Home | History | Annotate | Download | only in linker
      1 /*
      2  * Copyright (C) 2008, 2009 The Android Open Source Project
      3  * All rights reserved.
      4  *
      5  * Redistribution and use in source and binary forms, with or without
      6  * modification, are permitted provided that the following conditions
      7  * are met:
      8  *  * Redistributions of source code must retain the above copyright
      9  *    notice, this list of conditions and the following disclaimer.
     10  *  * Redistributions in binary form must reproduce the above copyright
     11  *    notice, this list of conditions and the following disclaimer in
     12  *    the documentation and/or other materials provided with the
     13  *    distribution.
     14  *
     15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
     16  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
     17  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
     18  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
     19  * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
     20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
     21  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
     22  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
     23  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
     24  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
     25  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     26  * SUCH DAMAGE.
     27  */
     28 
     29 #include <linux/auxvec.h>
     30 
     31 #include <stdio.h>
     32 #include <stdlib.h>
     33 #include <string.h>
     34 #include <unistd.h>
     35 #include <fcntl.h>
     36 #include <errno.h>
     37 #include <dlfcn.h>
     38 #include <sys/stat.h>
     39 
     40 #include <pthread.h>
     41 
     42 #include <sys/mman.h>
     43 
     44 #include <sys/atomics.h>
     45 
     46 /* special private C library header - see Android.mk */
     47 #include <bionic_tls.h>
     48 
     49 #include "linker.h"
     50 #include "linker_debug.h"
     51 #include "linker_environ.h"
     52 #include "linker_format.h"
     53 
     54 #define ALLOW_SYMBOLS_FROM_MAIN 1
     55 #define SO_MAX 128
     56 
     57 /* Assume average path length of 64 and max 8 paths */
     58 #define LDPATH_BUFSIZE 512
     59 #define LDPATH_MAX 8
     60 
     61 #define LDPRELOAD_BUFSIZE 512
     62 #define LDPRELOAD_MAX 8
     63 
     64 /* >>> IMPORTANT NOTE - READ ME BEFORE MODIFYING <<<
     65  *
     66  * Do NOT use malloc() and friends or pthread_*() code here.
     67  * Don't use printf() either; it's caused mysterious memory
     68  * corruption in the past.
     69  * The linker runs before we bring up libc and it's easiest
     70  * to make sure it does not depend on any complex libc features
     71  *
     72  * open issues / todo:
     73  *
     74  * - are we doing everything we should for ARM_COPY relocations?
     75  * - cleaner error reporting
     76  * - after linking, set as much stuff as possible to READONLY
     77  *   and NOEXEC
     78  * - linker hardcodes PAGE_SIZE and PAGE_MASK because the kernel
     79  *   headers provide versions that are negative...
     80  * - allocate space for soinfo structs dynamically instead of
     81  *   having a hard limit (64)
     82 */
     83 
     84 
     85 static int link_image(soinfo *si, unsigned wr_offset);
     86 
     87 static int socount = 0;
     88 static soinfo sopool[SO_MAX];
     89 static soinfo *freelist = NULL;
     90 static soinfo *solist = &libdl_info;
     91 static soinfo *sonext = &libdl_info;
     92 #if ALLOW_SYMBOLS_FROM_MAIN
     93 static soinfo *somain; /* main process, always the one after libdl_info */
     94 #endif
     95 
     96 
     97 static inline int validate_soinfo(soinfo *si)
     98 {
     99     return (si >= sopool && si < sopool + SO_MAX) ||
    100         si == &libdl_info;
    101 }
    102 
    103 static char ldpaths_buf[LDPATH_BUFSIZE];
    104 static const char *ldpaths[LDPATH_MAX + 1];
    105 
    106 static char ldpreloads_buf[LDPRELOAD_BUFSIZE];
    107 static const char *ldpreload_names[LDPRELOAD_MAX + 1];
    108 
    109 static soinfo *preloads[LDPRELOAD_MAX + 1];
    110 
    111 #if LINKER_DEBUG
    112 int debug_verbosity;
    113 #endif
    114 
    115 static int pid;
    116 
    117 /* This boolean is set if the program being loaded is setuid */
    118 static int program_is_setuid;
    119 
    120 #if STATS
    121 struct _link_stats linker_stats;
    122 #endif
    123 
    124 #if COUNT_PAGES
    125 unsigned bitmask[4096];
    126 #endif
    127 
    128 #ifndef PT_ARM_EXIDX
    129 #define PT_ARM_EXIDX    0x70000001      /* .ARM.exidx segment */
    130 #endif
    131 
    132 #define HOODLUM(name, ret, ...)                                               \
    133     ret name __VA_ARGS__                                                      \
    134     {                                                                         \
    135         char errstr[] = "ERROR: " #name " called from the dynamic linker!\n"; \
    136         write(2, errstr, sizeof(errstr));                                     \
    137         abort();                                                              \
    138     }
    139 HOODLUM(malloc, void *, (size_t size));
    140 HOODLUM(free, void, (void *ptr));
    141 HOODLUM(realloc, void *, (void *ptr, size_t size));
    142 HOODLUM(calloc, void *, (size_t cnt, size_t size));
    143 
    144 static char tmp_err_buf[768];
    145 static char __linker_dl_err_buf[768];
    146 #define DL_ERR(fmt, x...)                                                     \
    147     do {                                                                      \
    148         format_buffer(__linker_dl_err_buf, sizeof(__linker_dl_err_buf),            \
    149                  "%s[%d]: " fmt, __func__, __LINE__, ##x);                    \
    150         ERROR(fmt "\n", ##x);                                                      \
    151     } while(0)
    152 
    153 const char *linker_get_error(void)
    154 {
    155     return (const char *)&__linker_dl_err_buf[0];
    156 }
    157 
    158 /*
    159  * This function is an empty stub where GDB locates a breakpoint to get notified
    160  * about linker activity.
    161  */
    162 extern void __attribute__((noinline)) rtld_db_dlactivity(void);
    163 
    164 static struct r_debug _r_debug = {1, NULL, &rtld_db_dlactivity,
    165                                   RT_CONSISTENT, 0};
    166 static struct link_map *r_debug_tail = 0;
    167 
    168 static pthread_mutex_t _r_debug_lock = PTHREAD_MUTEX_INITIALIZER;
    169 
    170 static void insert_soinfo_into_debug_map(soinfo * info)
    171 {
    172     struct link_map * map;
    173 
    174     /* Copy the necessary fields into the debug structure.
    175      */
    176     map = &(info->linkmap);
    177     map->l_addr = info->base;
    178     map->l_name = (char*) info->name;
    179     map->l_ld = (uintptr_t)info->dynamic;
    180 
    181     /* Stick the new library at the end of the list.
    182      * gdb tends to care more about libc than it does
    183      * about leaf libraries, and ordering it this way
    184      * reduces the back-and-forth over the wire.
    185      */
    186     if (r_debug_tail) {
    187         r_debug_tail->l_next = map;
    188         map->l_prev = r_debug_tail;
    189         map->l_next = 0;
    190     } else {
    191         _r_debug.r_map = map;
    192         map->l_prev = 0;
    193         map->l_next = 0;
    194     }
    195     r_debug_tail = map;
    196 }
    197 
    198 static void remove_soinfo_from_debug_map(soinfo * info)
    199 {
    200     struct link_map * map = &(info->linkmap);
    201 
    202     if (r_debug_tail == map)
    203         r_debug_tail = map->l_prev;
    204 
    205     if (map->l_prev) map->l_prev->l_next = map->l_next;
    206     if (map->l_next) map->l_next->l_prev = map->l_prev;
    207 }
    208 
    209 void notify_gdb_of_load(soinfo * info)
    210 {
    211     if (info->flags & FLAG_EXE) {
    212         // GDB already knows about the main executable
    213         return;
    214     }
    215 
    216     pthread_mutex_lock(&_r_debug_lock);
    217 
    218     _r_debug.r_state = RT_ADD;
    219     rtld_db_dlactivity();
    220 
    221     insert_soinfo_into_debug_map(info);
    222 
    223     _r_debug.r_state = RT_CONSISTENT;
    224     rtld_db_dlactivity();
    225 
    226     pthread_mutex_unlock(&_r_debug_lock);
    227 }
    228 
    229 void notify_gdb_of_unload(soinfo * info)
    230 {
    231     if (info->flags & FLAG_EXE) {
    232         // GDB already knows about the main executable
    233         return;
    234     }
    235 
    236     pthread_mutex_lock(&_r_debug_lock);
    237 
    238     _r_debug.r_state = RT_DELETE;
    239     rtld_db_dlactivity();
    240 
    241     remove_soinfo_from_debug_map(info);
    242 
    243     _r_debug.r_state = RT_CONSISTENT;
    244     rtld_db_dlactivity();
    245 
    246     pthread_mutex_unlock(&_r_debug_lock);
    247 }
    248 
    249 void notify_gdb_of_libraries()
    250 {
    251     _r_debug.r_state = RT_ADD;
    252     rtld_db_dlactivity();
    253     _r_debug.r_state = RT_CONSISTENT;
    254     rtld_db_dlactivity();
    255 }
    256 
    257 static soinfo *alloc_info(const char *name)
    258 {
    259     soinfo *si;
    260 
    261     if(strlen(name) >= SOINFO_NAME_LEN) {
    262         DL_ERR("%5d library name %s too long", pid, name);
    263         return NULL;
    264     }
    265 
    266     /* The freelist is populated when we call free_info(), which in turn is
    267        done only by dlclose(), which is not likely to be used.
    268     */
    269     if (!freelist) {
    270         if(socount == SO_MAX) {
    271             DL_ERR("%5d too many libraries when loading %s", pid, name);
    272             return NULL;
    273         }
    274         freelist = sopool + socount++;
    275         freelist->next = NULL;
    276     }
    277 
    278     si = freelist;
    279     freelist = freelist->next;
    280 
    281     /* Make sure we get a clean block of soinfo */
    282     memset(si, 0, sizeof(soinfo));
    283     strlcpy((char*) si->name, name, sizeof(si->name));
    284     sonext->next = si;
    285     si->next = NULL;
    286     si->refcount = 0;
    287     sonext = si;
    288 
    289     TRACE("%5d name %s: allocated soinfo @ %p\n", pid, name, si);
    290     return si;
    291 }
    292 
    293 static void free_info(soinfo *si)
    294 {
    295     soinfo *prev = NULL, *trav;
    296 
    297     TRACE("%5d name %s: freeing soinfo @ %p\n", pid, si->name, si);
    298 
    299     for(trav = solist; trav != NULL; trav = trav->next){
    300         if (trav == si)
    301             break;
    302         prev = trav;
    303     }
    304     if (trav == NULL) {
    305         /* si was not ni solist */
    306         DL_ERR("%5d name %s is not in solist!", pid, si->name);
    307         return;
    308     }
    309 
    310     /* prev will never be NULL, because the first entry in solist is
    311        always the static libdl_info.
    312     */
    313     prev->next = si->next;
    314     if (si == sonext) sonext = prev;
    315     si->next = freelist;
    316     freelist = si;
    317 }
    318 
    319 const char *addr_to_name(unsigned addr)
    320 {
    321     soinfo *si;
    322 
    323     for(si = solist; si != 0; si = si->next){
    324         if((addr >= si->base) && (addr < (si->base + si->size))) {
    325             return si->name;
    326         }
    327     }
    328 
    329     return "";
    330 }
    331 
    332 /* For a given PC, find the .so that it belongs to.
    333  * Returns the base address of the .ARM.exidx section
    334  * for that .so, and the number of 8-byte entries
    335  * in that section (via *pcount).
    336  *
    337  * Intended to be called by libc's __gnu_Unwind_Find_exidx().
    338  *
    339  * This function is exposed via dlfcn.c and libdl.so.
    340  */
    341 #ifdef ANDROID_ARM_LINKER
    342 _Unwind_Ptr dl_unwind_find_exidx(_Unwind_Ptr pc, int *pcount)
    343 {
    344     soinfo *si;
    345     unsigned addr = (unsigned)pc;
    346 
    347     for (si = solist; si != 0; si = si->next){
    348         if ((addr >= si->base) && (addr < (si->base + si->size))) {
    349             *pcount = si->ARM_exidx_count;
    350             return (_Unwind_Ptr)(si->base + (unsigned long)si->ARM_exidx);
    351         }
    352     }
    353    *pcount = 0;
    354     return NULL;
    355 }
    356 #elif defined(ANDROID_X86_LINKER)
    357 /* Here, we only have to provide a callback to iterate across all the
    358  * loaded libraries. gcc_eh does the rest. */
    359 int
    360 dl_iterate_phdr(int (*cb)(struct dl_phdr_info *info, size_t size, void *data),
    361                 void *data)
    362 {
    363     soinfo *si;
    364     struct dl_phdr_info dl_info;
    365     int rv = 0;
    366 
    367     for (si = solist; si != NULL; si = si->next) {
    368         dl_info.dlpi_addr = si->linkmap.l_addr;
    369         dl_info.dlpi_name = si->linkmap.l_name;
    370         dl_info.dlpi_phdr = si->phdr;
    371         dl_info.dlpi_phnum = si->phnum;
    372         rv = cb(&dl_info, sizeof (struct dl_phdr_info), data);
    373         if (rv != 0)
    374             break;
    375     }
    376     return rv;
    377 }
    378 #endif
    379 
    380 static Elf32_Sym *_elf_lookup(soinfo *si, unsigned hash, const char *name)
    381 {
    382     Elf32_Sym *s;
    383     Elf32_Sym *symtab = si->symtab;
    384     const char *strtab = si->strtab;
    385     unsigned n;
    386 
    387     TRACE_TYPE(LOOKUP, "%5d SEARCH %s in %s@0x%08x %08x %d\n", pid,
    388                name, si->name, si->base, hash, hash % si->nbucket);
    389     n = hash % si->nbucket;
    390 
    391     for(n = si->bucket[hash % si->nbucket]; n != 0; n = si->chain[n]){
    392         s = symtab + n;
    393         if(strcmp(strtab + s->st_name, name)) continue;
    394 
    395             /* only concern ourselves with global and weak symbol definitions */
    396         switch(ELF32_ST_BIND(s->st_info)){
    397         case STB_GLOBAL:
    398         case STB_WEAK:
    399                 /* no section == undefined */
    400             if(s->st_shndx == 0) continue;
    401 
    402             TRACE_TYPE(LOOKUP, "%5d FOUND %s in %s (%08x) %d\n", pid,
    403                        name, si->name, s->st_value, s->st_size);
    404             return s;
    405         }
    406     }
    407 
    408     return NULL;
    409 }
    410 
    411 static unsigned elfhash(const char *_name)
    412 {
    413     const unsigned char *name = (const unsigned char *) _name;
    414     unsigned h = 0, g;
    415 
    416     while(*name) {
    417         h = (h << 4) + *name++;
    418         g = h & 0xf0000000;
    419         h ^= g;
    420         h ^= g >> 24;
    421     }
    422     return h;
    423 }
    424 
    425 static Elf32_Sym *
    426 _do_lookup(soinfo *si, const char *name, unsigned *base)
    427 {
    428     unsigned elf_hash = elfhash(name);
    429     Elf32_Sym *s;
    430     unsigned *d;
    431     soinfo *lsi = si;
    432     int i;
    433 
    434     /* Look for symbols in the local scope (the object who is
    435      * searching). This happens with C++ templates on i386 for some
    436      * reason.
    437      *
    438      * Notes on weak symbols:
    439      * The ELF specs are ambigious about treatment of weak definitions in
    440      * dynamic linking.  Some systems return the first definition found
    441      * and some the first non-weak definition.   This is system dependent.
    442      * Here we return the first definition found for simplicity.  */
    443 
    444     s = _elf_lookup(si, elf_hash, name);
    445     if(s != NULL)
    446         goto done;
    447 
    448     /* Next, look for it in the preloads list */
    449     for(i = 0; preloads[i] != NULL; i++) {
    450         lsi = preloads[i];
    451         s = _elf_lookup(lsi, elf_hash, name);
    452         if(s != NULL)
    453             goto done;
    454     }
    455 
    456     for(d = si->dynamic; *d; d += 2) {
    457         if(d[0] == DT_NEEDED){
    458             lsi = (soinfo *)d[1];
    459             if (!validate_soinfo(lsi)) {
    460                 DL_ERR("%5d bad DT_NEEDED pointer in %s",
    461                        pid, si->name);
    462                 return NULL;
    463             }
    464 
    465             DEBUG("%5d %s: looking up %s in %s\n",
    466                   pid, si->name, name, lsi->name);
    467             s = _elf_lookup(lsi, elf_hash, name);
    468             if ((s != NULL) && (s->st_shndx != SHN_UNDEF))
    469                 goto done;
    470         }
    471     }
    472 
    473 #if ALLOW_SYMBOLS_FROM_MAIN
    474     /* If we are resolving relocations while dlopen()ing a library, it's OK for
    475      * the library to resolve a symbol that's defined in the executable itself,
    476      * although this is rare and is generally a bad idea.
    477      */
    478     if (somain) {
    479         lsi = somain;
    480         DEBUG("%5d %s: looking up %s in executable %s\n",
    481               pid, si->name, name, lsi->name);
    482         s = _elf_lookup(lsi, elf_hash, name);
    483     }
    484 #endif
    485 
    486 done:
    487     if(s != NULL) {
    488         TRACE_TYPE(LOOKUP, "%5d si %s sym %s s->st_value = 0x%08x, "
    489                    "found in %s, base = 0x%08x\n",
    490                    pid, si->name, name, s->st_value, lsi->name, lsi->base);
    491         *base = lsi->base;
    492         return s;
    493     }
    494 
    495     return NULL;
    496 }
    497 
    498 /* This is used by dl_sym().  It performs symbol lookup only within the
    499    specified soinfo object and not in any of its dependencies.
    500  */
    501 Elf32_Sym *lookup_in_library(soinfo *si, const char *name)
    502 {
    503     return _elf_lookup(si, elfhash(name), name);
    504 }
    505 
    506 /* This is used by dl_sym().  It performs a global symbol lookup.
    507  */
    508 Elf32_Sym *lookup(const char *name, soinfo **found, soinfo *start)
    509 {
    510     unsigned elf_hash = elfhash(name);
    511     Elf32_Sym *s = NULL;
    512     soinfo *si;
    513 
    514     if(start == NULL) {
    515         start = solist;
    516     }
    517 
    518     for(si = start; (s == NULL) && (si != NULL); si = si->next)
    519     {
    520         if(si->flags & FLAG_ERROR)
    521             continue;
    522         s = _elf_lookup(si, elf_hash, name);
    523         if (s != NULL) {
    524             *found = si;
    525             break;
    526         }
    527     }
    528 
    529     if(s != NULL) {
    530         TRACE_TYPE(LOOKUP, "%5d %s s->st_value = 0x%08x, "
    531                    "si->base = 0x%08x\n", pid, name, s->st_value, si->base);
    532         return s;
    533     }
    534 
    535     return NULL;
    536 }
    537 
    538 soinfo *find_containing_library(const void *addr)
    539 {
    540     soinfo *si;
    541 
    542     for(si = solist; si != NULL; si = si->next)
    543     {
    544         if((unsigned)addr >= si->base && (unsigned)addr - si->base < si->size) {
    545             return si;
    546         }
    547     }
    548 
    549     return NULL;
    550 }
    551 
    552 Elf32_Sym *find_containing_symbol(const void *addr, soinfo *si)
    553 {
    554     unsigned int i;
    555     unsigned soaddr = (unsigned)addr - si->base;
    556 
    557     /* Search the library's symbol table for any defined symbol which
    558      * contains this address */
    559     for(i=0; i<si->nchain; i++) {
    560         Elf32_Sym *sym = &si->symtab[i];
    561 
    562         if(sym->st_shndx != SHN_UNDEF &&
    563            soaddr >= sym->st_value &&
    564            soaddr < sym->st_value + sym->st_size) {
    565             return sym;
    566         }
    567     }
    568 
    569     return NULL;
    570 }
    571 
    572 #if 0
    573 static void dump(soinfo *si)
    574 {
    575     Elf32_Sym *s = si->symtab;
    576     unsigned n;
    577 
    578     for(n = 0; n < si->nchain; n++) {
    579         TRACE("%5d %04d> %08x: %02x %04x %08x %08x %s\n", pid, n, s,
    580                s->st_info, s->st_shndx, s->st_value, s->st_size,
    581                si->strtab + s->st_name);
    582         s++;
    583     }
    584 }
    585 #endif
    586 
    587 static const char *sopaths[] = {
    588     "/vendor/lib",
    589     "/system/lib",
    590     0
    591 };
    592 
    593 static int _open_lib(const char *name)
    594 {
    595     int fd;
    596     struct stat filestat;
    597 
    598     if ((stat(name, &filestat) >= 0) && S_ISREG(filestat.st_mode)) {
    599         if ((fd = open(name, O_RDONLY)) >= 0)
    600             return fd;
    601     }
    602 
    603     return -1;
    604 }
    605 
    606 static int open_library(const char *name)
    607 {
    608     int fd;
    609     char buf[512];
    610     const char **path;
    611     int n;
    612 
    613     TRACE("[ %5d opening %s ]\n", pid, name);
    614 
    615     if(name == 0) return -1;
    616     if(strlen(name) > 256) return -1;
    617 
    618     if ((name[0] == '/') && ((fd = _open_lib(name)) >= 0))
    619         return fd;
    620 
    621     for (path = ldpaths; *path; path++) {
    622         n = format_buffer(buf, sizeof(buf), "%s/%s", *path, name);
    623         if (n < 0 || n >= (int)sizeof(buf)) {
    624             WARN("Ignoring very long library path: %s/%s\n", *path, name);
    625             continue;
    626         }
    627         if ((fd = _open_lib(buf)) >= 0)
    628             return fd;
    629     }
    630     for (path = sopaths; *path; path++) {
    631         n = format_buffer(buf, sizeof(buf), "%s/%s", *path, name);
    632         if (n < 0 || n >= (int)sizeof(buf)) {
    633             WARN("Ignoring very long library path: %s/%s\n", *path, name);
    634             continue;
    635         }
    636         if ((fd = _open_lib(buf)) >= 0)
    637             return fd;
    638     }
    639 
    640     return -1;
    641 }
    642 
    643 /* temporary space for holding the first page of the shared lib
    644  * which contains the elf header (with the pht). */
    645 static unsigned char __header[PAGE_SIZE];
    646 
    647 typedef struct {
    648     long mmap_addr;
    649     char tag[4]; /* 'P', 'R', 'E', ' ' */
    650 } prelink_info_t;
    651 
    652 /* Returns the requested base address if the library is prelinked,
    653  * and 0 otherwise.  */
    654 static unsigned long
    655 is_prelinked(int fd, const char *name)
    656 {
    657     off_t sz;
    658     prelink_info_t info;
    659 
    660     sz = lseek(fd, -sizeof(prelink_info_t), SEEK_END);
    661     if (sz < 0) {
    662         DL_ERR("lseek() failed!");
    663         return 0;
    664     }
    665 
    666     if (read(fd, &info, sizeof(info)) != sizeof(info)) {
    667         WARN("Could not read prelink_info_t structure for `%s`\n", name);
    668         return 0;
    669     }
    670 
    671     if (strncmp(info.tag, "PRE ", 4)) {
    672         WARN("`%s` is not a prelinked library\n", name);
    673         return 0;
    674     }
    675 
    676     return (unsigned long)info.mmap_addr;
    677 }
    678 
    679 /* verify_elf_object
    680  *      Verifies if the object @ base is a valid ELF object
    681  *
    682  * Args:
    683  *
    684  * Returns:
    685  *       0 on success
    686  *      -1 if no valid ELF object is found @ base.
    687  */
    688 static int
    689 verify_elf_object(void *base, const char *name)
    690 {
    691     Elf32_Ehdr *hdr = (Elf32_Ehdr *) base;
    692 
    693     if (hdr->e_ident[EI_MAG0] != ELFMAG0) return -1;
    694     if (hdr->e_ident[EI_MAG1] != ELFMAG1) return -1;
    695     if (hdr->e_ident[EI_MAG2] != ELFMAG2) return -1;
    696     if (hdr->e_ident[EI_MAG3] != ELFMAG3) return -1;
    697 
    698     /* TODO: Should we verify anything else in the header? */
    699 #ifdef ANDROID_ARM_LINKER
    700     if (hdr->e_machine != EM_ARM) return -1;
    701 #elif defined(ANDROID_X86_LINKER)
    702     if (hdr->e_machine != EM_386) return -1;
    703 #endif
    704     return 0;
    705 }
    706 
    707 
    708 /* get_lib_extents
    709  *      Retrieves the base (*base) address where the ELF object should be
    710  *      mapped and its overall memory size (*total_sz).
    711  *
    712  * Args:
    713  *      fd: Opened file descriptor for the library
    714  *      name: The name of the library
    715  *      _hdr: Pointer to the header page of the library
    716  *      total_sz: Total size of the memory that should be allocated for
    717  *                this library
    718  *
    719  * Returns:
    720  *      -1 if there was an error while trying to get the lib extents.
    721  *         The possible reasons are:
    722  *             - Could not determine if the library was prelinked.
    723  *             - The library provided is not a valid ELF object
    724  *       0 if the library did not request a specific base offset (normal
    725  *         for non-prelinked libs)
    726  *     > 0 if the library requests a specific address to be mapped to.
    727  *         This indicates a pre-linked library.
    728  */
    729 static unsigned
    730 get_lib_extents(int fd, const char *name, void *__hdr, unsigned *total_sz)
    731 {
    732     unsigned req_base;
    733     unsigned min_vaddr = 0xffffffff;
    734     unsigned max_vaddr = 0;
    735     unsigned char *_hdr = (unsigned char *)__hdr;
    736     Elf32_Ehdr *ehdr = (Elf32_Ehdr *)_hdr;
    737     Elf32_Phdr *phdr;
    738     int cnt;
    739 
    740     TRACE("[ %5d Computing extents for '%s'. ]\n", pid, name);
    741     if (verify_elf_object(_hdr, name) < 0) {
    742         DL_ERR("%5d - %s is not a valid ELF object", pid, name);
    743         return (unsigned)-1;
    744     }
    745 
    746     req_base = (unsigned) is_prelinked(fd, name);
    747     if (req_base == (unsigned)-1)
    748         return -1;
    749     else if (req_base != 0) {
    750         TRACE("[ %5d - Prelinked library '%s' requesting base @ 0x%08x ]\n",
    751               pid, name, req_base);
    752     } else {
    753         TRACE("[ %5d - Non-prelinked library '%s' found. ]\n", pid, name);
    754     }
    755 
    756     phdr = (Elf32_Phdr *)(_hdr + ehdr->e_phoff);
    757 
    758     /* find the min/max p_vaddrs from all the PT_LOAD segments so we can
    759      * get the range. */
    760     for (cnt = 0; cnt < ehdr->e_phnum; ++cnt, ++phdr) {
    761         if (phdr->p_type == PT_LOAD) {
    762             if ((phdr->p_vaddr + phdr->p_memsz) > max_vaddr)
    763                 max_vaddr = phdr->p_vaddr + phdr->p_memsz;
    764             if (phdr->p_vaddr < min_vaddr)
    765                 min_vaddr = phdr->p_vaddr;
    766         }
    767     }
    768 
    769     if ((min_vaddr == 0xffffffff) && (max_vaddr == 0)) {
    770         DL_ERR("%5d - No loadable segments found in %s.", pid, name);
    771         return (unsigned)-1;
    772     }
    773 
    774     /* truncate min_vaddr down to page boundary */
    775     min_vaddr &= ~PAGE_MASK;
    776 
    777     /* round max_vaddr up to the next page */
    778     max_vaddr = (max_vaddr + PAGE_SIZE - 1) & ~PAGE_MASK;
    779 
    780     *total_sz = (max_vaddr - min_vaddr);
    781     return (unsigned)req_base;
    782 }
    783 
    784 /* reserve_mem_region
    785  *
    786  *     This function reserves a chunk of memory to be used for mapping in
    787  *     a prelinked shared library. We reserve the entire memory region here, and
    788  *     then the rest of the linker will relocate the individual loadable
    789  *     segments into the correct locations within this memory range.
    790  *
    791  * Args:
    792  *     si->base: The requested base of the allocation.
    793  *     si->size: The size of the allocation.
    794  *
    795  * Returns:
    796  *     -1 on failure, and 0 on success.  On success, si->base will contain
    797  *     the virtual address at which the library will be mapped.
    798  */
    799 
    800 static int reserve_mem_region(soinfo *si)
    801 {
    802     void *base = mmap((void *)si->base, si->size, PROT_NONE,
    803                       MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    804     if (base == MAP_FAILED) {
    805         DL_ERR("%5d can NOT map (%sprelinked) library '%s' at 0x%08x "
    806               "as requested, will try general pool: %d (%s)",
    807               pid, (si->base ? "" : "non-"), si->name, si->base,
    808               errno, strerror(errno));
    809         return -1;
    810     } else if (base != (void *)si->base) {
    811         DL_ERR("OOPS: %5d %sprelinked library '%s' mapped at 0x%08x, "
    812               "not at 0x%08x", pid, (si->base ? "" : "non-"),
    813               si->name, (unsigned)base, si->base);
    814         munmap(base, si->size);
    815         return -1;
    816     }
    817     return 0;
    818 }
    819 
    820 static int alloc_mem_region(soinfo *si)
    821 {
    822     if (si->base) {
    823         /* Attempt to mmap a prelinked library. */
    824         return reserve_mem_region(si);
    825     }
    826 
    827     /* This is not a prelinked library, so we use the kernel's default
    828        allocator.
    829     */
    830 
    831     void *base = mmap(NULL, si->size, PROT_NONE,
    832                       MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    833     if (base == MAP_FAILED) {
    834         DL_ERR("%5d mmap of library '%s' failed: %d (%s)\n",
    835               pid, si->name,
    836               errno, strerror(errno));
    837         goto err;
    838     }
    839     si->base = (unsigned) base;
    840     PRINT("%5d mapped library '%s' to %08x via kernel allocator.\n",
    841           pid, si->name, si->base);
    842     return 0;
    843 
    844 err:
    845     DL_ERR("OOPS: %5d cannot map library '%s'. no vspace available.",
    846           pid, si->name);
    847     return -1;
    848 }
    849 
    850 #define MAYBE_MAP_FLAG(x,from,to)    (((x) & (from)) ? (to) : 0)
    851 #define PFLAGS_TO_PROT(x)            (MAYBE_MAP_FLAG((x), PF_X, PROT_EXEC) | \
    852                                       MAYBE_MAP_FLAG((x), PF_R, PROT_READ) | \
    853                                       MAYBE_MAP_FLAG((x), PF_W, PROT_WRITE))
    854 /* load_segments
    855  *
    856  *     This function loads all the loadable (PT_LOAD) segments into memory
    857  *     at their appropriate memory offsets off the base address.
    858  *
    859  * Args:
    860  *     fd: Open file descriptor to the library to load.
    861  *     header: Pointer to a header page that contains the ELF header.
    862  *             This is needed since we haven't mapped in the real file yet.
    863  *     si: ptr to soinfo struct describing the shared object.
    864  *
    865  * Returns:
    866  *     0 on success, -1 on failure.
    867  */
    868 static int
    869 load_segments(int fd, void *header, soinfo *si)
    870 {
    871     Elf32_Ehdr *ehdr = (Elf32_Ehdr *)header;
    872     Elf32_Phdr *phdr = (Elf32_Phdr *)((unsigned char *)header + ehdr->e_phoff);
    873     Elf32_Addr base = (Elf32_Addr) si->base;
    874     int cnt;
    875     unsigned len;
    876     Elf32_Addr tmp;
    877     unsigned char *pbase;
    878     unsigned char *extra_base;
    879     unsigned extra_len;
    880     unsigned total_sz = 0;
    881 
    882     si->wrprotect_start = 0xffffffff;
    883     si->wrprotect_end = 0;
    884 
    885     TRACE("[ %5d - Begin loading segments for '%s' @ 0x%08x ]\n",
    886           pid, si->name, (unsigned)si->base);
    887     /* Now go through all the PT_LOAD segments and map them into memory
    888      * at the appropriate locations. */
    889     for (cnt = 0; cnt < ehdr->e_phnum; ++cnt, ++phdr) {
    890         if (phdr->p_type == PT_LOAD) {
    891             DEBUG_DUMP_PHDR(phdr, "PT_LOAD", pid);
    892             /* we want to map in the segment on a page boundary */
    893             tmp = base + (phdr->p_vaddr & (~PAGE_MASK));
    894             /* add the # of bytes we masked off above to the total length. */
    895             len = phdr->p_filesz + (phdr->p_vaddr & PAGE_MASK);
    896 
    897             TRACE("[ %d - Trying to load segment from '%s' @ 0x%08x "
    898                   "(0x%08x). p_vaddr=0x%08x p_offset=0x%08x ]\n", pid, si->name,
    899                   (unsigned)tmp, len, phdr->p_vaddr, phdr->p_offset);
    900             pbase = mmap((void *)tmp, len, PFLAGS_TO_PROT(phdr->p_flags),
    901                          MAP_PRIVATE | MAP_FIXED, fd,
    902                          phdr->p_offset & (~PAGE_MASK));
    903             if (pbase == MAP_FAILED) {
    904                 DL_ERR("%d failed to map segment from '%s' @ 0x%08x (0x%08x). "
    905                       "p_vaddr=0x%08x p_offset=0x%08x", pid, si->name,
    906                       (unsigned)tmp, len, phdr->p_vaddr, phdr->p_offset);
    907                 goto fail;
    908             }
    909 
    910             /* If 'len' didn't end on page boundary, and it's a writable
    911              * segment, zero-fill the rest. */
    912             if ((len & PAGE_MASK) && (phdr->p_flags & PF_W))
    913                 memset((void *)(pbase + len), 0, PAGE_SIZE - (len & PAGE_MASK));
    914 
    915             /* Check to see if we need to extend the map for this segment to
    916              * cover the diff between filesz and memsz (i.e. for bss).
    917              *
    918              *  base           _+---------------------+  page boundary
    919              *                  .                     .
    920              *                  |                     |
    921              *                  .                     .
    922              *  pbase          _+---------------------+  page boundary
    923              *                  |                     |
    924              *                  .                     .
    925              *  base + p_vaddr _|                     |
    926              *                  . \          \        .
    927              *                  . | filesz   |        .
    928              *  pbase + len    _| /          |        |
    929              *     <0 pad>      .            .        .
    930              *  extra_base     _+------------|--------+  page boundary
    931              *               /  .            .        .
    932              *               |  .            .        .
    933              *               |  +------------|--------+  page boundary
    934              *  extra_len->  |  |            |        |
    935              *               |  .            | memsz  .
    936              *               |  .            |        .
    937              *               \ _|            /        |
    938              *                  .                     .
    939              *                  |                     |
    940              *                 _+---------------------+  page boundary
    941              */
    942             tmp = (Elf32_Addr)(((unsigned)pbase + len + PAGE_SIZE - 1) &
    943                                     (~PAGE_MASK));
    944             if (tmp < (base + phdr->p_vaddr + phdr->p_memsz)) {
    945                 extra_len = base + phdr->p_vaddr + phdr->p_memsz - tmp;
    946                 TRACE("[ %5d - Need to extend segment from '%s' @ 0x%08x "
    947                       "(0x%08x) ]\n", pid, si->name, (unsigned)tmp, extra_len);
    948                 /* map in the extra page(s) as anonymous into the range.
    949                  * This is probably not necessary as we already mapped in
    950                  * the entire region previously, but we just want to be
    951                  * sure. This will also set the right flags on the region
    952                  * (though we can probably accomplish the same thing with
    953                  * mprotect).
    954                  */
    955                 extra_base = mmap((void *)tmp, extra_len,
    956                                   PFLAGS_TO_PROT(phdr->p_flags),
    957                                   MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS,
    958                                   -1, 0);
    959                 if (extra_base == MAP_FAILED) {
    960                     DL_ERR("[ %5d - failed to extend segment from '%s' @ 0x%08x"
    961                            " (0x%08x) ]", pid, si->name, (unsigned)tmp,
    962                           extra_len);
    963                     goto fail;
    964                 }
    965                 /* TODO: Check if we need to memset-0 this region.
    966                  * Anonymous mappings are zero-filled copy-on-writes, so we
    967                  * shouldn't need to. */
    968                 TRACE("[ %5d - Segment from '%s' extended @ 0x%08x "
    969                       "(0x%08x)\n", pid, si->name, (unsigned)extra_base,
    970                       extra_len);
    971             }
    972             /* set the len here to show the full extent of the segment we
    973              * just loaded, mostly for debugging */
    974             len = (((unsigned)base + phdr->p_vaddr + phdr->p_memsz +
    975                     PAGE_SIZE - 1) & (~PAGE_MASK)) - (unsigned)pbase;
    976             TRACE("[ %5d - Successfully loaded segment from '%s' @ 0x%08x "
    977                   "(0x%08x). p_vaddr=0x%08x p_offset=0x%08x\n", pid, si->name,
    978                   (unsigned)pbase, len, phdr->p_vaddr, phdr->p_offset);
    979             total_sz += len;
    980             /* Make the section writable just in case we'll have to write to
    981              * it during relocation (i.e. text segment). However, we will
    982              * remember what range of addresses should be write protected.
    983              *
    984              */
    985             if (!(phdr->p_flags & PF_W)) {
    986                 if ((unsigned)pbase < si->wrprotect_start)
    987                     si->wrprotect_start = (unsigned)pbase;
    988                 if (((unsigned)pbase + len) > si->wrprotect_end)
    989                     si->wrprotect_end = (unsigned)pbase + len;
    990                 mprotect(pbase, len,
    991                          PFLAGS_TO_PROT(phdr->p_flags) | PROT_WRITE);
    992             }
    993         } else if (phdr->p_type == PT_DYNAMIC) {
    994             DEBUG_DUMP_PHDR(phdr, "PT_DYNAMIC", pid);
    995             /* this segment contains the dynamic linking information */
    996             si->dynamic = (unsigned *)(base + phdr->p_vaddr);
    997         } else if (phdr->p_type == PT_GNU_RELRO) {
    998             if ((phdr->p_vaddr >= si->size)
    999                     || ((phdr->p_vaddr + phdr->p_memsz) > si->size)
   1000                     || ((base + phdr->p_vaddr + phdr->p_memsz) < base)) {
   1001                 DL_ERR("%d invalid GNU_RELRO in '%s' "
   1002                        "p_vaddr=0x%08x p_memsz=0x%08x", pid, si->name,
   1003                        phdr->p_vaddr, phdr->p_memsz);
   1004                 goto fail;
   1005             }
   1006             si->gnu_relro_start = (Elf32_Addr) (base + phdr->p_vaddr);
   1007             si->gnu_relro_len = (unsigned) phdr->p_memsz;
   1008         } else {
   1009 #ifdef ANDROID_ARM_LINKER
   1010             if (phdr->p_type == PT_ARM_EXIDX) {
   1011                 DEBUG_DUMP_PHDR(phdr, "PT_ARM_EXIDX", pid);
   1012                 /* exidx entries (used for stack unwinding) are 8 bytes each.
   1013                  */
   1014                 si->ARM_exidx = (unsigned *)phdr->p_vaddr;
   1015                 si->ARM_exidx_count = phdr->p_memsz / 8;
   1016             }
   1017 #endif
   1018         }
   1019 
   1020     }
   1021 
   1022     /* Sanity check */
   1023     if (total_sz > si->size) {
   1024         DL_ERR("%5d - Total length (0x%08x) of mapped segments from '%s' is "
   1025               "greater than what was allocated (0x%08x). THIS IS BAD!",
   1026               pid, total_sz, si->name, si->size);
   1027         goto fail;
   1028     }
   1029 
   1030     TRACE("[ %5d - Finish loading segments for '%s' @ 0x%08x. "
   1031           "Total memory footprint: 0x%08x bytes ]\n", pid, si->name,
   1032           (unsigned)si->base, si->size);
   1033     return 0;
   1034 
   1035 fail:
   1036     /* We can just blindly unmap the entire region even though some things
   1037      * were mapped in originally with anonymous and others could have been
   1038      * been mapped in from the file before we failed. The kernel will unmap
   1039      * all the pages in the range, irrespective of how they got there.
   1040      */
   1041     munmap((void *)si->base, si->size);
   1042     si->flags |= FLAG_ERROR;
   1043     return -1;
   1044 }
   1045 
   1046 /* TODO: Implement this to take care of the fact that Android ARM
   1047  * ELF objects shove everything into a single loadable segment that has the
   1048  * write bit set. wr_offset is then used to set non-(data|bss) pages to be
   1049  * non-writable.
   1050  */
   1051 #if 0
   1052 static unsigned
   1053 get_wr_offset(int fd, const char *name, Elf32_Ehdr *ehdr)
   1054 {
   1055     Elf32_Shdr *shdr_start;
   1056     Elf32_Shdr *shdr;
   1057     int shdr_sz = ehdr->e_shnum * sizeof(Elf32_Shdr);
   1058     int cnt;
   1059     unsigned wr_offset = 0xffffffff;
   1060 
   1061     shdr_start = mmap(0, shdr_sz, PROT_READ, MAP_PRIVATE, fd,
   1062                       ehdr->e_shoff & (~PAGE_MASK));
   1063     if (shdr_start == MAP_FAILED) {
   1064         WARN("%5d - Could not read section header info from '%s'. Will not "
   1065              "not be able to determine write-protect offset.\n", pid, name);
   1066         return (unsigned)-1;
   1067     }
   1068 
   1069     for(cnt = 0, shdr = shdr_start; cnt < ehdr->e_shnum; ++cnt, ++shdr) {
   1070         if ((shdr->sh_type != SHT_NULL) && (shdr->sh_flags & SHF_WRITE) &&
   1071             (shdr->sh_addr < wr_offset)) {
   1072             wr_offset = shdr->sh_addr;
   1073         }
   1074     }
   1075 
   1076     munmap(shdr_start, shdr_sz);
   1077     return wr_offset;
   1078 }
   1079 #endif
   1080 
   1081 static soinfo *
   1082 load_library(const char *name)
   1083 {
   1084     int fd = open_library(name);
   1085     int cnt;
   1086     unsigned ext_sz;
   1087     unsigned req_base;
   1088     const char *bname;
   1089     soinfo *si = NULL;
   1090     Elf32_Ehdr *hdr;
   1091 
   1092     if(fd == -1) {
   1093         DL_ERR("Library '%s' not found", name);
   1094         return NULL;
   1095     }
   1096 
   1097     /* We have to read the ELF header to figure out what to do with this image
   1098      */
   1099     if (lseek(fd, 0, SEEK_SET) < 0) {
   1100         DL_ERR("lseek() failed!");
   1101         goto fail;
   1102     }
   1103 
   1104     if ((cnt = read(fd, &__header[0], PAGE_SIZE)) < 0) {
   1105         DL_ERR("read() failed!");
   1106         goto fail;
   1107     }
   1108 
   1109     /* Parse the ELF header and get the size of the memory footprint for
   1110      * the library */
   1111     req_base = get_lib_extents(fd, name, &__header[0], &ext_sz);
   1112     if (req_base == (unsigned)-1)
   1113         goto fail;
   1114     TRACE("[ %5d - '%s' (%s) wants base=0x%08x sz=0x%08x ]\n", pid, name,
   1115           (req_base ? "prelinked" : "not pre-linked"), req_base, ext_sz);
   1116 
   1117     /* Now configure the soinfo struct where we'll store all of our data
   1118      * for the ELF object. If the loading fails, we waste the entry, but
   1119      * same thing would happen if we failed during linking. Configuring the
   1120      * soinfo struct here is a lot more convenient.
   1121      */
   1122     bname = strrchr(name, '/');
   1123     si = alloc_info(bname ? bname + 1 : name);
   1124     if (si == NULL)
   1125         goto fail;
   1126 
   1127     /* Carve out a chunk of memory where we will map in the individual
   1128      * segments */
   1129     si->base = req_base;
   1130     si->size = ext_sz;
   1131     si->flags = 0;
   1132     si->entry = 0;
   1133     si->dynamic = (unsigned *)-1;
   1134     if (alloc_mem_region(si) < 0)
   1135         goto fail;
   1136 
   1137     TRACE("[ %5d allocated memory for %s @ %p (0x%08x) ]\n",
   1138           pid, name, (void *)si->base, (unsigned) ext_sz);
   1139 
   1140     /* Now actually load the library's segments into right places in memory */
   1141     if (load_segments(fd, &__header[0], si) < 0) {
   1142         goto fail;
   1143     }
   1144 
   1145     /* this might not be right. Technically, we don't even need this info
   1146      * once we go through 'load_segments'. */
   1147     hdr = (Elf32_Ehdr *)si->base;
   1148     si->phdr = (Elf32_Phdr *)((unsigned char *)si->base + hdr->e_phoff);
   1149     si->phnum = hdr->e_phnum;
   1150     /**/
   1151 
   1152     close(fd);
   1153     return si;
   1154 
   1155 fail:
   1156     if (si) free_info(si);
   1157     close(fd);
   1158     return NULL;
   1159 }
   1160 
   1161 static soinfo *
   1162 init_library(soinfo *si)
   1163 {
   1164     unsigned wr_offset = 0xffffffff;
   1165 
   1166     /* At this point we know that whatever is loaded @ base is a valid ELF
   1167      * shared library whose segments are properly mapped in. */
   1168     TRACE("[ %5d init_library base=0x%08x sz=0x%08x name='%s') ]\n",
   1169           pid, si->base, si->size, si->name);
   1170 
   1171     if(link_image(si, wr_offset)) {
   1172             /* We failed to link.  However, we can only restore libbase
   1173             ** if no additional libraries have moved it since we updated it.
   1174             */
   1175         munmap((void *)si->base, si->size);
   1176         return NULL;
   1177     }
   1178 
   1179     return si;
   1180 }
   1181 
   1182 soinfo *find_library(const char *name)
   1183 {
   1184     soinfo *si;
   1185     const char *bname;
   1186 
   1187 #if ALLOW_SYMBOLS_FROM_MAIN
   1188     if (name == NULL)
   1189         return somain;
   1190 #else
   1191     if (name == NULL)
   1192         return NULL;
   1193 #endif
   1194 
   1195     bname = strrchr(name, '/');
   1196     bname = bname ? bname + 1 : name;
   1197 
   1198     for(si = solist; si != 0; si = si->next){
   1199         if(!strcmp(bname, si->name)) {
   1200             if(si->flags & FLAG_ERROR) {
   1201                 DL_ERR("%5d '%s' failed to load previously", pid, bname);
   1202                 return NULL;
   1203             }
   1204             if(si->flags & FLAG_LINKED) return si;
   1205             DL_ERR("OOPS: %5d recursive link to '%s'", pid, si->name);
   1206             return NULL;
   1207         }
   1208     }
   1209 
   1210     TRACE("[ %5d '%s' has not been loaded yet.  Locating...]\n", pid, name);
   1211     si = load_library(name);
   1212     if(si == NULL)
   1213         return NULL;
   1214     return init_library(si);
   1215 }
   1216 
   1217 /* TODO:
   1218  *   notify gdb of unload
   1219  *   for non-prelinked libraries, find a way to decrement libbase
   1220  */
   1221 static void call_destructors(soinfo *si);
   1222 unsigned unload_library(soinfo *si)
   1223 {
   1224     unsigned *d;
   1225     if (si->refcount == 1) {
   1226         TRACE("%5d unloading '%s'\n", pid, si->name);
   1227         call_destructors(si);
   1228 
   1229         /*
   1230          * Make sure that we undo the PT_GNU_RELRO protections we added
   1231          * in link_image. This is needed to undo the DT_NEEDED hack below.
   1232          */
   1233         if ((si->gnu_relro_start != 0) && (si->gnu_relro_len != 0)) {
   1234             Elf32_Addr start = (si->gnu_relro_start & ~PAGE_MASK);
   1235             unsigned len = (si->gnu_relro_start - start) + si->gnu_relro_len;
   1236             if (mprotect((void *) start, len, PROT_READ | PROT_WRITE) < 0)
   1237                 DL_ERR("%5d %s: could not undo GNU_RELRO protections. "
   1238                        "Expect a crash soon. errno=%d (%s)",
   1239                        pid, si->name, errno, strerror(errno));
   1240 
   1241         }
   1242 
   1243         for(d = si->dynamic; *d; d += 2) {
   1244             if(d[0] == DT_NEEDED){
   1245                 soinfo *lsi = (soinfo *)d[1];
   1246 
   1247                 // The next line will segfault if the we don't undo the
   1248                 // PT_GNU_RELRO protections (see comments above and in
   1249                 // link_image().
   1250                 d[1] = 0;
   1251 
   1252                 if (validate_soinfo(lsi)) {
   1253                     TRACE("%5d %s needs to unload %s\n", pid,
   1254                           si->name, lsi->name);
   1255                     unload_library(lsi);
   1256                 }
   1257                 else
   1258                     DL_ERR("%5d %s: could not unload dependent library",
   1259                            pid, si->name);
   1260             }
   1261         }
   1262 
   1263         munmap((char *)si->base, si->size);
   1264         notify_gdb_of_unload(si);
   1265         free_info(si);
   1266         si->refcount = 0;
   1267     }
   1268     else {
   1269         si->refcount--;
   1270         PRINT("%5d not unloading '%s', decrementing refcount to %d\n",
   1271               pid, si->name, si->refcount);
   1272     }
   1273     return si->refcount;
   1274 }
   1275 
   1276 /* TODO: don't use unsigned for addrs below. It works, but is not
   1277  * ideal. They should probably be either uint32_t, Elf32_Addr, or unsigned
   1278  * long.
   1279  */
   1280 static int reloc_library(soinfo *si, Elf32_Rel *rel, unsigned count)
   1281 {
   1282     Elf32_Sym *symtab = si->symtab;
   1283     const char *strtab = si->strtab;
   1284     Elf32_Sym *s;
   1285     unsigned base;
   1286     Elf32_Rel *start = rel;
   1287     unsigned idx;
   1288 
   1289     for (idx = 0; idx < count; ++idx) {
   1290         unsigned type = ELF32_R_TYPE(rel->r_info);
   1291         unsigned sym = ELF32_R_SYM(rel->r_info);
   1292         unsigned reloc = (unsigned)(rel->r_offset + si->base);
   1293         unsigned sym_addr = 0;
   1294         char *sym_name = NULL;
   1295 
   1296         DEBUG("%5d Processing '%s' relocation at index %d\n", pid,
   1297               si->name, idx);
   1298         if(sym != 0) {
   1299             sym_name = (char *)(strtab + symtab[sym].st_name);
   1300             s = _do_lookup(si, sym_name, &base);
   1301             if(s == NULL) {
   1302                 /* We only allow an undefined symbol if this is a weak
   1303                    reference..   */
   1304                 s = &symtab[sym];
   1305                 if (ELF32_ST_BIND(s->st_info) != STB_WEAK) {
   1306                     DL_ERR("%5d cannot locate '%s'...\n", pid, sym_name);
   1307                     return -1;
   1308                 }
   1309 
   1310                 /* IHI0044C AAELF 4.5.1.1:
   1311 
   1312                    Libraries are not searched to resolve weak references.
   1313                    It is not an error for a weak reference to remain
   1314                    unsatisfied.
   1315 
   1316                    During linking, the value of an undefined weak reference is:
   1317                    - Zero if the relocation type is absolute
   1318                    - The address of the place if the relocation is pc-relative
   1319                    - The address of nominial base address if the relocation
   1320                      type is base-relative.
   1321                   */
   1322 
   1323                 switch (type) {
   1324 #if defined(ANDROID_ARM_LINKER)
   1325                 case R_ARM_JUMP_SLOT:
   1326                 case R_ARM_GLOB_DAT:
   1327                 case R_ARM_ABS32:
   1328                 case R_ARM_RELATIVE:    /* Don't care. */
   1329                 case R_ARM_NONE:        /* Don't care. */
   1330 #elif defined(ANDROID_X86_LINKER)
   1331                 case R_386_JUMP_SLOT:
   1332                 case R_386_GLOB_DAT:
   1333                 case R_386_32:
   1334                 case R_386_RELATIVE:    /* Dont' care. */
   1335 #endif /* ANDROID_*_LINKER */
   1336                     /* sym_addr was initialized to be zero above or relocation
   1337                        code below does not care about value of sym_addr.
   1338                        No need to do anything.  */
   1339                     break;
   1340 
   1341 #if defined(ANDROID_X86_LINKER)
   1342                 case R_386_PC32:
   1343                     sym_addr = reloc;
   1344                     break;
   1345 #endif /* ANDROID_X86_LINKER */
   1346 
   1347 #if defined(ANDROID_ARM_LINKER)
   1348                 case R_ARM_COPY:
   1349                     /* Fall through.  Can't really copy if weak symbol is
   1350                        not found in run-time.  */
   1351 #endif /* ANDROID_ARM_LINKER */
   1352                 default:
   1353                     DL_ERR("%5d unknown weak reloc type %d @ %p (%d)\n",
   1354                                  pid, type, rel, (int) (rel - start));
   1355                     return -1;
   1356                 }
   1357             } else {
   1358                 /* We got a definition.  */
   1359 #if 0
   1360             if((base == 0) && (si->base != 0)){
   1361                     /* linking from libraries to main image is bad */
   1362                 DL_ERR("%5d cannot locate '%s'...",
   1363                        pid, strtab + symtab[sym].st_name);
   1364                 return -1;
   1365             }
   1366 #endif
   1367                 sym_addr = (unsigned)(s->st_value + base);
   1368 	    }
   1369             COUNT_RELOC(RELOC_SYMBOL);
   1370         } else {
   1371             s = NULL;
   1372         }
   1373 
   1374 /* TODO: This is ugly. Split up the relocations by arch into
   1375  * different files.
   1376  */
   1377         switch(type){
   1378 #if defined(ANDROID_ARM_LINKER)
   1379         case R_ARM_JUMP_SLOT:
   1380             COUNT_RELOC(RELOC_ABSOLUTE);
   1381             MARK(rel->r_offset);
   1382             TRACE_TYPE(RELO, "%5d RELO JMP_SLOT %08x <- %08x %s\n", pid,
   1383                        reloc, sym_addr, sym_name);
   1384             *((unsigned*)reloc) = sym_addr;
   1385             break;
   1386         case R_ARM_GLOB_DAT:
   1387             COUNT_RELOC(RELOC_ABSOLUTE);
   1388             MARK(rel->r_offset);
   1389             TRACE_TYPE(RELO, "%5d RELO GLOB_DAT %08x <- %08x %s\n", pid,
   1390                        reloc, sym_addr, sym_name);
   1391             *((unsigned*)reloc) = sym_addr;
   1392             break;
   1393         case R_ARM_ABS32:
   1394             COUNT_RELOC(RELOC_ABSOLUTE);
   1395             MARK(rel->r_offset);
   1396             TRACE_TYPE(RELO, "%5d RELO ABS %08x <- %08x %s\n", pid,
   1397                        reloc, sym_addr, sym_name);
   1398             *((unsigned*)reloc) += sym_addr;
   1399             break;
   1400         case R_ARM_REL32:
   1401             COUNT_RELOC(RELOC_RELATIVE);
   1402             MARK(rel->r_offset);
   1403             TRACE_TYPE(RELO, "%5d RELO REL32 %08x <- %08x - %08x %s\n", pid,
   1404                        reloc, sym_addr, rel->r_offset, sym_name);
   1405             *((unsigned*)reloc) += sym_addr - rel->r_offset;
   1406             break;
   1407 #elif defined(ANDROID_X86_LINKER)
   1408         case R_386_JUMP_SLOT:
   1409             COUNT_RELOC(RELOC_ABSOLUTE);
   1410             MARK(rel->r_offset);
   1411             TRACE_TYPE(RELO, "%5d RELO JMP_SLOT %08x <- %08x %s\n", pid,
   1412                        reloc, sym_addr, sym_name);
   1413             *((unsigned*)reloc) = sym_addr;
   1414             break;
   1415         case R_386_GLOB_DAT:
   1416             COUNT_RELOC(RELOC_ABSOLUTE);
   1417             MARK(rel->r_offset);
   1418             TRACE_TYPE(RELO, "%5d RELO GLOB_DAT %08x <- %08x %s\n", pid,
   1419                        reloc, sym_addr, sym_name);
   1420             *((unsigned*)reloc) = sym_addr;
   1421             break;
   1422 #endif /* ANDROID_*_LINKER */
   1423 
   1424 #if defined(ANDROID_ARM_LINKER)
   1425         case R_ARM_RELATIVE:
   1426 #elif defined(ANDROID_X86_LINKER)
   1427         case R_386_RELATIVE:
   1428 #endif /* ANDROID_*_LINKER */
   1429             COUNT_RELOC(RELOC_RELATIVE);
   1430             MARK(rel->r_offset);
   1431             if(sym){
   1432                 DL_ERR("%5d odd RELATIVE form...", pid);
   1433                 return -1;
   1434             }
   1435             TRACE_TYPE(RELO, "%5d RELO RELATIVE %08x <- +%08x\n", pid,
   1436                        reloc, si->base);
   1437             *((unsigned*)reloc) += si->base;
   1438             break;
   1439 
   1440 #if defined(ANDROID_X86_LINKER)
   1441         case R_386_32:
   1442             COUNT_RELOC(RELOC_RELATIVE);
   1443             MARK(rel->r_offset);
   1444 
   1445             TRACE_TYPE(RELO, "%5d RELO R_386_32 %08x <- +%08x %s\n", pid,
   1446                        reloc, sym_addr, sym_name);
   1447             *((unsigned *)reloc) += (unsigned)sym_addr;
   1448             break;
   1449 
   1450         case R_386_PC32:
   1451             COUNT_RELOC(RELOC_RELATIVE);
   1452             MARK(rel->r_offset);
   1453             TRACE_TYPE(RELO, "%5d RELO R_386_PC32 %08x <- "
   1454                        "+%08x (%08x - %08x) %s\n", pid, reloc,
   1455                        (sym_addr - reloc), sym_addr, reloc, sym_name);
   1456             *((unsigned *)reloc) += (unsigned)(sym_addr - reloc);
   1457             break;
   1458 #endif /* ANDROID_X86_LINKER */
   1459 
   1460 #ifdef ANDROID_ARM_LINKER
   1461         case R_ARM_COPY:
   1462             COUNT_RELOC(RELOC_COPY);
   1463             MARK(rel->r_offset);
   1464             TRACE_TYPE(RELO, "%5d RELO %08x <- %d @ %08x %s\n", pid,
   1465                        reloc, s->st_size, sym_addr, sym_name);
   1466             memcpy((void*)reloc, (void*)sym_addr, s->st_size);
   1467             break;
   1468         case R_ARM_NONE:
   1469             break;
   1470 #endif /* ANDROID_ARM_LINKER */
   1471 
   1472         default:
   1473             DL_ERR("%5d unknown reloc type %d @ %p (%d)",
   1474                   pid, type, rel, (int) (rel - start));
   1475             return -1;
   1476         }
   1477         rel++;
   1478     }
   1479     return 0;
   1480 }
   1481 
   1482 /* Please read the "Initialization and Termination functions" functions.
   1483  * of the linker design note in bionic/linker/README.TXT to understand
   1484  * what the following code is doing.
   1485  *
   1486  * The important things to remember are:
   1487  *
   1488  *   DT_PREINIT_ARRAY must be called first for executables, and should
   1489  *   not appear in shared libraries.
   1490  *
   1491  *   DT_INIT should be called before DT_INIT_ARRAY if both are present
   1492  *
   1493  *   DT_FINI should be called after DT_FINI_ARRAY if both are present
   1494  *
   1495  *   DT_FINI_ARRAY must be parsed in reverse order.
   1496  */
   1497 
   1498 static void call_array(unsigned *ctor, int count, int reverse)
   1499 {
   1500     int n, inc = 1;
   1501 
   1502     if (reverse) {
   1503         ctor += (count-1);
   1504         inc   = -1;
   1505     }
   1506 
   1507     for(n = count; n > 0; n--) {
   1508         TRACE("[ %5d Looking at %s *0x%08x == 0x%08x ]\n", pid,
   1509               reverse ? "dtor" : "ctor",
   1510               (unsigned)ctor, (unsigned)*ctor);
   1511         void (*func)() = (void (*)()) *ctor;
   1512         ctor += inc;
   1513         if(((int) func == 0) || ((int) func == -1)) continue;
   1514         TRACE("[ %5d Calling func @ 0x%08x ]\n", pid, (unsigned)func);
   1515         func();
   1516     }
   1517 }
   1518 
   1519 void call_constructors_recursive(soinfo *si)
   1520 {
   1521     if (si->constructors_called)
   1522         return;
   1523 
   1524     // Set this before actually calling the constructors, otherwise it doesn't
   1525     // protect against recursive constructor calls. One simple example of
   1526     // constructor recursion is the libc debug malloc, which is implemented in
   1527     // libc_malloc_debug_leak.so:
   1528     // 1. The program depends on libc, so libc's constructor is called here.
   1529     // 2. The libc constructor calls dlopen() to load libc_malloc_debug_leak.so.
   1530     // 3. dlopen() calls call_constructors_recursive() with the newly created
   1531     //    soinfo for libc_malloc_debug_leak.so.
   1532     // 4. The debug so depends on libc, so call_constructors_recursive() is
   1533     //    called again with the libc soinfo. If it doesn't trigger the early-
   1534     //    out above, the libc constructor will be called again (recursively!).
   1535     si->constructors_called = 1;
   1536 
   1537     if (si->flags & FLAG_EXE) {
   1538         TRACE("[ %5d Calling preinit_array @ 0x%08x [%d] for '%s' ]\n",
   1539               pid, (unsigned)si->preinit_array, si->preinit_array_count,
   1540               si->name);
   1541         call_array(si->preinit_array, si->preinit_array_count, 0);
   1542         TRACE("[ %5d Done calling preinit_array for '%s' ]\n", pid, si->name);
   1543     } else {
   1544         if (si->preinit_array) {
   1545             DL_ERR("%5d Shared library '%s' has a preinit_array table @ 0x%08x."
   1546                    " This is INVALID.", pid, si->name,
   1547                    (unsigned)si->preinit_array);
   1548         }
   1549     }
   1550 
   1551     if (si->dynamic) {
   1552         unsigned *d;
   1553         for(d = si->dynamic; *d; d += 2) {
   1554             if(d[0] == DT_NEEDED){
   1555                 soinfo* lsi = (soinfo *)d[1];
   1556                 if (!validate_soinfo(lsi)) {
   1557                     DL_ERR("%5d bad DT_NEEDED pointer in %s",
   1558                            pid, si->name);
   1559                 } else {
   1560                     call_constructors_recursive(lsi);
   1561                 }
   1562             }
   1563         }
   1564     }
   1565 
   1566     if (si->init_func) {
   1567         TRACE("[ %5d Calling init_func @ 0x%08x for '%s' ]\n", pid,
   1568               (unsigned)si->init_func, si->name);
   1569         si->init_func();
   1570         TRACE("[ %5d Done calling init_func for '%s' ]\n", pid, si->name);
   1571     }
   1572 
   1573     if (si->init_array) {
   1574         TRACE("[ %5d Calling init_array @ 0x%08x [%d] for '%s' ]\n", pid,
   1575               (unsigned)si->init_array, si->init_array_count, si->name);
   1576         call_array(si->init_array, si->init_array_count, 0);
   1577         TRACE("[ %5d Done calling init_array for '%s' ]\n", pid, si->name);
   1578     }
   1579 
   1580 }
   1581 
   1582 static void call_destructors(soinfo *si)
   1583 {
   1584     if (si->fini_array) {
   1585         TRACE("[ %5d Calling fini_array @ 0x%08x [%d] for '%s' ]\n", pid,
   1586               (unsigned)si->fini_array, si->fini_array_count, si->name);
   1587         call_array(si->fini_array, si->fini_array_count, 1);
   1588         TRACE("[ %5d Done calling fini_array for '%s' ]\n", pid, si->name);
   1589     }
   1590 
   1591     if (si->fini_func) {
   1592         TRACE("[ %5d Calling fini_func @ 0x%08x for '%s' ]\n", pid,
   1593               (unsigned)si->fini_func, si->name);
   1594         si->fini_func();
   1595         TRACE("[ %5d Done calling fini_func for '%s' ]\n", pid, si->name);
   1596     }
   1597 }
   1598 
   1599 /* Force any of the closed stdin, stdout and stderr to be associated with
   1600    /dev/null. */
   1601 static int nullify_closed_stdio (void)
   1602 {
   1603     int dev_null, i, status;
   1604     int return_value = 0;
   1605 
   1606     dev_null = open("/dev/null", O_RDWR);
   1607     if (dev_null < 0) {
   1608         DL_ERR("Cannot open /dev/null.");
   1609         return -1;
   1610     }
   1611     TRACE("[ %5d Opened /dev/null file-descriptor=%d]\n", pid, dev_null);
   1612 
   1613     /* If any of the stdio file descriptors is valid and not associated
   1614        with /dev/null, dup /dev/null to it.  */
   1615     for (i = 0; i < 3; i++) {
   1616         /* If it is /dev/null already, we are done. */
   1617         if (i == dev_null)
   1618             continue;
   1619 
   1620         TRACE("[ %5d Nullifying stdio file descriptor %d]\n", pid, i);
   1621         /* The man page of fcntl does not say that fcntl(..,F_GETFL)
   1622            can be interrupted but we do this just to be safe. */
   1623         do {
   1624           status = fcntl(i, F_GETFL);
   1625         } while (status < 0 && errno == EINTR);
   1626 
   1627         /* If file is openned, we are good. */
   1628         if (status >= 0)
   1629           continue;
   1630 
   1631         /* The only error we allow is that the file descriptor does not
   1632            exist, in which case we dup /dev/null to it. */
   1633         if (errno != EBADF) {
   1634             DL_ERR("nullify_stdio: unhandled error %s", strerror(errno));
   1635             return_value = -1;
   1636             continue;
   1637         }
   1638 
   1639         /* Try dupping /dev/null to this stdio file descriptor and
   1640            repeat if there is a signal.  Note that any errors in closing
   1641            the stdio descriptor are lost.  */
   1642         do {
   1643             status = dup2(dev_null, i);
   1644         } while (status < 0 && errno == EINTR);
   1645 
   1646         if (status < 0) {
   1647             DL_ERR("nullify_stdio: dup2 error %s", strerror(errno));
   1648             return_value = -1;
   1649             continue;
   1650         }
   1651     }
   1652 
   1653     /* If /dev/null is not one of the stdio file descriptors, close it. */
   1654     if (dev_null > 2) {
   1655         TRACE("[ %5d Closing /dev/null file-descriptor=%d]\n", pid, dev_null);
   1656         do {
   1657             status = close(dev_null);
   1658         } while (status < 0 && errno == EINTR);
   1659 
   1660         if (status < 0) {
   1661             DL_ERR("nullify_stdio: close error %s", strerror(errno));
   1662             return_value = -1;
   1663         }
   1664     }
   1665 
   1666     return return_value;
   1667 }
   1668 
   1669 static int link_image(soinfo *si, unsigned wr_offset)
   1670 {
   1671     unsigned *d;
   1672     Elf32_Phdr *phdr = si->phdr;
   1673     int phnum = si->phnum;
   1674 
   1675     INFO("[ %5d linking %s ]\n", pid, si->name);
   1676     DEBUG("%5d si->base = 0x%08x si->flags = 0x%08x\n", pid,
   1677           si->base, si->flags);
   1678 
   1679     if (si->flags & (FLAG_EXE | FLAG_LINKER)) {
   1680         /* Locate the needed program segments (DYNAMIC/ARM_EXIDX) for
   1681          * linkage info if this is the executable or the linker itself.
   1682          * If this was a dynamic lib, that would have been done at load time.
   1683          *
   1684          * TODO: It's unfortunate that small pieces of this are
   1685          * repeated from the load_library routine. Refactor this just
   1686          * slightly to reuse these bits.
   1687          */
   1688         si->size = 0;
   1689         for(; phnum > 0; --phnum, ++phdr) {
   1690 #ifdef ANDROID_ARM_LINKER
   1691             if(phdr->p_type == PT_ARM_EXIDX) {
   1692                 /* exidx entries (used for stack unwinding) are 8 bytes each.
   1693                  */
   1694                 si->ARM_exidx = (unsigned *)phdr->p_vaddr;
   1695                 si->ARM_exidx_count = phdr->p_memsz / 8;
   1696             }
   1697 #endif
   1698             if (phdr->p_type == PT_LOAD) {
   1699                 /* For the executable, we use the si->size field only in
   1700                    dl_unwind_find_exidx(), so the meaning of si->size
   1701                    is not the size of the executable; it is the distance
   1702                    between the load location of the executable and the last
   1703                    address of the loadable part of the executable.
   1704                    We use the range [si->base, si->base + si->size) to
   1705                    determine whether a PC value falls within the executable
   1706                    section. Of course, if a value is between si->base and
   1707                    (si->base + phdr->p_vaddr), it's not in the executable
   1708                    section, but a) we shouldn't be asking for such a value
   1709                    anyway, and b) if we have to provide an EXIDX for such a
   1710                    value, then the executable's EXIDX is probably the better
   1711                    choice.
   1712                 */
   1713                 DEBUG_DUMP_PHDR(phdr, "PT_LOAD", pid);
   1714                 if (phdr->p_vaddr + phdr->p_memsz > si->size)
   1715                     si->size = phdr->p_vaddr + phdr->p_memsz;
   1716                 /* try to remember what range of addresses should be write
   1717                  * protected */
   1718                 if (!(phdr->p_flags & PF_W)) {
   1719                     unsigned _end;
   1720 
   1721                     if (si->base + phdr->p_vaddr < si->wrprotect_start)
   1722                         si->wrprotect_start = si->base + phdr->p_vaddr;
   1723                     _end = (((si->base + phdr->p_vaddr + phdr->p_memsz + PAGE_SIZE - 1) &
   1724                              (~PAGE_MASK)));
   1725                     if (_end > si->wrprotect_end)
   1726                         si->wrprotect_end = _end;
   1727                     /* Make the section writable just in case we'll have to
   1728                      * write to it during relocation (i.e. text segment).
   1729                      * However, we will remember what range of addresses
   1730                      * should be write protected.
   1731                      */
   1732                     mprotect((void *) (si->base + phdr->p_vaddr),
   1733                              phdr->p_memsz,
   1734                              PFLAGS_TO_PROT(phdr->p_flags) | PROT_WRITE);
   1735                 }
   1736             } else if (phdr->p_type == PT_DYNAMIC) {
   1737                 if (si->dynamic != (unsigned *)-1) {
   1738                     DL_ERR("%5d multiple PT_DYNAMIC segments found in '%s'. "
   1739                           "Segment at 0x%08x, previously one found at 0x%08x",
   1740                           pid, si->name, si->base + phdr->p_vaddr,
   1741                           (unsigned)si->dynamic);
   1742                     goto fail;
   1743                 }
   1744                 DEBUG_DUMP_PHDR(phdr, "PT_DYNAMIC", pid);
   1745                 si->dynamic = (unsigned *) (si->base + phdr->p_vaddr);
   1746             } else if (phdr->p_type == PT_GNU_RELRO) {
   1747                 if ((phdr->p_vaddr >= si->size)
   1748                         || ((phdr->p_vaddr + phdr->p_memsz) > si->size)
   1749                         || ((si->base + phdr->p_vaddr + phdr->p_memsz) < si->base)) {
   1750                     DL_ERR("%d invalid GNU_RELRO in '%s' "
   1751                            "p_vaddr=0x%08x p_memsz=0x%08x", pid, si->name,
   1752                            phdr->p_vaddr, phdr->p_memsz);
   1753                     goto fail;
   1754                 }
   1755                 si->gnu_relro_start = (Elf32_Addr) (si->base + phdr->p_vaddr);
   1756                 si->gnu_relro_len = (unsigned) phdr->p_memsz;
   1757             }
   1758         }
   1759     }
   1760 
   1761     if (si->dynamic == (unsigned *)-1) {
   1762         DL_ERR("%5d missing PT_DYNAMIC?!", pid);
   1763         goto fail;
   1764     }
   1765 
   1766     DEBUG("%5d dynamic = %p\n", pid, si->dynamic);
   1767 
   1768     /* extract useful information from dynamic section */
   1769     for(d = si->dynamic; *d; d++){
   1770         DEBUG("%5d d = %p, d[0] = 0x%08x d[1] = 0x%08x\n", pid, d, d[0], d[1]);
   1771         switch(*d++){
   1772         case DT_HASH:
   1773             si->nbucket = ((unsigned *) (si->base + *d))[0];
   1774             si->nchain = ((unsigned *) (si->base + *d))[1];
   1775             si->bucket = (unsigned *) (si->base + *d + 8);
   1776             si->chain = (unsigned *) (si->base + *d + 8 + si->nbucket * 4);
   1777             break;
   1778         case DT_STRTAB:
   1779             si->strtab = (const char *) (si->base + *d);
   1780             break;
   1781         case DT_SYMTAB:
   1782             si->symtab = (Elf32_Sym *) (si->base + *d);
   1783             break;
   1784         case DT_PLTREL:
   1785             if(*d != DT_REL) {
   1786                 DL_ERR("DT_RELA not supported");
   1787                 goto fail;
   1788             }
   1789             break;
   1790         case DT_JMPREL:
   1791             si->plt_rel = (Elf32_Rel*) (si->base + *d);
   1792             break;
   1793         case DT_PLTRELSZ:
   1794             si->plt_rel_count = *d / 8;
   1795             break;
   1796         case DT_REL:
   1797             si->rel = (Elf32_Rel*) (si->base + *d);
   1798             break;
   1799         case DT_RELSZ:
   1800             si->rel_count = *d / 8;
   1801             break;
   1802         case DT_PLTGOT:
   1803             /* Save this in case we decide to do lazy binding. We don't yet. */
   1804             si->plt_got = (unsigned *)(si->base + *d);
   1805             break;
   1806         case DT_DEBUG:
   1807             // Set the DT_DEBUG entry to the addres of _r_debug for GDB
   1808             *d = (int) &_r_debug;
   1809             break;
   1810          case DT_RELA:
   1811             DL_ERR("%5d DT_RELA not supported", pid);
   1812             goto fail;
   1813         case DT_INIT:
   1814             si->init_func = (void (*)(void))(si->base + *d);
   1815             DEBUG("%5d %s constructors (init func) found at %p\n",
   1816                   pid, si->name, si->init_func);
   1817             break;
   1818         case DT_FINI:
   1819             si->fini_func = (void (*)(void))(si->base + *d);
   1820             DEBUG("%5d %s destructors (fini func) found at %p\n",
   1821                   pid, si->name, si->fini_func);
   1822             break;
   1823         case DT_INIT_ARRAY:
   1824             si->init_array = (unsigned *)(si->base + *d);
   1825             DEBUG("%5d %s constructors (init_array) found at %p\n",
   1826                   pid, si->name, si->init_array);
   1827             break;
   1828         case DT_INIT_ARRAYSZ:
   1829             si->init_array_count = ((unsigned)*d) / sizeof(Elf32_Addr);
   1830             break;
   1831         case DT_FINI_ARRAY:
   1832             si->fini_array = (unsigned *)(si->base + *d);
   1833             DEBUG("%5d %s destructors (fini_array) found at %p\n",
   1834                   pid, si->name, si->fini_array);
   1835             break;
   1836         case DT_FINI_ARRAYSZ:
   1837             si->fini_array_count = ((unsigned)*d) / sizeof(Elf32_Addr);
   1838             break;
   1839         case DT_PREINIT_ARRAY:
   1840             si->preinit_array = (unsigned *)(si->base + *d);
   1841             DEBUG("%5d %s constructors (preinit_array) found at %p\n",
   1842                   pid, si->name, si->preinit_array);
   1843             break;
   1844         case DT_PREINIT_ARRAYSZ:
   1845             si->preinit_array_count = ((unsigned)*d) / sizeof(Elf32_Addr);
   1846             break;
   1847         case DT_TEXTREL:
   1848             /* TODO: make use of this. */
   1849             /* this means that we might have to write into where the text
   1850              * segment was loaded during relocation... Do something with
   1851              * it.
   1852              */
   1853             DEBUG("%5d Text segment should be writable during relocation.\n",
   1854                   pid);
   1855             break;
   1856         }
   1857     }
   1858 
   1859     DEBUG("%5d si->base = 0x%08x, si->strtab = %p, si->symtab = %p\n",
   1860            pid, si->base, si->strtab, si->symtab);
   1861 
   1862     if((si->strtab == 0) || (si->symtab == 0)) {
   1863         DL_ERR("%5d missing essential tables", pid);
   1864         goto fail;
   1865     }
   1866 
   1867     /* if this is the main executable, then load all of the preloads now */
   1868     if(si->flags & FLAG_EXE) {
   1869         int i;
   1870         memset(preloads, 0, sizeof(preloads));
   1871         for(i = 0; ldpreload_names[i] != NULL; i++) {
   1872             soinfo *lsi = find_library(ldpreload_names[i]);
   1873             if(lsi == 0) {
   1874                 strlcpy(tmp_err_buf, linker_get_error(), sizeof(tmp_err_buf));
   1875                 DL_ERR("%5d could not load needed library '%s' for '%s' (%s)",
   1876                        pid, ldpreload_names[i], si->name, tmp_err_buf);
   1877                 goto fail;
   1878             }
   1879             lsi->refcount++;
   1880             preloads[i] = lsi;
   1881         }
   1882     }
   1883 
   1884     for(d = si->dynamic; *d; d += 2) {
   1885         if(d[0] == DT_NEEDED){
   1886             DEBUG("%5d %s needs %s\n", pid, si->name, si->strtab + d[1]);
   1887             soinfo *lsi = find_library(si->strtab + d[1]);
   1888             if(lsi == 0) {
   1889                 strlcpy(tmp_err_buf, linker_get_error(), sizeof(tmp_err_buf));
   1890                 DL_ERR("%5d could not load needed library '%s' for '%s' (%s)",
   1891                        pid, si->strtab + d[1], si->name, tmp_err_buf);
   1892                 goto fail;
   1893             }
   1894             /* Save the soinfo of the loaded DT_NEEDED library in the payload
   1895                of the DT_NEEDED entry itself, so that we can retrieve the
   1896                soinfo directly later from the dynamic segment.  This is a hack,
   1897                but it allows us to map from DT_NEEDED to soinfo efficiently
   1898                later on when we resolve relocations, trying to look up a symbol
   1899                with dlsym().
   1900             */
   1901             d[1] = (unsigned)lsi;
   1902             lsi->refcount++;
   1903         }
   1904     }
   1905 
   1906     if(si->plt_rel) {
   1907         DEBUG("[ %5d relocating %s plt ]\n", pid, si->name );
   1908         if(reloc_library(si, si->plt_rel, si->plt_rel_count))
   1909             goto fail;
   1910     }
   1911     if(si->rel) {
   1912         DEBUG("[ %5d relocating %s ]\n", pid, si->name );
   1913         if(reloc_library(si, si->rel, si->rel_count))
   1914             goto fail;
   1915     }
   1916 
   1917     si->flags |= FLAG_LINKED;
   1918     DEBUG("[ %5d finished linking %s ]\n", pid, si->name);
   1919 
   1920 #if 0
   1921     /* This is the way that the old dynamic linker did protection of
   1922      * non-writable areas. It would scan section headers and find where
   1923      * .text ended (rather where .data/.bss began) and assume that this is
   1924      * the upper range of the non-writable area. This is too coarse,
   1925      * and is kept here for reference until we fully move away from single
   1926      * segment elf objects. See the code in get_wr_offset (also #if'd 0)
   1927      * that made this possible.
   1928      */
   1929     if(wr_offset < 0xffffffff){
   1930         mprotect((void*) si->base, wr_offset, PROT_READ | PROT_EXEC);
   1931     }
   1932 #else
   1933     /* TODO: Verify that this does the right thing in all cases, as it
   1934      * presently probably does not. It is possible that an ELF image will
   1935      * come with multiple read-only segments. What we ought to do is scan
   1936      * the program headers again and mprotect all the read-only segments.
   1937      * To prevent re-scanning the program header, we would have to build a
   1938      * list of loadable segments in si, and then scan that instead. */
   1939     if (si->wrprotect_start != 0xffffffff && si->wrprotect_end != 0) {
   1940         mprotect((void *)si->wrprotect_start,
   1941                  si->wrprotect_end - si->wrprotect_start,
   1942                  PROT_READ | PROT_EXEC);
   1943     }
   1944 #endif
   1945 
   1946     if (si->gnu_relro_start != 0 && si->gnu_relro_len != 0) {
   1947         Elf32_Addr start = (si->gnu_relro_start & ~PAGE_MASK);
   1948         unsigned len = (si->gnu_relro_start - start) + si->gnu_relro_len;
   1949         if (mprotect((void *) start, len, PROT_READ) < 0) {
   1950             DL_ERR("%5d GNU_RELRO mprotect of library '%s' failed: %d (%s)\n",
   1951                    pid, si->name, errno, strerror(errno));
   1952             goto fail;
   1953         }
   1954     }
   1955 
   1956     /* If this is a SET?ID program, dup /dev/null to opened stdin,
   1957        stdout and stderr to close a security hole described in:
   1958 
   1959     ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:23.stdio.asc
   1960 
   1961      */
   1962     if (program_is_setuid)
   1963         nullify_closed_stdio ();
   1964     notify_gdb_of_load(si);
   1965     return 0;
   1966 
   1967 fail:
   1968     ERROR("failed to link %s\n", si->name);
   1969     si->flags |= FLAG_ERROR;
   1970     return -1;
   1971 }
   1972 
   1973 static void parse_library_path(const char *path, char *delim)
   1974 {
   1975     size_t len;
   1976     char *ldpaths_bufp = ldpaths_buf;
   1977     int i = 0;
   1978 
   1979     len = strlcpy(ldpaths_buf, path, sizeof(ldpaths_buf));
   1980 
   1981     while (i < LDPATH_MAX && (ldpaths[i] = strsep(&ldpaths_bufp, delim))) {
   1982         if (*ldpaths[i] != '\0')
   1983             ++i;
   1984     }
   1985 
   1986     /* Forget the last path if we had to truncate; this occurs if the 2nd to
   1987      * last char isn't '\0' (i.e. not originally a delim). */
   1988     if (i > 0 && len >= sizeof(ldpaths_buf) &&
   1989             ldpaths_buf[sizeof(ldpaths_buf) - 2] != '\0') {
   1990         ldpaths[i - 1] = NULL;
   1991     } else {
   1992         ldpaths[i] = NULL;
   1993     }
   1994 }
   1995 
   1996 static void parse_preloads(const char *path, char *delim)
   1997 {
   1998     size_t len;
   1999     char *ldpreloads_bufp = ldpreloads_buf;
   2000     int i = 0;
   2001 
   2002     len = strlcpy(ldpreloads_buf, path, sizeof(ldpreloads_buf));
   2003 
   2004     while (i < LDPRELOAD_MAX && (ldpreload_names[i] = strsep(&ldpreloads_bufp, delim))) {
   2005         if (*ldpreload_names[i] != '\0') {
   2006             ++i;
   2007         }
   2008     }
   2009 
   2010     /* Forget the last path if we had to truncate; this occurs if the 2nd to
   2011      * last char isn't '\0' (i.e. not originally a delim). */
   2012     if (i > 0 && len >= sizeof(ldpreloads_buf) &&
   2013             ldpreloads_buf[sizeof(ldpreloads_buf) - 2] != '\0') {
   2014         ldpreload_names[i - 1] = NULL;
   2015     } else {
   2016         ldpreload_names[i] = NULL;
   2017     }
   2018 }
   2019 
   2020 /*
   2021  * This code is called after the linker has linked itself and
   2022  * fixed it's own GOT. It is safe to make references to externs
   2023  * and other non-local data at this point.
   2024  */
   2025 static unsigned __linker_init_post_relocation(unsigned **elfdata)
   2026 {
   2027     static soinfo linker_soinfo;
   2028 
   2029     int argc = (int) *elfdata;
   2030     char **argv = (char**) (elfdata + 1);
   2031     unsigned *vecs = (unsigned*) (argv + argc + 1);
   2032     unsigned *v;
   2033     soinfo *si;
   2034     struct link_map * map;
   2035     const char *ldpath_env = NULL;
   2036     const char *ldpreload_env = NULL;
   2037 
   2038     /* NOTE: we store the elfdata pointer on a special location
   2039      *       of the temporary TLS area in order to pass it to
   2040      *       the C Library's runtime initializer.
   2041      *
   2042      *       The initializer must clear the slot and reset the TLS
   2043      *       to point to a different location to ensure that no other
   2044      *       shared library constructor can access it.
   2045      */
   2046     __libc_init_tls(elfdata);
   2047 
   2048     pid = getpid();
   2049 
   2050 #if TIMING
   2051     struct timeval t0, t1;
   2052     gettimeofday(&t0, 0);
   2053 #endif
   2054 
   2055     /* Initialize environment functions, and get to the ELF aux vectors table */
   2056     vecs = linker_env_init(vecs);
   2057 
   2058     /* Check auxv for AT_SECURE first to see if program is setuid, setgid,
   2059        has file caps, or caused a SELinux/AppArmor domain transition. */
   2060     for (v = vecs; v[0]; v += 2) {
   2061         if (v[0] == AT_SECURE) {
   2062             /* kernel told us whether to enable secure mode */
   2063             program_is_setuid = v[1];
   2064             goto sanitize;
   2065         }
   2066     }
   2067 
   2068     /* Kernel did not provide AT_SECURE - fall back on legacy test. */
   2069     program_is_setuid = (getuid() != geteuid()) || (getgid() != getegid());
   2070 
   2071 sanitize:
   2072     /* Sanitize environment if we're loading a setuid program */
   2073     if (program_is_setuid)
   2074         linker_env_secure();
   2075 
   2076     debugger_init();
   2077 
   2078     /* Get a few environment variables */
   2079     {
   2080 #if LINKER_DEBUG
   2081         const char* env;
   2082         env = linker_env_get("DEBUG"); /* XXX: TODO: Change to LD_DEBUG */
   2083         if (env)
   2084             debug_verbosity = atoi(env);
   2085 #endif
   2086 
   2087         /* Normally, these are cleaned by linker_env_secure, but the test
   2088          * against program_is_setuid doesn't cost us anything */
   2089         if (!program_is_setuid) {
   2090             ldpath_env = linker_env_get("LD_LIBRARY_PATH");
   2091             ldpreload_env = linker_env_get("LD_PRELOAD");
   2092         }
   2093     }
   2094 
   2095     INFO("[ android linker & debugger ]\n");
   2096     DEBUG("%5d elfdata @ 0x%08x\n", pid, (unsigned)elfdata);
   2097 
   2098     si = alloc_info(argv[0]);
   2099     if(si == 0) {
   2100         exit(-1);
   2101     }
   2102 
   2103         /* bootstrap the link map, the main exe always needs to be first */
   2104     si->flags |= FLAG_EXE;
   2105     map = &(si->linkmap);
   2106 
   2107     map->l_addr = 0;
   2108     map->l_name = argv[0];
   2109     map->l_prev = NULL;
   2110     map->l_next = NULL;
   2111 
   2112     _r_debug.r_map = map;
   2113     r_debug_tail = map;
   2114 
   2115         /* gdb expects the linker to be in the debug shared object list,
   2116          * and we need to make sure that the reported load address is zero.
   2117          * Without this, gdb gets the wrong idea of where rtld_db_dlactivity()
   2118          * is.  Don't use alloc_info(), because the linker shouldn't
   2119          * be on the soinfo list.
   2120          */
   2121     strlcpy((char*) linker_soinfo.name, "/system/bin/linker", sizeof linker_soinfo.name);
   2122     linker_soinfo.flags = 0;
   2123     linker_soinfo.base = 0;     // This is the important part; must be zero.
   2124     insert_soinfo_into_debug_map(&linker_soinfo);
   2125 
   2126         /* extract information passed from the kernel */
   2127     while(vecs[0] != 0){
   2128         switch(vecs[0]){
   2129         case AT_PHDR:
   2130             si->phdr = (Elf32_Phdr*) vecs[1];
   2131             break;
   2132         case AT_PHNUM:
   2133             si->phnum = (int) vecs[1];
   2134             break;
   2135         case AT_ENTRY:
   2136             si->entry = vecs[1];
   2137             break;
   2138         }
   2139         vecs += 2;
   2140     }
   2141 
   2142     /* Compute the value of si->base. We can't rely on the fact that
   2143      * the first entry is the PHDR because this will not be true
   2144      * for certain executables (e.g. some in the NDK unit test suite)
   2145      */
   2146     int nn;
   2147     si->base = 0;
   2148     for ( nn = 0; nn < si->phnum; nn++ ) {
   2149         if (si->phdr[nn].p_type == PT_PHDR) {
   2150             si->base = (Elf32_Addr) si->phdr - si->phdr[nn].p_vaddr;
   2151             break;
   2152         }
   2153     }
   2154     si->dynamic = (unsigned *)-1;
   2155     si->wrprotect_start = 0xffffffff;
   2156     si->wrprotect_end = 0;
   2157     si->refcount = 1;
   2158     si->gnu_relro_start = 0;
   2159     si->gnu_relro_len = 0;
   2160 
   2161         /* Use LD_LIBRARY_PATH if we aren't setuid/setgid */
   2162     if (ldpath_env)
   2163         parse_library_path(ldpath_env, ":");
   2164 
   2165     if (ldpreload_env) {
   2166         parse_preloads(ldpreload_env, " :");
   2167     }
   2168 
   2169     if(link_image(si, 0)) {
   2170         char errmsg[] = "CANNOT LINK EXECUTABLE\n";
   2171         write(2, __linker_dl_err_buf, strlen(__linker_dl_err_buf));
   2172         write(2, errmsg, sizeof(errmsg));
   2173         exit(-1);
   2174     }
   2175 
   2176     call_constructors_recursive(si);
   2177 
   2178 #if ALLOW_SYMBOLS_FROM_MAIN
   2179     /* Set somain after we've loaded all the libraries in order to prevent
   2180      * linking of symbols back to the main image, which is not set up at that
   2181      * point yet.
   2182      */
   2183     somain = si;
   2184 #endif
   2185 
   2186 #if TIMING
   2187     gettimeofday(&t1,NULL);
   2188     PRINT("LINKER TIME: %s: %d microseconds\n", argv[0], (int) (
   2189                (((long long)t1.tv_sec * 1000000LL) + (long long)t1.tv_usec) -
   2190                (((long long)t0.tv_sec * 1000000LL) + (long long)t0.tv_usec)
   2191                ));
   2192 #endif
   2193 #if STATS
   2194     PRINT("RELO STATS: %s: %d abs, %d rel, %d copy, %d symbol\n", argv[0],
   2195            linker_stats.reloc[RELOC_ABSOLUTE],
   2196            linker_stats.reloc[RELOC_RELATIVE],
   2197            linker_stats.reloc[RELOC_COPY],
   2198            linker_stats.reloc[RELOC_SYMBOL]);
   2199 #endif
   2200 #if COUNT_PAGES
   2201     {
   2202         unsigned n;
   2203         unsigned i;
   2204         unsigned count = 0;
   2205         for(n = 0; n < 4096; n++){
   2206             if(bitmask[n]){
   2207                 unsigned x = bitmask[n];
   2208                 for(i = 0; i < 8; i++){
   2209                     if(x & 1) count++;
   2210                     x >>= 1;
   2211                 }
   2212             }
   2213         }
   2214         PRINT("PAGES MODIFIED: %s: %d (%dKB)\n", argv[0], count, count * 4);
   2215     }
   2216 #endif
   2217 
   2218 #if TIMING || STATS || COUNT_PAGES
   2219     fflush(stdout);
   2220 #endif
   2221 
   2222     TRACE("[ %5d Ready to execute '%s' @ 0x%08x ]\n", pid, si->name,
   2223           si->entry);
   2224     return si->entry;
   2225 }
   2226 
   2227 /*
   2228  * Find the value of AT_BASE passed to us by the kernel. This is the load
   2229  * location of the linker.
   2230  */
   2231 static unsigned find_linker_base(unsigned **elfdata) {
   2232     int argc = (int) *elfdata;
   2233     char **argv = (char**) (elfdata + 1);
   2234     unsigned *vecs = (unsigned*) (argv + argc + 1);
   2235     while (vecs[0] != 0) {
   2236         vecs++;
   2237     }
   2238 
   2239     /* The end of the environment block is marked by two NULL pointers */
   2240     vecs++;
   2241 
   2242     while(vecs[0]) {
   2243         if (vecs[0] == AT_BASE) {
   2244             return vecs[1];
   2245         }
   2246         vecs += 2;
   2247     }
   2248 
   2249     return 0; // should never happen
   2250 }
   2251 
   2252 /*
   2253  * This is the entry point for the linker, called from begin.S. This
   2254  * method is responsible for fixing the linker's own relocations, and
   2255  * then calling __linker_init_post_relocation().
   2256  *
   2257  * Because this method is called before the linker has fixed it's own
   2258  * relocations, any attempt to reference an extern variable, extern
   2259  * function, or other GOT reference will generate a segfault.
   2260  */
   2261 unsigned __linker_init(unsigned **elfdata) {
   2262     unsigned linker_addr = find_linker_base(elfdata);
   2263     Elf32_Ehdr *elf_hdr = (Elf32_Ehdr *) linker_addr;
   2264     Elf32_Phdr *phdr =
   2265         (Elf32_Phdr *)((unsigned char *) linker_addr + elf_hdr->e_phoff);
   2266 
   2267     soinfo linker_so;
   2268     memset(&linker_so, 0, sizeof(soinfo));
   2269 
   2270     linker_so.base = linker_addr;
   2271     linker_so.dynamic = (unsigned *) -1;
   2272     linker_so.phdr = phdr;
   2273     linker_so.phnum = elf_hdr->e_phnum;
   2274     linker_so.flags |= FLAG_LINKER;
   2275     linker_so.wrprotect_start = 0xffffffff;
   2276     linker_so.wrprotect_end = 0;
   2277     linker_so.gnu_relro_start = 0;
   2278     linker_so.gnu_relro_len = 0;
   2279 
   2280     if (link_image(&linker_so, 0)) {
   2281         // It would be nice to print an error message, but if the linker
   2282         // can't link itself, there's no guarantee that we'll be able to
   2283         // call write() (because it involves a GOT reference).
   2284         //
   2285         // This situation should never occur unless the linker itself
   2286         // is corrupt.
   2287         exit(-1);
   2288     }
   2289 
   2290     // We have successfully fixed our own relocations. It's safe to run
   2291     // the main part of the linker now.
   2292     return __linker_init_post_relocation(elfdata);
   2293 }
   2294