Mostly copy and pasting from an old post in the newsgroup. I tried to build druntime as a shared library and encountered this bug. I tried to reduce it to a simpler testcase, but that didn't work.
To reproduce: Download the druntime shared library makefile (so.mak) from this site: http://www.curoles.com/j/dso/dso.html (at the bottom of the page) and compile druntime with it.
Compile this very simple test program, as described at the top of that page.
----
void main(){ }
----
The problem seems to be in the assembler code generated for main:
http://www.dsource.org/projects/druntime/browser/trunk/src/rt/dmain2.d :
extern (C) int main(int argc, char **argv)
---------------------------------------
(gdb) disassemble 0xb7f9f36c
Dump of assembler code for function main: #ebx=0xb7f16ff4 ebp=0xbffff0a8
0xb7f9f338 <+0>: push %ebp
0xb7f9f339 <+1>: mov %esp,%ebp
0xb7f9f33b <+3>: sub $0x3c,%esp
0xb7f9f33e <+6>: push %ebx #ebx=0xb7f16ff4
0xb7f9f33f <+7>: mov 0xc(%ebp),%ebx
0xb7f9f342 <+10>: push %esi #ebx=0xbffff154
0xb7f9f343 <+11>: push %edi
0xb7f9f344 <+12>: call 0xb7f9f349 <main+17>
0xb7f9f349 <+17>: pop %eax
0xb7f9f34a <+18>: add $0x15343,%eax
0xb7f9f34f <+23>: mov %eax,-0x38(%ebp)
0xb7f9f352 <+26>: movl $0x0,-0x34(%ebp)
0xb7f9f359 <+33>: movl $0x0,-0x30(%ebp)
0xb7f9f360 <+40>: movl $0x0,-0x2c(%ebp)
0xb7f9f367 <+47>: call 0xb7f8813c <_STI_monitor_staticctor at plt>
---------------------------------------
(gdb) disassemble '_STI_monitor_staticctor at plt'
Dump of assembler code for function _STI_monitor_staticctor at plt:
0xb7f8813c <+0>: jmp *0x2b4(%ebx) -->Segfault here
0xb7f88142 <+6>: push $0x550
0xb7f88147 <+11>: jmp 0xb7f8768c
--------------------------------------
The problem is the ebx register. If I understood elf files correctly,
the ebx register must hold the address of the GOT when calling a PLT
entry. I guess when the main function is called by libc, ebx should be
set correctly, in this case to 0xb7f16ff4. I also guess the "push %ebx"
instruction is meant to save the GOT adress to stack, because ebx is
used for other stuff. But the ebx register is not restored to the GOT
address before calling <_STI_monitor_staticctor at plt> and therefore "*jmp
0x2b4(%ebx) " crashes. So this seems to be a problem with dmds PIC
support / -fPIC switch.
Comment #1 by bugzilla — 2010-08-05T14:20:51Z
I don't think EBX is required to pass between functions. Each function reloads it as necessary.
Comment #2 by johannespfau — 2010-08-06T02:22:55Z
Yes I know, but the problem occurs even before the called function is executed: The PLT is a table containing executable code. If you do an position independent function call, you call into this PLT code, not directly into your target function. And these PLT instructions require EBX to be set to the GOT address.
I strogly recommend reading http://www.skyfree.org/linux/references/ELF_Format.pdf especially the section about PLT, page 48 and page 49, I think the explanation there is very good.
Comment #3 by johannespfau — 2010-08-06T03:18:32Z
Btw, that's different on x86_64 which uses "Instruction pointer relative data access".
http://www.x86-64.org/documentation/abi.pdf
(I guess you already know this document, as you're implementing 64 bit support, but just in case...)
Comment #4 by hoganmeier — 2011-11-30T11:32:10Z
Created attachment 1047
my Makefile adjustments
I tried it on x64:
$ make MODEL=64 -f posix.mak -j2
cc -c -m64 -O -fPIC src/core/stdc/errno.c -oobj/errno_c.o
cc -Wa,-noexecstack -c -m64 -O -fPIC src/core/threadasm.S -oobj/threadasm.o
cc -c -m64 -O -fPIC src/rt/complex.c -oobj/complex.o
...
dmd -c -oflib/ofdrt.o -m64 -O -fPIC -release -inline -nofloat -w -d -Isrc -Iimport src/object_.d [......]
gcc -shared -Wl,-export-dynamic,-soname,lib/libdruntime.so.1 -o lib/libdruntime.so.1.0.1 lib/ofdrt.o obj/errno_c.o obj/threadasm.o obj/complex.o
/usr/bin/ld: lib/ofdrt.o: relocation R_X86_64_PC32 against symbol `_Dmodule_ref' can not be used when making a shared object; recompile with -fPIC
/usr/bin/ld: final link failed: Bad value
Comment #5 by bugzilla — 2011-11-30T14:31:30Z
(In reply to comment #2)
> Yes I know, but the problem occurs even before the called function is executed:
> The PLT is a table containing executable code. If you do an position
> independent function call, you call into this PLT code, not directly into your
> target function. And these PLT instructions require EBX to be set to the GOT
> address.
You're right. DMD doesn't do this at the moment.
(In reply to comment #6)
> This addresses setting EBX before the function call, not any other issues.
Still, a couple of the runtime compiler helper functions pass arguments in EBX. This still needs fixing.
Comment #8 by github-bugzilla — 2012-05-04T23:00:44Z