Fix the parsing of the .fini_array in the dynamic linker (it should happen in reverse order).

Also add a small design overview document for the linker. The latter contains details on
how the initialization/finalization is supposed to work.

2 files changed, 148 insertions, 24 deletions

diff --git a/linker/README.TXT b/linker/README.TXT
new file mode 100644
index 0000000..4fff14e
--- /dev/null
+++ b/linker/README.TXT
@@ -0,0 +1,114 @@
+Android Dynamic Linker Design Notes
+===================================
+
+Introduction:
+-------------
+
+This document provides several notes related to the design of the Android
+dynamic linker.
+
+
+Prelinking:
+-----------
+
+System libraries in Android are internally prelinked, which means that
+any internal relocations within them are stripped from the corresponding
+shared object, in order to reduce size and speed up loading.
+
+Such libraries can only be loaded at the very specific virtual memory address
+they have been prelinked to (during the build process). The list of prelinked
+system libraries and their corresponding virtual memory address is found in
+the file:
+
+   build/core/prelink-linux-<arch>.map
+
+It should be updated each time a new system library is added to the
+system.
+
+The prelink step happens at build time, and uses the 'soslim' and 'apriori'
+tools:
+
+  - 'apriori' is the real prelink tool which removes relocations from the
+    shared object, however, it must be given a list of symbols to remove
+    from the file.
+
+  - 'soslim' is used to find symbols in an executable ELF file
+    and generate a list that can be passed to 'apriori'.
+
+By default, these tools are only used to remove internal symbols from
+libraries, though they have been designed to allow more aggressive
+optimizations (e.g. 'global' prelinking and symbol stripping, which
+prevent replacing individual system libraries though).
+
+You can disable prelinking at build time by modifying your Android.mk with
+a line like:
+
+    LOCAL_PRELINK_MODULE := false
+
+
+Initialization and Termination functions:
+-----------------------------------------
+
+The Unix Sys V Binary Interface standard states that an
+executable can have the following entries in its .dynamic
+section:
+
+  DT_INIT
+      Points to the address of an initialization function
+      that must be called when the file is loaded.
+
+  DT_INIT_ARRAY
+      Points to an array of function addresses that must be
+      called, in-order, to perform initialization. Some of
+      the entries in the array can be 0 or -1, and should
+      be ignored.
+
+      Note: this is generally stored in a .init_array section
+
+  DT_INIT_ARRAYSZ
+      The size of the DT_INITARRAY, if any
+
+  DT_FINI
+      Points to the address of a finalization function which
+      must be called when the file is unloaded or the process
+      terminated.
+
+  DT_FINI_ARRAY
+      Same as DT_INITARRAY but for finalizers. Note that the
+      functions must be called in reverse-order though
+
+      Note: this is generally stroed in a .fini_array section
+
+  DT_FINI_ARRAYSZ
+      Size of FT_FINIARRAY
+
+  DT_PREINIT_ARRAY
+      An array similar to DT_INIT_ARRAY which must *only* be
+      present in executables, not shared libraries, which contains
+      a list of functions that need to be called before any other
+      initialization function (i.e. DT_INIT and/or DT_INIT_ARRAY)
+
+      Note: this is generally stroed in a .preinit_array section
+
+  DT_PREINIT_ARRAYSZ
+      The size of DT_PREINIT_ARRAY
+
+If both a DT_INIT and DT_INITARRAY entry are present, the DT_INIT
+function must be called before the DT_INITARRAY functions.
+
+Consequently, the DT_FINIARRAY must be parsed in reverse order before
+the DT_FINI function, if both are available.
+
+Note that the implementation of static C++ constructors is very
+much processor dependent, and may use different ELF sections.
+
+On the ARM (see "C++ ABI for ARM" document), the static constructors
+must be called explicitely from the DT_INIT_ARRAY, and each one of them
+shall register a destructor by calling the special __eabi_atexit()
+function (provided by the C library). The DT_FINI_ARRAY is not used
+by static C++ destructors.
+
+On x86, the lists of constructors and destructors are placed in special
+sections named ".ctors" and ".dtors", and the DT_INIT / DT_FINI functions
+are in charge of calling them explicitely.
+
diff --git a/linker/linker.c b/linker/linker.c
index bb3b8e7..5180ae0 100644
--- a/linker/linker.c
+++ b/linker/linker.c
@@ -1248,13 +1248,38 @@ static int reloc_library(soinfo *si, Elf32_Rel *rel, unsigned count)
     return 0;
 }
 
-static void call_array(unsigned *ctor, int count)
+
+/* Please read the "Initialization and Termination functions" functions.
+ * of the linker design note in bionic/linker/README.TXT to understand
+ * what the following code is doing.
+ *
+ * The important things to remember are:
+ *
+ *   DT_PREINIT_ARRAY must be called first for executables, and should
+ *   not appear in shared libraries.
+ *
+ *   DT_INIT should be called before DT_INIT_ARRAY if both are present
+ *
+ *   DT_FINI should be called after DT_FINI_ARRAY if both are present
+ *
+ *   DT_FINI_ARRAY must be parsed in reverse order.
+ */
+
+static void call_array(unsigned *ctor, int count, int reverse)
 {
-    int n;
-    for(n = count; n > 0; n--){
-        TRACE("[ %5d Looking at ctor *0x%08x == 0x%08x ]\n", pid,
+    int n, inc = 1;
+
+    if (reverse) {
+        ctor += (count-1);
+        inc   = -1;
+    }
+
+    for(n = count; n > 0; n--) {
+        TRACE("[ %5d Looking at %s *0x%08x == 0x%08x ]\n", pid,
+              reverse ? "dtor" : "ctor",
               (unsigned)ctor, (unsigned)*ctor);
-        void (*func)() = (void (*)()) *ctor++;
+        void (*func)() = (void (*)()) *ctor;
+        ctor += inc;
         if(((int) func == 0) || ((int) func == -1)) continue;
         TRACE("[ %5d Calling func @ 0x%08x ]\n", pid, (unsigned)func);
         func();
@@ -1263,17 +1288,11 @@ static void call_array(unsigned *ctor, int count)
 
 static void call_constructors(soinfo *si)
 {
-    /* TODO: THE ORIGINAL CODE SEEMED TO CALL THE INIT FUNCS IN THE WRONG ORDER.
-     *       Old order: init, init_array, preinit_array..
-     *       Correct order: preinit_array, init, init_array.
-     *       Verify WHY.
-     */
-
     if (si->flags & FLAG_EXE) {
         TRACE("[ %5d Calling preinit_array @ 0x%08x [%d] for '%s' ]\n",
               pid, (unsigned)si->preinit_array, si->preinit_array_count,
               si->name);
-        call_array(si->preinit_array, si->preinit_array_count);
+        call_array(si->preinit_array, si->preinit_array_count, 0);
         TRACE("[ %5d Done calling preinit_array for '%s' ]\n", pid, si->name);
     } else {
         if (si->preinit_array) {
@@ -1283,11 +1302,6 @@ static void call_constructors(soinfo *si)
         }
     }
 
-    // If we have an init section, then we should call it now, to make sure
-    // that all the funcs in the .ctors section get run.
-    // Note: For ARM, we shouldn't have a .ctor section (should be empty)
-    // when we have an (pre)init_array section, but let's be compatible with
-    // old (non-eabi) binaries and try the _init (DT_INIT) anyway.
     if (si->init_func) {
         TRACE("[ %5d Calling init_func @ 0x%08x for '%s' ]\n", pid,
               (unsigned)si->init_func, si->name);
@@ -1298,25 +1312,21 @@ static void call_constructors(soinfo *si)
     if (si->init_array) {
         TRACE("[ %5d Calling init_array @ 0x%08x [%d] for '%s' ]\n", pid,
               (unsigned)si->init_array, si->init_array_count, si->name);
-        call_array(si->init_array, si->init_array_count);
+        call_array(si->init_array, si->init_array_count, 0);
         TRACE("[ %5d Done calling init_array for '%s' ]\n", pid, si->name);
     }
 }
 
+
 static void call_destructors(soinfo *si)
 {
     if (si->fini_array) {
         TRACE("[ %5d Calling fini_array @ 0x%08x [%d] for '%s' ]\n", pid,
               (unsigned)si->fini_array, si->fini_array_count, si->name);
-        call_array(si->fini_array, si->fini_array_count);
+        call_array(si->fini_array, si->fini_array_count, 1);
         TRACE("[ %5d Done calling fini_array for '%s' ]\n", pid, si->name);
     }
 
-    // If we have an fini section, then we should call it now, to make sure
-    // that all the funcs in the .dtors section get run.
-    // Note: For ARM, we shouldn't have a .dtor section (should be empty)
-    // when we have an fini_array section, but let's be compatible with
-    // old (non-eabi) binaries and try the _fini (DT_FINI) anyway.
     if (si->fini_func) {
         TRACE("[ %5d Calling fini_func @ 0x%08x for '%s' ]\n", pid,
               (unsigned)si->fini_func, si->name);