG, "__dlclose: {}", handle);
  277. __pthread_mutex_lock(&s_loader_lock);
  278. ScopeGuard unlock_guard = [] { __pthread_mutex_unlock(&s_loader_lock); };
  279. // FIXME: this will not currently destroy the dynamic object
  280. // because we're intentionally holding a strong reference to it
  281. // via s_global_objects until there's proper unload support.
  282. auto object = static_cast<ELF::DynamicObject*>(handle);
  283. object->unref();
  284. return {};
  285. }
  286. static Optional<DlErrorMessage> verify_tls_for_dlopen(const DynamicLoader& loader)
  287. {
  288. if (loader.tls_size_of_current_object() == 0)
  289. return {};
  290. if (s_total_tls_size + loader.tls_size_of_current_object() > s_allocated_tls_block_size)
  291. return DlErrorMessage("TLS size too large");
  292. bool tls_data_is_all_zero = true;
  293. loader.image().for_each_program_header([&loader, &tls_data_is_all_zero](ELF::Image::ProgramHeader program_header) {
  294. if (program_header.type() != PT_TLS)
  295. return IterationDecision::Continue;
  296. auto* tls_data = (const u8*)loader.image().base_address() + program_header.offset();
  297. for (size_t i = 0; i < program_header.size_in_image(); ++i) {
  298. if (tls_data[i] != 0) {
  299. tls_data_is_all_zero = false;
  300. break;
  301. }
  302. }
  303. return IterationDecision::Break;
  304. });
  305. if (tls_data_is_all_zero)
  306. return {};
  307. return DlErrorMessage("Using dlopen() with libraries that have non-zeroed TLS is currently not supported");
  308. }
  309. static Result<void*, DlErrorMessage> __dlopen(const char* filename, int flags)
  310. {
  311. // FIXME: RTLD_NOW and RTLD_LOCAL are not supported
  312. flags &= ~RTLD_NOW;
  313. flags |= RTLD_LAZY;
  314. flags &= ~RTLD_LOCAL;
  315. flags |= RTLD_GLOBAL;
  316. dbgln_if(DYNAMIC_LOAD_DEBUG, "__dlopen invoked, filename={}, flags={}", filename, flags);
  317. auto library_name = get_library_name(filename ? filename : s_main_program_name);
  318. if (__pthread_mutex_trylock(&s_loader_lock) != 0)
  319. return DlErrorMessage { "Nested calls to dlopen() are not permitted." };
  320. ScopeGuard unlock_guard = [] { __pthread_mutex_unlock(&s_loader_lock); };
  321. auto existing_elf_object = s_global_objects.get(library_name);
  322. if (existing_elf_object.has_value()) {
  323. // It's up to the caller to release the ref with dlclose().
  324. existing_elf_object.value()->ref();
  325. return *existing_elf_object;
  326. }
  327. VERIFY(!library_name.is_empty());
  328. auto result1 = map_library(filename);
  329. if (result1.is_error()) {
  330. return result1.error();
  331. }
  332. if (auto error = verify_tls_for_dlopen(result1.value()); error.has_value())
  333. return error.value();
  334. auto result2 = map_dependencies(library_name);
  335. if (result2.is_error()) {
  336. return result2.error();
  337. }
  338. auto result = load_main_library(library_name, flags, true);
  339. if (result.is_error())
  340. return result.error();
  341. s_total_tls_size += result1.value()->tls_size_of_current_object();
  342. auto object = s_global_objects.get(library_name);
  343. if (!object.has_value())
  344. return DlErrorMessage { "Could not load ELF object." };
  345. // It's up to the caller to release the ref with dlclose().
  346. object.value()->ref();
  347. return *object;
  348. }
  349. static Result<void*, DlErrorMessage> __dlsym(void* handle, const char* symbol_name)
  350. {
  351. dbgln_if(DYNAMIC_LOAD_DEBUG, "__dlsym: {}, {}", handle, symbol_name);
  352. __pthread_mutex_lock(&s_loader_lock);
  353. ScopeGuard unlock_guard = [] { __pthread_mutex_unlock(&s_loader_lock); };
  354. auto object = static_cast<DynamicObject*>(handle);
  355. if (!handle) {
  356. auto library_name = get_library_name(s_main_program_name);
  357. auto global_object = s_global_objects.get(library_name);
  358. object = *global_object;
  359. }
  360. auto symbol = object->lookup_symbol(symbol_name);
  361. if (!symbol.has_value()) {
  362. return DlErrorMessage { String::formatted("Symbol {} not found", symbol_name) };
  363. }
  364. return symbol.value().address.as_ptr();
  365. }
  366. static Result<void, DlErrorMessage> __dladdr(void* addr, Dl_info* info)
  367. {
  368. VirtualAddress user_addr { addr };
  369. __pthread_mutex_lock(&s_loader_lock);
  370. ScopeGuard unlock_guard = [] { __pthread_mutex_unlock(&s_loader_lock); };
  371. RefPtr<DynamicObject> best_matching_library;
  372. VirtualAddress best_library_offset;
  373. for (auto& lib : s_global_objects) {
  374. if (user_addr < lib.value->base_address())
  375. continue;
  376. auto offset = user_addr - lib.value->base_address();
  377. if (!best_matching_library || offset < best_library_offset) {
  378. best_matching_library = lib.value;
  379. best_library_offset = offset;
  380. }
  381. }
  382. if (!best_matching_library) {
  383. return DlErrorMessage { "No library found which contains the specified address" };
  384. }
  385. Optional<DynamicObject::Symbol> best_matching_symbol;
  386. best_matching_library->for_each_symbol([&](auto const& symbol) {
  387. if (user_addr < symbol.address() || user_addr > symbol.address().offset(symbol.size()))
  388. return;
  389. best_matching_symbol = symbol;
  390. });
  391. info->dli_fbase = best_matching_library->base_address().as_ptr();
  392. // This works because we don't support unloading objects.
  393. info->dli_fname = best_matching_library->filename().characters();
  394. if (best_matching_symbol.has_value()) {
  395. info->dli_saddr = best_matching_symbol.value().address().as_ptr();
  396. info->dli_sname = best_matching_symbol.value().raw_name();
  397. } else {
  398. info->dli_saddr = nullptr;
  399. info->dli_sname = nullptr;
  400. }
  401. return {};
  402. }
  403. static void read_environment_variables()
  404. {
  405. for (char** env = s_envp; *env; ++env) {
  406. if (StringView { *env } == "_LOADER_BREAKPOINT=1"sv) {
  407. s_do_breakpoint_trap_before_entry = true;
  408. }
  409. }
  410. }
  411. void ELF::DynamicLinker::linker_main(String&& main_program_name, int main_program_fd, bool is_secure, int argc, char** argv, char** envp)
  412. {
  413. s_envp = envp;
  414. s_allowed_to_check_environment_variables = !is_secure;
  415. if (s_allowed_to_check_environment_variables)
  416. read_environment_variables();
  417. s_main_program_name = main_program_name;
  418. auto library_name = get_library_name(main_program_name);
  419. // NOTE: We always map the main library first, since it may require
  420. // placement at a specific address.
  421. auto result1 = map_library(main_program_name, main_program_fd);
  422. if (result1.is_error()) {
  423. warnln("{}", result1.error().text);
  424. fflush(stderr);
  425. _exit(1);
  426. }
  427. result1.release_value();
  428. auto result2 = map_dependencies(library_name);
  429. if (result2.is_error()) {
  430. warnln("{}", result2.error().text);
  431. fflush(stderr);
  432. _exit(1);
  433. }
  434. dbgln_if(DYNAMIC_LOAD_DEBUG, "loaded all dependencies");
  435. for ([[maybe_unused]] auto& lib : s_loaders) {
  436. dbgln_if(DYNAMIC_LOAD_DEBUG, "{} - tls size: {}, tls offset: {}", lib.key, lib.value->tls_size_of_current_object(), lib.value->tls_offset());
  437. }
  438. allocate_tls();
  439. auto entry_point_function = [&main_program_name] {
  440. auto library_name = get_library_name(main_program_name);
  441. auto result = load_main_library(library_name, RTLD_GLOBAL | RTLD_LAZY, false);
  442. if (result.is_error()) {
  443. warnln("{}", result.error().text);
  444. _exit(1);
  445. }
  446. auto& main_executable_loader = result.value();
  447. auto entry_point = main_executable_loader->image().entry();
  448. if (main_executable_loader->is_dynamic())
  449. entry_point = entry_point.offset(main_executable_loader->base_address().get());
  450. return (EntryPointFunction)(entry_point.as_ptr());
  451. }();
  452. s_loaders.clear();
  453. int rc = syscall(SC_msyscall, nullptr);
  454. if (rc < 0) {
  455. VERIFY_NOT_REACHED();
  456. }
  457. dbgln_if(DYNAMIC_LOAD_DEBUG, "Jumping to entry point: {:p}", entry_point_function);
  458. if (s_do_breakpoint_trap_before_entry) {
  459. asm("int3");
  460. }
  461. _invoke_entry(argc, argv, envp, entry_point_function);
  462. VERIFY_NOT_REACHED();
  463. }
  464. }