• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (C) 2016 The Android Open Source Project
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *  * Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  *  * Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in
12  *    the documentation and/or other materials provided with the
13  *    distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19  * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include "linker_main.h"
30 
31 #include <link.h>
32 #include <sys/auxv.h>
33 
34 #include "linker_debug.h"
35 #include "linker_cfi.h"
36 #include "linker_gdb_support.h"
37 #include "linker_globals.h"
38 #include "linker_phdr.h"
39 #include "linker_tls.h"
40 #include "linker_utils.h"
41 
42 #include "private/bionic_globals.h"
43 #include "private/bionic_tls.h"
44 #include "private/KernelArgumentBlock.h"
45 
46 #include "android-base/unique_fd.h"
47 #include "android-base/strings.h"
48 #include "android-base/stringprintf.h"
49 #ifdef __ANDROID__
50 #include "debuggerd/handler.h"
51 #endif
52 
53 #include <async_safe/log.h>
54 #include <bionic/libc_init_common.h>
55 #include <bionic/pthread_internal.h>
56 
57 #include <vector>
58 
59 __LIBC_HIDDEN__ extern "C" void _start();
60 
61 static ElfW(Addr) get_elf_exec_load_bias(const ElfW(Ehdr)* elf);
62 
63 static void get_elf_base_from_phdr(const ElfW(Phdr)* phdr_table, size_t phdr_count,
64                                    ElfW(Addr)* base, ElfW(Addr)* load_bias);
65 
66 // These should be preserved static to avoid emitting
67 // RELATIVE relocations for the part of the code running
68 // before linker links itself.
69 
70 // TODO (dimtiry): remove somain, rename solist to solist_head
71 static soinfo* solist;
72 static soinfo* sonext;
73 static soinfo* somain; // main process, always the one after libdl_info
74 static soinfo* solinker;
75 static soinfo* vdso; // vdso if present
76 
solist_add_soinfo(soinfo * si)77 void solist_add_soinfo(soinfo* si) {
78   sonext->next = si;
79   sonext = si;
80 }
81 
solist_remove_soinfo(soinfo * si)82 bool solist_remove_soinfo(soinfo* si) {
83   soinfo *prev = nullptr, *trav;
84   for (trav = solist; trav != nullptr; trav = trav->next) {
85     if (trav == si) {
86       break;
87     }
88     prev = trav;
89   }
90 
91   if (trav == nullptr) {
92     // si was not in solist
93     PRINT("name \"%s\"@%p is not in solist!", si->get_realpath(), si);
94     return false;
95   }
96 
97   // prev will never be null, because the first entry in solist is
98   // always the static libdl_info.
99   CHECK(prev != nullptr);
100   prev->next = si->next;
101   if (si == sonext) {
102     sonext = prev;
103   }
104 
105   return true;
106 }
107 
solist_get_head()108 soinfo* solist_get_head() {
109   return solist;
110 }
111 
solist_get_somain()112 soinfo* solist_get_somain() {
113   return somain;
114 }
115 
solist_get_vdso()116 soinfo* solist_get_vdso() {
117   return vdso;
118 }
119 
120 int g_ld_debug_verbosity;
121 
122 static std::vector<std::string> g_ld_preload_names;
123 
124 static std::vector<soinfo*> g_ld_preloads;
125 
parse_path(const char * path,const char * delimiters,std::vector<std::string> * resolved_paths)126 static void parse_path(const char* path, const char* delimiters,
127                        std::vector<std::string>* resolved_paths) {
128   std::vector<std::string> paths;
129   split_path(path, delimiters, &paths);
130   resolve_paths(paths, resolved_paths);
131 }
132 
parse_LD_LIBRARY_PATH(const char * path)133 static void parse_LD_LIBRARY_PATH(const char* path) {
134   std::vector<std::string> ld_libary_paths;
135   parse_path(path, ":", &ld_libary_paths);
136   g_default_namespace.set_ld_library_paths(std::move(ld_libary_paths));
137 }
138 
parse_LD_PRELOAD(const char * path)139 static void parse_LD_PRELOAD(const char* path) {
140   g_ld_preload_names.clear();
141   if (path != nullptr) {
142     // We have historically supported ':' as well as ' ' in LD_PRELOAD.
143     g_ld_preload_names = android::base::Split(path, " :");
144     g_ld_preload_names.erase(std::remove_if(g_ld_preload_names.begin(), g_ld_preload_names.end(),
145                                             [](const std::string& s) { return s.empty(); }),
146                              g_ld_preload_names.end());
147   }
148 }
149 
150 // An empty list of soinfos
151 static soinfo_list_t g_empty_list;
152 
add_vdso()153 static void add_vdso() {
154   ElfW(Ehdr)* ehdr_vdso = reinterpret_cast<ElfW(Ehdr)*>(getauxval(AT_SYSINFO_EHDR));
155   if (ehdr_vdso == nullptr) {
156     return;
157   }
158 
159   soinfo* si = soinfo_alloc(&g_default_namespace, "[vdso]", nullptr, 0, 0);
160 
161   si->phdr = reinterpret_cast<ElfW(Phdr)*>(reinterpret_cast<char*>(ehdr_vdso) + ehdr_vdso->e_phoff);
162   si->phnum = ehdr_vdso->e_phnum;
163   si->base = reinterpret_cast<ElfW(Addr)>(ehdr_vdso);
164   si->size = phdr_table_get_load_size(si->phdr, si->phnum);
165   si->load_bias = get_elf_exec_load_bias(ehdr_vdso);
166 
167   si->prelink_image();
168   si->link_image(g_empty_list, soinfo_list_t::make_list(si), nullptr, nullptr);
169   // prevents accidental unloads...
170   si->set_dt_flags_1(si->get_dt_flags_1() | DF_1_NODELETE);
171   si->set_linked();
172   si->call_constructors();
173 
174   vdso = si;
175 }
176 
177 // Initializes an soinfo's link_map_head field using other fields from the
178 // soinfo (phdr, phnum, load_bias).
init_link_map_head(soinfo & info,const char * linker_path)179 static void init_link_map_head(soinfo& info, const char* linker_path) {
180   auto& map = info.link_map_head;
181   map.l_addr = info.load_bias;
182   map.l_name = const_cast<char*>(linker_path);
183   phdr_table_get_dynamic_section(info.phdr, info.phnum, info.load_bias, &map.l_ld, nullptr);
184 }
185 
186 extern "C" int __system_properties_init(void);
187 
188 struct ExecutableInfo {
189   std::string path;
190   struct stat file_stat;
191   const ElfW(Phdr)* phdr;
192   size_t phdr_count;
193   ElfW(Addr) entry_point;
194 };
195 
get_executable_info()196 static ExecutableInfo get_executable_info() {
197   ExecutableInfo result = {};
198 
199   if (is_first_stage_init()) {
200     // /proc fs is not mounted when first stage init starts. Therefore we can't
201     // use /proc/self/exe for init.
202     stat("/init", &result.file_stat);
203 
204     // /init may be a symlink, so try to read it as such.
205     char path[PATH_MAX];
206     ssize_t path_len = readlink("/init", path, sizeof(path));
207     if (path_len == -1 || path_len >= static_cast<ssize_t>(sizeof(path))) {
208       result.path = "/init";
209     } else {
210       result.path = std::string(path, path_len);
211     }
212   } else {
213     // Stat "/proc/self/exe" instead of executable_path because
214     // the executable could be unlinked by this point and it should
215     // not cause a crash (see http://b/31084669)
216     if (TEMP_FAILURE_RETRY(stat("/proc/self/exe", &result.file_stat)) != 0) {
217       async_safe_fatal("unable to stat \"/proc/self/exe\": %s", strerror(errno));
218     }
219     char path[PATH_MAX];
220     ssize_t path_len = readlink("/proc/self/exe", path, sizeof(path));
221     if (path_len == -1 || path_len >= static_cast<ssize_t>(sizeof(path))) {
222       async_safe_fatal("readlink('/proc/self/exe') failed: %s", strerror(errno));
223     }
224     result.path = std::string(path, path_len);
225   }
226 
227   result.phdr = reinterpret_cast<const ElfW(Phdr)*>(getauxval(AT_PHDR));
228   result.phdr_count = getauxval(AT_PHNUM);
229   result.entry_point = getauxval(AT_ENTRY);
230   return result;
231 }
232 
233 #if defined(__LP64__)
234 static char kLinkerPath[] = "/system/bin/linker64";
235 #else
236 static char kLinkerPath[] = "/system/bin/linker";
237 #endif
238 
239 __printflike(1, 2)
__linker_error(const char * fmt,...)240 static void __linker_error(const char* fmt, ...) {
241   va_list ap;
242 
243   va_start(ap, fmt);
244   async_safe_format_fd_va_list(STDERR_FILENO, fmt, ap);
245   va_end(ap);
246 
247   va_start(ap, fmt);
248   async_safe_format_log_va_list(ANDROID_LOG_FATAL, "linker", fmt, ap);
249   va_end(ap);
250 
251   _exit(EXIT_FAILURE);
252 }
253 
__linker_cannot_link(const char * argv0)254 static void __linker_cannot_link(const char* argv0) {
255   __linker_error("CANNOT LINK EXECUTABLE \"%s\": %s\n",
256                  argv0,
257                  linker_get_error_buffer());
258 }
259 
260 // Load an executable. Normally the kernel has already loaded the executable when the linker
261 // starts. The linker can be invoked directly on an executable, though, and then the linker must
262 // load it. This function doesn't load dependencies or resolve relocations.
load_executable(const char * orig_path)263 static ExecutableInfo load_executable(const char* orig_path) {
264   ExecutableInfo result = {};
265 
266   if (orig_path[0] != '/') {
267     __linker_error("error: expected absolute path: \"%s\"\n", orig_path);
268   }
269 
270   off64_t file_offset;
271   android::base::unique_fd fd(open_executable(orig_path, &file_offset, &result.path));
272   if (fd.get() == -1) {
273     __linker_error("error: unable to open file \"%s\"\n", orig_path);
274   }
275 
276   if (TEMP_FAILURE_RETRY(fstat(fd.get(), &result.file_stat)) == -1) {
277     __linker_error("error: unable to stat \"%s\": %s\n", result.path.c_str(), strerror(errno));
278   }
279 
280   ElfReader elf_reader;
281   if (!elf_reader.Read(result.path.c_str(), fd.get(), file_offset, result.file_stat.st_size)) {
282     __linker_error("error: %s\n", linker_get_error_buffer());
283   }
284   address_space_params address_space;
285   if (!elf_reader.Load(&address_space)) {
286     __linker_error("error: %s\n", linker_get_error_buffer());
287   }
288 
289   result.phdr = elf_reader.loaded_phdr();
290   result.phdr_count = elf_reader.phdr_count();
291   result.entry_point = elf_reader.entry_point();
292   return result;
293 }
294 
linker_main(KernelArgumentBlock & args,const char * exe_to_load)295 static ElfW(Addr) linker_main(KernelArgumentBlock& args, const char* exe_to_load) {
296   ProtectedDataGuard guard;
297 
298 #if TIMING
299   struct timeval t0, t1;
300   gettimeofday(&t0, 0);
301 #endif
302 
303   // Sanitize the environment.
304   __libc_init_AT_SECURE(args.envp);
305 
306   // Initialize system properties
307   __system_properties_init(); // may use 'environ'
308 
309   // Register the debuggerd signal handler.
310 #ifdef __ANDROID__
311   debuggerd_callbacks_t callbacks = {
312     .get_abort_message = []() {
313       return __libc_shared_globals()->abort_msg;
314     },
315     .post_dump = &notify_gdb_of_libraries,
316   };
317   debuggerd_init(&callbacks);
318 #endif
319 
320   g_linker_logger.ResetState();
321 
322   // Get a few environment variables.
323   const char* LD_DEBUG = getenv("LD_DEBUG");
324   if (LD_DEBUG != nullptr) {
325     g_ld_debug_verbosity = atoi(LD_DEBUG);
326   }
327 
328 #if defined(__LP64__)
329   INFO("[ Android dynamic linker (64-bit) ]");
330 #else
331   INFO("[ Android dynamic linker (32-bit) ]");
332 #endif
333 
334   // These should have been sanitized by __libc_init_AT_SECURE, but the test
335   // doesn't cost us anything.
336   const char* ldpath_env = nullptr;
337   const char* ldpreload_env = nullptr;
338   if (!getauxval(AT_SECURE)) {
339     ldpath_env = getenv("LD_LIBRARY_PATH");
340     if (ldpath_env != nullptr) {
341       INFO("[ LD_LIBRARY_PATH set to \"%s\" ]", ldpath_env);
342     }
343     ldpreload_env = getenv("LD_PRELOAD");
344     if (ldpreload_env != nullptr) {
345       INFO("[ LD_PRELOAD set to \"%s\" ]", ldpreload_env);
346     }
347   }
348 
349   const ExecutableInfo exe_info = exe_to_load ? load_executable(exe_to_load) :
350                                                 get_executable_info();
351 
352   // Assign to a static variable for the sake of the debug map, which needs
353   // a C-style string to last until the program exits.
354   static std::string exe_path = exe_info.path;
355 
356   INFO("[ Linking executable \"%s\" ]", exe_path.c_str());
357 
358   // Initialize the main exe's soinfo.
359   soinfo* si = soinfo_alloc(&g_default_namespace,
360                             exe_path.c_str(), &exe_info.file_stat,
361                             0, RTLD_GLOBAL);
362   somain = si;
363   si->phdr = exe_info.phdr;
364   si->phnum = exe_info.phdr_count;
365   get_elf_base_from_phdr(si->phdr, si->phnum, &si->base, &si->load_bias);
366   si->size = phdr_table_get_load_size(si->phdr, si->phnum);
367   si->dynamic = nullptr;
368   si->set_main_executable();
369   init_link_map_head(*si, exe_path.c_str());
370 
371   // Register the main executable and the linker upfront to have
372   // gdb aware of them before loading the rest of the dependency
373   // tree.
374   //
375   // gdb expects the linker to be in the debug shared object list.
376   // Without this, gdb has trouble locating the linker's ".text"
377   // and ".plt" sections. Gdb could also potentially use this to
378   // relocate the offset of our exported 'rtld_db_dlactivity' symbol.
379   //
380   insert_link_map_into_debug_map(&si->link_map_head);
381   insert_link_map_into_debug_map(&solinker->link_map_head);
382 
383   add_vdso();
384 
385   ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(si->base);
386 
387   // We haven't supported non-PIE since Lollipop for security reasons.
388   if (elf_hdr->e_type != ET_DYN) {
389     // We don't use async_safe_fatal here because we don't want a tombstone:
390     // even after several years we still find ourselves on app compatibility
391     // investigations because some app's trying to launch an executable that
392     // hasn't worked in at least three years, and we've "helpfully" dropped a
393     // tombstone for them. The tombstone never provided any detail relevant to
394     // fixing the problem anyway, and the utility of drawing extra attention
395     // to the problem is non-existent at this late date.
396     async_safe_format_fd(STDERR_FILENO,
397                          "\"%s\": error: Android 5.0 and later only support "
398                          "position-independent executables (-fPIE).\n",
399                          g_argv[0]);
400     exit(EXIT_FAILURE);
401   }
402 
403   // Use LD_LIBRARY_PATH and LD_PRELOAD (but only if we aren't setuid/setgid).
404   parse_LD_LIBRARY_PATH(ldpath_env);
405   parse_LD_PRELOAD(ldpreload_env);
406 
407   std::vector<android_namespace_t*> namespaces = init_default_namespaces(exe_path.c_str());
408 
409   if (!si->prelink_image()) __linker_cannot_link(g_argv[0]);
410 
411   // add somain to global group
412   si->set_dt_flags_1(si->get_dt_flags_1() | DF_1_GLOBAL);
413   // ... and add it to all other linked namespaces
414   for (auto linked_ns : namespaces) {
415     if (linked_ns != &g_default_namespace) {
416       linked_ns->add_soinfo(somain);
417       somain->add_secondary_namespace(linked_ns);
418     }
419   }
420 
421   linker_setup_exe_static_tls(g_argv[0]);
422 
423   // Load ld_preloads and dependencies.
424   std::vector<const char*> needed_library_name_list;
425   size_t ld_preloads_count = 0;
426 
427   for (const auto& ld_preload_name : g_ld_preload_names) {
428     needed_library_name_list.push_back(ld_preload_name.c_str());
429     ++ld_preloads_count;
430   }
431 
432   for_each_dt_needed(si, [&](const char* name) {
433     needed_library_name_list.push_back(name);
434   });
435 
436   const char** needed_library_names = &needed_library_name_list[0];
437   size_t needed_libraries_count = needed_library_name_list.size();
438 
439   if (needed_libraries_count > 0 &&
440       !find_libraries(&g_default_namespace,
441                       si,
442                       needed_library_names,
443                       needed_libraries_count,
444                       nullptr,
445                       &g_ld_preloads,
446                       ld_preloads_count,
447                       RTLD_GLOBAL,
448                       nullptr,
449                       true /* add_as_children */,
450                       true /* search_linked_namespaces */,
451                       &namespaces)) {
452     __linker_cannot_link(g_argv[0]);
453   } else if (needed_libraries_count == 0) {
454     if (!si->link_image(g_empty_list, soinfo_list_t::make_list(si), nullptr, nullptr)) {
455       __linker_cannot_link(g_argv[0]);
456     }
457     si->increment_ref_count();
458   }
459 
460   linker_finalize_static_tls();
461   __libc_init_main_thread_final();
462 
463   if (!get_cfi_shadow()->InitialLinkDone(solist)) __linker_cannot_link(g_argv[0]);
464 
465   si->call_pre_init_constructors();
466   si->call_constructors();
467 
468 #if TIMING
469   gettimeofday(&t1, nullptr);
470   PRINT("LINKER TIME: %s: %d microseconds", g_argv[0], (int) (
471            (((long long)t1.tv_sec * 1000000LL) + (long long)t1.tv_usec) -
472            (((long long)t0.tv_sec * 1000000LL) + (long long)t0.tv_usec)));
473 #endif
474 #if STATS
475   PRINT("RELO STATS: %s: %d abs, %d rel, %d copy, %d symbol", g_argv[0],
476          linker_stats.count[kRelocAbsolute],
477          linker_stats.count[kRelocRelative],
478          linker_stats.count[kRelocCopy],
479          linker_stats.count[kRelocSymbol]);
480 #endif
481 #if COUNT_PAGES
482   {
483     unsigned n;
484     unsigned i;
485     unsigned count = 0;
486     for (n = 0; n < 4096; n++) {
487       if (bitmask[n]) {
488         unsigned x = bitmask[n];
489 #if defined(__LP64__)
490         for (i = 0; i < 32; i++) {
491 #else
492         for (i = 0; i < 8; i++) {
493 #endif
494           if (x & 1) {
495             count++;
496           }
497           x >>= 1;
498         }
499       }
500     }
501     PRINT("PAGES MODIFIED: %s: %d (%dKB)", g_argv[0], count, count * 4);
502   }
503 #endif
504 
505 #if TIMING || STATS || COUNT_PAGES
506   fflush(stdout);
507 #endif
508 
509   // We are about to hand control over to the executable loaded.  We don't want
510   // to leave dirty pages behind unnecessarily.
511   purge_unused_memory();
512 
513   ElfW(Addr) entry = exe_info.entry_point;
514   TRACE("[ Ready to execute \"%s\" @ %p ]", si->get_realpath(), reinterpret_cast<void*>(entry));
515   return entry;
516 }
517 
518 /* Compute the load-bias of an existing executable. This shall only
519  * be used to compute the load bias of an executable or shared library
520  * that was loaded by the kernel itself.
521  *
522  * Input:
523  *    elf    -> address of ELF header, assumed to be at the start of the file.
524  * Return:
525  *    load bias, i.e. add the value of any p_vaddr in the file to get
526  *    the corresponding address in memory.
527  */
528 static ElfW(Addr) get_elf_exec_load_bias(const ElfW(Ehdr)* elf) {
529   ElfW(Addr) offset = elf->e_phoff;
530   const ElfW(Phdr)* phdr_table =
531       reinterpret_cast<const ElfW(Phdr)*>(reinterpret_cast<uintptr_t>(elf) + offset);
532   const ElfW(Phdr)* phdr_end = phdr_table + elf->e_phnum;
533 
534   for (const ElfW(Phdr)* phdr = phdr_table; phdr < phdr_end; phdr++) {
535     if (phdr->p_type == PT_LOAD) {
536       return reinterpret_cast<ElfW(Addr)>(elf) + phdr->p_offset - phdr->p_vaddr;
537     }
538   }
539   return 0;
540 }
541 
542 /* Find the load bias and base address of an executable or shared object loaded
543  * by the kernel. The ELF file's PHDR table must have a PT_PHDR entry.
544  *
545  * A VDSO doesn't have a PT_PHDR entry in its PHDR table.
546  */
547 static void get_elf_base_from_phdr(const ElfW(Phdr)* phdr_table, size_t phdr_count,
548                                    ElfW(Addr)* base, ElfW(Addr)* load_bias) {
549   for (size_t i = 0; i < phdr_count; ++i) {
550     if (phdr_table[i].p_type == PT_PHDR) {
551       *load_bias = reinterpret_cast<ElfW(Addr)>(phdr_table) - phdr_table[i].p_vaddr;
552       *base = reinterpret_cast<ElfW(Addr)>(phdr_table) - phdr_table[i].p_offset;
553       return;
554     }
555   }
556   async_safe_fatal("Could not find a PHDR: broken executable?");
557 }
558 
559 // Detect an attempt to run the linker on itself. e.g.:
560 //   /system/bin/linker64 /system/bin/linker64
561 // Use priority-1 to run this constructor before other constructors.
562 __attribute__((constructor(1))) static void detect_self_exec() {
563   // Normally, the linker initializes the auxv global before calling its
564   // constructors. If the linker loads itself, though, the first loader calls
565   // the second loader's constructors before calling __linker_init.
566   if (__libc_shared_globals()->auxv != nullptr) {
567     return;
568   }
569 #if defined(__i386__)
570   // We don't have access to the auxv struct from here, so use the int 0x80
571   // fallback.
572   __libc_sysinfo = reinterpret_cast<void*>(__libc_int0x80);
573 #endif
574   __linker_error("error: linker cannot load itself\n");
575 }
576 
577 static ElfW(Addr) __attribute__((noinline))
578 __linker_init_post_relocation(KernelArgumentBlock& args, soinfo& linker_so);
579 
580 /*
581  * This is the entry point for the linker, called from begin.S. This
582  * method is responsible for fixing the linker's own relocations, and
583  * then calling __linker_init_post_relocation().
584  *
585  * Because this method is called before the linker has fixed it's own
586  * relocations, any attempt to reference an extern variable, extern
587  * function, or other GOT reference will generate a segfault.
588  */
589 extern "C" ElfW(Addr) __linker_init(void* raw_args) {
590   // Initialize TLS early so system calls and errno work.
591   KernelArgumentBlock args(raw_args);
592   bionic_tcb temp_tcb = {};
593   __libc_init_main_thread_early(args, &temp_tcb);
594 
595   // When the linker is run by itself (rather than as an interpreter for
596   // another program), AT_BASE is 0.
597   ElfW(Addr) linker_addr = getauxval(AT_BASE);
598   if (linker_addr == 0) {
599     // The AT_PHDR and AT_PHNUM aux values describe this linker instance, so use
600     // the phdr to find the linker's base address.
601     ElfW(Addr) load_bias;
602     get_elf_base_from_phdr(
603       reinterpret_cast<ElfW(Phdr)*>(getauxval(AT_PHDR)), getauxval(AT_PHNUM),
604       &linker_addr, &load_bias);
605   }
606 
607   ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(linker_addr);
608   ElfW(Phdr)* phdr = reinterpret_cast<ElfW(Phdr)*>(linker_addr + elf_hdr->e_phoff);
609 
610   soinfo tmp_linker_so(nullptr, nullptr, nullptr, 0, 0);
611 
612   tmp_linker_so.base = linker_addr;
613   tmp_linker_so.size = phdr_table_get_load_size(phdr, elf_hdr->e_phnum);
614   tmp_linker_so.load_bias = get_elf_exec_load_bias(elf_hdr);
615   tmp_linker_so.dynamic = nullptr;
616   tmp_linker_so.phdr = phdr;
617   tmp_linker_so.phnum = elf_hdr->e_phnum;
618   tmp_linker_so.set_linker_flag();
619 
620   // Prelink the linker so we can access linker globals.
621   if (!tmp_linker_so.prelink_image()) __linker_cannot_link(args.argv[0]);
622 
623   // This might not be obvious... The reasons why we pass g_empty_list
624   // in place of local_group here are (1) we do not really need it, because
625   // linker is built with DT_SYMBOLIC and therefore relocates its symbols against
626   // itself without having to look into local_group and (2) allocators
627   // are not yet initialized, and therefore we cannot use linked_list.push_*
628   // functions at this point.
629   if (!tmp_linker_so.link_image(g_empty_list, g_empty_list, nullptr, nullptr)) __linker_cannot_link(args.argv[0]);
630 
631   return __linker_init_post_relocation(args, tmp_linker_so);
632 }
633 
634 /*
635  * This code is called after the linker has linked itself and fixed its own
636  * GOT. It is safe to make references to externs and other non-local data at
637  * this point. The compiler sometimes moves GOT references earlier in a
638  * function, so avoid inlining this function (http://b/80503879).
639  */
640 static ElfW(Addr) __attribute__((noinline))
641 __linker_init_post_relocation(KernelArgumentBlock& args, soinfo& tmp_linker_so) {
642   // Finish initializing the main thread.
643   __libc_init_main_thread_late();
644 
645   // We didn't protect the linker's RELRO pages in link_image because we
646   // couldn't make system calls on x86 at that point, but we can now...
647   if (!tmp_linker_so.protect_relro()) __linker_cannot_link(args.argv[0]);
648 
649   // Initialize the linker's static libc's globals
650   __libc_init_globals();
651 
652   // Initialize the linker's own global variables
653   tmp_linker_so.call_constructors();
654 
655   // When the linker is run directly rather than acting as PT_INTERP, parse
656   // arguments and determine the executable to load. When it's instead acting
657   // as PT_INTERP, AT_ENTRY will refer to the loaded executable rather than the
658   // linker's _start.
659   const char* exe_to_load = nullptr;
660   if (getauxval(AT_ENTRY) == reinterpret_cast<uintptr_t>(&_start)) {
661     if (args.argc <= 1 || !strcmp(args.argv[1], "--help")) {
662       async_safe_format_fd(STDOUT_FILENO,
663          "Usage: %s program [arguments...]\n"
664          "       %s path.zip!/program [arguments...]\n"
665          "\n"
666          "A helper program for linking dynamic executables. Typically, the kernel loads\n"
667          "this program because it's the PT_INTERP of a dynamic executable.\n"
668          "\n"
669          "This program can also be run directly to load and run a dynamic executable. The\n"
670          "executable can be inside a zip file if it's stored uncompressed and at a\n"
671          "page-aligned offset.\n",
672          args.argv[0], args.argv[0]);
673       exit(0);
674     }
675     exe_to_load = args.argv[1];
676     __libc_shared_globals()->initial_linker_arg_count = 1;
677   }
678 
679   // store argc/argv/envp to use them for calling constructors
680   g_argc = args.argc - __libc_shared_globals()->initial_linker_arg_count;
681   g_argv = args.argv + __libc_shared_globals()->initial_linker_arg_count;
682   g_envp = args.envp;
683   __libc_shared_globals()->init_progname = g_argv[0];
684 
685   // Initialize static variables. Note that in order to
686   // get correct libdl_info we need to call constructors
687   // before get_libdl_info().
688   sonext = solist = solinker = get_libdl_info(kLinkerPath, tmp_linker_so);
689   g_default_namespace.add_soinfo(solinker);
690   init_link_map_head(*solinker, kLinkerPath);
691 
692   ElfW(Addr) start_address = linker_main(args, exe_to_load);
693 
694   INFO("[ Jumping to _start (%p)... ]", reinterpret_cast<void*>(start_address));
695 
696   // Return the address that the calling assembly stub should jump to.
697   return start_address;
698 }
699