• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (C) 2016 The Android Open Source Project
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *  * Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  *  * Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in
12  *    the documentation and/or other materials provided with the
13  *    distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19  * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include "linker_main.h"
30 
31 #include <link.h>
32 #include <stdlib.h>
33 #include <sys/auxv.h>
34 #include <sys/prctl.h>
35 
36 #include "linker.h"
37 #include "linker_auxv.h"
38 #include "linker_cfi.h"
39 #include "linker_debug.h"
40 #include "linker_debuggerd.h"
41 #include "linker_gdb_support.h"
42 #include "linker_globals.h"
43 #include "linker_phdr.h"
44 #include "linker_relocate.h"
45 #include "linker_relocs.h"
46 #include "linker_tls.h"
47 #include "linker_utils.h"
48 
49 #include "private/KernelArgumentBlock.h"
50 #include "private/bionic_call_ifunc_resolver.h"
51 #include "private/bionic_globals.h"
52 #include "private/bionic_tls.h"
53 
54 #include "android-base/unique_fd.h"
55 #include "android-base/strings.h"
56 #include "android-base/stringprintf.h"
57 
58 #include <async_safe/log.h>
59 #include <bionic/libc_init_common.h>
60 #include <bionic/pthread_internal.h>
61 
62 #include <vector>
63 
64 __LIBC_HIDDEN__ extern "C" void _start();
65 
66 static ElfW(Addr) get_elf_exec_load_bias(const ElfW(Ehdr)* elf);
67 
68 static void get_elf_base_from_phdr(const ElfW(Phdr)* phdr_table, size_t phdr_count,
69                                    ElfW(Addr)* base, ElfW(Addr)* load_bias);
70 
71 static void set_bss_vma_name(soinfo* si);
72 
73 void __libc_init_mte(const memtag_dynamic_entries_t* memtag_dynamic_entries, const void* phdr_start,
74                      size_t phdr_count, uintptr_t load_bias, void* stack_top);
75 
76 // These should be preserved static to avoid emitting
77 // RELATIVE relocations for the part of the code running
78 // before linker links itself.
79 
80 // TODO (dimtiry): remove somain, rename solist to solist_head
81 static soinfo* solist;
82 static soinfo* sonext;
83 static soinfo* somain; // main process, always the one after libdl_info
84 static soinfo* solinker;
85 static soinfo* vdso; // vdso if present
86 
solist_add_soinfo(soinfo * si)87 void solist_add_soinfo(soinfo* si) {
88   sonext->next = si;
89   sonext = si;
90 }
91 
solist_remove_soinfo(soinfo * si)92 bool solist_remove_soinfo(soinfo* si) {
93   soinfo *prev = nullptr, *trav;
94   for (trav = solist; trav != nullptr; trav = trav->next) {
95     if (trav == si) {
96       break;
97     }
98     prev = trav;
99   }
100 
101   if (trav == nullptr) {
102     // si was not in solist
103     PRINT("name \"%s\"@%p is not in solist!", si->get_realpath(), si);
104     return false;
105   }
106 
107   // prev will never be null, because the first entry in solist is
108   // always the static libdl_info.
109   CHECK(prev != nullptr);
110   prev->next = si->next;
111   if (si == sonext) {
112     sonext = prev;
113   }
114 
115   return true;
116 }
117 
solist_get_head()118 soinfo* solist_get_head() {
119   return solist;
120 }
121 
solist_get_somain()122 soinfo* solist_get_somain() {
123   return somain;
124 }
125 
solist_get_vdso()126 soinfo* solist_get_vdso() {
127   return vdso;
128 }
129 
130 bool g_is_ldd;
131 int g_ld_debug_verbosity;
132 
133 static std::vector<std::string> g_ld_preload_names;
134 
135 static std::vector<soinfo*> g_ld_preloads;
136 
parse_path(const char * path,const char * delimiters,std::vector<std::string> * resolved_paths)137 static void parse_path(const char* path, const char* delimiters,
138                        std::vector<std::string>* resolved_paths) {
139   std::vector<std::string> paths;
140   split_path(path, delimiters, &paths);
141   resolve_paths(paths, resolved_paths);
142 }
143 
parse_LD_LIBRARY_PATH(const char * path)144 static void parse_LD_LIBRARY_PATH(const char* path) {
145   std::vector<std::string> ld_libary_paths;
146   parse_path(path, ":", &ld_libary_paths);
147   g_default_namespace.set_ld_library_paths(std::move(ld_libary_paths));
148 }
149 
parse_LD_PRELOAD(const char * path)150 static void parse_LD_PRELOAD(const char* path) {
151   g_ld_preload_names.clear();
152   if (path != nullptr) {
153     // We have historically supported ':' as well as ' ' in LD_PRELOAD.
154     g_ld_preload_names = android::base::Split(path, " :");
155     g_ld_preload_names.erase(std::remove_if(g_ld_preload_names.begin(), g_ld_preload_names.end(),
156                                             [](const std::string& s) { return s.empty(); }),
157                              g_ld_preload_names.end());
158   }
159 }
160 
161 // An empty list of soinfos
162 static soinfo_list_t g_empty_list;
163 
add_vdso()164 static void add_vdso() {
165   ElfW(Ehdr)* ehdr_vdso = reinterpret_cast<ElfW(Ehdr)*>(getauxval(AT_SYSINFO_EHDR));
166   if (ehdr_vdso == nullptr) {
167     return;
168   }
169 
170   soinfo* si = soinfo_alloc(&g_default_namespace, "[vdso]", nullptr, 0, 0);
171 
172   si->phdr = reinterpret_cast<ElfW(Phdr)*>(reinterpret_cast<char*>(ehdr_vdso) + ehdr_vdso->e_phoff);
173   si->phnum = ehdr_vdso->e_phnum;
174   si->base = reinterpret_cast<ElfW(Addr)>(ehdr_vdso);
175   si->size = phdr_table_get_load_size(si->phdr, si->phnum);
176   si->load_bias = get_elf_exec_load_bias(ehdr_vdso);
177 
178   si->prelink_image();
179   si->link_image(SymbolLookupList(si), si, nullptr, nullptr);
180   // prevents accidental unloads...
181   si->set_dt_flags_1(si->get_dt_flags_1() | DF_1_NODELETE);
182   si->set_linked();
183   si->call_constructors();
184 
185   vdso = si;
186 }
187 
188 // Initializes an soinfo's link_map_head field using other fields from the
189 // soinfo (phdr, phnum, load_bias). The soinfo's realpath must not change after
190 // this function is called.
init_link_map_head(soinfo & info)191 static void init_link_map_head(soinfo& info) {
192   auto& map = info.link_map_head;
193   map.l_addr = info.load_bias;
194   map.l_name = const_cast<char*>(info.get_realpath());
195   phdr_table_get_dynamic_section(info.phdr, info.phnum, info.load_bias, &map.l_ld, nullptr);
196 }
197 
198 extern "C" int __system_properties_init(void);
199 
200 struct ExecutableInfo {
201   std::string path;
202   struct stat file_stat;
203   const ElfW(Phdr)* phdr;
204   size_t phdr_count;
205   ElfW(Addr) entry_point;
206   bool should_pad_segments;
207 };
208 
get_executable_info(const char * arg_path)209 static ExecutableInfo get_executable_info(const char* arg_path) {
210   ExecutableInfo result = {};
211   char const* exe_path = "/proc/self/exe";
212 
213   // Stat "/proc/self/exe" instead of executable_path because
214   // the executable could be unlinked by this point and it should
215   // not cause a crash (see http://b/31084669)
216   if (TEMP_FAILURE_RETRY(stat(exe_path, &result.file_stat) == -1)) {
217     // Fallback to argv[0] for the case where /proc isn't available
218     if (TEMP_FAILURE_RETRY(stat(arg_path, &result.file_stat) == -1)) {
219       async_safe_fatal("unable to stat either \"/proc/self/exe\" or \"%s\": %s",
220           arg_path, strerror(errno));
221     }
222     exe_path = arg_path;
223   }
224 
225   // Path might be a symlink; we need the target so that we get the right
226   // linker configuration later.
227   char sym_path[PATH_MAX];
228   result.path = std::string(realpath(exe_path, sym_path) != nullptr ? sym_path : exe_path);
229 
230   result.phdr = reinterpret_cast<const ElfW(Phdr)*>(getauxval(AT_PHDR));
231   result.phdr_count = getauxval(AT_PHNUM);
232   result.entry_point = getauxval(AT_ENTRY);
233   return result;
234 }
235 
236 #if defined(__LP64__)
237 static char kFallbackLinkerPath[] = "/system/bin/linker64";
238 #else
239 static char kFallbackLinkerPath[] = "/system/bin/linker";
240 #endif
241 
242 __printflike(1, 2)
__linker_error(const char * fmt,...)243 static void __linker_error(const char* fmt, ...) {
244   va_list ap;
245 
246   va_start(ap, fmt);
247   async_safe_format_fd_va_list(STDERR_FILENO, fmt, ap);
248   va_end(ap);
249 
250   va_start(ap, fmt);
251   async_safe_format_log_va_list(ANDROID_LOG_FATAL, "linker", fmt, ap);
252   va_end(ap);
253 
254   _exit(EXIT_FAILURE);
255 }
256 
__linker_cannot_link(const char * argv0)257 static void __linker_cannot_link(const char* argv0) {
258   __linker_error("CANNOT LINK EXECUTABLE \"%s\": %s\n",
259                  argv0,
260                  linker_get_error_buffer());
261 }
262 
263 // Load an executable. Normally the kernel has already loaded the executable when the linker
264 // starts. The linker can be invoked directly on an executable, though, and then the linker must
265 // load it. This function doesn't load dependencies or resolve relocations.
load_executable(const char * orig_path)266 static ExecutableInfo load_executable(const char* orig_path) {
267   ExecutableInfo result = {};
268 
269   if (orig_path[0] != '/') {
270     __linker_error("error: expected absolute path: \"%s\"\n", orig_path);
271   }
272 
273   off64_t file_offset;
274   android::base::unique_fd fd(open_executable(orig_path, &file_offset, &result.path));
275   if (fd.get() == -1) {
276     __linker_error("error: unable to open file \"%s\"\n", orig_path);
277   }
278 
279   if (TEMP_FAILURE_RETRY(fstat(fd.get(), &result.file_stat)) == -1) {
280     __linker_error("error: unable to stat \"%s\": %s\n", result.path.c_str(), strerror(errno));
281   }
282 
283   ElfReader elf_reader;
284   if (!elf_reader.Read(result.path.c_str(), fd.get(), file_offset, result.file_stat.st_size)) {
285     __linker_error("error: %s\n", linker_get_error_buffer());
286   }
287   address_space_params address_space;
288   if (!elf_reader.Load(&address_space)) {
289     __linker_error("error: %s\n", linker_get_error_buffer());
290   }
291 
292   result.phdr = elf_reader.loaded_phdr();
293   result.phdr_count = elf_reader.phdr_count();
294   result.entry_point = elf_reader.entry_point();
295   result.should_pad_segments = elf_reader.should_pad_segments();
296   return result;
297 }
298 
platform_properties_init()299 static void platform_properties_init() {
300 #if defined(__aarch64__)
301   const unsigned long hwcap2 = getauxval(AT_HWCAP2);
302   g_platform_properties.bti_supported = (hwcap2 & HWCAP2_BTI) != 0;
303 #endif
304 }
305 
linker_main(KernelArgumentBlock & args,const char * exe_to_load)306 static ElfW(Addr) linker_main(KernelArgumentBlock& args, const char* exe_to_load) {
307   ProtectedDataGuard guard;
308 
309 #if TIMING
310   struct timeval t0, t1;
311   gettimeofday(&t0, 0);
312 #endif
313 
314   // Sanitize the environment.
315   __libc_init_AT_SECURE(args.envp);
316 
317   // Initialize system properties
318   __system_properties_init(); // may use 'environ'
319 
320   // Initialize platform properties.
321   platform_properties_init();
322 
323   // Register the debuggerd signal handler.
324   linker_debuggerd_init();
325 
326   g_linker_logger.ResetState();
327 
328   // Enable debugging logs?
329   const char* LD_DEBUG = getenv("LD_DEBUG");
330   if (LD_DEBUG != nullptr) {
331     g_ld_debug_verbosity = atoi(LD_DEBUG);
332   }
333 
334   if (getenv("LD_SHOW_AUXV") != nullptr) ld_show_auxv(args.auxv);
335 
336 #if defined(__LP64__)
337   INFO("[ Android dynamic linker (64-bit) ]");
338 #else
339   INFO("[ Android dynamic linker (32-bit) ]");
340 #endif
341 
342   // These should have been sanitized by __libc_init_AT_SECURE, but the test
343   // doesn't cost us anything.
344   const char* ldpath_env = nullptr;
345   const char* ldpreload_env = nullptr;
346   if (!getauxval(AT_SECURE)) {
347     ldpath_env = getenv("LD_LIBRARY_PATH");
348     if (ldpath_env != nullptr) {
349       INFO("[ LD_LIBRARY_PATH set to \"%s\" ]", ldpath_env);
350     }
351     ldpreload_env = getenv("LD_PRELOAD");
352     if (ldpreload_env != nullptr) {
353       INFO("[ LD_PRELOAD set to \"%s\" ]", ldpreload_env);
354     }
355   }
356 
357   const ExecutableInfo exe_info = exe_to_load ? load_executable(exe_to_load) :
358                                                 get_executable_info(args.argv[0]);
359 
360   INFO("[ Linking executable \"%s\" ]", exe_info.path.c_str());
361 
362   // Initialize the main exe's soinfo.
363   soinfo* si = soinfo_alloc(&g_default_namespace,
364                             exe_info.path.c_str(), &exe_info.file_stat,
365                             0, RTLD_GLOBAL);
366   somain = si;
367   si->phdr = exe_info.phdr;
368   si->phnum = exe_info.phdr_count;
369   si->set_should_pad_segments(exe_info.should_pad_segments);
370   get_elf_base_from_phdr(si->phdr, si->phnum, &si->base, &si->load_bias);
371   si->size = phdr_table_get_load_size(si->phdr, si->phnum);
372   si->dynamic = nullptr;
373   si->set_main_executable();
374   init_link_map_head(*si);
375 
376   set_bss_vma_name(si);
377 
378   // Use the executable's PT_INTERP string as the solinker filename in the
379   // dynamic linker's module list. gdb reads both PT_INTERP and the module list,
380   // and if the paths for the linker are different, gdb will report that the
381   // PT_INTERP linker path was unloaded once the module list is initialized.
382   // There are three situations to handle:
383   //  - the APEX linker (/system/bin/linker[64] -> /apex/.../linker[64])
384   //  - the ASAN linker (/system/bin/linker_asan[64] -> /apex/.../linker[64])
385   //  - the bootstrap linker (/system/bin/bootstrap/linker[64])
386   const char *interp = phdr_table_get_interpreter_name(somain->phdr, somain->phnum,
387                                                        somain->load_bias);
388   if (interp == nullptr) {
389     // This case can happen if the linker attempts to execute itself
390     // (e.g. "linker64 /system/bin/linker64").
391     interp = kFallbackLinkerPath;
392   }
393   solinker->set_realpath(interp);
394   init_link_map_head(*solinker);
395 
396 #if defined(__aarch64__)
397   if (exe_to_load == nullptr) {
398     // Kernel does not add PROT_BTI to executable pages of the loaded ELF.
399     // Apply appropriate protections here if it is needed.
400     auto note_gnu_property = GnuPropertySection(somain);
401     if (note_gnu_property.IsBTICompatible() &&
402         (phdr_table_protect_segments(somain->phdr, somain->phnum, somain->load_bias,
403                                      somain->should_pad_segments(), &note_gnu_property) < 0)) {
404       __linker_error("error: can't protect segments for \"%s\": %s", exe_info.path.c_str(),
405                      strerror(errno));
406     }
407   }
408 #endif
409 
410   // Register the main executable and the linker upfront to have
411   // gdb aware of them before loading the rest of the dependency
412   // tree.
413   //
414   // gdb expects the linker to be in the debug shared object list.
415   // Without this, gdb has trouble locating the linker's ".text"
416   // and ".plt" sections. Gdb could also potentially use this to
417   // relocate the offset of our exported 'rtld_db_dlactivity' symbol.
418   //
419   insert_link_map_into_debug_map(&si->link_map_head);
420   insert_link_map_into_debug_map(&solinker->link_map_head);
421 
422   add_vdso();
423 
424   ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(si->base);
425 
426   // For security reasons we dropped non-PIE support in API level 21,
427   // and the NDK no longer supports earlier API levels.
428   if (elf_hdr->e_type != ET_DYN) {
429     __linker_error("error: %s: Android only supports position-independent "
430                    "executables (-fPIE)\n", exe_info.path.c_str());
431   }
432 
433   // Use LD_LIBRARY_PATH and LD_PRELOAD (but only if we aren't setuid/setgid).
434   parse_LD_LIBRARY_PATH(ldpath_env);
435   parse_LD_PRELOAD(ldpreload_env);
436 
437   std::vector<android_namespace_t*> namespaces = init_default_namespaces(exe_info.path.c_str());
438 
439   if (!si->prelink_image()) __linker_cannot_link(g_argv[0]);
440 
441   // add somain to global group
442   si->set_dt_flags_1(si->get_dt_flags_1() | DF_1_GLOBAL);
443   // ... and add it to all other linked namespaces
444   for (auto linked_ns : namespaces) {
445     if (linked_ns != &g_default_namespace) {
446       linked_ns->add_soinfo(somain);
447       somain->add_secondary_namespace(linked_ns);
448     }
449   }
450 
451   linker_setup_exe_static_tls(g_argv[0]);
452 
453   // Load ld_preloads and dependencies.
454   std::vector<const char*> needed_library_name_list;
455   size_t ld_preloads_count = 0;
456 
457   for (const auto& ld_preload_name : g_ld_preload_names) {
458     needed_library_name_list.push_back(ld_preload_name.c_str());
459     ++ld_preloads_count;
460   }
461 
462   for_each_dt_needed(si, [&](const char* name) {
463     needed_library_name_list.push_back(name);
464   });
465 
466   const char** needed_library_names = &needed_library_name_list[0];
467   size_t needed_libraries_count = needed_library_name_list.size();
468 
469   if (needed_libraries_count > 0 &&
470       !find_libraries(&g_default_namespace,
471                       si,
472                       needed_library_names,
473                       needed_libraries_count,
474                       nullptr,
475                       &g_ld_preloads,
476                       ld_preloads_count,
477                       RTLD_GLOBAL,
478                       nullptr,
479                       true /* add_as_children */,
480                       &namespaces)) {
481     __linker_cannot_link(g_argv[0]);
482   } else if (needed_libraries_count == 0) {
483     if (!si->link_image(SymbolLookupList(si), si, nullptr, nullptr)) {
484       __linker_cannot_link(g_argv[0]);
485     }
486     si->increment_ref_count();
487   }
488 
489   // Exit early for ldd. We don't want to run the code that was loaded, so skip
490   // the constructor calls. Skip CFI setup because it would call __cfi_init in
491   // libdl.so.
492   if (g_is_ldd) _exit(EXIT_SUCCESS);
493 
494 #if defined(__aarch64__)
495   // This has to happen after the find_libraries, which will have collected any possible
496   // libraries that request memtag_stack in the dynamic section.
497   __libc_init_mte(somain->memtag_dynamic_entries(), somain->phdr, somain->phnum, somain->load_bias,
498                   args.argv);
499 #endif
500 
501   linker_finalize_static_tls();
502   __libc_init_main_thread_final();
503 
504   if (!get_cfi_shadow()->InitialLinkDone(solist)) __linker_cannot_link(g_argv[0]);
505 
506   si->call_pre_init_constructors();
507   si->call_constructors();
508 
509 #if TIMING
510   gettimeofday(&t1, nullptr);
511   PRINT("LINKER TIME: %s: %d microseconds", g_argv[0],
512         static_cast<int>(((static_cast<long long>(t1.tv_sec) * 1000000LL) +
513                           static_cast<long long>(t1.tv_usec)) -
514                          ((static_cast<long long>(t0.tv_sec) * 1000000LL) +
515                           static_cast<long long>(t0.tv_usec))));
516 #endif
517 #if STATS
518   print_linker_stats();
519 #endif
520 #if TIMING || STATS
521   fflush(stdout);
522 #endif
523 
524   // We are about to hand control over to the executable loaded.  We don't want
525   // to leave dirty pages behind unnecessarily.
526   purge_unused_memory();
527 
528   ElfW(Addr) entry = exe_info.entry_point;
529   TRACE("[ Ready to execute \"%s\" @ %p ]", si->get_realpath(), reinterpret_cast<void*>(entry));
530   return entry;
531 }
532 
533 /* Compute the load-bias of an existing executable. This shall only
534  * be used to compute the load bias of an executable or shared library
535  * that was loaded by the kernel itself.
536  *
537  * Input:
538  *    elf    -> address of ELF header, assumed to be at the start of the file.
539  * Return:
540  *    load bias, i.e. add the value of any p_vaddr in the file to get
541  *    the corresponding address in memory.
542  */
get_elf_exec_load_bias(const ElfW (Ehdr)* elf)543 static ElfW(Addr) get_elf_exec_load_bias(const ElfW(Ehdr)* elf) {
544   ElfW(Addr) offset = elf->e_phoff;
545   const ElfW(Phdr)* phdr_table =
546       reinterpret_cast<const ElfW(Phdr)*>(reinterpret_cast<uintptr_t>(elf) + offset);
547   const ElfW(Phdr)* phdr_end = phdr_table + elf->e_phnum;
548 
549   for (const ElfW(Phdr)* phdr = phdr_table; phdr < phdr_end; phdr++) {
550     if (phdr->p_type == PT_LOAD) {
551       return reinterpret_cast<ElfW(Addr)>(elf) + phdr->p_offset - phdr->p_vaddr;
552     }
553   }
554   return 0;
555 }
556 
557 /* Find the load bias and base address of an executable or shared object loaded
558  * by the kernel. The ELF file's PHDR table must have a PT_PHDR entry.
559  *
560  * A VDSO doesn't have a PT_PHDR entry in its PHDR table.
561  */
get_elf_base_from_phdr(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)* base,ElfW (Addr)* load_bias)562 static void get_elf_base_from_phdr(const ElfW(Phdr)* phdr_table, size_t phdr_count,
563                                    ElfW(Addr)* base, ElfW(Addr)* load_bias) {
564   for (size_t i = 0; i < phdr_count; ++i) {
565     if (phdr_table[i].p_type == PT_PHDR) {
566       *load_bias = reinterpret_cast<ElfW(Addr)>(phdr_table) - phdr_table[i].p_vaddr;
567       *base = reinterpret_cast<ElfW(Addr)>(phdr_table) - phdr_table[i].p_offset;
568       return;
569     }
570   }
571   async_safe_fatal("Could not find a PHDR: broken executable?");
572 }
573 
574 /*
575  * Set anonymous VMA name for .bss section.  For DSOs loaded by the linker, this
576  * is done by ElfReader.  This function is here for DSOs loaded by the kernel,
577  * namely the linker itself and the main executable.
578  */
set_bss_vma_name(soinfo * si)579 static void set_bss_vma_name(soinfo* si) {
580   for (size_t i = 0; i < si->phnum; ++i) {
581     auto phdr = &si->phdr[i];
582 
583     if (phdr->p_type != PT_LOAD) {
584       continue;
585     }
586 
587     ElfW(Addr) seg_start = phdr->p_vaddr + si->load_bias;
588     ElfW(Addr) seg_page_end = page_end(seg_start + phdr->p_memsz);
589     ElfW(Addr) seg_file_end = page_end(seg_start + phdr->p_filesz);
590 
591     if (seg_page_end > seg_file_end) {
592       prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME,
593             reinterpret_cast<void*>(seg_file_end), seg_page_end - seg_file_end,
594             ".bss");
595     }
596   }
597 }
598 
599 #if defined(USE_RELA)
600 using RelType = ElfW(Rela);
601 const unsigned kRelTag = DT_RELA;
602 const unsigned kRelSzTag = DT_RELASZ;
603 #else
604 using RelType = ElfW(Rel);
605 const unsigned kRelTag = DT_REL;
606 const unsigned kRelSzTag = DT_RELSZ;
607 #endif
608 
609 extern __LIBC_HIDDEN__ ElfW(Ehdr) __ehdr_start;
610 
call_ifunc_resolvers_for_section(RelType * begin,RelType * end)611 static void call_ifunc_resolvers_for_section(RelType* begin, RelType* end) {
612   auto ehdr = reinterpret_cast<ElfW(Addr)>(&__ehdr_start);
613   for (RelType *r = begin; r != end; ++r) {
614     if (ELFW(R_TYPE)(r->r_info) != R_GENERIC_IRELATIVE) {
615       continue;
616     }
617     ElfW(Addr)* offset = reinterpret_cast<ElfW(Addr)*>(ehdr + r->r_offset);
618 #if defined(USE_RELA)
619     ElfW(Addr) resolver = ehdr + r->r_addend;
620 #else
621     ElfW(Addr) resolver = ehdr + *offset;
622 #endif
623     *offset = __bionic_call_ifunc_resolver(resolver);
624   }
625 }
626 
relocate_linker()627 static void relocate_linker() {
628   // The linker should only have relative relocations (in RELR) and IRELATIVE
629   // relocations. Find the IRELATIVE relocations using the DT_JMPREL and
630   // DT_PLTRELSZ, or DT_RELA/DT_RELASZ (DT_REL/DT_RELSZ on ILP32).
631   auto ehdr = reinterpret_cast<ElfW(Addr)>(&__ehdr_start);
632   auto* phdr = reinterpret_cast<ElfW(Phdr)*>(ehdr + __ehdr_start.e_phoff);
633   for (size_t i = 0; i != __ehdr_start.e_phnum; ++i) {
634     if (phdr[i].p_type != PT_DYNAMIC) {
635       continue;
636     }
637     auto *dyn = reinterpret_cast<ElfW(Dyn)*>(ehdr + phdr[i].p_vaddr);
638     ElfW(Addr) relr = 0, relrsz = 0, pltrel = 0, pltrelsz = 0, rel = 0, relsz = 0;
639     for (size_t j = 0, size = phdr[i].p_filesz / sizeof(ElfW(Dyn)); j != size; ++j) {
640       const auto tag = dyn[j].d_tag;
641       const auto val = dyn[j].d_un.d_ptr;
642       // We don't currently handle IRELATIVE relocations in DT_ANDROID_REL[A].
643       // We disabled DT_ANDROID_REL[A] at build time; verify that it was actually disabled.
644       CHECK(tag != DT_ANDROID_REL && tag != DT_ANDROID_RELA);
645       if (tag == DT_RELR || tag == DT_ANDROID_RELR) {
646         relr = val;
647       } else if (tag == DT_RELRSZ || tag == DT_ANDROID_RELRSZ) {
648         relrsz = val;
649       } else if (tag == DT_JMPREL) {
650         pltrel = val;
651       } else if (tag == DT_PLTRELSZ) {
652         pltrelsz = val;
653       } else if (tag == kRelTag) {
654         rel = val;
655       } else if (tag == kRelSzTag) {
656         relsz = val;
657       }
658     }
659     // Apply RELR relocations first so that the GOT is initialized for ifunc
660     // resolvers.
661     if (relr && relrsz) {
662       relocate_relr(reinterpret_cast<ElfW(Relr*)>(ehdr + relr),
663                     reinterpret_cast<ElfW(Relr*)>(ehdr + relr + relrsz), ehdr);
664     }
665     if (pltrel && pltrelsz) {
666       call_ifunc_resolvers_for_section(reinterpret_cast<RelType*>(ehdr + pltrel),
667                                        reinterpret_cast<RelType*>(ehdr + pltrel + pltrelsz));
668     }
669     if (rel && relsz) {
670       call_ifunc_resolvers_for_section(reinterpret_cast<RelType*>(ehdr + rel),
671                                        reinterpret_cast<RelType*>(ehdr + rel + relsz));
672     }
673   }
674 }
675 
676 // Usable before ifunc resolvers have been called. This function is compiled with -ffreestanding.
linker_memclr(void * dst,size_t cnt)677 static void linker_memclr(void* dst, size_t cnt) {
678   for (size_t i = 0; i < cnt; ++i) {
679     reinterpret_cast<char*>(dst)[i] = '\0';
680   }
681 }
682 
683 // Detect an attempt to run the linker on itself. e.g.:
684 //   /system/bin/linker64 /system/bin/linker64
685 // Use priority-1 to run this constructor before other constructors.
detect_self_exec()686 __attribute__((constructor(1))) static void detect_self_exec() {
687   // Normally, the linker initializes the auxv global before calling its
688   // constructors. If the linker loads itself, though, the first loader calls
689   // the second loader's constructors before calling __linker_init.
690   if (__libc_shared_globals()->auxv != nullptr) {
691     return;
692   }
693 #if defined(__i386__)
694   // We don't have access to the auxv struct from here, so use the int 0x80
695   // fallback.
696   __libc_sysinfo = reinterpret_cast<void*>(__libc_int0x80);
697 #endif
698   __linker_error("error: linker cannot load itself\n");
699 }
700 
701 static ElfW(Addr) __attribute__((noinline))
702 __linker_init_post_relocation(KernelArgumentBlock& args, soinfo& linker_so);
703 
704 /*
705  * This is the entry point for the linker, called from begin.S. This
706  * method is responsible for fixing the linker's own relocations, and
707  * then calling __linker_init_post_relocation().
708  *
709  * Because this method is called before the linker has fixed it's own
710  * relocations, any attempt to reference an extern variable, extern
711  * function, or other GOT reference will generate a segfault.
712  */
__linker_init(void * raw_args)713 extern "C" ElfW(Addr) __linker_init(void* raw_args) {
714   // Unlock the loader mutex immediately before transferring to the executable's
715   // entry point. This must happen after destructors are called in this function
716   // (e.g. ~soinfo), so declare this variable very early.
717   struct DlMutexUnlocker {
718     ~DlMutexUnlocker() { pthread_mutex_unlock(&g_dl_mutex); }
719   } unlocker;
720 
721   // Initialize TLS early so system calls and errno work.
722   KernelArgumentBlock args(raw_args);
723   bionic_tcb temp_tcb __attribute__((uninitialized));
724   linker_memclr(&temp_tcb, sizeof(temp_tcb));
725   __libc_init_main_thread_early(args, &temp_tcb);
726 
727   // When the linker is run by itself (rather than as an interpreter for
728   // another program), AT_BASE is 0.
729   ElfW(Addr) linker_addr = getauxval(AT_BASE);
730   if (linker_addr == 0) {
731     // The AT_PHDR and AT_PHNUM aux values describe this linker instance, so use
732     // the phdr to find the linker's base address.
733     ElfW(Addr) load_bias;
734     get_elf_base_from_phdr(
735       reinterpret_cast<ElfW(Phdr)*>(getauxval(AT_PHDR)), getauxval(AT_PHNUM),
736       &linker_addr, &load_bias);
737   }
738 
739   ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(linker_addr);
740   ElfW(Phdr)* phdr = reinterpret_cast<ElfW(Phdr)*>(linker_addr + elf_hdr->e_phoff);
741 
742   // Relocate the linker. This step will initialize the GOT, which is needed for
743   // accessing non-hidden global variables. (On some targets, the stack
744   // protector uses GOT accesses rather than TLS.) Relocating the linker will
745   // also call the linker's ifunc resolvers so that string.h functions can be
746   // used.
747   relocate_linker();
748 
749   soinfo tmp_linker_so(nullptr, nullptr, nullptr, 0, 0);
750 
751   tmp_linker_so.base = linker_addr;
752   tmp_linker_so.size = phdr_table_get_load_size(phdr, elf_hdr->e_phnum);
753   tmp_linker_so.load_bias = get_elf_exec_load_bias(elf_hdr);
754   tmp_linker_so.dynamic = nullptr;
755   tmp_linker_so.phdr = phdr;
756   tmp_linker_so.phnum = elf_hdr->e_phnum;
757   tmp_linker_so.set_linker_flag();
758 
759   if (!tmp_linker_so.prelink_image()) __linker_cannot_link(args.argv[0]);
760   if (!tmp_linker_so.link_image(SymbolLookupList(&tmp_linker_so), &tmp_linker_so, nullptr, nullptr)) __linker_cannot_link(args.argv[0]);
761 
762   return __linker_init_post_relocation(args, tmp_linker_so);
763 }
764 
765 /*
766  * This code is called after the linker has linked itself and fixed its own
767  * GOT. It is safe to make references to externs and other non-local data at
768  * this point. The compiler sometimes moves GOT references earlier in a
769  * function, so avoid inlining this function (http://b/80503879).
770  */
771 static ElfW(Addr) __attribute__((noinline))
__linker_init_post_relocation(KernelArgumentBlock & args,soinfo & tmp_linker_so)772 __linker_init_post_relocation(KernelArgumentBlock& args, soinfo& tmp_linker_so) {
773   // Finish initializing the main thread.
774   __libc_init_main_thread_late();
775 
776   // We didn't protect the linker's RELRO pages in link_image because we
777   // couldn't make system calls on x86 at that point, but we can now...
778   if (!tmp_linker_so.protect_relro()) __linker_cannot_link(args.argv[0]);
779 
780   // And we can set VMA name for the bss section now
781   set_bss_vma_name(&tmp_linker_so);
782 
783   // Initialize the linker's static libc's globals
784   __libc_init_globals();
785 
786   // A constructor could spawn a thread that calls into the loader, so as soon
787   // as we've called a constructor, we need to hold the lock until transferring
788   // to the entry point.
789   pthread_mutex_lock(&g_dl_mutex);
790 
791   // Initialize the linker's own global variables
792   tmp_linker_so.call_constructors();
793 
794   // Setting the linker soinfo's soname can allocate heap memory, so delay it until here.
795   for (const ElfW(Dyn)* d = tmp_linker_so.dynamic; d->d_tag != DT_NULL; ++d) {
796     if (d->d_tag == DT_SONAME) {
797       tmp_linker_so.set_soname(tmp_linker_so.get_string(d->d_un.d_val));
798     }
799   }
800 
801   // When the linker is run directly rather than acting as PT_INTERP, parse
802   // arguments and determine the executable to load. When it's instead acting
803   // as PT_INTERP, AT_ENTRY will refer to the loaded executable rather than the
804   // linker's _start.
805   const char* exe_to_load = nullptr;
806   if (getauxval(AT_ENTRY) == reinterpret_cast<uintptr_t>(&_start)) {
807     if (args.argc == 3 && !strcmp(args.argv[1], "--list")) {
808       // We're being asked to behave like ldd(1).
809       g_is_ldd = true;
810       exe_to_load = args.argv[2];
811     } else if (args.argc <= 1 || !strcmp(args.argv[1], "--help")) {
812       async_safe_format_fd(STDOUT_FILENO,
813          "Usage: %s [--list] PROGRAM [ARGS-FOR-PROGRAM...]\n"
814          "       %s [--list] path.zip!/PROGRAM [ARGS-FOR-PROGRAM...]\n"
815          "\n"
816          "A helper program for linking dynamic executables. Typically, the kernel loads\n"
817          "this program because it's the PT_INTERP of a dynamic executable.\n"
818          "\n"
819          "This program can also be run directly to load and run a dynamic executable. The\n"
820          "executable can be inside a zip file if it's stored uncompressed and at a\n"
821          "page-aligned offset.\n"
822          "\n"
823          "The --list option gives behavior equivalent to ldd(1) on other systems.\n",
824          args.argv[0], args.argv[0]);
825       _exit(EXIT_SUCCESS);
826     } else {
827       exe_to_load = args.argv[1];
828       __libc_shared_globals()->initial_linker_arg_count = 1;
829     }
830   }
831 
832   // store argc/argv/envp to use them for calling constructors
833   g_argc = args.argc - __libc_shared_globals()->initial_linker_arg_count;
834   g_argv = args.argv + __libc_shared_globals()->initial_linker_arg_count;
835   g_envp = args.envp;
836   __libc_shared_globals()->init_progname = g_argv[0];
837 
838   // Initialize static variables. Note that in order to
839   // get correct libdl_info we need to call constructors
840   // before get_libdl_info().
841   sonext = solist = solinker = get_libdl_info(tmp_linker_so);
842   g_default_namespace.add_soinfo(solinker);
843 
844   ElfW(Addr) start_address = linker_main(args, exe_to_load);
845 
846   INFO("[ Jumping to _start (%p)... ]", reinterpret_cast<void*>(start_address));
847 
848   // Return the address that the calling assembly stub should jump to.
849   return start_address;
850 }
851