1.\" Copyright (c) 1993 Paul Kranenburg 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by Paul Kranenburg. 15.\" 3. The name of the author may not be used to endorse or promote products 16.\" derived from this software without specific prior written permission 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28.\" 29.\" $FreeBSD: src/share/man/man5/link.5,v 1.14.2.10 2004/05/17 11:38:55 brueffer Exp $ 30.\" $DragonFly: src/share/man/man5/link.5,v 1.7 2008/05/02 02:05:06 swildner Exp $ 31.\" 32.Dd October 23, 1993 33.Dt LINK 5 34.Os 35.Sh NAME 36.Nm link 37.Nd dynamic loader and link editor interface 38.Sh SYNOPSIS 39.In sys/types.h 40.In nlist.h 41.In link.h 42.Sh DESCRIPTION 43The include file 44.In link.h 45declares several structures that are present in dynamically linked 46programs and libraries. 47The structures define the interface between several components of the 48link-editor and loader mechanism. 49The layout of a number of these 50structures within the binaries resembles the a.out format in many places 51as it serves such similar functions as symbol definitions (including the 52accompanying string table) and relocation records needed to resolve 53references to external entities. 54It also records a number of data structures 55unique to the dynamic loading and linking process. 56These include references 57to other objects that are required to complete the link-editing process and 58indirection tables to facilitate 59.Em Position Independent Code 60(PIC for short) to improve sharing of code pages among different processes. 61The collection of data structures described here will be referred to as the 62.Em Run-time Relocation Section (RRS) 63and is embedded in the standard text and data segments of the dynamically 64linked program or shared object image as the existing 65.Xr a.out 5 66format offers no room for it elsewhere. 67.Pp 68Several utilities cooperate to ensure that the task of getting a program 69ready to run can complete successfully in a way that optimizes the use 70of system resources. 71The compiler emits PIC code from which shared libraries 72can be built by 73.Xr ld 1 . 74The compiler also includes size information of any initialized data items 75through the .size assembler directive. 76PIC code differs from conventional code 77in that it accesses data variables through an indirection table, the 78Global Offset Table, by convention accessible by the reserved name 79.Dv _GLOBAL_OFFSET_TABLE_ . 80The exact mechanism used for this is machine dependent, usually a machine 81register is reserved for the purpose. 82The rational behind this construct 83is to generate code that is independent of the actual load address. 84Only 85the values contained in the Global Offset Table may need updating at run-time 86depending on the load addresses of the various shared objects in the address 87space. 88.Pp 89Likewise, procedure calls to globally defined functions are redirected through 90the Procedure Linkage Table (PLT) residing in the data segment of the core 91image. 92Again, this is done to avoid run-time modifications to the text segment. 93.Pp 94The linker-editor allocates the Global Offset Table and Procedure Linkage Table 95when combining PIC object files into an image suitable for mapping into the 96process address space. 97It also collects all symbols that may be needed by the 98run-time link-editor and stores these along with the image's text and data bits. 99Another reserved symbol, 100.Em _DYNAMIC 101is used to indicate the presence of the run-time linker structures. 102Whenever 103_DYNAMIC is relocated to 0, there is no need to invoke the run-time 104link-editor. 105If this symbol is non-zero, it points at a data structure from 106which the location of the necessary relocation- and symbol information can 107be derived. 108This is most notably used by the start-up module, 109.Em crt0 . 110The _DYNAMIC structure is conventionally located at the start of the data 111segment of the image to which it pertains. 112.Sh DATA STRUCTURES 113The data structures supporting dynamic linking and run-time relocation 114reside both in the text and data segments of the image they apply to. 115The text segments contain read-only data such as symbols descriptions and 116names, while the data segments contain the tables that need to be modified by 117during the relocation process. 118.Pp 119The _DYNAMIC symbol references a 120.Fa _dynamic 121structure: 122.Bd -literal -offset indent 123struct _dynamic { 124 int d_version; 125 struct so_debug *d_debug; 126 union { 127 struct section_dispatch_table *d_sdt; 128 } d_un; 129 struct ld_entry *d_entry; 130}; 131.Ed 132.Bl -tag -width d_version 133.It Fa d_version 134This field provides for different versions of the dynamic linking 135implementation. 136The current version numbers understood by 137.Xr ld 1 138and 139.Xr rtld 1 140are 141.Em LD_VERSION_SUN (3) , 142which is used by the 143.Tn SunOS 1444.x releases, and 145.Em LD_VERSION_BSD (8) , 146which has been in use since 147.Fx 1.1 . 148.It Fa d_un 149Refers to a 150.Em d_version 151dependent data structure. 152.It Fa so_debug 153this field provides debuggers with a hook to access symbol tables of shared 154objects loaded as a result of the actions of the run-time link-editor. 155.El 156.Pp 157The 158.Fa section_dispatch_table 159structure is the main 160.Dq dispatcher 161table, containing offsets into the image's segments where various symbol 162and relocation information is located. 163.Bd -literal -offset indent 164struct section_dispatch_table { 165 struct so_map *sdt_loaded; 166 long sdt_sods; 167 long sdt_filler1; 168 long sdt_got; 169 long sdt_plt; 170 long sdt_rel; 171 long sdt_hash; 172 long sdt_nzlist; 173 long sdt_filler2; 174 long sdt_buckets; 175 long sdt_strings; 176 long sdt_str_sz; 177 long sdt_text_sz; 178 long sdt_plt_sz; 179}; 180.Ed 181.Bl -tag -width sdt_filler1 182.It Fa sdt_loaded 183A pointer to the first link map loaded (see below). This field is set by 184.Xr rtld 1 185.It Fa sdt_sods 186The start of a (linked) list of shared object descriptors needed by 187.Em this 188object. 189.It Fa sdt_filler1 190Deprecated (used by SunOS to specify library search rules). 191.It Fa sdt_got 192The location of the Global Offset Table within this image. 193.It Fa sdt_plt 194The location of the Procedure Linkage Table within this image. 195.It Fa sdt_rel 196The location of an array of 197.Fa relocation_info 198structures 199(see 200.Xr a.out 5 ) 201specifying run-time relocations. 202.It Fa sdt_hash 203The location of the hash table for fast symbol lookup in this object's 204symbol table. 205.It Fa sdt_nzlist 206The location of the symbol table. 207.It Fa sdt_filler2 208Currently unused. 209.It Fa sdt_buckets 210The number of buckets in 211.Fa sdt_hash 212.It Fa sdt_strings 213The location of the symbol string table that goes with 214.Fa sdt_nzlist . 215.It Fa sdt_str_sz 216The size of the string table. 217.It Fa sdt_text_sz 218The size of the object's text segment. 219.It Fa sdt_plt_sz 220The size of the Procedure Linkage Table. 221.El 222.Pp 223A 224.Fa sod 225structure describes a shared object that is needed 226to complete the link edit process of the object containing it. 227A list of such objects 228(chained through 229.Fa sod_next ) 230is pointed at 231by the 232.Fa sdt_sods 233in the section_dispatch_table structure. 234.Bd -literal -offset indent 235struct sod { 236 long sod_name; 237 u_int sod_library : 1, 238 sod_reserved : 31; 239 short sod_major; 240 short sod_minor; 241 long sod_next; 242}; 243.Ed 244.Bl -tag -width sod_library 245.It Fa sod_name 246The offset in the text segment of a string describing this link object. 247.It Fa sod_library 248If set, 249.Fa sod_name 250specifies a library that is to be searched for by 251.Xr rtld 1 . 252The path name 253is obtained by searching a set of directories 254(see also 255.Xr ldconfig 8 ) 256for a shared object matching 257.Em lib\&<sod_name>\&.so.n.m . 258If not set, 259.Fa sod_name 260should point at a full path name for the desired shared object. 261.It Fa sod_major 262Specifies the major version number of the shared object to load. 263.It Fa sod_minor 264Specifies the preferred minor version number of the shared object to load. 265.El 266.Pp 267The run-time link-editor maintains a list of structures called 268.Em link maps 269to keep track of all shared objects loaded into a process' address space. 270These structures are only used at run-time and do not occur within 271the text or data segment of an executable or shared library. 272.Bd -literal -offset indent 273struct so_map { 274 caddr_t som_addr; 275 char *som_path; 276 struct so_map *som_next; 277 struct sod *som_sod; 278 caddr_t som_sodbase; 279 u_int som_write : 1; 280 struct _dynamic *som_dynamic; 281 caddr_t som_spd; 282}; 283.Ed 284.Bl -tag -width som_dynamic 285.It Fa som_addr 286The address at which the shared object associated with this link map has 287been loaded. 288.It Fa som_path 289The full path name of the loaded object. 290.It Fa som_next 291Pointer to the next link map. 292.It Fa som_sod 293The 294.Fa sod 295structure that was responsible for loading this shared object. 296.It Fa som_sodbase 297Tossed out in later versions of the run-time linker. 298.It Fa som_write 299Set if (some portion of) this object's text segment is currently writable. 300.It Fa som_dynamic 301Pointer to this object's 302.Fa _dynamic 303structure. 304.It Fa som_spd 305Hook for attaching private data maintained by the run-time link-editor. 306.El 307.Pp 308Symbol description with size. 309This is simply an 310.Fa nlist 311structure with one field 312.Pq Fa nz_size 313added. 314Used to convey size information on items in the data segment 315of shared objects. 316An array of these lives in the shared object's 317text segment and is addressed by the 318.Fa sdt_nzlist 319field of 320.Fa section_dispatch_table . 321.Bd -literal -offset indent 322struct nzlist { 323 struct nlist nlist; 324 u_long nz_size; 325#define nz_un nlist.n_un 326#define nz_strx nlist.n_un.n_strx 327#define nz_name nlist.n_un.n_name 328#define nz_type nlist.n_type 329#define nz_value nlist.n_value 330#define nz_desc nlist.n_desc 331#define nz_other nlist.n_other 332}; 333.Ed 334.Bl -tag -width nz_size 335.It Fa nlist 336(see 337.Xr nlist 3 ) . 338.It Fa nz_size 339The size of the data represented by this symbol. 340.El 341.Pp 342A hash table is included within the text segment of shared object 343to facilitate quick lookup of symbols during run-time link-editing. 344The 345.Fa sdt_hash 346field of the 347.Fa section_dispatch_table 348structure points at an array of 349.Fa rrs_hash 350structures: 351.Bd -literal -offset indent 352struct rrs_hash { 353 int rh_symbolnum; /* symbol number */ 354 int rh_next; /* next hash entry */ 355}; 356.Ed 357.Bl -tag -width rh_symbolnum 358.It Fa rh_symbolnum 359The index of the symbol in the shared object's symbol table (as given by the 360.Fa ld_symbols 361field). 362.It Fa rh_next 363In case of collisions, this field is the offset of the next entry in this 364hash table bucket. 365It is zero for the last bucket element. 366.El 367The 368.Fa rt_symbol 369structure is used to keep track of run-time allocated commons 370and data items copied from shared objects. 371These items are kept on linked list 372and is exported through the 373.Fa dd_cc 374field in the 375.Fa so_debug 376structure (see below) for use by debuggers. 377.Bd -literal -offset indent 378struct rt_symbol { 379 struct nzlist *rt_sp; 380 struct rt_symbol *rt_next; 381 struct rt_symbol *rt_link; 382 caddr_t rt_srcaddr; 383 struct so_map *rt_smp; 384}; 385.Ed 386.Bl -tag -width rt_scraddr 387.It Fa rt_sp 388The symbol description. 389.It Fa rt_next 390Virtual address of next rt_symbol. 391.It Fa rt_link 392Next in hash bucket. 393Used internally by 394.Xr rtld 1 . 395.It Fa rt_srcaddr 396Location of the source of initialized data within a shared object. 397.It Fa rt_smp 398The shared object which is the original source of the data that this 399run-time symbol describes. 400.El 401.Pp 402The 403.Fa so_debug 404structure is used by debuggers to gain knowledge of any shared objects 405that have been loaded in the process's address space as a result of run-time 406link-editing. 407Since the run-time link-editor runs as a part of process 408initialization, a debugger that wishes to access symbols from shared objects 409can only do so after the link-editor has been called from crt0. 410A dynamically linked binary contains a 411.Fa so_debug 412structure which can be located by means of the 413.Fa d_debug 414field in 415.Fa _dynamic . 416.Bd -literal -offset indent 417struct so_debug { 418 int dd_version; 419 int dd_in_debugger; 420 int dd_sym_loaded; 421 char *dd_bpt_addr; 422 int dd_bpt_shadow; 423 struct rt_symbol *dd_cc; 424}; 425.Ed 426.Bl -tag -width dd_in_debugger 427.It Fa dd_version 428Version number of this interface. 429.It Fa dd_in_debugger 430Set by the debugger to indicate to the run-time linker that the program is 431run under control of a debugger. 432.It Fa dd_sym_loaded 433Set by the run-time linker whenever it adds symbols by loading shared objects. 434.It Fa dd_bpt_addr 435The address where a breakpoint will be set by the run-time linker to 436divert control to the debugger. 437This address is determined by the start-up 438module, 439.Pa crt0.o , 440to be some convenient place before the call to _main. 441.It Fa dd_bpt_shadow 442Contains the original instruction that was at 443.Fa dd_bpt_addr . 444The debugger is expected to put this instruction back before continuing the 445program. 446.It Fa dd_cc 447A pointer to the linked list of run-time allocated symbols that the debugger 448may be interested in. 449.El 450.Pp 451The 452.Em ld_entry 453structure defines a set of service routines within 454.Xr rtld 1 . 455.\" See 456.\" .Xr libdl.a 457.\" for more information. 458.Bd -literal -offset indent 459struct ld_entry { 460 void *(*dlopen)(char *, int); 461 int (*dlclose)(void *); 462 void *(*dlsym)(void *, char *); 463 char *(*dlerror)(void); 464}; 465.Ed 466.Pp 467The 468.Fa crt_ldso 469structure defines the interface between the start-up code in crt0 and 470.Xr rtld 1 . 471.Bd -literal -offset indent 472struct crt_ldso { 473 int crt_ba; 474 int crt_dzfd; 475 int crt_ldfd; 476 struct _dynamic *crt_dp; 477 char **crt_ep; 478 caddr_t crt_bp; 479 char *crt_prog; 480 char *crt_ldso; 481 struct ld_entry *crt_ldentry; 482}; 483#define CRT_VERSION_SUN 1 484#define CRT_VERSION_BSD_2 2 485#define CRT_VERSION_BSD_3 3 486#define CRT_VERSION_BSD_4 4 487.Ed 488.Bl -tag -width crt_dzfd 489.It Fa crt_ba 490The virtual address at which 491.Xr rtld 1 492was loaded by crt0. 493.It Fa crt_dzfd 494On SunOS systems, this field contains an open file descriptor to 495.Dq Pa /dev/zero 496used to get demand paged zeroed pages. 497On 498.Dx 499systems it contains -1. 500.It Fa crt_ldfd 501Contains an open file descriptor that was used by crt0 to load 502.Xr rtld 1 . 503.It Fa crt_dp 504A pointer to main's 505.Fa _dynamic 506structure. 507.It Fa crt_ep 508A pointer to the environment strings. 509.It Fa crt_bp 510The address at which a breakpoint will be placed by the run-time linker 511if the main program is run by a debugger. 512See 513.Fa so_debug 514.It Fa crt_prog 515The name of the main program as determined by crt0 (CRT_VERSION_BSD3 only). 516.It Fa crt_ldso 517The path of the run-time linker as mapped by crt0 (CRT_VERSION_BSD4 only). 518.El 519.Pp 520The 521.Fa hints_header 522and 523.Fa hints_bucket 524structures define the layout of the library hints, normally found in 525.Dq Pa /var/run/ld-elf.so.hints , 526which is used by 527.Xr rtld 1 528to quickly locate the shared object images in the 529filesystem. 530The organization of the hints file is not unlike that of an 531.Dq a.out 532object file, in that it contains a header determining the offset and size 533of a table of fixed sized hash buckets and a common string pool. 534.Bd -literal -offset indent 535struct hints_header { 536 long hh_magic; 537#define HH_MAGIC 011421044151 538 long hh_version; 539#define LD_HINTS_VERSION_1 1 540 long hh_hashtab; 541 long hh_nbucket; 542 long hh_strtab; 543 long hh_strtab_sz; 544 long hh_ehints; 545}; 546.Ed 547.Bl -tag -width hh_strtab_sz 548.It Fa hh_magic 549Hints file magic number. 550.It Fa hh_version 551Interface version number. 552.It Fa hh_hashtab 553Offset of hash table. 554.It Fa hh_strtab 555Offset of string table. 556.It Fa hh_strtab_sz 557Size of strings. 558.It Fa hh_ehints 559Maximum usable offset in hints file. 560.El 561.Bd -literal -offset indent 562/* 563 * Hash table element in hints file. 564 */ 565struct hints_bucket { 566 int hi_namex; 567 int hi_pathx; 568 int hi_dewey[MAXDEWEY]; 569 int hi_ndewey; 570#define hi_major hi_dewey[0] 571#define hi_minor hi_dewey[1] 572 int hi_next; 573}; 574.Ed 575.Bl -tag -width hi_ndewey 576.It Fa hi_namex 577Index of the string identifying the library. 578.It Fa hi_pathx 579Index of the string representing the full path name of the library. 580.It Fa hi_dewey 581The version numbers of the shared library. 582.It Fa hi_ndewey 583The number of valid entries in 584.Fa hi_dewey . 585.It Fa hi_next 586Next bucket in case of hashing collisions. 587.El 588.Sh CAVEATS 589Only the (GNU) C compiler currently supports the creation of shared libraries. 590Other programming languages cannot be used. 591