PAWNYABLE kernel userfaultfd 笔记

# include<stdio.h>

int main(){
    char c;
    c = getchar();
    printf("c: %c\n", c);
  return 0;
}

//gcc -g dl.c -no-pie -o dl

struct link_map
  {
    //libc 基址
    ElfW(Addr) l_addr;
    ...
  //dynamic section
    ElfW(Dyn) *l_info[DT_NUM + DT_THISPROCNUM + DT_VERSIONTAGNUM
          + DT_EXTRANUM + DT_VALNUM + DT_ADDRNUM];
   ...
    //version
    struct r_found_version *l_versions;

typedef struct
{
  Elf64_Sxword  d_tag;      /* Dynamic entry type */
  union
    {
      Elf64_Xword d_val;    /* Integer value */
      Elf64_Addr d_ptr;      /* Address value */
    } d_un;
} Elf64_Dyn;

typedef struct
{
  Elf64_Word  st_name;    /* Symbol name (string tbl index) */
  unsigned char  st_info;    /* Symbol type and binding */
  unsigned char st_other;    /* Symbol visibility */
  Elf64_Section  st_shndx;    /* Section index */
  Elf64_Addr  st_value;    /* Symbol value */
  Elf64_Xword  st_size;    /* Symbol size */
} Elf64_Sym;

_dl_fixup (
# ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS
     ELF_MACHINE_RUNTIME_FIXUP_ARGS,
# endif
     struct link_map *l, ElfW(Word) reloc_arg)
{
  const ElfW(Sym) *const symtab
    = (const void *) D_PTR (l, l_info[DT_SYMTAB]);
  const char *strtab = (const void *) D_PTR (l, l_info[DT_STRTAB]);

  const uintptr_t pltgot = (uintptr_t) D_PTR (l, l_info[DT_PLTGOT]);

  const PLTREL *const reloc
    = (const void *) (D_PTR (l, l_info[DT_JMPREL])
          + reloc_offset (pltgot, reloc_arg));
  const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)];
  const ElfW(Sym) *refsym = sym;
  void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);
  lookup_t result;
  DL_FIXUP_VALUE_TYPE value;

  /* Sanity check that we're really looking at a PLT relocation.  */
  assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT);

   /* Look up the target symbol.  If the normal lookup rules are not
      used don't look in the global scope.  */
  if (__builtin_expect (ELFW(ST_VISIBILITY) (sym->st_other), 0) == 0)
    {
      const struct r_found_version *version = NULL;

      if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
  {
    const ElfW(Half) *vernum =
      (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]);
    ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
    version = &l->l_versions[ndx];
    if (version->hash == 0)
      version = NULL;
  }

      /* We need to keep the scope around so do some locking.  This is
   not necessary for objects which cannot be unloaded or when
   we are not using any threads (yet).  */
      int flags = DL_LOOKUP_ADD_DEPENDENCY;
      if (!RTLD_SINGLE_THREAD_P)
  {
    THREAD_GSCOPE_SET_FLAG ();
    flags |= DL_LOOKUP_GSCOPE_LOCK;
  }

#ifdef RTLD_ENABLE_FOREIGN_CALL
      RTLD_ENABLE_FOREIGN_CALL;
#endif

      result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope,
            version, ELF_RTYPE_CLASS_PLT, flags, NULL);

      /* We are done with the global scope.  */
      if (!RTLD_SINGLE_THREAD_P)
  THREAD_GSCOPE_RESET_FLAG ();

#ifdef RTLD_FINALIZE_FOREIGN_CALL
      RTLD_FINALIZE_FOREIGN_CALL;
#endif

      /* Currently result contains the base load address (or link map)
   of the object that defines sym.  Now add in the symbol
   offset.  */
      value = DL_FIXUP_MAKE_VALUE (result,
           SYMBOL_ADDRESS (result, sym, false));
    }
  else
    {
      /* We already found the symbol.  The module (and therefore its load
   address) is also known.  */
      value = DL_FIXUP_MAKE_VALUE (l, SYMBOL_ADDRESS (l, sym, true));
      result = l;
    }

  /* And now perhaps the relocation addend.  */
  value = elf_machine_plt_value (l, reloc, value);

  if (sym != NULL
      && __builtin_expect (ELFW(ST_TYPE) (sym->st_info) == STT_GNU_IFUNC, 0))
    value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));

  /* Finally, fix up the plt itself.  */
  if (__glibc_unlikely (GLRO(dl_bind_not)))
    return value;

  return elf_machine_fixup_plt (l, result, refsym, sym, reloc, rel_addr, value);
}

const ElfW(Sym) *const symtab
    = (const void *) D_PTR (l, l_info[DT_SYMTAB]);

#define ElfW(type)  _ElfW (Elf, __ELF_NATIVE_CLASS, type)
#define _ElfW(e,w,t)  _ElfW_1 (e, w, _##t) // 64 位 w = 64
#define _ElfW_1(e,w,t)  e##w##t  // ## 用于连接成符号

#define DT_PLTGOT   3     /* Processor defined value */
#define DT_HASH       4     /* Address of symbol hash table */
#define DT_STRTAB  5     /* Address of string table */
#define DT_SYMTAB  6     /* Address of symbol table */
#define DT_RELA       7     /* Address of Rela relocs */

# define D_PTR(map, i) (map)->i->d_un.d_ptr

D_PTR (l, l_info[DT_SYMTAB])
    = l-> l_info[5]->d_un.d_ptr

const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)];
const ElfW(Sym) *refsym = sym;
void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);

assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT);

#define ELF32_R_TYPE(val)   ((val) & 0xff)
#define ELF_MACHINE_JMP_SLOT  R_X86_64_JUMP_SLOT
#define R_X86_64_JUMP_SLOT  7  /* Create PLT entry */

//等价于
assert ((reloc->r_info & 0xff) == 0x7);

if (__builtin_expect (ELFW(ST_VISIBILITY) (sym->st_other), 0) == 0)

#define ELF64_ST_VISIBILITY(o)  ELF32_ST_VISIBILITY (o)
#define ELF32_ST_VISIBILITY(o)  ((o) & 0x03)

  if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
{
  const ElfW(Half) *vernum =
    (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]);
  ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
  version = &l->l_versions[ndx];
  if (version->hash == 0)
    version = NULL;
}

result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope,
  version, ELF_RTYPE_CLASS_PLT, flags, NULL);

value = DL_FIXUP_MAKE_VALUE (result,
 SYMBOL_ADDRESS (result, sym, false));

return elf_machine_fixup_plt (l, result, refsym, sym, reloc, rel_addr, value);