xref: /freebsd/libexec/rtld-elf/rtld.c (revision 1e413cf93298b5b97441a21d9a50fdcd0ee9945e)
1 /*-
2  * Copyright 1996, 1997, 1998, 1999, 2000 John D. Polstra.
3  * Copyright 2003 Alexander Kabaev <kan@FreeBSD.ORG>.
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  *
26  * $FreeBSD$
27  */
28 
29 /*
30  * Dynamic linker for ELF.
31  *
32  * John Polstra <jdp@polstra.com>.
33  */
34 
35 #ifndef __GNUC__
36 #error "GCC is needed to compile this file"
37 #endif
38 
39 #include <sys/param.h>
40 #include <sys/mount.h>
41 #include <sys/mman.h>
42 #include <sys/stat.h>
43 #include <sys/uio.h>
44 #include <sys/ktrace.h>
45 
46 #include <dlfcn.h>
47 #include <err.h>
48 #include <errno.h>
49 #include <fcntl.h>
50 #include <stdarg.h>
51 #include <stdio.h>
52 #include <stdlib.h>
53 #include <string.h>
54 #include <unistd.h>
55 
56 #include "debug.h"
57 #include "rtld.h"
58 #include "libmap.h"
59 #include "rtld_tls.h"
60 
61 #ifndef COMPAT_32BIT
62 #define PATH_RTLD	"/libexec/ld-elf.so.1"
63 #else
64 #define PATH_RTLD	"/libexec/ld-elf32.so.1"
65 #endif
66 
67 /* Types. */
68 typedef void (*func_ptr_type)();
69 typedef void * (*path_enum_proc) (const char *path, size_t len, void *arg);
70 
71 /*
72  * This structure provides a reentrant way to keep a list of objects and
73  * check which ones have already been processed in some way.
74  */
75 typedef struct Struct_DoneList {
76     const Obj_Entry **objs;		/* Array of object pointers */
77     unsigned int num_alloc;		/* Allocated size of the array */
78     unsigned int num_used;		/* Number of array slots used */
79 } DoneList;
80 
81 /*
82  * Function declarations.
83  */
84 static const char *basename(const char *);
85 static void die(void) __dead2;
86 static void digest_dynamic(Obj_Entry *, int);
87 static Obj_Entry *digest_phdr(const Elf_Phdr *, int, caddr_t, const char *);
88 static Obj_Entry *dlcheck(void *);
89 static Obj_Entry *do_load_object(int, const char *, char *, struct stat *);
90 static int do_search_info(const Obj_Entry *obj, int, struct dl_serinfo *);
91 static bool donelist_check(DoneList *, const Obj_Entry *);
92 static void errmsg_restore(char *);
93 static char *errmsg_save(void);
94 static void *fill_search_info(const char *, size_t, void *);
95 static char *find_library(const char *, const Obj_Entry *);
96 static const char *gethints(void);
97 static void init_dag(Obj_Entry *);
98 static void init_dag1(Obj_Entry *, Obj_Entry *, DoneList *);
99 static void init_rtld(caddr_t);
100 static void initlist_add_neededs(Needed_Entry *, Objlist *);
101 static void initlist_add_objects(Obj_Entry *, Obj_Entry **, Objlist *);
102 static bool is_exported(const Elf_Sym *);
103 static void linkmap_add(Obj_Entry *);
104 static void linkmap_delete(Obj_Entry *);
105 static int load_needed_objects(Obj_Entry *);
106 static int load_preload_objects(void);
107 static Obj_Entry *load_object(const char *, const Obj_Entry *);
108 static Obj_Entry *obj_from_addr(const void *);
109 static void objlist_call_fini(Objlist *);
110 static void objlist_call_init(Objlist *);
111 static void objlist_clear(Objlist *);
112 static Objlist_Entry *objlist_find(Objlist *, const Obj_Entry *);
113 static void objlist_init(Objlist *);
114 static void objlist_push_head(Objlist *, Obj_Entry *);
115 static void objlist_push_tail(Objlist *, Obj_Entry *);
116 static void objlist_remove(Objlist *, Obj_Entry *);
117 static void objlist_remove_unref(Objlist *);
118 static void *path_enumerate(const char *, path_enum_proc, void *);
119 static int relocate_objects(Obj_Entry *, bool, Obj_Entry *);
120 static int rtld_dirname(const char *, char *);
121 static void rtld_exit(void);
122 static char *search_library_path(const char *, const char *);
123 static const void **get_program_var_addr(const char *);
124 static void set_program_var(const char *, const void *);
125 static const Elf_Sym *symlook_default(const char *, unsigned long,
126   const Obj_Entry *, const Obj_Entry **, const Ver_Entry *, int);
127 static const Elf_Sym *symlook_list(const char *, unsigned long, const Objlist *,
128   const Obj_Entry **, const Ver_Entry *, int, DoneList *);
129 static const Elf_Sym *symlook_needed(const char *, unsigned long,
130   const Needed_Entry *, const Obj_Entry **, const Ver_Entry *,
131   int, DoneList *);
132 static void trace_loaded_objects(Obj_Entry *);
133 static void unlink_object(Obj_Entry *);
134 static void unload_object(Obj_Entry *);
135 static void unref_dag(Obj_Entry *);
136 static void ref_dag(Obj_Entry *);
137 static int  rtld_verify_versions(const Objlist *);
138 static int  rtld_verify_object_versions(Obj_Entry *);
139 static void object_add_name(Obj_Entry *, const char *);
140 static int  object_match_name(const Obj_Entry *, const char *);
141 static void ld_utrace_log(int, void *, void *, size_t, int, const char *);
142 
143 void r_debug_state(struct r_debug *, struct link_map *);
144 
145 /*
146  * Data declarations.
147  */
148 static char *error_message;	/* Message for dlerror(), or NULL */
149 struct r_debug r_debug;		/* for GDB; */
150 static bool libmap_disable;	/* Disable libmap */
151 static char *libmap_override;	/* Maps to use in addition to libmap.conf */
152 static bool trust;		/* False for setuid and setgid programs */
153 static bool dangerous_ld_env;	/* True if environment variables have been
154 				   used to affect the libraries loaded */
155 static char *ld_bind_now;	/* Environment variable for immediate binding */
156 static char *ld_debug;		/* Environment variable for debugging */
157 static char *ld_library_path;	/* Environment variable for search path */
158 static char *ld_preload;	/* Environment variable for libraries to
159 				   load first */
160 static char *ld_tracing;	/* Called from ldd to print libs */
161 static char *ld_utrace;		/* Use utrace() to log events. */
162 static Obj_Entry *obj_list;	/* Head of linked list of shared objects */
163 static Obj_Entry **obj_tail;	/* Link field of last object in list */
164 static Obj_Entry *obj_main;	/* The main program shared object */
165 static Obj_Entry obj_rtld;	/* The dynamic linker shared object */
166 static unsigned int obj_count;	/* Number of objects in obj_list */
167 static unsigned int obj_loads;	/* Number of objects in obj_list */
168 
169 static Objlist list_global =	/* Objects dlopened with RTLD_GLOBAL */
170   STAILQ_HEAD_INITIALIZER(list_global);
171 static Objlist list_main =	/* Objects loaded at program startup */
172   STAILQ_HEAD_INITIALIZER(list_main);
173 static Objlist list_fini =	/* Objects needing fini() calls */
174   STAILQ_HEAD_INITIALIZER(list_fini);
175 
176 static Elf_Sym sym_zero;	/* For resolving undefined weak refs. */
177 
178 #define GDB_STATE(s,m)	r_debug.r_state = s; r_debug_state(&r_debug,m);
179 
180 extern Elf_Dyn _DYNAMIC;
181 #pragma weak _DYNAMIC
182 #ifndef RTLD_IS_DYNAMIC
183 #define	RTLD_IS_DYNAMIC()	(&_DYNAMIC != NULL)
184 #endif
185 
186 /*
187  * These are the functions the dynamic linker exports to application
188  * programs.  They are the only symbols the dynamic linker is willing
189  * to export from itself.
190  */
191 static func_ptr_type exports[] = {
192     (func_ptr_type) &_rtld_error,
193     (func_ptr_type) &dlclose,
194     (func_ptr_type) &dlerror,
195     (func_ptr_type) &dlopen,
196     (func_ptr_type) &dlsym,
197     (func_ptr_type) &dlvsym,
198     (func_ptr_type) &dladdr,
199     (func_ptr_type) &dllockinit,
200     (func_ptr_type) &dlinfo,
201     (func_ptr_type) &_rtld_thread_init,
202 #ifdef __i386__
203     (func_ptr_type) &___tls_get_addr,
204 #endif
205     (func_ptr_type) &__tls_get_addr,
206     (func_ptr_type) &_rtld_allocate_tls,
207     (func_ptr_type) &_rtld_free_tls,
208     (func_ptr_type) &dl_iterate_phdr,
209     NULL
210 };
211 
212 /*
213  * Global declarations normally provided by crt1.  The dynamic linker is
214  * not built with crt1, so we have to provide them ourselves.
215  */
216 char *__progname;
217 char **environ;
218 
219 /*
220  * Globals to control TLS allocation.
221  */
222 size_t tls_last_offset;		/* Static TLS offset of last module */
223 size_t tls_last_size;		/* Static TLS size of last module */
224 size_t tls_static_space;	/* Static TLS space allocated */
225 int tls_dtv_generation = 1;	/* Used to detect when dtv size changes  */
226 int tls_max_index = 1;		/* Largest module index allocated */
227 
228 /*
229  * Fill in a DoneList with an allocation large enough to hold all of
230  * the currently-loaded objects.  Keep this as a macro since it calls
231  * alloca and we want that to occur within the scope of the caller.
232  */
233 #define donelist_init(dlp)					\
234     ((dlp)->objs = alloca(obj_count * sizeof (dlp)->objs[0]),	\
235     assert((dlp)->objs != NULL),				\
236     (dlp)->num_alloc = obj_count,				\
237     (dlp)->num_used = 0)
238 
239 #define	UTRACE_DLOPEN_START		1
240 #define	UTRACE_DLOPEN_STOP		2
241 #define	UTRACE_DLCLOSE_START		3
242 #define	UTRACE_DLCLOSE_STOP		4
243 #define	UTRACE_LOAD_OBJECT		5
244 #define	UTRACE_UNLOAD_OBJECT		6
245 #define	UTRACE_ADD_RUNDEP		7
246 #define	UTRACE_PRELOAD_FINISHED		8
247 #define	UTRACE_INIT_CALL		9
248 #define	UTRACE_FINI_CALL		10
249 
250 struct utrace_rtld {
251 	char sig[4];			/* 'RTLD' */
252 	int event;
253 	void *handle;
254 	void *mapbase;			/* Used for 'parent' and 'init/fini' */
255 	size_t mapsize;
256 	int refcnt;			/* Used for 'mode' */
257 	char name[MAXPATHLEN];
258 };
259 
260 #define	LD_UTRACE(e, h, mb, ms, r, n) do {			\
261 	if (ld_utrace != NULL)					\
262 		ld_utrace_log(e, h, mb, ms, r, n);		\
263 } while (0)
264 
265 static void
266 ld_utrace_log(int event, void *handle, void *mapbase, size_t mapsize,
267     int refcnt, const char *name)
268 {
269 	struct utrace_rtld ut;
270 
271 	ut.sig[0] = 'R';
272 	ut.sig[1] = 'T';
273 	ut.sig[2] = 'L';
274 	ut.sig[3] = 'D';
275 	ut.event = event;
276 	ut.handle = handle;
277 	ut.mapbase = mapbase;
278 	ut.mapsize = mapsize;
279 	ut.refcnt = refcnt;
280 	bzero(ut.name, sizeof(ut.name));
281 	if (name)
282 		strlcpy(ut.name, name, sizeof(ut.name));
283 	utrace(&ut, sizeof(ut));
284 }
285 
286 /*
287  * Main entry point for dynamic linking.  The first argument is the
288  * stack pointer.  The stack is expected to be laid out as described
289  * in the SVR4 ABI specification, Intel 386 Processor Supplement.
290  * Specifically, the stack pointer points to a word containing
291  * ARGC.  Following that in the stack is a null-terminated sequence
292  * of pointers to argument strings.  Then comes a null-terminated
293  * sequence of pointers to environment strings.  Finally, there is a
294  * sequence of "auxiliary vector" entries.
295  *
296  * The second argument points to a place to store the dynamic linker's
297  * exit procedure pointer and the third to a place to store the main
298  * program's object.
299  *
300  * The return value is the main program's entry point.
301  */
302 func_ptr_type
303 _rtld(Elf_Addr *sp, func_ptr_type *exit_proc, Obj_Entry **objp)
304 {
305     Elf_Auxinfo *aux_info[AT_COUNT];
306     int i;
307     int argc;
308     char **argv;
309     char **env;
310     Elf_Auxinfo *aux;
311     Elf_Auxinfo *auxp;
312     const char *argv0;
313     Objlist_Entry *entry;
314     Obj_Entry *obj;
315     Obj_Entry **preload_tail;
316     Objlist initlist;
317     int lockstate;
318 
319     /*
320      * On entry, the dynamic linker itself has not been relocated yet.
321      * Be very careful not to reference any global data until after
322      * init_rtld has returned.  It is OK to reference file-scope statics
323      * and string constants, and to call static and global functions.
324      */
325 
326     /* Find the auxiliary vector on the stack. */
327     argc = *sp++;
328     argv = (char **) sp;
329     sp += argc + 1;	/* Skip over arguments and NULL terminator */
330     env = (char **) sp;
331     while (*sp++ != 0)	/* Skip over environment, and NULL terminator */
332 	;
333     aux = (Elf_Auxinfo *) sp;
334 
335     /* Digest the auxiliary vector. */
336     for (i = 0;  i < AT_COUNT;  i++)
337 	aux_info[i] = NULL;
338     for (auxp = aux;  auxp->a_type != AT_NULL;  auxp++) {
339 	if (auxp->a_type < AT_COUNT)
340 	    aux_info[auxp->a_type] = auxp;
341     }
342 
343     /* Initialize and relocate ourselves. */
344     assert(aux_info[AT_BASE] != NULL);
345     init_rtld((caddr_t) aux_info[AT_BASE]->a_un.a_ptr);
346 
347     __progname = obj_rtld.path;
348     argv0 = argv[0] != NULL ? argv[0] : "(null)";
349     environ = env;
350 
351     trust = !issetugid();
352 
353     ld_bind_now = getenv(LD_ "BIND_NOW");
354     /*
355      * If the process is tainted, then we un-set the dangerous environment
356      * variables.  The process will be marked as tainted until setuid(2)
357      * is called.  If any child process calls setuid(2) we do not want any
358      * future processes to honor the potentially un-safe variables.
359      */
360     if (!trust) {
361         unsetenv(LD_ "PRELOAD");
362         unsetenv(LD_ "LIBMAP");
363         unsetenv(LD_ "LIBRARY_PATH");
364         unsetenv(LD_ "LIBMAP_DISABLE");
365         unsetenv(LD_ "DEBUG");
366     }
367     ld_debug = getenv(LD_ "DEBUG");
368     libmap_disable = getenv(LD_ "LIBMAP_DISABLE") != NULL;
369     libmap_override = getenv(LD_ "LIBMAP");
370     ld_library_path = getenv(LD_ "LIBRARY_PATH");
371     ld_preload = getenv(LD_ "PRELOAD");
372     dangerous_ld_env = libmap_disable || (libmap_override != NULL) ||
373 	(ld_library_path != NULL) || (ld_preload != NULL);
374     ld_tracing = getenv(LD_ "TRACE_LOADED_OBJECTS");
375     ld_utrace = getenv(LD_ "UTRACE");
376 
377     if (ld_debug != NULL && *ld_debug != '\0')
378 	debug = 1;
379     dbg("%s is initialized, base address = %p", __progname,
380 	(caddr_t) aux_info[AT_BASE]->a_un.a_ptr);
381     dbg("RTLD dynamic = %p", obj_rtld.dynamic);
382     dbg("RTLD pltgot  = %p", obj_rtld.pltgot);
383 
384     /*
385      * Load the main program, or process its program header if it is
386      * already loaded.
387      */
388     if (aux_info[AT_EXECFD] != NULL) {	/* Load the main program. */
389 	int fd = aux_info[AT_EXECFD]->a_un.a_val;
390 	dbg("loading main program");
391 	obj_main = map_object(fd, argv0, NULL);
392 	close(fd);
393 	if (obj_main == NULL)
394 	    die();
395     } else {				/* Main program already loaded. */
396 	const Elf_Phdr *phdr;
397 	int phnum;
398 	caddr_t entry;
399 
400 	dbg("processing main program's program header");
401 	assert(aux_info[AT_PHDR] != NULL);
402 	phdr = (const Elf_Phdr *) aux_info[AT_PHDR]->a_un.a_ptr;
403 	assert(aux_info[AT_PHNUM] != NULL);
404 	phnum = aux_info[AT_PHNUM]->a_un.a_val;
405 	assert(aux_info[AT_PHENT] != NULL);
406 	assert(aux_info[AT_PHENT]->a_un.a_val == sizeof(Elf_Phdr));
407 	assert(aux_info[AT_ENTRY] != NULL);
408 	entry = (caddr_t) aux_info[AT_ENTRY]->a_un.a_ptr;
409 	if ((obj_main = digest_phdr(phdr, phnum, entry, argv0)) == NULL)
410 	    die();
411     }
412 
413     obj_main->path = xstrdup(argv0);
414     obj_main->mainprog = true;
415 
416     /*
417      * Get the actual dynamic linker pathname from the executable if
418      * possible.  (It should always be possible.)  That ensures that
419      * gdb will find the right dynamic linker even if a non-standard
420      * one is being used.
421      */
422     if (obj_main->interp != NULL &&
423       strcmp(obj_main->interp, obj_rtld.path) != 0) {
424 	free(obj_rtld.path);
425 	obj_rtld.path = xstrdup(obj_main->interp);
426         __progname = obj_rtld.path;
427     }
428 
429     digest_dynamic(obj_main, 0);
430 
431     linkmap_add(obj_main);
432     linkmap_add(&obj_rtld);
433 
434     /* Link the main program into the list of objects. */
435     *obj_tail = obj_main;
436     obj_tail = &obj_main->next;
437     obj_count++;
438     obj_loads++;
439     /* Make sure we don't call the main program's init and fini functions. */
440     obj_main->init = obj_main->fini = (Elf_Addr)NULL;
441 
442     /* Initialize a fake symbol for resolving undefined weak references. */
443     sym_zero.st_info = ELF_ST_INFO(STB_GLOBAL, STT_NOTYPE);
444     sym_zero.st_shndx = SHN_UNDEF;
445 
446     if (!libmap_disable)
447         libmap_disable = (bool)lm_init(libmap_override);
448 
449     dbg("loading LD_PRELOAD libraries");
450     if (load_preload_objects() == -1)
451 	die();
452     preload_tail = obj_tail;
453 
454     dbg("loading needed objects");
455     if (load_needed_objects(obj_main) == -1)
456 	die();
457 
458     /* Make a list of all objects loaded at startup. */
459     for (obj = obj_list;  obj != NULL;  obj = obj->next) {
460 	objlist_push_tail(&list_main, obj);
461     	obj->refcount++;
462     }
463 
464     dbg("checking for required versions");
465     if (rtld_verify_versions(&list_main) == -1 && !ld_tracing)
466 	die();
467 
468     if (ld_tracing) {		/* We're done */
469 	trace_loaded_objects(obj_main);
470 	exit(0);
471     }
472 
473     if (getenv(LD_ "DUMP_REL_PRE") != NULL) {
474        dump_relocations(obj_main);
475        exit (0);
476     }
477 
478     /* setup TLS for main thread */
479     dbg("initializing initial thread local storage");
480     STAILQ_FOREACH(entry, &list_main, link) {
481 	/*
482 	 * Allocate all the initial objects out of the static TLS
483 	 * block even if they didn't ask for it.
484 	 */
485 	allocate_tls_offset(entry->obj);
486     }
487     allocate_initial_tls(obj_list);
488 
489     if (relocate_objects(obj_main,
490 	ld_bind_now != NULL && *ld_bind_now != '\0', &obj_rtld) == -1)
491 	die();
492 
493     dbg("doing copy relocations");
494     if (do_copy_relocations(obj_main) == -1)
495 	die();
496 
497     if (getenv(LD_ "DUMP_REL_POST") != NULL) {
498        dump_relocations(obj_main);
499        exit (0);
500     }
501 
502     dbg("initializing key program variables");
503     set_program_var("__progname", argv[0] != NULL ? basename(argv[0]) : "");
504     set_program_var("environ", env);
505 
506     dbg("initializing thread locks");
507     lockdflt_init();
508 
509     /* Make a list of init functions to call. */
510     objlist_init(&initlist);
511     initlist_add_objects(obj_list, preload_tail, &initlist);
512 
513     r_debug_state(NULL, &obj_main->linkmap); /* say hello to gdb! */
514 
515     objlist_call_init(&initlist);
516     lockstate = wlock_acquire(rtld_bind_lock);
517     objlist_clear(&initlist);
518     wlock_release(rtld_bind_lock, lockstate);
519 
520     dbg("transferring control to program entry point = %p", obj_main->entry);
521 
522     /* Return the exit procedure and the program entry point. */
523     *exit_proc = rtld_exit;
524     *objp = obj_main;
525     return (func_ptr_type) obj_main->entry;
526 }
527 
528 Elf_Addr
529 _rtld_bind(Obj_Entry *obj, Elf_Size reloff)
530 {
531     const Elf_Rel *rel;
532     const Elf_Sym *def;
533     const Obj_Entry *defobj;
534     Elf_Addr *where;
535     Elf_Addr target;
536     int lockstate;
537 
538     lockstate = rlock_acquire(rtld_bind_lock);
539     if (obj->pltrel)
540 	rel = (const Elf_Rel *) ((caddr_t) obj->pltrel + reloff);
541     else
542 	rel = (const Elf_Rel *) ((caddr_t) obj->pltrela + reloff);
543 
544     where = (Elf_Addr *) (obj->relocbase + rel->r_offset);
545     def = find_symdef(ELF_R_SYM(rel->r_info), obj, &defobj, true, NULL);
546     if (def == NULL)
547 	die();
548 
549     target = (Elf_Addr)(defobj->relocbase + def->st_value);
550 
551     dbg("\"%s\" in \"%s\" ==> %p in \"%s\"",
552       defobj->strtab + def->st_name, basename(obj->path),
553       (void *)target, basename(defobj->path));
554 
555     /*
556      * Write the new contents for the jmpslot. Note that depending on
557      * architecture, the value which we need to return back to the
558      * lazy binding trampoline may or may not be the target
559      * address. The value returned from reloc_jmpslot() is the value
560      * that the trampoline needs.
561      */
562     target = reloc_jmpslot(where, target, defobj, obj, rel);
563     rlock_release(rtld_bind_lock, lockstate);
564     return target;
565 }
566 
567 /*
568  * Error reporting function.  Use it like printf.  If formats the message
569  * into a buffer, and sets things up so that the next call to dlerror()
570  * will return the message.
571  */
572 void
573 _rtld_error(const char *fmt, ...)
574 {
575     static char buf[512];
576     va_list ap;
577 
578     va_start(ap, fmt);
579     vsnprintf(buf, sizeof buf, fmt, ap);
580     error_message = buf;
581     va_end(ap);
582 }
583 
584 /*
585  * Return a dynamically-allocated copy of the current error message, if any.
586  */
587 static char *
588 errmsg_save(void)
589 {
590     return error_message == NULL ? NULL : xstrdup(error_message);
591 }
592 
593 /*
594  * Restore the current error message from a copy which was previously saved
595  * by errmsg_save().  The copy is freed.
596  */
597 static void
598 errmsg_restore(char *saved_msg)
599 {
600     if (saved_msg == NULL)
601 	error_message = NULL;
602     else {
603 	_rtld_error("%s", saved_msg);
604 	free(saved_msg);
605     }
606 }
607 
608 static const char *
609 basename(const char *name)
610 {
611     const char *p = strrchr(name, '/');
612     return p != NULL ? p + 1 : name;
613 }
614 
615 static void
616 die(void)
617 {
618     const char *msg = dlerror();
619 
620     if (msg == NULL)
621 	msg = "Fatal error";
622     errx(1, "%s", msg);
623 }
624 
625 /*
626  * Process a shared object's DYNAMIC section, and save the important
627  * information in its Obj_Entry structure.
628  */
629 static void
630 digest_dynamic(Obj_Entry *obj, int early)
631 {
632     const Elf_Dyn *dynp;
633     Needed_Entry **needed_tail = &obj->needed;
634     const Elf_Dyn *dyn_rpath = NULL;
635     const Elf_Dyn *dyn_soname = NULL;
636     int plttype = DT_REL;
637 
638     obj->bind_now = false;
639     for (dynp = obj->dynamic;  dynp->d_tag != DT_NULL;  dynp++) {
640 	switch (dynp->d_tag) {
641 
642 	case DT_REL:
643 	    obj->rel = (const Elf_Rel *) (obj->relocbase + dynp->d_un.d_ptr);
644 	    break;
645 
646 	case DT_RELSZ:
647 	    obj->relsize = dynp->d_un.d_val;
648 	    break;
649 
650 	case DT_RELENT:
651 	    assert(dynp->d_un.d_val == sizeof(Elf_Rel));
652 	    break;
653 
654 	case DT_JMPREL:
655 	    obj->pltrel = (const Elf_Rel *)
656 	      (obj->relocbase + dynp->d_un.d_ptr);
657 	    break;
658 
659 	case DT_PLTRELSZ:
660 	    obj->pltrelsize = dynp->d_un.d_val;
661 	    break;
662 
663 	case DT_RELA:
664 	    obj->rela = (const Elf_Rela *) (obj->relocbase + dynp->d_un.d_ptr);
665 	    break;
666 
667 	case DT_RELASZ:
668 	    obj->relasize = dynp->d_un.d_val;
669 	    break;
670 
671 	case DT_RELAENT:
672 	    assert(dynp->d_un.d_val == sizeof(Elf_Rela));
673 	    break;
674 
675 	case DT_PLTREL:
676 	    plttype = dynp->d_un.d_val;
677 	    assert(dynp->d_un.d_val == DT_REL || plttype == DT_RELA);
678 	    break;
679 
680 	case DT_SYMTAB:
681 	    obj->symtab = (const Elf_Sym *)
682 	      (obj->relocbase + dynp->d_un.d_ptr);
683 	    break;
684 
685 	case DT_SYMENT:
686 	    assert(dynp->d_un.d_val == sizeof(Elf_Sym));
687 	    break;
688 
689 	case DT_STRTAB:
690 	    obj->strtab = (const char *) (obj->relocbase + dynp->d_un.d_ptr);
691 	    break;
692 
693 	case DT_STRSZ:
694 	    obj->strsize = dynp->d_un.d_val;
695 	    break;
696 
697 	case DT_VERNEED:
698 	    obj->verneed = (const Elf_Verneed *) (obj->relocbase +
699 		dynp->d_un.d_val);
700 	    break;
701 
702 	case DT_VERNEEDNUM:
703 	    obj->verneednum = dynp->d_un.d_val;
704 	    break;
705 
706 	case DT_VERDEF:
707 	    obj->verdef = (const Elf_Verdef *) (obj->relocbase +
708 		dynp->d_un.d_val);
709 	    break;
710 
711 	case DT_VERDEFNUM:
712 	    obj->verdefnum = dynp->d_un.d_val;
713 	    break;
714 
715 	case DT_VERSYM:
716 	    obj->versyms = (const Elf_Versym *)(obj->relocbase +
717 		dynp->d_un.d_val);
718 	    break;
719 
720 	case DT_HASH:
721 	    {
722 		const Elf_Hashelt *hashtab = (const Elf_Hashelt *)
723 		  (obj->relocbase + dynp->d_un.d_ptr);
724 		obj->nbuckets = hashtab[0];
725 		obj->nchains = hashtab[1];
726 		obj->buckets = hashtab + 2;
727 		obj->chains = obj->buckets + obj->nbuckets;
728 	    }
729 	    break;
730 
731 	case DT_NEEDED:
732 	    if (!obj->rtld) {
733 		Needed_Entry *nep = NEW(Needed_Entry);
734 		nep->name = dynp->d_un.d_val;
735 		nep->obj = NULL;
736 		nep->next = NULL;
737 
738 		*needed_tail = nep;
739 		needed_tail = &nep->next;
740 	    }
741 	    break;
742 
743 	case DT_PLTGOT:
744 	    obj->pltgot = (Elf_Addr *) (obj->relocbase + dynp->d_un.d_ptr);
745 	    break;
746 
747 	case DT_TEXTREL:
748 	    obj->textrel = true;
749 	    break;
750 
751 	case DT_SYMBOLIC:
752 	    obj->symbolic = true;
753 	    break;
754 
755 	case DT_RPATH:
756 	case DT_RUNPATH:	/* XXX: process separately */
757 	    /*
758 	     * We have to wait until later to process this, because we
759 	     * might not have gotten the address of the string table yet.
760 	     */
761 	    dyn_rpath = dynp;
762 	    break;
763 
764 	case DT_SONAME:
765 	    dyn_soname = dynp;
766 	    break;
767 
768 	case DT_INIT:
769 	    obj->init = (Elf_Addr) (obj->relocbase + dynp->d_un.d_ptr);
770 	    break;
771 
772 	case DT_FINI:
773 	    obj->fini = (Elf_Addr) (obj->relocbase + dynp->d_un.d_ptr);
774 	    break;
775 
776 	case DT_DEBUG:
777 	    /* XXX - not implemented yet */
778 	    if (!early)
779 		dbg("Filling in DT_DEBUG entry");
780 	    ((Elf_Dyn*)dynp)->d_un.d_ptr = (Elf_Addr) &r_debug;
781 	    break;
782 
783 	case DT_FLAGS:
784 		if (dynp->d_un.d_val & DF_ORIGIN) {
785 		    obj->origin_path = xmalloc(PATH_MAX);
786 		    if (rtld_dirname(obj->path, obj->origin_path) == -1)
787 			die();
788 		}
789 		if (dynp->d_un.d_val & DF_SYMBOLIC)
790 		    obj->symbolic = true;
791 		if (dynp->d_un.d_val & DF_TEXTREL)
792 		    obj->textrel = true;
793 		if (dynp->d_un.d_val & DF_BIND_NOW)
794 		    obj->bind_now = true;
795 		if (dynp->d_un.d_val & DF_STATIC_TLS)
796 		    ;
797 	    break;
798 
799 	default:
800 	    if (!early) {
801 		dbg("Ignoring d_tag %ld = %#lx", (long)dynp->d_tag,
802 		    (long)dynp->d_tag);
803 	    }
804 	    break;
805 	}
806     }
807 
808     obj->traced = false;
809 
810     if (plttype == DT_RELA) {
811 	obj->pltrela = (const Elf_Rela *) obj->pltrel;
812 	obj->pltrel = NULL;
813 	obj->pltrelasize = obj->pltrelsize;
814 	obj->pltrelsize = 0;
815     }
816 
817     if (dyn_rpath != NULL)
818 	obj->rpath = obj->strtab + dyn_rpath->d_un.d_val;
819 
820     if (dyn_soname != NULL)
821 	object_add_name(obj, obj->strtab + dyn_soname->d_un.d_val);
822 }
823 
824 /*
825  * Process a shared object's program header.  This is used only for the
826  * main program, when the kernel has already loaded the main program
827  * into memory before calling the dynamic linker.  It creates and
828  * returns an Obj_Entry structure.
829  */
830 static Obj_Entry *
831 digest_phdr(const Elf_Phdr *phdr, int phnum, caddr_t entry, const char *path)
832 {
833     Obj_Entry *obj;
834     const Elf_Phdr *phlimit = phdr + phnum;
835     const Elf_Phdr *ph;
836     int nsegs = 0;
837 
838     obj = obj_new();
839     for (ph = phdr;  ph < phlimit;  ph++) {
840 	switch (ph->p_type) {
841 
842 	case PT_PHDR:
843 	    if ((const Elf_Phdr *)ph->p_vaddr != phdr) {
844 		_rtld_error("%s: invalid PT_PHDR", path);
845 		return NULL;
846 	    }
847 	    obj->phdr = (const Elf_Phdr *) ph->p_vaddr;
848 	    obj->phsize = ph->p_memsz;
849 	    break;
850 
851 	case PT_INTERP:
852 	    obj->interp = (const char *) ph->p_vaddr;
853 	    break;
854 
855 	case PT_LOAD:
856 	    if (nsegs == 0) {	/* First load segment */
857 		obj->vaddrbase = trunc_page(ph->p_vaddr);
858 		obj->mapbase = (caddr_t) obj->vaddrbase;
859 		obj->relocbase = obj->mapbase - obj->vaddrbase;
860 		obj->textsize = round_page(ph->p_vaddr + ph->p_memsz) -
861 		  obj->vaddrbase;
862 	    } else {		/* Last load segment */
863 		obj->mapsize = round_page(ph->p_vaddr + ph->p_memsz) -
864 		  obj->vaddrbase;
865 	    }
866 	    nsegs++;
867 	    break;
868 
869 	case PT_DYNAMIC:
870 	    obj->dynamic = (const Elf_Dyn *) ph->p_vaddr;
871 	    break;
872 
873 	case PT_TLS:
874 	    obj->tlsindex = 1;
875 	    obj->tlssize = ph->p_memsz;
876 	    obj->tlsalign = ph->p_align;
877 	    obj->tlsinitsize = ph->p_filesz;
878 	    obj->tlsinit = (void*) ph->p_vaddr;
879 	    break;
880 	}
881     }
882     if (nsegs < 1) {
883 	_rtld_error("%s: too few PT_LOAD segments", path);
884 	return NULL;
885     }
886 
887     obj->entry = entry;
888     return obj;
889 }
890 
891 static Obj_Entry *
892 dlcheck(void *handle)
893 {
894     Obj_Entry *obj;
895 
896     for (obj = obj_list;  obj != NULL;  obj = obj->next)
897 	if (obj == (Obj_Entry *) handle)
898 	    break;
899 
900     if (obj == NULL || obj->refcount == 0 || obj->dl_refcount == 0) {
901 	_rtld_error("Invalid shared object handle %p", handle);
902 	return NULL;
903     }
904     return obj;
905 }
906 
907 /*
908  * If the given object is already in the donelist, return true.  Otherwise
909  * add the object to the list and return false.
910  */
911 static bool
912 donelist_check(DoneList *dlp, const Obj_Entry *obj)
913 {
914     unsigned int i;
915 
916     for (i = 0;  i < dlp->num_used;  i++)
917 	if (dlp->objs[i] == obj)
918 	    return true;
919     /*
920      * Our donelist allocation should always be sufficient.  But if
921      * our threads locking isn't working properly, more shared objects
922      * could have been loaded since we allocated the list.  That should
923      * never happen, but we'll handle it properly just in case it does.
924      */
925     if (dlp->num_used < dlp->num_alloc)
926 	dlp->objs[dlp->num_used++] = obj;
927     return false;
928 }
929 
930 /*
931  * Hash function for symbol table lookup.  Don't even think about changing
932  * this.  It is specified by the System V ABI.
933  */
934 unsigned long
935 elf_hash(const char *name)
936 {
937     const unsigned char *p = (const unsigned char *) name;
938     unsigned long h = 0;
939     unsigned long g;
940 
941     while (*p != '\0') {
942 	h = (h << 4) + *p++;
943 	if ((g = h & 0xf0000000) != 0)
944 	    h ^= g >> 24;
945 	h &= ~g;
946     }
947     return h;
948 }
949 
950 /*
951  * Find the library with the given name, and return its full pathname.
952  * The returned string is dynamically allocated.  Generates an error
953  * message and returns NULL if the library cannot be found.
954  *
955  * If the second argument is non-NULL, then it refers to an already-
956  * loaded shared object, whose library search path will be searched.
957  *
958  * The search order is:
959  *   LD_LIBRARY_PATH
960  *   rpath in the referencing file
961  *   ldconfig hints
962  *   /lib:/usr/lib
963  */
964 static char *
965 find_library(const char *xname, const Obj_Entry *refobj)
966 {
967     char *pathname;
968     char *name;
969 
970     if (strchr(xname, '/') != NULL) {	/* Hard coded pathname */
971 	if (xname[0] != '/' && !trust) {
972 	    _rtld_error("Absolute pathname required for shared object \"%s\"",
973 	      xname);
974 	    return NULL;
975 	}
976 	return xstrdup(xname);
977     }
978 
979     if (libmap_disable || (refobj == NULL) ||
980 	(name = lm_find(refobj->path, xname)) == NULL)
981 	name = (char *)xname;
982 
983     dbg(" Searching for \"%s\"", name);
984 
985     if ((pathname = search_library_path(name, ld_library_path)) != NULL ||
986       (refobj != NULL &&
987       (pathname = search_library_path(name, refobj->rpath)) != NULL) ||
988       (pathname = search_library_path(name, gethints())) != NULL ||
989       (pathname = search_library_path(name, STANDARD_LIBRARY_PATH)) != NULL)
990 	return pathname;
991 
992     if(refobj != NULL && refobj->path != NULL) {
993 	_rtld_error("Shared object \"%s\" not found, required by \"%s\"",
994 	  name, basename(refobj->path));
995     } else {
996 	_rtld_error("Shared object \"%s\" not found", name);
997     }
998     return NULL;
999 }
1000 
1001 /*
1002  * Given a symbol number in a referencing object, find the corresponding
1003  * definition of the symbol.  Returns a pointer to the symbol, or NULL if
1004  * no definition was found.  Returns a pointer to the Obj_Entry of the
1005  * defining object via the reference parameter DEFOBJ_OUT.
1006  */
1007 const Elf_Sym *
1008 find_symdef(unsigned long symnum, const Obj_Entry *refobj,
1009     const Obj_Entry **defobj_out, int flags, SymCache *cache)
1010 {
1011     const Elf_Sym *ref;
1012     const Elf_Sym *def;
1013     const Obj_Entry *defobj;
1014     const Ver_Entry *ventry;
1015     const char *name;
1016     unsigned long hash;
1017 
1018     /*
1019      * If we have already found this symbol, get the information from
1020      * the cache.
1021      */
1022     if (symnum >= refobj->nchains)
1023 	return NULL;	/* Bad object */
1024     if (cache != NULL && cache[symnum].sym != NULL) {
1025 	*defobj_out = cache[symnum].obj;
1026 	return cache[symnum].sym;
1027     }
1028 
1029     ref = refobj->symtab + symnum;
1030     name = refobj->strtab + ref->st_name;
1031     defobj = NULL;
1032 
1033     /*
1034      * We don't have to do a full scale lookup if the symbol is local.
1035      * We know it will bind to the instance in this load module; to
1036      * which we already have a pointer (ie ref). By not doing a lookup,
1037      * we not only improve performance, but it also avoids unresolvable
1038      * symbols when local symbols are not in the hash table. This has
1039      * been seen with the ia64 toolchain.
1040      */
1041     if (ELF_ST_BIND(ref->st_info) != STB_LOCAL) {
1042 	if (ELF_ST_TYPE(ref->st_info) == STT_SECTION) {
1043 	    _rtld_error("%s: Bogus symbol table entry %lu", refobj->path,
1044 		symnum);
1045 	}
1046 	ventry = fetch_ventry(refobj, symnum);
1047 	hash = elf_hash(name);
1048 	def = symlook_default(name, hash, refobj, &defobj, ventry, flags);
1049     } else {
1050 	def = ref;
1051 	defobj = refobj;
1052     }
1053 
1054     /*
1055      * If we found no definition and the reference is weak, treat the
1056      * symbol as having the value zero.
1057      */
1058     if (def == NULL && ELF_ST_BIND(ref->st_info) == STB_WEAK) {
1059 	def = &sym_zero;
1060 	defobj = obj_main;
1061     }
1062 
1063     if (def != NULL) {
1064 	*defobj_out = defobj;
1065 	/* Record the information in the cache to avoid subsequent lookups. */
1066 	if (cache != NULL) {
1067 	    cache[symnum].sym = def;
1068 	    cache[symnum].obj = defobj;
1069 	}
1070     } else {
1071 	if (refobj != &obj_rtld)
1072 	    _rtld_error("%s: Undefined symbol \"%s\"", refobj->path, name);
1073     }
1074     return def;
1075 }
1076 
1077 /*
1078  * Return the search path from the ldconfig hints file, reading it if
1079  * necessary.  Returns NULL if there are problems with the hints file,
1080  * or if the search path there is empty.
1081  */
1082 static const char *
1083 gethints(void)
1084 {
1085     static char *hints;
1086 
1087     if (hints == NULL) {
1088 	int fd;
1089 	struct elfhints_hdr hdr;
1090 	char *p;
1091 
1092 	/* Keep from trying again in case the hints file is bad. */
1093 	hints = "";
1094 
1095 	if ((fd = open(_PATH_ELF_HINTS, O_RDONLY)) == -1)
1096 	    return NULL;
1097 	if (read(fd, &hdr, sizeof hdr) != sizeof hdr ||
1098 	  hdr.magic != ELFHINTS_MAGIC ||
1099 	  hdr.version != 1) {
1100 	    close(fd);
1101 	    return NULL;
1102 	}
1103 	p = xmalloc(hdr.dirlistlen + 1);
1104 	if (lseek(fd, hdr.strtab + hdr.dirlist, SEEK_SET) == -1 ||
1105 	  read(fd, p, hdr.dirlistlen + 1) != (ssize_t)hdr.dirlistlen + 1) {
1106 	    free(p);
1107 	    close(fd);
1108 	    return NULL;
1109 	}
1110 	hints = p;
1111 	close(fd);
1112     }
1113     return hints[0] != '\0' ? hints : NULL;
1114 }
1115 
1116 static void
1117 init_dag(Obj_Entry *root)
1118 {
1119     DoneList donelist;
1120 
1121     donelist_init(&donelist);
1122     init_dag1(root, root, &donelist);
1123 }
1124 
1125 static void
1126 init_dag1(Obj_Entry *root, Obj_Entry *obj, DoneList *dlp)
1127 {
1128     const Needed_Entry *needed;
1129 
1130     if (donelist_check(dlp, obj))
1131 	return;
1132 
1133     obj->refcount++;
1134     objlist_push_tail(&obj->dldags, root);
1135     objlist_push_tail(&root->dagmembers, obj);
1136     for (needed = obj->needed;  needed != NULL;  needed = needed->next)
1137 	if (needed->obj != NULL)
1138 	    init_dag1(root, needed->obj, dlp);
1139 }
1140 
1141 /*
1142  * Initialize the dynamic linker.  The argument is the address at which
1143  * the dynamic linker has been mapped into memory.  The primary task of
1144  * this function is to relocate the dynamic linker.
1145  */
1146 static void
1147 init_rtld(caddr_t mapbase)
1148 {
1149     Obj_Entry objtmp;	/* Temporary rtld object */
1150 
1151     /*
1152      * Conjure up an Obj_Entry structure for the dynamic linker.
1153      *
1154      * The "path" member can't be initialized yet because string constatns
1155      * cannot yet be acessed. Below we will set it correctly.
1156      */
1157     memset(&objtmp, 0, sizeof(objtmp));
1158     objtmp.path = NULL;
1159     objtmp.rtld = true;
1160     objtmp.mapbase = mapbase;
1161 #ifdef PIC
1162     objtmp.relocbase = mapbase;
1163 #endif
1164     if (RTLD_IS_DYNAMIC()) {
1165 	objtmp.dynamic = rtld_dynamic(&objtmp);
1166 	digest_dynamic(&objtmp, 1);
1167 	assert(objtmp.needed == NULL);
1168 	assert(!objtmp.textrel);
1169 
1170 	/*
1171 	 * Temporarily put the dynamic linker entry into the object list, so
1172 	 * that symbols can be found.
1173 	 */
1174 
1175 	relocate_objects(&objtmp, true, &objtmp);
1176     }
1177 
1178     /* Initialize the object list. */
1179     obj_tail = &obj_list;
1180 
1181     /* Now that non-local variables can be accesses, copy out obj_rtld. */
1182     memcpy(&obj_rtld, &objtmp, sizeof(obj_rtld));
1183 
1184     /* Replace the path with a dynamically allocated copy. */
1185     obj_rtld.path = xstrdup(PATH_RTLD);
1186 
1187     r_debug.r_brk = r_debug_state;
1188     r_debug.r_state = RT_CONSISTENT;
1189 }
1190 
1191 /*
1192  * Add the init functions from a needed object list (and its recursive
1193  * needed objects) to "list".  This is not used directly; it is a helper
1194  * function for initlist_add_objects().  The write lock must be held
1195  * when this function is called.
1196  */
1197 static void
1198 initlist_add_neededs(Needed_Entry *needed, Objlist *list)
1199 {
1200     /* Recursively process the successor needed objects. */
1201     if (needed->next != NULL)
1202 	initlist_add_neededs(needed->next, list);
1203 
1204     /* Process the current needed object. */
1205     if (needed->obj != NULL)
1206 	initlist_add_objects(needed->obj, &needed->obj->next, list);
1207 }
1208 
1209 /*
1210  * Scan all of the DAGs rooted in the range of objects from "obj" to
1211  * "tail" and add their init functions to "list".  This recurses over
1212  * the DAGs and ensure the proper init ordering such that each object's
1213  * needed libraries are initialized before the object itself.  At the
1214  * same time, this function adds the objects to the global finalization
1215  * list "list_fini" in the opposite order.  The write lock must be
1216  * held when this function is called.
1217  */
1218 static void
1219 initlist_add_objects(Obj_Entry *obj, Obj_Entry **tail, Objlist *list)
1220 {
1221     if (obj->init_done)
1222 	return;
1223     obj->init_done = true;
1224 
1225     /* Recursively process the successor objects. */
1226     if (&obj->next != tail)
1227 	initlist_add_objects(obj->next, tail, list);
1228 
1229     /* Recursively process the needed objects. */
1230     if (obj->needed != NULL)
1231 	initlist_add_neededs(obj->needed, list);
1232 
1233     /* Add the object to the init list. */
1234     if (obj->init != (Elf_Addr)NULL)
1235 	objlist_push_tail(list, obj);
1236 
1237     /* Add the object to the global fini list in the reverse order. */
1238     if (obj->fini != (Elf_Addr)NULL)
1239 	objlist_push_head(&list_fini, obj);
1240 }
1241 
1242 #ifndef FPTR_TARGET
1243 #define FPTR_TARGET(f)	((Elf_Addr) (f))
1244 #endif
1245 
1246 static bool
1247 is_exported(const Elf_Sym *def)
1248 {
1249     Elf_Addr value;
1250     const func_ptr_type *p;
1251 
1252     value = (Elf_Addr)(obj_rtld.relocbase + def->st_value);
1253     for (p = exports;  *p != NULL;  p++)
1254 	if (FPTR_TARGET(*p) == value)
1255 	    return true;
1256     return false;
1257 }
1258 
1259 /*
1260  * Given a shared object, traverse its list of needed objects, and load
1261  * each of them.  Returns 0 on success.  Generates an error message and
1262  * returns -1 on failure.
1263  */
1264 static int
1265 load_needed_objects(Obj_Entry *first)
1266 {
1267     Obj_Entry *obj;
1268 
1269     for (obj = first;  obj != NULL;  obj = obj->next) {
1270 	Needed_Entry *needed;
1271 
1272 	for (needed = obj->needed;  needed != NULL;  needed = needed->next) {
1273 	    needed->obj = load_object(obj->strtab + needed->name, obj);
1274 	    if (needed->obj == NULL && !ld_tracing)
1275 		return -1;
1276 	}
1277     }
1278 
1279     return 0;
1280 }
1281 
1282 static int
1283 load_preload_objects(void)
1284 {
1285     char *p = ld_preload;
1286     static const char delim[] = " \t:;";
1287 
1288     if (p == NULL)
1289 	return 0;
1290 
1291     p += strspn(p, delim);
1292     while (*p != '\0') {
1293 	size_t len = strcspn(p, delim);
1294 	char savech;
1295 
1296 	savech = p[len];
1297 	p[len] = '\0';
1298 	if (load_object(p, NULL) == NULL)
1299 	    return -1;	/* XXX - cleanup */
1300 	p[len] = savech;
1301 	p += len;
1302 	p += strspn(p, delim);
1303     }
1304     LD_UTRACE(UTRACE_PRELOAD_FINISHED, NULL, NULL, 0, 0, NULL);
1305     return 0;
1306 }
1307 
1308 /*
1309  * Load a shared object into memory, if it is not already loaded.
1310  *
1311  * Returns a pointer to the Obj_Entry for the object.  Returns NULL
1312  * on failure.
1313  */
1314 static Obj_Entry *
1315 load_object(const char *name, const Obj_Entry *refobj)
1316 {
1317     Obj_Entry *obj;
1318     int fd = -1;
1319     struct stat sb;
1320     char *path;
1321 
1322     for (obj = obj_list->next;  obj != NULL;  obj = obj->next)
1323 	if (object_match_name(obj, name))
1324 	    return obj;
1325 
1326     path = find_library(name, refobj);
1327     if (path == NULL)
1328 	return NULL;
1329 
1330     /*
1331      * If we didn't find a match by pathname, open the file and check
1332      * again by device and inode.  This avoids false mismatches caused
1333      * by multiple links or ".." in pathnames.
1334      *
1335      * To avoid a race, we open the file and use fstat() rather than
1336      * using stat().
1337      */
1338     if ((fd = open(path, O_RDONLY)) == -1) {
1339 	_rtld_error("Cannot open \"%s\"", path);
1340 	free(path);
1341 	return NULL;
1342     }
1343     if (fstat(fd, &sb) == -1) {
1344 	_rtld_error("Cannot fstat \"%s\"", path);
1345 	close(fd);
1346 	free(path);
1347 	return NULL;
1348     }
1349     for (obj = obj_list->next;  obj != NULL;  obj = obj->next) {
1350 	if (obj->ino == sb.st_ino && obj->dev == sb.st_dev) {
1351 	    close(fd);
1352 	    break;
1353 	}
1354     }
1355     if (obj != NULL) {
1356 	object_add_name(obj, name);
1357 	free(path);
1358 	close(fd);
1359 	return obj;
1360     }
1361 
1362     /* First use of this object, so we must map it in */
1363     obj = do_load_object(fd, name, path, &sb);
1364     if (obj == NULL)
1365 	free(path);
1366     close(fd);
1367 
1368     return obj;
1369 }
1370 
1371 static Obj_Entry *
1372 do_load_object(int fd, const char *name, char *path, struct stat *sbp)
1373 {
1374     Obj_Entry *obj;
1375     struct statfs fs;
1376 
1377     /*
1378      * but first, make sure that environment variables haven't been
1379      * used to circumvent the noexec flag on a filesystem.
1380      */
1381     if (dangerous_ld_env) {
1382 	if (fstatfs(fd, &fs) != 0) {
1383 	    _rtld_error("Cannot fstatfs \"%s\"", path);
1384 		return NULL;
1385 	}
1386 	if (fs.f_flags & MNT_NOEXEC) {
1387 	    _rtld_error("Cannot execute objects on %s\n", fs.f_mntonname);
1388 	    return NULL;
1389 	}
1390     }
1391     dbg("loading \"%s\"", path);
1392     obj = map_object(fd, path, sbp);
1393     if (obj == NULL)
1394         return NULL;
1395 
1396     object_add_name(obj, name);
1397     obj->path = path;
1398     digest_dynamic(obj, 0);
1399 
1400     *obj_tail = obj;
1401     obj_tail = &obj->next;
1402     obj_count++;
1403     obj_loads++;
1404     linkmap_add(obj);	/* for GDB & dlinfo() */
1405 
1406     dbg("  %p .. %p: %s", obj->mapbase,
1407          obj->mapbase + obj->mapsize - 1, obj->path);
1408     if (obj->textrel)
1409 	dbg("  WARNING: %s has impure text", obj->path);
1410     LD_UTRACE(UTRACE_LOAD_OBJECT, obj, obj->mapbase, obj->mapsize, 0,
1411 	obj->path);
1412 
1413     return obj;
1414 }
1415 
1416 static Obj_Entry *
1417 obj_from_addr(const void *addr)
1418 {
1419     Obj_Entry *obj;
1420 
1421     for (obj = obj_list;  obj != NULL;  obj = obj->next) {
1422 	if (addr < (void *) obj->mapbase)
1423 	    continue;
1424 	if (addr < (void *) (obj->mapbase + obj->mapsize))
1425 	    return obj;
1426     }
1427     return NULL;
1428 }
1429 
1430 /*
1431  * Call the finalization functions for each of the objects in "list"
1432  * which are unreferenced.  All of the objects are expected to have
1433  * non-NULL fini functions.
1434  */
1435 static void
1436 objlist_call_fini(Objlist *list)
1437 {
1438     Objlist_Entry *elm;
1439     char *saved_msg;
1440 
1441     /*
1442      * Preserve the current error message since a fini function might
1443      * call into the dynamic linker and overwrite it.
1444      */
1445     saved_msg = errmsg_save();
1446     STAILQ_FOREACH(elm, list, link) {
1447 	if (elm->obj->refcount == 0) {
1448 	    dbg("calling fini function for %s at %p", elm->obj->path,
1449 	        (void *)elm->obj->fini);
1450 	    LD_UTRACE(UTRACE_FINI_CALL, elm->obj, (void *)elm->obj->fini, 0, 0,
1451 		elm->obj->path);
1452 	    call_initfini_pointer(elm->obj, elm->obj->fini);
1453 	}
1454     }
1455     errmsg_restore(saved_msg);
1456 }
1457 
1458 /*
1459  * Call the initialization functions for each of the objects in
1460  * "list".  All of the objects are expected to have non-NULL init
1461  * functions.
1462  */
1463 static void
1464 objlist_call_init(Objlist *list)
1465 {
1466     Objlist_Entry *elm;
1467     char *saved_msg;
1468 
1469     /*
1470      * Preserve the current error message since an init function might
1471      * call into the dynamic linker and overwrite it.
1472      */
1473     saved_msg = errmsg_save();
1474     STAILQ_FOREACH(elm, list, link) {
1475 	dbg("calling init function for %s at %p", elm->obj->path,
1476 	    (void *)elm->obj->init);
1477 	LD_UTRACE(UTRACE_INIT_CALL, elm->obj, (void *)elm->obj->init, 0, 0,
1478 	    elm->obj->path);
1479 	call_initfini_pointer(elm->obj, elm->obj->init);
1480     }
1481     errmsg_restore(saved_msg);
1482 }
1483 
1484 static void
1485 objlist_clear(Objlist *list)
1486 {
1487     Objlist_Entry *elm;
1488 
1489     while (!STAILQ_EMPTY(list)) {
1490 	elm = STAILQ_FIRST(list);
1491 	STAILQ_REMOVE_HEAD(list, link);
1492 	free(elm);
1493     }
1494 }
1495 
1496 static Objlist_Entry *
1497 objlist_find(Objlist *list, const Obj_Entry *obj)
1498 {
1499     Objlist_Entry *elm;
1500 
1501     STAILQ_FOREACH(elm, list, link)
1502 	if (elm->obj == obj)
1503 	    return elm;
1504     return NULL;
1505 }
1506 
1507 static void
1508 objlist_init(Objlist *list)
1509 {
1510     STAILQ_INIT(list);
1511 }
1512 
1513 static void
1514 objlist_push_head(Objlist *list, Obj_Entry *obj)
1515 {
1516     Objlist_Entry *elm;
1517 
1518     elm = NEW(Objlist_Entry);
1519     elm->obj = obj;
1520     STAILQ_INSERT_HEAD(list, elm, link);
1521 }
1522 
1523 static void
1524 objlist_push_tail(Objlist *list, Obj_Entry *obj)
1525 {
1526     Objlist_Entry *elm;
1527 
1528     elm = NEW(Objlist_Entry);
1529     elm->obj = obj;
1530     STAILQ_INSERT_TAIL(list, elm, link);
1531 }
1532 
1533 static void
1534 objlist_remove(Objlist *list, Obj_Entry *obj)
1535 {
1536     Objlist_Entry *elm;
1537 
1538     if ((elm = objlist_find(list, obj)) != NULL) {
1539 	STAILQ_REMOVE(list, elm, Struct_Objlist_Entry, link);
1540 	free(elm);
1541     }
1542 }
1543 
1544 /*
1545  * Remove all of the unreferenced objects from "list".
1546  */
1547 static void
1548 objlist_remove_unref(Objlist *list)
1549 {
1550     Objlist newlist;
1551     Objlist_Entry *elm;
1552 
1553     STAILQ_INIT(&newlist);
1554     while (!STAILQ_EMPTY(list)) {
1555 	elm = STAILQ_FIRST(list);
1556 	STAILQ_REMOVE_HEAD(list, link);
1557 	if (elm->obj->refcount == 0)
1558 	    free(elm);
1559 	else
1560 	    STAILQ_INSERT_TAIL(&newlist, elm, link);
1561     }
1562     *list = newlist;
1563 }
1564 
1565 /*
1566  * Relocate newly-loaded shared objects.  The argument is a pointer to
1567  * the Obj_Entry for the first such object.  All objects from the first
1568  * to the end of the list of objects are relocated.  Returns 0 on success,
1569  * or -1 on failure.
1570  */
1571 static int
1572 relocate_objects(Obj_Entry *first, bool bind_now, Obj_Entry *rtldobj)
1573 {
1574     Obj_Entry *obj;
1575 
1576     for (obj = first;  obj != NULL;  obj = obj->next) {
1577 	if (obj != rtldobj)
1578 	    dbg("relocating \"%s\"", obj->path);
1579 	if (obj->nbuckets == 0 || obj->nchains == 0 || obj->buckets == NULL ||
1580 	    obj->symtab == NULL || obj->strtab == NULL) {
1581 	    _rtld_error("%s: Shared object has no run-time symbol table",
1582 	      obj->path);
1583 	    return -1;
1584 	}
1585 
1586 	if (obj->textrel) {
1587 	    /* There are relocations to the write-protected text segment. */
1588 	    if (mprotect(obj->mapbase, obj->textsize,
1589 	      PROT_READ|PROT_WRITE|PROT_EXEC) == -1) {
1590 		_rtld_error("%s: Cannot write-enable text segment: %s",
1591 		  obj->path, strerror(errno));
1592 		return -1;
1593 	    }
1594 	}
1595 
1596 	/* Process the non-PLT relocations. */
1597 	if (reloc_non_plt(obj, rtldobj))
1598 		return -1;
1599 
1600 	if (obj->textrel) {	/* Re-protected the text segment. */
1601 	    if (mprotect(obj->mapbase, obj->textsize,
1602 	      PROT_READ|PROT_EXEC) == -1) {
1603 		_rtld_error("%s: Cannot write-protect text segment: %s",
1604 		  obj->path, strerror(errno));
1605 		return -1;
1606 	    }
1607 	}
1608 
1609 	/* Process the PLT relocations. */
1610 	if (reloc_plt(obj) == -1)
1611 	    return -1;
1612 	/* Relocate the jump slots if we are doing immediate binding. */
1613 	if (obj->bind_now || bind_now)
1614 	    if (reloc_jmpslots(obj) == -1)
1615 		return -1;
1616 
1617 
1618 	/*
1619 	 * Set up the magic number and version in the Obj_Entry.  These
1620 	 * were checked in the crt1.o from the original ElfKit, so we
1621 	 * set them for backward compatibility.
1622 	 */
1623 	obj->magic = RTLD_MAGIC;
1624 	obj->version = RTLD_VERSION;
1625 
1626 	/* Set the special PLT or GOT entries. */
1627 	init_pltgot(obj);
1628     }
1629 
1630     return 0;
1631 }
1632 
1633 /*
1634  * Cleanup procedure.  It will be called (by the atexit mechanism) just
1635  * before the process exits.
1636  */
1637 static void
1638 rtld_exit(void)
1639 {
1640     Obj_Entry *obj;
1641 
1642     dbg("rtld_exit()");
1643     /* Clear all the reference counts so the fini functions will be called. */
1644     for (obj = obj_list;  obj != NULL;  obj = obj->next)
1645 	obj->refcount = 0;
1646     objlist_call_fini(&list_fini);
1647     /* No need to remove the items from the list, since we are exiting. */
1648     if (!libmap_disable)
1649         lm_fini();
1650 }
1651 
1652 static void *
1653 path_enumerate(const char *path, path_enum_proc callback, void *arg)
1654 {
1655 #ifdef COMPAT_32BIT
1656     const char *trans;
1657 #endif
1658     if (path == NULL)
1659 	return (NULL);
1660 
1661     path += strspn(path, ":;");
1662     while (*path != '\0') {
1663 	size_t len;
1664 	char  *res;
1665 
1666 	len = strcspn(path, ":;");
1667 #ifdef COMPAT_32BIT
1668 	trans = lm_findn(NULL, path, len);
1669 	if (trans)
1670 	    res = callback(trans, strlen(trans), arg);
1671 	else
1672 #endif
1673 	res = callback(path, len, arg);
1674 
1675 	if (res != NULL)
1676 	    return (res);
1677 
1678 	path += len;
1679 	path += strspn(path, ":;");
1680     }
1681 
1682     return (NULL);
1683 }
1684 
1685 struct try_library_args {
1686     const char	*name;
1687     size_t	 namelen;
1688     char	*buffer;
1689     size_t	 buflen;
1690 };
1691 
1692 static void *
1693 try_library_path(const char *dir, size_t dirlen, void *param)
1694 {
1695     struct try_library_args *arg;
1696 
1697     arg = param;
1698     if (*dir == '/' || trust) {
1699 	char *pathname;
1700 
1701 	if (dirlen + 1 + arg->namelen + 1 > arg->buflen)
1702 		return (NULL);
1703 
1704 	pathname = arg->buffer;
1705 	strncpy(pathname, dir, dirlen);
1706 	pathname[dirlen] = '/';
1707 	strcpy(pathname + dirlen + 1, arg->name);
1708 
1709 	dbg("  Trying \"%s\"", pathname);
1710 	if (access(pathname, F_OK) == 0) {		/* We found it */
1711 	    pathname = xmalloc(dirlen + 1 + arg->namelen + 1);
1712 	    strcpy(pathname, arg->buffer);
1713 	    return (pathname);
1714 	}
1715     }
1716     return (NULL);
1717 }
1718 
1719 static char *
1720 search_library_path(const char *name, const char *path)
1721 {
1722     char *p;
1723     struct try_library_args arg;
1724 
1725     if (path == NULL)
1726 	return NULL;
1727 
1728     arg.name = name;
1729     arg.namelen = strlen(name);
1730     arg.buffer = xmalloc(PATH_MAX);
1731     arg.buflen = PATH_MAX;
1732 
1733     p = path_enumerate(path, try_library_path, &arg);
1734 
1735     free(arg.buffer);
1736 
1737     return (p);
1738 }
1739 
1740 int
1741 dlclose(void *handle)
1742 {
1743     Obj_Entry *root;
1744     int lockstate;
1745 
1746     lockstate = wlock_acquire(rtld_bind_lock);
1747     root = dlcheck(handle);
1748     if (root == NULL) {
1749 	wlock_release(rtld_bind_lock, lockstate);
1750 	return -1;
1751     }
1752     LD_UTRACE(UTRACE_DLCLOSE_START, handle, NULL, 0, root->dl_refcount,
1753 	root->path);
1754 
1755     /* Unreference the object and its dependencies. */
1756     root->dl_refcount--;
1757 
1758     unref_dag(root);
1759 
1760     if (root->refcount == 0) {
1761 	/*
1762 	 * The object is no longer referenced, so we must unload it.
1763 	 * First, call the fini functions with no locks held.
1764 	 */
1765 	wlock_release(rtld_bind_lock, lockstate);
1766 	objlist_call_fini(&list_fini);
1767 	lockstate = wlock_acquire(rtld_bind_lock);
1768 	objlist_remove_unref(&list_fini);
1769 
1770 	/* Finish cleaning up the newly-unreferenced objects. */
1771 	GDB_STATE(RT_DELETE,&root->linkmap);
1772 	unload_object(root);
1773 	GDB_STATE(RT_CONSISTENT,NULL);
1774     }
1775     LD_UTRACE(UTRACE_DLCLOSE_STOP, handle, NULL, 0, 0, NULL);
1776     wlock_release(rtld_bind_lock, lockstate);
1777     return 0;
1778 }
1779 
1780 const char *
1781 dlerror(void)
1782 {
1783     char *msg = error_message;
1784     error_message = NULL;
1785     return msg;
1786 }
1787 
1788 /*
1789  * This function is deprecated and has no effect.
1790  */
1791 void
1792 dllockinit(void *context,
1793 	   void *(*lock_create)(void *context),
1794            void (*rlock_acquire)(void *lock),
1795            void (*wlock_acquire)(void *lock),
1796            void (*lock_release)(void *lock),
1797            void (*lock_destroy)(void *lock),
1798 	   void (*context_destroy)(void *context))
1799 {
1800     static void *cur_context;
1801     static void (*cur_context_destroy)(void *);
1802 
1803     /* Just destroy the context from the previous call, if necessary. */
1804     if (cur_context_destroy != NULL)
1805 	cur_context_destroy(cur_context);
1806     cur_context = context;
1807     cur_context_destroy = context_destroy;
1808 }
1809 
1810 void *
1811 dlopen(const char *name, int mode)
1812 {
1813     Obj_Entry **old_obj_tail;
1814     Obj_Entry *obj;
1815     Objlist initlist;
1816     int result, lockstate;
1817 
1818     LD_UTRACE(UTRACE_DLOPEN_START, NULL, NULL, 0, mode, name);
1819     ld_tracing = (mode & RTLD_TRACE) == 0 ? NULL : "1";
1820     if (ld_tracing != NULL)
1821 	environ = (char **)*get_program_var_addr("environ");
1822 
1823     objlist_init(&initlist);
1824 
1825     lockstate = wlock_acquire(rtld_bind_lock);
1826     GDB_STATE(RT_ADD,NULL);
1827 
1828     old_obj_tail = obj_tail;
1829     obj = NULL;
1830     if (name == NULL) {
1831 	obj = obj_main;
1832 	obj->refcount++;
1833     } else {
1834 	obj = load_object(name, obj_main);
1835     }
1836 
1837     if (obj) {
1838 	obj->dl_refcount++;
1839 	if (mode & RTLD_GLOBAL && objlist_find(&list_global, obj) == NULL)
1840 	    objlist_push_tail(&list_global, obj);
1841 	mode &= RTLD_MODEMASK;
1842 	if (*old_obj_tail != NULL) {		/* We loaded something new. */
1843 	    assert(*old_obj_tail == obj);
1844 	    result = load_needed_objects(obj);
1845 	    init_dag(obj);
1846 	    if (result != -1)
1847 		result = rtld_verify_versions(&obj->dagmembers);
1848 	    if (result != -1 && ld_tracing)
1849 		goto trace;
1850 	    if (result == -1 ||
1851 	      (relocate_objects(obj, mode == RTLD_NOW, &obj_rtld)) == -1) {
1852 		obj->dl_refcount--;
1853 		unref_dag(obj);
1854 		if (obj->refcount == 0)
1855 		    unload_object(obj);
1856 		obj = NULL;
1857 	    } else {
1858 		/* Make list of init functions to call. */
1859 		initlist_add_objects(obj, &obj->next, &initlist);
1860 	    }
1861 	} else {
1862 
1863 	    /* Bump the reference counts for objects on this DAG. */
1864 	    ref_dag(obj);
1865 
1866 	    if (ld_tracing)
1867 		goto trace;
1868 	}
1869     }
1870 
1871     LD_UTRACE(UTRACE_DLOPEN_STOP, obj, NULL, 0, obj ? obj->dl_refcount : 0,
1872 	name);
1873     GDB_STATE(RT_CONSISTENT,obj ? &obj->linkmap : NULL);
1874 
1875     /* Call the init functions with no locks held. */
1876     wlock_release(rtld_bind_lock, lockstate);
1877     objlist_call_init(&initlist);
1878     lockstate = wlock_acquire(rtld_bind_lock);
1879     objlist_clear(&initlist);
1880     wlock_release(rtld_bind_lock, lockstate);
1881     return obj;
1882 trace:
1883     trace_loaded_objects(obj);
1884     wlock_release(rtld_bind_lock, lockstate);
1885     exit(0);
1886 }
1887 
1888 static void *
1889 do_dlsym(void *handle, const char *name, void *retaddr, const Ver_Entry *ve,
1890     int flags)
1891 {
1892     DoneList donelist;
1893     const Obj_Entry *obj, *defobj;
1894     const Elf_Sym *def;
1895     unsigned long hash;
1896     int lockstate;
1897 
1898     hash = elf_hash(name);
1899     def = NULL;
1900     defobj = NULL;
1901     flags |= SYMLOOK_IN_PLT;
1902 
1903     lockstate = rlock_acquire(rtld_bind_lock);
1904     if (handle == NULL || handle == RTLD_NEXT ||
1905 	handle == RTLD_DEFAULT || handle == RTLD_SELF) {
1906 
1907 	if ((obj = obj_from_addr(retaddr)) == NULL) {
1908 	    _rtld_error("Cannot determine caller's shared object");
1909 	    rlock_release(rtld_bind_lock, lockstate);
1910 	    return NULL;
1911 	}
1912 	if (handle == NULL) {	/* Just the caller's shared object. */
1913 	    def = symlook_obj(name, hash, obj, ve, flags);
1914 	    defobj = obj;
1915 	} else if (handle == RTLD_NEXT || /* Objects after caller's */
1916 		   handle == RTLD_SELF) { /* ... caller included */
1917 	    if (handle == RTLD_NEXT)
1918 		obj = obj->next;
1919 	    for (; obj != NULL; obj = obj->next) {
1920 		if ((def = symlook_obj(name, hash, obj, ve, flags)) != NULL) {
1921 		    defobj = obj;
1922 		    break;
1923 		}
1924 	    }
1925 	} else {
1926 	    assert(handle == RTLD_DEFAULT);
1927 	    def = symlook_default(name, hash, obj, &defobj, ve, flags);
1928 	}
1929     } else {
1930 	if ((obj = dlcheck(handle)) == NULL) {
1931 	    rlock_release(rtld_bind_lock, lockstate);
1932 	    return NULL;
1933 	}
1934 
1935 	donelist_init(&donelist);
1936 	if (obj->mainprog) {
1937 	    /* Search main program and all libraries loaded by it. */
1938 	    def = symlook_list(name, hash, &list_main, &defobj, ve, flags,
1939 			       &donelist);
1940 	} else {
1941 	    Needed_Entry fake;
1942 
1943 	    /* Search the whole DAG rooted at the given object. */
1944 	    fake.next = NULL;
1945 	    fake.obj = (Obj_Entry *)obj;
1946 	    fake.name = 0;
1947 	    def = symlook_needed(name, hash, &fake, &defobj, ve, flags,
1948 				 &donelist);
1949 	}
1950     }
1951 
1952     if (def != NULL) {
1953 	rlock_release(rtld_bind_lock, lockstate);
1954 
1955 	/*
1956 	 * The value required by the caller is derived from the value
1957 	 * of the symbol. For the ia64 architecture, we need to
1958 	 * construct a function descriptor which the caller can use to
1959 	 * call the function with the right 'gp' value. For other
1960 	 * architectures and for non-functions, the value is simply
1961 	 * the relocated value of the symbol.
1962 	 */
1963 	if (ELF_ST_TYPE(def->st_info) == STT_FUNC)
1964 	    return make_function_pointer(def, defobj);
1965 	else
1966 	    return defobj->relocbase + def->st_value;
1967     }
1968 
1969     _rtld_error("Undefined symbol \"%s\"", name);
1970     rlock_release(rtld_bind_lock, lockstate);
1971     return NULL;
1972 }
1973 
1974 void *
1975 dlsym(void *handle, const char *name)
1976 {
1977 	return do_dlsym(handle, name, __builtin_return_address(0), NULL,
1978 	    SYMLOOK_DLSYM);
1979 }
1980 
1981 void *
1982 dlvsym(void *handle, const char *name, const char *version)
1983 {
1984 	Ver_Entry ventry;
1985 
1986 	ventry.name = version;
1987 	ventry.file = NULL;
1988 	ventry.hash = elf_hash(version);
1989 	ventry.flags= 0;
1990 	return do_dlsym(handle, name, __builtin_return_address(0), &ventry,
1991 	    SYMLOOK_DLSYM);
1992 }
1993 
1994 int
1995 dladdr(const void *addr, Dl_info *info)
1996 {
1997     const Obj_Entry *obj;
1998     const Elf_Sym *def;
1999     void *symbol_addr;
2000     unsigned long symoffset;
2001     int lockstate;
2002 
2003     lockstate = rlock_acquire(rtld_bind_lock);
2004     obj = obj_from_addr(addr);
2005     if (obj == NULL) {
2006         _rtld_error("No shared object contains address");
2007 	rlock_release(rtld_bind_lock, lockstate);
2008         return 0;
2009     }
2010     info->dli_fname = obj->path;
2011     info->dli_fbase = obj->mapbase;
2012     info->dli_saddr = (void *)0;
2013     info->dli_sname = NULL;
2014 
2015     /*
2016      * Walk the symbol list looking for the symbol whose address is
2017      * closest to the address sent in.
2018      */
2019     for (symoffset = 0; symoffset < obj->nchains; symoffset++) {
2020         def = obj->symtab + symoffset;
2021 
2022         /*
2023          * For skip the symbol if st_shndx is either SHN_UNDEF or
2024          * SHN_COMMON.
2025          */
2026         if (def->st_shndx == SHN_UNDEF || def->st_shndx == SHN_COMMON)
2027             continue;
2028 
2029         /*
2030          * If the symbol is greater than the specified address, or if it
2031          * is further away from addr than the current nearest symbol,
2032          * then reject it.
2033          */
2034         symbol_addr = obj->relocbase + def->st_value;
2035         if (symbol_addr > addr || symbol_addr < info->dli_saddr)
2036             continue;
2037 
2038         /* Update our idea of the nearest symbol. */
2039         info->dli_sname = obj->strtab + def->st_name;
2040         info->dli_saddr = symbol_addr;
2041 
2042         /* Exact match? */
2043         if (info->dli_saddr == addr)
2044             break;
2045     }
2046     rlock_release(rtld_bind_lock, lockstate);
2047     return 1;
2048 }
2049 
2050 int
2051 dlinfo(void *handle, int request, void *p)
2052 {
2053     const Obj_Entry *obj;
2054     int error, lockstate;
2055 
2056     lockstate = rlock_acquire(rtld_bind_lock);
2057 
2058     if (handle == NULL || handle == RTLD_SELF) {
2059 	void *retaddr;
2060 
2061 	retaddr = __builtin_return_address(0);	/* __GNUC__ only */
2062 	if ((obj = obj_from_addr(retaddr)) == NULL)
2063 	    _rtld_error("Cannot determine caller's shared object");
2064     } else
2065 	obj = dlcheck(handle);
2066 
2067     if (obj == NULL) {
2068 	rlock_release(rtld_bind_lock, lockstate);
2069 	return (-1);
2070     }
2071 
2072     error = 0;
2073     switch (request) {
2074     case RTLD_DI_LINKMAP:
2075 	*((struct link_map const **)p) = &obj->linkmap;
2076 	break;
2077     case RTLD_DI_ORIGIN:
2078 	error = rtld_dirname(obj->path, p);
2079 	break;
2080 
2081     case RTLD_DI_SERINFOSIZE:
2082     case RTLD_DI_SERINFO:
2083 	error = do_search_info(obj, request, (struct dl_serinfo *)p);
2084 	break;
2085 
2086     default:
2087 	_rtld_error("Invalid request %d passed to dlinfo()", request);
2088 	error = -1;
2089     }
2090 
2091     rlock_release(rtld_bind_lock, lockstate);
2092 
2093     return (error);
2094 }
2095 
2096 int
2097 dl_iterate_phdr(__dl_iterate_hdr_callback callback, void *param)
2098 {
2099     struct dl_phdr_info phdr_info;
2100     const Obj_Entry *obj;
2101     int error, lockstate;
2102 
2103     lockstate = rlock_acquire(rtld_bind_lock);
2104 
2105     error = 0;
2106 
2107     for (obj = obj_list;  obj != NULL;  obj = obj->next) {
2108 	phdr_info.dlpi_addr = (Elf_Addr)obj->relocbase;
2109 	phdr_info.dlpi_name = STAILQ_FIRST(&obj->names) ?
2110 	    STAILQ_FIRST(&obj->names)->name : obj->path;
2111 	phdr_info.dlpi_phdr = obj->phdr;
2112 	phdr_info.dlpi_phnum = obj->phsize / sizeof(obj->phdr[0]);
2113 	phdr_info.dlpi_tls_modid = obj->tlsindex;
2114 	phdr_info.dlpi_tls_data = obj->tlsinit;
2115 	phdr_info.dlpi_adds = obj_loads;
2116 	phdr_info.dlpi_subs = obj_loads - obj_count;
2117 
2118 	if ((error = callback(&phdr_info, sizeof phdr_info, param)) != 0)
2119 		break;
2120 
2121     }
2122     rlock_release(rtld_bind_lock, lockstate);
2123 
2124     return (error);
2125 }
2126 
2127 struct fill_search_info_args {
2128     int		 request;
2129     unsigned int flags;
2130     Dl_serinfo  *serinfo;
2131     Dl_serpath  *serpath;
2132     char	*strspace;
2133 };
2134 
2135 static void *
2136 fill_search_info(const char *dir, size_t dirlen, void *param)
2137 {
2138     struct fill_search_info_args *arg;
2139 
2140     arg = param;
2141 
2142     if (arg->request == RTLD_DI_SERINFOSIZE) {
2143 	arg->serinfo->dls_cnt ++;
2144 	arg->serinfo->dls_size += sizeof(Dl_serpath) + dirlen + 1;
2145     } else {
2146 	struct dl_serpath *s_entry;
2147 
2148 	s_entry = arg->serpath;
2149 	s_entry->dls_name  = arg->strspace;
2150 	s_entry->dls_flags = arg->flags;
2151 
2152 	strncpy(arg->strspace, dir, dirlen);
2153 	arg->strspace[dirlen] = '\0';
2154 
2155 	arg->strspace += dirlen + 1;
2156 	arg->serpath++;
2157     }
2158 
2159     return (NULL);
2160 }
2161 
2162 static int
2163 do_search_info(const Obj_Entry *obj, int request, struct dl_serinfo *info)
2164 {
2165     struct dl_serinfo _info;
2166     struct fill_search_info_args args;
2167 
2168     args.request = RTLD_DI_SERINFOSIZE;
2169     args.serinfo = &_info;
2170 
2171     _info.dls_size = __offsetof(struct dl_serinfo, dls_serpath);
2172     _info.dls_cnt  = 0;
2173 
2174     path_enumerate(ld_library_path, fill_search_info, &args);
2175     path_enumerate(obj->rpath, fill_search_info, &args);
2176     path_enumerate(gethints(), fill_search_info, &args);
2177     path_enumerate(STANDARD_LIBRARY_PATH, fill_search_info, &args);
2178 
2179 
2180     if (request == RTLD_DI_SERINFOSIZE) {
2181 	info->dls_size = _info.dls_size;
2182 	info->dls_cnt = _info.dls_cnt;
2183 	return (0);
2184     }
2185 
2186     if (info->dls_cnt != _info.dls_cnt || info->dls_size != _info.dls_size) {
2187 	_rtld_error("Uninitialized Dl_serinfo struct passed to dlinfo()");
2188 	return (-1);
2189     }
2190 
2191     args.request  = RTLD_DI_SERINFO;
2192     args.serinfo  = info;
2193     args.serpath  = &info->dls_serpath[0];
2194     args.strspace = (char *)&info->dls_serpath[_info.dls_cnt];
2195 
2196     args.flags = LA_SER_LIBPATH;
2197     if (path_enumerate(ld_library_path, fill_search_info, &args) != NULL)
2198 	return (-1);
2199 
2200     args.flags = LA_SER_RUNPATH;
2201     if (path_enumerate(obj->rpath, fill_search_info, &args) != NULL)
2202 	return (-1);
2203 
2204     args.flags = LA_SER_CONFIG;
2205     if (path_enumerate(gethints(), fill_search_info, &args) != NULL)
2206 	return (-1);
2207 
2208     args.flags = LA_SER_DEFAULT;
2209     if (path_enumerate(STANDARD_LIBRARY_PATH, fill_search_info, &args) != NULL)
2210 	return (-1);
2211     return (0);
2212 }
2213 
2214 static int
2215 rtld_dirname(const char *path, char *bname)
2216 {
2217     const char *endp;
2218 
2219     /* Empty or NULL string gets treated as "." */
2220     if (path == NULL || *path == '\0') {
2221 	bname[0] = '.';
2222 	bname[1] = '\0';
2223 	return (0);
2224     }
2225 
2226     /* Strip trailing slashes */
2227     endp = path + strlen(path) - 1;
2228     while (endp > path && *endp == '/')
2229 	endp--;
2230 
2231     /* Find the start of the dir */
2232     while (endp > path && *endp != '/')
2233 	endp--;
2234 
2235     /* Either the dir is "/" or there are no slashes */
2236     if (endp == path) {
2237 	bname[0] = *endp == '/' ? '/' : '.';
2238 	bname[1] = '\0';
2239 	return (0);
2240     } else {
2241 	do {
2242 	    endp--;
2243 	} while (endp > path && *endp == '/');
2244     }
2245 
2246     if (endp - path + 2 > PATH_MAX)
2247     {
2248 	_rtld_error("Filename is too long: %s", path);
2249 	return(-1);
2250     }
2251 
2252     strncpy(bname, path, endp - path + 1);
2253     bname[endp - path + 1] = '\0';
2254     return (0);
2255 }
2256 
2257 static void
2258 linkmap_add(Obj_Entry *obj)
2259 {
2260     struct link_map *l = &obj->linkmap;
2261     struct link_map *prev;
2262 
2263     obj->linkmap.l_name = obj->path;
2264     obj->linkmap.l_addr = obj->mapbase;
2265     obj->linkmap.l_ld = obj->dynamic;
2266 #ifdef __mips__
2267     /* GDB needs load offset on MIPS to use the symbols */
2268     obj->linkmap.l_offs = obj->relocbase;
2269 #endif
2270 
2271     if (r_debug.r_map == NULL) {
2272 	r_debug.r_map = l;
2273 	return;
2274     }
2275 
2276     /*
2277      * Scan to the end of the list, but not past the entry for the
2278      * dynamic linker, which we want to keep at the very end.
2279      */
2280     for (prev = r_debug.r_map;
2281       prev->l_next != NULL && prev->l_next != &obj_rtld.linkmap;
2282       prev = prev->l_next)
2283 	;
2284 
2285     /* Link in the new entry. */
2286     l->l_prev = prev;
2287     l->l_next = prev->l_next;
2288     if (l->l_next != NULL)
2289 	l->l_next->l_prev = l;
2290     prev->l_next = l;
2291 }
2292 
2293 static void
2294 linkmap_delete(Obj_Entry *obj)
2295 {
2296     struct link_map *l = &obj->linkmap;
2297 
2298     if (l->l_prev == NULL) {
2299 	if ((r_debug.r_map = l->l_next) != NULL)
2300 	    l->l_next->l_prev = NULL;
2301 	return;
2302     }
2303 
2304     if ((l->l_prev->l_next = l->l_next) != NULL)
2305 	l->l_next->l_prev = l->l_prev;
2306 }
2307 
2308 /*
2309  * Function for the debugger to set a breakpoint on to gain control.
2310  *
2311  * The two parameters allow the debugger to easily find and determine
2312  * what the runtime loader is doing and to whom it is doing it.
2313  *
2314  * When the loadhook trap is hit (r_debug_state, set at program
2315  * initialization), the arguments can be found on the stack:
2316  *
2317  *  +8   struct link_map *m
2318  *  +4   struct r_debug  *rd
2319  *  +0   RetAddr
2320  */
2321 void
2322 r_debug_state(struct r_debug* rd, struct link_map *m)
2323 {
2324 }
2325 
2326 /*
2327  * Get address of the pointer variable in the main program.
2328  */
2329 static const void **
2330 get_program_var_addr(const char *name)
2331 {
2332     const Obj_Entry *obj;
2333     unsigned long hash;
2334 
2335     hash = elf_hash(name);
2336     for (obj = obj_main;  obj != NULL;  obj = obj->next) {
2337 	const Elf_Sym *def;
2338 
2339 	if ((def = symlook_obj(name, hash, obj, NULL, 0)) != NULL) {
2340 	    const void **addr;
2341 
2342 	    addr = (const void **)(obj->relocbase + def->st_value);
2343 	    return addr;
2344 	}
2345     }
2346     return NULL;
2347 }
2348 
2349 /*
2350  * Set a pointer variable in the main program to the given value.  This
2351  * is used to set key variables such as "environ" before any of the
2352  * init functions are called.
2353  */
2354 static void
2355 set_program_var(const char *name, const void *value)
2356 {
2357     const void **addr;
2358 
2359     if ((addr = get_program_var_addr(name)) != NULL) {
2360 	dbg("\"%s\": *%p <-- %p", name, addr, value);
2361 	*addr = value;
2362     }
2363 }
2364 
2365 /*
2366  * Given a symbol name in a referencing object, find the corresponding
2367  * definition of the symbol.  Returns a pointer to the symbol, or NULL if
2368  * no definition was found.  Returns a pointer to the Obj_Entry of the
2369  * defining object via the reference parameter DEFOBJ_OUT.
2370  */
2371 static const Elf_Sym *
2372 symlook_default(const char *name, unsigned long hash, const Obj_Entry *refobj,
2373     const Obj_Entry **defobj_out, const Ver_Entry *ventry, int flags)
2374 {
2375     DoneList donelist;
2376     const Elf_Sym *def;
2377     const Elf_Sym *symp;
2378     const Obj_Entry *obj;
2379     const Obj_Entry *defobj;
2380     const Objlist_Entry *elm;
2381     def = NULL;
2382     defobj = NULL;
2383     donelist_init(&donelist);
2384 
2385     /* Look first in the referencing object if linked symbolically. */
2386     if (refobj->symbolic && !donelist_check(&donelist, refobj)) {
2387 	symp = symlook_obj(name, hash, refobj, ventry, flags);
2388 	if (symp != NULL) {
2389 	    def = symp;
2390 	    defobj = refobj;
2391 	}
2392     }
2393 
2394     /* Search all objects loaded at program start up. */
2395     if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) {
2396 	symp = symlook_list(name, hash, &list_main, &obj, ventry, flags,
2397 	    &donelist);
2398 	if (symp != NULL &&
2399 	  (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) {
2400 	    def = symp;
2401 	    defobj = obj;
2402 	}
2403     }
2404 
2405     /* Search all DAGs whose roots are RTLD_GLOBAL objects. */
2406     STAILQ_FOREACH(elm, &list_global, link) {
2407        if (def != NULL && ELF_ST_BIND(def->st_info) != STB_WEAK)
2408            break;
2409        symp = symlook_list(name, hash, &elm->obj->dagmembers, &obj, ventry,
2410 	   flags, &donelist);
2411 	if (symp != NULL &&
2412 	  (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) {
2413 	    def = symp;
2414 	    defobj = obj;
2415 	}
2416     }
2417 
2418     /* Search all dlopened DAGs containing the referencing object. */
2419     STAILQ_FOREACH(elm, &refobj->dldags, link) {
2420 	if (def != NULL && ELF_ST_BIND(def->st_info) != STB_WEAK)
2421 	    break;
2422 	symp = symlook_list(name, hash, &elm->obj->dagmembers, &obj, ventry,
2423 	    flags, &donelist);
2424 	if (symp != NULL &&
2425 	  (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) {
2426 	    def = symp;
2427 	    defobj = obj;
2428 	}
2429     }
2430 
2431     /*
2432      * Search the dynamic linker itself, and possibly resolve the
2433      * symbol from there.  This is how the application links to
2434      * dynamic linker services such as dlopen.  Only the values listed
2435      * in the "exports" array can be resolved from the dynamic linker.
2436      */
2437     if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) {
2438 	symp = symlook_obj(name, hash, &obj_rtld, ventry, flags);
2439 	if (symp != NULL && is_exported(symp)) {
2440 	    def = symp;
2441 	    defobj = &obj_rtld;
2442 	}
2443     }
2444 
2445     if (def != NULL)
2446 	*defobj_out = defobj;
2447     return def;
2448 }
2449 
2450 static const Elf_Sym *
2451 symlook_list(const char *name, unsigned long hash, const Objlist *objlist,
2452   const Obj_Entry **defobj_out, const Ver_Entry *ventry, int flags,
2453   DoneList *dlp)
2454 {
2455     const Elf_Sym *symp;
2456     const Elf_Sym *def;
2457     const Obj_Entry *defobj;
2458     const Objlist_Entry *elm;
2459 
2460     def = NULL;
2461     defobj = NULL;
2462     STAILQ_FOREACH(elm, objlist, link) {
2463 	if (donelist_check(dlp, elm->obj))
2464 	    continue;
2465 	if ((symp = symlook_obj(name, hash, elm->obj, ventry, flags)) != NULL) {
2466 	    if (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK) {
2467 		def = symp;
2468 		defobj = elm->obj;
2469 		if (ELF_ST_BIND(def->st_info) != STB_WEAK)
2470 		    break;
2471 	    }
2472 	}
2473     }
2474     if (def != NULL)
2475 	*defobj_out = defobj;
2476     return def;
2477 }
2478 
2479 /*
2480  * Search the symbol table of a shared object and all objects needed
2481  * by it for a symbol of the given name.  Search order is
2482  * breadth-first.  Returns a pointer to the symbol, or NULL if no
2483  * definition was found.
2484  */
2485 static const Elf_Sym *
2486 symlook_needed(const char *name, unsigned long hash, const Needed_Entry *needed,
2487   const Obj_Entry **defobj_out, const Ver_Entry *ventry, int flags,
2488   DoneList *dlp)
2489 {
2490     const Elf_Sym *def, *def_w;
2491     const Needed_Entry *n;
2492     const Obj_Entry *obj, *defobj, *defobj1;
2493 
2494     def = def_w = NULL;
2495     defobj = NULL;
2496     for (n = needed; n != NULL; n = n->next) {
2497 	if ((obj = n->obj) == NULL ||
2498 	    donelist_check(dlp, obj) ||
2499 	    (def = symlook_obj(name, hash, obj, ventry, flags)) == NULL)
2500 	    continue;
2501 	defobj = obj;
2502 	if (ELF_ST_BIND(def->st_info) != STB_WEAK) {
2503 	    *defobj_out = defobj;
2504 	    return (def);
2505 	}
2506     }
2507     /*
2508      * There we come when either symbol definition is not found in
2509      * directly needed objects, or found symbol is weak.
2510      */
2511     for (n = needed; n != NULL; n = n->next) {
2512 	if ((obj = n->obj) == NULL)
2513 	    continue;
2514 	def_w = symlook_needed(name, hash, obj->needed, &defobj1,
2515 			       ventry, flags, dlp);
2516 	if (def_w == NULL)
2517 	    continue;
2518 	if (def == NULL || ELF_ST_BIND(def_w->st_info) != STB_WEAK) {
2519 	    def = def_w;
2520 	    defobj = defobj1;
2521 	}
2522 	if (ELF_ST_BIND(def_w->st_info) != STB_WEAK)
2523 	    break;
2524     }
2525     if (def != NULL)
2526 	*defobj_out = defobj;
2527     return (def);
2528 }
2529 
2530 /*
2531  * Search the symbol table of a single shared object for a symbol of
2532  * the given name and version, if requested.  Returns a pointer to the
2533  * symbol, or NULL if no definition was found.
2534  *
2535  * The symbol's hash value is passed in for efficiency reasons; that
2536  * eliminates many recomputations of the hash value.
2537  */
2538 const Elf_Sym *
2539 symlook_obj(const char *name, unsigned long hash, const Obj_Entry *obj,
2540     const Ver_Entry *ventry, int flags)
2541 {
2542     unsigned long symnum;
2543     const Elf_Sym *vsymp;
2544     Elf_Versym verndx;
2545     int vcount;
2546 
2547     if (obj->buckets == NULL)
2548 	return NULL;
2549 
2550     vsymp = NULL;
2551     vcount = 0;
2552     symnum = obj->buckets[hash % obj->nbuckets];
2553 
2554     for (; symnum != STN_UNDEF; symnum = obj->chains[symnum]) {
2555 	const Elf_Sym *symp;
2556 	const char *strp;
2557 
2558 	if (symnum >= obj->nchains)
2559 		return NULL;	/* Bad object */
2560 
2561 	symp = obj->symtab + symnum;
2562 	strp = obj->strtab + symp->st_name;
2563 
2564 	switch (ELF_ST_TYPE(symp->st_info)) {
2565 	case STT_FUNC:
2566 	case STT_NOTYPE:
2567 	case STT_OBJECT:
2568 	    if (symp->st_value == 0)
2569 		continue;
2570 		/* fallthrough */
2571 	case STT_TLS:
2572 	    if (symp->st_shndx != SHN_UNDEF ||
2573 		((flags & SYMLOOK_IN_PLT) == 0 &&
2574 		 ELF_ST_TYPE(symp->st_info) == STT_FUNC))
2575 		break;
2576 		/* fallthrough */
2577 	default:
2578 	    continue;
2579 	}
2580 	if (name[0] != strp[0] || strcmp(name, strp) != 0)
2581 	    continue;
2582 
2583 	if (ventry == NULL) {
2584 	    if (obj->versyms != NULL) {
2585 		verndx = VER_NDX(obj->versyms[symnum]);
2586 		if (verndx > obj->vernum) {
2587 		    _rtld_error("%s: symbol %s references wrong version %d",
2588 			obj->path, obj->strtab + symnum, verndx);
2589 		    continue;
2590 		}
2591 		/*
2592 		 * If we are not called from dlsym (i.e. this is a normal
2593 		 * relocation from unversioned binary, accept the symbol
2594 		 * immediately if it happens to have first version after
2595 		 * this shared object became versioned. Otherwise, if
2596 		 * symbol is versioned and not hidden, remember it. If it
2597 		 * is the only symbol with this name exported by the
2598 		 * shared object, it will be returned as a match at the
2599 		 * end of the function. If symbol is global (verndx < 2)
2600 		 * accept it unconditionally.
2601 		 */
2602 		if ((flags & SYMLOOK_DLSYM) == 0 && verndx == VER_NDX_GIVEN)
2603 		    return symp;
2604 	        else if (verndx >= VER_NDX_GIVEN) {
2605 		    if ((obj->versyms[symnum] & VER_NDX_HIDDEN) == 0) {
2606 			if (vsymp == NULL)
2607 			    vsymp = symp;
2608 			vcount ++;
2609 		    }
2610 		    continue;
2611 		}
2612 	    }
2613 	    return symp;
2614 	} else {
2615 	    if (obj->versyms == NULL) {
2616 		if (object_match_name(obj, ventry->name)) {
2617 		    _rtld_error("%s: object %s should provide version %s for "
2618 			"symbol %s", obj_rtld.path, obj->path, ventry->name,
2619 			obj->strtab + symnum);
2620 		    continue;
2621 		}
2622 	    } else {
2623 		verndx = VER_NDX(obj->versyms[symnum]);
2624 		if (verndx > obj->vernum) {
2625 		    _rtld_error("%s: symbol %s references wrong version %d",
2626 			obj->path, obj->strtab + symnum, verndx);
2627 		    continue;
2628 		}
2629 		if (obj->vertab[verndx].hash != ventry->hash ||
2630 		    strcmp(obj->vertab[verndx].name, ventry->name)) {
2631 		    /*
2632 		     * Version does not match. Look if this is a global symbol
2633 		     * and if it is not hidden. If global symbol (verndx < 2)
2634 		     * is available, use it. Do not return symbol if we are
2635 		     * called by dlvsym, because dlvsym looks for a specific
2636 		     * version and default one is not what dlvsym wants.
2637 		     */
2638 		    if ((flags & SYMLOOK_DLSYM) ||
2639 			(obj->versyms[symnum] & VER_NDX_HIDDEN) ||
2640 			(verndx >= VER_NDX_GIVEN))
2641 			continue;
2642 		}
2643 	    }
2644 	    return symp;
2645 	}
2646     }
2647     return (vcount == 1) ? vsymp : NULL;
2648 }
2649 
2650 static void
2651 trace_loaded_objects(Obj_Entry *obj)
2652 {
2653     char	*fmt1, *fmt2, *fmt, *main_local, *list_containers;
2654     int		c;
2655 
2656     if ((main_local = getenv(LD_ "TRACE_LOADED_OBJECTS_PROGNAME")) == NULL)
2657 	main_local = "";
2658 
2659     if ((fmt1 = getenv(LD_ "TRACE_LOADED_OBJECTS_FMT1")) == NULL)
2660 	fmt1 = "\t%o => %p (%x)\n";
2661 
2662     if ((fmt2 = getenv(LD_ "TRACE_LOADED_OBJECTS_FMT2")) == NULL)
2663 	fmt2 = "\t%o (%x)\n";
2664 
2665     list_containers = getenv(LD_ "TRACE_LOADED_OBJECTS_ALL");
2666 
2667     for (; obj; obj = obj->next) {
2668 	Needed_Entry		*needed;
2669 	char			*name, *path;
2670 	bool			is_lib;
2671 
2672 	if (list_containers && obj->needed != NULL)
2673 	    printf("%s:\n", obj->path);
2674 	for (needed = obj->needed; needed; needed = needed->next) {
2675 	    if (needed->obj != NULL) {
2676 		if (needed->obj->traced && !list_containers)
2677 		    continue;
2678 		needed->obj->traced = true;
2679 		path = needed->obj->path;
2680 	    } else
2681 		path = "not found";
2682 
2683 	    name = (char *)obj->strtab + needed->name;
2684 	    is_lib = strncmp(name, "lib", 3) == 0;	/* XXX - bogus */
2685 
2686 	    fmt = is_lib ? fmt1 : fmt2;
2687 	    while ((c = *fmt++) != '\0') {
2688 		switch (c) {
2689 		default:
2690 		    putchar(c);
2691 		    continue;
2692 		case '\\':
2693 		    switch (c = *fmt) {
2694 		    case '\0':
2695 			continue;
2696 		    case 'n':
2697 			putchar('\n');
2698 			break;
2699 		    case 't':
2700 			putchar('\t');
2701 			break;
2702 		    }
2703 		    break;
2704 		case '%':
2705 		    switch (c = *fmt) {
2706 		    case '\0':
2707 			continue;
2708 		    case '%':
2709 		    default:
2710 			putchar(c);
2711 			break;
2712 		    case 'A':
2713 			printf("%s", main_local);
2714 			break;
2715 		    case 'a':
2716 			printf("%s", obj_main->path);
2717 			break;
2718 		    case 'o':
2719 			printf("%s", name);
2720 			break;
2721 #if 0
2722 		    case 'm':
2723 			printf("%d", sodp->sod_major);
2724 			break;
2725 		    case 'n':
2726 			printf("%d", sodp->sod_minor);
2727 			break;
2728 #endif
2729 		    case 'p':
2730 			printf("%s", path);
2731 			break;
2732 		    case 'x':
2733 			printf("%p", needed->obj ? needed->obj->mapbase : 0);
2734 			break;
2735 		    }
2736 		    break;
2737 		}
2738 		++fmt;
2739 	    }
2740 	}
2741     }
2742 }
2743 
2744 /*
2745  * Unload a dlopened object and its dependencies from memory and from
2746  * our data structures.  It is assumed that the DAG rooted in the
2747  * object has already been unreferenced, and that the object has a
2748  * reference count of 0.
2749  */
2750 static void
2751 unload_object(Obj_Entry *root)
2752 {
2753     Obj_Entry *obj;
2754     Obj_Entry **linkp;
2755 
2756     assert(root->refcount == 0);
2757 
2758     /*
2759      * Pass over the DAG removing unreferenced objects from
2760      * appropriate lists.
2761      */
2762     unlink_object(root);
2763 
2764     /* Unmap all objects that are no longer referenced. */
2765     linkp = &obj_list->next;
2766     while ((obj = *linkp) != NULL) {
2767 	if (obj->refcount == 0) {
2768 	    LD_UTRACE(UTRACE_UNLOAD_OBJECT, obj, obj->mapbase, obj->mapsize, 0,
2769 		obj->path);
2770 	    dbg("unloading \"%s\"", obj->path);
2771 	    munmap(obj->mapbase, obj->mapsize);
2772 	    linkmap_delete(obj);
2773 	    *linkp = obj->next;
2774 	    obj_count--;
2775 	    obj_free(obj);
2776 	} else
2777 	    linkp = &obj->next;
2778     }
2779     obj_tail = linkp;
2780 }
2781 
2782 static void
2783 unlink_object(Obj_Entry *root)
2784 {
2785     Objlist_Entry *elm;
2786 
2787     if (root->refcount == 0) {
2788 	/* Remove the object from the RTLD_GLOBAL list. */
2789 	objlist_remove(&list_global, root);
2790 
2791     	/* Remove the object from all objects' DAG lists. */
2792     	STAILQ_FOREACH(elm, &root->dagmembers, link) {
2793 	    objlist_remove(&elm->obj->dldags, root);
2794 	    if (elm->obj != root)
2795 		unlink_object(elm->obj);
2796 	}
2797     }
2798 }
2799 
2800 static void
2801 ref_dag(Obj_Entry *root)
2802 {
2803     Objlist_Entry *elm;
2804 
2805     STAILQ_FOREACH(elm, &root->dagmembers, link)
2806 	elm->obj->refcount++;
2807 }
2808 
2809 static void
2810 unref_dag(Obj_Entry *root)
2811 {
2812     Objlist_Entry *elm;
2813 
2814     STAILQ_FOREACH(elm, &root->dagmembers, link)
2815 	elm->obj->refcount--;
2816 }
2817 
2818 /*
2819  * Common code for MD __tls_get_addr().
2820  */
2821 void *
2822 tls_get_addr_common(Elf_Addr** dtvp, int index, size_t offset)
2823 {
2824     Elf_Addr* dtv = *dtvp;
2825     int lockstate;
2826 
2827     /* Check dtv generation in case new modules have arrived */
2828     if (dtv[0] != tls_dtv_generation) {
2829 	Elf_Addr* newdtv;
2830 	int to_copy;
2831 
2832 	lockstate = wlock_acquire(rtld_bind_lock);
2833 	newdtv = calloc(1, (tls_max_index + 2) * sizeof(Elf_Addr));
2834 	to_copy = dtv[1];
2835 	if (to_copy > tls_max_index)
2836 	    to_copy = tls_max_index;
2837 	memcpy(&newdtv[2], &dtv[2], to_copy * sizeof(Elf_Addr));
2838 	newdtv[0] = tls_dtv_generation;
2839 	newdtv[1] = tls_max_index;
2840 	free(dtv);
2841 	wlock_release(rtld_bind_lock, lockstate);
2842 	*dtvp = newdtv;
2843     }
2844 
2845     /* Dynamically allocate module TLS if necessary */
2846     if (!dtv[index + 1]) {
2847 	/* Signal safe, wlock will block out signals. */
2848 	lockstate = wlock_acquire(rtld_bind_lock);
2849 	if (!dtv[index + 1])
2850 	    dtv[index + 1] = (Elf_Addr)allocate_module_tls(index);
2851 	wlock_release(rtld_bind_lock, lockstate);
2852     }
2853     return (void*) (dtv[index + 1] + offset);
2854 }
2855 
2856 /* XXX not sure what variants to use for arm. */
2857 
2858 #if defined(__ia64__) || defined(__powerpc__)
2859 
2860 /*
2861  * Allocate Static TLS using the Variant I method.
2862  */
2863 void *
2864 allocate_tls(Obj_Entry *objs, void *oldtcb, size_t tcbsize, size_t tcbalign)
2865 {
2866     Obj_Entry *obj;
2867     char *tcb;
2868     Elf_Addr **tls;
2869     Elf_Addr *dtv;
2870     Elf_Addr addr;
2871     int i;
2872 
2873     if (oldtcb != NULL && tcbsize == TLS_TCB_SIZE)
2874 	return (oldtcb);
2875 
2876     assert(tcbsize >= TLS_TCB_SIZE);
2877     tcb = calloc(1, tls_static_space - TLS_TCB_SIZE + tcbsize);
2878     tls = (Elf_Addr **)(tcb + tcbsize - TLS_TCB_SIZE);
2879 
2880     if (oldtcb != NULL) {
2881 	memcpy(tls, oldtcb, tls_static_space);
2882 	free(oldtcb);
2883 
2884 	/* Adjust the DTV. */
2885 	dtv = tls[0];
2886 	for (i = 0; i < dtv[1]; i++) {
2887 	    if (dtv[i+2] >= (Elf_Addr)oldtcb &&
2888 		dtv[i+2] < (Elf_Addr)oldtcb + tls_static_space) {
2889 		dtv[i+2] = dtv[i+2] - (Elf_Addr)oldtcb + (Elf_Addr)tls;
2890 	    }
2891 	}
2892     } else {
2893 	dtv = calloc(tls_max_index + 2, sizeof(Elf_Addr));
2894 	tls[0] = dtv;
2895 	dtv[0] = tls_dtv_generation;
2896 	dtv[1] = tls_max_index;
2897 
2898 	for (obj = objs; obj; obj = obj->next) {
2899 	    if (obj->tlsoffset) {
2900 		addr = (Elf_Addr)tls + obj->tlsoffset;
2901 		memset((void*) (addr + obj->tlsinitsize),
2902 		       0, obj->tlssize - obj->tlsinitsize);
2903 		if (obj->tlsinit)
2904 		    memcpy((void*) addr, obj->tlsinit,
2905 			   obj->tlsinitsize);
2906 		dtv[obj->tlsindex + 1] = addr;
2907 	    }
2908 	}
2909     }
2910 
2911     return (tcb);
2912 }
2913 
2914 void
2915 free_tls(void *tcb, size_t tcbsize, size_t tcbalign)
2916 {
2917     Elf_Addr *dtv;
2918     Elf_Addr tlsstart, tlsend;
2919     int dtvsize, i;
2920 
2921     assert(tcbsize >= TLS_TCB_SIZE);
2922 
2923     tlsstart = (Elf_Addr)tcb + tcbsize - TLS_TCB_SIZE;
2924     tlsend = tlsstart + tls_static_space;
2925 
2926     dtv = *(Elf_Addr **)tlsstart;
2927     dtvsize = dtv[1];
2928     for (i = 0; i < dtvsize; i++) {
2929 	if (dtv[i+2] && (dtv[i+2] < tlsstart || dtv[i+2] >= tlsend)) {
2930 	    free((void*)dtv[i+2]);
2931 	}
2932     }
2933     free(dtv);
2934     free(tcb);
2935 }
2936 
2937 #endif
2938 
2939 #if defined(__i386__) || defined(__amd64__) || defined(__sparc64__) || \
2940     defined(__arm__)
2941 
2942 /*
2943  * Allocate Static TLS using the Variant II method.
2944  */
2945 void *
2946 allocate_tls(Obj_Entry *objs, void *oldtls, size_t tcbsize, size_t tcbalign)
2947 {
2948     Obj_Entry *obj;
2949     size_t size;
2950     char *tls;
2951     Elf_Addr *dtv, *olddtv;
2952     Elf_Addr segbase, oldsegbase, addr;
2953     int i;
2954 
2955     size = round(tls_static_space, tcbalign);
2956 
2957     assert(tcbsize >= 2*sizeof(Elf_Addr));
2958     tls = calloc(1, size + tcbsize);
2959     dtv = calloc(1, (tls_max_index + 2) * sizeof(Elf_Addr));
2960 
2961     segbase = (Elf_Addr)(tls + size);
2962     ((Elf_Addr*)segbase)[0] = segbase;
2963     ((Elf_Addr*)segbase)[1] = (Elf_Addr) dtv;
2964 
2965     dtv[0] = tls_dtv_generation;
2966     dtv[1] = tls_max_index;
2967 
2968     if (oldtls) {
2969 	/*
2970 	 * Copy the static TLS block over whole.
2971 	 */
2972 	oldsegbase = (Elf_Addr) oldtls;
2973 	memcpy((void *)(segbase - tls_static_space),
2974 	       (const void *)(oldsegbase - tls_static_space),
2975 	       tls_static_space);
2976 
2977 	/*
2978 	 * If any dynamic TLS blocks have been created tls_get_addr(),
2979 	 * move them over.
2980 	 */
2981 	olddtv = ((Elf_Addr**)oldsegbase)[1];
2982 	for (i = 0; i < olddtv[1]; i++) {
2983 	    if (olddtv[i+2] < oldsegbase - size || olddtv[i+2] > oldsegbase) {
2984 		dtv[i+2] = olddtv[i+2];
2985 		olddtv[i+2] = 0;
2986 	    }
2987 	}
2988 
2989 	/*
2990 	 * We assume that this block was the one we created with
2991 	 * allocate_initial_tls().
2992 	 */
2993 	free_tls(oldtls, 2*sizeof(Elf_Addr), sizeof(Elf_Addr));
2994     } else {
2995 	for (obj = objs; obj; obj = obj->next) {
2996 	    if (obj->tlsoffset) {
2997 		addr = segbase - obj->tlsoffset;
2998 		memset((void*) (addr + obj->tlsinitsize),
2999 		       0, obj->tlssize - obj->tlsinitsize);
3000 		if (obj->tlsinit)
3001 		    memcpy((void*) addr, obj->tlsinit, obj->tlsinitsize);
3002 		dtv[obj->tlsindex + 1] = addr;
3003 	    }
3004 	}
3005     }
3006 
3007     return (void*) segbase;
3008 }
3009 
3010 void
3011 free_tls(void *tls, size_t tcbsize, size_t tcbalign)
3012 {
3013     size_t size;
3014     Elf_Addr* dtv;
3015     int dtvsize, i;
3016     Elf_Addr tlsstart, tlsend;
3017 
3018     /*
3019      * Figure out the size of the initial TLS block so that we can
3020      * find stuff which ___tls_get_addr() allocated dynamically.
3021      */
3022     size = round(tls_static_space, tcbalign);
3023 
3024     dtv = ((Elf_Addr**)tls)[1];
3025     dtvsize = dtv[1];
3026     tlsend = (Elf_Addr) tls;
3027     tlsstart = tlsend - size;
3028     for (i = 0; i < dtvsize; i++) {
3029 	if (dtv[i+2] && (dtv[i+2] < tlsstart || dtv[i+2] > tlsend)) {
3030 	    free((void*) dtv[i+2]);
3031 	}
3032     }
3033 
3034     free((void*) tlsstart);
3035     free((void*) dtv);
3036 }
3037 
3038 #endif
3039 
3040 /*
3041  * Allocate TLS block for module with given index.
3042  */
3043 void *
3044 allocate_module_tls(int index)
3045 {
3046     Obj_Entry* obj;
3047     char* p;
3048 
3049     for (obj = obj_list; obj; obj = obj->next) {
3050 	if (obj->tlsindex == index)
3051 	    break;
3052     }
3053     if (!obj) {
3054 	_rtld_error("Can't find module with TLS index %d", index);
3055 	die();
3056     }
3057 
3058     p = malloc(obj->tlssize);
3059     memcpy(p, obj->tlsinit, obj->tlsinitsize);
3060     memset(p + obj->tlsinitsize, 0, obj->tlssize - obj->tlsinitsize);
3061 
3062     return p;
3063 }
3064 
3065 bool
3066 allocate_tls_offset(Obj_Entry *obj)
3067 {
3068     size_t off;
3069 
3070     if (obj->tls_done)
3071 	return true;
3072 
3073     if (obj->tlssize == 0) {
3074 	obj->tls_done = true;
3075 	return true;
3076     }
3077 
3078     if (obj->tlsindex == 1)
3079 	off = calculate_first_tls_offset(obj->tlssize, obj->tlsalign);
3080     else
3081 	off = calculate_tls_offset(tls_last_offset, tls_last_size,
3082 				   obj->tlssize, obj->tlsalign);
3083 
3084     /*
3085      * If we have already fixed the size of the static TLS block, we
3086      * must stay within that size. When allocating the static TLS, we
3087      * leave a small amount of space spare to be used for dynamically
3088      * loading modules which use static TLS.
3089      */
3090     if (tls_static_space) {
3091 	if (calculate_tls_end(off, obj->tlssize) > tls_static_space)
3092 	    return false;
3093     }
3094 
3095     tls_last_offset = obj->tlsoffset = off;
3096     tls_last_size = obj->tlssize;
3097     obj->tls_done = true;
3098 
3099     return true;
3100 }
3101 
3102 void
3103 free_tls_offset(Obj_Entry *obj)
3104 {
3105 #if defined(__i386__) || defined(__amd64__) || defined(__sparc64__) || \
3106     defined(__arm__)
3107     /*
3108      * If we were the last thing to allocate out of the static TLS
3109      * block, we give our space back to the 'allocator'. This is a
3110      * simplistic workaround to allow libGL.so.1 to be loaded and
3111      * unloaded multiple times. We only handle the Variant II
3112      * mechanism for now - this really needs a proper allocator.
3113      */
3114     if (calculate_tls_end(obj->tlsoffset, obj->tlssize)
3115 	== calculate_tls_end(tls_last_offset, tls_last_size)) {
3116 	tls_last_offset -= obj->tlssize;
3117 	tls_last_size = 0;
3118     }
3119 #endif
3120 }
3121 
3122 void *
3123 _rtld_allocate_tls(void *oldtls, size_t tcbsize, size_t tcbalign)
3124 {
3125     void *ret;
3126     int lockstate;
3127 
3128     lockstate = wlock_acquire(rtld_bind_lock);
3129     ret = allocate_tls(obj_list, oldtls, tcbsize, tcbalign);
3130     wlock_release(rtld_bind_lock, lockstate);
3131     return (ret);
3132 }
3133 
3134 void
3135 _rtld_free_tls(void *tcb, size_t tcbsize, size_t tcbalign)
3136 {
3137     int lockstate;
3138 
3139     lockstate = wlock_acquire(rtld_bind_lock);
3140     free_tls(tcb, tcbsize, tcbalign);
3141     wlock_release(rtld_bind_lock, lockstate);
3142 }
3143 
3144 static void
3145 object_add_name(Obj_Entry *obj, const char *name)
3146 {
3147     Name_Entry *entry;
3148     size_t len;
3149 
3150     len = strlen(name);
3151     entry = malloc(sizeof(Name_Entry) + len);
3152 
3153     if (entry != NULL) {
3154 	strcpy(entry->name, name);
3155 	STAILQ_INSERT_TAIL(&obj->names, entry, link);
3156     }
3157 }
3158 
3159 static int
3160 object_match_name(const Obj_Entry *obj, const char *name)
3161 {
3162     Name_Entry *entry;
3163 
3164     STAILQ_FOREACH(entry, &obj->names, link) {
3165 	if (strcmp(name, entry->name) == 0)
3166 	    return (1);
3167     }
3168     return (0);
3169 }
3170 
3171 static Obj_Entry *
3172 locate_dependency(const Obj_Entry *obj, const char *name)
3173 {
3174     const Objlist_Entry *entry;
3175     const Needed_Entry *needed;
3176 
3177     STAILQ_FOREACH(entry, &list_main, link) {
3178 	if (object_match_name(entry->obj, name))
3179 	    return entry->obj;
3180     }
3181 
3182     for (needed = obj->needed;  needed != NULL;  needed = needed->next) {
3183 	if (needed->obj == NULL)
3184 	    continue;
3185 	if (object_match_name(needed->obj, name))
3186 	    return needed->obj;
3187     }
3188     _rtld_error("%s: Unexpected  inconsistency: dependency %s not found",
3189 	obj->path, name);
3190     die();
3191 }
3192 
3193 static int
3194 check_object_provided_version(Obj_Entry *refobj, const Obj_Entry *depobj,
3195     const Elf_Vernaux *vna)
3196 {
3197     const Elf_Verdef *vd;
3198     const char *vername;
3199 
3200     vername = refobj->strtab + vna->vna_name;
3201     vd = depobj->verdef;
3202     if (vd == NULL) {
3203 	_rtld_error("%s: version %s required by %s not defined",
3204 	    depobj->path, vername, refobj->path);
3205 	return (-1);
3206     }
3207     for (;;) {
3208 	if (vd->vd_version != VER_DEF_CURRENT) {
3209 	    _rtld_error("%s: Unsupported version %d of Elf_Verdef entry",
3210 		depobj->path, vd->vd_version);
3211 	    return (-1);
3212 	}
3213 	if (vna->vna_hash == vd->vd_hash) {
3214 	    const Elf_Verdaux *aux = (const Elf_Verdaux *)
3215 		((char *)vd + vd->vd_aux);
3216 	    if (strcmp(vername, depobj->strtab + aux->vda_name) == 0)
3217 		return (0);
3218 	}
3219 	if (vd->vd_next == 0)
3220 	    break;
3221 	vd = (const Elf_Verdef *) ((char *)vd + vd->vd_next);
3222     }
3223     if (vna->vna_flags & VER_FLG_WEAK)
3224 	return (0);
3225     _rtld_error("%s: version %s required by %s not found",
3226 	depobj->path, vername, refobj->path);
3227     return (-1);
3228 }
3229 
3230 static int
3231 rtld_verify_object_versions(Obj_Entry *obj)
3232 {
3233     const Elf_Verneed *vn;
3234     const Elf_Verdef  *vd;
3235     const Elf_Verdaux *vda;
3236     const Elf_Vernaux *vna;
3237     const Obj_Entry *depobj;
3238     int maxvernum, vernum;
3239 
3240     maxvernum = 0;
3241     /*
3242      * Walk over defined and required version records and figure out
3243      * max index used by any of them. Do very basic sanity checking
3244      * while there.
3245      */
3246     vn = obj->verneed;
3247     while (vn != NULL) {
3248 	if (vn->vn_version != VER_NEED_CURRENT) {
3249 	    _rtld_error("%s: Unsupported version %d of Elf_Verneed entry",
3250 		obj->path, vn->vn_version);
3251 	    return (-1);
3252 	}
3253 	vna = (const Elf_Vernaux *) ((char *)vn + vn->vn_aux);
3254 	for (;;) {
3255 	    vernum = VER_NEED_IDX(vna->vna_other);
3256 	    if (vernum > maxvernum)
3257 		maxvernum = vernum;
3258 	    if (vna->vna_next == 0)
3259 		 break;
3260 	    vna = (const Elf_Vernaux *) ((char *)vna + vna->vna_next);
3261 	}
3262 	if (vn->vn_next == 0)
3263 	    break;
3264 	vn = (const Elf_Verneed *) ((char *)vn + vn->vn_next);
3265     }
3266 
3267     vd = obj->verdef;
3268     while (vd != NULL) {
3269 	if (vd->vd_version != VER_DEF_CURRENT) {
3270 	    _rtld_error("%s: Unsupported version %d of Elf_Verdef entry",
3271 		obj->path, vd->vd_version);
3272 	    return (-1);
3273 	}
3274 	vernum = VER_DEF_IDX(vd->vd_ndx);
3275 	if (vernum > maxvernum)
3276 		maxvernum = vernum;
3277 	if (vd->vd_next == 0)
3278 	    break;
3279 	vd = (const Elf_Verdef *) ((char *)vd + vd->vd_next);
3280     }
3281 
3282     if (maxvernum == 0)
3283 	return (0);
3284 
3285     /*
3286      * Store version information in array indexable by version index.
3287      * Verify that object version requirements are satisfied along the
3288      * way.
3289      */
3290     obj->vernum = maxvernum + 1;
3291     obj->vertab = calloc(obj->vernum, sizeof(Ver_Entry));
3292 
3293     vd = obj->verdef;
3294     while (vd != NULL) {
3295 	if ((vd->vd_flags & VER_FLG_BASE) == 0) {
3296 	    vernum = VER_DEF_IDX(vd->vd_ndx);
3297 	    assert(vernum <= maxvernum);
3298 	    vda = (const Elf_Verdaux *)((char *)vd + vd->vd_aux);
3299 	    obj->vertab[vernum].hash = vd->vd_hash;
3300 	    obj->vertab[vernum].name = obj->strtab + vda->vda_name;
3301 	    obj->vertab[vernum].file = NULL;
3302 	    obj->vertab[vernum].flags = 0;
3303 	}
3304 	if (vd->vd_next == 0)
3305 	    break;
3306 	vd = (const Elf_Verdef *) ((char *)vd + vd->vd_next);
3307     }
3308 
3309     vn = obj->verneed;
3310     while (vn != NULL) {
3311 	depobj = locate_dependency(obj, obj->strtab + vn->vn_file);
3312 	vna = (const Elf_Vernaux *) ((char *)vn + vn->vn_aux);
3313 	for (;;) {
3314 	    if (check_object_provided_version(obj, depobj, vna))
3315 		return (-1);
3316 	    vernum = VER_NEED_IDX(vna->vna_other);
3317 	    assert(vernum <= maxvernum);
3318 	    obj->vertab[vernum].hash = vna->vna_hash;
3319 	    obj->vertab[vernum].name = obj->strtab + vna->vna_name;
3320 	    obj->vertab[vernum].file = obj->strtab + vn->vn_file;
3321 	    obj->vertab[vernum].flags = (vna->vna_other & VER_NEED_HIDDEN) ?
3322 		VER_INFO_HIDDEN : 0;
3323 	    if (vna->vna_next == 0)
3324 		 break;
3325 	    vna = (const Elf_Vernaux *) ((char *)vna + vna->vna_next);
3326 	}
3327 	if (vn->vn_next == 0)
3328 	    break;
3329 	vn = (const Elf_Verneed *) ((char *)vn + vn->vn_next);
3330     }
3331     return 0;
3332 }
3333 
3334 static int
3335 rtld_verify_versions(const Objlist *objlist)
3336 {
3337     Objlist_Entry *entry;
3338     int rc;
3339 
3340     rc = 0;
3341     STAILQ_FOREACH(entry, objlist, link) {
3342 	/*
3343 	 * Skip dummy objects or objects that have their version requirements
3344 	 * already checked.
3345 	 */
3346 	if (entry->obj->strtab == NULL || entry->obj->vertab != NULL)
3347 	    continue;
3348 	if (rtld_verify_object_versions(entry->obj) == -1) {
3349 	    rc = -1;
3350 	    if (ld_tracing == NULL)
3351 		break;
3352 	}
3353     }
3354     if (rc == 0 || ld_tracing != NULL)
3355     	rc = rtld_verify_object_versions(&obj_rtld);
3356     return rc;
3357 }
3358 
3359 const Ver_Entry *
3360 fetch_ventry(const Obj_Entry *obj, unsigned long symnum)
3361 {
3362     Elf_Versym vernum;
3363 
3364     if (obj->vertab) {
3365 	vernum = VER_NDX(obj->versyms[symnum]);
3366 	if (vernum >= obj->vernum) {
3367 	    _rtld_error("%s: symbol %s has wrong verneed value %d",
3368 		obj->path, obj->strtab + symnum, vernum);
3369 	} else if (obj->vertab[vernum].hash != 0) {
3370 	    return &obj->vertab[vernum];
3371 	}
3372     }
3373     return NULL;
3374 }
3375