1 # This change reimplements the ARM _dl_linux_resolve entry point - this is
2 # called to resolve DLL PLT entries. The assembler is changed to be thumb
3 # compatible and slightly faster, the C function, _dl_linux_resolver (note
4 # the extra r) is changed to take a byte address in place of an 8 byte
5 # count (faster in caller and callee, and slightly easier to understand).
7 --- uClibc-0.9.28/.pc/thumb-resolve.patch/ldso/ldso/arm/elfinterp.c 2005-08-17 15:49:41.000000000 -0700
8 +++ uClibc-0.9.28/ldso/ldso/arm/elfinterp.c 2005-09-17 12:55:26.379172744 -0700
11 rel_addr = (ELF_RELOC *) tpnt->dynamic_info[DT_JMPREL];
13 - this_reloc = rel_addr + (reloc_entry >> 3);
14 + this_reloc = rel_addr + reloc_entry;
15 reloc_type = ELF32_R_TYPE(this_reloc->r_info);
16 symtab_index = ELF32_R_SYM(this_reloc->r_info);
21 #if defined (__SUPPORT_LD_DEBUG__)
22 +#if !defined __SUPPORT_LD_DEBUG_EARLY__
23 if ((unsigned long) got_addr < 0x40000000)
26 if (_dl_debug_bindings)
28 --- uClibc-0.9.28/.pc/thumb-resolve.patch/ldso/ldso/arm/resolve.S 2005-08-17 15:49:41.000000000 -0700
29 +++ uClibc-0.9.28/ldso/ldso/arm/resolve.S 2005-09-17 11:02:27.860627464 -0700
32 - * This function is _not_ called directly. It is jumped to (so no return
33 - * address is on the stack) when attempting to use a symbol that has not yet
34 - * been resolved. The first time a jump symbol (such as a function call inside
35 - * a shared library) is used (before it gets resolved) it will jump here to
36 - * _dl_linux_resolve. When we get called the stack looks like this:
40 - * This function saves all the registers, puts a copy of reloc_entry and tpnt
41 - * on the stack (as function arguments) then make the function call
42 - * _dl_linux_resolver(tpnt, reloc_entry). _dl_linux_resolver() figures out
43 - * where the jump symbol is _really_ supposed to have jumped to and returns
44 - * that to us. Once we have that, we overwrite tpnt with this fixed up
45 - * address. We then clean up after ourselves, put all the registers back how we
46 - * found them, then we jump to the fixed up address, which is where the jump
47 - * symbol that got us here really wanted to jump to in the first place.
49 + * On ARM the PLT contains the following three instructions (for ARM calls):
51 + * add ip, pc, #0xNN00000
52 + * add ip, ip, #0xNN000
53 + * ldr pc, [ip, #0xNNN]!
55 + * So that, effectively, causes the following to happen:
57 + * ip := pc+0x0NNNNNNN
60 + * For thumb the above fragment is preceded by "bx pc, nop" to switch to ARM
61 + * mode and the thumb 'bl' must go to PLT-4 - the PLT entry is expanded by
62 + * four bytes to accomodate the trampoline code.
64 + * 0x0NNNNNNN is the offset of the GOT entry for this function relative to
65 + * the PLT entry for this function (where the code is). So the code in the
66 + * PLT causes a branch to whatever is in the GOT, leaving the actual address
67 + * of the GOT entry in ip. (Note that the GOT must follow the PLT - the
68 + * added value is 28 bit unsigned).
70 + * ip is a pointer to the GOT entry for this function, the first time round
71 + * *ip points to this code:
73 + * str lr, [sp, #-4]! @ save lr
74 + * ldr lr, [pc, #4] @ lr := *dat (&GOT_TABLE[0]-.)
75 + * add lr, pc, lr @ lr += &dat (so lr == &GOT_TABLE[0])
76 + * ldr pc, [lr, #8]! @ pc := GOT_TABLE[2]
77 + *dat: .long &GOT_TABLE[0] - .
79 + * (this code is actually held in the first entry of the PLT). The code
80 + * preserves lr then uses it as a scratch register (this preserves the ip
81 + * value calculated above). GOT_TABLE[2] is initialized by INIT_GOT in
82 + * dl-sysdep.h to point to _dl_linux_resolve - this function. The first
83 + * three entries in the GOT are reserved, then they are followed by the
84 + * entries for the PLT entries, in order.
86 + * The linker initialises the following (non-reserved) GOT entries to
87 + * the offset of the PLT with an associated relocation so that on load
88 + * the entry is relocated to point to the PLT - the above code.
90 + * The net effect of all this is that on the first call to an external (as
91 + * yet unresolved) function all seven of the above instructions are
92 + * executed in sequence and the program ends up executing _dl_linux_resolve
93 + * with the following important values in registers:
95 + * ip - a pointer to the GOT entry for the as yet unresolved function
96 + * lr - &GOT_TABLE[2]
98 + * GOT_TABLE[2] has already been initialised to _dl_linux_resolve, and
99 + * GOT_TABLE[1] is a pointer to the (elf_resolve*) from INIT_GOT.
100 + * _dl_linux_resolve unfrobnicates the ip and lr values to obtain arguments
101 + * for a call to _dl_linux_resolver (not the additional 'r' on the end) -
102 + * this is in elfinterp.c in this directory. The call takes arguments:
104 + * _dl_linux_resolver(struct elf_resolve *tpnt, int reloc_entry)
106 + * And returns the address of the function, it also overwrites the GOT
107 + * table entry so that the next time round only the first code fragment will
108 + * be executed - it will call the function directly.
110 + * [[Of course, this simply doesn't work on ARM 4T with a thumb target - because
111 + * 4T did not do the thumb/arm change on ldr pc! It can be made to work by
112 + * changing _dl_linux_resolver to return __%s_from_arm for an STT_TFUNC, but
113 + * this hasn't been done, and there is no guarantee that the linker generated
114 + * that glue anyway.]]
116 + * _dl_linux_resolve gets the arguments to call the resolver as follows:
118 + * tpnt GOT_TABLE[1], [lr-4]
119 + * reloc-entry &GOT-&GOT_TABLE[3], (ip - lr - 4)/4
121 + * (I.e. 'GOT' means the table entry for this function, the thing for which
122 + * ip holds the address.) The reloc-entry is passed as an index, since
123 + * since the GOT table has 4 byte entries the code needs to divide this by 4
124 + * to get the actual index.
126 + * John Bowler, August 13, 2005 - determined by experiment and examination
127 + * of generated ARM code (there was no documentation...)
129 + * This code is all ARM code - not thumb - _dl_linux_resolver may, itself,
130 + * be thumb, in which case the linker will insert the appropriate glue. A
131 + * call from thumb to the PLT hits the trampoline code described above.
132 + * This code (now) builds a proper stack frame.
134 + * The code does *not* set sb (r9,v6) - to do that the basic PLT instructions
135 + * would need to save sb and load the new value and that would require
136 + * support in the linker since it generates those instructions. (Also note
137 + * that linux/uclibc seems to be using r10 - sl - as a PIC base register - see
144 +#include <sys/syscall.h>
147 +.align 4 @ 16 byte boundary and there are 32 bytes below (arm case)
148 +#if !defined(__thumb__)
150 .globl _dl_linux_resolve
151 .type _dl_linux_resolve,%function
155 - stmdb sp!, {r0, r1, r2, r3, sl, fp}
161 + @ _dl_linux_resolver is a standard subroutine call, therefore it
162 + @ preserves everything except r0-r3 (a1-a4), ip and lr. This
163 + @ function must branch to the real function, and that expects
164 + @ r0-r3 and lr to be as they were before the whole PLT stuff -
165 + @ ip can be trashed.
167 + ldr r0, [lr, #-4] @ r0 := [lr-4] (GOT_TABLE[1])
168 + sub r1, lr, ip @ r1 := (lr-ip) (a multple of 4)
169 + mvn r1, r1, ASR #2 @ r1 := ~((lr-ip)>>2), since -x = (1+~x)
170 + @ ~x = -x-1, therefore ~(r1>>2) = (-((lr-ip)>>2)-1)
171 + @ = - ((lr-ip)/4) - 1 = (ip - lr - 4)/4, as required
173 bl _dl_linux_resolver
176 - ldmia sp!, {r0, r1, r2, r3, sl, fp, lr}
179 + ldmia sp!, {r0-r3, lr}
180 +#if defined(__THUMB_INTERWORK__)
185 +.size _dl_linux_resolve, .-_dl_linux_resolve
187 + @ In the thumb case _dl_linux_resolver is thumb. If a bl is used
188 + @ from arm code the linker will insert a stub call which, with
189 + @ binutils 2.16, is not PIC. Since this code is accessed by an
190 + @ ldr pc the reasonable fix is to make _dl_linux_resolve thumb too.
192 +.globl _dl_linux_resolve
194 +.type _dl_linux_resolve,%function
197 + @ _dl_linux_resolver is a standard subroutine call, therefore it
198 + @ preserves everything except r0-r3 (a1-a4), ip and lr. This
199 + @ function must branch to the real function, and that expects
200 + @ r0-r3 and lr to be as they were before the whole PLT stuff -
201 + @ ip can be trashed.
203 + mov r1, lr @ &GOT_TABLE[2]
205 + mov r2, ip @ &GOT[n]
206 + ldr r0, [r0] @ r0 := GOT_TABLE[1]
207 + @ for the function call r1 := n-3
210 + mvn r1, r1 @ exactly as in the arm code above
212 + bl _dl_linux_resolver
214 + @ r0 contains the branch address, the return address is above
223 .size _dl_linux_resolve, .-_dl_linux_resolve
225 --- uClibc-0.9.28/.pc/thumb-resolve.patch/ldso/ldso/dl-hash.c 2005-08-17 15:49:41.000000000 -0700
226 +++ uClibc-0.9.28/ldso/ldso/dl-hash.c 2005-09-21 18:56:31.181689732 -0700
227 @@ -182,28 +182,52 @@
228 strtab = (char *) (tpnt->dynamic_info[DT_STRTAB]);
230 for (si = tpnt->elf_buckets[hn]; si != STN_UNDEF; si = tpnt->chains[si]) {
234 - if (type_class & (sym->st_shndx == SHN_UNDEF))
235 + if (sym->st_shndx == SHN_UNDEF)
237 - if (_dl_strcmp(strtab + sym->st_name, name) != 0)
238 + if (ELF_ST_TYPE(sym->st_info) > STT_FUNC
239 +#if defined(__arm__) || defined(__thumb__)
240 + /* On ARM (only) STT_ARM_TFUNC is a function
241 + * and has a value >STT_FUNC, so this must
242 + * be checked specially.
244 + && ELF_ST_TYPE(sym->st_info) != STT_ARM_TFUNC
248 - if (sym->st_value == 0)
249 + if (_dl_strcmp(strtab + sym->st_name, name) != 0)
251 - if (ELF_ST_TYPE(sym->st_info) > STT_FUNC)
253 + /* I don't know how to write this test - need to test shndx
254 + * to see if it is the PLT for this module.
256 + if ((type_class & ELF_RTYPE_CLASS_PLT) && some test)
260 +#if defined(__arm__) || defined(__thumb__)
261 + /* On ARM the caller needs to know that STT_ARM_TFUNC
262 + * is a thumb function call, this is now indicated by
263 + * setting the low bit of the value (and newer binutils
264 + * will do this and record STT_FUNC).
266 + result = (char*)tpnt->loadaddr + (sym->st_value |
267 + (ELF_ST_TYPE(sym->st_info) == STT_ARM_TFUNC));
269 + result = (char*)tpnt->loadaddr + sym->st_value;
271 switch (ELF_ST_BIND(sym->st_info)) {
274 -/* Perhaps we should support old style weak symbol handling
275 - * per what glibc does when you export LD_DYNAMIC_WEAK */
276 + /* Record for use later if we can't find a global. */
278 - weak_result = (char *)tpnt->loadaddr + sym->st_value;
279 + weak_result = result;
284 - return (char*)tpnt->loadaddr + sym->st_value;
287 default: /* Local symbols not handled here */