Merge "Fix WCHAR_MAX, WCHAR_MIN, WINT_MAX, and WINT_MIN."
diff --git a/libc/include/android/dlext.h b/libc/include/android/dlext.h
new file mode 100644
index 0000000..90962fa
--- /dev/null
+++ b/libc/include/android/dlext.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __ANDROID_DLEXT_H__
+#define __ANDROID_DLEXT_H__
+
+#include <stddef.h>
+#include <sys/cdefs.h>
+
+__BEGIN_DECLS
+
+/* bitfield definitions for android_dlextinfo.flags */
+enum {
+  /* When set, the reserved_addr and reserved_size fields must point to an
+   * already-reserved region of address space which will be used to load the
+   * library if it fits. If the reserved region is not large enough, the load
+   * will fail.
+   */
+  ANDROID_DLEXT_RESERVED_ADDRESS      = 0x1,
+
+  /* As DLEXT_RESERVED_ADDRESS, but if the reserved region is not large enough,
+   * the linker will choose an available address instead.
+   */
+  ANDROID_DLEXT_RESERVED_ADDRESS_HINT = 0x2,
+
+  /* When set, write the GNU RELRO section of the mapped library to relro_fd
+   * after relocation has been performed, to allow it to be reused by another
+   * process loading the same library at the same address. This implies
+   * ANDROID_DLEXT_USE_RELRO.
+   */
+  ANDROID_DLEXT_WRITE_RELRO           = 0x4,
+
+  /* When set, compare the GNU RELRO section of the mapped library to relro_fd
+   * after relocation has been performed, and replace any relocated pages that
+   * are identical with a version mapped from the file.
+   */
+  ANDROID_DLEXT_USE_RELRO             = 0x8,
+
+  /* Mask of valid bits */
+  ANDROID_DLEXT_VALID_FLAG_BITS       = ANDROID_DLEXT_RESERVED_ADDRESS |
+                                        ANDROID_DLEXT_RESERVED_ADDRESS_HINT |
+                                        ANDROID_DLEXT_WRITE_RELRO |
+                                        ANDROID_DLEXT_USE_RELRO,
+};
+
+typedef struct {
+  int     flags;
+  void*   reserved_addr;
+  size_t  reserved_size;
+  int     relro_fd;
+} android_dlextinfo;
+
+extern void* android_dlopen_ext(const char* filename, int flag, const android_dlextinfo* extinfo);
+
+__END_DECLS
+
+#endif /* __ANDROID_DLEXT_H__ */
diff --git a/libdl/libdl.c b/libdl/libdl.c
index 310db54..dca51b0 100644
--- a/libdl/libdl.c
+++ b/libdl/libdl.c
@@ -17,6 +17,7 @@
 #include <dlfcn.h>
 #include <link.h>
 #include <stdlib.h>
+#include <android/dlext.h>
 
 // These are stubs for functions that are actually defined
 // in the dynamic linker and hijacked at runtime.
@@ -27,11 +28,13 @@
 int dladdr(const void* addr __unused, Dl_info* info __unused) { return 0; }
 int dlclose(void* handle __unused) { return 0; }
 
-void android_get_LD_LIBRARY_PATH(char* buffer __unused, size_t buffer_size __unused) { }
-void android_update_LD_LIBRARY_PATH(const char* ld_library_path __unused) { }
-
 #if defined(__arm__)
 _Unwind_Ptr dl_unwind_find_exidx(_Unwind_Ptr pc __unused, int* pcount __unused) { return 0; }
 #endif
 
 int dl_iterate_phdr(int (*cb)(struct dl_phdr_info* info, size_t size, void* data) __unused, void* data __unused) { return 0; }
+
+void android_get_LD_LIBRARY_PATH(char* buffer __unused, size_t buffer_size __unused) { }
+void android_update_LD_LIBRARY_PATH(const char* ld_library_path __unused) { }
+
+void* android_dlopen_ext(const char* filename __unused, int flag __unused, const android_dlextinfo* extinfo __unused) { return 0; }
diff --git a/linker/dlfcn.cpp b/linker/dlfcn.cpp
index 6e70808..0292bdf 100644
--- a/linker/dlfcn.cpp
+++ b/linker/dlfcn.cpp
@@ -20,6 +20,7 @@
 #include <pthread.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <android/dlext.h>
 
 #include <bionic/pthread_internal.h>
 #include "private/bionic_tls.h"
@@ -64,9 +65,10 @@
   do_android_update_LD_LIBRARY_PATH(ld_library_path);
 }
 
-void* dlopen(const char* filename, int flags) {
+void* android_dlopen_ext(const char* filename, int flags, const android_dlextinfo* extinfo)
+{
   ScopedPthreadMutexLocker locker(&gDlMutex);
-  soinfo* result = do_dlopen(filename, flags);
+  soinfo* result = do_dlopen(filename, flags, extinfo);
   if (result == NULL) {
     __bionic_format_dlerror("dlopen failed", linker_get_error_buffer());
     return NULL;
@@ -74,6 +76,10 @@
   return result;
 }
 
+void* dlopen(const char* filename, int flags) {
+  return android_dlopen_ext(filename, flags, NULL);
+}
+
 void* dlsym(void* handle, const char* symbol) {
   ScopedPthreadMutexLocker locker(&gDlMutex);
 
@@ -168,15 +174,15 @@
     }
 
 #if defined(__arm__)
-  // 0000000 00011111 111112 22222222 2333333 3333444444444455555555556666666 6667777777777888888888899999 9999900000000001 1
-  // 0123456 78901234 567890 12345678 9012345 6789012345678901234567890123456 7890123456789012345678901234 5678901234567890 1
+  // 0000000 00011111 111112 22222222 2333333 3333444444444455555555556666666 6667777777777888888888899999 9999900000000001 1111111112222222222 333333333344444444445
+  // 0123456 78901234 567890 12345678 9012345 6789012345678901234567890123456 7890123456789012345678901234 5678901234567890 1234567890123456789 012345678901234567890
 #  define ANDROID_LIBDL_STRTAB \
-    "dlopen\0dlclose\0dlsym\0dlerror\0dladdr\0android_update_LD_LIBRARY_PATH\0android_get_LD_LIBRARY_PATH\0dl_iterate_phdr\0dl_unwind_find_exidx\0"
+    "dlopen\0dlclose\0dlsym\0dlerror\0dladdr\0android_update_LD_LIBRARY_PATH\0android_get_LD_LIBRARY_PATH\0dl_iterate_phdr\0android_dlopen_ext\0dl_unwind_find_exidx\0"
 #elif defined(__aarch64__) || defined(__i386__) || defined(__mips__) || defined(__x86_64__)
-  // 0000000 00011111 111112 22222222 2333333 3333444444444455555555556666666 6667777777777888888888899999 9999900000000001 1
-  // 0123456 78901234 567890 12345678 9012345 6789012345678901234567890123456 7890123456789012345678901234 5678901234567890 1
+  // 0000000 00011111 111112 22222222 2333333 3333444444444455555555556666666 6667777777777888888888899999 9999900000000001 1111111112222222222
+  // 0123456 78901234 567890 12345678 9012345 6789012345678901234567890123456 7890123456789012345678901234 5678901234567890 1234567890123456789
 #  define ANDROID_LIBDL_STRTAB \
-    "dlopen\0dlclose\0dlsym\0dlerror\0dladdr\0android_update_LD_LIBRARY_PATH\0android_get_LD_LIBRARY_PATH\0dl_iterate_phdr\0"
+    "dlopen\0dlclose\0dlsym\0dlerror\0dladdr\0android_update_LD_LIBRARY_PATH\0android_get_LD_LIBRARY_PATH\0dl_iterate_phdr\0android_dlopen_ext\0"
 #else
 #  error Unsupported architecture. Only arm, arm64, mips, mips64, x86 and x86_64 are presently supported.
 #endif
@@ -195,8 +201,9 @@
   ELFW(SYM_INITIALIZER)( 36, &android_update_LD_LIBRARY_PATH, 1),
   ELFW(SYM_INITIALIZER)( 67, &android_get_LD_LIBRARY_PATH, 1),
   ELFW(SYM_INITIALIZER)( 95, &dl_iterate_phdr, 1),
+  ELFW(SYM_INITIALIZER)(111, &android_dlopen_ext, 1),
 #if defined(__arm__)
-  ELFW(SYM_INITIALIZER)(111, &dl_unwind_find_exidx, 1),
+  ELFW(SYM_INITIALIZER)(130, &dl_unwind_find_exidx, 1),
 #endif
 };
 
@@ -213,9 +220,9 @@
 // Note that adding any new symbols here requires stubbing them out in libdl.
 static unsigned gLibDlBuckets[1] = { 1 };
 #if defined(__arm__)
-static unsigned gLibDlChains[] = { 0, 2, 3, 4, 5, 6, 7, 8, 9, 0 };
+static unsigned gLibDlChains[] = { 0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 0 };
 #else
-static unsigned gLibDlChains[] = { 0, 2, 3, 4, 5, 6, 7, 8, 0 };
+static unsigned gLibDlChains[] = { 0, 2, 3, 4, 5, 6, 7, 8, 9, 0 };
 #endif
 
 // This is used by the dynamic linker. Every process gets these symbols for free.
diff --git a/linker/linker.cpp b/linker/linker.cpp
index 8e4c13c..4d8563e 100755
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -65,7 +65,7 @@
  *   and NOEXEC
  */
 
-static bool soinfo_link_image(soinfo* si);
+static bool soinfo_link_image(soinfo* si, const android_dlextinfo* extinfo);
 static ElfW(Addr) get_elf_exec_load_bias(const ElfW(Ehdr)* elf);
 
 // We can't use malloc(3) in the dynamic linker. We use a linked list of anonymous
@@ -690,7 +690,7 @@
   return fd;
 }
 
-static soinfo* load_library(const char* name) {
+static soinfo* load_library(const char* name, const android_dlextinfo* extinfo) {
     // Open the file.
     int fd = open_library(name);
     if (fd == -1) {
@@ -700,7 +700,7 @@
 
     // Read the ELF header and load the segments.
     ElfReader elf_reader(name, fd);
-    if (!elf_reader.Load()) {
+    if (!elf_reader.Load(extinfo)) {
         return NULL;
     }
 
@@ -735,7 +735,7 @@
     return NULL;
 }
 
-static soinfo* find_library_internal(const char* name) {
+static soinfo* find_library_internal(const char* name, const android_dlextinfo* extinfo) {
   if (name == NULL) {
     return somain;
   }
@@ -750,7 +750,7 @@
   }
 
   TRACE("[ '%s' has not been loaded yet.  Locating...]", name);
-  si = load_library(name);
+  si = load_library(name, extinfo);
   if (si == NULL) {
     return NULL;
   }
@@ -760,7 +760,7 @@
   TRACE("[ find_library_internal base=%p size=%zu name='%s' ]",
         reinterpret_cast<void*>(si->base), si->size, si->name);
 
-  if (!soinfo_link_image(si)) {
+  if (!soinfo_link_image(si, extinfo)) {
     munmap(reinterpret_cast<void*>(si->base), si->size);
     soinfo_free(si);
     return NULL;
@@ -769,8 +769,8 @@
   return si;
 }
 
-static soinfo* find_library(const char* name) {
-  soinfo* si = find_library_internal(name);
+static soinfo* find_library(const char* name, const android_dlextinfo* extinfo) {
+  soinfo* si = find_library_internal(name, extinfo);
   if (si != NULL) {
     si->ref_count++;
   }
@@ -811,13 +811,17 @@
   }
 }
 
-soinfo* do_dlopen(const char* name, int flags) {
+soinfo* do_dlopen(const char* name, int flags, const android_dlextinfo* extinfo) {
   if ((flags & ~(RTLD_NOW|RTLD_LAZY|RTLD_LOCAL|RTLD_GLOBAL)) != 0) {
     DL_ERR("invalid flags to dlopen: %x", flags);
     return NULL;
   }
+  if (extinfo != NULL && ((extinfo->flags & ~(ANDROID_DLEXT_VALID_FLAG_BITS)) != 0)) {
+    DL_ERR("invalid extended flags to android_dlopen_ext: %x", extinfo->flags);
+    return NULL;
+  }
   set_soinfo_pool_protection(PROT_READ | PROT_WRITE);
-  soinfo* si = find_library(name);
+  soinfo* si = find_library(name, extinfo);
   if (si != NULL) {
     si->CallConstructors();
   }
@@ -1562,7 +1566,7 @@
     return return_value;
 }
 
-static bool soinfo_link_image(soinfo* si) {
+static bool soinfo_link_image(soinfo* si, const android_dlextinfo* extinfo) {
     /* "base" might wrap around UINT32_MAX. */
     ElfW(Addr) base = si->load_bias;
     const ElfW(Phdr)* phdr = si->phdr;
@@ -1799,7 +1803,7 @@
         memset(gLdPreloads, 0, sizeof(gLdPreloads));
         size_t preload_count = 0;
         for (size_t i = 0; gLdPreloadNames[i] != NULL; i++) {
-            soinfo* lsi = find_library(gLdPreloadNames[i]);
+            soinfo* lsi = find_library(gLdPreloadNames[i], NULL);
             if (lsi != NULL) {
                 gLdPreloads[preload_count++] = lsi;
             } else {
@@ -1817,7 +1821,7 @@
         if (d->d_tag == DT_NEEDED) {
             const char* library_name = si->strtab + d->d_un.d_val;
             DEBUG("%s needs %s", si->name, library_name);
-            soinfo* lsi = find_library(library_name);
+            soinfo* lsi = find_library(library_name, NULL);
             if (lsi == NULL) {
                 strlcpy(tmp_err_buf, linker_get_error_buffer(), sizeof(tmp_err_buf));
                 DL_ERR("could not load library \"%s\" needed by \"%s\"; caused by %s",
@@ -1900,6 +1904,23 @@
         return false;
     }
 
+    /* Handle serializing/sharing the RELRO segment */
+    if (extinfo && (extinfo->flags & ANDROID_DLEXT_WRITE_RELRO)) {
+      if (phdr_table_serialize_gnu_relro(si->phdr, si->phnum, si->load_bias,
+                                         extinfo->relro_fd) < 0) {
+        DL_ERR("failed serializing GNU RELRO section for \"%s\": %s",
+               si->name, strerror(errno));
+        return false;
+      }
+    } else if (extinfo && (extinfo->flags & ANDROID_DLEXT_USE_RELRO)) {
+      if (phdr_table_map_gnu_relro(si->phdr, si->phnum, si->load_bias,
+                                   extinfo->relro_fd) < 0) {
+        DL_ERR("failed mapping GNU RELRO section for \"%s\": %s",
+               si->name, strerror(errno));
+        return false;
+      }
+    }
+
     notify_gdb_of_load(si);
     return true;
 }
@@ -1925,7 +1946,7 @@
   si->flags = 0;
   si->load_bias = get_elf_exec_load_bias(ehdr_vdso);
 
-  soinfo_link_image(si);
+  soinfo_link_image(si, NULL);
 #endif
 }
 
@@ -2053,7 +2074,7 @@
 
     somain = si;
 
-    if (!soinfo_link_image(si)) {
+    if (!soinfo_link_image(si, NULL)) {
         __libc_format_fd(2, "CANNOT LINK EXECUTABLE: %s\n", linker_get_error_buffer());
         exit(EXIT_FAILURE);
     }
@@ -2170,7 +2191,7 @@
   linker_so.phnum = elf_hdr->e_phnum;
   linker_so.flags |= FLAG_LINKER;
 
-  if (!soinfo_link_image(&linker_so)) {
+  if (!soinfo_link_image(&linker_so, NULL)) {
     // It would be nice to print an error message, but if the linker
     // can't link itself, there's no guarantee that we'll be able to
     // call write() (because it involves a GOT reference). We may as
diff --git a/linker/linker.h b/linker/linker.h
index b8d0587..93ab51d 100644
--- a/linker/linker.h
+++ b/linker/linker.h
@@ -32,6 +32,7 @@
 #include <elf.h>
 #include <link.h>
 #include <unistd.h>
+#include <android/dlext.h>
 
 #include "private/libc_logging.h"
 
@@ -192,7 +193,7 @@
 
 void do_android_get_LD_LIBRARY_PATH(char*, size_t);
 void do_android_update_LD_LIBRARY_PATH(const char* ld_library_path);
-soinfo* do_dlopen(const char* name, int flags);
+soinfo* do_dlopen(const char* name, int flags, const android_dlextinfo* extinfo);
 int do_dlclose(soinfo* si);
 
 ElfW(Sym)* dlsym_linear_lookup(const char* name, soinfo** found, soinfo* start);
diff --git a/linker/linker_phdr.cpp b/linker/linker_phdr.cpp
index 7c5d3f6..cfeab96 100644
--- a/linker/linker_phdr.cpp
+++ b/linker/linker_phdr.cpp
@@ -31,6 +31,9 @@
 #include <errno.h>
 #include <machine/exec.h>
 #include <sys/mman.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
 
 #include "linker.h"
 #include "linker_debug.h"
@@ -132,11 +135,11 @@
   }
 }
 
-bool ElfReader::Load() {
+bool ElfReader::Load(const android_dlextinfo* extinfo) {
   return ReadElfHeader() &&
          VerifyElfHeader() &&
          ReadProgramHeader() &&
-         ReserveAddressSpace() &&
+         ReserveAddressSpace(extinfo) &&
          LoadSegments() &&
          FindPhdr();
 }
@@ -291,7 +294,7 @@
 // Reserve a virtual address range big enough to hold all loadable
 // segments of a program header table. This is done by creating a
 // private anonymous mmap() with PROT_NONE.
-bool ElfReader::ReserveAddressSpace() {
+bool ElfReader::ReserveAddressSpace(const android_dlextinfo* extinfo) {
   ElfW(Addr) min_vaddr;
   load_size_ = phdr_table_get_load_size(phdr_table_, phdr_num_, &min_vaddr);
   if (load_size_ == 0) {
@@ -300,11 +303,33 @@
   }
 
   uint8_t* addr = reinterpret_cast<uint8_t*>(min_vaddr);
-  int mmap_flags = MAP_PRIVATE | MAP_ANONYMOUS;
-  void* start = mmap(addr, load_size_, PROT_NONE, mmap_flags, -1, 0);
-  if (start == MAP_FAILED) {
-    DL_ERR("couldn't reserve %zd bytes of address space for \"%s\"", load_size_, name_);
-    return false;
+  void* start;
+  size_t reserved_size = 0;
+  bool reserved_hint = true;
+
+  if (extinfo != NULL) {
+    if (extinfo->flags & ANDROID_DLEXT_RESERVED_ADDRESS) {
+      reserved_size = extinfo->reserved_size;
+      reserved_hint = false;
+    } else if (extinfo->flags & ANDROID_DLEXT_RESERVED_ADDRESS_HINT) {
+      reserved_size = extinfo->reserved_size;
+    }
+  }
+
+  if (load_size_ > reserved_size) {
+    if (!reserved_hint) {
+      DL_ERR("reserved address space %zd smaller than %zd bytes needed for \"%s\"",
+             reserved_size - load_size_, load_size_, name_);
+      return false;
+    }
+    int mmap_flags = MAP_PRIVATE | MAP_ANONYMOUS;
+    start = mmap(addr, load_size_, PROT_NONE, mmap_flags, -1, 0);
+    if (start == MAP_FAILED) {
+      DL_ERR("couldn't reserve %zd bytes of address space for \"%s\"", load_size_, name_);
+      return false;
+    }
+  } else {
+    start = extinfo->reserved_addr;
   }
 
   load_start_ = start;
@@ -501,6 +526,129 @@
   return _phdr_table_set_gnu_relro_prot(phdr_table, phdr_count, load_bias, PROT_READ);
 }
 
+/* Serialize the GNU relro segments to the given file descriptor. This can be
+ * performed after relocations to allow another process to later share the
+ * relocated segment, if it was loaded at the same address.
+ *
+ * Input:
+ *   phdr_table  -> program header table
+ *   phdr_count  -> number of entries in tables
+ *   load_bias   -> load bias
+ *   fd          -> writable file descriptor to use
+ * Return:
+ *   0 on error, -1 on failure (error code in errno).
+ */
+int phdr_table_serialize_gnu_relro(const ElfW(Phdr)* phdr_table, size_t phdr_count, ElfW(Addr) load_bias,
+                                   int fd) {
+  const ElfW(Phdr)* phdr = phdr_table;
+  const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
+  ssize_t file_offset = 0;
+
+  for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
+    if (phdr->p_type != PT_GNU_RELRO) {
+      continue;
+    }
+
+    ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
+    ElfW(Addr) seg_page_end   = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
+    ssize_t size = seg_page_end - seg_page_start;
+
+    ssize_t written = TEMP_FAILURE_RETRY(write(fd, reinterpret_cast<void*>(seg_page_start), size));
+    if (written != size) {
+      return -1;
+    }
+    void* map = mmap(reinterpret_cast<void*>(seg_page_start), size, PROT_READ,
+                     MAP_PRIVATE|MAP_FIXED, fd, file_offset);
+    if (map == MAP_FAILED) {
+      return -1;
+    }
+    file_offset += size;
+  }
+  return 0;
+}
+
+/* Where possible, replace the GNU relro segments with mappings of the given
+ * file descriptor. This can be performed after relocations to allow a file
+ * previously created by phdr_table_serialize_gnu_relro in another process to
+ * replace the dirty relocated pages, saving memory, if it was loaded at the
+ * same address. We have to compare the data before we map over it, since some
+ * parts of the relro segment may not be identical due to other libraries in
+ * the process being loaded at different addresses.
+ *
+ * Input:
+ *   phdr_table  -> program header table
+ *   phdr_count  -> number of entries in tables
+ *   load_bias   -> load bias
+ *   fd          -> readable file descriptor to use
+ * Return:
+ *   0 on error, -1 on failure (error code in errno).
+ */
+int phdr_table_map_gnu_relro(const ElfW(Phdr)* phdr_table, size_t phdr_count, ElfW(Addr) load_bias,
+                             int fd) {
+  // Map the file at a temporary location so we can compare its contents.
+  struct stat file_stat;
+  if (TEMP_FAILURE_RETRY(fstat(fd, &file_stat)) != 0) {
+    return -1;
+  }
+  off_t file_size = file_stat.st_size;
+  void* temp_mapping = mmap(NULL, file_size, PROT_READ, MAP_PRIVATE, fd, 0);
+  if (temp_mapping == MAP_FAILED) {
+    return -1;
+  }
+  size_t file_offset = 0;
+
+  // Iterate over the relro segments and compare/remap the pages.
+  const ElfW(Phdr)* phdr = phdr_table;
+  const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
+
+  for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
+    if (phdr->p_type != PT_GNU_RELRO) {
+      continue;
+    }
+
+    ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
+    ElfW(Addr) seg_page_end   = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
+
+    char* file_base = static_cast<char*>(temp_mapping) + file_offset;
+    char* mem_base = reinterpret_cast<char*>(seg_page_start);
+    size_t match_offset = 0;
+    size_t size = seg_page_end - seg_page_start;
+
+    while (match_offset < size) {
+      // Skip over dissimilar pages.
+      while (match_offset < size &&
+             memcmp(mem_base + match_offset, file_base + match_offset, PAGE_SIZE) != 0) {
+        match_offset += PAGE_SIZE;
+      }
+
+      // Count similar pages.
+      size_t mismatch_offset = match_offset;
+      while (mismatch_offset < size &&
+             memcmp(mem_base + mismatch_offset, file_base + mismatch_offset, PAGE_SIZE) == 0) {
+        mismatch_offset += PAGE_SIZE;
+      }
+
+      // Map over similar pages.
+      if (mismatch_offset > match_offset) {
+        void* map = mmap(mem_base + match_offset, mismatch_offset - match_offset,
+                         PROT_READ, MAP_PRIVATE|MAP_FIXED, fd, match_offset);
+        if (map == MAP_FAILED) {
+          munmap(temp_mapping, file_size);
+          return -1;
+        }
+      }
+
+      match_offset = mismatch_offset;
+    }
+
+    // Add to the base file offset in case there are multiple relro segments.
+    file_offset += size;
+  }
+  munmap(temp_mapping, file_size);
+  return 0;
+}
+
+
 #if defined(__arm__)
 
 #  ifndef PT_ARM_EXIDX
diff --git a/linker/linker_phdr.h b/linker/linker_phdr.h
index 6b72caf..611f1a7 100644
--- a/linker/linker_phdr.h
+++ b/linker/linker_phdr.h
@@ -42,7 +42,7 @@
   ElfReader(const char* name, int fd);
   ~ElfReader();
 
-  bool Load();
+  bool Load(const android_dlextinfo* extinfo);
 
   size_t phdr_count() { return phdr_num_; }
   ElfW(Addr) load_start() { return reinterpret_cast<ElfW(Addr)>(load_start_); }
@@ -54,7 +54,7 @@
   bool ReadElfHeader();
   bool VerifyElfHeader();
   bool ReadProgramHeader();
-  bool ReserveAddressSpace();
+  bool ReserveAddressSpace(const android_dlextinfo* extinfo);
   bool LoadSegments();
   bool FindPhdr();
   bool CheckPhdr(ElfW(Addr));
@@ -89,6 +89,11 @@
 
 int phdr_table_protect_gnu_relro(const ElfW(Phdr)* phdr_table, size_t phdr_count, ElfW(Addr) load_bias);
 
+int phdr_table_serialize_gnu_relro(const ElfW(Phdr)* phdr_table, size_t phdr_count, ElfW(Addr) load_bias,
+                                   int fd);
+
+int phdr_table_map_gnu_relro(const ElfW(Phdr)* phdr_table, size_t phdr_count, ElfW(Addr) load_bias,
+                             int fd);
 
 #if defined(__arm__)
 int phdr_table_get_arm_exidx(const ElfW(Phdr)* phdr_table, size_t phdr_count, ElfW(Addr) load_bias,
diff --git a/tests/Android.mk b/tests/Android.mk
index 723d7cf..d2bcce8 100644
--- a/tests/Android.mk
+++ b/tests/Android.mk
@@ -190,6 +190,18 @@
 endif
 
 # -----------------------------------------------------------------------------
+# Library used by dlext tests.
+# -----------------------------------------------------------------------------
+libdlext_test_src_files := \
+    dlext_test_library.cpp \
+
+module := libdlext_test
+module_tag := optional
+build_type := target
+build_target := SHARED_LIBRARY
+include $(LOCAL_PATH)/Android.build.mk
+
+# -----------------------------------------------------------------------------
 # Tests for the device using bionic's .so. Run with:
 #   adb shell /data/nativetest/bionic-unit-tests/bionic-unit-tests
 # -----------------------------------------------------------------------------
@@ -197,6 +209,7 @@
     libBionicTests \
 
 bionic-unit-tests_src_files := \
+    dlext_test.cpp \
     dlfcn_test.cpp \
 
 bionic-unit-tests_ldflags := \
diff --git a/tests/dlext_test.cpp b/tests/dlext_test.cpp
new file mode 100644
index 0000000..14dff2b
--- /dev/null
+++ b/tests/dlext_test.cpp
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include <dlfcn.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <android/dlext.h>
+#include <sys/mman.h>
+#include <sys/wait.h>
+
+
+#define ASSERT_DL_NOTNULL(ptr) \
+    ASSERT_TRUE(ptr != NULL) << "dlerror: " << dlerror()
+
+#define ASSERT_DL_ZERO(i) \
+    ASSERT_EQ(0, i) << "dlerror: " << dlerror()
+
+#define ASSERT_NOERROR(i) \
+    ASSERT_NE(-1, i) << "errno: " << strerror(errno)
+
+
+typedef int (*fn)(void);
+#define LIBNAME "libdlext_test.so"
+#define LIBSIZE 1024*1024 // how much address space to reserve for it
+#define RELRO_FILE "/data/local/tmp/libdlext_test.relro"
+
+
+class DlExtTest : public ::testing::Test {
+protected:
+  virtual void SetUp() {
+    handle_ = NULL;
+    // verify that we don't have the library loaded already
+    ASSERT_EQ(NULL, dlsym(RTLD_DEFAULT, "getRandomNumber"));
+    // call dlerror() to swallow the error, and check it was the one we wanted
+    ASSERT_STREQ("undefined symbol: getRandomNumber", dlerror());
+  }
+
+  virtual void TearDown() {
+    if (handle_ != NULL) {
+      ASSERT_DL_ZERO(dlclose(handle_));
+    }
+  }
+
+  void* handle_;
+};
+
+TEST_F(DlExtTest, ExtInfoNull) {
+  handle_ = android_dlopen_ext(LIBNAME, RTLD_NOW, NULL);
+  ASSERT_DL_NOTNULL(handle_);
+  fn f = reinterpret_cast<fn>(dlsym(handle_, "getRandomNumber"));
+  ASSERT_DL_NOTNULL(f);
+  EXPECT_EQ(4, f());
+}
+
+TEST_F(DlExtTest, ExtInfoNoFlags) {
+  android_dlextinfo extinfo;
+  extinfo.flags = 0;
+  handle_ = android_dlopen_ext(LIBNAME, RTLD_NOW, &extinfo);
+  ASSERT_DL_NOTNULL(handle_);
+  fn f = reinterpret_cast<fn>(dlsym(handle_, "getRandomNumber"));
+  ASSERT_DL_NOTNULL(f);
+  EXPECT_EQ(4, f());
+}
+
+TEST_F(DlExtTest, Reserved) {
+  void* start = mmap(NULL, LIBSIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
+                     -1, 0);
+  ASSERT_TRUE(start != MAP_FAILED);
+  android_dlextinfo extinfo;
+  extinfo.flags = ANDROID_DLEXT_RESERVED_ADDRESS;
+  extinfo.reserved_addr = start;
+  extinfo.reserved_size = LIBSIZE;
+  handle_ = android_dlopen_ext(LIBNAME, RTLD_NOW, &extinfo);
+  ASSERT_DL_NOTNULL(handle_);
+  fn f = reinterpret_cast<fn>(dlsym(handle_, "getRandomNumber"));
+  ASSERT_DL_NOTNULL(f);
+  EXPECT_GE(f, start);
+  EXPECT_LT(reinterpret_cast<void*>(f),
+            reinterpret_cast<char*>(start) + LIBSIZE);
+  EXPECT_EQ(4, f());
+}
+
+TEST_F(DlExtTest, ReservedTooSmall) {
+  void* start = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
+                     -1, 0);
+  ASSERT_TRUE(start != MAP_FAILED);
+  android_dlextinfo extinfo;
+  extinfo.flags = ANDROID_DLEXT_RESERVED_ADDRESS;
+  extinfo.reserved_addr = start;
+  extinfo.reserved_size = PAGE_SIZE;
+  handle_ = android_dlopen_ext(LIBNAME, RTLD_NOW, &extinfo);
+  EXPECT_EQ(NULL, handle_);
+}
+
+TEST_F(DlExtTest, ReservedHint) {
+  void* start = mmap(NULL, LIBSIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
+                     -1, 0);
+  ASSERT_TRUE(start != MAP_FAILED);
+  android_dlextinfo extinfo;
+  extinfo.flags = ANDROID_DLEXT_RESERVED_ADDRESS_HINT;
+  extinfo.reserved_addr = start;
+  extinfo.reserved_size = LIBSIZE;
+  handle_ = android_dlopen_ext(LIBNAME, RTLD_NOW, &extinfo);
+  ASSERT_DL_NOTNULL(handle_);
+  fn f = reinterpret_cast<fn>(dlsym(handle_, "getRandomNumber"));
+  ASSERT_DL_NOTNULL(f);
+  EXPECT_GE(f, start);
+  EXPECT_LT(reinterpret_cast<void*>(f),
+            reinterpret_cast<char*>(start) + LIBSIZE);
+  EXPECT_EQ(4, f());
+}
+
+TEST_F(DlExtTest, ReservedHintTooSmall) {
+  void* start = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
+                     -1, 0);
+  ASSERT_TRUE(start != MAP_FAILED);
+  android_dlextinfo extinfo;
+  extinfo.flags = ANDROID_DLEXT_RESERVED_ADDRESS_HINT;
+  extinfo.reserved_addr = start;
+  extinfo.reserved_size = PAGE_SIZE;
+  handle_ = android_dlopen_ext(LIBNAME, RTLD_NOW, &extinfo);
+  ASSERT_DL_NOTNULL(handle_);
+  fn f = reinterpret_cast<fn>(dlsym(handle_, "getRandomNumber"));
+  ASSERT_DL_NOTNULL(f);
+  EXPECT_TRUE(f < start || (reinterpret_cast<void*>(f) >=
+                            reinterpret_cast<char*>(start) + PAGE_SIZE));
+  EXPECT_EQ(4, f());
+}
+
+TEST_F(DlExtTest, RelroShareChildWrites) {
+  void* start = mmap(NULL, LIBSIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
+                     -1, 0);
+  ASSERT_TRUE(start != MAP_FAILED);
+  android_dlextinfo extinfo;
+  extinfo.reserved_addr = start;
+  extinfo.reserved_size = LIBSIZE;
+
+  int relro_fd;
+  relro_fd = open(RELRO_FILE, O_CREAT | O_RDWR | O_TRUNC, 0644);
+  extinfo.flags = ANDROID_DLEXT_RESERVED_ADDRESS | ANDROID_DLEXT_WRITE_RELRO;
+  ASSERT_NOERROR(relro_fd);
+  extinfo.relro_fd = relro_fd;
+
+  pid_t pid = fork();
+  if (pid == 0) {
+    // child process
+    void* handle = android_dlopen_ext(LIBNAME, RTLD_NOW, &extinfo);
+    if (handle == NULL) {
+      fprintf(stderr, "in child: %s\n", dlerror());
+      exit(1);
+    }
+    exit(0);
+  }
+
+  // continuing in parent
+  ASSERT_NOERROR(close(relro_fd));
+  ASSERT_NOERROR(pid);
+  int status;
+  ASSERT_EQ(pid, waitpid(pid, &status, 0));
+  ASSERT_TRUE(WIFEXITED(status));
+  ASSERT_EQ(0, WEXITSTATUS(status));
+
+  relro_fd = open(RELRO_FILE, O_RDONLY);
+  ASSERT_NOERROR(relro_fd);
+  extinfo.flags = ANDROID_DLEXT_RESERVED_ADDRESS | ANDROID_DLEXT_USE_RELRO;
+  extinfo.relro_fd = relro_fd;
+  handle_ = android_dlopen_ext(LIBNAME, RTLD_NOW, &extinfo);
+  ASSERT_NOERROR(close(relro_fd));
+
+  ASSERT_DL_NOTNULL(handle_);
+  fn f = reinterpret_cast<fn>(dlsym(handle_, "getRandomNumber"));
+  ASSERT_DL_NOTNULL(f);
+  EXPECT_EQ(4, f());
+}
diff --git a/tests/dlext_test_library.cpp b/tests/dlext_test_library.cpp
new file mode 100644
index 0000000..5c04329
--- /dev/null
+++ b/tests/dlext_test_library.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+class A {
+public:
+  virtual int getRandomNumber() {
+    return 4;  // chosen by fair dice roll.
+               // guaranteed to be random.
+  }
+
+  virtual ~A() {}
+};
+
+A a;
+
+// nested macros to make it easy to define a large amount of read-only data
+// which will require relocation.
+#define A_16 &a, &a, &a, &a, &a, &a, &a, &a, &a, &a, &a, &a, &a, &a, &a, &a,
+#define A_128 A_16 A_16 A_16 A_16 A_16 A_16 A_16 A_16
+#define A_1024 A_128 A_128 A_128 A_128 A_128 A_128 A_128 A_128
+
+extern "C" A* const lots_of_relro[] = {
+  A_1024 A_1024 A_1024 A_1024 A_1024 A_1024 A_1024 A_1024
+};
+
+extern "C" int getRandomNumber() {
+  // access the relro section (twice, in fact, once for the pointer, and once
+  // for the vtable of A) to check it's actually there.
+  return lots_of_relro[0]->getRandomNumber();
+}