ELFLoader的实现#

1
// 在链表中查找模块
2
static struct elf_module *find_module(const char *name)
3
{
4
    struct list_head *pos;
5
    struct elf_module *m = NULL, *tmp;
6

7
    list_for_each(pos, &mod_list) {
8
        tmp = list_entry(pos, struct elf_module, list);
9
        if (!strcmp(name, tmp->name)) {
10
            m = tmp;
11
            break;
12
        }
13
    }
14

15
    if (m != NULL) {
16
        if (m->flags & FLAG_LINKED)
17
            return m;
18
        LOG_ERR("OOPS: recursive link to \"%s\"", m->name);
19
        return NULL;
20
    }
21

22
    LOG_DEBUG("[ \"%s\" has not been loaded yet ]", name);
23
    return NULL;
24
}

1
// 校验elf头
2
static bool verify_elf_header(struct elf_info *info)
3
{
4
    int elf_class;
5

6
    if (info->len < sizeof(*(info->hdr))) {
7
        LOG_ERR("\"%s\" is too small to be an ELF executable. Expected at least %zu bytes, "
8
                "only found %zu bytes", info->name, sizeof(*(info->hdr)), info->len);
9
    return false;
10
    }
11
  if (memcmp(info->hdr->e_ident, ELFMAG, SELFMAG)) {
12
        LOG_ERR("\"%s\" has bad ELF magic", info->name);
13
        return false;
14
    }
15

16
    elf_class = info->hdr->e_ident[EI_CLASS];
17
    if (elf_class != ELFCLASS64) {
18
        if (elf_class == ELFCLASS32) {
19
            LOG_ERR("\"%s\" is 32-bit instead of 64-bit", info->name);
20
        } else {
21
            LOG_ERR("\"%s\" has unknown ELF class: %d", info->name, elf_class);
22
        }
23
        return false;
24
    }
25

26
    if (info->hdr->e_ident[EI_DATA] != ELFDATA2LSB) {
27
        LOG_ERR("\"%s\" not little-endian: %d", info->name, info->hdr->e_ident[EI_DATA]);
28
        return false;
29
    }
30

31
  if (info->hdr->e_type != ET_EXEC && info->hdr->e_type != ET_DYN) {
32
        LOG_ERR("\"%s\" has unexpected e_type: %d", info->name, info->hdr->e_type);
33
        return false;
34
    }
35

36
    if (info->hdr->e_version != EV_CURRENT) {
37
        LOG_ERR("\"%s\" has unexpected e_version: %d", info->name, info->hdr->e_version);
38
        return false;
39
    }
40

41
  if (!elf_check_arch(info->hdr)) {
42
        LOG_ERR("\"%s\" has unexpected e_machine: %d", info->name, info->hdr->e_machine);
43
      return false;
44
    }
45

46
    LOG_DEBUG("\"%s\" verify elf header done.", info->name);
47
    return true;
48
}
49

50
// 读取program_headers
51
static bool read_program_headers(struct elf_info *info)
52
{
53
    if (info->hdr->e_phoff == 0) {
54
        LOG_ERR("\"%s\" has no program header table", info->name);
55
        return false;
56
    }
57

58
    if (info->hdr->e_phnum < 1 || info->hdr->e_phnum > (65536U / sizeof(ElfW(Phdr)))) {
59
        LOG_ERR("\"%s\" has invalid e_phnum: %d", info->name, info->hdr->e_phnum);
60
        return false;
61
    }
62

63
    if (info->hdr->e_phentsize != sizeof(ElfW(Phdr))) {
64
        LOG_ERR("\"%s\" has invalid e_phentsize", info->name);
65
        return false;
66
    }
67

68
    if (info->hdr->e_phoff >= info->len
69
            || (info->hdr->e_phnum * sizeof(ElfW(Phdr)) > info->len - info->hdr->e_phoff)) {
70
        LOG_ERR("\"%s\" has invalid offset/size of program header table", info->name);
71
        return false;
72
    }
73

74
    info->phdr_table = (ElfW(Phdr) *)((char *)info->hdr + info->hdr->e_phoff);
75
    LOG_DEBUG("\"%s\" read program header done.", info->name);
76
    return true;
77
}

1
// 模块内存初始化
2
static struct elf_module *elf_module_alloc(const char *name)
3
{
4
    struct elf_module *m;
5

6
    if (strlen(name) >= ELF_MODULE_NAME_LEN) {
7
        LOG_ERR("ELF name to long");
8
        return NULL;
9
    }
10

11
    m = malloc(sizeof(*m));
12
    if (m == NULL) {
13
        LOG_ERR("\"%s\" elf module memory alloc failed: %s", name, strerror(errno));
14
        return NULL;
15
    }
16

17
    memset(m, 0, sizeof(*m));
18
    strncpy(m->name, name, sizeof(m->name) - 1);
19
    INIT_LIST_HEAD(&m->list);
20
    m->refcnt = 1;
21

22
    LOG_DEBUG("name %s: allocated struct elf_module @ %p", name, m);
23
    return m;
24
}
25

26
// 释放模块
27
static void elf_module_free(struct elf_module *m)
28
{
29
    if (!m)
30
        return;
31

32
    LOG_DEBUG("name %s: freeing soinfo @ %p", m->name, m);
33

34
    if (m->base)
35
        munmap((void *)m->base, m->size);
36
    free(m);
37
}

1
//为 ELF 模块的各个段分配虚拟地址空间，并计算加载偏移量
2
static bool layout_segments(struct elf_module *m, struct elf_info *info)
3
{
4
    ElfW(Addr) min_vaddr;
5
    void *mm_start;
6
    size_t i;
7

8
    m->size = phdr_table_get_load_size(info->phdr_table, info->hdr->e_phnum, &min_vaddr, NULL);
9
    if (m->size == 0) {
10
        LOG_ERR("\"%s\" has no loadable segments", m->name);
11
        return false;
12
    }
13

14
    mm_start = mmap(NULL,
15
                    m->size,
16
                    PROT_READ | PROT_WRITE | PROT_EXEC,
17
                    MAP_PRIVATE | MAP_ANONYMOUS,
18
                    -1,
19
                    0); // munmap in elf_module_free()
20
    if (mm_start == MAP_FAILED) {
21
        LOG_ERR("couldn't map \"%s\" address space, %s", m->name, strerror(errno));
22
        return false;
23
    }
24

25
    memset(mm_start, 0, m->size);
26
    m->base = (ElfW(Addr))mm_start;
27
    m->load_bias = (char *)mm_start - (char *)min_vaddr;
28

29
    for (i = 0; i < info->hdr->e_phnum; ++i) {
30
        const ElfW(Phdr) *phdr = &info->phdr_table[i];
31
        if (phdr->p_type != PT_LOAD)
32
            continue;
33
        if (phdr->p_offset + phdr->p_filesz > info->len) {
34
            LOG_ERR("\"%s\" has invalid segment[%zu]:"
35
                    "p_offset (%zx) + p_filesz (%zx) past end of %zx)",
36
                    m->name, i, phdr->p_offset, phdr->p_filesz, info->len);
37
            return false;
38
        }
39
        memcpy((char *)m->load_bias + phdr->p_vaddr,
40
               (char *)info->hdr + phdr->p_offset, phdr->p_filesz);
41
    }
42

43
    return true;
44
}

1
// 查找已经加载的 ELF 模块的程序头表
2
// 为了拿到so的起始地址和其他的有些信息
3
static ElfW(Phdr) *find_loaded_phdr(struct elf_module *m, struct elf_info *info)
4
{
5
    size_t i;
6
    ElfW(Addr) loaded_phdr = 0;
7
    const ElfW(Phdr) *pphdr;
8

9
    // If there is a PT_PHDR, use it directly.
10
    for (i = 0, pphdr = info->phdr_table; i < info->hdr->e_phnum; ++i, ++pphdr) {
11
        if (pphdr->p_type == PT_PHDR) {
12
            loaded_phdr = (ElfW(Addr))(m->load_bias + pphdr->p_vaddr);
13
            break;
14
        }
15
    }
16

17
    // Otherwise, check the first loadable segment. If its file offset
18
    // is 0, it starts with the ELF header, and we can trivially find the
19
    // loaded program header from it.
20
    if (loaded_phdr == 0) {
21
        for (i = 0, pphdr = info->phdr_table; i < info->hdr->e_phnum; ++i, ++pphdr) {
22
            if (pphdr->p_type == PT_LOAD) {
23
                if (pphdr->p_offset == 0) {
24
                    const ElfW(Ehdr) *ehdr = (const ElfW(Ehdr) *)(m->load_bias + pphdr->p_vaddr);
25
                    loaded_phdr = (ElfW(Addr))((char *)ehdr + ehdr->e_phoff);
26
                    break;
27
                }
28
                break;
29
            }
30
        }
31
    }
32

33
    if (loaded_phdr == 0) {
34
         LOG_ERR("can't find loaded phdr for \"%s\"", m->name);
35
         return false;
36
    }
37

38
    // Ensures that our program header is actually within a loadable
39
    // segment. This should help catch badly-formed ELF files that
40
    // would cause the linker to crash later when trying to access it.
41
    for (i = 0, pphdr = info->phdr_table; i < info->hdr->e_phnum; ++i, ++pphdr) {
42
        ElfW(Addr) seg_start, seg_end;
43

44
        if (pphdr->p_type != PT_LOAD)
45
            continue;
46
        seg_start = m->load_bias + pphdr->p_vaddr;
47
        seg_end = seg_start + pphdr->p_filesz;
48
        if (seg_start <= loaded_phdr
49
                && (loaded_phdr + info->hdr->e_phnum * sizeof(ElfW(Phdr)) <= seg_end)) {
50
            LOG_DEBUG("find loaded phdr for \"%s\" done", m->name);
51
            return (ElfW(Phdr) *)loaded_phdr;
52
        }
53
    }
54

55
    LOG_ERR("\"%s\" loaded phdr 0x%zx not in loadable segment", m->name, loaded_phdr);
56
    return NULL;
57
}

1
// 从程序头表中提取动态段（.dynamic 段）
2
static void phdr_table_get_dynamic_section(const ElfW(Phdr) *phdr_table, size_t phdr_count,
3
                                           ElfW(Addr) load_bias, ElfW(Dyn) **dynamic,
4
                                           ElfW(Word) *dynamic_flags)
5
{
6
    size_t i;
7

8
    *dynamic = NULL;
9
    for (i = 0; i < phdr_count; ++i) {
10
        const ElfW(Phdr) *phdr = &phdr_table[i];
11
        if (phdr->p_type == PT_DYNAMIC) {
12
            *dynamic = (ElfW(Dyn) *)(load_bias + phdr->p_vaddr);
13
            if (dynamic_flags)
14
                *dynamic_flags = phdr->p_flags;
15
            return;
16
        }
17
    }
18
}

1
// 加载动态段中的信息（如符号表、字符串表、重定位表等
2
static bool load_dynamic(struct elf_module *m)
3
{
4
    ElfW(Dyn) *d;
5

6
    m->needed_count = 0;
7
    for (d = m->dynamic; d->d_tag != DT_NULL; ++d) {
8
        LOG_DEBUG("d = %p, d[0](tag) = 0x%p d[1](val) = 0x%p",
9
                  d, (void *)d->d_tag, (void *)d->d_un.d_val);
10

11
        switch (d->d_tag) {
12
        case DT_HASH:
13
            m->nbucket = ((uint32_t *)(m->load_bias + d->d_un.d_ptr))[0];
14
            m->nchain = ((uint32_t *)(m->load_bias + d->d_un.d_ptr))[1];
15
            m->bucket = (uint32_t *)(m->load_bias + d->d_un.d_ptr + 8);
16
            m->chain = (uint32_t *)(m->load_bias + d->d_un.d_ptr + 8 + m->nbucket *4);
17
            break;
18
        case DT_GNU_HASH:
19
            m->gnu_nbucket = ((uint32_t *)(m->load_bias + d->d_un.d_ptr))[0];
20
            // skip symndx
21
            m->gnu_maskwords = ((uint32_t *)(m->load_bias + d->d_un.d_ptr))[2];
22
            m->gnu_shift2 = ((uint32_t *)(m->load_bias + d->d_un.d_ptr))[3];
23

24
            m->gnu_bloom_filter = (ElfW(Addr) *)(m->load_bias + d->d_un.d_ptr + 16);
25
            m->gnu_bucket = (uint32_t *)(m->gnu_bloom_filter + m->gnu_maskwords);
26
            // amend chain for symndx = header[1]
27
            m->gnu_chain = m->gnu_bucket + m->gnu_nbucket -
28
                ((uint32_t *)(m->load_bias + d->d_un.d_ptr))[1];
29

30
            if (!powerof2(m->gnu_maskwords)) {
31
                LOG_ERR("invalid maskwords for gnu_hash = 0x%x, in \"%s\" expecting power to two",
32
                        m->gnu_maskwords, m->name);
33
                return false;
34
            }
35
            m->gnu_maskwords--;
36
            m->flags |= FLAG_GNU_HASH;
37
            break;
38
        case DT_STRTAB:
39
            m->strtab = (char *)(m->load_bias + d->d_un.d_ptr);
40
            break;
41
        case DT_STRSZ:
42
            m->strtab_size = d->d_un.d_val;
43
            break;
44
        case DT_SYMTAB:
45
            m->symtab = (ElfW(Sym) *)(m->load_bias + d->d_un.d_ptr);
46
            break;
47
        case DT_SYMENT:
48
            if (d->d_un.d_val != sizeof(ElfW(Sym))) {
49
                LOG_ERR("invalid DT_SYMENT: %zu in \"%s\"", (size_t)d->d_un.d_val, m->name);
50
                return false;
51
            }
52
            break;
53
        case DT_PLTREL:
54
            if (d->d_un.d_val != DT_RELA) {
55
                LOG_ERR("unsupported DT_PLTREL in \"%s\"; expected DT_RELA", m->name);
56
                return false;
57
            }
58
            break;
59
        case DT_JMPREL:
60
            m->plt_rela = (ElfW(Rela) *)(m->load_bias + d->d_un.d_ptr);
61
            break;
62
        case DT_PLTRELSZ:
63
            m->plt_rela_count = d->d_un.d_val / sizeof(ElfW(Rela));
64
            break;
65
        case DT_RELA:
66
            m->rela = (ElfW(Rela) *)(m->load_bias + d->d_un.d_ptr);
67
            break;
68
        case DT_RELASZ:
69
            m->rela_count = d->d_un.d_val /sizeof(ElfW(Rela));
70
            break;
71
        case DT_RELAENT:
72
            if (d->d_un.d_val != sizeof(ElfW(Rela))) {
73
                LOG_ERR("invalid DT_RELAENT: %zu", (size_t)d->d_un.d_val);
74
                return false;
75
            }
76
            break;
77
        case DT_REL:
78
            LOG_ERR("unsupported DT_REL in \"%s\"", m->name);
79
            return false;
80
        case DT_RELSZ:
81
            LOG_ERR("unsupported DT_RELSZ in \"%s\"", m->name);
82
            return false;
83
        case DT_NEEDED:
84
            m->needed_count++;
85
            break;
86
        default:
87
            LOG_DEBUG("\"%s\" unused DT entry: type %p arg %p",
88
                      m->name, (void *)d->d_tag, (void *)d->d_un.d_val);
89
            break;
90
        };
91
    }
92

93
    LOG_DEBUG("mod->base = %zx, mod->strtab = %p, mod->symtab = %p",
94
              m->base, m->strtab, m->symtab);
95

96
    // Sanity checks.
97
    if (m->nbucket == 0 && m->gnu_nbucket == 0) {
98
        LOG_ERR("empty/missing DT_HASH/DT_GNU_HASH in \"%s\" "
99
                "(new hash type from the future?)", m->name);
100
        return false;
101
    }
102
    if (m->strtab == 0) {
103
        LOG_ERR("empty/missing DT_STRTAB in \"%s\"", m->name);
104
        return false;
105
    }
106
    if (m->symtab == 0) {
107
        LOG_ERR("empty/missing DT_SYMTAB in \"%s\"", m->name);
108
        return false;
109
    }
110

111
    return true;
112
}

1
// 执行动态链接，解析符号并应用重定位
2
static bool elf_link(struct elf_module *m)
3
{
4
    bool ret = false;
5
    ElfW(Dyn) *d;
6
    struct elf_module **needed;
7
    struct elf_module **pneeded;
8

9
    LOG_DEBUG("[ linking %s ]", m->name);
10
    LOG_DEBUG("mod->base = %zx mod->flags = 0x%08x", m->base, m->flags);
11

12
    /* load needed module */
13
    pneeded = needed = (struct elf_module **)malloc((1 + m->needed_count) * sizeof(struct elf_module *));
14
    if (needed == NULL) {
15
        LOG_ERR("\"%s\"malloc for needed array failed", m->name);
16
        return false;
17
    }
18

19
    for (d = m->dynamic; d->d_tag != DT_NULL; ++d) {
20
        if (d->d_tag == DT_NEEDED) {
21
            struct elf_module *need_mod;
22
            const char *need_name = m->strtab + d->d_un.d_val;
23
            LOG_DEBUG("%s needs %s", m->name, need_name);
24
            need_mod = find_module(need_name);
25
            if (need_mod != NULL) {
26
                need_mod->refcnt++;
27
                *pneeded++ = need_mod;
28
                continue;
29
            }
30
            LOG_DEBUG("load module %s use dlopen()", m->name);
31
            if (dlopen(need_name, RTLD_NOW | RTLD_GLOBAL) == NULL) {
32
                LOG_ERR("could not load module \"%s\" needed by \"%s\"", need_name, m->name);
33
                return false;
34
            }
35
        }
36
    }
37
    *pneeded = NULL;
38

39
    if (m->rela != NULL) {
40
        LOG_DEBUG("[ relocating %s ]", m->name);
41
        if (!apply_relocate_add(m, m->rela, m->rela_count, needed))
42
            goto out;
43
    }
44

45
    if (m->plt_rela != NULL) {
46
        LOG_DEBUG("[ relocating %s plt ]", m->name);
47
        if (!apply_relocate_add(m, m->plt_rela, m->plt_rela_count, needed))
48
            goto out;
49
    }
50
    m->flags |= FLAG_LINKED;
51
    ret = true;
52
out:
53
    free(needed);
54
    LOG_DEBUG("[ finished linking %s, ret=%d ]", m->name, ret);
55
    return ret;
56
}

1
//将新模块添加到模块列表的尾部 类比soinfo_list
2
void list_add_tail(struct list_head *new, struct list_head *head)
3
{
4
  __list_add(new, head->prev, head);
5
}

1
struct elf_module *load_elf_module(const char *name, const void *elf_data, size_t elf_len)
2
{
3
    struct elf_info info = { .name = name, .hdr = elf_data, .len = elf_len };
4
    struct elf_module *m;
5

6
    LOG_DEBUG("load_elf_module: name=%s, bin=%p, len=%zu", name, elf_data, elf_len);
7

8
    if (find_module(name)) {
9
        LOG_ERR("\"%s\" already exist", name);
10
        return NULL;
11
    }
12

13
    if (!verify_elf_header(&info) || !read_program_headers(&info))
14
        return NULL;
15

16
    m = elf_module_alloc(name);
17
    if (m == NULL)
18
        return NULL;
19

20
    if (!layout_segments(m, &info)) // 此时 ELF 文件的程序头表（info.hdr->e_phoff）已经可以映射到内存中的正确位置
21
        goto out_free;
22

23
    m->phdr = find_loaded_phdr(m, &info); // 查找 ELF 模块的程序头表
24
    if (m->phdr == NULL)
25
        goto out_free;
26
    m->phnum = info.hdr->e_phnum;
27
    m->entry = m->load_bias + info.hdr->e_entry;
28

29
    phdr_table_get_dynamic_section(m->phdr, m->phnum, m->load_bias, &m->dynamic, NULL); // 从程序头表中提取动态段（.dynamic 段）
30
    if (m->dynamic) {
31
        if (!load_dynamic(m)) // 加载动态段中的信息（如符号表、字符串表、重定位表等
32
            goto out_free;
33

34
        if (!elf_link(m)) // 执行动态链接，解析符号并应用重定位
35
            goto out_free;
36
    }
37

38
    list_add_tail(&m->list, &mod_list); // 将新模块添加到模块列表的尾部 类比soinfo_list
39

40
    LOG_DEBUG("[ \"%s\" load done, base=0x%zx sz=0x%zx entry=0x%zx ]",
41
              m->name, m->base, m->size, m->entry);
42
    return m;
43

44
out_free:
45
    elf_module_free(m);
46
    return NULL;
47
}
48

49
void unload_elf_module(const char *name)
50
{
51
    struct elf_module *m;
52
    ElfW(Dyn) *d;
53

54
    m = find_module(name);
55
    if (m == NULL)
56
        return;
57

58
    if (m->refcnt == 1) {
59
        LOG_DEBUG("unloading \"%s\"", m->name);
60

61
        list_del(&m->list);
62

63
        for (d = m->dynamic; d->d_tag != DT_NULL; ++d) {
64
            if (d->d_tag == DT_NEEDED) {
65
                const char *need_name = m->strtab + d->d_un.d_val;
66
                LOG_DEBUG("%s needs to unload %s", m->name, need_name);
67
                unload_elf_module(need_name);
68
            }
69
        }
70

71
        elf_module_free(m);
72
    } else {
73
        m->refcnt--;
74
        LOG_DEBUG("not unloading \"%s\", decrementing refcnt to %zu", m->name, m->refcnt);
75
    }
76
}
77

78
typedef int (*main_func_t)(void);
79

80
int run_elf_module(struct elf_module *m, const char *func)
81
{
82
    ElfW(Sym *) s = lookup_symbol_in_module(m, func);
83
    main_func_t fn;
84

85
    if (!s) {
86
        LOG_ERR("not found function %s", func);
87
        return -1;
88
    }
89

90
    fn = (void *)(m->load_bias + s->st_value);
91

92
    return fn();
93
}