xref: /freebsd/libexec/rtld-elf/rtld.c (revision 41466b50c1d5bfd1cf6adaae547a579a75d7c04e)
1 /*-
2  * Copyright 1996, 1997, 1998, 1999, 2000 John D. Polstra.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  *
25  * $FreeBSD$
26  */
27 
28 /*
29  * Dynamic linker for ELF.
30  *
31  * John Polstra <jdp@polstra.com>.
32  */
33 
34 #ifndef __GNUC__
35 #error "GCC is needed to compile this file"
36 #endif
37 
38 #include <sys/param.h>
39 #include <sys/mman.h>
40 #include <sys/stat.h>
41 
42 #include <dlfcn.h>
43 #include <err.h>
44 #include <errno.h>
45 #include <fcntl.h>
46 #include <stdarg.h>
47 #include <stdio.h>
48 #include <stdlib.h>
49 #include <string.h>
50 #include <unistd.h>
51 
52 #include "debug.h"
53 #include "rtld.h"
54 
55 #define END_SYM		"_end"
56 #define PATH_RTLD	"/usr/libexec/ld-elf.so.1"
57 
58 /* Types. */
59 typedef void (*func_ptr_type)();
60 
61 /*
62  * This structure provides a reentrant way to keep a list of objects and
63  * check which ones have already been processed in some way.
64  */
65 typedef struct Struct_DoneList {
66     const Obj_Entry **objs;		/* Array of object pointers */
67     unsigned int num_alloc;		/* Allocated size of the array */
68     unsigned int num_used;		/* Number of array slots used */
69 } DoneList;
70 
71 /*
72  * Function declarations.
73  */
74 static const char *basename(const char *);
75 static void die(void);
76 static void digest_dynamic(Obj_Entry *);
77 static Obj_Entry *digest_phdr(const Elf_Phdr *, int, caddr_t, const char *);
78 static Obj_Entry *dlcheck(void *);
79 static bool donelist_check(DoneList *, const Obj_Entry *);
80 static void errmsg_restore(char *);
81 static char *errmsg_save(void);
82 static char *find_library(const char *, const Obj_Entry *);
83 static const char *gethints(void);
84 static void init_dag(Obj_Entry *);
85 static void init_dag1(Obj_Entry *root, Obj_Entry *obj, DoneList *);
86 static void init_rtld(caddr_t);
87 static void initlist_add_neededs(Needed_Entry *needed, Objlist *list);
88 static void initlist_add_objects(Obj_Entry *obj, Obj_Entry **tail,
89   Objlist *list);
90 static bool is_exported(const Elf_Sym *);
91 static void linkmap_add(Obj_Entry *);
92 static void linkmap_delete(Obj_Entry *);
93 static int load_needed_objects(Obj_Entry *);
94 static int load_preload_objects(void);
95 static Obj_Entry *load_object(char *);
96 static void lock_check(void);
97 static Obj_Entry *obj_from_addr(const void *);
98 static void objlist_call_fini(Objlist *);
99 static void objlist_call_init(Objlist *);
100 static void objlist_clear(Objlist *);
101 static Objlist_Entry *objlist_find(Objlist *, const Obj_Entry *);
102 static void objlist_init(Objlist *);
103 static void objlist_push_head(Objlist *, Obj_Entry *);
104 static void objlist_push_tail(Objlist *, Obj_Entry *);
105 static void objlist_remove(Objlist *, Obj_Entry *);
106 static void objlist_remove_unref(Objlist *);
107 static int relocate_objects(Obj_Entry *, bool);
108 static void rtld_exit(void);
109 static char *search_library_path(const char *, const char *);
110 static void set_program_var(const char *, const void *);
111 static const Elf_Sym *symlook_default(const char *, unsigned long hash,
112   const Obj_Entry *refobj, const Obj_Entry **defobj_out, bool in_plt);
113 static const Elf_Sym *symlook_list(const char *, unsigned long,
114   Objlist *, const Obj_Entry **, bool in_plt, DoneList *);
115 static void trace_loaded_objects(Obj_Entry *obj);
116 static void unload_object(Obj_Entry *);
117 static void unref_dag(Obj_Entry *);
118 
119 void r_debug_state(struct r_debug*, struct link_map*);
120 void xprintf(const char *, ...);
121 
122 /*
123  * Data declarations.
124  */
125 static char *error_message;	/* Message for dlerror(), or NULL */
126 struct r_debug r_debug;	/* for GDB; */
127 static bool trust;		/* False for setuid and setgid programs */
128 static char *ld_bind_now;	/* Environment variable for immediate binding */
129 static char *ld_debug;		/* Environment variable for debugging */
130 static char *ld_library_path;	/* Environment variable for search path */
131 static char *ld_preload;	/* Environment variable for libraries to
132 				   load first */
133 static char *ld_tracing;	/* Called from ldd to print libs */
134 static Obj_Entry *obj_list;	/* Head of linked list of shared objects */
135 static Obj_Entry **obj_tail;	/* Link field of last object in list */
136 static Obj_Entry *obj_main;	/* The main program shared object */
137 static Obj_Entry obj_rtld;	/* The dynamic linker shared object */
138 static unsigned int obj_count;	/* Number of objects in obj_list */
139 
140 static Objlist list_global =	/* Objects dlopened with RTLD_GLOBAL */
141   STAILQ_HEAD_INITIALIZER(list_global);
142 static Objlist list_main =	/* Objects loaded at program startup */
143   STAILQ_HEAD_INITIALIZER(list_main);
144 static Objlist list_fini =	/* Objects needing fini() calls */
145   STAILQ_HEAD_INITIALIZER(list_fini);
146 
147 static LockInfo lockinfo;
148 
149 static Elf_Sym sym_zero;	/* For resolving undefined weak refs. */
150 
151 #define GDB_STATE(s,m)	r_debug.r_state = s; r_debug_state(&r_debug,m);
152 
153 extern Elf_Dyn _DYNAMIC;
154 #pragma weak _DYNAMIC
155 
156 /*
157  * These are the functions the dynamic linker exports to application
158  * programs.  They are the only symbols the dynamic linker is willing
159  * to export from itself.
160  */
161 static func_ptr_type exports[] = {
162     (func_ptr_type) &_rtld_error,
163     (func_ptr_type) &dlclose,
164     (func_ptr_type) &dlerror,
165     (func_ptr_type) &dlopen,
166     (func_ptr_type) &dlsym,
167     (func_ptr_type) &dladdr,
168     (func_ptr_type) &dllockinit,
169     NULL
170 };
171 
172 /*
173  * Global declarations normally provided by crt1.  The dynamic linker is
174  * not built with crt1, so we have to provide them ourselves.
175  */
176 char *__progname;
177 char **environ;
178 
179 /*
180  * Fill in a DoneList with an allocation large enough to hold all of
181  * the currently-loaded objects.  Keep this as a macro since it calls
182  * alloca and we want that to occur within the scope of the caller.
183  */
184 #define donelist_init(dlp)					\
185     ((dlp)->objs = alloca(obj_count * sizeof (dlp)->objs[0]),	\
186     assert((dlp)->objs != NULL),				\
187     (dlp)->num_alloc = obj_count,				\
188     (dlp)->num_used = 0)
189 
190 static __inline void
191 rlock_acquire(void)
192 {
193     lockinfo.rlock_acquire(lockinfo.thelock);
194     atomic_incr_int(&lockinfo.rcount);
195     lock_check();
196 }
197 
198 static __inline void
199 wlock_acquire(void)
200 {
201     lockinfo.wlock_acquire(lockinfo.thelock);
202     atomic_incr_int(&lockinfo.wcount);
203     lock_check();
204 }
205 
206 static __inline void
207 rlock_release(void)
208 {
209     atomic_decr_int(&lockinfo.rcount);
210     lockinfo.rlock_release(lockinfo.thelock);
211 }
212 
213 static __inline void
214 wlock_release(void)
215 {
216     atomic_decr_int(&lockinfo.wcount);
217     lockinfo.wlock_release(lockinfo.thelock);
218 }
219 
220 /*
221  * Main entry point for dynamic linking.  The first argument is the
222  * stack pointer.  The stack is expected to be laid out as described
223  * in the SVR4 ABI specification, Intel 386 Processor Supplement.
224  * Specifically, the stack pointer points to a word containing
225  * ARGC.  Following that in the stack is a null-terminated sequence
226  * of pointers to argument strings.  Then comes a null-terminated
227  * sequence of pointers to environment strings.  Finally, there is a
228  * sequence of "auxiliary vector" entries.
229  *
230  * The second argument points to a place to store the dynamic linker's
231  * exit procedure pointer and the third to a place to store the main
232  * program's object.
233  *
234  * The return value is the main program's entry point.
235  */
236 func_ptr_type
237 _rtld(Elf_Addr *sp, func_ptr_type *exit_proc, Obj_Entry **objp)
238 {
239     Elf_Auxinfo *aux_info[AT_COUNT];
240     int i;
241     int argc;
242     char **argv;
243     char **env;
244     Elf_Auxinfo *aux;
245     Elf_Auxinfo *auxp;
246     const char *argv0;
247     Obj_Entry *obj;
248     Obj_Entry **preload_tail;
249     Objlist initlist;
250 
251     /*
252      * On entry, the dynamic linker itself has not been relocated yet.
253      * Be very careful not to reference any global data until after
254      * init_rtld has returned.  It is OK to reference file-scope statics
255      * and string constants, and to call static and global functions.
256      */
257 
258     /* Find the auxiliary vector on the stack. */
259     argc = *sp++;
260     argv = (char **) sp;
261     sp += argc + 1;	/* Skip over arguments and NULL terminator */
262     env = (char **) sp;
263     while (*sp++ != 0)	/* Skip over environment, and NULL terminator */
264 	;
265     aux = (Elf_Auxinfo *) sp;
266 
267     /* Digest the auxiliary vector. */
268     for (i = 0;  i < AT_COUNT;  i++)
269 	aux_info[i] = NULL;
270     for (auxp = aux;  auxp->a_type != AT_NULL;  auxp++) {
271 	if (auxp->a_type < AT_COUNT)
272 	    aux_info[auxp->a_type] = auxp;
273     }
274 
275     /* Initialize and relocate ourselves. */
276     assert(aux_info[AT_BASE] != NULL);
277     init_rtld((caddr_t) aux_info[AT_BASE]->a_un.a_ptr);
278 
279     __progname = obj_rtld.path;
280     argv0 = argv[0] != NULL ? argv[0] : "(null)";
281     environ = env;
282 
283     trust = geteuid() == getuid() && getegid() == getgid();
284 
285     ld_bind_now = getenv("LD_BIND_NOW");
286     if (trust) {
287 	ld_debug = getenv("LD_DEBUG");
288 	ld_library_path = getenv("LD_LIBRARY_PATH");
289 	ld_preload = getenv("LD_PRELOAD");
290     }
291     ld_tracing = getenv("LD_TRACE_LOADED_OBJECTS");
292 
293     if (ld_debug != NULL && *ld_debug != '\0')
294 	debug = 1;
295     dbg("%s is initialized, base address = %p", __progname,
296 	(caddr_t) aux_info[AT_BASE]->a_un.a_ptr);
297     dbg("RTLD dynamic = %p", obj_rtld.dynamic);
298     dbg("RTLD pltgot  = %p", obj_rtld.pltgot);
299 
300     /*
301      * Load the main program, or process its program header if it is
302      * already loaded.
303      */
304     if (aux_info[AT_EXECFD] != NULL) {	/* Load the main program. */
305 	int fd = aux_info[AT_EXECFD]->a_un.a_val;
306 	dbg("loading main program");
307 	obj_main = map_object(fd, argv0, NULL);
308 	close(fd);
309 	if (obj_main == NULL)
310 	    die();
311     } else {				/* Main program already loaded. */
312 	const Elf_Phdr *phdr;
313 	int phnum;
314 	caddr_t entry;
315 
316 	dbg("processing main program's program header");
317 	assert(aux_info[AT_PHDR] != NULL);
318 	phdr = (const Elf_Phdr *) aux_info[AT_PHDR]->a_un.a_ptr;
319 	assert(aux_info[AT_PHNUM] != NULL);
320 	phnum = aux_info[AT_PHNUM]->a_un.a_val;
321 	assert(aux_info[AT_PHENT] != NULL);
322 	assert(aux_info[AT_PHENT]->a_un.a_val == sizeof(Elf_Phdr));
323 	assert(aux_info[AT_ENTRY] != NULL);
324 	entry = (caddr_t) aux_info[AT_ENTRY]->a_un.a_ptr;
325 	if ((obj_main = digest_phdr(phdr, phnum, entry, argv0)) == NULL)
326 	    die();
327     }
328 
329     obj_main->path = xstrdup(argv0);
330     obj_main->mainprog = true;
331 
332     /*
333      * Get the actual dynamic linker pathname from the executable if
334      * possible.  (It should always be possible.)  That ensures that
335      * gdb will find the right dynamic linker even if a non-standard
336      * one is being used.
337      */
338     if (obj_main->interp != NULL &&
339       strcmp(obj_main->interp, obj_rtld.path) != 0) {
340 	free(obj_rtld.path);
341 	obj_rtld.path = xstrdup(obj_main->interp);
342     }
343 
344     digest_dynamic(obj_main);
345 
346     linkmap_add(obj_main);
347     linkmap_add(&obj_rtld);
348 
349     /* Link the main program into the list of objects. */
350     *obj_tail = obj_main;
351     obj_tail = &obj_main->next;
352     obj_count++;
353     obj_main->refcount++;
354     /* Make sure we don't call the main program's init and fini functions. */
355     obj_main->init = obj_main->fini = NULL;
356 
357     /* Initialize a fake symbol for resolving undefined weak references. */
358     sym_zero.st_info = ELF_ST_INFO(STB_GLOBAL, STT_NOTYPE);
359     sym_zero.st_shndx = SHN_ABS;
360 
361     dbg("loading LD_PRELOAD libraries");
362     if (load_preload_objects() == -1)
363 	die();
364     preload_tail = obj_tail;
365 
366     dbg("loading needed objects");
367     if (load_needed_objects(obj_main) == -1)
368 	die();
369 
370     /* Make a list of all objects loaded at startup. */
371     for (obj = obj_list;  obj != NULL;  obj = obj->next)
372 	objlist_push_tail(&list_main, obj);
373 
374     if (ld_tracing) {		/* We're done */
375 	trace_loaded_objects(obj_main);
376 	exit(0);
377     }
378 
379     if (relocate_objects(obj_main,
380 	ld_bind_now != NULL && *ld_bind_now != '\0') == -1)
381 	die();
382 
383     dbg("doing copy relocations");
384     if (do_copy_relocations(obj_main) == -1)
385 	die();
386 
387     dbg("initializing key program variables");
388     set_program_var("__progname", argv[0] != NULL ? basename(argv[0]) : "");
389     set_program_var("environ", env);
390 
391     dbg("initializing thread locks");
392     lockdflt_init(&lockinfo);
393     lockinfo.thelock = lockinfo.lock_create(lockinfo.context);
394 
395     /* Make a list of init functions to call. */
396     objlist_init(&initlist);
397     initlist_add_objects(obj_list, preload_tail, &initlist);
398 
399     r_debug_state(NULL, &obj_main->linkmap); /* say hello to gdb! */
400 
401     objlist_call_init(&initlist);
402     wlock_acquire();
403     objlist_clear(&initlist);
404     wlock_release();
405 
406     dbg("transferring control to program entry point = %p", obj_main->entry);
407 
408     /* Return the exit procedure and the program entry point. */
409     *exit_proc = rtld_exit;
410     *objp = obj_main;
411     return (func_ptr_type) obj_main->entry;
412 }
413 
414 Elf_Addr
415 _rtld_bind(Obj_Entry *obj, Elf_Word reloff)
416 {
417     const Elf_Rel *rel;
418     const Elf_Sym *def;
419     const Obj_Entry *defobj;
420     Elf_Addr *where;
421     Elf_Addr target;
422 
423     rlock_acquire();
424     if (obj->pltrel)
425 	rel = (const Elf_Rel *) ((caddr_t) obj->pltrel + reloff);
426     else
427 	rel = (const Elf_Rel *) ((caddr_t) obj->pltrela + reloff);
428 
429     where = (Elf_Addr *) (obj->relocbase + rel->r_offset);
430     def = find_symdef(ELF_R_SYM(rel->r_info), obj, &defobj, true, NULL);
431     if (def == NULL)
432 	die();
433 
434     target = (Elf_Addr)(defobj->relocbase + def->st_value);
435 
436     dbg("\"%s\" in \"%s\" ==> %p in \"%s\"",
437       defobj->strtab + def->st_name, basename(obj->path),
438       (void *)target, basename(defobj->path));
439 
440     /*
441      * Write the new contents for the jmpslot. Note that depending on
442      * architecture, the value which we need to return back to the
443      * lazy binding trampoline may or may not be the target
444      * address. The value returned from reloc_jmpslot() is the value
445      * that the trampoline needs.
446      */
447     target = reloc_jmpslot(where, target, defobj);
448     rlock_release();
449     return target;
450 }
451 
452 /*
453  * Error reporting function.  Use it like printf.  If formats the message
454  * into a buffer, and sets things up so that the next call to dlerror()
455  * will return the message.
456  */
457 void
458 _rtld_error(const char *fmt, ...)
459 {
460     static char buf[512];
461     va_list ap;
462 
463     va_start(ap, fmt);
464     vsnprintf(buf, sizeof buf, fmt, ap);
465     error_message = buf;
466     va_end(ap);
467 }
468 
469 /*
470  * Return a dynamically-allocated copy of the current error message, if any.
471  */
472 static char *
473 errmsg_save(void)
474 {
475     return error_message == NULL ? NULL : xstrdup(error_message);
476 }
477 
478 /*
479  * Restore the current error message from a copy which was previously saved
480  * by errmsg_save().  The copy is freed.
481  */
482 static void
483 errmsg_restore(char *saved_msg)
484 {
485     if (saved_msg == NULL)
486 	error_message = NULL;
487     else {
488 	_rtld_error("%s", saved_msg);
489 	free(saved_msg);
490     }
491 }
492 
493 static const char *
494 basename(const char *name)
495 {
496     const char *p = strrchr(name, '/');
497     return p != NULL ? p + 1 : name;
498 }
499 
500 static void
501 die(void)
502 {
503     const char *msg = dlerror();
504 
505     if (msg == NULL)
506 	msg = "Fatal error";
507     errx(1, "%s", msg);
508 }
509 
510 /*
511  * Process a shared object's DYNAMIC section, and save the important
512  * information in its Obj_Entry structure.
513  */
514 static void
515 digest_dynamic(Obj_Entry *obj)
516 {
517     const Elf_Dyn *dynp;
518     Needed_Entry **needed_tail = &obj->needed;
519     const Elf_Dyn *dyn_rpath = NULL;
520     int plttype = DT_REL;
521 
522     for (dynp = obj->dynamic;  dynp->d_tag != DT_NULL;  dynp++) {
523 	switch (dynp->d_tag) {
524 
525 	case DT_REL:
526 	    obj->rel = (const Elf_Rel *) (obj->relocbase + dynp->d_un.d_ptr);
527 	    break;
528 
529 	case DT_RELSZ:
530 	    obj->relsize = dynp->d_un.d_val;
531 	    break;
532 
533 	case DT_RELENT:
534 	    assert(dynp->d_un.d_val == sizeof(Elf_Rel));
535 	    break;
536 
537 	case DT_JMPREL:
538 	    obj->pltrel = (const Elf_Rel *)
539 	      (obj->relocbase + dynp->d_un.d_ptr);
540 	    break;
541 
542 	case DT_PLTRELSZ:
543 	    obj->pltrelsize = dynp->d_un.d_val;
544 	    break;
545 
546 	case DT_RELA:
547 	    obj->rela = (const Elf_Rela *) (obj->relocbase + dynp->d_un.d_ptr);
548 	    break;
549 
550 	case DT_RELASZ:
551 	    obj->relasize = dynp->d_un.d_val;
552 	    break;
553 
554 	case DT_RELAENT:
555 	    assert(dynp->d_un.d_val == sizeof(Elf_Rela));
556 	    break;
557 
558 	case DT_PLTREL:
559 	    plttype = dynp->d_un.d_val;
560 	    assert(dynp->d_un.d_val == DT_REL || plttype == DT_RELA);
561 	    break;
562 
563 	case DT_SYMTAB:
564 	    obj->symtab = (const Elf_Sym *)
565 	      (obj->relocbase + dynp->d_un.d_ptr);
566 	    break;
567 
568 	case DT_SYMENT:
569 	    assert(dynp->d_un.d_val == sizeof(Elf_Sym));
570 	    break;
571 
572 	case DT_STRTAB:
573 	    obj->strtab = (const char *) (obj->relocbase + dynp->d_un.d_ptr);
574 	    break;
575 
576 	case DT_STRSZ:
577 	    obj->strsize = dynp->d_un.d_val;
578 	    break;
579 
580 	case DT_HASH:
581 	    {
582 		const Elf_Hashelt *hashtab = (const Elf_Hashelt *)
583 		  (obj->relocbase + dynp->d_un.d_ptr);
584 		obj->nbuckets = hashtab[0];
585 		obj->nchains = hashtab[1];
586 		obj->buckets = hashtab + 2;
587 		obj->chains = obj->buckets + obj->nbuckets;
588 	    }
589 	    break;
590 
591 	case DT_NEEDED:
592 	    if (!obj->rtld) {
593 		Needed_Entry *nep = NEW(Needed_Entry);
594 		nep->name = dynp->d_un.d_val;
595 		nep->obj = NULL;
596 		nep->next = NULL;
597 
598 		*needed_tail = nep;
599 		needed_tail = &nep->next;
600 	    }
601 	    break;
602 
603 	case DT_PLTGOT:
604 	    obj->pltgot = (Elf_Addr *) (obj->relocbase + dynp->d_un.d_ptr);
605 	    break;
606 
607 	case DT_TEXTREL:
608 	    obj->textrel = true;
609 	    break;
610 
611 	case DT_SYMBOLIC:
612 	    obj->symbolic = true;
613 	    break;
614 
615 	case DT_RPATH:
616 	    /*
617 	     * We have to wait until later to process this, because we
618 	     * might not have gotten the address of the string table yet.
619 	     */
620 	    dyn_rpath = dynp;
621 	    break;
622 
623 	case DT_SONAME:
624 	    /* Not used by the dynamic linker. */
625 	    break;
626 
627 	case DT_INIT:
628 	    obj->init = (Elf_Addr) (obj->relocbase + dynp->d_un.d_ptr);
629 	    break;
630 
631 	case DT_FINI:
632 	    obj->fini = (Elf_Addr) (obj->relocbase + dynp->d_un.d_ptr);
633 	    break;
634 
635 	case DT_DEBUG:
636 	    /* XXX - not implemented yet */
637 	    dbg("Filling in DT_DEBUG entry");
638 	    ((Elf_Dyn*)dynp)->d_un.d_ptr = (Elf_Addr) &r_debug;
639 	    break;
640 
641 	default:
642 	    dbg("Ignoring d_tag %ld = %#lx", (long)dynp->d_tag,
643 	        (long)dynp->d_tag);
644 	    break;
645 	}
646     }
647 
648     obj->traced = false;
649 
650     if (plttype == DT_RELA) {
651 	obj->pltrela = (const Elf_Rela *) obj->pltrel;
652 	obj->pltrel = NULL;
653 	obj->pltrelasize = obj->pltrelsize;
654 	obj->pltrelsize = 0;
655     }
656 
657     if (dyn_rpath != NULL)
658 	obj->rpath = obj->strtab + dyn_rpath->d_un.d_val;
659 }
660 
661 /*
662  * Process a shared object's program header.  This is used only for the
663  * main program, when the kernel has already loaded the main program
664  * into memory before calling the dynamic linker.  It creates and
665  * returns an Obj_Entry structure.
666  */
667 static Obj_Entry *
668 digest_phdr(const Elf_Phdr *phdr, int phnum, caddr_t entry, const char *path)
669 {
670     Obj_Entry *obj;
671     const Elf_Phdr *phlimit = phdr + phnum;
672     const Elf_Phdr *ph;
673     int nsegs = 0;
674 
675     obj = obj_new();
676     for (ph = phdr;  ph < phlimit;  ph++) {
677 	switch (ph->p_type) {
678 
679 	case PT_PHDR:
680 	    if ((const Elf_Phdr *)ph->p_vaddr != phdr) {
681 		_rtld_error("%s: invalid PT_PHDR", path);
682 		return NULL;
683 	    }
684 	    obj->phdr = (const Elf_Phdr *) ph->p_vaddr;
685 	    obj->phsize = ph->p_memsz;
686 	    break;
687 
688 	case PT_INTERP:
689 	    obj->interp = (const char *) ph->p_vaddr;
690 	    break;
691 
692 	case PT_LOAD:
693 	    if (nsegs >= 2) {
694 		_rtld_error("%s: too many PT_LOAD segments", path);
695 		return NULL;
696 	    }
697 	    if (nsegs == 0) {	/* First load segment */
698 		obj->vaddrbase = trunc_page(ph->p_vaddr);
699 		obj->mapbase = (caddr_t) obj->vaddrbase;
700 		obj->relocbase = obj->mapbase - obj->vaddrbase;
701 		obj->textsize = round_page(ph->p_vaddr + ph->p_memsz) -
702 		  obj->vaddrbase;
703 	    } else {		/* Last load segment */
704 		obj->mapsize = round_page(ph->p_vaddr + ph->p_memsz) -
705 		  obj->vaddrbase;
706 	    }
707 	    nsegs++;
708 	    break;
709 
710 	case PT_DYNAMIC:
711 	    obj->dynamic = (const Elf_Dyn *) ph->p_vaddr;
712 	    break;
713 	}
714     }
715     if (nsegs < 2) {
716 	_rtld_error("%s: too few PT_LOAD segments", path);
717 	return NULL;
718     }
719 
720     obj->entry = entry;
721     return obj;
722 }
723 
724 static Obj_Entry *
725 dlcheck(void *handle)
726 {
727     Obj_Entry *obj;
728 
729     for (obj = obj_list;  obj != NULL;  obj = obj->next)
730 	if (obj == (Obj_Entry *) handle)
731 	    break;
732 
733     if (obj == NULL || obj->refcount == 0 || obj->dl_refcount == 0) {
734 	_rtld_error("Invalid shared object handle %p", handle);
735 	return NULL;
736     }
737     return obj;
738 }
739 
740 /*
741  * If the given object is already in the donelist, return true.  Otherwise
742  * add the object to the list and return false.
743  */
744 static bool
745 donelist_check(DoneList *dlp, const Obj_Entry *obj)
746 {
747     unsigned int i;
748 
749     for (i = 0;  i < dlp->num_used;  i++)
750 	if (dlp->objs[i] == obj)
751 	    return true;
752     /*
753      * Our donelist allocation should always be sufficient.  But if
754      * our threads locking isn't working properly, more shared objects
755      * could have been loaded since we allocated the list.  That should
756      * never happen, but we'll handle it properly just in case it does.
757      */
758     if (dlp->num_used < dlp->num_alloc)
759 	dlp->objs[dlp->num_used++] = obj;
760     return false;
761 }
762 
763 /*
764  * Hash function for symbol table lookup.  Don't even think about changing
765  * this.  It is specified by the System V ABI.
766  */
767 unsigned long
768 elf_hash(const char *name)
769 {
770     const unsigned char *p = (const unsigned char *) name;
771     unsigned long h = 0;
772     unsigned long g;
773 
774     while (*p != '\0') {
775 	h = (h << 4) + *p++;
776 	if ((g = h & 0xf0000000) != 0)
777 	    h ^= g >> 24;
778 	h &= ~g;
779     }
780     return h;
781 }
782 
783 /*
784  * Find the library with the given name, and return its full pathname.
785  * The returned string is dynamically allocated.  Generates an error
786  * message and returns NULL if the library cannot be found.
787  *
788  * If the second argument is non-NULL, then it refers to an already-
789  * loaded shared object, whose library search path will be searched.
790  *
791  * The search order is:
792  *   rpath in the referencing file
793  *   LD_LIBRARY_PATH
794  *   ldconfig hints
795  *   /usr/lib
796  */
797 static char *
798 find_library(const char *name, const Obj_Entry *refobj)
799 {
800     char *pathname;
801 
802     if (strchr(name, '/') != NULL) {	/* Hard coded pathname */
803 	if (name[0] != '/' && !trust) {
804 	    _rtld_error("Absolute pathname required for shared object \"%s\"",
805 	      name);
806 	    return NULL;
807 	}
808 	return xstrdup(name);
809     }
810 
811     dbg(" Searching for \"%s\"", name);
812 
813     if ((refobj != NULL &&
814       (pathname = search_library_path(name, refobj->rpath)) != NULL) ||
815       (pathname = search_library_path(name, ld_library_path)) != NULL ||
816       (pathname = search_library_path(name, gethints())) != NULL ||
817       (pathname = search_library_path(name, STANDARD_LIBRARY_PATH)) != NULL)
818 	return pathname;
819 
820     _rtld_error("Shared object \"%s\" not found", name);
821     return NULL;
822 }
823 
824 /*
825  * Given a symbol number in a referencing object, find the corresponding
826  * definition of the symbol.  Returns a pointer to the symbol, or NULL if
827  * no definition was found.  Returns a pointer to the Obj_Entry of the
828  * defining object via the reference parameter DEFOBJ_OUT.
829  */
830 const Elf_Sym *
831 find_symdef(unsigned long symnum, const Obj_Entry *refobj,
832     const Obj_Entry **defobj_out, bool in_plt, SymCache *cache)
833 {
834     const Elf_Sym *ref;
835     const Elf_Sym *def;
836     const Obj_Entry *defobj;
837     const char *name;
838     unsigned long hash;
839 
840     /*
841      * If we have already found this symbol, get the information from
842      * the cache.
843      */
844     if (symnum >= refobj->nchains)
845 	return NULL;	/* Bad object */
846     if (cache != NULL && cache[symnum].sym != NULL) {
847 	*defobj_out = cache[symnum].obj;
848 	return cache[symnum].sym;
849     }
850 
851     ref = refobj->symtab + symnum;
852     name = refobj->strtab + ref->st_name;
853     hash = elf_hash(name);
854     defobj = NULL;
855 
856     def = symlook_default(name, hash, refobj, &defobj, in_plt);
857 
858     /*
859      * If we found no definition and the reference is weak, treat the
860      * symbol as having the value zero.
861      */
862     if (def == NULL && ELF_ST_BIND(ref->st_info) == STB_WEAK) {
863 	def = &sym_zero;
864 	defobj = obj_main;
865     }
866 
867     if (def != NULL) {
868 	*defobj_out = defobj;
869 	/* Record the information in the cache to avoid subsequent lookups. */
870 	if (cache != NULL) {
871 	    cache[symnum].sym = def;
872 	    cache[symnum].obj = defobj;
873 	}
874     } else {
875 	if (refobj != &obj_rtld)
876 	    _rtld_error("%s: Undefined symbol \"%s\"", refobj->path, name);
877     }
878     return def;
879 }
880 
881 /*
882  * Return the search path from the ldconfig hints file, reading it if
883  * necessary.  Returns NULL if there are problems with the hints file,
884  * or if the search path there is empty.
885  */
886 static const char *
887 gethints(void)
888 {
889     static char *hints;
890 
891     if (hints == NULL) {
892 	int fd;
893 	struct elfhints_hdr hdr;
894 	char *p;
895 
896 	/* Keep from trying again in case the hints file is bad. */
897 	hints = "";
898 
899 	if ((fd = open(_PATH_ELF_HINTS, O_RDONLY)) == -1)
900 	    return NULL;
901 	if (read(fd, &hdr, sizeof hdr) != sizeof hdr ||
902 	  hdr.magic != ELFHINTS_MAGIC ||
903 	  hdr.version != 1) {
904 	    close(fd);
905 	    return NULL;
906 	}
907 	p = xmalloc(hdr.dirlistlen + 1);
908 	if (lseek(fd, hdr.strtab + hdr.dirlist, SEEK_SET) == -1 ||
909 	  read(fd, p, hdr.dirlistlen + 1) != hdr.dirlistlen + 1) {
910 	    free(p);
911 	    close(fd);
912 	    return NULL;
913 	}
914 	hints = p;
915 	close(fd);
916     }
917     return hints[0] != '\0' ? hints : NULL;
918 }
919 
920 static void
921 init_dag(Obj_Entry *root)
922 {
923     DoneList donelist;
924 
925     donelist_init(&donelist);
926     init_dag1(root, root, &donelist);
927 }
928 
929 static void
930 init_dag1(Obj_Entry *root, Obj_Entry *obj, DoneList *dlp)
931 {
932     const Needed_Entry *needed;
933 
934     if (donelist_check(dlp, obj))
935 	return;
936     objlist_push_tail(&obj->dldags, root);
937     objlist_push_tail(&root->dagmembers, obj);
938     for (needed = obj->needed;  needed != NULL;  needed = needed->next)
939 	if (needed->obj != NULL)
940 	    init_dag1(root, needed->obj, dlp);
941 }
942 
943 /*
944  * Initialize the dynamic linker.  The argument is the address at which
945  * the dynamic linker has been mapped into memory.  The primary task of
946  * this function is to relocate the dynamic linker.
947  */
948 static void
949 init_rtld(caddr_t mapbase)
950 {
951     /*
952      * Conjure up an Obj_Entry structure for the dynamic linker.
953      *
954      * The "path" member is supposed to be dynamically-allocated, but we
955      * aren't yet initialized sufficiently to do that.  Below we will
956      * replace the static version with a dynamically-allocated copy.
957      */
958     obj_rtld.path = PATH_RTLD;
959     obj_rtld.rtld = true;
960     obj_rtld.mapbase = mapbase;
961 #ifdef PIC
962     obj_rtld.relocbase = mapbase;
963 #endif
964     if (&_DYNAMIC != 0) {
965 	obj_rtld.dynamic = rtld_dynamic(&obj_rtld);
966 	digest_dynamic(&obj_rtld);
967 	assert(obj_rtld.needed == NULL);
968 	assert(!obj_rtld.textrel);
969 
970 	/*
971 	 * Temporarily put the dynamic linker entry into the object list, so
972 	 * that symbols can be found.
973 	 */
974 	obj_list = &obj_rtld;
975 	obj_tail = &obj_rtld.next;
976 	obj_count = 1;
977 
978 	relocate_objects(&obj_rtld, true);
979     }
980 
981     /* Make the object list empty again. */
982     obj_list = NULL;
983     obj_tail = &obj_list;
984     obj_count = 0;
985 
986     /* Replace the path with a dynamically allocated copy. */
987     obj_rtld.path = xstrdup(obj_rtld.path);
988 
989     r_debug.r_brk = r_debug_state;
990     r_debug.r_state = RT_CONSISTENT;
991 }
992 
993 /*
994  * Add the init functions from a needed object list (and its recursive
995  * needed objects) to "list".  This is not used directly; it is a helper
996  * function for initlist_add_objects().  The write lock must be held
997  * when this function is called.
998  */
999 static void
1000 initlist_add_neededs(Needed_Entry *needed, Objlist *list)
1001 {
1002     /* Recursively process the successor needed objects. */
1003     if (needed->next != NULL)
1004 	initlist_add_neededs(needed->next, list);
1005 
1006     /* Process the current needed object. */
1007     if (needed->obj != NULL)
1008 	initlist_add_objects(needed->obj, &needed->obj->next, list);
1009 }
1010 
1011 /*
1012  * Scan all of the DAGs rooted in the range of objects from "obj" to
1013  * "tail" and add their init functions to "list".  This recurses over
1014  * the DAGs and ensure the proper init ordering such that each object's
1015  * needed libraries are initialized before the object itself.  At the
1016  * same time, this function adds the objects to the global finalization
1017  * list "list_fini" in the opposite order.  The write lock must be
1018  * held when this function is called.
1019  */
1020 static void
1021 initlist_add_objects(Obj_Entry *obj, Obj_Entry **tail, Objlist *list)
1022 {
1023     if (obj->init_done)
1024 	return;
1025     obj->init_done = true;
1026 
1027     /* Recursively process the successor objects. */
1028     if (&obj->next != tail)
1029 	initlist_add_objects(obj->next, tail, list);
1030 
1031     /* Recursively process the needed objects. */
1032     if (obj->needed != NULL)
1033 	initlist_add_neededs(obj->needed, list);
1034 
1035     /* Add the object to the init list. */
1036     if (obj->init != NULL)
1037 	objlist_push_tail(list, obj);
1038 
1039     /* Add the object to the global fini list in the reverse order. */
1040     if (obj->fini != NULL)
1041 	objlist_push_head(&list_fini, obj);
1042 }
1043 
1044 #ifndef FPTR_TARGET
1045 #define FPTR_TARGET(f)	((Elf_Addr) (f))
1046 #endif
1047 
1048 static bool
1049 is_exported(const Elf_Sym *def)
1050 {
1051     Elf_Addr value;
1052     const func_ptr_type *p;
1053 
1054     value = (Elf_Addr)(obj_rtld.relocbase + def->st_value);
1055     for (p = exports;  *p != NULL;  p++)
1056 	if (FPTR_TARGET(*p) == value)
1057 	    return true;
1058     return false;
1059 }
1060 
1061 /*
1062  * Given a shared object, traverse its list of needed objects, and load
1063  * each of them.  Returns 0 on success.  Generates an error message and
1064  * returns -1 on failure.
1065  */
1066 static int
1067 load_needed_objects(Obj_Entry *first)
1068 {
1069     Obj_Entry *obj;
1070 
1071     for (obj = first;  obj != NULL;  obj = obj->next) {
1072 	Needed_Entry *needed;
1073 
1074 	for (needed = obj->needed;  needed != NULL;  needed = needed->next) {
1075 	    const char *name = obj->strtab + needed->name;
1076 	    char *path = find_library(name, obj);
1077 
1078 	    needed->obj = NULL;
1079 	    if (path == NULL && !ld_tracing)
1080 		return -1;
1081 
1082 	    if (path) {
1083 		needed->obj = load_object(path);
1084 		if (needed->obj == NULL && !ld_tracing)
1085 		    return -1;		/* XXX - cleanup */
1086 	    }
1087 	}
1088     }
1089 
1090     return 0;
1091 }
1092 
1093 static int
1094 load_preload_objects(void)
1095 {
1096     char *p = ld_preload;
1097     static const char delim[] = " \t:;";
1098 
1099     if (p == NULL)
1100 	return NULL;
1101 
1102     p += strspn(p, delim);
1103     while (*p != '\0') {
1104 	size_t len = strcspn(p, delim);
1105 	char *path;
1106 	char savech;
1107 
1108 	savech = p[len];
1109 	p[len] = '\0';
1110 	if ((path = find_library(p, NULL)) == NULL)
1111 	    return -1;
1112 	if (load_object(path) == NULL)
1113 	    return -1;	/* XXX - cleanup */
1114 	p[len] = savech;
1115 	p += len;
1116 	p += strspn(p, delim);
1117     }
1118     return 0;
1119 }
1120 
1121 /*
1122  * Load a shared object into memory, if it is not already loaded.  The
1123  * argument must be a string allocated on the heap.  This function assumes
1124  * responsibility for freeing it when necessary.
1125  *
1126  * Returns a pointer to the Obj_Entry for the object.  Returns NULL
1127  * on failure.
1128  */
1129 static Obj_Entry *
1130 load_object(char *path)
1131 {
1132     Obj_Entry *obj;
1133     int fd = -1;
1134     struct stat sb;
1135 
1136     for (obj = obj_list->next;  obj != NULL;  obj = obj->next)
1137 	if (strcmp(obj->path, path) == 0)
1138 	    break;
1139 
1140     /*
1141      * If we didn't find a match by pathname, open the file and check
1142      * again by device and inode.  This avoids false mismatches caused
1143      * by multiple links or ".." in pathnames.
1144      *
1145      * To avoid a race, we open the file and use fstat() rather than
1146      * using stat().
1147      */
1148     if (obj == NULL) {
1149 	if ((fd = open(path, O_RDONLY)) == -1) {
1150 	    _rtld_error("Cannot open \"%s\"", path);
1151 	    return NULL;
1152 	}
1153 	if (fstat(fd, &sb) == -1) {
1154 	    _rtld_error("Cannot fstat \"%s\"", path);
1155 	    close(fd);
1156 	    return NULL;
1157 	}
1158 	for (obj = obj_list->next;  obj != NULL;  obj = obj->next) {
1159 	    if (obj->ino == sb.st_ino && obj->dev == sb.st_dev) {
1160 		close(fd);
1161 		break;
1162 	    }
1163 	}
1164     }
1165 
1166     if (obj == NULL) {	/* First use of this object, so we must map it in */
1167 	dbg("loading \"%s\"", path);
1168 	obj = map_object(fd, path, &sb);
1169 	close(fd);
1170 	if (obj == NULL) {
1171 	    free(path);
1172 	    return NULL;
1173 	}
1174 
1175 	obj->path = path;
1176 	digest_dynamic(obj);
1177 
1178 	*obj_tail = obj;
1179 	obj_tail = &obj->next;
1180 	obj_count++;
1181 	linkmap_add(obj);	/* for GDB */
1182 
1183 	dbg("  %p .. %p: %s", obj->mapbase,
1184 	  obj->mapbase + obj->mapsize - 1, obj->path);
1185 	if (obj->textrel)
1186 	    dbg("  WARNING: %s has impure text", obj->path);
1187     } else
1188 	free(path);
1189 
1190     obj->refcount++;
1191     return obj;
1192 }
1193 
1194 /*
1195  * Check for locking violations and die if one is found.
1196  */
1197 static void
1198 lock_check(void)
1199 {
1200     int rcount, wcount;
1201 
1202     rcount = lockinfo.rcount;
1203     wcount = lockinfo.wcount;
1204     assert(rcount >= 0);
1205     assert(wcount >= 0);
1206     if (wcount > 1 || (wcount != 0 && rcount != 0)) {
1207 	_rtld_error("Application locking error: %d readers and %d writers"
1208 	  " in dynamic linker.  See DLLOCKINIT(3) in manual pages.",
1209 	  rcount, wcount);
1210 	die();
1211     }
1212 }
1213 
1214 static Obj_Entry *
1215 obj_from_addr(const void *addr)
1216 {
1217     unsigned long endhash;
1218     Obj_Entry *obj;
1219 
1220     endhash = elf_hash(END_SYM);
1221     for (obj = obj_list;  obj != NULL;  obj = obj->next) {
1222 	const Elf_Sym *endsym;
1223 
1224 	if (addr < (void *) obj->mapbase)
1225 	    continue;
1226 	if ((endsym = symlook_obj(END_SYM, endhash, obj, true)) == NULL)
1227 	    continue;	/* No "end" symbol?! */
1228 	if (addr < (void *) (obj->relocbase + endsym->st_value))
1229 	    return obj;
1230     }
1231     return NULL;
1232 }
1233 
1234 /*
1235  * Call the finalization functions for each of the objects in "list"
1236  * which are unreferenced.  All of the objects are expected to have
1237  * non-NULL fini functions.
1238  */
1239 static void
1240 objlist_call_fini(Objlist *list)
1241 {
1242     Objlist_Entry *elm;
1243     char *saved_msg;
1244 
1245     /*
1246      * Preserve the current error message since a fini function might
1247      * call into the dynamic linker and overwrite it.
1248      */
1249     saved_msg = errmsg_save();
1250     STAILQ_FOREACH(elm, list, link) {
1251 	if (elm->obj->refcount == 0) {
1252 	    dbg("calling fini function for %s at %p", elm->obj->path,
1253 	        (void *)elm->obj->fini);
1254 	    call_initfini_pointer(elm->obj, elm->obj->fini);
1255 	}
1256     }
1257     errmsg_restore(saved_msg);
1258 }
1259 
1260 /*
1261  * Call the initialization functions for each of the objects in
1262  * "list".  All of the objects are expected to have non-NULL init
1263  * functions.
1264  */
1265 static void
1266 objlist_call_init(Objlist *list)
1267 {
1268     Objlist_Entry *elm;
1269     char *saved_msg;
1270 
1271     /*
1272      * Preserve the current error message since an init function might
1273      * call into the dynamic linker and overwrite it.
1274      */
1275     saved_msg = errmsg_save();
1276     STAILQ_FOREACH(elm, list, link) {
1277 	dbg("calling init function for %s at %p", elm->obj->path,
1278 	    (void *)elm->obj->init);
1279 	call_initfini_pointer(elm->obj, elm->obj->init);
1280     }
1281     errmsg_restore(saved_msg);
1282 }
1283 
1284 static void
1285 objlist_clear(Objlist *list)
1286 {
1287     Objlist_Entry *elm;
1288 
1289     while (!STAILQ_EMPTY(list)) {
1290 	elm = STAILQ_FIRST(list);
1291 	STAILQ_REMOVE_HEAD(list, link);
1292 	free(elm);
1293     }
1294 }
1295 
1296 static Objlist_Entry *
1297 objlist_find(Objlist *list, const Obj_Entry *obj)
1298 {
1299     Objlist_Entry *elm;
1300 
1301     STAILQ_FOREACH(elm, list, link)
1302 	if (elm->obj == obj)
1303 	    return elm;
1304     return NULL;
1305 }
1306 
1307 static void
1308 objlist_init(Objlist *list)
1309 {
1310     STAILQ_INIT(list);
1311 }
1312 
1313 static void
1314 objlist_push_head(Objlist *list, Obj_Entry *obj)
1315 {
1316     Objlist_Entry *elm;
1317 
1318     elm = NEW(Objlist_Entry);
1319     elm->obj = obj;
1320     STAILQ_INSERT_HEAD(list, elm, link);
1321 }
1322 
1323 static void
1324 objlist_push_tail(Objlist *list, Obj_Entry *obj)
1325 {
1326     Objlist_Entry *elm;
1327 
1328     elm = NEW(Objlist_Entry);
1329     elm->obj = obj;
1330     STAILQ_INSERT_TAIL(list, elm, link);
1331 }
1332 
1333 static void
1334 objlist_remove(Objlist *list, Obj_Entry *obj)
1335 {
1336     Objlist_Entry *elm;
1337 
1338     if ((elm = objlist_find(list, obj)) != NULL) {
1339 	STAILQ_REMOVE(list, elm, Struct_Objlist_Entry, link);
1340 	free(elm);
1341     }
1342 }
1343 
1344 /*
1345  * Remove all of the unreferenced objects from "list".
1346  */
1347 static void
1348 objlist_remove_unref(Objlist *list)
1349 {
1350     Objlist newlist;
1351     Objlist_Entry *elm;
1352 
1353     STAILQ_INIT(&newlist);
1354     while (!STAILQ_EMPTY(list)) {
1355 	elm = STAILQ_FIRST(list);
1356 	STAILQ_REMOVE_HEAD(list, link);
1357 	if (elm->obj->refcount == 0)
1358 	    free(elm);
1359 	else
1360 	    STAILQ_INSERT_TAIL(&newlist, elm, link);
1361     }
1362     *list = newlist;
1363 }
1364 
1365 /*
1366  * Relocate newly-loaded shared objects.  The argument is a pointer to
1367  * the Obj_Entry for the first such object.  All objects from the first
1368  * to the end of the list of objects are relocated.  Returns 0 on success,
1369  * or -1 on failure.
1370  */
1371 static int
1372 relocate_objects(Obj_Entry *first, bool bind_now)
1373 {
1374     Obj_Entry *obj;
1375 
1376     for (obj = first;  obj != NULL;  obj = obj->next) {
1377 	if (obj != &obj_rtld)
1378 	    dbg("relocating \"%s\"", obj->path);
1379 	if (obj->nbuckets == 0 || obj->nchains == 0 || obj->buckets == NULL ||
1380 	    obj->symtab == NULL || obj->strtab == NULL) {
1381 	    _rtld_error("%s: Shared object has no run-time symbol table",
1382 	      obj->path);
1383 	    return -1;
1384 	}
1385 
1386 	if (obj->textrel) {
1387 	    /* There are relocations to the write-protected text segment. */
1388 	    if (mprotect(obj->mapbase, obj->textsize,
1389 	      PROT_READ|PROT_WRITE|PROT_EXEC) == -1) {
1390 		_rtld_error("%s: Cannot write-enable text segment: %s",
1391 		  obj->path, strerror(errno));
1392 		return -1;
1393 	    }
1394 	}
1395 
1396 	/* Process the non-PLT relocations. */
1397 	if (reloc_non_plt(obj, &obj_rtld))
1398 		return -1;
1399 
1400 	if (obj->textrel) {	/* Re-protected the text segment. */
1401 	    if (mprotect(obj->mapbase, obj->textsize,
1402 	      PROT_READ|PROT_EXEC) == -1) {
1403 		_rtld_error("%s: Cannot write-protect text segment: %s",
1404 		  obj->path, strerror(errno));
1405 		return -1;
1406 	    }
1407 	}
1408 
1409 	/* Process the PLT relocations. */
1410 	if (reloc_plt(obj) == -1)
1411 	    return -1;
1412 	/* Relocate the jump slots if we are doing immediate binding. */
1413 	if (bind_now)
1414 	    if (reloc_jmpslots(obj) == -1)
1415 		return -1;
1416 
1417 
1418 	/*
1419 	 * Set up the magic number and version in the Obj_Entry.  These
1420 	 * were checked in the crt1.o from the original ElfKit, so we
1421 	 * set them for backward compatibility.
1422 	 */
1423 	obj->magic = RTLD_MAGIC;
1424 	obj->version = RTLD_VERSION;
1425 
1426 	/* Set the special PLT or GOT entries. */
1427 	init_pltgot(obj);
1428     }
1429 
1430     return 0;
1431 }
1432 
1433 /*
1434  * Cleanup procedure.  It will be called (by the atexit mechanism) just
1435  * before the process exits.
1436  */
1437 static void
1438 rtld_exit(void)
1439 {
1440     Obj_Entry *obj;
1441 
1442     dbg("rtld_exit()");
1443     wlock_acquire();
1444     /* Clear all the reference counts so the fini functions will be called. */
1445     for (obj = obj_list;  obj != NULL;  obj = obj->next)
1446 	obj->refcount = 0;
1447     wlock_release();
1448     objlist_call_fini(&list_fini);
1449     /* No need to remove the items from the list, since we are exiting. */
1450 }
1451 
1452 static char *
1453 search_library_path(const char *name, const char *path)
1454 {
1455     size_t namelen = strlen(name);
1456     const char *p = path;
1457 
1458     if (p == NULL)
1459 	return NULL;
1460 
1461     p += strspn(p, ":;");
1462     while (*p != '\0') {
1463 	size_t len = strcspn(p, ":;");
1464 
1465 	if (*p == '/' || trust) {
1466 	    char *pathname;
1467 	    const char *dir = p;
1468 	    size_t dirlen = len;
1469 
1470 	    pathname = xmalloc(dirlen + 1 + namelen + 1);
1471 	    strncpy(pathname, dir, dirlen);
1472 	    pathname[dirlen] = '/';
1473 	    strcpy(pathname + dirlen + 1, name);
1474 
1475 	    dbg("  Trying \"%s\"", pathname);
1476 	    if (access(pathname, F_OK) == 0)		/* We found it */
1477 		return pathname;
1478 
1479 	    free(pathname);
1480 	}
1481 	p += len;
1482 	p += strspn(p, ":;");
1483     }
1484 
1485     return NULL;
1486 }
1487 
1488 int
1489 dlclose(void *handle)
1490 {
1491     Obj_Entry *root;
1492 
1493     wlock_acquire();
1494     root = dlcheck(handle);
1495     if (root == NULL) {
1496 	wlock_release();
1497 	return -1;
1498     }
1499 
1500     /* Unreference the object and its dependencies. */
1501     root->dl_refcount--;
1502     unref_dag(root);
1503 
1504     if (root->refcount == 0) {
1505 	/*
1506 	 * The object is no longer referenced, so we must unload it.
1507 	 * First, call the fini functions with no locks held.
1508 	 */
1509 	wlock_release();
1510 	objlist_call_fini(&list_fini);
1511 	wlock_acquire();
1512 	objlist_remove_unref(&list_fini);
1513 
1514 	/* Finish cleaning up the newly-unreferenced objects. */
1515 	GDB_STATE(RT_DELETE,&root->linkmap);
1516 	unload_object(root);
1517 	GDB_STATE(RT_CONSISTENT,NULL);
1518     }
1519     wlock_release();
1520     return 0;
1521 }
1522 
1523 const char *
1524 dlerror(void)
1525 {
1526     char *msg = error_message;
1527     error_message = NULL;
1528     return msg;
1529 }
1530 
1531 /*
1532  * This function is deprecated and has no effect.
1533  */
1534 void
1535 dllockinit(void *context,
1536 	   void *(*lock_create)(void *context),
1537            void (*rlock_acquire)(void *lock),
1538            void (*wlock_acquire)(void *lock),
1539            void (*lock_release)(void *lock),
1540            void (*lock_destroy)(void *lock),
1541 	   void (*context_destroy)(void *context))
1542 {
1543     static void *cur_context;
1544     static void (*cur_context_destroy)(void *);
1545 
1546     /* Just destroy the context from the previous call, if necessary. */
1547     if (cur_context_destroy != NULL)
1548 	cur_context_destroy(cur_context);
1549     cur_context = context;
1550     cur_context_destroy = context_destroy;
1551 }
1552 
1553 void *
1554 dlopen(const char *name, int mode)
1555 {
1556     Obj_Entry **old_obj_tail;
1557     Obj_Entry *obj;
1558     Objlist initlist;
1559 
1560     objlist_init(&initlist);
1561 
1562     wlock_acquire();
1563     GDB_STATE(RT_ADD,NULL);
1564 
1565     old_obj_tail = obj_tail;
1566     obj = NULL;
1567     if (name == NULL) {
1568 	obj = obj_main;
1569 	obj->refcount++;
1570     } else {
1571 	char *path = find_library(name, obj_main);
1572 	if (path != NULL)
1573 	    obj = load_object(path);
1574     }
1575 
1576     if (obj) {
1577 	obj->dl_refcount++;
1578 	if (mode & RTLD_GLOBAL && objlist_find(&list_global, obj) == NULL)
1579 	    objlist_push_tail(&list_global, obj);
1580 	mode &= RTLD_MODEMASK;
1581 	if (*old_obj_tail != NULL) {		/* We loaded something new. */
1582 	    assert(*old_obj_tail == obj);
1583 
1584 	    if (load_needed_objects(obj) == -1 ||
1585 	      (init_dag(obj), relocate_objects(obj, mode == RTLD_NOW)) == -1) {
1586 		obj->dl_refcount--;
1587 		unref_dag(obj);
1588 		if (obj->refcount == 0)
1589 		    unload_object(obj);
1590 		obj = NULL;
1591 	    } else {
1592 		/* Make list of init functions to call. */
1593 		initlist_add_objects(obj, &obj->next, &initlist);
1594 	    }
1595 	}
1596     }
1597 
1598     GDB_STATE(RT_CONSISTENT,obj ? &obj->linkmap : NULL);
1599 
1600     /* Call the init functions with no locks held. */
1601     wlock_release();
1602     objlist_call_init(&initlist);
1603     wlock_acquire();
1604     objlist_clear(&initlist);
1605     wlock_release();
1606     return obj;
1607 }
1608 
1609 void *
1610 dlsym(void *handle, const char *name)
1611 {
1612     const Obj_Entry *obj;
1613     unsigned long hash;
1614     const Elf_Sym *def;
1615     const Obj_Entry *defobj;
1616 
1617     hash = elf_hash(name);
1618     def = NULL;
1619     defobj = NULL;
1620 
1621     rlock_acquire();
1622     if (handle == NULL || handle == RTLD_NEXT || handle == RTLD_DEFAULT) {
1623 	void *retaddr;
1624 
1625 	retaddr = __builtin_return_address(0);	/* __GNUC__ only */
1626 	if ((obj = obj_from_addr(retaddr)) == NULL) {
1627 	    _rtld_error("Cannot determine caller's shared object");
1628 	    rlock_release();
1629 	    return NULL;
1630 	}
1631 	if (handle == NULL) {	/* Just the caller's shared object. */
1632 	    def = symlook_obj(name, hash, obj, true);
1633 	    defobj = obj;
1634 	} else if (handle == RTLD_NEXT) {	/* Objects after caller's */
1635 	    while ((obj = obj->next) != NULL) {
1636 		if ((def = symlook_obj(name, hash, obj, true)) != NULL) {
1637 		    defobj = obj;
1638 		    break;
1639 		}
1640 	    }
1641 	} else {
1642 	    assert(handle == RTLD_DEFAULT);
1643 	    def = symlook_default(name, hash, obj, &defobj, true);
1644 	}
1645     } else {
1646 	if ((obj = dlcheck(handle)) == NULL) {
1647 	    rlock_release();
1648 	    return NULL;
1649 	}
1650 
1651 	if (obj->mainprog) {
1652 	    DoneList donelist;
1653 
1654 	    /* Search main program and all libraries loaded by it. */
1655 	    donelist_init(&donelist);
1656 	    def = symlook_list(name, hash, &list_main, &defobj, true,
1657 	      &donelist);
1658 	} else {
1659 	    /*
1660 	     * XXX - This isn't correct.  The search should include the whole
1661 	     * DAG rooted at the given object.
1662 	     */
1663 	    def = symlook_obj(name, hash, obj, true);
1664 	    defobj = obj;
1665 	}
1666     }
1667 
1668     if (def != NULL) {
1669 	rlock_release();
1670 
1671 	/*
1672 	 * The value required by the caller is derived from the value
1673 	 * of the symbol. For the ia64 architecture, we need to
1674 	 * construct a function descriptor which the caller can use to
1675 	 * call the function with the right 'gp' value. For other
1676 	 * architectures and for non-functions, the value is simply
1677 	 * the relocated value of the symbol.
1678 	 */
1679 	if (ELF_ST_TYPE(def->st_info) == STT_FUNC)
1680 	    return make_function_pointer(def, defobj);
1681 	else
1682 	    return defobj->relocbase + def->st_value;
1683     }
1684 
1685     _rtld_error("Undefined symbol \"%s\"", name);
1686     rlock_release();
1687     return NULL;
1688 }
1689 
1690 int
1691 dladdr(const void *addr, Dl_info *info)
1692 {
1693     const Obj_Entry *obj;
1694     const Elf_Sym *def;
1695     void *symbol_addr;
1696     unsigned long symoffset;
1697 
1698     rlock_acquire();
1699     obj = obj_from_addr(addr);
1700     if (obj == NULL) {
1701         _rtld_error("No shared object contains address");
1702 	rlock_release();
1703         return 0;
1704     }
1705     info->dli_fname = obj->path;
1706     info->dli_fbase = obj->mapbase;
1707     info->dli_saddr = (void *)0;
1708     info->dli_sname = NULL;
1709 
1710     /*
1711      * Walk the symbol list looking for the symbol whose address is
1712      * closest to the address sent in.
1713      */
1714     for (symoffset = 0; symoffset < obj->nchains; symoffset++) {
1715         def = obj->symtab + symoffset;
1716 
1717         /*
1718          * For skip the symbol if st_shndx is either SHN_UNDEF or
1719          * SHN_COMMON.
1720          */
1721         if (def->st_shndx == SHN_UNDEF || def->st_shndx == SHN_COMMON)
1722             continue;
1723 
1724         /*
1725          * If the symbol is greater than the specified address, or if it
1726          * is further away from addr than the current nearest symbol,
1727          * then reject it.
1728          */
1729         symbol_addr = obj->relocbase + def->st_value;
1730         if (symbol_addr > addr || symbol_addr < info->dli_saddr)
1731             continue;
1732 
1733         /* Update our idea of the nearest symbol. */
1734         info->dli_sname = obj->strtab + def->st_name;
1735         info->dli_saddr = symbol_addr;
1736 
1737         /* Exact match? */
1738         if (info->dli_saddr == addr)
1739             break;
1740     }
1741     rlock_release();
1742     return 1;
1743 }
1744 
1745 static void
1746 linkmap_add(Obj_Entry *obj)
1747 {
1748     struct link_map *l = &obj->linkmap;
1749     struct link_map *prev;
1750 
1751     obj->linkmap.l_name = obj->path;
1752     obj->linkmap.l_addr = obj->mapbase;
1753     obj->linkmap.l_ld = obj->dynamic;
1754 #ifdef __mips__
1755     /* GDB needs load offset on MIPS to use the symbols */
1756     obj->linkmap.l_offs = obj->relocbase;
1757 #endif
1758 
1759     if (r_debug.r_map == NULL) {
1760 	r_debug.r_map = l;
1761 	return;
1762     }
1763 
1764     /*
1765      * Scan to the end of the list, but not past the entry for the
1766      * dynamic linker, which we want to keep at the very end.
1767      */
1768     for (prev = r_debug.r_map;
1769       prev->l_next != NULL && prev->l_next != &obj_rtld.linkmap;
1770       prev = prev->l_next)
1771 	;
1772 
1773     /* Link in the new entry. */
1774     l->l_prev = prev;
1775     l->l_next = prev->l_next;
1776     if (l->l_next != NULL)
1777 	l->l_next->l_prev = l;
1778     prev->l_next = l;
1779 }
1780 
1781 static void
1782 linkmap_delete(Obj_Entry *obj)
1783 {
1784     struct link_map *l = &obj->linkmap;
1785 
1786     if (l->l_prev == NULL) {
1787 	if ((r_debug.r_map = l->l_next) != NULL)
1788 	    l->l_next->l_prev = NULL;
1789 	return;
1790     }
1791 
1792     if ((l->l_prev->l_next = l->l_next) != NULL)
1793 	l->l_next->l_prev = l->l_prev;
1794 }
1795 
1796 /*
1797  * Function for the debugger to set a breakpoint on to gain control.
1798  *
1799  * The two parameters allow the debugger to easily find and determine
1800  * what the runtime loader is doing and to whom it is doing it.
1801  *
1802  * When the loadhook trap is hit (r_debug_state, set at program
1803  * initialization), the arguments can be found on the stack:
1804  *
1805  *  +8   struct link_map *m
1806  *  +4   struct r_debug  *rd
1807  *  +0   RetAddr
1808  */
1809 void
1810 r_debug_state(struct r_debug* rd, struct link_map *m)
1811 {
1812 }
1813 
1814 /*
1815  * Set a pointer variable in the main program to the given value.  This
1816  * is used to set key variables such as "environ" before any of the
1817  * init functions are called.
1818  */
1819 static void
1820 set_program_var(const char *name, const void *value)
1821 {
1822     const Obj_Entry *obj;
1823     unsigned long hash;
1824 
1825     hash = elf_hash(name);
1826     for (obj = obj_main;  obj != NULL;  obj = obj->next) {
1827 	const Elf_Sym *def;
1828 
1829 	if ((def = symlook_obj(name, hash, obj, false)) != NULL) {
1830 	    const void **addr;
1831 
1832 	    addr = (const void **)(obj->relocbase + def->st_value);
1833 	    dbg("\"%s\": *%p <-- %p", name, addr, value);
1834 	    *addr = value;
1835 	    break;
1836 	}
1837     }
1838 }
1839 
1840 /*
1841  * Given a symbol name in a referencing object, find the corresponding
1842  * definition of the symbol.  Returns a pointer to the symbol, or NULL if
1843  * no definition was found.  Returns a pointer to the Obj_Entry of the
1844  * defining object via the reference parameter DEFOBJ_OUT.
1845  */
1846 static const Elf_Sym *
1847 symlook_default(const char *name, unsigned long hash,
1848     const Obj_Entry *refobj, const Obj_Entry **defobj_out, bool in_plt)
1849 {
1850     DoneList donelist;
1851     const Elf_Sym *def;
1852     const Elf_Sym *symp;
1853     const Obj_Entry *obj;
1854     const Obj_Entry *defobj;
1855     const Objlist_Entry *elm;
1856     def = NULL;
1857     defobj = NULL;
1858     donelist_init(&donelist);
1859 
1860     /* Look first in the referencing object if linked symbolically. */
1861     if (refobj->symbolic && !donelist_check(&donelist, refobj)) {
1862 	symp = symlook_obj(name, hash, refobj, in_plt);
1863 	if (symp != NULL) {
1864 	    def = symp;
1865 	    defobj = refobj;
1866 	}
1867     }
1868 
1869     /* Search all objects loaded at program start up. */
1870     if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) {
1871 	symp = symlook_list(name, hash, &list_main, &obj, in_plt, &donelist);
1872 	if (symp != NULL &&
1873 	  (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) {
1874 	    def = symp;
1875 	    defobj = obj;
1876 	}
1877     }
1878 
1879     /* Search all dlopened DAGs containing the referencing object. */
1880     STAILQ_FOREACH(elm, &refobj->dldags, link) {
1881 	if (def != NULL && ELF_ST_BIND(def->st_info) != STB_WEAK)
1882 	    break;
1883 	symp = symlook_list(name, hash, &elm->obj->dagmembers, &obj, in_plt,
1884 	  &donelist);
1885 	if (symp != NULL &&
1886 	  (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) {
1887 	    def = symp;
1888 	    defobj = obj;
1889 	}
1890     }
1891 
1892     /* Search all RTLD_GLOBAL objects. */
1893     if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) {
1894 	symp = symlook_list(name, hash, &list_global, &obj, in_plt, &donelist);
1895 	if (symp != NULL &&
1896 	  (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) {
1897 	    def = symp;
1898 	    defobj = obj;
1899 	}
1900     }
1901 
1902     /*
1903      * Search the dynamic linker itself, and possibly resolve the
1904      * symbol from there.  This is how the application links to
1905      * dynamic linker services such as dlopen.  Only the values listed
1906      * in the "exports" array can be resolved from the dynamic linker.
1907      */
1908     if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) {
1909 	symp = symlook_obj(name, hash, &obj_rtld, in_plt);
1910 	if (symp != NULL && is_exported(symp)) {
1911 	    def = symp;
1912 	    defobj = &obj_rtld;
1913 	}
1914     }
1915 
1916     if (def != NULL)
1917 	*defobj_out = defobj;
1918     return def;
1919 }
1920 
1921 static const Elf_Sym *
1922 symlook_list(const char *name, unsigned long hash, Objlist *objlist,
1923   const Obj_Entry **defobj_out, bool in_plt, DoneList *dlp)
1924 {
1925     const Elf_Sym *symp;
1926     const Elf_Sym *def;
1927     const Obj_Entry *defobj;
1928     const Objlist_Entry *elm;
1929 
1930     def = NULL;
1931     defobj = NULL;
1932     STAILQ_FOREACH(elm, objlist, link) {
1933 	if (donelist_check(dlp, elm->obj))
1934 	    continue;
1935 	if ((symp = symlook_obj(name, hash, elm->obj, in_plt)) != NULL) {
1936 	    if (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK) {
1937 		def = symp;
1938 		defobj = elm->obj;
1939 		if (ELF_ST_BIND(def->st_info) != STB_WEAK)
1940 		    break;
1941 	    }
1942 	}
1943     }
1944     if (def != NULL)
1945 	*defobj_out = defobj;
1946     return def;
1947 }
1948 
1949 /*
1950  * Search the symbol table of a single shared object for a symbol of
1951  * the given name.  Returns a pointer to the symbol, or NULL if no
1952  * definition was found.
1953  *
1954  * The symbol's hash value is passed in for efficiency reasons; that
1955  * eliminates many recomputations of the hash value.
1956  */
1957 const Elf_Sym *
1958 symlook_obj(const char *name, unsigned long hash, const Obj_Entry *obj,
1959   bool in_plt)
1960 {
1961     if (obj->buckets != NULL) {
1962 	unsigned long symnum = obj->buckets[hash % obj->nbuckets];
1963 
1964 	while (symnum != STN_UNDEF) {
1965 	    const Elf_Sym *symp;
1966 	    const char *strp;
1967 
1968 	    if (symnum >= obj->nchains)
1969 		return NULL;	/* Bad object */
1970 	    symp = obj->symtab + symnum;
1971 	    strp = obj->strtab + symp->st_name;
1972 
1973 	    if (name[0] == strp[0] && strcmp(name, strp) == 0)
1974 		return symp->st_shndx != SHN_UNDEF ||
1975 		  (!in_plt && symp->st_value != 0 &&
1976 		  ELF_ST_TYPE(symp->st_info) == STT_FUNC) ? symp : NULL;
1977 
1978 	    symnum = obj->chains[symnum];
1979 	}
1980     }
1981     return NULL;
1982 }
1983 
1984 static void
1985 trace_loaded_objects(Obj_Entry *obj)
1986 {
1987     char	*fmt1, *fmt2, *fmt, *main_local;
1988     int		c;
1989 
1990     if ((main_local = getenv("LD_TRACE_LOADED_OBJECTS_PROGNAME")) == NULL)
1991 	main_local = "";
1992 
1993     if ((fmt1 = getenv("LD_TRACE_LOADED_OBJECTS_FMT1")) == NULL)
1994 	fmt1 = "\t%o => %p (%x)\n";
1995 
1996     if ((fmt2 = getenv("LD_TRACE_LOADED_OBJECTS_FMT2")) == NULL)
1997 	fmt2 = "\t%o (%x)\n";
1998 
1999     for (; obj; obj = obj->next) {
2000 	Needed_Entry		*needed;
2001 	char			*name, *path;
2002 	bool			is_lib;
2003 
2004 	for (needed = obj->needed; needed; needed = needed->next) {
2005 	    if (needed->obj != NULL) {
2006 		if (needed->obj->traced)
2007 		    continue;
2008 		needed->obj->traced = true;
2009 		path = needed->obj->path;
2010 	    } else
2011 		path = "not found";
2012 
2013 	    name = (char *)obj->strtab + needed->name;
2014 	    is_lib = strncmp(name, "lib", 3) == 0;	/* XXX - bogus */
2015 
2016 	    fmt = is_lib ? fmt1 : fmt2;
2017 	    while ((c = *fmt++) != '\0') {
2018 		switch (c) {
2019 		default:
2020 		    putchar(c);
2021 		    continue;
2022 		case '\\':
2023 		    switch (c = *fmt) {
2024 		    case '\0':
2025 			continue;
2026 		    case 'n':
2027 			putchar('\n');
2028 			break;
2029 		    case 't':
2030 			putchar('\t');
2031 			break;
2032 		    }
2033 		    break;
2034 		case '%':
2035 		    switch (c = *fmt) {
2036 		    case '\0':
2037 			continue;
2038 		    case '%':
2039 		    default:
2040 			putchar(c);
2041 			break;
2042 		    case 'A':
2043 			printf("%s", main_local);
2044 			break;
2045 		    case 'a':
2046 			printf("%s", obj_main->path);
2047 			break;
2048 		    case 'o':
2049 			printf("%s", name);
2050 			break;
2051 #if 0
2052 		    case 'm':
2053 			printf("%d", sodp->sod_major);
2054 			break;
2055 		    case 'n':
2056 			printf("%d", sodp->sod_minor);
2057 			break;
2058 #endif
2059 		    case 'p':
2060 			printf("%s", path);
2061 			break;
2062 		    case 'x':
2063 			printf("%p", needed->obj ? needed->obj->mapbase : 0);
2064 			break;
2065 		    }
2066 		    break;
2067 		}
2068 		++fmt;
2069 	    }
2070 	}
2071     }
2072 }
2073 
2074 /*
2075  * Unload a dlopened object and its dependencies from memory and from
2076  * our data structures.  It is assumed that the DAG rooted in the
2077  * object has already been unreferenced, and that the object has a
2078  * reference count of 0.
2079  */
2080 static void
2081 unload_object(Obj_Entry *root)
2082 {
2083     Obj_Entry *obj;
2084     Obj_Entry **linkp;
2085     Objlist_Entry *elm;
2086 
2087     assert(root->refcount == 0);
2088 
2089     /* Remove the DAG from all objects' DAG lists. */
2090     STAILQ_FOREACH(elm, &root->dagmembers , link)
2091 	objlist_remove(&elm->obj->dldags, root);
2092 
2093     /* Remove the DAG from the RTLD_GLOBAL list. */
2094     objlist_remove(&list_global, root);
2095 
2096     /* Unmap all objects that are no longer referenced. */
2097     linkp = &obj_list->next;
2098     while ((obj = *linkp) != NULL) {
2099 	if (obj->refcount == 0) {
2100 	    dbg("unloading \"%s\"", obj->path);
2101 	    munmap(obj->mapbase, obj->mapsize);
2102 	    linkmap_delete(obj);
2103 	    *linkp = obj->next;
2104 	    obj_count--;
2105 	    obj_free(obj);
2106 	} else
2107 	    linkp = &obj->next;
2108     }
2109     obj_tail = linkp;
2110 }
2111 
2112 static void
2113 unref_dag(Obj_Entry *root)
2114 {
2115     const Needed_Entry *needed;
2116 
2117     if (root->refcount == 0)
2118 	return;
2119     root->refcount--;
2120     if (root->refcount == 0)
2121 	for (needed = root->needed;  needed != NULL;  needed = needed->next)
2122 	    if (needed->obj != NULL)
2123 		unref_dag(needed->obj);
2124 }
2125 
2126 /*
2127  * Non-mallocing printf, for use by malloc itself.
2128  * XXX - This doesn't belong in this module.
2129  */
2130 void
2131 xprintf(const char *fmt, ...)
2132 {
2133     char buf[256];
2134     va_list ap;
2135 
2136     va_start(ap, fmt);
2137     vsprintf(buf, fmt, ap);
2138     (void)write(STDOUT_FILENO, buf, strlen(buf));
2139     va_end(ap);
2140 }
2141