• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (C) 2008, 2009 The Android Open Source Project
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *  * Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  *  * Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in
12  *    the documentation and/or other materials provided with the
13  *    distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19  * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <dlfcn.h>
30 #include <errno.h>
31 #include <fcntl.h>
32 #include <linux/auxvec.h>
33 #include <pthread.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <string.h>
37 #include <sys/atomics.h>
38 #include <sys/mman.h>
39 #include <sys/stat.h>
40 #include <unistd.h>
41 
42 // Private C library headers.
43 #include <private/bionic_tls.h>
44 #include <private/KernelArgumentBlock.h>
45 #include <private/ScopedPthreadMutexLocker.h>
46 
47 #include "linker.h"
48 #include "linker_debug.h"
49 #include "linker_environ.h"
50 #include "linker_phdr.h"
51 
52 /* Assume average path length of 64 and max 8 paths */
53 #define LDPATH_BUFSIZE 512
54 #define LDPATH_MAX 8
55 
56 #define LDPRELOAD_BUFSIZE 512
57 #define LDPRELOAD_MAX 8
58 
59 /* >>> IMPORTANT NOTE - READ ME BEFORE MODIFYING <<<
60  *
61  * Do NOT use malloc() and friends or pthread_*() code here.
62  * Don't use printf() either; it's caused mysterious memory
63  * corruption in the past.
64  * The linker runs before we bring up libc and it's easiest
65  * to make sure it does not depend on any complex libc features
66  *
67  * open issues / todo:
68  *
69  * - are we doing everything we should for ARM_COPY relocations?
70  * - cleaner error reporting
71  * - after linking, set as much stuff as possible to READONLY
72  *   and NOEXEC
73  */
74 
75 static bool soinfo_link_image(soinfo* si);
76 
77 // We can't use malloc(3) in the dynamic linker. We use a linked list of anonymous
78 // maps, each a single page in size. The pages are broken up into as many struct soinfo
79 // objects as will fit, and they're all threaded together on a free list.
80 #define SOINFO_PER_POOL ((PAGE_SIZE - sizeof(soinfo_pool_t*)) / sizeof(soinfo))
81 struct soinfo_pool_t {
82   soinfo_pool_t* next;
83   soinfo info[SOINFO_PER_POOL];
84 };
85 static struct soinfo_pool_t* gSoInfoPools = NULL;
86 static soinfo* gSoInfoFreeList = NULL;
87 
88 static soinfo* solist = &libdl_info;
89 static soinfo* sonext = &libdl_info;
90 static soinfo* somain; /* main process, always the one after libdl_info */
91 
92 static const char* const gSoPaths[] = {
93   "/vendor/lib",
94   "/system/lib",
95   NULL
96 };
97 
98 static char gLdPathsBuffer[LDPATH_BUFSIZE];
99 static const char* gLdPaths[LDPATH_MAX + 1];
100 
101 static char gLdPreloadsBuffer[LDPRELOAD_BUFSIZE];
102 static const char* gLdPreloadNames[LDPRELOAD_MAX + 1];
103 
104 static soinfo* gLdPreloads[LDPRELOAD_MAX + 1];
105 
106 __LIBC_HIDDEN__ int gLdDebugVerbosity;
107 
108 __LIBC_HIDDEN__ abort_msg_t* gAbortMessage = NULL; // For debuggerd.
109 
110 enum RelocationKind {
111     kRelocAbsolute = 0,
112     kRelocRelative,
113     kRelocCopy,
114     kRelocSymbol,
115     kRelocMax
116 };
117 
118 #if STATS
119 struct linker_stats_t {
120     int count[kRelocMax];
121 };
122 
123 static linker_stats_t linker_stats;
124 
count_relocation(RelocationKind kind)125 static void count_relocation(RelocationKind kind) {
126     ++linker_stats.count[kind];
127 }
128 #else
count_relocation(RelocationKind)129 static void count_relocation(RelocationKind) {
130 }
131 #endif
132 
133 #if COUNT_PAGES
134 static unsigned bitmask[4096];
135 #define MARK(offset) \
136     do { \
137         bitmask[((offset) >> 12) >> 3] |= (1 << (((offset) >> 12) & 7)); \
138     } while(0)
139 #else
140 #define MARK(x) do {} while (0)
141 #endif
142 
143 // You shouldn't try to call memory-allocating functions in the dynamic linker.
144 // Guard against the most obvious ones.
145 #define DISALLOW_ALLOCATION(return_type, name, ...) \
146     return_type name __VA_ARGS__ \
147     { \
148         const char* msg = "ERROR: " #name " called from the dynamic linker!\n"; \
149         __libc_format_log(ANDROID_LOG_FATAL, "linker", "%s", msg); \
150         write(2, msg, strlen(msg)); \
151         abort(); \
152     }
153 #define UNUSED __attribute__((unused))
154 DISALLOW_ALLOCATION(void*, malloc, (size_t u UNUSED));
155 DISALLOW_ALLOCATION(void, free, (void* u UNUSED));
156 DISALLOW_ALLOCATION(void*, realloc, (void* u1 UNUSED, size_t u2 UNUSED));
157 DISALLOW_ALLOCATION(void*, calloc, (size_t u1 UNUSED, size_t u2 UNUSED));
158 
159 static char tmp_err_buf[768];
160 static char __linker_dl_err_buf[768];
161 
linker_get_error_buffer()162 char* linker_get_error_buffer() {
163   return &__linker_dl_err_buf[0];
164 }
165 
linker_get_error_buffer_size()166 size_t linker_get_error_buffer_size() {
167   return sizeof(__linker_dl_err_buf);
168 }
169 
170 /*
171  * This function is an empty stub where GDB locates a breakpoint to get notified
172  * about linker activity.
173  */
174 extern "C" void __attribute__((noinline)) __attribute__((visibility("default"))) rtld_db_dlactivity();
175 
176 static r_debug _r_debug = {1, NULL, &rtld_db_dlactivity, RT_CONSISTENT, 0};
177 static link_map_t* r_debug_tail = 0;
178 
179 static pthread_mutex_t gDebugMutex = PTHREAD_MUTEX_INITIALIZER;
180 
insert_soinfo_into_debug_map(soinfo * info)181 static void insert_soinfo_into_debug_map(soinfo * info) {
182     // Copy the necessary fields into the debug structure.
183     link_map_t* map = &(info->link_map);
184     map->l_addr = info->base;
185     map->l_name = (char*) info->name;
186     map->l_ld = (uintptr_t)info->dynamic;
187 
188     /* Stick the new library at the end of the list.
189      * gdb tends to care more about libc than it does
190      * about leaf libraries, and ordering it this way
191      * reduces the back-and-forth over the wire.
192      */
193     if (r_debug_tail) {
194         r_debug_tail->l_next = map;
195         map->l_prev = r_debug_tail;
196         map->l_next = 0;
197     } else {
198         _r_debug.r_map = map;
199         map->l_prev = 0;
200         map->l_next = 0;
201     }
202     r_debug_tail = map;
203 }
204 
remove_soinfo_from_debug_map(soinfo * info)205 static void remove_soinfo_from_debug_map(soinfo* info) {
206     link_map_t* map = &(info->link_map);
207 
208     if (r_debug_tail == map) {
209         r_debug_tail = map->l_prev;
210     }
211 
212     if (map->l_prev) {
213         map->l_prev->l_next = map->l_next;
214     }
215     if (map->l_next) {
216         map->l_next->l_prev = map->l_prev;
217     }
218 }
219 
notify_gdb_of_load(soinfo * info)220 static void notify_gdb_of_load(soinfo* info) {
221     if (info->flags & FLAG_EXE) {
222         // GDB already knows about the main executable
223         return;
224     }
225 
226     ScopedPthreadMutexLocker locker(&gDebugMutex);
227 
228     _r_debug.r_state = RT_ADD;
229     rtld_db_dlactivity();
230 
231     insert_soinfo_into_debug_map(info);
232 
233     _r_debug.r_state = RT_CONSISTENT;
234     rtld_db_dlactivity();
235 }
236 
notify_gdb_of_unload(soinfo * info)237 static void notify_gdb_of_unload(soinfo* info) {
238     if (info->flags & FLAG_EXE) {
239         // GDB already knows about the main executable
240         return;
241     }
242 
243     ScopedPthreadMutexLocker locker(&gDebugMutex);
244 
245     _r_debug.r_state = RT_DELETE;
246     rtld_db_dlactivity();
247 
248     remove_soinfo_from_debug_map(info);
249 
250     _r_debug.r_state = RT_CONSISTENT;
251     rtld_db_dlactivity();
252 }
253 
notify_gdb_of_libraries()254 void notify_gdb_of_libraries() {
255     _r_debug.r_state = RT_ADD;
256     rtld_db_dlactivity();
257     _r_debug.r_state = RT_CONSISTENT;
258     rtld_db_dlactivity();
259 }
260 
ensure_free_list_non_empty()261 static bool ensure_free_list_non_empty() {
262   if (gSoInfoFreeList != NULL) {
263     return true;
264   }
265 
266   // Allocate a new pool.
267   soinfo_pool_t* pool = reinterpret_cast<soinfo_pool_t*>(mmap(NULL, sizeof(*pool),
268                                                               PROT_READ|PROT_WRITE,
269                                                               MAP_PRIVATE|MAP_ANONYMOUS, 0, 0));
270   if (pool == MAP_FAILED) {
271     return false;
272   }
273 
274   // Add the pool to our list of pools.
275   pool->next = gSoInfoPools;
276   gSoInfoPools = pool;
277 
278   // Chain the entries in the new pool onto the free list.
279   gSoInfoFreeList = &pool->info[0];
280   soinfo* next = NULL;
281   for (int i = SOINFO_PER_POOL - 1; i >= 0; --i) {
282     pool->info[i].next = next;
283     next = &pool->info[i];
284   }
285 
286   return true;
287 }
288 
set_soinfo_pool_protection(int protection)289 static void set_soinfo_pool_protection(int protection) {
290   for (soinfo_pool_t* p = gSoInfoPools; p != NULL; p = p->next) {
291     if (mprotect(p, sizeof(*p), protection) == -1) {
292       abort(); // Can't happen.
293     }
294   }
295 }
296 
soinfo_alloc(const char * name)297 static soinfo* soinfo_alloc(const char* name) {
298   if (strlen(name) >= SOINFO_NAME_LEN) {
299     DL_ERR("library name \"%s\" too long", name);
300     return NULL;
301   }
302 
303   if (!ensure_free_list_non_empty()) {
304     DL_ERR("out of memory when loading \"%s\"", name);
305     return NULL;
306   }
307 
308   // Take the head element off the free list.
309   soinfo* si = gSoInfoFreeList;
310   gSoInfoFreeList = gSoInfoFreeList->next;
311 
312   // Initialize the new element.
313   memset(si, 0, sizeof(soinfo));
314   strlcpy(si->name, name, sizeof(si->name));
315   sonext->next = si;
316   sonext = si;
317 
318   TRACE("name %s: allocated soinfo @ %p", name, si);
319   return si;
320 }
321 
soinfo_free(soinfo * si)322 static void soinfo_free(soinfo* si)
323 {
324     if (si == NULL) {
325         return;
326     }
327 
328     soinfo *prev = NULL, *trav;
329 
330     TRACE("name %s: freeing soinfo @ %p", si->name, si);
331 
332     for (trav = solist; trav != NULL; trav = trav->next) {
333         if (trav == si)
334             break;
335         prev = trav;
336     }
337     if (trav == NULL) {
338         /* si was not in solist */
339         DL_ERR("name \"%s\" is not in solist!", si->name);
340         return;
341     }
342 
343     /* prev will never be NULL, because the first entry in solist is
344        always the static libdl_info.
345     */
346     prev->next = si->next;
347     if (si == sonext) {
348         sonext = prev;
349     }
350     si->next = gSoInfoFreeList;
351     gSoInfoFreeList = si;
352 }
353 
354 
parse_path(const char * path,const char * delimiters,const char ** array,char * buf,size_t buf_size,size_t max_count)355 static void parse_path(const char* path, const char* delimiters,
356                        const char** array, char* buf, size_t buf_size, size_t max_count) {
357   if (path == NULL) {
358     return;
359   }
360 
361   size_t len = strlcpy(buf, path, buf_size);
362 
363   size_t i = 0;
364   char* buf_p = buf;
365   while (i < max_count && (array[i] = strsep(&buf_p, delimiters))) {
366     if (*array[i] != '\0') {
367       ++i;
368     }
369   }
370 
371   // Forget the last path if we had to truncate; this occurs if the 2nd to
372   // last char isn't '\0' (i.e. wasn't originally a delimiter).
373   if (i > 0 && len >= buf_size && buf[buf_size - 2] != '\0') {
374     array[i - 1] = NULL;
375   } else {
376     array[i] = NULL;
377   }
378 }
379 
parse_LD_LIBRARY_PATH(const char * path)380 static void parse_LD_LIBRARY_PATH(const char* path) {
381   parse_path(path, ":", gLdPaths,
382              gLdPathsBuffer, sizeof(gLdPathsBuffer), LDPATH_MAX);
383 }
384 
parse_LD_PRELOAD(const char * path)385 static void parse_LD_PRELOAD(const char* path) {
386   // We have historically supported ':' as well as ' ' in LD_PRELOAD.
387   parse_path(path, " :", gLdPreloadNames,
388              gLdPreloadsBuffer, sizeof(gLdPreloadsBuffer), LDPRELOAD_MAX);
389 }
390 
391 #ifdef ANDROID_ARM_LINKER
392 
393 /* For a given PC, find the .so that it belongs to.
394  * Returns the base address of the .ARM.exidx section
395  * for that .so, and the number of 8-byte entries
396  * in that section (via *pcount).
397  *
398  * Intended to be called by libc's __gnu_Unwind_Find_exidx().
399  *
400  * This function is exposed via dlfcn.cpp and libdl.so.
401  */
dl_unwind_find_exidx(_Unwind_Ptr pc,int * pcount)402 _Unwind_Ptr dl_unwind_find_exidx(_Unwind_Ptr pc, int *pcount)
403 {
404     soinfo *si;
405     unsigned addr = (unsigned)pc;
406 
407     for (si = solist; si != 0; si = si->next){
408         if ((addr >= si->base) && (addr < (si->base + si->size))) {
409             *pcount = si->ARM_exidx_count;
410             return (_Unwind_Ptr)si->ARM_exidx;
411         }
412     }
413    *pcount = 0;
414     return NULL;
415 }
416 
417 #elif defined(ANDROID_X86_LINKER) || defined(ANDROID_MIPS_LINKER)
418 
419 /* Here, we only have to provide a callback to iterate across all the
420  * loaded libraries. gcc_eh does the rest. */
421 int
dl_iterate_phdr(int (* cb)(dl_phdr_info * info,size_t size,void * data),void * data)422 dl_iterate_phdr(int (*cb)(dl_phdr_info *info, size_t size, void *data),
423                 void *data)
424 {
425     int rv = 0;
426     for (soinfo* si = solist; si != NULL; si = si->next) {
427         dl_phdr_info dl_info;
428         dl_info.dlpi_addr = si->link_map.l_addr;
429         dl_info.dlpi_name = si->link_map.l_name;
430         dl_info.dlpi_phdr = si->phdr;
431         dl_info.dlpi_phnum = si->phnum;
432         rv = cb(&dl_info, sizeof(dl_phdr_info), data);
433         if (rv != 0) {
434             break;
435         }
436     }
437     return rv;
438 }
439 
440 #endif
441 
soinfo_elf_lookup(soinfo * si,unsigned hash,const char * name)442 static Elf32_Sym* soinfo_elf_lookup(soinfo* si, unsigned hash, const char* name) {
443     Elf32_Sym* s;
444     Elf32_Sym* symtab = si->symtab;
445     const char* strtab = si->strtab;
446     unsigned n;
447 
448     TRACE_TYPE(LOOKUP, "SEARCH %s in %s@0x%08x %08x %d",
449                name, si->name, si->base, hash, hash % si->nbucket);
450     n = hash % si->nbucket;
451 
452     for (n = si->bucket[hash % si->nbucket]; n != 0; n = si->chain[n]) {
453         s = symtab + n;
454         if (strcmp(strtab + s->st_name, name)) continue;
455 
456             /* only concern ourselves with global and weak symbol definitions */
457         switch(ELF32_ST_BIND(s->st_info)){
458         case STB_GLOBAL:
459         case STB_WEAK:
460             if (s->st_shndx == SHN_UNDEF) {
461                 continue;
462             }
463 
464             TRACE_TYPE(LOOKUP, "FOUND %s in %s (%08x) %d",
465                        name, si->name, s->st_value, s->st_size);
466             return s;
467         }
468     }
469 
470     return NULL;
471 }
472 
elfhash(const char * _name)473 static unsigned elfhash(const char* _name) {
474     const unsigned char* name = (const unsigned char*) _name;
475     unsigned h = 0, g;
476 
477     while(*name) {
478         h = (h << 4) + *name++;
479         g = h & 0xf0000000;
480         h ^= g;
481         h ^= g >> 24;
482     }
483     return h;
484 }
485 
soinfo_do_lookup(soinfo * si,const char * name,soinfo ** lsi,soinfo * needed[])486 static Elf32_Sym* soinfo_do_lookup(soinfo* si, const char* name, soinfo** lsi, soinfo* needed[]) {
487     unsigned elf_hash = elfhash(name);
488     Elf32_Sym* s = NULL;
489 
490     if (si != NULL && somain != NULL) {
491 
492         /*
493          * Local scope is executable scope. Just start looking into it right away
494          * for the shortcut.
495          */
496 
497         if (si == somain) {
498             s = soinfo_elf_lookup(si, elf_hash, name);
499             if (s != NULL) {
500                 *lsi = si;
501                 goto done;
502             }
503         } else {
504             /* Order of symbol lookup is controlled by DT_SYMBOLIC flag */
505 
506             /*
507              * If this object was built with symbolic relocations disabled, the
508              * first place to look to resolve external references is the main
509              * executable.
510              */
511 
512             if (!si->has_DT_SYMBOLIC) {
513                 DEBUG("%s: looking up %s in executable %s",
514                       si->name, name, somain->name);
515                 s = soinfo_elf_lookup(somain, elf_hash, name);
516                 if (s != NULL) {
517                     *lsi = somain;
518                     goto done;
519                 }
520             }
521 
522             /* Look for symbols in the local scope (the object who is
523              * searching). This happens with C++ templates on i386 for some
524              * reason.
525              *
526              * Notes on weak symbols:
527              * The ELF specs are ambiguous about treatment of weak definitions in
528              * dynamic linking.  Some systems return the first definition found
529              * and some the first non-weak definition.   This is system dependent.
530              * Here we return the first definition found for simplicity.  */
531 
532             s = soinfo_elf_lookup(si, elf_hash, name);
533             if (s != NULL) {
534                 *lsi = si;
535                 goto done;
536             }
537 
538             /*
539              * If this object was built with -Bsymbolic and symbol is not found
540              * in the local scope, try to find the symbol in the main executable.
541              */
542 
543             if (si->has_DT_SYMBOLIC) {
544                 DEBUG("%s: looking up %s in executable %s after local scope",
545                       si->name, name, somain->name);
546                 s = soinfo_elf_lookup(somain, elf_hash, name);
547                 if (s != NULL) {
548                     *lsi = somain;
549                     goto done;
550                 }
551             }
552         }
553     }
554 
555     /* Next, look for it in the preloads list */
556     for (int i = 0; gLdPreloads[i] != NULL; i++) {
557         s = soinfo_elf_lookup(gLdPreloads[i], elf_hash, name);
558         if (s != NULL) {
559             *lsi = gLdPreloads[i];
560             goto done;
561         }
562     }
563 
564     for (int i = 0; needed[i] != NULL; i++) {
565         DEBUG("%s: looking up %s in %s",
566               si->name, name, needed[i]->name);
567         s = soinfo_elf_lookup(needed[i], elf_hash, name);
568         if (s != NULL) {
569             *lsi = needed[i];
570             goto done;
571         }
572     }
573 
574 done:
575     if (s != NULL) {
576         TRACE_TYPE(LOOKUP, "si %s sym %s s->st_value = 0x%08x, "
577                    "found in %s, base = 0x%08x, load bias = 0x%08x",
578                    si->name, name, s->st_value,
579                    (*lsi)->name, (*lsi)->base, (*lsi)->load_bias);
580         return s;
581     }
582 
583     return NULL;
584 }
585 
586 /* This is used by dlsym(3).  It performs symbol lookup only within the
587    specified soinfo object and not in any of its dependencies.
588 
589    TODO: Only looking in the specified soinfo seems wrong. dlsym(3) says
590    that it should do a breadth first search through the dependency
591    tree. This agrees with the ELF spec (aka System V Application
592    Binary Interface) where in Chapter 5 it discuss resolving "Shared
593    Object Dependencies" in breadth first search order.
594  */
dlsym_handle_lookup(soinfo * si,const char * name)595 Elf32_Sym* dlsym_handle_lookup(soinfo* si, const char* name)
596 {
597     return soinfo_elf_lookup(si, elfhash(name), name);
598 }
599 
600 /* This is used by dlsym(3) to performs a global symbol lookup. If the
601    start value is null (for RTLD_DEFAULT), the search starts at the
602    beginning of the global solist. Otherwise the search starts at the
603    specified soinfo (for RTLD_NEXT).
604  */
dlsym_linear_lookup(const char * name,soinfo ** found,soinfo * start)605 Elf32_Sym* dlsym_linear_lookup(const char* name, soinfo** found, soinfo* start) {
606   unsigned elf_hash = elfhash(name);
607 
608   if (start == NULL) {
609     start = solist;
610   }
611 
612   Elf32_Sym* s = NULL;
613   for (soinfo* si = start; (s == NULL) && (si != NULL); si = si->next) {
614     s = soinfo_elf_lookup(si, elf_hash, name);
615     if (s != NULL) {
616       *found = si;
617       break;
618     }
619   }
620 
621   if (s != NULL) {
622     TRACE_TYPE(LOOKUP, "%s s->st_value = 0x%08x, found->base = 0x%08x",
623                name, s->st_value, (*found)->base);
624   }
625 
626   return s;
627 }
628 
find_containing_library(const void * p)629 soinfo* find_containing_library(const void* p) {
630   Elf32_Addr address = reinterpret_cast<Elf32_Addr>(p);
631   for (soinfo* si = solist; si != NULL; si = si->next) {
632     if (address >= si->base && address - si->base < si->size) {
633       return si;
634     }
635   }
636   return NULL;
637 }
638 
dladdr_find_symbol(soinfo * si,const void * addr)639 Elf32_Sym* dladdr_find_symbol(soinfo* si, const void* addr) {
640   Elf32_Addr soaddr = reinterpret_cast<Elf32_Addr>(addr) - si->base;
641 
642   // Search the library's symbol table for any defined symbol which
643   // contains this address.
644   for (size_t i = 0; i < si->nchain; ++i) {
645     Elf32_Sym* sym = &si->symtab[i];
646     if (sym->st_shndx != SHN_UNDEF &&
647         soaddr >= sym->st_value &&
648         soaddr < sym->st_value + sym->st_size) {
649       return sym;
650     }
651   }
652 
653   return NULL;
654 }
655 
656 #if 0
657 static void dump(soinfo* si)
658 {
659     Elf32_Sym* s = si->symtab;
660     for (unsigned n = 0; n < si->nchain; n++) {
661         TRACE("%04d> %08x: %02x %04x %08x %08x %s", n, s,
662                s->st_info, s->st_shndx, s->st_value, s->st_size,
663                si->strtab + s->st_name);
664         s++;
665     }
666 }
667 #endif
668 
open_library_on_path(const char * name,const char * const paths[])669 static int open_library_on_path(const char* name, const char* const paths[]) {
670   char buf[512];
671   for (size_t i = 0; paths[i] != NULL; ++i) {
672     int n = __libc_format_buffer(buf, sizeof(buf), "%s/%s", paths[i], name);
673     if (n < 0 || n >= static_cast<int>(sizeof(buf))) {
674       PRINT("Warning: ignoring very long library path: %s/%s", paths[i], name);
675       continue;
676     }
677     int fd = TEMP_FAILURE_RETRY(open(buf, O_RDONLY | O_CLOEXEC));
678     if (fd != -1) {
679       return fd;
680     }
681   }
682   return -1;
683 }
684 
open_library(const char * name)685 static int open_library(const char* name) {
686   TRACE("[ opening %s ]", name);
687 
688   // If the name contains a slash, we should attempt to open it directly and not search the paths.
689   if (strchr(name, '/') != NULL) {
690     int fd = TEMP_FAILURE_RETRY(open(name, O_RDONLY | O_CLOEXEC));
691     if (fd != -1) {
692       return fd;
693     }
694     // ...but nvidia binary blobs (at least) rely on this behavior, so fall through for now.
695   }
696 
697   // Otherwise we try LD_LIBRARY_PATH first, and fall back to the built-in well known paths.
698   int fd = open_library_on_path(name, gLdPaths);
699   if (fd == -1) {
700     fd = open_library_on_path(name, gSoPaths);
701   }
702   return fd;
703 }
704 
load_library(const char * name)705 static soinfo* load_library(const char* name) {
706     // Open the file.
707     int fd = open_library(name);
708     if (fd == -1) {
709         DL_ERR("library \"%s\" not found", name);
710         return NULL;
711     }
712 
713     // Read the ELF header and load the segments.
714     ElfReader elf_reader(name, fd);
715     if (!elf_reader.Load()) {
716         return NULL;
717     }
718 
719     const char* bname = strrchr(name, '/');
720     soinfo* si = soinfo_alloc(bname ? bname + 1 : name);
721     if (si == NULL) {
722         return NULL;
723     }
724     si->base = elf_reader.load_start();
725     si->size = elf_reader.load_size();
726     si->load_bias = elf_reader.load_bias();
727     si->flags = 0;
728     si->entry = 0;
729     si->dynamic = NULL;
730     si->phnum = elf_reader.phdr_count();
731     si->phdr = elf_reader.loaded_phdr();
732     return si;
733 }
734 
find_loaded_library(const char * name)735 static soinfo *find_loaded_library(const char *name)
736 {
737     soinfo *si;
738     const char *bname;
739 
740     // TODO: don't use basename only for determining libraries
741     // http://code.google.com/p/android/issues/detail?id=6670
742 
743     bname = strrchr(name, '/');
744     bname = bname ? bname + 1 : name;
745 
746     for (si = solist; si != NULL; si = si->next) {
747         if (!strcmp(bname, si->name)) {
748             return si;
749         }
750     }
751     return NULL;
752 }
753 
find_library_internal(const char * name)754 static soinfo* find_library_internal(const char* name) {
755   if (name == NULL) {
756     return somain;
757   }
758 
759   soinfo* si = find_loaded_library(name);
760   if (si != NULL) {
761     if (si->flags & FLAG_LINKED) {
762       return si;
763     }
764     DL_ERR("OOPS: recursive link to \"%s\"", si->name);
765     return NULL;
766   }
767 
768   TRACE("[ '%s' has not been loaded yet.  Locating...]", name);
769   si = load_library(name);
770   if (si == NULL) {
771     return NULL;
772   }
773 
774   // At this point we know that whatever is loaded @ base is a valid ELF
775   // shared library whose segments are properly mapped in.
776   TRACE("[ init_library base=0x%08x sz=0x%08x name='%s' ]",
777         si->base, si->size, si->name);
778 
779   if (!soinfo_link_image(si)) {
780     munmap(reinterpret_cast<void*>(si->base), si->size);
781     soinfo_free(si);
782     return NULL;
783   }
784 
785   return si;
786 }
787 
find_library(const char * name)788 static soinfo* find_library(const char* name) {
789   soinfo* si = find_library_internal(name);
790   if (si != NULL) {
791     si->ref_count++;
792   }
793   return si;
794 }
795 
soinfo_unload(soinfo * si)796 static int soinfo_unload(soinfo* si) {
797   if (si->ref_count == 1) {
798     TRACE("unloading '%s'", si->name);
799     si->CallDestructors();
800 
801     for (Elf32_Dyn* d = si->dynamic; d->d_tag != DT_NULL; ++d) {
802       if (d->d_tag == DT_NEEDED) {
803         const char* library_name = si->strtab + d->d_un.d_val;
804         TRACE("%s needs to unload %s", si->name, library_name);
805         soinfo_unload(find_loaded_library(library_name));
806       }
807     }
808 
809     munmap(reinterpret_cast<void*>(si->base), si->size);
810     notify_gdb_of_unload(si);
811     soinfo_free(si);
812     si->ref_count = 0;
813   } else {
814     si->ref_count--;
815     TRACE("not unloading '%s', decrementing ref_count to %d", si->name, si->ref_count);
816   }
817   return 0;
818 }
819 
do_android_update_LD_LIBRARY_PATH(const char * ld_library_path)820 void do_android_update_LD_LIBRARY_PATH(const char* ld_library_path) {
821   if (!get_AT_SECURE()) {
822     parse_LD_LIBRARY_PATH(ld_library_path);
823   }
824 }
825 
do_dlopen(const char * name,int flags)826 soinfo* do_dlopen(const char* name, int flags) {
827   if ((flags & ~(RTLD_NOW|RTLD_LAZY|RTLD_LOCAL|RTLD_GLOBAL)) != 0) {
828     DL_ERR("invalid flags to dlopen: %x", flags);
829     return NULL;
830   }
831   set_soinfo_pool_protection(PROT_READ | PROT_WRITE);
832   soinfo* si = find_library(name);
833   if (si != NULL) {
834     si->CallConstructors();
835   }
836   set_soinfo_pool_protection(PROT_READ);
837   return si;
838 }
839 
do_dlclose(soinfo * si)840 int do_dlclose(soinfo* si) {
841   set_soinfo_pool_protection(PROT_READ | PROT_WRITE);
842   int result = soinfo_unload(si);
843   set_soinfo_pool_protection(PROT_READ);
844   return result;
845 }
846 
847 /* TODO: don't use unsigned for addrs below. It works, but is not
848  * ideal. They should probably be either uint32_t, Elf32_Addr, or unsigned
849  * long.
850  */
soinfo_relocate(soinfo * si,Elf32_Rel * rel,unsigned count,soinfo * needed[])851 static int soinfo_relocate(soinfo* si, Elf32_Rel* rel, unsigned count,
852                            soinfo* needed[])
853 {
854     Elf32_Sym* symtab = si->symtab;
855     const char* strtab = si->strtab;
856     Elf32_Sym* s;
857     Elf32_Rel* start = rel;
858     soinfo* lsi;
859 
860     for (size_t idx = 0; idx < count; ++idx, ++rel) {
861         unsigned type = ELF32_R_TYPE(rel->r_info);
862         unsigned sym = ELF32_R_SYM(rel->r_info);
863         Elf32_Addr reloc = static_cast<Elf32_Addr>(rel->r_offset + si->load_bias);
864         Elf32_Addr sym_addr = 0;
865         char* sym_name = NULL;
866 
867         DEBUG("Processing '%s' relocation at index %d", si->name, idx);
868         if (type == 0) { // R_*_NONE
869             continue;
870         }
871         if (sym != 0) {
872             sym_name = (char *)(strtab + symtab[sym].st_name);
873             s = soinfo_do_lookup(si, sym_name, &lsi, needed);
874             if (s == NULL) {
875                 /* We only allow an undefined symbol if this is a weak
876                    reference..   */
877                 s = &symtab[sym];
878                 if (ELF32_ST_BIND(s->st_info) != STB_WEAK) {
879                     DL_ERR("cannot locate symbol \"%s\" referenced by \"%s\"...", sym_name, si->name);
880                     return -1;
881                 }
882 
883                 /* IHI0044C AAELF 4.5.1.1:
884 
885                    Libraries are not searched to resolve weak references.
886                    It is not an error for a weak reference to remain
887                    unsatisfied.
888 
889                    During linking, the value of an undefined weak reference is:
890                    - Zero if the relocation type is absolute
891                    - The address of the place if the relocation is pc-relative
892                    - The address of nominal base address if the relocation
893                      type is base-relative.
894                   */
895 
896                 switch (type) {
897 #if defined(ANDROID_ARM_LINKER)
898                 case R_ARM_JUMP_SLOT:
899                 case R_ARM_GLOB_DAT:
900                 case R_ARM_ABS32:
901                 case R_ARM_RELATIVE:    /* Don't care. */
902 #elif defined(ANDROID_X86_LINKER)
903                 case R_386_JMP_SLOT:
904                 case R_386_GLOB_DAT:
905                 case R_386_32:
906                 case R_386_RELATIVE:    /* Dont' care. */
907 #endif /* ANDROID_*_LINKER */
908                     /* sym_addr was initialized to be zero above or relocation
909                        code below does not care about value of sym_addr.
910                        No need to do anything.  */
911                     break;
912 
913 #if defined(ANDROID_X86_LINKER)
914                 case R_386_PC32:
915                     sym_addr = reloc;
916                     break;
917 #endif /* ANDROID_X86_LINKER */
918 
919 #if defined(ANDROID_ARM_LINKER)
920                 case R_ARM_COPY:
921                     /* Fall through.  Can't really copy if weak symbol is
922                        not found in run-time.  */
923 #endif /* ANDROID_ARM_LINKER */
924                 default:
925                     DL_ERR("unknown weak reloc type %d @ %p (%d)",
926                                  type, rel, (int) (rel - start));
927                     return -1;
928                 }
929             } else {
930                 /* We got a definition.  */
931 #if 0
932                 if ((base == 0) && (si->base != 0)) {
933                         /* linking from libraries to main image is bad */
934                     DL_ERR("cannot locate \"%s\"...",
935                            strtab + symtab[sym].st_name);
936                     return -1;
937                 }
938 #endif
939                 sym_addr = static_cast<Elf32_Addr>(s->st_value + lsi->load_bias);
940             }
941             count_relocation(kRelocSymbol);
942         } else {
943             s = NULL;
944         }
945 
946 /* TODO: This is ugly. Split up the relocations by arch into
947  * different files.
948  */
949         switch(type){
950 #if defined(ANDROID_ARM_LINKER)
951         case R_ARM_JUMP_SLOT:
952             count_relocation(kRelocAbsolute);
953             MARK(rel->r_offset);
954             TRACE_TYPE(RELO, "RELO JMP_SLOT %08x <- %08x %s", reloc, sym_addr, sym_name);
955             *reinterpret_cast<Elf32_Addr*>(reloc) = sym_addr;
956             break;
957         case R_ARM_GLOB_DAT:
958             count_relocation(kRelocAbsolute);
959             MARK(rel->r_offset);
960             TRACE_TYPE(RELO, "RELO GLOB_DAT %08x <- %08x %s", reloc, sym_addr, sym_name);
961             *reinterpret_cast<Elf32_Addr*>(reloc) = sym_addr;
962             break;
963         case R_ARM_ABS32:
964             count_relocation(kRelocAbsolute);
965             MARK(rel->r_offset);
966             TRACE_TYPE(RELO, "RELO ABS %08x <- %08x %s", reloc, sym_addr, sym_name);
967             *reinterpret_cast<Elf32_Addr*>(reloc) += sym_addr;
968             break;
969         case R_ARM_REL32:
970             count_relocation(kRelocRelative);
971             MARK(rel->r_offset);
972             TRACE_TYPE(RELO, "RELO REL32 %08x <- %08x - %08x %s",
973                        reloc, sym_addr, rel->r_offset, sym_name);
974             *reinterpret_cast<Elf32_Addr*>(reloc) += sym_addr - rel->r_offset;
975             break;
976 #elif defined(ANDROID_X86_LINKER)
977         case R_386_JMP_SLOT:
978             count_relocation(kRelocAbsolute);
979             MARK(rel->r_offset);
980             TRACE_TYPE(RELO, "RELO JMP_SLOT %08x <- %08x %s", reloc, sym_addr, sym_name);
981             *reinterpret_cast<Elf32_Addr*>(reloc) = sym_addr;
982             break;
983         case R_386_GLOB_DAT:
984             count_relocation(kRelocAbsolute);
985             MARK(rel->r_offset);
986             TRACE_TYPE(RELO, "RELO GLOB_DAT %08x <- %08x %s", reloc, sym_addr, sym_name);
987             *reinterpret_cast<Elf32_Addr*>(reloc) = sym_addr;
988             break;
989 #elif defined(ANDROID_MIPS_LINKER)
990     case R_MIPS_REL32:
991             count_relocation(kRelocAbsolute);
992             MARK(rel->r_offset);
993             TRACE_TYPE(RELO, "RELO REL32 %08x <- %08x %s",
994                        reloc, sym_addr, (sym_name) ? sym_name : "*SECTIONHDR*");
995             if (s) {
996                 *reinterpret_cast<Elf32_Addr*>(reloc) += sym_addr;
997             } else {
998                 *reinterpret_cast<Elf32_Addr*>(reloc) += si->base;
999             }
1000             break;
1001 #endif /* ANDROID_*_LINKER */
1002 
1003 #if defined(ANDROID_ARM_LINKER)
1004         case R_ARM_RELATIVE:
1005 #elif defined(ANDROID_X86_LINKER)
1006         case R_386_RELATIVE:
1007 #endif /* ANDROID_*_LINKER */
1008             count_relocation(kRelocRelative);
1009             MARK(rel->r_offset);
1010             if (sym) {
1011                 DL_ERR("odd RELATIVE form...");
1012                 return -1;
1013             }
1014             TRACE_TYPE(RELO, "RELO RELATIVE %08x <- +%08x", reloc, si->base);
1015             *reinterpret_cast<Elf32_Addr*>(reloc) += si->base;
1016             break;
1017 
1018 #if defined(ANDROID_X86_LINKER)
1019         case R_386_32:
1020             count_relocation(kRelocRelative);
1021             MARK(rel->r_offset);
1022 
1023             TRACE_TYPE(RELO, "RELO R_386_32 %08x <- +%08x %s", reloc, sym_addr, sym_name);
1024             *reinterpret_cast<Elf32_Addr*>(reloc) += sym_addr;
1025             break;
1026 
1027         case R_386_PC32:
1028             count_relocation(kRelocRelative);
1029             MARK(rel->r_offset);
1030             TRACE_TYPE(RELO, "RELO R_386_PC32 %08x <- +%08x (%08x - %08x) %s",
1031                        reloc, (sym_addr - reloc), sym_addr, reloc, sym_name);
1032             *reinterpret_cast<Elf32_Addr*>(reloc) += (sym_addr - reloc);
1033             break;
1034 #endif /* ANDROID_X86_LINKER */
1035 
1036 #ifdef ANDROID_ARM_LINKER
1037         case R_ARM_COPY:
1038             if ((si->flags & FLAG_EXE) == 0) {
1039                 /*
1040                  * http://infocenter.arm.com/help/topic/com.arm.doc.ihi0044d/IHI0044D_aaelf.pdf
1041                  *
1042                  * Section 4.7.1.10 "Dynamic relocations"
1043                  * R_ARM_COPY may only appear in executable objects where e_type is
1044                  * set to ET_EXEC.
1045                  *
1046                  * TODO: FLAG_EXE is set for both ET_DYN and ET_EXEC executables.
1047                  * We should explicitly disallow ET_DYN executables from having
1048                  * R_ARM_COPY relocations.
1049                  */
1050                 DL_ERR("%s R_ARM_COPY relocations only supported for ET_EXEC", si->name);
1051                 return -1;
1052             }
1053             count_relocation(kRelocCopy);
1054             MARK(rel->r_offset);
1055             TRACE_TYPE(RELO, "RELO %08x <- %d @ %08x %s", reloc, s->st_size, sym_addr, sym_name);
1056             if (reloc == sym_addr) {
1057                 Elf32_Sym *src = soinfo_do_lookup(NULL, sym_name, &lsi, needed);
1058 
1059                 if (src == NULL) {
1060                     DL_ERR("%s R_ARM_COPY relocation source cannot be resolved", si->name);
1061                     return -1;
1062                 }
1063                 if (lsi->has_DT_SYMBOLIC) {
1064                     DL_ERR("%s invalid R_ARM_COPY relocation against DT_SYMBOLIC shared "
1065                            "library %s (built with -Bsymbolic?)", si->name, lsi->name);
1066                     return -1;
1067                 }
1068                 if (s->st_size < src->st_size) {
1069                     DL_ERR("%s R_ARM_COPY relocation size mismatch (%d < %d)",
1070                            si->name, s->st_size, src->st_size);
1071                     return -1;
1072                 }
1073                 memcpy((void*)reloc, (void*)(src->st_value + lsi->load_bias), src->st_size);
1074             } else {
1075                 DL_ERR("%s R_ARM_COPY relocation target cannot be resolved", si->name);
1076                 return -1;
1077             }
1078             break;
1079 #endif /* ANDROID_ARM_LINKER */
1080 
1081         default:
1082             DL_ERR("unknown reloc type %d @ %p (%d)",
1083                    type, rel, (int) (rel - start));
1084             return -1;
1085         }
1086     }
1087     return 0;
1088 }
1089 
1090 #ifdef ANDROID_MIPS_LINKER
mips_relocate_got(soinfo * si,soinfo * needed[])1091 static int mips_relocate_got(soinfo* si, soinfo* needed[]) {
1092     unsigned *got;
1093     unsigned local_gotno, gotsym, symtabno;
1094     Elf32_Sym *symtab, *sym;
1095     unsigned g;
1096 
1097     got = si->plt_got;
1098     local_gotno = si->mips_local_gotno;
1099     gotsym = si->mips_gotsym;
1100     symtabno = si->mips_symtabno;
1101     symtab = si->symtab;
1102 
1103     /*
1104      * got[0] is address of lazy resolver function
1105      * got[1] may be used for a GNU extension
1106      * set it to a recognizable address in case someone calls it
1107      * (should be _rtld_bind_start)
1108      * FIXME: maybe this should be in a separate routine
1109      */
1110 
1111     if ((si->flags & FLAG_LINKER) == 0) {
1112         g = 0;
1113         got[g++] = 0xdeadbeef;
1114         if (got[g] & 0x80000000) {
1115             got[g++] = 0xdeadfeed;
1116         }
1117         /*
1118          * Relocate the local GOT entries need to be relocated
1119          */
1120         for (; g < local_gotno; g++) {
1121             got[g] += si->load_bias;
1122         }
1123     }
1124 
1125     /* Now for the global GOT entries */
1126     sym = symtab + gotsym;
1127     got = si->plt_got + local_gotno;
1128     for (g = gotsym; g < symtabno; g++, sym++, got++) {
1129         const char* sym_name;
1130         Elf32_Sym* s;
1131         soinfo* lsi;
1132 
1133         /* This is an undefined reference... try to locate it */
1134         sym_name = si->strtab + sym->st_name;
1135         s = soinfo_do_lookup(si, sym_name, &lsi, needed);
1136         if (s == NULL) {
1137             /* We only allow an undefined symbol if this is a weak
1138                reference..   */
1139             s = &symtab[g];
1140             if (ELF32_ST_BIND(s->st_info) != STB_WEAK) {
1141                 DL_ERR("cannot locate \"%s\"...", sym_name);
1142                 return -1;
1143             }
1144             *got = 0;
1145         }
1146         else {
1147             /* FIXME: is this sufficient?
1148              * For reference see NetBSD link loader
1149              * http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ld.elf_so/arch/mips/mips_reloc.c?rev=1.53&content-type=text/x-cvsweb-markup
1150              */
1151              *got = lsi->load_bias + s->st_value;
1152         }
1153     }
1154     return 0;
1155 }
1156 #endif
1157 
CallArray(const char * array_name UNUSED,linker_function_t * functions,size_t count,bool reverse)1158 void soinfo::CallArray(const char* array_name UNUSED, linker_function_t* functions, size_t count, bool reverse) {
1159   if (functions == NULL) {
1160     return;
1161   }
1162 
1163   TRACE("[ Calling %s (size %d) @ %p for '%s' ]", array_name, count, functions, name);
1164 
1165   int begin = reverse ? (count - 1) : 0;
1166   int end = reverse ? -1 : count;
1167   int step = reverse ? -1 : 1;
1168 
1169   for (int i = begin; i != end; i += step) {
1170     TRACE("[ %s[%d] == %p ]", array_name, i, functions[i]);
1171     CallFunction("function", functions[i]);
1172   }
1173 
1174   TRACE("[ Done calling %s for '%s' ]", array_name, name);
1175 }
1176 
CallFunction(const char * function_name UNUSED,linker_function_t function)1177 void soinfo::CallFunction(const char* function_name UNUSED, linker_function_t function) {
1178   if (function == NULL || reinterpret_cast<uintptr_t>(function) == static_cast<uintptr_t>(-1)) {
1179     return;
1180   }
1181 
1182   TRACE("[ Calling %s @ %p for '%s' ]", function_name, function, name);
1183   function();
1184   TRACE("[ Done calling %s @ %p for '%s' ]", function_name, function, name);
1185 
1186   // The function may have called dlopen(3) or dlclose(3), so we need to ensure our data structures
1187   // are still writable. This happens with our debug malloc (see http://b/7941716).
1188   set_soinfo_pool_protection(PROT_READ | PROT_WRITE);
1189 }
1190 
CallPreInitConstructors()1191 void soinfo::CallPreInitConstructors() {
1192   // DT_PREINIT_ARRAY functions are called before any other constructors for executables,
1193   // but ignored in a shared library.
1194   CallArray("DT_PREINIT_ARRAY", preinit_array, preinit_array_count, false);
1195 }
1196 
CallConstructors()1197 void soinfo::CallConstructors() {
1198   if (constructors_called) {
1199     return;
1200   }
1201 
1202   // We set constructors_called before actually calling the constructors, otherwise it doesn't
1203   // protect against recursive constructor calls. One simple example of constructor recursion
1204   // is the libc debug malloc, which is implemented in libc_malloc_debug_leak.so:
1205   // 1. The program depends on libc, so libc's constructor is called here.
1206   // 2. The libc constructor calls dlopen() to load libc_malloc_debug_leak.so.
1207   // 3. dlopen() calls the constructors on the newly created
1208   //    soinfo for libc_malloc_debug_leak.so.
1209   // 4. The debug .so depends on libc, so CallConstructors is
1210   //    called again with the libc soinfo. If it doesn't trigger the early-
1211   //    out above, the libc constructor will be called again (recursively!).
1212   constructors_called = true;
1213 
1214   if ((flags & FLAG_EXE) == 0 && preinit_array != NULL) {
1215     // The GNU dynamic linker silently ignores these, but we warn the developer.
1216     PRINT("\"%s\": ignoring %d-entry DT_PREINIT_ARRAY in shared library!",
1217           name, preinit_array_count);
1218   }
1219 
1220   if (dynamic != NULL) {
1221     for (Elf32_Dyn* d = dynamic; d->d_tag != DT_NULL; ++d) {
1222       if (d->d_tag == DT_NEEDED) {
1223         const char* library_name = strtab + d->d_un.d_val;
1224         TRACE("\"%s\": calling constructors in DT_NEEDED \"%s\"", name, library_name);
1225         find_loaded_library(library_name)->CallConstructors();
1226       }
1227     }
1228   }
1229 
1230   TRACE("\"%s\": calling constructors", name);
1231 
1232   // DT_INIT should be called before DT_INIT_ARRAY if both are present.
1233   CallFunction("DT_INIT", init_func);
1234   CallArray("DT_INIT_ARRAY", init_array, init_array_count, false);
1235 }
1236 
CallDestructors()1237 void soinfo::CallDestructors() {
1238   TRACE("\"%s\": calling destructors", name);
1239 
1240   // DT_FINI_ARRAY must be parsed in reverse order.
1241   CallArray("DT_FINI_ARRAY", fini_array, fini_array_count, true);
1242 
1243   // DT_FINI should be called after DT_FINI_ARRAY if both are present.
1244   CallFunction("DT_FINI", fini_func);
1245 }
1246 
1247 /* Force any of the closed stdin, stdout and stderr to be associated with
1248    /dev/null. */
nullify_closed_stdio()1249 static int nullify_closed_stdio() {
1250     int dev_null, i, status;
1251     int return_value = 0;
1252 
1253     dev_null = TEMP_FAILURE_RETRY(open("/dev/null", O_RDWR));
1254     if (dev_null < 0) {
1255         DL_ERR("cannot open /dev/null: %s", strerror(errno));
1256         return -1;
1257     }
1258     TRACE("[ Opened /dev/null file-descriptor=%d]", dev_null);
1259 
1260     /* If any of the stdio file descriptors is valid and not associated
1261        with /dev/null, dup /dev/null to it.  */
1262     for (i = 0; i < 3; i++) {
1263         /* If it is /dev/null already, we are done. */
1264         if (i == dev_null) {
1265             continue;
1266         }
1267 
1268         TRACE("[ Nullifying stdio file descriptor %d]", i);
1269         status = TEMP_FAILURE_RETRY(fcntl(i, F_GETFL));
1270 
1271         /* If file is opened, we are good. */
1272         if (status != -1) {
1273             continue;
1274         }
1275 
1276         /* The only error we allow is that the file descriptor does not
1277            exist, in which case we dup /dev/null to it. */
1278         if (errno != EBADF) {
1279             DL_ERR("fcntl failed: %s", strerror(errno));
1280             return_value = -1;
1281             continue;
1282         }
1283 
1284         /* Try dupping /dev/null to this stdio file descriptor and
1285            repeat if there is a signal.  Note that any errors in closing
1286            the stdio descriptor are lost.  */
1287         status = TEMP_FAILURE_RETRY(dup2(dev_null, i));
1288         if (status < 0) {
1289             DL_ERR("dup2 failed: %s", strerror(errno));
1290             return_value = -1;
1291             continue;
1292         }
1293     }
1294 
1295     /* If /dev/null is not one of the stdio file descriptors, close it. */
1296     if (dev_null > 2) {
1297         TRACE("[ Closing /dev/null file-descriptor=%d]", dev_null);
1298         status = TEMP_FAILURE_RETRY(close(dev_null));
1299         if (status == -1) {
1300             DL_ERR("close failed: %s", strerror(errno));
1301             return_value = -1;
1302         }
1303     }
1304 
1305     return return_value;
1306 }
1307 
soinfo_link_image(soinfo * si)1308 static bool soinfo_link_image(soinfo* si) {
1309     /* "base" might wrap around UINT32_MAX. */
1310     Elf32_Addr base = si->load_bias;
1311     const Elf32_Phdr *phdr = si->phdr;
1312     int phnum = si->phnum;
1313     bool relocating_linker = (si->flags & FLAG_LINKER) != 0;
1314 
1315     /* We can't debug anything until the linker is relocated */
1316     if (!relocating_linker) {
1317         INFO("[ linking %s ]", si->name);
1318         DEBUG("si->base = 0x%08x si->flags = 0x%08x", si->base, si->flags);
1319     }
1320 
1321     /* Extract dynamic section */
1322     size_t dynamic_count;
1323     Elf32_Word dynamic_flags;
1324     phdr_table_get_dynamic_section(phdr, phnum, base, &si->dynamic,
1325                                    &dynamic_count, &dynamic_flags);
1326     if (si->dynamic == NULL) {
1327         if (!relocating_linker) {
1328             DL_ERR("missing PT_DYNAMIC in \"%s\"", si->name);
1329         }
1330         return false;
1331     } else {
1332         if (!relocating_linker) {
1333             DEBUG("dynamic = %p", si->dynamic);
1334         }
1335     }
1336 
1337 #ifdef ANDROID_ARM_LINKER
1338     (void) phdr_table_get_arm_exidx(phdr, phnum, base,
1339                                     &si->ARM_exidx, &si->ARM_exidx_count);
1340 #endif
1341 
1342     // Extract useful information from dynamic section.
1343     uint32_t needed_count = 0;
1344     for (Elf32_Dyn* d = si->dynamic; d->d_tag != DT_NULL; ++d) {
1345         DEBUG("d = %p, d[0](tag) = 0x%08x d[1](val) = 0x%08x", d, d->d_tag, d->d_un.d_val);
1346         switch(d->d_tag){
1347         case DT_HASH:
1348             si->nbucket = ((unsigned *) (base + d->d_un.d_ptr))[0];
1349             si->nchain = ((unsigned *) (base + d->d_un.d_ptr))[1];
1350             si->bucket = (unsigned *) (base + d->d_un.d_ptr + 8);
1351             si->chain = (unsigned *) (base + d->d_un.d_ptr + 8 + si->nbucket * 4);
1352             break;
1353         case DT_STRTAB:
1354             si->strtab = (const char *) (base + d->d_un.d_ptr);
1355             break;
1356         case DT_SYMTAB:
1357             si->symtab = (Elf32_Sym *) (base + d->d_un.d_ptr);
1358             break;
1359         case DT_PLTREL:
1360             if (d->d_un.d_val != DT_REL) {
1361                 DL_ERR("unsupported DT_RELA in \"%s\"", si->name);
1362                 return false;
1363             }
1364             break;
1365         case DT_JMPREL:
1366             si->plt_rel = (Elf32_Rel*) (base + d->d_un.d_ptr);
1367             break;
1368         case DT_PLTRELSZ:
1369             si->plt_rel_count = d->d_un.d_val / sizeof(Elf32_Rel);
1370             break;
1371         case DT_REL:
1372             si->rel = (Elf32_Rel*) (base + d->d_un.d_ptr);
1373             break;
1374         case DT_RELSZ:
1375             si->rel_count = d->d_un.d_val / sizeof(Elf32_Rel);
1376             break;
1377         case DT_PLTGOT:
1378             /* Save this in case we decide to do lazy binding. We don't yet. */
1379             si->plt_got = (unsigned *)(base + d->d_un.d_ptr);
1380             break;
1381         case DT_DEBUG:
1382             // Set the DT_DEBUG entry to the address of _r_debug for GDB
1383             // if the dynamic table is writable
1384             if ((dynamic_flags & PF_W) != 0) {
1385                 d->d_un.d_val = (int) &_r_debug;
1386             }
1387             break;
1388          case DT_RELA:
1389             DL_ERR("unsupported DT_RELA in \"%s\"", si->name);
1390             return false;
1391         case DT_INIT:
1392             si->init_func = reinterpret_cast<linker_function_t>(base + d->d_un.d_ptr);
1393             DEBUG("%s constructors (DT_INIT) found at %p", si->name, si->init_func);
1394             break;
1395         case DT_FINI:
1396             si->fini_func = reinterpret_cast<linker_function_t>(base + d->d_un.d_ptr);
1397             DEBUG("%s destructors (DT_FINI) found at %p", si->name, si->fini_func);
1398             break;
1399         case DT_INIT_ARRAY:
1400             si->init_array = reinterpret_cast<linker_function_t*>(base + d->d_un.d_ptr);
1401             DEBUG("%s constructors (DT_INIT_ARRAY) found at %p", si->name, si->init_array);
1402             break;
1403         case DT_INIT_ARRAYSZ:
1404             si->init_array_count = ((unsigned)d->d_un.d_val) / sizeof(Elf32_Addr);
1405             break;
1406         case DT_FINI_ARRAY:
1407             si->fini_array = reinterpret_cast<linker_function_t*>(base + d->d_un.d_ptr);
1408             DEBUG("%s destructors (DT_FINI_ARRAY) found at %p", si->name, si->fini_array);
1409             break;
1410         case DT_FINI_ARRAYSZ:
1411             si->fini_array_count = ((unsigned)d->d_un.d_val) / sizeof(Elf32_Addr);
1412             break;
1413         case DT_PREINIT_ARRAY:
1414             si->preinit_array = reinterpret_cast<linker_function_t*>(base + d->d_un.d_ptr);
1415             DEBUG("%s constructors (DT_PREINIT_ARRAY) found at %p", si->name, si->preinit_array);
1416             break;
1417         case DT_PREINIT_ARRAYSZ:
1418             si->preinit_array_count = ((unsigned)d->d_un.d_val) / sizeof(Elf32_Addr);
1419             break;
1420         case DT_TEXTREL:
1421             si->has_text_relocations = true;
1422             break;
1423         case DT_SYMBOLIC:
1424             si->has_DT_SYMBOLIC = true;
1425             break;
1426         case DT_NEEDED:
1427             ++needed_count;
1428             break;
1429 #if defined DT_FLAGS
1430         // TODO: why is DT_FLAGS not defined?
1431         case DT_FLAGS:
1432             if (d->d_un.d_val & DF_TEXTREL) {
1433                 si->has_text_relocations = true;
1434             }
1435             if (d->d_un.d_val & DF_SYMBOLIC) {
1436                 si->has_DT_SYMBOLIC = true;
1437             }
1438             break;
1439 #endif
1440 #if defined(ANDROID_MIPS_LINKER)
1441         case DT_STRSZ:
1442         case DT_SYMENT:
1443         case DT_RELENT:
1444              break;
1445         case DT_MIPS_RLD_MAP:
1446             // Set the DT_MIPS_RLD_MAP entry to the address of _r_debug for GDB.
1447             {
1448               r_debug** dp = (r_debug**) d->d_un.d_ptr;
1449               *dp = &_r_debug;
1450             }
1451             break;
1452         case DT_MIPS_RLD_VERSION:
1453         case DT_MIPS_FLAGS:
1454         case DT_MIPS_BASE_ADDRESS:
1455         case DT_MIPS_UNREFEXTNO:
1456             break;
1457 
1458         case DT_MIPS_SYMTABNO:
1459             si->mips_symtabno = d->d_un.d_val;
1460             break;
1461 
1462         case DT_MIPS_LOCAL_GOTNO:
1463             si->mips_local_gotno = d->d_un.d_val;
1464             break;
1465 
1466         case DT_MIPS_GOTSYM:
1467             si->mips_gotsym = d->d_un.d_val;
1468             break;
1469 
1470         default:
1471             DEBUG("Unused DT entry: type 0x%08x arg 0x%08x", d->d_tag, d->d_un.d_val);
1472             break;
1473 #endif
1474         }
1475     }
1476 
1477     DEBUG("si->base = 0x%08x, si->strtab = %p, si->symtab = %p",
1478           si->base, si->strtab, si->symtab);
1479 
1480     // Sanity checks.
1481     if (relocating_linker && needed_count != 0) {
1482         DL_ERR("linker cannot have DT_NEEDED dependencies on other libraries");
1483         return false;
1484     }
1485     if (si->nbucket == 0) {
1486         DL_ERR("empty/missing DT_HASH in \"%s\" (built with --hash-style=gnu?)", si->name);
1487         return false;
1488     }
1489     if (si->strtab == 0) {
1490         DL_ERR("empty/missing DT_STRTAB in \"%s\"", si->name);
1491         return false;
1492     }
1493     if (si->symtab == 0) {
1494         DL_ERR("empty/missing DT_SYMTAB in \"%s\"", si->name);
1495         return false;
1496     }
1497 
1498     /* if this is the main executable, then load all of the preloads now */
1499     if (si->flags & FLAG_EXE) {
1500         memset(gLdPreloads, 0, sizeof(gLdPreloads));
1501         for (size_t i = 0; gLdPreloadNames[i] != NULL; i++) {
1502             soinfo* lsi = find_library(gLdPreloadNames[i]);
1503             if (lsi == NULL) {
1504                 strlcpy(tmp_err_buf, linker_get_error_buffer(), sizeof(tmp_err_buf));
1505                 DL_ERR("could not load library \"%s\" needed by \"%s\"; caused by %s",
1506                        gLdPreloadNames[i], si->name, tmp_err_buf);
1507                 return false;
1508             }
1509             gLdPreloads[i] = lsi;
1510         }
1511     }
1512 
1513     soinfo** needed = (soinfo**) alloca((1 + needed_count) * sizeof(soinfo*));
1514     soinfo** pneeded = needed;
1515 
1516     for (Elf32_Dyn* d = si->dynamic; d->d_tag != DT_NULL; ++d) {
1517         if (d->d_tag == DT_NEEDED) {
1518             const char* library_name = si->strtab + d->d_un.d_val;
1519             DEBUG("%s needs %s", si->name, library_name);
1520             soinfo* lsi = find_library(library_name);
1521             if (lsi == NULL) {
1522                 strlcpy(tmp_err_buf, linker_get_error_buffer(), sizeof(tmp_err_buf));
1523                 DL_ERR("could not load library \"%s\" needed by \"%s\"; caused by %s",
1524                        library_name, si->name, tmp_err_buf);
1525                 return false;
1526             }
1527             *pneeded++ = lsi;
1528         }
1529     }
1530     *pneeded = NULL;
1531 
1532     if (si->has_text_relocations) {
1533         /* Unprotect the segments, i.e. make them writable, to allow
1534          * text relocations to work properly. We will later call
1535          * phdr_table_protect_segments() after all of them are applied
1536          * and all constructors are run.
1537          */
1538         if (phdr_table_unprotect_segments(si->phdr, si->phnum, si->load_bias) < 0) {
1539             DL_ERR("can't unprotect loadable segments for \"%s\": %s",
1540                    si->name, strerror(errno));
1541             return false;
1542         }
1543     }
1544 
1545     if (si->plt_rel != NULL) {
1546         DEBUG("[ relocating %s plt ]", si->name );
1547         if (soinfo_relocate(si, si->plt_rel, si->plt_rel_count, needed)) {
1548             return false;
1549         }
1550     }
1551     if (si->rel != NULL) {
1552         DEBUG("[ relocating %s ]", si->name );
1553         if (soinfo_relocate(si, si->rel, si->rel_count, needed)) {
1554             return false;
1555         }
1556     }
1557 
1558 #ifdef ANDROID_MIPS_LINKER
1559     if (mips_relocate_got(si, needed)) {
1560         return false;
1561     }
1562 #endif
1563 
1564     si->flags |= FLAG_LINKED;
1565     DEBUG("[ finished linking %s ]", si->name);
1566 
1567     if (si->has_text_relocations) {
1568         /* All relocations are done, we can protect our segments back to
1569          * read-only. */
1570         if (phdr_table_protect_segments(si->phdr, si->phnum, si->load_bias) < 0) {
1571             DL_ERR("can't protect segments for \"%s\": %s",
1572                    si->name, strerror(errno));
1573             return false;
1574         }
1575     }
1576 
1577     /* We can also turn on GNU RELRO protection */
1578     if (phdr_table_protect_gnu_relro(si->phdr, si->phnum, si->load_bias) < 0) {
1579         DL_ERR("can't enable GNU RELRO protection for \"%s\": %s",
1580                si->name, strerror(errno));
1581         return false;
1582     }
1583 
1584     // If this is a setuid/setgid program, close the security hole described in
1585     // ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:23.stdio.asc
1586     if (get_AT_SECURE()) {
1587         nullify_closed_stdio();
1588     }
1589     notify_gdb_of_load(si);
1590     return true;
1591 }
1592 
1593 /*
1594  * This code is called after the linker has linked itself and
1595  * fixed it's own GOT. It is safe to make references to externs
1596  * and other non-local data at this point.
1597  */
__linker_init_post_relocation(KernelArgumentBlock & args,Elf32_Addr linker_base)1598 static Elf32_Addr __linker_init_post_relocation(KernelArgumentBlock& args, Elf32_Addr linker_base) {
1599     /* NOTE: we store the args pointer on a special location
1600      *       of the temporary TLS area in order to pass it to
1601      *       the C Library's runtime initializer.
1602      *
1603      *       The initializer must clear the slot and reset the TLS
1604      *       to point to a different location to ensure that no other
1605      *       shared library constructor can access it.
1606      */
1607   __libc_init_tls(args);
1608 
1609 #if TIMING
1610     struct timeval t0, t1;
1611     gettimeofday(&t0, 0);
1612 #endif
1613 
1614     // Initialize environment functions, and get to the ELF aux vectors table.
1615     linker_env_init(args);
1616 
1617     debuggerd_init();
1618 
1619     // Get a few environment variables.
1620     const char* LD_DEBUG = linker_env_get("LD_DEBUG");
1621     if (LD_DEBUG != NULL) {
1622       gLdDebugVerbosity = atoi(LD_DEBUG);
1623     }
1624 
1625     // Normally, these are cleaned by linker_env_init, but the test
1626     // doesn't cost us anything.
1627     const char* ldpath_env = NULL;
1628     const char* ldpreload_env = NULL;
1629     if (!get_AT_SECURE()) {
1630       ldpath_env = linker_env_get("LD_LIBRARY_PATH");
1631       ldpreload_env = linker_env_get("LD_PRELOAD");
1632     }
1633 
1634     INFO("[ android linker & debugger ]");
1635 
1636     soinfo* si = soinfo_alloc(args.argv[0]);
1637     if (si == NULL) {
1638         exit(EXIT_FAILURE);
1639     }
1640 
1641     /* bootstrap the link map, the main exe always needs to be first */
1642     si->flags |= FLAG_EXE;
1643     link_map_t* map = &(si->link_map);
1644 
1645     map->l_addr = 0;
1646     map->l_name = args.argv[0];
1647     map->l_prev = NULL;
1648     map->l_next = NULL;
1649 
1650     _r_debug.r_map = map;
1651     r_debug_tail = map;
1652 
1653     /* gdb expects the linker to be in the debug shared object list.
1654      * Without this, gdb has trouble locating the linker's ".text"
1655      * and ".plt" sections. Gdb could also potentially use this to
1656      * relocate the offset of our exported 'rtld_db_dlactivity' symbol.
1657      * Don't use soinfo_alloc(), because the linker shouldn't
1658      * be on the soinfo list.
1659      */
1660     {
1661         static soinfo linker_soinfo;
1662         strlcpy(linker_soinfo.name, "/system/bin/linker", sizeof(linker_soinfo.name));
1663         linker_soinfo.flags = 0;
1664         linker_soinfo.base = linker_base;
1665 
1666         /*
1667          * Set the dynamic field in the link map otherwise gdb will complain with
1668          * the following:
1669          *   warning: .dynamic section for "/system/bin/linker" is not at the
1670          *   expected address (wrong library or version mismatch?)
1671          */
1672         Elf32_Ehdr *elf_hdr = (Elf32_Ehdr *) linker_base;
1673         Elf32_Phdr *phdr = (Elf32_Phdr*)((unsigned char*) linker_base + elf_hdr->e_phoff);
1674         phdr_table_get_dynamic_section(phdr, elf_hdr->e_phnum, linker_base,
1675                                        &linker_soinfo.dynamic, NULL, NULL);
1676         insert_soinfo_into_debug_map(&linker_soinfo);
1677     }
1678 
1679     // Extract information passed from the kernel.
1680     si->phdr = reinterpret_cast<Elf32_Phdr*>(args.getauxval(AT_PHDR));
1681     si->phnum = args.getauxval(AT_PHNUM);
1682     si->entry = args.getauxval(AT_ENTRY);
1683 
1684     /* Compute the value of si->base. We can't rely on the fact that
1685      * the first entry is the PHDR because this will not be true
1686      * for certain executables (e.g. some in the NDK unit test suite)
1687      */
1688     si->base = 0;
1689     si->size = phdr_table_get_load_size(si->phdr, si->phnum);
1690     si->load_bias = 0;
1691     for (size_t i = 0; i < si->phnum; ++i) {
1692       if (si->phdr[i].p_type == PT_PHDR) {
1693         si->load_bias = reinterpret_cast<Elf32_Addr>(si->phdr) - si->phdr[i].p_vaddr;
1694         si->base = reinterpret_cast<Elf32_Addr>(si->phdr) - si->phdr[i].p_offset;
1695         break;
1696       }
1697     }
1698     si->dynamic = NULL;
1699     si->ref_count = 1;
1700 
1701     // Use LD_LIBRARY_PATH and LD_PRELOAD (but only if we aren't setuid/setgid).
1702     parse_LD_LIBRARY_PATH(ldpath_env);
1703     parse_LD_PRELOAD(ldpreload_env);
1704 
1705     somain = si;
1706 
1707     if (!soinfo_link_image(si)) {
1708         __libc_format_fd(2, "CANNOT LINK EXECUTABLE: %s\n", linker_get_error_buffer());
1709         exit(EXIT_FAILURE);
1710     }
1711 
1712     si->CallPreInitConstructors();
1713 
1714     for (size_t i = 0; gLdPreloads[i] != NULL; ++i) {
1715         gLdPreloads[i]->CallConstructors();
1716     }
1717 
1718     /* After the link_image, the si->load_bias is initialized.
1719      * For so lib, the map->l_addr will be updated in notify_gdb_of_load.
1720      * We need to update this value for so exe here. So Unwind_Backtrace
1721      * for some arch like x86 could work correctly within so exe.
1722      */
1723     map->l_addr = si->load_bias;
1724     si->CallConstructors();
1725 
1726 #if TIMING
1727     gettimeofday(&t1,NULL);
1728     PRINT("LINKER TIME: %s: %d microseconds", args.argv[0], (int) (
1729                (((long long)t1.tv_sec * 1000000LL) + (long long)t1.tv_usec) -
1730                (((long long)t0.tv_sec * 1000000LL) + (long long)t0.tv_usec)
1731                ));
1732 #endif
1733 #if STATS
1734     PRINT("RELO STATS: %s: %d abs, %d rel, %d copy, %d symbol", args.argv[0],
1735            linker_stats.count[kRelocAbsolute],
1736            linker_stats.count[kRelocRelative],
1737            linker_stats.count[kRelocCopy],
1738            linker_stats.count[kRelocSymbol]);
1739 #endif
1740 #if COUNT_PAGES
1741     {
1742         unsigned n;
1743         unsigned i;
1744         unsigned count = 0;
1745         for (n = 0; n < 4096; n++) {
1746             if (bitmask[n]) {
1747                 unsigned x = bitmask[n];
1748                 for (i = 0; i < 8; i++) {
1749                     if (x & 1) {
1750                         count++;
1751                     }
1752                     x >>= 1;
1753                 }
1754             }
1755         }
1756         PRINT("PAGES MODIFIED: %s: %d (%dKB)", args.argv[0], count, count * 4);
1757     }
1758 #endif
1759 
1760 #if TIMING || STATS || COUNT_PAGES
1761     fflush(stdout);
1762 #endif
1763 
1764     TRACE("[ Ready to execute '%s' @ 0x%08x ]", si->name, si->entry);
1765     return si->entry;
1766 }
1767 
1768 /* Compute the load-bias of an existing executable. This shall only
1769  * be used to compute the load bias of an executable or shared library
1770  * that was loaded by the kernel itself.
1771  *
1772  * Input:
1773  *    elf    -> address of ELF header, assumed to be at the start of the file.
1774  * Return:
1775  *    load bias, i.e. add the value of any p_vaddr in the file to get
1776  *    the corresponding address in memory.
1777  */
get_elf_exec_load_bias(const Elf32_Ehdr * elf)1778 static Elf32_Addr get_elf_exec_load_bias(const Elf32_Ehdr* elf) {
1779   Elf32_Addr        offset     = elf->e_phoff;
1780   const Elf32_Phdr* phdr_table = (const Elf32_Phdr*)((char*)elf + offset);
1781   const Elf32_Phdr* phdr_end   = phdr_table + elf->e_phnum;
1782 
1783   for (const Elf32_Phdr* phdr = phdr_table; phdr < phdr_end; phdr++) {
1784     if (phdr->p_type == PT_LOAD) {
1785       return reinterpret_cast<Elf32_Addr>(elf) + phdr->p_offset - phdr->p_vaddr;
1786     }
1787   }
1788   return 0;
1789 }
1790 
1791 /*
1792  * This is the entry point for the linker, called from begin.S. This
1793  * method is responsible for fixing the linker's own relocations, and
1794  * then calling __linker_init_post_relocation().
1795  *
1796  * Because this method is called before the linker has fixed it's own
1797  * relocations, any attempt to reference an extern variable, extern
1798  * function, or other GOT reference will generate a segfault.
1799  */
__linker_init(void * raw_args)1800 extern "C" Elf32_Addr __linker_init(void* raw_args) {
1801   KernelArgumentBlock args(raw_args);
1802 
1803   Elf32_Addr linker_addr = args.getauxval(AT_BASE);
1804 
1805   Elf32_Ehdr* elf_hdr = (Elf32_Ehdr*) linker_addr;
1806   Elf32_Phdr* phdr = (Elf32_Phdr*)((unsigned char*) linker_addr + elf_hdr->e_phoff);
1807 
1808   soinfo linker_so;
1809   memset(&linker_so, 0, sizeof(soinfo));
1810 
1811   linker_so.base = linker_addr;
1812   linker_so.size = phdr_table_get_load_size(phdr, elf_hdr->e_phnum);
1813   linker_so.load_bias = get_elf_exec_load_bias(elf_hdr);
1814   linker_so.dynamic = NULL;
1815   linker_so.phdr = phdr;
1816   linker_so.phnum = elf_hdr->e_phnum;
1817   linker_so.flags |= FLAG_LINKER;
1818 
1819   if (!soinfo_link_image(&linker_so)) {
1820     // It would be nice to print an error message, but if the linker
1821     // can't link itself, there's no guarantee that we'll be able to
1822     // call write() (because it involves a GOT reference).
1823     //
1824     // This situation should never occur unless the linker itself
1825     // is corrupt.
1826     exit(EXIT_FAILURE);
1827   }
1828 
1829   // We have successfully fixed our own relocations. It's safe to run
1830   // the main part of the linker now.
1831   args.abort_message_ptr = &gAbortMessage;
1832   Elf32_Addr start_address = __linker_init_post_relocation(args, linker_addr);
1833 
1834   set_soinfo_pool_protection(PROT_READ);
1835 
1836   // Return the address that the calling assembly stub should jump to.
1837   return start_address;
1838 }
1839