27 */
28
29/*
30 * Dynamic linker for ELF.
31 *
32 * John Polstra <jdp@polstra.com>.
33 */
34
35#ifndef __GNUC__
36#error "GCC is needed to compile this file"
37#endif
38
39#include <sys/param.h>
40#include <sys/mount.h>
41#include <sys/mman.h>
42#include <sys/stat.h>
43#include <sys/uio.h>
44#include <sys/utsname.h>
45#include <sys/ktrace.h>
46
47#include <dlfcn.h>
48#include <err.h>
49#include <errno.h>
50#include <fcntl.h>
51#include <stdarg.h>
52#include <stdio.h>
53#include <stdlib.h>
54#include <string.h>
55#include <unistd.h>
56
57#include "debug.h"
58#include "rtld.h"
59#include "libmap.h"
60#include "rtld_tls.h"
61
62#ifndef COMPAT_32BIT
63#define PATH_RTLD "/libexec/ld-elf.so.1"
64#else
65#define PATH_RTLD "/libexec/ld-elf32.so.1"
66#endif
67
68/* Types. */
69typedef void (*func_ptr_type)();
70typedef void * (*path_enum_proc) (const char *path, size_t len, void *arg);
71
72/*
73 * This structure provides a reentrant way to keep a list of objects and
74 * check which ones have already been processed in some way.
75 */
76typedef struct Struct_DoneList {
77 const Obj_Entry **objs; /* Array of object pointers */
78 unsigned int num_alloc; /* Allocated size of the array */
79 unsigned int num_used; /* Number of array slots used */
80} DoneList;
81
82/*
83 * Function declarations.
84 */
85static const char *basename(const char *);
86static void die(void) __dead2;
87static void digest_dynamic(Obj_Entry *, int);
88static Obj_Entry *digest_phdr(const Elf_Phdr *, int, caddr_t, const char *);
89static Obj_Entry *dlcheck(void *);
90static Obj_Entry *do_load_object(int, const char *, char *, struct stat *, int);
91static int do_search_info(const Obj_Entry *obj, int, struct dl_serinfo *);
92static bool donelist_check(DoneList *, const Obj_Entry *);
93static void errmsg_restore(char *);
94static char *errmsg_save(void);
95static void *fill_search_info(const char *, size_t, void *);
96static char *find_library(const char *, const Obj_Entry *);
97static const char *gethints(void);
98static void init_dag(Obj_Entry *);
99static void init_dag1(Obj_Entry *, Obj_Entry *, DoneList *);
100static void init_rtld(caddr_t);
101static void initlist_add_neededs(Needed_Entry *, Objlist *);
102static void initlist_add_objects(Obj_Entry *, Obj_Entry **, Objlist *);
103static bool is_exported(const Elf_Sym *);
104static void linkmap_add(Obj_Entry *);
105static void linkmap_delete(Obj_Entry *);
106static int load_needed_objects(Obj_Entry *, int);
107static int load_preload_objects(void);
108static Obj_Entry *load_object(const char *, const Obj_Entry *, int);
109static Obj_Entry *obj_from_addr(const void *);
110static void objlist_call_fini(Objlist *, bool, int *);
111static void objlist_call_init(Objlist *, int *);
112static void objlist_clear(Objlist *);
113static Objlist_Entry *objlist_find(Objlist *, const Obj_Entry *);
114static void objlist_init(Objlist *);
115static void objlist_push_head(Objlist *, Obj_Entry *);
116static void objlist_push_tail(Objlist *, Obj_Entry *);
117static void objlist_remove(Objlist *, Obj_Entry *);
118static void *path_enumerate(const char *, path_enum_proc, void *);
119static int relocate_objects(Obj_Entry *, bool, Obj_Entry *);
120static int rtld_dirname(const char *, char *);
121static int rtld_dirname_abs(const char *, char *);
122static void rtld_exit(void);
123static char *search_library_path(const char *, const char *);
124static const void **get_program_var_addr(const char *);
125static void set_program_var(const char *, const void *);
126static const Elf_Sym *symlook_default(const char *, unsigned long,
127 const Obj_Entry *, const Obj_Entry **, const Ver_Entry *, int);
128static const Elf_Sym *symlook_list(const char *, unsigned long, const Objlist *,
129 const Obj_Entry **, const Ver_Entry *, int, DoneList *);
130static const Elf_Sym *symlook_needed(const char *, unsigned long,
131 const Needed_Entry *, const Obj_Entry **, const Ver_Entry *,
132 int, DoneList *);
133static void trace_loaded_objects(Obj_Entry *);
134static void unlink_object(Obj_Entry *);
135static void unload_object(Obj_Entry *);
136static void unref_dag(Obj_Entry *);
137static void ref_dag(Obj_Entry *);
138static int origin_subst_one(char **, const char *, const char *,
139 const char *, char *);
140static char *origin_subst(const char *, const char *);
141static int rtld_verify_versions(const Objlist *);
142static int rtld_verify_object_versions(Obj_Entry *);
143static void object_add_name(Obj_Entry *, const char *);
144static int object_match_name(const Obj_Entry *, const char *);
145static void ld_utrace_log(int, void *, void *, size_t, int, const char *);
146
147void r_debug_state(struct r_debug *, struct link_map *);
148
149/*
150 * Data declarations.
151 */
152static char *error_message; /* Message for dlerror(), or NULL */
153struct r_debug r_debug; /* for GDB; */
154static bool libmap_disable; /* Disable libmap */
155static char *libmap_override; /* Maps to use in addition to libmap.conf */
156static bool trust; /* False for setuid and setgid programs */
157static bool dangerous_ld_env; /* True if environment variables have been
158 used to affect the libraries loaded */
159static char *ld_bind_now; /* Environment variable for immediate binding */
160static char *ld_debug; /* Environment variable for debugging */
161static char *ld_library_path; /* Environment variable for search path */
162static char *ld_preload; /* Environment variable for libraries to
163 load first */
164static char *ld_elf_hints_path; /* Environment variable for alternative hints path */
165static char *ld_tracing; /* Called from ldd to print libs */
166static char *ld_utrace; /* Use utrace() to log events. */
167static Obj_Entry *obj_list; /* Head of linked list of shared objects */
168static Obj_Entry **obj_tail; /* Link field of last object in list */
169static Obj_Entry *obj_main; /* The main program shared object */
170static Obj_Entry obj_rtld; /* The dynamic linker shared object */
171static unsigned int obj_count; /* Number of objects in obj_list */
172static unsigned int obj_loads; /* Number of objects in obj_list */
173
174static Objlist list_global = /* Objects dlopened with RTLD_GLOBAL */
175 STAILQ_HEAD_INITIALIZER(list_global);
176static Objlist list_main = /* Objects loaded at program startup */
177 STAILQ_HEAD_INITIALIZER(list_main);
178static Objlist list_fini = /* Objects needing fini() calls */
179 STAILQ_HEAD_INITIALIZER(list_fini);
180
181static Elf_Sym sym_zero; /* For resolving undefined weak refs. */
182
183#define GDB_STATE(s,m) r_debug.r_state = s; r_debug_state(&r_debug,m);
184
185extern Elf_Dyn _DYNAMIC;
186#pragma weak _DYNAMIC
187#ifndef RTLD_IS_DYNAMIC
188#define RTLD_IS_DYNAMIC() (&_DYNAMIC != NULL)
189#endif
190
191/*
192 * These are the functions the dynamic linker exports to application
193 * programs. They are the only symbols the dynamic linker is willing
194 * to export from itself.
195 */
196static func_ptr_type exports[] = {
197 (func_ptr_type) &_rtld_error,
198 (func_ptr_type) &dlclose,
199 (func_ptr_type) &dlerror,
200 (func_ptr_type) &dlopen,
201 (func_ptr_type) &dlsym,
202 (func_ptr_type) &dlfunc,
203 (func_ptr_type) &dlvsym,
204 (func_ptr_type) &dladdr,
205 (func_ptr_type) &dllockinit,
206 (func_ptr_type) &dlinfo,
207 (func_ptr_type) &_rtld_thread_init,
208#ifdef __i386__
209 (func_ptr_type) &___tls_get_addr,
210#endif
211 (func_ptr_type) &__tls_get_addr,
212 (func_ptr_type) &_rtld_allocate_tls,
213 (func_ptr_type) &_rtld_free_tls,
214 (func_ptr_type) &dl_iterate_phdr,
215 (func_ptr_type) &_rtld_atfork_pre,
216 (func_ptr_type) &_rtld_atfork_post,
217 NULL
218};
219
220/*
221 * Global declarations normally provided by crt1. The dynamic linker is
222 * not built with crt1, so we have to provide them ourselves.
223 */
224char *__progname;
225char **environ;
226
227/*
228 * Globals to control TLS allocation.
229 */
230size_t tls_last_offset; /* Static TLS offset of last module */
231size_t tls_last_size; /* Static TLS size of last module */
232size_t tls_static_space; /* Static TLS space allocated */
233int tls_dtv_generation = 1; /* Used to detect when dtv size changes */
234int tls_max_index = 1; /* Largest module index allocated */
235
236/*
237 * Fill in a DoneList with an allocation large enough to hold all of
238 * the currently-loaded objects. Keep this as a macro since it calls
239 * alloca and we want that to occur within the scope of the caller.
240 */
241#define donelist_init(dlp) \
242 ((dlp)->objs = alloca(obj_count * sizeof (dlp)->objs[0]), \
243 assert((dlp)->objs != NULL), \
244 (dlp)->num_alloc = obj_count, \
245 (dlp)->num_used = 0)
246
247#define UTRACE_DLOPEN_START 1
248#define UTRACE_DLOPEN_STOP 2
249#define UTRACE_DLCLOSE_START 3
250#define UTRACE_DLCLOSE_STOP 4
251#define UTRACE_LOAD_OBJECT 5
252#define UTRACE_UNLOAD_OBJECT 6
253#define UTRACE_ADD_RUNDEP 7
254#define UTRACE_PRELOAD_FINISHED 8
255#define UTRACE_INIT_CALL 9
256#define UTRACE_FINI_CALL 10
257
258struct utrace_rtld {
259 char sig[4]; /* 'RTLD' */
260 int event;
261 void *handle;
262 void *mapbase; /* Used for 'parent' and 'init/fini' */
263 size_t mapsize;
264 int refcnt; /* Used for 'mode' */
265 char name[MAXPATHLEN];
266};
267
268#define LD_UTRACE(e, h, mb, ms, r, n) do { \
269 if (ld_utrace != NULL) \
270 ld_utrace_log(e, h, mb, ms, r, n); \
271} while (0)
272
273static void
274ld_utrace_log(int event, void *handle, void *mapbase, size_t mapsize,
275 int refcnt, const char *name)
276{
277 struct utrace_rtld ut;
278
279 ut.sig[0] = 'R';
280 ut.sig[1] = 'T';
281 ut.sig[2] = 'L';
282 ut.sig[3] = 'D';
283 ut.event = event;
284 ut.handle = handle;
285 ut.mapbase = mapbase;
286 ut.mapsize = mapsize;
287 ut.refcnt = refcnt;
288 bzero(ut.name, sizeof(ut.name));
289 if (name)
290 strlcpy(ut.name, name, sizeof(ut.name));
291 utrace(&ut, sizeof(ut));
292}
293
294/*
295 * Main entry point for dynamic linking. The first argument is the
296 * stack pointer. The stack is expected to be laid out as described
297 * in the SVR4 ABI specification, Intel 386 Processor Supplement.
298 * Specifically, the stack pointer points to a word containing
299 * ARGC. Following that in the stack is a null-terminated sequence
300 * of pointers to argument strings. Then comes a null-terminated
301 * sequence of pointers to environment strings. Finally, there is a
302 * sequence of "auxiliary vector" entries.
303 *
304 * The second argument points to a place to store the dynamic linker's
305 * exit procedure pointer and the third to a place to store the main
306 * program's object.
307 *
308 * The return value is the main program's entry point.
309 */
310func_ptr_type
311_rtld(Elf_Addr *sp, func_ptr_type *exit_proc, Obj_Entry **objp)
312{
313 Elf_Auxinfo *aux_info[AT_COUNT];
314 int i;
315 int argc;
316 char **argv;
317 char **env;
318 Elf_Auxinfo *aux;
319 Elf_Auxinfo *auxp;
320 const char *argv0;
321 Objlist_Entry *entry;
322 Obj_Entry *obj;
323 Obj_Entry **preload_tail;
324 Objlist initlist;
325 int lockstate;
326
327 /*
328 * On entry, the dynamic linker itself has not been relocated yet.
329 * Be very careful not to reference any global data until after
330 * init_rtld has returned. It is OK to reference file-scope statics
331 * and string constants, and to call static and global functions.
332 */
333
334 /* Find the auxiliary vector on the stack. */
335 argc = *sp++;
336 argv = (char **) sp;
337 sp += argc + 1; /* Skip over arguments and NULL terminator */
338 env = (char **) sp;
339 while (*sp++ != 0) /* Skip over environment, and NULL terminator */
340 ;
341 aux = (Elf_Auxinfo *) sp;
342
343 /* Digest the auxiliary vector. */
344 for (i = 0; i < AT_COUNT; i++)
345 aux_info[i] = NULL;
346 for (auxp = aux; auxp->a_type != AT_NULL; auxp++) {
347 if (auxp->a_type < AT_COUNT)
348 aux_info[auxp->a_type] = auxp;
349 }
350
351 /* Initialize and relocate ourselves. */
352 assert(aux_info[AT_BASE] != NULL);
353 init_rtld((caddr_t) aux_info[AT_BASE]->a_un.a_ptr);
354
355 __progname = obj_rtld.path;
356 argv0 = argv[0] != NULL ? argv[0] : "(null)";
357 environ = env;
358
359 trust = !issetugid();
360
361 ld_bind_now = getenv(LD_ "BIND_NOW");
362 /*
363 * If the process is tainted, then we un-set the dangerous environment
364 * variables. The process will be marked as tainted until setuid(2)
365 * is called. If any child process calls setuid(2) we do not want any
366 * future processes to honor the potentially un-safe variables.
367 */
368 if (!trust) {
369 if (unsetenv(LD_ "PRELOAD") || unsetenv(LD_ "LIBMAP") ||
370 unsetenv(LD_ "LIBRARY_PATH") || unsetenv(LD_ "LIBMAP_DISABLE") ||
371 unsetenv(LD_ "DEBUG") || unsetenv(LD_ "ELF_HINTS_PATH")) {
372 _rtld_error("environment corrupt; aborting");
373 die();
374 }
375 }
376 ld_debug = getenv(LD_ "DEBUG");
377 libmap_disable = getenv(LD_ "LIBMAP_DISABLE") != NULL;
378 libmap_override = getenv(LD_ "LIBMAP");
379 ld_library_path = getenv(LD_ "LIBRARY_PATH");
380 ld_preload = getenv(LD_ "PRELOAD");
381 ld_elf_hints_path = getenv(LD_ "ELF_HINTS_PATH");
382 dangerous_ld_env = libmap_disable || (libmap_override != NULL) ||
383 (ld_library_path != NULL) || (ld_preload != NULL) ||
384 (ld_elf_hints_path != NULL);
385 ld_tracing = getenv(LD_ "TRACE_LOADED_OBJECTS");
386 ld_utrace = getenv(LD_ "UTRACE");
387
388 if ((ld_elf_hints_path == NULL) || strlen(ld_elf_hints_path) == 0)
389 ld_elf_hints_path = _PATH_ELF_HINTS;
390
391 if (ld_debug != NULL && *ld_debug != '\0')
392 debug = 1;
393 dbg("%s is initialized, base address = %p", __progname,
394 (caddr_t) aux_info[AT_BASE]->a_un.a_ptr);
395 dbg("RTLD dynamic = %p", obj_rtld.dynamic);
396 dbg("RTLD pltgot = %p", obj_rtld.pltgot);
397
398 /*
399 * Load the main program, or process its program header if it is
400 * already loaded.
401 */
402 if (aux_info[AT_EXECFD] != NULL) { /* Load the main program. */
403 int fd = aux_info[AT_EXECFD]->a_un.a_val;
404 dbg("loading main program");
405 obj_main = map_object(fd, argv0, NULL);
406 close(fd);
407 if (obj_main == NULL)
408 die();
409 } else { /* Main program already loaded. */
410 const Elf_Phdr *phdr;
411 int phnum;
412 caddr_t entry;
413
414 dbg("processing main program's program header");
415 assert(aux_info[AT_PHDR] != NULL);
416 phdr = (const Elf_Phdr *) aux_info[AT_PHDR]->a_un.a_ptr;
417 assert(aux_info[AT_PHNUM] != NULL);
418 phnum = aux_info[AT_PHNUM]->a_un.a_val;
419 assert(aux_info[AT_PHENT] != NULL);
420 assert(aux_info[AT_PHENT]->a_un.a_val == sizeof(Elf_Phdr));
421 assert(aux_info[AT_ENTRY] != NULL);
422 entry = (caddr_t) aux_info[AT_ENTRY]->a_un.a_ptr;
423 if ((obj_main = digest_phdr(phdr, phnum, entry, argv0)) == NULL)
424 die();
425 }
426
427 if (aux_info[AT_EXECPATH] != 0) {
428 char *kexecpath;
429 char buf[MAXPATHLEN];
430
431 kexecpath = aux_info[AT_EXECPATH]->a_un.a_ptr;
432 dbg("AT_EXECPATH %p %s", kexecpath, kexecpath);
433 if (kexecpath[0] == '/')
434 obj_main->path = kexecpath;
435 else if (getcwd(buf, sizeof(buf)) == NULL ||
436 strlcat(buf, "/", sizeof(buf)) >= sizeof(buf) ||
437 strlcat(buf, kexecpath, sizeof(buf)) >= sizeof(buf))
438 obj_main->path = xstrdup(argv0);
439 else
440 obj_main->path = xstrdup(buf);
441 } else {
442 dbg("No AT_EXECPATH");
443 obj_main->path = xstrdup(argv0);
444 }
445 dbg("obj_main path %s", obj_main->path);
446 obj_main->mainprog = true;
447
448 /*
449 * Get the actual dynamic linker pathname from the executable if
450 * possible. (It should always be possible.) That ensures that
451 * gdb will find the right dynamic linker even if a non-standard
452 * one is being used.
453 */
454 if (obj_main->interp != NULL &&
455 strcmp(obj_main->interp, obj_rtld.path) != 0) {
456 free(obj_rtld.path);
457 obj_rtld.path = xstrdup(obj_main->interp);
458 __progname = obj_rtld.path;
459 }
460
461 digest_dynamic(obj_main, 0);
462
463 linkmap_add(obj_main);
464 linkmap_add(&obj_rtld);
465
466 /* Link the main program into the list of objects. */
467 *obj_tail = obj_main;
468 obj_tail = &obj_main->next;
469 obj_count++;
470 obj_loads++;
471 /* Make sure we don't call the main program's init and fini functions. */
472 obj_main->init = obj_main->fini = (Elf_Addr)NULL;
473
474 /* Initialize a fake symbol for resolving undefined weak references. */
475 sym_zero.st_info = ELF_ST_INFO(STB_GLOBAL, STT_NOTYPE);
476 sym_zero.st_shndx = SHN_UNDEF;
477 sym_zero.st_value = -(uintptr_t)obj_main->relocbase;
478
479 if (!libmap_disable)
480 libmap_disable = (bool)lm_init(libmap_override);
481
482 dbg("loading LD_PRELOAD libraries");
483 if (load_preload_objects() == -1)
484 die();
485 preload_tail = obj_tail;
486
487 dbg("loading needed objects");
488 if (load_needed_objects(obj_main, 0) == -1)
489 die();
490
491 /* Make a list of all objects loaded at startup. */
492 for (obj = obj_list; obj != NULL; obj = obj->next) {
493 objlist_push_tail(&list_main, obj);
494 obj->refcount++;
495 }
496
497 dbg("checking for required versions");
498 if (rtld_verify_versions(&list_main) == -1 && !ld_tracing)
499 die();
500
501 if (ld_tracing) { /* We're done */
502 trace_loaded_objects(obj_main);
503 exit(0);
504 }
505
506 if (getenv(LD_ "DUMP_REL_PRE") != NULL) {
507 dump_relocations(obj_main);
508 exit (0);
509 }
510
511 /* setup TLS for main thread */
512 dbg("initializing initial thread local storage");
513 STAILQ_FOREACH(entry, &list_main, link) {
514 /*
515 * Allocate all the initial objects out of the static TLS
516 * block even if they didn't ask for it.
517 */
518 allocate_tls_offset(entry->obj);
519 }
520 allocate_initial_tls(obj_list);
521
522 if (relocate_objects(obj_main,
523 ld_bind_now != NULL && *ld_bind_now != '\0', &obj_rtld) == -1)
524 die();
525
526 dbg("doing copy relocations");
527 if (do_copy_relocations(obj_main) == -1)
528 die();
529
530 if (getenv(LD_ "DUMP_REL_POST") != NULL) {
531 dump_relocations(obj_main);
532 exit (0);
533 }
534
535 dbg("initializing key program variables");
536 set_program_var("__progname", argv[0] != NULL ? basename(argv[0]) : "");
537 set_program_var("environ", env);
538
539 dbg("initializing thread locks");
540 lockdflt_init();
541
542 /* Make a list of init functions to call. */
543 objlist_init(&initlist);
544 initlist_add_objects(obj_list, preload_tail, &initlist);
545
546 r_debug_state(NULL, &obj_main->linkmap); /* say hello to gdb! */
547
548 lockstate = wlock_acquire(rtld_bind_lock);
549 objlist_call_init(&initlist, &lockstate);
550 objlist_clear(&initlist);
551 wlock_release(rtld_bind_lock, lockstate);
552
553 dbg("transferring control to program entry point = %p", obj_main->entry);
554
555 /* Return the exit procedure and the program entry point. */
556 *exit_proc = rtld_exit;
557 *objp = obj_main;
558 return (func_ptr_type) obj_main->entry;
559}
560
561Elf_Addr
562_rtld_bind(Obj_Entry *obj, Elf_Size reloff)
563{
564 const Elf_Rel *rel;
565 const Elf_Sym *def;
566 const Obj_Entry *defobj;
567 Elf_Addr *where;
568 Elf_Addr target;
569 int lockstate;
570
571 lockstate = rlock_acquire(rtld_bind_lock);
572 if (obj->pltrel)
573 rel = (const Elf_Rel *) ((caddr_t) obj->pltrel + reloff);
574 else
575 rel = (const Elf_Rel *) ((caddr_t) obj->pltrela + reloff);
576
577 where = (Elf_Addr *) (obj->relocbase + rel->r_offset);
578 def = find_symdef(ELF_R_SYM(rel->r_info), obj, &defobj, true, NULL);
579 if (def == NULL)
580 die();
581
582 target = (Elf_Addr)(defobj->relocbase + def->st_value);
583
584 dbg("\"%s\" in \"%s\" ==> %p in \"%s\"",
585 defobj->strtab + def->st_name, basename(obj->path),
586 (void *)target, basename(defobj->path));
587
588 /*
589 * Write the new contents for the jmpslot. Note that depending on
590 * architecture, the value which we need to return back to the
591 * lazy binding trampoline may or may not be the target
592 * address. The value returned from reloc_jmpslot() is the value
593 * that the trampoline needs.
594 */
595 target = reloc_jmpslot(where, target, defobj, obj, rel);
596 rlock_release(rtld_bind_lock, lockstate);
597 return target;
598}
599
600/*
601 * Error reporting function. Use it like printf. If formats the message
602 * into a buffer, and sets things up so that the next call to dlerror()
603 * will return the message.
604 */
605void
606_rtld_error(const char *fmt, ...)
607{
608 static char buf[512];
609 va_list ap;
610
611 va_start(ap, fmt);
612 vsnprintf(buf, sizeof buf, fmt, ap);
613 error_message = buf;
614 va_end(ap);
615}
616
617/*
618 * Return a dynamically-allocated copy of the current error message, if any.
619 */
620static char *
621errmsg_save(void)
622{
623 return error_message == NULL ? NULL : xstrdup(error_message);
624}
625
626/*
627 * Restore the current error message from a copy which was previously saved
628 * by errmsg_save(). The copy is freed.
629 */
630static void
631errmsg_restore(char *saved_msg)
632{
633 if (saved_msg == NULL)
634 error_message = NULL;
635 else {
636 _rtld_error("%s", saved_msg);
637 free(saved_msg);
638 }
639}
640
641static const char *
642basename(const char *name)
643{
644 const char *p = strrchr(name, '/');
645 return p != NULL ? p + 1 : name;
646}
647
648static struct utsname uts;
649
650static int
651origin_subst_one(char **res, const char *real, const char *kw, const char *subst,
652 char *may_free)
653{
654 const char *p, *p1;
655 char *res1;
656 int subst_len;
657 int kw_len;
658
659 res1 = *res = NULL;
660 p = real;
661 subst_len = kw_len = 0;
662 for (;;) {
663 p1 = strstr(p, kw);
664 if (p1 != NULL) {
665 if (subst_len == 0) {
666 subst_len = strlen(subst);
667 kw_len = strlen(kw);
668 }
669 if (*res == NULL) {
670 *res = xmalloc(PATH_MAX);
671 res1 = *res;
672 }
673 if ((res1 - *res) + subst_len + (p1 - p) >= PATH_MAX) {
674 _rtld_error("Substitution of %s in %s cannot be performed",
675 kw, real);
676 if (may_free != NULL)
677 free(may_free);
678 free(res);
679 return (false);
680 }
681 memcpy(res1, p, p1 - p);
682 res1 += p1 - p;
683 memcpy(res1, subst, subst_len);
684 res1 += subst_len;
685 p = p1 + kw_len;
686 } else {
687 if (*res == NULL) {
688 if (may_free != NULL)
689 *res = may_free;
690 else
691 *res = xstrdup(real);
692 return (true);
693 }
694 *res1 = '\0';
695 if (may_free != NULL)
696 free(may_free);
697 if (strlcat(res1, p, PATH_MAX - (res1 - *res)) >= PATH_MAX) {
698 free(res);
699 return (false);
700 }
701 return (true);
702 }
703 }
704}
705
706static char *
707origin_subst(const char *real, const char *origin_path)
708{
709 char *res1, *res2, *res3, *res4;
710
711 if (uts.sysname[0] == '\0') {
712 if (uname(&uts) != 0) {
713 _rtld_error("utsname failed: %d", errno);
714 return (NULL);
715 }
716 }
717 if (!origin_subst_one(&res1, real, "$ORIGIN", origin_path, NULL) ||
718 !origin_subst_one(&res2, res1, "$OSNAME", uts.sysname, res1) ||
719 !origin_subst_one(&res3, res2, "$OSREL", uts.release, res2) ||
720 !origin_subst_one(&res4, res3, "$PLATFORM", uts.machine, res3))
721 return (NULL);
722 return (res4);
723}
724
725static void
726die(void)
727{
728 const char *msg = dlerror();
729
730 if (msg == NULL)
731 msg = "Fatal error";
732 errx(1, "%s", msg);
733}
734
735/*
736 * Process a shared object's DYNAMIC section, and save the important
737 * information in its Obj_Entry structure.
738 */
739static void
740digest_dynamic(Obj_Entry *obj, int early)
741{
742 const Elf_Dyn *dynp;
743 Needed_Entry **needed_tail = &obj->needed;
744 const Elf_Dyn *dyn_rpath = NULL;
745 const Elf_Dyn *dyn_soname = NULL;
746 int plttype = DT_REL;
747
748 obj->bind_now = false;
749 for (dynp = obj->dynamic; dynp->d_tag != DT_NULL; dynp++) {
750 switch (dynp->d_tag) {
751
752 case DT_REL:
753 obj->rel = (const Elf_Rel *) (obj->relocbase + dynp->d_un.d_ptr);
754 break;
755
756 case DT_RELSZ:
757 obj->relsize = dynp->d_un.d_val;
758 break;
759
760 case DT_RELENT:
761 assert(dynp->d_un.d_val == sizeof(Elf_Rel));
762 break;
763
764 case DT_JMPREL:
765 obj->pltrel = (const Elf_Rel *)
766 (obj->relocbase + dynp->d_un.d_ptr);
767 break;
768
769 case DT_PLTRELSZ:
770 obj->pltrelsize = dynp->d_un.d_val;
771 break;
772
773 case DT_RELA:
774 obj->rela = (const Elf_Rela *) (obj->relocbase + dynp->d_un.d_ptr);
775 break;
776
777 case DT_RELASZ:
778 obj->relasize = dynp->d_un.d_val;
779 break;
780
781 case DT_RELAENT:
782 assert(dynp->d_un.d_val == sizeof(Elf_Rela));
783 break;
784
785 case DT_PLTREL:
786 plttype = dynp->d_un.d_val;
787 assert(dynp->d_un.d_val == DT_REL || plttype == DT_RELA);
788 break;
789
790 case DT_SYMTAB:
791 obj->symtab = (const Elf_Sym *)
792 (obj->relocbase + dynp->d_un.d_ptr);
793 break;
794
795 case DT_SYMENT:
796 assert(dynp->d_un.d_val == sizeof(Elf_Sym));
797 break;
798
799 case DT_STRTAB:
800 obj->strtab = (const char *) (obj->relocbase + dynp->d_un.d_ptr);
801 break;
802
803 case DT_STRSZ:
804 obj->strsize = dynp->d_un.d_val;
805 break;
806
807 case DT_VERNEED:
808 obj->verneed = (const Elf_Verneed *) (obj->relocbase +
809 dynp->d_un.d_val);
810 break;
811
812 case DT_VERNEEDNUM:
813 obj->verneednum = dynp->d_un.d_val;
814 break;
815
816 case DT_VERDEF:
817 obj->verdef = (const Elf_Verdef *) (obj->relocbase +
818 dynp->d_un.d_val);
819 break;
820
821 case DT_VERDEFNUM:
822 obj->verdefnum = dynp->d_un.d_val;
823 break;
824
825 case DT_VERSYM:
826 obj->versyms = (const Elf_Versym *)(obj->relocbase +
827 dynp->d_un.d_val);
828 break;
829
830 case DT_HASH:
831 {
832 const Elf_Hashelt *hashtab = (const Elf_Hashelt *)
833 (obj->relocbase + dynp->d_un.d_ptr);
834 obj->nbuckets = hashtab[0];
835 obj->nchains = hashtab[1];
836 obj->buckets = hashtab + 2;
837 obj->chains = obj->buckets + obj->nbuckets;
838 }
839 break;
840
841 case DT_NEEDED:
842 if (!obj->rtld) {
843 Needed_Entry *nep = NEW(Needed_Entry);
844 nep->name = dynp->d_un.d_val;
845 nep->obj = NULL;
846 nep->next = NULL;
847
848 *needed_tail = nep;
849 needed_tail = &nep->next;
850 }
851 break;
852
853 case DT_PLTGOT:
854 obj->pltgot = (Elf_Addr *) (obj->relocbase + dynp->d_un.d_ptr);
855 break;
856
857 case DT_TEXTREL:
858 obj->textrel = true;
859 break;
860
861 case DT_SYMBOLIC:
862 obj->symbolic = true;
863 break;
864
865 case DT_RPATH:
866 case DT_RUNPATH: /* XXX: process separately */
867 /*
868 * We have to wait until later to process this, because we
869 * might not have gotten the address of the string table yet.
870 */
871 dyn_rpath = dynp;
872 break;
873
874 case DT_SONAME:
875 dyn_soname = dynp;
876 break;
877
878 case DT_INIT:
879 obj->init = (Elf_Addr) (obj->relocbase + dynp->d_un.d_ptr);
880 break;
881
882 case DT_FINI:
883 obj->fini = (Elf_Addr) (obj->relocbase + dynp->d_un.d_ptr);
884 break;
885
886 /*
887 * Don't process DT_DEBUG on MIPS as the dynamic section
888 * is mapped read-only. DT_MIPS_RLD_MAP is used instead.
889 */
890
891#ifndef __mips__
892 case DT_DEBUG:
893 /* XXX - not implemented yet */
894 if (!early)
895 dbg("Filling in DT_DEBUG entry");
896 ((Elf_Dyn*)dynp)->d_un.d_ptr = (Elf_Addr) &r_debug;
897 break;
898#endif
899
900 case DT_FLAGS:
901 if ((dynp->d_un.d_val & DF_ORIGIN) && trust)
902 obj->z_origin = true;
903 if (dynp->d_un.d_val & DF_SYMBOLIC)
904 obj->symbolic = true;
905 if (dynp->d_un.d_val & DF_TEXTREL)
906 obj->textrel = true;
907 if (dynp->d_un.d_val & DF_BIND_NOW)
908 obj->bind_now = true;
909 if (dynp->d_un.d_val & DF_STATIC_TLS)
910 ;
911 break;
912#ifdef __mips__
913 case DT_MIPS_LOCAL_GOTNO:
914 obj->local_gotno = dynp->d_un.d_val;
915 break;
916
917 case DT_MIPS_SYMTABNO:
918 obj->symtabno = dynp->d_un.d_val;
919 break;
920
921 case DT_MIPS_GOTSYM:
922 obj->gotsym = dynp->d_un.d_val;
923 break;
924
925 case DT_MIPS_RLD_MAP:
926#ifdef notyet
927 if (!early)
928 dbg("Filling in DT_DEBUG entry");
929 ((Elf_Dyn*)dynp)->d_un.d_ptr = (Elf_Addr) &r_debug;
930#endif
931 break;
932#endif
933
934 case DT_FLAGS_1:
935 if (dynp->d_un.d_val & DF_1_NOOPEN)
936 obj->z_noopen = true;
937 if ((dynp->d_un.d_val & DF_1_ORIGIN) && trust)
938 obj->z_origin = true;
939 if (dynp->d_un.d_val & DF_1_GLOBAL)
940 /* XXX */;
941 if (dynp->d_un.d_val & DF_1_BIND_NOW)
942 obj->bind_now = true;
943 if (dynp->d_un.d_val & DF_1_NODELETE)
944 obj->z_nodelete = true;
945 break;
946
947 default:
948 if (!early) {
949 dbg("Ignoring d_tag %ld = %#lx", (long)dynp->d_tag,
950 (long)dynp->d_tag);
951 }
952 break;
953 }
954 }
955
956 obj->traced = false;
957
958 if (plttype == DT_RELA) {
959 obj->pltrela = (const Elf_Rela *) obj->pltrel;
960 obj->pltrel = NULL;
961 obj->pltrelasize = obj->pltrelsize;
962 obj->pltrelsize = 0;
963 }
964
965 if (obj->z_origin && obj->origin_path == NULL) {
966 obj->origin_path = xmalloc(PATH_MAX);
967 if (rtld_dirname_abs(obj->path, obj->origin_path) == -1)
968 die();
969 }
970
971 if (dyn_rpath != NULL) {
972 obj->rpath = (char *)obj->strtab + dyn_rpath->d_un.d_val;
973 if (obj->z_origin)
974 obj->rpath = origin_subst(obj->rpath, obj->origin_path);
975 }
976
977 if (dyn_soname != NULL)
978 object_add_name(obj, obj->strtab + dyn_soname->d_un.d_val);
979}
980
981/*
982 * Process a shared object's program header. This is used only for the
983 * main program, when the kernel has already loaded the main program
984 * into memory before calling the dynamic linker. It creates and
985 * returns an Obj_Entry structure.
986 */
987static Obj_Entry *
988digest_phdr(const Elf_Phdr *phdr, int phnum, caddr_t entry, const char *path)
989{
990 Obj_Entry *obj;
991 const Elf_Phdr *phlimit = phdr + phnum;
992 const Elf_Phdr *ph;
993 int nsegs = 0;
994
995 obj = obj_new();
996 for (ph = phdr; ph < phlimit; ph++) {
997 if (ph->p_type != PT_PHDR)
998 continue;
999
1000 obj->phdr = phdr;
1001 obj->phsize = ph->p_memsz;
1002 obj->relocbase = (caddr_t)phdr - ph->p_vaddr;
1003 break;
1004 }
1005
1006 for (ph = phdr; ph < phlimit; ph++) {
1007 switch (ph->p_type) {
1008
1009 case PT_INTERP:
1010 obj->interp = (const char *)(ph->p_vaddr + obj->relocbase);
1011 break;
1012
1013 case PT_LOAD:
1014 if (nsegs == 0) { /* First load segment */
1015 obj->vaddrbase = trunc_page(ph->p_vaddr);
1016 obj->mapbase = obj->vaddrbase + obj->relocbase;
1017 obj->textsize = round_page(ph->p_vaddr + ph->p_memsz) -
1018 obj->vaddrbase;
1019 } else { /* Last load segment */
1020 obj->mapsize = round_page(ph->p_vaddr + ph->p_memsz) -
1021 obj->vaddrbase;
1022 }
1023 nsegs++;
1024 break;
1025
1026 case PT_DYNAMIC:
1027 obj->dynamic = (const Elf_Dyn *)(ph->p_vaddr + obj->relocbase);
1028 break;
1029
1030 case PT_TLS:
1031 obj->tlsindex = 1;
1032 obj->tlssize = ph->p_memsz;
1033 obj->tlsalign = ph->p_align;
1034 obj->tlsinitsize = ph->p_filesz;
1035 obj->tlsinit = (void*)(ph->p_vaddr + obj->relocbase);
1036 break;
1037 }
1038 }
1039 if (nsegs < 1) {
1040 _rtld_error("%s: too few PT_LOAD segments", path);
1041 return NULL;
1042 }
1043
1044 obj->entry = entry;
1045 return obj;
1046}
1047
1048static Obj_Entry *
1049dlcheck(void *handle)
1050{
1051 Obj_Entry *obj;
1052
1053 for (obj = obj_list; obj != NULL; obj = obj->next)
1054 if (obj == (Obj_Entry *) handle)
1055 break;
1056
1057 if (obj == NULL || obj->refcount == 0 || obj->dl_refcount == 0) {
1058 _rtld_error("Invalid shared object handle %p", handle);
1059 return NULL;
1060 }
1061 return obj;
1062}
1063
1064/*
1065 * If the given object is already in the donelist, return true. Otherwise
1066 * add the object to the list and return false.
1067 */
1068static bool
1069donelist_check(DoneList *dlp, const Obj_Entry *obj)
1070{
1071 unsigned int i;
1072
1073 for (i = 0; i < dlp->num_used; i++)
1074 if (dlp->objs[i] == obj)
1075 return true;
1076 /*
1077 * Our donelist allocation should always be sufficient. But if
1078 * our threads locking isn't working properly, more shared objects
1079 * could have been loaded since we allocated the list. That should
1080 * never happen, but we'll handle it properly just in case it does.
1081 */
1082 if (dlp->num_used < dlp->num_alloc)
1083 dlp->objs[dlp->num_used++] = obj;
1084 return false;
1085}
1086
1087/*
1088 * Hash function for symbol table lookup. Don't even think about changing
1089 * this. It is specified by the System V ABI.
1090 */
1091unsigned long
1092elf_hash(const char *name)
1093{
1094 const unsigned char *p = (const unsigned char *) name;
1095 unsigned long h = 0;
1096 unsigned long g;
1097
1098 while (*p != '\0') {
1099 h = (h << 4) + *p++;
1100 if ((g = h & 0xf0000000) != 0)
1101 h ^= g >> 24;
1102 h &= ~g;
1103 }
1104 return h;
1105}
1106
1107/*
1108 * Find the library with the given name, and return its full pathname.
1109 * The returned string is dynamically allocated. Generates an error
1110 * message and returns NULL if the library cannot be found.
1111 *
1112 * If the second argument is non-NULL, then it refers to an already-
1113 * loaded shared object, whose library search path will be searched.
1114 *
1115 * The search order is:
1116 * LD_LIBRARY_PATH
1117 * rpath in the referencing file
1118 * ldconfig hints
1119 * /lib:/usr/lib
1120 */
1121static char *
1122find_library(const char *xname, const Obj_Entry *refobj)
1123{
1124 char *pathname;
1125 char *name;
1126
1127 if (strchr(xname, '/') != NULL) { /* Hard coded pathname */
1128 if (xname[0] != '/' && !trust) {
1129 _rtld_error("Absolute pathname required for shared object \"%s\"",
1130 xname);
1131 return NULL;
1132 }
1133 if (refobj != NULL && refobj->z_origin)
1134 return origin_subst(xname, refobj->origin_path);
1135 else
1136 return xstrdup(xname);
1137 }
1138
1139 if (libmap_disable || (refobj == NULL) ||
1140 (name = lm_find(refobj->path, xname)) == NULL)
1141 name = (char *)xname;
1142
1143 dbg(" Searching for \"%s\"", name);
1144
1145 if ((pathname = search_library_path(name, ld_library_path)) != NULL ||
1146 (refobj != NULL &&
1147 (pathname = search_library_path(name, refobj->rpath)) != NULL) ||
1148 (pathname = search_library_path(name, gethints())) != NULL ||
1149 (pathname = search_library_path(name, STANDARD_LIBRARY_PATH)) != NULL)
1150 return pathname;
1151
1152 if(refobj != NULL && refobj->path != NULL) {
1153 _rtld_error("Shared object \"%s\" not found, required by \"%s\"",
1154 name, basename(refobj->path));
1155 } else {
1156 _rtld_error("Shared object \"%s\" not found", name);
1157 }
1158 return NULL;
1159}
1160
1161/*
1162 * Given a symbol number in a referencing object, find the corresponding
1163 * definition of the symbol. Returns a pointer to the symbol, or NULL if
1164 * no definition was found. Returns a pointer to the Obj_Entry of the
1165 * defining object via the reference parameter DEFOBJ_OUT.
1166 */
1167const Elf_Sym *
1168find_symdef(unsigned long symnum, const Obj_Entry *refobj,
1169 const Obj_Entry **defobj_out, int flags, SymCache *cache)
1170{
1171 const Elf_Sym *ref;
1172 const Elf_Sym *def;
1173 const Obj_Entry *defobj;
1174 const Ver_Entry *ventry;
1175 const char *name;
1176 unsigned long hash;
1177
1178 /*
1179 * If we have already found this symbol, get the information from
1180 * the cache.
1181 */
1182 if (symnum >= refobj->nchains)
1183 return NULL; /* Bad object */
1184 if (cache != NULL && cache[symnum].sym != NULL) {
1185 *defobj_out = cache[symnum].obj;
1186 return cache[symnum].sym;
1187 }
1188
1189 ref = refobj->symtab + symnum;
1190 name = refobj->strtab + ref->st_name;
1191 defobj = NULL;
1192
1193 /*
1194 * We don't have to do a full scale lookup if the symbol is local.
1195 * We know it will bind to the instance in this load module; to
1196 * which we already have a pointer (ie ref). By not doing a lookup,
1197 * we not only improve performance, but it also avoids unresolvable
1198 * symbols when local symbols are not in the hash table. This has
1199 * been seen with the ia64 toolchain.
1200 */
1201 if (ELF_ST_BIND(ref->st_info) != STB_LOCAL) {
1202 if (ELF_ST_TYPE(ref->st_info) == STT_SECTION) {
1203 _rtld_error("%s: Bogus symbol table entry %lu", refobj->path,
1204 symnum);
1205 }
1206 ventry = fetch_ventry(refobj, symnum);
1207 hash = elf_hash(name);
1208 def = symlook_default(name, hash, refobj, &defobj, ventry, flags);
1209 } else {
1210 def = ref;
1211 defobj = refobj;
1212 }
1213
1214 /*
1215 * If we found no definition and the reference is weak, treat the
1216 * symbol as having the value zero.
1217 */
1218 if (def == NULL && ELF_ST_BIND(ref->st_info) == STB_WEAK) {
1219 def = &sym_zero;
1220 defobj = obj_main;
1221 }
1222
1223 if (def != NULL) {
1224 *defobj_out = defobj;
1225 /* Record the information in the cache to avoid subsequent lookups. */
1226 if (cache != NULL) {
1227 cache[symnum].sym = def;
1228 cache[symnum].obj = defobj;
1229 }
1230 } else {
1231 if (refobj != &obj_rtld)
1232 _rtld_error("%s: Undefined symbol \"%s\"", refobj->path, name);
1233 }
1234 return def;
1235}
1236
1237/*
1238 * Return the search path from the ldconfig hints file, reading it if
1239 * necessary. Returns NULL if there are problems with the hints file,
1240 * or if the search path there is empty.
1241 */
1242static const char *
1243gethints(void)
1244{
1245 static char *hints;
1246
1247 if (hints == NULL) {
1248 int fd;
1249 struct elfhints_hdr hdr;
1250 char *p;
1251
1252 /* Keep from trying again in case the hints file is bad. */
1253 hints = "";
1254
1255 if ((fd = open(ld_elf_hints_path, O_RDONLY)) == -1)
1256 return NULL;
1257 if (read(fd, &hdr, sizeof hdr) != sizeof hdr ||
1258 hdr.magic != ELFHINTS_MAGIC ||
1259 hdr.version != 1) {
1260 close(fd);
1261 return NULL;
1262 }
1263 p = xmalloc(hdr.dirlistlen + 1);
1264 if (lseek(fd, hdr.strtab + hdr.dirlist, SEEK_SET) == -1 ||
1265 read(fd, p, hdr.dirlistlen + 1) != (ssize_t)hdr.dirlistlen + 1) {
1266 free(p);
1267 close(fd);
1268 return NULL;
1269 }
1270 hints = p;
1271 close(fd);
1272 }
1273 return hints[0] != '\0' ? hints : NULL;
1274}
1275
1276static void
1277init_dag(Obj_Entry *root)
1278{
1279 DoneList donelist;
1280
1281 donelist_init(&donelist);
1282 init_dag1(root, root, &donelist);
1283}
1284
1285static void
1286init_dag1(Obj_Entry *root, Obj_Entry *obj, DoneList *dlp)
1287{
1288 const Needed_Entry *needed;
1289
1290 if (donelist_check(dlp, obj))
1291 return;
1292
1293 obj->refcount++;
1294 objlist_push_tail(&obj->dldags, root);
1295 objlist_push_tail(&root->dagmembers, obj);
1296 for (needed = obj->needed; needed != NULL; needed = needed->next)
1297 if (needed->obj != NULL)
1298 init_dag1(root, needed->obj, dlp);
1299}
1300
1301/*
1302 * Initialize the dynamic linker. The argument is the address at which
1303 * the dynamic linker has been mapped into memory. The primary task of
1304 * this function is to relocate the dynamic linker.
1305 */
1306static void
1307init_rtld(caddr_t mapbase)
1308{
1309 Obj_Entry objtmp; /* Temporary rtld object */
1310
1311 /*
1312 * Conjure up an Obj_Entry structure for the dynamic linker.
1313 *
1314 * The "path" member can't be initialized yet because string constants
1315 * cannot yet be accessed. Below we will set it correctly.
1316 */
1317 memset(&objtmp, 0, sizeof(objtmp));
1318 objtmp.path = NULL;
1319 objtmp.rtld = true;
1320 objtmp.mapbase = mapbase;
1321#ifdef PIC
1322 objtmp.relocbase = mapbase;
1323#endif
1324 if (RTLD_IS_DYNAMIC()) {
1325 objtmp.dynamic = rtld_dynamic(&objtmp);
1326 digest_dynamic(&objtmp, 1);
1327 assert(objtmp.needed == NULL);
1328#if !defined(__mips__)
1329 /* MIPS and SH{3,5} have a bogus DT_TEXTREL. */
1330 assert(!objtmp.textrel);
1331#endif
1332
1333 /*
1334 * Temporarily put the dynamic linker entry into the object list, so
1335 * that symbols can be found.
1336 */
1337
1338 relocate_objects(&objtmp, true, &objtmp);
1339 }
1340
1341 /* Initialize the object list. */
1342 obj_tail = &obj_list;
1343
1344 /* Now that non-local variables can be accesses, copy out obj_rtld. */
1345 memcpy(&obj_rtld, &objtmp, sizeof(obj_rtld));
1346
1347 /* Replace the path with a dynamically allocated copy. */
1348 obj_rtld.path = xstrdup(PATH_RTLD);
1349
1350 r_debug.r_brk = r_debug_state;
1351 r_debug.r_state = RT_CONSISTENT;
1352}
1353
1354/*
1355 * Add the init functions from a needed object list (and its recursive
1356 * needed objects) to "list". This is not used directly; it is a helper
1357 * function for initlist_add_objects(). The write lock must be held
1358 * when this function is called.
1359 */
1360static void
1361initlist_add_neededs(Needed_Entry *needed, Objlist *list)
1362{
1363 /* Recursively process the successor needed objects. */
1364 if (needed->next != NULL)
1365 initlist_add_neededs(needed->next, list);
1366
1367 /* Process the current needed object. */
1368 if (needed->obj != NULL)
1369 initlist_add_objects(needed->obj, &needed->obj->next, list);
1370}
1371
1372/*
1373 * Scan all of the DAGs rooted in the range of objects from "obj" to
1374 * "tail" and add their init functions to "list". This recurses over
1375 * the DAGs and ensure the proper init ordering such that each object's
1376 * needed libraries are initialized before the object itself. At the
1377 * same time, this function adds the objects to the global finalization
1378 * list "list_fini" in the opposite order. The write lock must be
1379 * held when this function is called.
1380 */
1381static void
1382initlist_add_objects(Obj_Entry *obj, Obj_Entry **tail, Objlist *list)
1383{
1384 if (obj->init_scanned || obj->init_done)
1385 return;
1386 obj->init_scanned = true;
1387
1388 /* Recursively process the successor objects. */
1389 if (&obj->next != tail)
1390 initlist_add_objects(obj->next, tail, list);
1391
1392 /* Recursively process the needed objects. */
1393 if (obj->needed != NULL)
1394 initlist_add_neededs(obj->needed, list);
1395
1396 /* Add the object to the init list. */
1397 if (obj->init != (Elf_Addr)NULL)
1398 objlist_push_tail(list, obj);
1399
1400 /* Add the object to the global fini list in the reverse order. */
1401 if (obj->fini != (Elf_Addr)NULL && !obj->on_fini_list) {
1402 objlist_push_head(&list_fini, obj);
1403 obj->on_fini_list = true;
1404 }
1405}
1406
1407#ifndef FPTR_TARGET
1408#define FPTR_TARGET(f) ((Elf_Addr) (f))
1409#endif
1410
1411static bool
1412is_exported(const Elf_Sym *def)
1413{
1414 Elf_Addr value;
1415 const func_ptr_type *p;
1416
1417 value = (Elf_Addr)(obj_rtld.relocbase + def->st_value);
1418 for (p = exports; *p != NULL; p++)
1419 if (FPTR_TARGET(*p) == value)
1420 return true;
1421 return false;
1422}
1423
1424/*
1425 * Given a shared object, traverse its list of needed objects, and load
1426 * each of them. Returns 0 on success. Generates an error message and
1427 * returns -1 on failure.
1428 */
1429static int
1430load_needed_objects(Obj_Entry *first, int flags)
1431{
1432 Obj_Entry *obj, *obj1;
1433
1434 for (obj = first; obj != NULL; obj = obj->next) {
1435 Needed_Entry *needed;
1436
1437 for (needed = obj->needed; needed != NULL; needed = needed->next) {
1438 obj1 = needed->obj = load_object(obj->strtab + needed->name, obj,
1439 flags & ~RTLD_LO_NOLOAD);
1440 if (obj1 == NULL && !ld_tracing)
1441 return -1;
1442 if (obj1 != NULL && obj1->z_nodelete && !obj1->ref_nodel) {
1443 dbg("obj %s nodelete", obj1->path);
1444 init_dag(obj1);
1445 ref_dag(obj1);
1446 obj1->ref_nodel = true;
1447 }
1448 }
1449 }
1450
1451 return 0;
1452}
1453
1454static int
1455load_preload_objects(void)
1456{
1457 char *p = ld_preload;
1458 static const char delim[] = " \t:;";
1459
1460 if (p == NULL)
1461 return 0;
1462
1463 p += strspn(p, delim);
1464 while (*p != '\0') {
1465 size_t len = strcspn(p, delim);
1466 char savech;
1467
1468 savech = p[len];
1469 p[len] = '\0';
1470 if (load_object(p, NULL, 0) == NULL)
1471 return -1; /* XXX - cleanup */
1472 p[len] = savech;
1473 p += len;
1474 p += strspn(p, delim);
1475 }
1476 LD_UTRACE(UTRACE_PRELOAD_FINISHED, NULL, NULL, 0, 0, NULL);
1477 return 0;
1478}
1479
1480/*
1481 * Load a shared object into memory, if it is not already loaded.
1482 *
1483 * Returns a pointer to the Obj_Entry for the object. Returns NULL
1484 * on failure.
1485 */
1486static Obj_Entry *
1487load_object(const char *name, const Obj_Entry *refobj, int flags)
1488{
1489 Obj_Entry *obj;
1490 int fd = -1;
1491 struct stat sb;
1492 char *path;
1493
1494 for (obj = obj_list->next; obj != NULL; obj = obj->next)
1495 if (object_match_name(obj, name))
1496 return obj;
1497
1498 path = find_library(name, refobj);
1499 if (path == NULL)
1500 return NULL;
1501
1502 /*
1503 * If we didn't find a match by pathname, open the file and check
1504 * again by device and inode. This avoids false mismatches caused
1505 * by multiple links or ".." in pathnames.
1506 *
1507 * To avoid a race, we open the file and use fstat() rather than
1508 * using stat().
1509 */
1510 if ((fd = open(path, O_RDONLY)) == -1) {
1511 _rtld_error("Cannot open \"%s\"", path);
1512 free(path);
1513 return NULL;
1514 }
1515 if (fstat(fd, &sb) == -1) {
1516 _rtld_error("Cannot fstat \"%s\"", path);
1517 close(fd);
1518 free(path);
1519 return NULL;
1520 }
1521 for (obj = obj_list->next; obj != NULL; obj = obj->next) {
1522 if (obj->ino == sb.st_ino && obj->dev == sb.st_dev) {
1523 close(fd);
1524 break;
1525 }
1526 }
1527 if (obj != NULL) {
1528 object_add_name(obj, name);
1529 free(path);
1530 close(fd);
1531 return obj;
1532 }
1533 if (flags & RTLD_LO_NOLOAD)
1534 return (NULL);
1535
1536 /* First use of this object, so we must map it in */
1537 obj = do_load_object(fd, name, path, &sb, flags);
1538 if (obj == NULL)
1539 free(path);
1540 close(fd);
1541
1542 return obj;
1543}
1544
1545static Obj_Entry *
1546do_load_object(int fd, const char *name, char *path, struct stat *sbp,
1547 int flags)
1548{
1549 Obj_Entry *obj;
1550 struct statfs fs;
1551
1552 /*
1553 * but first, make sure that environment variables haven't been
1554 * used to circumvent the noexec flag on a filesystem.
1555 */
1556 if (dangerous_ld_env) {
1557 if (fstatfs(fd, &fs) != 0) {
1558 _rtld_error("Cannot fstatfs \"%s\"", path);
1559 return NULL;
1560 }
1561 if (fs.f_flags & MNT_NOEXEC) {
1562 _rtld_error("Cannot execute objects on %s\n", fs.f_mntonname);
1563 return NULL;
1564 }
1565 }
1566 dbg("loading \"%s\"", path);
1567 obj = map_object(fd, path, sbp);
1568 if (obj == NULL)
1569 return NULL;
1570
1571 object_add_name(obj, name);
1572 obj->path = path;
1573 digest_dynamic(obj, 0);
1574 if (obj->z_noopen && (flags & (RTLD_LO_DLOPEN | RTLD_LO_TRACE)) ==
1575 RTLD_LO_DLOPEN) {
1576 dbg("refusing to load non-loadable \"%s\"", obj->path);
1577 _rtld_error("Cannot dlopen non-loadable %s", obj->path);
1578 munmap(obj->mapbase, obj->mapsize);
1579 obj_free(obj);
1580 return (NULL);
1581 }
1582
1583 *obj_tail = obj;
1584 obj_tail = &obj->next;
1585 obj_count++;
1586 obj_loads++;
1587 linkmap_add(obj); /* for GDB & dlinfo() */
1588
1589 dbg(" %p .. %p: %s", obj->mapbase,
1590 obj->mapbase + obj->mapsize - 1, obj->path);
1591 if (obj->textrel)
1592 dbg(" WARNING: %s has impure text", obj->path);
1593 LD_UTRACE(UTRACE_LOAD_OBJECT, obj, obj->mapbase, obj->mapsize, 0,
1594 obj->path);
1595
1596 return obj;
1597}
1598
1599static Obj_Entry *
1600obj_from_addr(const void *addr)
1601{
1602 Obj_Entry *obj;
1603
1604 for (obj = obj_list; obj != NULL; obj = obj->next) {
1605 if (addr < (void *) obj->mapbase)
1606 continue;
1607 if (addr < (void *) (obj->mapbase + obj->mapsize))
1608 return obj;
1609 }
1610 return NULL;
1611}
1612
1613/*
1614 * Call the finalization functions for each of the objects in "list"
1615 * which are unreferenced. All of the objects are expected to have
1616 * non-NULL fini functions.
1617 */
1618static void
1619objlist_call_fini(Objlist *list, bool force, int *lockstate)
1620{
1621 Objlist_Entry *elm, *elm_tmp;
1622 char *saved_msg;
1623
1624 /*
1625 * Preserve the current error message since a fini function might
1626 * call into the dynamic linker and overwrite it.
1627 */
1628 saved_msg = errmsg_save();
1629 STAILQ_FOREACH_SAFE(elm, list, link, elm_tmp) {
1630 if (elm->obj->refcount == 0 || force) {
1631 dbg("calling fini function for %s at %p", elm->obj->path,
1632 (void *)elm->obj->fini);
1633 LD_UTRACE(UTRACE_FINI_CALL, elm->obj, (void *)elm->obj->fini, 0, 0,
1634 elm->obj->path);
1635 /* Remove object from fini list to prevent recursive invocation. */
1636 STAILQ_REMOVE(list, elm, Struct_Objlist_Entry, link);
1637 wlock_release(rtld_bind_lock, *lockstate);
1638 call_initfini_pointer(elm->obj, elm->obj->fini);
1639 *lockstate = wlock_acquire(rtld_bind_lock);
1640 /* No need to free anything if process is going down. */
1641 if (!force)
1642 free(elm);
1643 }
1644 }
1645 errmsg_restore(saved_msg);
1646}
1647
1648/*
1649 * Call the initialization functions for each of the objects in
1650 * "list". All of the objects are expected to have non-NULL init
1651 * functions.
1652 */
1653static void
1654objlist_call_init(Objlist *list, int *lockstate)
1655{
1656 Objlist_Entry *elm;
1657 Obj_Entry *obj;
1658 char *saved_msg;
1659
1660 /*
1661 * Clean init_scanned flag so that objects can be rechecked and
1662 * possibly initialized earlier if any of vectors called below
1663 * cause the change by using dlopen.
1664 */
1665 for (obj = obj_list; obj != NULL; obj = obj->next)
1666 obj->init_scanned = false;
1667
1668 /*
1669 * Preserve the current error message since an init function might
1670 * call into the dynamic linker and overwrite it.
1671 */
1672 saved_msg = errmsg_save();
1673 STAILQ_FOREACH(elm, list, link) {
1674 if (elm->obj->init_done) /* Initialized early. */
1675 continue;
1676 dbg("calling init function for %s at %p", elm->obj->path,
1677 (void *)elm->obj->init);
1678 LD_UTRACE(UTRACE_INIT_CALL, elm->obj, (void *)elm->obj->init, 0, 0,
1679 elm->obj->path);
1680 /*
1681 * Race: other thread might try to use this object before current
1682 * one completes the initilization. Not much can be done here
1683 * without better locking.
1684 */
1685 elm->obj->init_done = true;
1686 wlock_release(rtld_bind_lock, *lockstate);
1687 call_initfini_pointer(elm->obj, elm->obj->init);
1688 *lockstate = wlock_acquire(rtld_bind_lock);
1689 }
1690 errmsg_restore(saved_msg);
1691}
1692
1693static void
1694objlist_clear(Objlist *list)
1695{
1696 Objlist_Entry *elm;
1697
1698 while (!STAILQ_EMPTY(list)) {
1699 elm = STAILQ_FIRST(list);
1700 STAILQ_REMOVE_HEAD(list, link);
1701 free(elm);
1702 }
1703}
1704
1705static Objlist_Entry *
1706objlist_find(Objlist *list, const Obj_Entry *obj)
1707{
1708 Objlist_Entry *elm;
1709
1710 STAILQ_FOREACH(elm, list, link)
1711 if (elm->obj == obj)
1712 return elm;
1713 return NULL;
1714}
1715
1716static void
1717objlist_init(Objlist *list)
1718{
1719 STAILQ_INIT(list);
1720}
1721
1722static void
1723objlist_push_head(Objlist *list, Obj_Entry *obj)
1724{
1725 Objlist_Entry *elm;
1726
1727 elm = NEW(Objlist_Entry);
1728 elm->obj = obj;
1729 STAILQ_INSERT_HEAD(list, elm, link);
1730}
1731
1732static void
1733objlist_push_tail(Objlist *list, Obj_Entry *obj)
1734{
1735 Objlist_Entry *elm;
1736
1737 elm = NEW(Objlist_Entry);
1738 elm->obj = obj;
1739 STAILQ_INSERT_TAIL(list, elm, link);
1740}
1741
1742static void
1743objlist_remove(Objlist *list, Obj_Entry *obj)
1744{
1745 Objlist_Entry *elm;
1746
1747 if ((elm = objlist_find(list, obj)) != NULL) {
1748 STAILQ_REMOVE(list, elm, Struct_Objlist_Entry, link);
1749 free(elm);
1750 }
1751}
1752
1753/*
1754 * Relocate newly-loaded shared objects. The argument is a pointer to
1755 * the Obj_Entry for the first such object. All objects from the first
1756 * to the end of the list of objects are relocated. Returns 0 on success,
1757 * or -1 on failure.
1758 */
1759static int
1760relocate_objects(Obj_Entry *first, bool bind_now, Obj_Entry *rtldobj)
1761{
1762 Obj_Entry *obj;
1763
1764 for (obj = first; obj != NULL; obj = obj->next) {
1765 if (obj != rtldobj)
1766 dbg("relocating \"%s\"", obj->path);
1767 if (obj->nbuckets == 0 || obj->nchains == 0 || obj->buckets == NULL ||
1768 obj->symtab == NULL || obj->strtab == NULL) {
1769 _rtld_error("%s: Shared object has no run-time symbol table",
1770 obj->path);
1771 return -1;
1772 }
1773
1774 if (obj->textrel) {
1775 /* There are relocations to the write-protected text segment. */
1776 if (mprotect(obj->mapbase, obj->textsize,
1777 PROT_READ|PROT_WRITE|PROT_EXEC) == -1) {
1778 _rtld_error("%s: Cannot write-enable text segment: %s",
1779 obj->path, strerror(errno));
1780 return -1;
1781 }
1782 }
1783
1784 /* Process the non-PLT relocations. */
1785 if (reloc_non_plt(obj, rtldobj))
1786 return -1;
1787
1788 if (obj->textrel) { /* Re-protected the text segment. */
1789 if (mprotect(obj->mapbase, obj->textsize,
1790 PROT_READ|PROT_EXEC) == -1) {
1791 _rtld_error("%s: Cannot write-protect text segment: %s",
1792 obj->path, strerror(errno));
1793 return -1;
1794 }
1795 }
1796
1797 /* Process the PLT relocations. */
1798 if (reloc_plt(obj) == -1)
1799 return -1;
1800 /* Relocate the jump slots if we are doing immediate binding. */
1801 if (obj->bind_now || bind_now)
1802 if (reloc_jmpslots(obj) == -1)
1803 return -1;
1804
1805
1806 /*
1807 * Set up the magic number and version in the Obj_Entry. These
1808 * were checked in the crt1.o from the original ElfKit, so we
1809 * set them for backward compatibility.
1810 */
1811 obj->magic = RTLD_MAGIC;
1812 obj->version = RTLD_VERSION;
1813
1814 /* Set the special PLT or GOT entries. */
1815 init_pltgot(obj);
1816 }
1817
1818 return 0;
1819}
1820
1821/*
1822 * Cleanup procedure. It will be called (by the atexit mechanism) just
1823 * before the process exits.
1824 */
1825static void
1826rtld_exit(void)
1827{
1828 int lockstate;
1829
1830 lockstate = wlock_acquire(rtld_bind_lock);
1831 dbg("rtld_exit()");
1832 objlist_call_fini(&list_fini, true, &lockstate);
1833 /* No need to remove the items from the list, since we are exiting. */
1834 if (!libmap_disable)
1835 lm_fini();
1836 wlock_release(rtld_bind_lock, lockstate);
1837}
1838
1839static void *
1840path_enumerate(const char *path, path_enum_proc callback, void *arg)
1841{
1842#ifdef COMPAT_32BIT
1843 const char *trans;
1844#endif
1845 if (path == NULL)
1846 return (NULL);
1847
1848 path += strspn(path, ":;");
1849 while (*path != '\0') {
1850 size_t len;
1851 char *res;
1852
1853 len = strcspn(path, ":;");
1854#ifdef COMPAT_32BIT
1855 trans = lm_findn(NULL, path, len);
1856 if (trans)
1857 res = callback(trans, strlen(trans), arg);
1858 else
1859#endif
1860 res = callback(path, len, arg);
1861
1862 if (res != NULL)
1863 return (res);
1864
1865 path += len;
1866 path += strspn(path, ":;");
1867 }
1868
1869 return (NULL);
1870}
1871
1872struct try_library_args {
1873 const char *name;
1874 size_t namelen;
1875 char *buffer;
1876 size_t buflen;
1877};
1878
1879static void *
1880try_library_path(const char *dir, size_t dirlen, void *param)
1881{
1882 struct try_library_args *arg;
1883
1884 arg = param;
1885 if (*dir == '/' || trust) {
1886 char *pathname;
1887
1888 if (dirlen + 1 + arg->namelen + 1 > arg->buflen)
1889 return (NULL);
1890
1891 pathname = arg->buffer;
1892 strncpy(pathname, dir, dirlen);
1893 pathname[dirlen] = '/';
1894 strcpy(pathname + dirlen + 1, arg->name);
1895
1896 dbg(" Trying \"%s\"", pathname);
1897 if (access(pathname, F_OK) == 0) { /* We found it */
1898 pathname = xmalloc(dirlen + 1 + arg->namelen + 1);
1899 strcpy(pathname, arg->buffer);
1900 return (pathname);
1901 }
1902 }
1903 return (NULL);
1904}
1905
1906static char *
1907search_library_path(const char *name, const char *path)
1908{
1909 char *p;
1910 struct try_library_args arg;
1911
1912 if (path == NULL)
1913 return NULL;
1914
1915 arg.name = name;
1916 arg.namelen = strlen(name);
1917 arg.buffer = xmalloc(PATH_MAX);
1918 arg.buflen = PATH_MAX;
1919
1920 p = path_enumerate(path, try_library_path, &arg);
1921
1922 free(arg.buffer);
1923
1924 return (p);
1925}
1926
1927int
1928dlclose(void *handle)
1929{
1930 Obj_Entry *root;
1931 int lockstate;
1932
1933 lockstate = wlock_acquire(rtld_bind_lock);
1934 root = dlcheck(handle);
1935 if (root == NULL) {
1936 wlock_release(rtld_bind_lock, lockstate);
1937 return -1;
1938 }
1939 LD_UTRACE(UTRACE_DLCLOSE_START, handle, NULL, 0, root->dl_refcount,
1940 root->path);
1941
1942 /* Unreference the object and its dependencies. */
1943 root->dl_refcount--;
1944
1945 unref_dag(root);
1946
1947 if (root->refcount == 0) {
1948 /*
1949 * The object is no longer referenced, so we must unload it.
1950 * First, call the fini functions.
1951 */
1952 objlist_call_fini(&list_fini, false, &lockstate);
1953
1954 /* Finish cleaning up the newly-unreferenced objects. */
1955 GDB_STATE(RT_DELETE,&root->linkmap);
1956 unload_object(root);
1957 GDB_STATE(RT_CONSISTENT,NULL);
1958 }
1959 LD_UTRACE(UTRACE_DLCLOSE_STOP, handle, NULL, 0, 0, NULL);
1960 wlock_release(rtld_bind_lock, lockstate);
1961 return 0;
1962}
1963
1964char *
1965dlerror(void)
1966{
1967 char *msg = error_message;
1968 error_message = NULL;
1969 return msg;
1970}
1971
1972/*
1973 * This function is deprecated and has no effect.
1974 */
1975void
1976dllockinit(void *context,
1977 void *(*lock_create)(void *context),
1978 void (*rlock_acquire)(void *lock),
1979 void (*wlock_acquire)(void *lock),
1980 void (*lock_release)(void *lock),
1981 void (*lock_destroy)(void *lock),
1982 void (*context_destroy)(void *context))
1983{
1984 static void *cur_context;
1985 static void (*cur_context_destroy)(void *);
1986
1987 /* Just destroy the context from the previous call, if necessary. */
1988 if (cur_context_destroy != NULL)
1989 cur_context_destroy(cur_context);
1990 cur_context = context;
1991 cur_context_destroy = context_destroy;
1992}
1993
1994void *
1995dlopen(const char *name, int mode)
1996{
1997 Obj_Entry **old_obj_tail;
1998 Obj_Entry *obj;
1999 Objlist initlist;
2000 int result, lockstate, nodelete, lo_flags;
2001
2002 LD_UTRACE(UTRACE_DLOPEN_START, NULL, NULL, 0, mode, name);
2003 ld_tracing = (mode & RTLD_TRACE) == 0 ? NULL : "1";
2004 if (ld_tracing != NULL)
2005 environ = (char **)*get_program_var_addr("environ");
2006 nodelete = mode & RTLD_NODELETE;
2007 lo_flags = RTLD_LO_DLOPEN;
2008 if (mode & RTLD_NOLOAD)
2009 lo_flags |= RTLD_LO_NOLOAD;
2010 if (ld_tracing != NULL)
2011 lo_flags |= RTLD_LO_TRACE;
2012
2013 objlist_init(&initlist);
2014
2015 lockstate = wlock_acquire(rtld_bind_lock);
2016 GDB_STATE(RT_ADD,NULL);
2017
2018 old_obj_tail = obj_tail;
2019 obj = NULL;
2020 if (name == NULL) {
2021 obj = obj_main;
2022 obj->refcount++;
2023 } else {
2024 obj = load_object(name, obj_main, lo_flags);
2025 }
2026
2027 if (obj) {
2028 obj->dl_refcount++;
2029 if (mode & RTLD_GLOBAL && objlist_find(&list_global, obj) == NULL)
2030 objlist_push_tail(&list_global, obj);
2031 mode &= RTLD_MODEMASK;
2032 if (*old_obj_tail != NULL) { /* We loaded something new. */
2033 assert(*old_obj_tail == obj);
2034 result = load_needed_objects(obj, RTLD_LO_DLOPEN);
2035 init_dag(obj);
2036 if (result != -1)
2037 result = rtld_verify_versions(&obj->dagmembers);
2038 if (result != -1 && ld_tracing)
2039 goto trace;
2040 if (result == -1 ||
2041 (relocate_objects(obj, mode == RTLD_NOW, &obj_rtld)) == -1) {
2042 obj->dl_refcount--;
2043 unref_dag(obj);
2044 if (obj->refcount == 0)
2045 unload_object(obj);
2046 obj = NULL;
2047 } else {
2048 /* Make list of init functions to call. */
2049 initlist_add_objects(obj, &obj->next, &initlist);
2050 }
2051 } else {
2052
2053 /* Bump the reference counts for objects on this DAG. */
2054 ref_dag(obj);
2055
2056 if (ld_tracing)
2057 goto trace;
2058 }
2059 if (obj != NULL && (nodelete || obj->z_nodelete) && !obj->ref_nodel) {
2060 dbg("obj %s nodelete", obj->path);
2061 ref_dag(obj);
2062 obj->z_nodelete = obj->ref_nodel = true;
2063 }
2064 }
2065
2066 LD_UTRACE(UTRACE_DLOPEN_STOP, obj, NULL, 0, obj ? obj->dl_refcount : 0,
2067 name);
2068 GDB_STATE(RT_CONSISTENT,obj ? &obj->linkmap : NULL);
2069
2070 /* Call the init functions. */
2071 objlist_call_init(&initlist, &lockstate);
2072 objlist_clear(&initlist);
2073 wlock_release(rtld_bind_lock, lockstate);
2074 return obj;
2075trace:
2076 trace_loaded_objects(obj);
2077 wlock_release(rtld_bind_lock, lockstate);
2078 exit(0);
2079}
2080
2081static void *
2082do_dlsym(void *handle, const char *name, void *retaddr, const Ver_Entry *ve,
2083 int flags)
2084{
2085 DoneList donelist;
2086 const Obj_Entry *obj, *defobj;
2087 const Elf_Sym *def, *symp;
2088 unsigned long hash;
2089 int lockstate;
2090
2091 hash = elf_hash(name);
2092 def = NULL;
2093 defobj = NULL;
2094 flags |= SYMLOOK_IN_PLT;
2095
2096 lockstate = rlock_acquire(rtld_bind_lock);
2097 if (handle == NULL || handle == RTLD_NEXT ||
2098 handle == RTLD_DEFAULT || handle == RTLD_SELF) {
2099
2100 if ((obj = obj_from_addr(retaddr)) == NULL) {
2101 _rtld_error("Cannot determine caller's shared object");
2102 rlock_release(rtld_bind_lock, lockstate);
2103 return NULL;
2104 }
2105 if (handle == NULL) { /* Just the caller's shared object. */
2106 def = symlook_obj(name, hash, obj, ve, flags);
2107 defobj = obj;
2108 } else if (handle == RTLD_NEXT || /* Objects after caller's */
2109 handle == RTLD_SELF) { /* ... caller included */
2110 if (handle == RTLD_NEXT)
2111 obj = obj->next;
2112 for (; obj != NULL; obj = obj->next) {
2113 if ((symp = symlook_obj(name, hash, obj, ve, flags)) != NULL) {
2114 if (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK) {
2115 def = symp;
2116 defobj = obj;
2117 if (ELF_ST_BIND(def->st_info) != STB_WEAK)
2118 break;
2119 }
2120 }
2121 }
2122 /*
2123 * Search the dynamic linker itself, and possibly resolve the
2124 * symbol from there. This is how the application links to
2125 * dynamic linker services such as dlopen. Only the values listed
2126 * in the "exports" array can be resolved from the dynamic linker.
2127 */
2128 if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) {
2129 symp = symlook_obj(name, hash, &obj_rtld, ve, flags);
2130 if (symp != NULL && is_exported(symp)) {
2131 def = symp;
2132 defobj = &obj_rtld;
2133 }
2134 }
2135 } else {
2136 assert(handle == RTLD_DEFAULT);
2137 def = symlook_default(name, hash, obj, &defobj, ve, flags);
2138 }
2139 } else {
2140 if ((obj = dlcheck(handle)) == NULL) {
2141 rlock_release(rtld_bind_lock, lockstate);
2142 return NULL;
2143 }
2144
2145 donelist_init(&donelist);
2146 if (obj->mainprog) {
2147 /* Search main program and all libraries loaded by it. */
2148 def = symlook_list(name, hash, &list_main, &defobj, ve, flags,
2149 &donelist);
2150
2151 /*
2152 * We do not distinguish between 'main' object and global scope.
2153 * If symbol is not defined by objects loaded at startup, continue
2154 * search among dynamically loaded objects with RTLD_GLOBAL
2155 * scope.
2156 */
2157 if (def == NULL)
2158 def = symlook_list(name, hash, &list_global, &defobj, ve,
2159 flags, &donelist);
2160 } else {
2161 Needed_Entry fake;
2162
2163 /* Search the whole DAG rooted at the given object. */
2164 fake.next = NULL;
2165 fake.obj = (Obj_Entry *)obj;
2166 fake.name = 0;
2167 def = symlook_needed(name, hash, &fake, &defobj, ve, flags,
2168 &donelist);
2169 }
2170 }
2171
2172 if (def != NULL) {
2173 rlock_release(rtld_bind_lock, lockstate);
2174
2175 /*
2176 * The value required by the caller is derived from the value
2177 * of the symbol. For the ia64 architecture, we need to
2178 * construct a function descriptor which the caller can use to
2179 * call the function with the right 'gp' value. For other
2180 * architectures and for non-functions, the value is simply
2181 * the relocated value of the symbol.
2182 */
2183 if (ELF_ST_TYPE(def->st_info) == STT_FUNC)
2184 return make_function_pointer(def, defobj);
2185 else
2186 return defobj->relocbase + def->st_value;
2187 }
2188
2189 _rtld_error("Undefined symbol \"%s\"", name);
2190 rlock_release(rtld_bind_lock, lockstate);
2191 return NULL;
2192}
2193
2194void *
2195dlsym(void *handle, const char *name)
2196{
2197 return do_dlsym(handle, name, __builtin_return_address(0), NULL,
2198 SYMLOOK_DLSYM);
2199}
2200
2201dlfunc_t
2202dlfunc(void *handle, const char *name)
2203{
2204 union {
2205 void *d;
2206 dlfunc_t f;
2207 } rv;
2208
2209 rv.d = do_dlsym(handle, name, __builtin_return_address(0), NULL,
2210 SYMLOOK_DLSYM);
2211 return (rv.f);
2212}
2213
2214void *
2215dlvsym(void *handle, const char *name, const char *version)
2216{
2217 Ver_Entry ventry;
2218
2219 ventry.name = version;
2220 ventry.file = NULL;
2221 ventry.hash = elf_hash(version);
2222 ventry.flags= 0;
2223 return do_dlsym(handle, name, __builtin_return_address(0), &ventry,
2224 SYMLOOK_DLSYM);
2225}
2226
2227int
2228dladdr(const void *addr, Dl_info *info)
2229{
2230 const Obj_Entry *obj;
2231 const Elf_Sym *def;
2232 void *symbol_addr;
2233 unsigned long symoffset;
2234 int lockstate;
2235
2236 lockstate = rlock_acquire(rtld_bind_lock);
2237 obj = obj_from_addr(addr);
2238 if (obj == NULL) {
2239 _rtld_error("No shared object contains address");
2240 rlock_release(rtld_bind_lock, lockstate);
2241 return 0;
2242 }
2243 info->dli_fname = obj->path;
2244 info->dli_fbase = obj->mapbase;
2245 info->dli_saddr = (void *)0;
2246 info->dli_sname = NULL;
2247
2248 /*
2249 * Walk the symbol list looking for the symbol whose address is
2250 * closest to the address sent in.
2251 */
2252 for (symoffset = 0; symoffset < obj->nchains; symoffset++) {
2253 def = obj->symtab + symoffset;
2254
2255 /*
2256 * For skip the symbol if st_shndx is either SHN_UNDEF or
2257 * SHN_COMMON.
2258 */
2259 if (def->st_shndx == SHN_UNDEF || def->st_shndx == SHN_COMMON)
2260 continue;
2261
2262 /*
2263 * If the symbol is greater than the specified address, or if it
2264 * is further away from addr than the current nearest symbol,
2265 * then reject it.
2266 */
2267 symbol_addr = obj->relocbase + def->st_value;
2268 if (symbol_addr > addr || symbol_addr < info->dli_saddr)
2269 continue;
2270
2271 /* Update our idea of the nearest symbol. */
2272 info->dli_sname = obj->strtab + def->st_name;
2273 info->dli_saddr = symbol_addr;
2274
2275 /* Exact match? */
2276 if (info->dli_saddr == addr)
2277 break;
2278 }
2279 rlock_release(rtld_bind_lock, lockstate);
2280 return 1;
2281}
2282
2283int
2284dlinfo(void *handle, int request, void *p)
2285{
2286 const Obj_Entry *obj;
2287 int error, lockstate;
2288
2289 lockstate = rlock_acquire(rtld_bind_lock);
2290
2291 if (handle == NULL || handle == RTLD_SELF) {
2292 void *retaddr;
2293
2294 retaddr = __builtin_return_address(0); /* __GNUC__ only */
2295 if ((obj = obj_from_addr(retaddr)) == NULL)
2296 _rtld_error("Cannot determine caller's shared object");
2297 } else
2298 obj = dlcheck(handle);
2299
2300 if (obj == NULL) {
2301 rlock_release(rtld_bind_lock, lockstate);
2302 return (-1);
2303 }
2304
2305 error = 0;
2306 switch (request) {
2307 case RTLD_DI_LINKMAP:
2308 *((struct link_map const **)p) = &obj->linkmap;
2309 break;
2310 case RTLD_DI_ORIGIN:
2311 error = rtld_dirname(obj->path, p);
2312 break;
2313
2314 case RTLD_DI_SERINFOSIZE:
2315 case RTLD_DI_SERINFO:
2316 error = do_search_info(obj, request, (struct dl_serinfo *)p);
2317 break;
2318
2319 default:
2320 _rtld_error("Invalid request %d passed to dlinfo()", request);
2321 error = -1;
2322 }
2323
2324 rlock_release(rtld_bind_lock, lockstate);
2325
2326 return (error);
2327}
2328
2329int
2330dl_iterate_phdr(__dl_iterate_hdr_callback callback, void *param)
2331{
2332 struct dl_phdr_info phdr_info;
2333 const Obj_Entry *obj;
2334 int error, bind_lockstate, phdr_lockstate;
2335
2336 phdr_lockstate = wlock_acquire(rtld_phdr_lock);
2337 bind_lockstate = rlock_acquire(rtld_bind_lock);
2338
2339 error = 0;
2340
2341 for (obj = obj_list; obj != NULL; obj = obj->next) {
2342 phdr_info.dlpi_addr = (Elf_Addr)obj->relocbase;
2343 phdr_info.dlpi_name = STAILQ_FIRST(&obj->names) ?
2344 STAILQ_FIRST(&obj->names)->name : obj->path;
2345 phdr_info.dlpi_phdr = obj->phdr;
2346 phdr_info.dlpi_phnum = obj->phsize / sizeof(obj->phdr[0]);
2347 phdr_info.dlpi_tls_modid = obj->tlsindex;
2348 phdr_info.dlpi_tls_data = obj->tlsinit;
2349 phdr_info.dlpi_adds = obj_loads;
2350 phdr_info.dlpi_subs = obj_loads - obj_count;
2351
2352 if ((error = callback(&phdr_info, sizeof phdr_info, param)) != 0)
2353 break;
2354
2355 }
2356 rlock_release(rtld_bind_lock, bind_lockstate);
2357 wlock_release(rtld_phdr_lock, phdr_lockstate);
2358
2359 return (error);
2360}
2361
2362struct fill_search_info_args {
2363 int request;
2364 unsigned int flags;
2365 Dl_serinfo *serinfo;
2366 Dl_serpath *serpath;
2367 char *strspace;
2368};
2369
2370static void *
2371fill_search_info(const char *dir, size_t dirlen, void *param)
2372{
2373 struct fill_search_info_args *arg;
2374
2375 arg = param;
2376
2377 if (arg->request == RTLD_DI_SERINFOSIZE) {
2378 arg->serinfo->dls_cnt ++;
2379 arg->serinfo->dls_size += sizeof(Dl_serpath) + dirlen + 1;
2380 } else {
2381 struct dl_serpath *s_entry;
2382
2383 s_entry = arg->serpath;
2384 s_entry->dls_name = arg->strspace;
2385 s_entry->dls_flags = arg->flags;
2386
2387 strncpy(arg->strspace, dir, dirlen);
2388 arg->strspace[dirlen] = '\0';
2389
2390 arg->strspace += dirlen + 1;
2391 arg->serpath++;
2392 }
2393
2394 return (NULL);
2395}
2396
2397static int
2398do_search_info(const Obj_Entry *obj, int request, struct dl_serinfo *info)
2399{
2400 struct dl_serinfo _info;
2401 struct fill_search_info_args args;
2402
2403 args.request = RTLD_DI_SERINFOSIZE;
2404 args.serinfo = &_info;
2405
2406 _info.dls_size = __offsetof(struct dl_serinfo, dls_serpath);
2407 _info.dls_cnt = 0;
2408
2409 path_enumerate(ld_library_path, fill_search_info, &args);
2410 path_enumerate(obj->rpath, fill_search_info, &args);
2411 path_enumerate(gethints(), fill_search_info, &args);
2412 path_enumerate(STANDARD_LIBRARY_PATH, fill_search_info, &args);
2413
2414
2415 if (request == RTLD_DI_SERINFOSIZE) {
2416 info->dls_size = _info.dls_size;
2417 info->dls_cnt = _info.dls_cnt;
2418 return (0);
2419 }
2420
2421 if (info->dls_cnt != _info.dls_cnt || info->dls_size != _info.dls_size) {
2422 _rtld_error("Uninitialized Dl_serinfo struct passed to dlinfo()");
2423 return (-1);
2424 }
2425
2426 args.request = RTLD_DI_SERINFO;
2427 args.serinfo = info;
2428 args.serpath = &info->dls_serpath[0];
2429 args.strspace = (char *)&info->dls_serpath[_info.dls_cnt];
2430
2431 args.flags = LA_SER_LIBPATH;
2432 if (path_enumerate(ld_library_path, fill_search_info, &args) != NULL)
2433 return (-1);
2434
2435 args.flags = LA_SER_RUNPATH;
2436 if (path_enumerate(obj->rpath, fill_search_info, &args) != NULL)
2437 return (-1);
2438
2439 args.flags = LA_SER_CONFIG;
2440 if (path_enumerate(gethints(), fill_search_info, &args) != NULL)
2441 return (-1);
2442
2443 args.flags = LA_SER_DEFAULT;
2444 if (path_enumerate(STANDARD_LIBRARY_PATH, fill_search_info, &args) != NULL)
2445 return (-1);
2446 return (0);
2447}
2448
2449static int
2450rtld_dirname(const char *path, char *bname)
2451{
2452 const char *endp;
2453
2454 /* Empty or NULL string gets treated as "." */
2455 if (path == NULL || *path == '\0') {
2456 bname[0] = '.';
2457 bname[1] = '\0';
2458 return (0);
2459 }
2460
2461 /* Strip trailing slashes */
2462 endp = path + strlen(path) - 1;
2463 while (endp > path && *endp == '/')
2464 endp--;
2465
2466 /* Find the start of the dir */
2467 while (endp > path && *endp != '/')
2468 endp--;
2469
2470 /* Either the dir is "/" or there are no slashes */
2471 if (endp == path) {
2472 bname[0] = *endp == '/' ? '/' : '.';
2473 bname[1] = '\0';
2474 return (0);
2475 } else {
2476 do {
2477 endp--;
2478 } while (endp > path && *endp == '/');
2479 }
2480
2481 if (endp - path + 2 > PATH_MAX)
2482 {
2483 _rtld_error("Filename is too long: %s", path);
2484 return(-1);
2485 }
2486
2487 strncpy(bname, path, endp - path + 1);
2488 bname[endp - path + 1] = '\0';
2489 return (0);
2490}
2491
2492static int
2493rtld_dirname_abs(const char *path, char *base)
2494{
2495 char base_rel[PATH_MAX];
2496
2497 if (rtld_dirname(path, base) == -1)
2498 return (-1);
2499 if (base[0] == '/')
2500 return (0);
2501 if (getcwd(base_rel, sizeof(base_rel)) == NULL ||
2502 strlcat(base_rel, "/", sizeof(base_rel)) >= sizeof(base_rel) ||
2503 strlcat(base_rel, base, sizeof(base_rel)) >= sizeof(base_rel))
2504 return (-1);
2505 strcpy(base, base_rel);
2506 return (0);
2507}
2508
2509static void
2510linkmap_add(Obj_Entry *obj)
2511{
2512 struct link_map *l = &obj->linkmap;
2513 struct link_map *prev;
2514
2515 obj->linkmap.l_name = obj->path;
2516 obj->linkmap.l_addr = obj->mapbase;
2517 obj->linkmap.l_ld = obj->dynamic;
2518#ifdef __mips__
2519 /* GDB needs load offset on MIPS to use the symbols */
2520 obj->linkmap.l_offs = obj->relocbase;
2521#endif
2522
2523 if (r_debug.r_map == NULL) {
2524 r_debug.r_map = l;
2525 return;
2526 }
2527
2528 /*
2529 * Scan to the end of the list, but not past the entry for the
2530 * dynamic linker, which we want to keep at the very end.
2531 */
2532 for (prev = r_debug.r_map;
2533 prev->l_next != NULL && prev->l_next != &obj_rtld.linkmap;
2534 prev = prev->l_next)
2535 ;
2536
2537 /* Link in the new entry. */
2538 l->l_prev = prev;
2539 l->l_next = prev->l_next;
2540 if (l->l_next != NULL)
2541 l->l_next->l_prev = l;
2542 prev->l_next = l;
2543}
2544
2545static void
2546linkmap_delete(Obj_Entry *obj)
2547{
2548 struct link_map *l = &obj->linkmap;
2549
2550 if (l->l_prev == NULL) {
2551 if ((r_debug.r_map = l->l_next) != NULL)
2552 l->l_next->l_prev = NULL;
2553 return;
2554 }
2555
2556 if ((l->l_prev->l_next = l->l_next) != NULL)
2557 l->l_next->l_prev = l->l_prev;
2558}
2559
2560/*
2561 * Function for the debugger to set a breakpoint on to gain control.
2562 *
2563 * The two parameters allow the debugger to easily find and determine
2564 * what the runtime loader is doing and to whom it is doing it.
2565 *
2566 * When the loadhook trap is hit (r_debug_state, set at program
2567 * initialization), the arguments can be found on the stack:
2568 *
2569 * +8 struct link_map *m
2570 * +4 struct r_debug *rd
2571 * +0 RetAddr
2572 */
2573void
2574r_debug_state(struct r_debug* rd, struct link_map *m)
2575{
2576}
2577
2578/*
2579 * Get address of the pointer variable in the main program.
2580 */
2581static const void **
2582get_program_var_addr(const char *name)
2583{
2584 const Obj_Entry *obj;
2585 unsigned long hash;
2586
2587 hash = elf_hash(name);
2588 for (obj = obj_main; obj != NULL; obj = obj->next) {
2589 const Elf_Sym *def;
2590
2591 if ((def = symlook_obj(name, hash, obj, NULL, 0)) != NULL) {
2592 const void **addr;
2593
2594 addr = (const void **)(obj->relocbase + def->st_value);
2595 return addr;
2596 }
2597 }
2598 return NULL;
2599}
2600
2601/*
2602 * Set a pointer variable in the main program to the given value. This
2603 * is used to set key variables such as "environ" before any of the
2604 * init functions are called.
2605 */
2606static void
2607set_program_var(const char *name, const void *value)
2608{
2609 const void **addr;
2610
2611 if ((addr = get_program_var_addr(name)) != NULL) {
2612 dbg("\"%s\": *%p <-- %p", name, addr, value);
2613 *addr = value;
2614 }
2615}
2616
2617/*
2618 * Given a symbol name in a referencing object, find the corresponding
2619 * definition of the symbol. Returns a pointer to the symbol, or NULL if
2620 * no definition was found. Returns a pointer to the Obj_Entry of the
2621 * defining object via the reference parameter DEFOBJ_OUT.
2622 */
2623static const Elf_Sym *
2624symlook_default(const char *name, unsigned long hash, const Obj_Entry *refobj,
2625 const Obj_Entry **defobj_out, const Ver_Entry *ventry, int flags)
2626{
2627 DoneList donelist;
2628 const Elf_Sym *def;
2629 const Elf_Sym *symp;
2630 const Obj_Entry *obj;
2631 const Obj_Entry *defobj;
2632 const Objlist_Entry *elm;
2633 def = NULL;
2634 defobj = NULL;
2635 donelist_init(&donelist);
2636
2637 /* Look first in the referencing object if linked symbolically. */
2638 if (refobj->symbolic && !donelist_check(&donelist, refobj)) {
2639 symp = symlook_obj(name, hash, refobj, ventry, flags);
2640 if (symp != NULL) {
2641 def = symp;
2642 defobj = refobj;
2643 }
2644 }
2645
2646 /* Search all objects loaded at program start up. */
2647 if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) {
2648 symp = symlook_list(name, hash, &list_main, &obj, ventry, flags,
2649 &donelist);
2650 if (symp != NULL &&
2651 (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) {
2652 def = symp;
2653 defobj = obj;
2654 }
2655 }
2656
2657 /* Search all DAGs whose roots are RTLD_GLOBAL objects. */
2658 STAILQ_FOREACH(elm, &list_global, link) {
2659 if (def != NULL && ELF_ST_BIND(def->st_info) != STB_WEAK)
2660 break;
2661 symp = symlook_list(name, hash, &elm->obj->dagmembers, &obj, ventry,
2662 flags, &donelist);
2663 if (symp != NULL &&
2664 (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) {
2665 def = symp;
2666 defobj = obj;
2667 }
2668 }
2669
2670 /* Search all dlopened DAGs containing the referencing object. */
2671 STAILQ_FOREACH(elm, &refobj->dldags, link) {
2672 if (def != NULL && ELF_ST_BIND(def->st_info) != STB_WEAK)
2673 break;
2674 symp = symlook_list(name, hash, &elm->obj->dagmembers, &obj, ventry,
2675 flags, &donelist);
2676 if (symp != NULL &&
2677 (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) {
2678 def = symp;
2679 defobj = obj;
2680 }
2681 }
2682
2683 /*
2684 * Search the dynamic linker itself, and possibly resolve the
2685 * symbol from there. This is how the application links to
2686 * dynamic linker services such as dlopen. Only the values listed
2687 * in the "exports" array can be resolved from the dynamic linker.
2688 */
2689 if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) {
2690 symp = symlook_obj(name, hash, &obj_rtld, ventry, flags);
2691 if (symp != NULL && is_exported(symp)) {
2692 def = symp;
2693 defobj = &obj_rtld;
2694 }
2695 }
2696
2697 if (def != NULL)
2698 *defobj_out = defobj;
2699 return def;
2700}
2701
2702static const Elf_Sym *
2703symlook_list(const char *name, unsigned long hash, const Objlist *objlist,
2704 const Obj_Entry **defobj_out, const Ver_Entry *ventry, int flags,
2705 DoneList *dlp)
2706{
2707 const Elf_Sym *symp;
2708 const Elf_Sym *def;
2709 const Obj_Entry *defobj;
2710 const Objlist_Entry *elm;
2711
2712 def = NULL;
2713 defobj = NULL;
2714 STAILQ_FOREACH(elm, objlist, link) {
2715 if (donelist_check(dlp, elm->obj))
2716 continue;
2717 if ((symp = symlook_obj(name, hash, elm->obj, ventry, flags)) != NULL) {
2718 if (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK) {
2719 def = symp;
2720 defobj = elm->obj;
2721 if (ELF_ST_BIND(def->st_info) != STB_WEAK)
2722 break;
2723 }
2724 }
2725 }
2726 if (def != NULL)
2727 *defobj_out = defobj;
2728 return def;
2729}
2730
2731/*
2732 * Search the symbol table of a shared object and all objects needed
2733 * by it for a symbol of the given name. Search order is
2734 * breadth-first. Returns a pointer to the symbol, or NULL if no
2735 * definition was found.
2736 */
2737static const Elf_Sym *
2738symlook_needed(const char *name, unsigned long hash, const Needed_Entry *needed,
2739 const Obj_Entry **defobj_out, const Ver_Entry *ventry, int flags,
2740 DoneList *dlp)
2741{
2742 const Elf_Sym *def, *def_w;
2743 const Needed_Entry *n;
2744 const Obj_Entry *obj, *defobj, *defobj1;
2745
2746 def = def_w = NULL;
2747 defobj = NULL;
2748 for (n = needed; n != NULL; n = n->next) {
2749 if ((obj = n->obj) == NULL ||
2750 donelist_check(dlp, obj) ||
2751 (def = symlook_obj(name, hash, obj, ventry, flags)) == NULL)
2752 continue;
2753 defobj = obj;
2754 if (ELF_ST_BIND(def->st_info) != STB_WEAK) {
2755 *defobj_out = defobj;
2756 return (def);
2757 }
2758 }
2759 /*
2760 * There we come when either symbol definition is not found in
2761 * directly needed objects, or found symbol is weak.
2762 */
2763 for (n = needed; n != NULL; n = n->next) {
2764 if ((obj = n->obj) == NULL)
2765 continue;
2766 def_w = symlook_needed(name, hash, obj->needed, &defobj1,
2767 ventry, flags, dlp);
2768 if (def_w == NULL)
2769 continue;
2770 if (def == NULL || ELF_ST_BIND(def_w->st_info) != STB_WEAK) {
2771 def = def_w;
2772 defobj = defobj1;
2773 }
2774 if (ELF_ST_BIND(def_w->st_info) != STB_WEAK)
2775 break;
2776 }
2777 if (def != NULL)
2778 *defobj_out = defobj;
2779 return (def);
2780}
2781
2782/*
2783 * Search the symbol table of a single shared object for a symbol of
2784 * the given name and version, if requested. Returns a pointer to the
2785 * symbol, or NULL if no definition was found.
2786 *
2787 * The symbol's hash value is passed in for efficiency reasons; that
2788 * eliminates many recomputations of the hash value.
2789 */
2790const Elf_Sym *
2791symlook_obj(const char *name, unsigned long hash, const Obj_Entry *obj,
2792 const Ver_Entry *ventry, int flags)
2793{
2794 unsigned long symnum;
2795 const Elf_Sym *vsymp;
2796 Elf_Versym verndx;
2797 int vcount;
2798
2799 if (obj->buckets == NULL)
2800 return NULL;
2801
2802 vsymp = NULL;
2803 vcount = 0;
2804 symnum = obj->buckets[hash % obj->nbuckets];
2805
2806 for (; symnum != STN_UNDEF; symnum = obj->chains[symnum]) {
2807 const Elf_Sym *symp;
2808 const char *strp;
2809
2810 if (symnum >= obj->nchains)
2811 return NULL; /* Bad object */
2812
2813 symp = obj->symtab + symnum;
2814 strp = obj->strtab + symp->st_name;
2815
2816 switch (ELF_ST_TYPE(symp->st_info)) {
2817 case STT_FUNC:
2818 case STT_NOTYPE:
2819 case STT_OBJECT:
2820 if (symp->st_value == 0)
2821 continue;
2822 /* fallthrough */
2823 case STT_TLS:
2824 if (symp->st_shndx != SHN_UNDEF)
2825 break;
2826#ifndef __mips__
2827 else if (((flags & SYMLOOK_IN_PLT) == 0) &&
2828 (ELF_ST_TYPE(symp->st_info) == STT_FUNC))
2829 break;
2830 /* fallthrough */
2831#endif
2832 default:
2833 continue;
2834 }
2835 if (name[0] != strp[0] || strcmp(name, strp) != 0)
2836 continue;
2837
2838 if (ventry == NULL) {
2839 if (obj->versyms != NULL) {
2840 verndx = VER_NDX(obj->versyms[symnum]);
2841 if (verndx > obj->vernum) {
2842 _rtld_error("%s: symbol %s references wrong version %d",
2843 obj->path, obj->strtab + symnum, verndx);
2844 continue;
2845 }
2846 /*
2847 * If we are not called from dlsym (i.e. this is a normal
2848 * relocation from unversioned binary, accept the symbol
2849 * immediately if it happens to have first version after
2850 * this shared object became versioned. Otherwise, if
2851 * symbol is versioned and not hidden, remember it. If it
2852 * is the only symbol with this name exported by the
2853 * shared object, it will be returned as a match at the
2854 * end of the function. If symbol is global (verndx < 2)
2855 * accept it unconditionally.
2856 */
2857 if ((flags & SYMLOOK_DLSYM) == 0 && verndx == VER_NDX_GIVEN)
2858 return symp;
2859 else if (verndx >= VER_NDX_GIVEN) {
2860 if ((obj->versyms[symnum] & VER_NDX_HIDDEN) == 0) {
2861 if (vsymp == NULL)
2862 vsymp = symp;
2863 vcount ++;
2864 }
2865 continue;
2866 }
2867 }
2868 return symp;
2869 } else {
2870 if (obj->versyms == NULL) {
2871 if (object_match_name(obj, ventry->name)) {
2872 _rtld_error("%s: object %s should provide version %s for "
2873 "symbol %s", obj_rtld.path, obj->path, ventry->name,
2874 obj->strtab + symnum);
2875 continue;
2876 }
2877 } else {
2878 verndx = VER_NDX(obj->versyms[symnum]);
2879 if (verndx > obj->vernum) {
2880 _rtld_error("%s: symbol %s references wrong version %d",
2881 obj->path, obj->strtab + symnum, verndx);
2882 continue;
2883 }
2884 if (obj->vertab[verndx].hash != ventry->hash ||
2885 strcmp(obj->vertab[verndx].name, ventry->name)) {
2886 /*
2887 * Version does not match. Look if this is a global symbol
2888 * and if it is not hidden. If global symbol (verndx < 2)
2889 * is available, use it. Do not return symbol if we are
2890 * called by dlvsym, because dlvsym looks for a specific
2891 * version and default one is not what dlvsym wants.
2892 */
2893 if ((flags & SYMLOOK_DLSYM) ||
2894 (obj->versyms[symnum] & VER_NDX_HIDDEN) ||
2895 (verndx >= VER_NDX_GIVEN))
2896 continue;
2897 }
2898 }
2899 return symp;
2900 }
2901 }
2902 return (vcount == 1) ? vsymp : NULL;
2903}
2904
2905static void
2906trace_loaded_objects(Obj_Entry *obj)
2907{
2908 char *fmt1, *fmt2, *fmt, *main_local, *list_containers;
2909 int c;
2910
2911 if ((main_local = getenv(LD_ "TRACE_LOADED_OBJECTS_PROGNAME")) == NULL)
2912 main_local = "";
2913
2914 if ((fmt1 = getenv(LD_ "TRACE_LOADED_OBJECTS_FMT1")) == NULL)
2915 fmt1 = "\t%o => %p (%x)\n";
2916
2917 if ((fmt2 = getenv(LD_ "TRACE_LOADED_OBJECTS_FMT2")) == NULL)
2918 fmt2 = "\t%o (%x)\n";
2919
2920 list_containers = getenv(LD_ "TRACE_LOADED_OBJECTS_ALL");
2921
2922 for (; obj; obj = obj->next) {
2923 Needed_Entry *needed;
2924 char *name, *path;
2925 bool is_lib;
2926
2927 if (list_containers && obj->needed != NULL)
2928 printf("%s:\n", obj->path);
2929 for (needed = obj->needed; needed; needed = needed->next) {
2930 if (needed->obj != NULL) {
2931 if (needed->obj->traced && !list_containers)
2932 continue;
2933 needed->obj->traced = true;
2934 path = needed->obj->path;
2935 } else
2936 path = "not found";
2937
2938 name = (char *)obj->strtab + needed->name;
2939 is_lib = strncmp(name, "lib", 3) == 0; /* XXX - bogus */
2940
2941 fmt = is_lib ? fmt1 : fmt2;
2942 while ((c = *fmt++) != '\0') {
2943 switch (c) {
2944 default:
2945 putchar(c);
2946 continue;
2947 case '\\':
2948 switch (c = *fmt) {
2949 case '\0':
2950 continue;
2951 case 'n':
2952 putchar('\n');
2953 break;
2954 case 't':
2955 putchar('\t');
2956 break;
2957 }
2958 break;
2959 case '%':
2960 switch (c = *fmt) {
2961 case '\0':
2962 continue;
2963 case '%':
2964 default:
2965 putchar(c);
2966 break;
2967 case 'A':
2968 printf("%s", main_local);
2969 break;
2970 case 'a':
2971 printf("%s", obj_main->path);
2972 break;
2973 case 'o':
2974 printf("%s", name);
2975 break;
2976#if 0
2977 case 'm':
2978 printf("%d", sodp->sod_major);
2979 break;
2980 case 'n':
2981 printf("%d", sodp->sod_minor);
2982 break;
2983#endif
2984 case 'p':
2985 printf("%s", path);
2986 break;
2987 case 'x':
2988 printf("%p", needed->obj ? needed->obj->mapbase : 0);
2989 break;
2990 }
2991 break;
2992 }
2993 ++fmt;
2994 }
2995 }
2996 }
2997}
2998
2999/*
3000 * Unload a dlopened object and its dependencies from memory and from
3001 * our data structures. It is assumed that the DAG rooted in the
3002 * object has already been unreferenced, and that the object has a
3003 * reference count of 0.
3004 */
3005static void
3006unload_object(Obj_Entry *root)
3007{
3008 Obj_Entry *obj;
3009 Obj_Entry **linkp;
3010
3011 assert(root->refcount == 0);
3012
3013 /*
3014 * Pass over the DAG removing unreferenced objects from
3015 * appropriate lists.
3016 */
3017 unlink_object(root);
3018
3019 /* Unmap all objects that are no longer referenced. */
3020 linkp = &obj_list->next;
3021 while ((obj = *linkp) != NULL) {
3022 if (obj->refcount == 0) {
3023 LD_UTRACE(UTRACE_UNLOAD_OBJECT, obj, obj->mapbase, obj->mapsize, 0,
3024 obj->path);
3025 dbg("unloading \"%s\"", obj->path);
3026 munmap(obj->mapbase, obj->mapsize);
3027 linkmap_delete(obj);
3028 *linkp = obj->next;
3029 obj_count--;
3030 obj_free(obj);
3031 } else
3032 linkp = &obj->next;
3033 }
3034 obj_tail = linkp;
3035}
3036
3037static void
3038unlink_object(Obj_Entry *root)
3039{
3040 Objlist_Entry *elm;
3041
3042 if (root->refcount == 0) {
3043 /* Remove the object from the RTLD_GLOBAL list. */
3044 objlist_remove(&list_global, root);
3045
3046 /* Remove the object from all objects' DAG lists. */
3047 STAILQ_FOREACH(elm, &root->dagmembers, link) {
3048 objlist_remove(&elm->obj->dldags, root);
3049 if (elm->obj != root)
3050 unlink_object(elm->obj);
3051 }
3052 }
3053}
3054
3055static void
3056ref_dag(Obj_Entry *root)
3057{
3058 Objlist_Entry *elm;
3059
3060 STAILQ_FOREACH(elm, &root->dagmembers, link)
3061 elm->obj->refcount++;
3062}
3063
3064static void
3065unref_dag(Obj_Entry *root)
3066{
3067 Objlist_Entry *elm;
3068
3069 STAILQ_FOREACH(elm, &root->dagmembers, link)
3070 elm->obj->refcount--;
3071}
3072
3073/*
3074 * Common code for MD __tls_get_addr().
3075 */
3076void *
3077tls_get_addr_common(Elf_Addr** dtvp, int index, size_t offset)
3078{
3079 Elf_Addr* dtv = *dtvp;
3080 int lockstate;
3081
3082 /* Check dtv generation in case new modules have arrived */
3083 if (dtv[0] != tls_dtv_generation) {
3084 Elf_Addr* newdtv;
3085 int to_copy;
3086
3087 lockstate = wlock_acquire(rtld_bind_lock);
3088 newdtv = calloc(1, (tls_max_index + 2) * sizeof(Elf_Addr));
3089 to_copy = dtv[1];
3090 if (to_copy > tls_max_index)
3091 to_copy = tls_max_index;
3092 memcpy(&newdtv[2], &dtv[2], to_copy * sizeof(Elf_Addr));
3093 newdtv[0] = tls_dtv_generation;
3094 newdtv[1] = tls_max_index;
3095 free(dtv);
3096 wlock_release(rtld_bind_lock, lockstate);
3097 *dtvp = newdtv;
3098 }
3099
3100 /* Dynamically allocate module TLS if necessary */
3101 if (!dtv[index + 1]) {
3102 /* Signal safe, wlock will block out signals. */
3103 lockstate = wlock_acquire(rtld_bind_lock);
3104 if (!dtv[index + 1])
3105 dtv[index + 1] = (Elf_Addr)allocate_module_tls(index);
3106 wlock_release(rtld_bind_lock, lockstate);
3107 }
3108 return (void*) (dtv[index + 1] + offset);
3109}
3110
3111/* XXX not sure what variants to use for arm. */
3112
3113#if defined(__ia64__) || defined(__powerpc__)
3114
3115/*
3116 * Allocate Static TLS using the Variant I method.
3117 */
3118void *
3119allocate_tls(Obj_Entry *objs, void *oldtcb, size_t tcbsize, size_t tcbalign)
3120{
3121 Obj_Entry *obj;
3122 char *tcb;
3123 Elf_Addr **tls;
3124 Elf_Addr *dtv;
3125 Elf_Addr addr;
3126 int i;
3127
3128 if (oldtcb != NULL && tcbsize == TLS_TCB_SIZE)
3129 return (oldtcb);
3130
3131 assert(tcbsize >= TLS_TCB_SIZE);
3132 tcb = calloc(1, tls_static_space - TLS_TCB_SIZE + tcbsize);
3133 tls = (Elf_Addr **)(tcb + tcbsize - TLS_TCB_SIZE);
3134
3135 if (oldtcb != NULL) {
3136 memcpy(tls, oldtcb, tls_static_space);
3137 free(oldtcb);
3138
3139 /* Adjust the DTV. */
3140 dtv = tls[0];
3141 for (i = 0; i < dtv[1]; i++) {
3142 if (dtv[i+2] >= (Elf_Addr)oldtcb &&
3143 dtv[i+2] < (Elf_Addr)oldtcb + tls_static_space) {
3144 dtv[i+2] = dtv[i+2] - (Elf_Addr)oldtcb + (Elf_Addr)tls;
3145 }
3146 }
3147 } else {
3148 dtv = calloc(tls_max_index + 2, sizeof(Elf_Addr));
3149 tls[0] = dtv;
3150 dtv[0] = tls_dtv_generation;
3151 dtv[1] = tls_max_index;
3152
3153 for (obj = objs; obj; obj = obj->next) {
3154 if (obj->tlsoffset > 0) {
3155 addr = (Elf_Addr)tls + obj->tlsoffset;
3156 if (obj->tlsinitsize > 0)
3157 memcpy((void*) addr, obj->tlsinit, obj->tlsinitsize);
3158 if (obj->tlssize > obj->tlsinitsize)
3159 memset((void*) (addr + obj->tlsinitsize), 0,
3160 obj->tlssize - obj->tlsinitsize);
3161 dtv[obj->tlsindex + 1] = addr;
3162 }
3163 }
3164 }
3165
3166 return (tcb);
3167}
3168
3169void
3170free_tls(void *tcb, size_t tcbsize, size_t tcbalign)
3171{
3172 Elf_Addr *dtv;
3173 Elf_Addr tlsstart, tlsend;
3174 int dtvsize, i;
3175
3176 assert(tcbsize >= TLS_TCB_SIZE);
3177
3178 tlsstart = (Elf_Addr)tcb + tcbsize - TLS_TCB_SIZE;
3179 tlsend = tlsstart + tls_static_space;
3180
3181 dtv = *(Elf_Addr **)tlsstart;
3182 dtvsize = dtv[1];
3183 for (i = 0; i < dtvsize; i++) {
3184 if (dtv[i+2] && (dtv[i+2] < tlsstart || dtv[i+2] >= tlsend)) {
3185 free((void*)dtv[i+2]);
3186 }
3187 }
3188 free(dtv);
3189 free(tcb);
3190}
3191
3192#endif
3193
3194#if defined(__i386__) || defined(__amd64__) || defined(__sparc64__) || \
3195 defined(__arm__) || defined(__mips__)
3196
3197/*
3198 * Allocate Static TLS using the Variant II method.
3199 */
3200void *
3201allocate_tls(Obj_Entry *objs, void *oldtls, size_t tcbsize, size_t tcbalign)
3202{
3203 Obj_Entry *obj;
3204 size_t size;
3205 char *tls;
3206 Elf_Addr *dtv, *olddtv;
3207 Elf_Addr segbase, oldsegbase, addr;
3208 int i;
3209
3210 size = round(tls_static_space, tcbalign);
3211
3212 assert(tcbsize >= 2*sizeof(Elf_Addr));
3213 tls = calloc(1, size + tcbsize);
3214 dtv = calloc(1, (tls_max_index + 2) * sizeof(Elf_Addr));
3215
3216 segbase = (Elf_Addr)(tls + size);
3217 ((Elf_Addr*)segbase)[0] = segbase;
3218 ((Elf_Addr*)segbase)[1] = (Elf_Addr) dtv;
3219
3220 dtv[0] = tls_dtv_generation;
3221 dtv[1] = tls_max_index;
3222
3223 if (oldtls) {
3224 /*
3225 * Copy the static TLS block over whole.
3226 */
3227 oldsegbase = (Elf_Addr) oldtls;
3228 memcpy((void *)(segbase - tls_static_space),
3229 (const void *)(oldsegbase - tls_static_space),
3230 tls_static_space);
3231
3232 /*
3233 * If any dynamic TLS blocks have been created tls_get_addr(),
3234 * move them over.
3235 */
3236 olddtv = ((Elf_Addr**)oldsegbase)[1];
3237 for (i = 0; i < olddtv[1]; i++) {
3238 if (olddtv[i+2] < oldsegbase - size || olddtv[i+2] > oldsegbase) {
3239 dtv[i+2] = olddtv[i+2];
3240 olddtv[i+2] = 0;
3241 }
3242 }
3243
3244 /*
3245 * We assume that this block was the one we created with
3246 * allocate_initial_tls().
3247 */
3248 free_tls(oldtls, 2*sizeof(Elf_Addr), sizeof(Elf_Addr));
3249 } else {
3250 for (obj = objs; obj; obj = obj->next) {
3251 if (obj->tlsoffset) {
3252 addr = segbase - obj->tlsoffset;
3253 memset((void*) (addr + obj->tlsinitsize),
3254 0, obj->tlssize - obj->tlsinitsize);
3255 if (obj->tlsinit)
3256 memcpy((void*) addr, obj->tlsinit, obj->tlsinitsize);
3257 dtv[obj->tlsindex + 1] = addr;
3258 }
3259 }
3260 }
3261
3262 return (void*) segbase;
3263}
3264
3265void
3266free_tls(void *tls, size_t tcbsize, size_t tcbalign)
3267{
3268 size_t size;
3269 Elf_Addr* dtv;
3270 int dtvsize, i;
3271 Elf_Addr tlsstart, tlsend;
3272
3273 /*
3274 * Figure out the size of the initial TLS block so that we can
3275 * find stuff which ___tls_get_addr() allocated dynamically.
3276 */
3277 size = round(tls_static_space, tcbalign);
3278
3279 dtv = ((Elf_Addr**)tls)[1];
3280 dtvsize = dtv[1];
3281 tlsend = (Elf_Addr) tls;
3282 tlsstart = tlsend - size;
3283 for (i = 0; i < dtvsize; i++) {
3284 if (dtv[i+2] && (dtv[i+2] < tlsstart || dtv[i+2] > tlsend)) {
3285 free((void*) dtv[i+2]);
3286 }
3287 }
3288
3289 free((void*) tlsstart);
3290 free((void*) dtv);
3291}
3292
3293#endif
3294
3295/*
3296 * Allocate TLS block for module with given index.
3297 */
3298void *
3299allocate_module_tls(int index)
3300{
3301 Obj_Entry* obj;
3302 char* p;
3303
3304 for (obj = obj_list; obj; obj = obj->next) {
3305 if (obj->tlsindex == index)
3306 break;
3307 }
3308 if (!obj) {
3309 _rtld_error("Can't find module with TLS index %d", index);
3310 die();
3311 }
3312
3313 p = malloc(obj->tlssize);
| 27 */
28
29/*
30 * Dynamic linker for ELF.
31 *
32 * John Polstra <jdp@polstra.com>.
33 */
34
35#ifndef __GNUC__
36#error "GCC is needed to compile this file"
37#endif
38
39#include <sys/param.h>
40#include <sys/mount.h>
41#include <sys/mman.h>
42#include <sys/stat.h>
43#include <sys/uio.h>
44#include <sys/utsname.h>
45#include <sys/ktrace.h>
46
47#include <dlfcn.h>
48#include <err.h>
49#include <errno.h>
50#include <fcntl.h>
51#include <stdarg.h>
52#include <stdio.h>
53#include <stdlib.h>
54#include <string.h>
55#include <unistd.h>
56
57#include "debug.h"
58#include "rtld.h"
59#include "libmap.h"
60#include "rtld_tls.h"
61
62#ifndef COMPAT_32BIT
63#define PATH_RTLD "/libexec/ld-elf.so.1"
64#else
65#define PATH_RTLD "/libexec/ld-elf32.so.1"
66#endif
67
68/* Types. */
69typedef void (*func_ptr_type)();
70typedef void * (*path_enum_proc) (const char *path, size_t len, void *arg);
71
72/*
73 * This structure provides a reentrant way to keep a list of objects and
74 * check which ones have already been processed in some way.
75 */
76typedef struct Struct_DoneList {
77 const Obj_Entry **objs; /* Array of object pointers */
78 unsigned int num_alloc; /* Allocated size of the array */
79 unsigned int num_used; /* Number of array slots used */
80} DoneList;
81
82/*
83 * Function declarations.
84 */
85static const char *basename(const char *);
86static void die(void) __dead2;
87static void digest_dynamic(Obj_Entry *, int);
88static Obj_Entry *digest_phdr(const Elf_Phdr *, int, caddr_t, const char *);
89static Obj_Entry *dlcheck(void *);
90static Obj_Entry *do_load_object(int, const char *, char *, struct stat *, int);
91static int do_search_info(const Obj_Entry *obj, int, struct dl_serinfo *);
92static bool donelist_check(DoneList *, const Obj_Entry *);
93static void errmsg_restore(char *);
94static char *errmsg_save(void);
95static void *fill_search_info(const char *, size_t, void *);
96static char *find_library(const char *, const Obj_Entry *);
97static const char *gethints(void);
98static void init_dag(Obj_Entry *);
99static void init_dag1(Obj_Entry *, Obj_Entry *, DoneList *);
100static void init_rtld(caddr_t);
101static void initlist_add_neededs(Needed_Entry *, Objlist *);
102static void initlist_add_objects(Obj_Entry *, Obj_Entry **, Objlist *);
103static bool is_exported(const Elf_Sym *);
104static void linkmap_add(Obj_Entry *);
105static void linkmap_delete(Obj_Entry *);
106static int load_needed_objects(Obj_Entry *, int);
107static int load_preload_objects(void);
108static Obj_Entry *load_object(const char *, const Obj_Entry *, int);
109static Obj_Entry *obj_from_addr(const void *);
110static void objlist_call_fini(Objlist *, bool, int *);
111static void objlist_call_init(Objlist *, int *);
112static void objlist_clear(Objlist *);
113static Objlist_Entry *objlist_find(Objlist *, const Obj_Entry *);
114static void objlist_init(Objlist *);
115static void objlist_push_head(Objlist *, Obj_Entry *);
116static void objlist_push_tail(Objlist *, Obj_Entry *);
117static void objlist_remove(Objlist *, Obj_Entry *);
118static void *path_enumerate(const char *, path_enum_proc, void *);
119static int relocate_objects(Obj_Entry *, bool, Obj_Entry *);
120static int rtld_dirname(const char *, char *);
121static int rtld_dirname_abs(const char *, char *);
122static void rtld_exit(void);
123static char *search_library_path(const char *, const char *);
124static const void **get_program_var_addr(const char *);
125static void set_program_var(const char *, const void *);
126static const Elf_Sym *symlook_default(const char *, unsigned long,
127 const Obj_Entry *, const Obj_Entry **, const Ver_Entry *, int);
128static const Elf_Sym *symlook_list(const char *, unsigned long, const Objlist *,
129 const Obj_Entry **, const Ver_Entry *, int, DoneList *);
130static const Elf_Sym *symlook_needed(const char *, unsigned long,
131 const Needed_Entry *, const Obj_Entry **, const Ver_Entry *,
132 int, DoneList *);
133static void trace_loaded_objects(Obj_Entry *);
134static void unlink_object(Obj_Entry *);
135static void unload_object(Obj_Entry *);
136static void unref_dag(Obj_Entry *);
137static void ref_dag(Obj_Entry *);
138static int origin_subst_one(char **, const char *, const char *,
139 const char *, char *);
140static char *origin_subst(const char *, const char *);
141static int rtld_verify_versions(const Objlist *);
142static int rtld_verify_object_versions(Obj_Entry *);
143static void object_add_name(Obj_Entry *, const char *);
144static int object_match_name(const Obj_Entry *, const char *);
145static void ld_utrace_log(int, void *, void *, size_t, int, const char *);
146
147void r_debug_state(struct r_debug *, struct link_map *);
148
149/*
150 * Data declarations.
151 */
152static char *error_message; /* Message for dlerror(), or NULL */
153struct r_debug r_debug; /* for GDB; */
154static bool libmap_disable; /* Disable libmap */
155static char *libmap_override; /* Maps to use in addition to libmap.conf */
156static bool trust; /* False for setuid and setgid programs */
157static bool dangerous_ld_env; /* True if environment variables have been
158 used to affect the libraries loaded */
159static char *ld_bind_now; /* Environment variable for immediate binding */
160static char *ld_debug; /* Environment variable for debugging */
161static char *ld_library_path; /* Environment variable for search path */
162static char *ld_preload; /* Environment variable for libraries to
163 load first */
164static char *ld_elf_hints_path; /* Environment variable for alternative hints path */
165static char *ld_tracing; /* Called from ldd to print libs */
166static char *ld_utrace; /* Use utrace() to log events. */
167static Obj_Entry *obj_list; /* Head of linked list of shared objects */
168static Obj_Entry **obj_tail; /* Link field of last object in list */
169static Obj_Entry *obj_main; /* The main program shared object */
170static Obj_Entry obj_rtld; /* The dynamic linker shared object */
171static unsigned int obj_count; /* Number of objects in obj_list */
172static unsigned int obj_loads; /* Number of objects in obj_list */
173
174static Objlist list_global = /* Objects dlopened with RTLD_GLOBAL */
175 STAILQ_HEAD_INITIALIZER(list_global);
176static Objlist list_main = /* Objects loaded at program startup */
177 STAILQ_HEAD_INITIALIZER(list_main);
178static Objlist list_fini = /* Objects needing fini() calls */
179 STAILQ_HEAD_INITIALIZER(list_fini);
180
181static Elf_Sym sym_zero; /* For resolving undefined weak refs. */
182
183#define GDB_STATE(s,m) r_debug.r_state = s; r_debug_state(&r_debug,m);
184
185extern Elf_Dyn _DYNAMIC;
186#pragma weak _DYNAMIC
187#ifndef RTLD_IS_DYNAMIC
188#define RTLD_IS_DYNAMIC() (&_DYNAMIC != NULL)
189#endif
190
191/*
192 * These are the functions the dynamic linker exports to application
193 * programs. They are the only symbols the dynamic linker is willing
194 * to export from itself.
195 */
196static func_ptr_type exports[] = {
197 (func_ptr_type) &_rtld_error,
198 (func_ptr_type) &dlclose,
199 (func_ptr_type) &dlerror,
200 (func_ptr_type) &dlopen,
201 (func_ptr_type) &dlsym,
202 (func_ptr_type) &dlfunc,
203 (func_ptr_type) &dlvsym,
204 (func_ptr_type) &dladdr,
205 (func_ptr_type) &dllockinit,
206 (func_ptr_type) &dlinfo,
207 (func_ptr_type) &_rtld_thread_init,
208#ifdef __i386__
209 (func_ptr_type) &___tls_get_addr,
210#endif
211 (func_ptr_type) &__tls_get_addr,
212 (func_ptr_type) &_rtld_allocate_tls,
213 (func_ptr_type) &_rtld_free_tls,
214 (func_ptr_type) &dl_iterate_phdr,
215 (func_ptr_type) &_rtld_atfork_pre,
216 (func_ptr_type) &_rtld_atfork_post,
217 NULL
218};
219
220/*
221 * Global declarations normally provided by crt1. The dynamic linker is
222 * not built with crt1, so we have to provide them ourselves.
223 */
224char *__progname;
225char **environ;
226
227/*
228 * Globals to control TLS allocation.
229 */
230size_t tls_last_offset; /* Static TLS offset of last module */
231size_t tls_last_size; /* Static TLS size of last module */
232size_t tls_static_space; /* Static TLS space allocated */
233int tls_dtv_generation = 1; /* Used to detect when dtv size changes */
234int tls_max_index = 1; /* Largest module index allocated */
235
236/*
237 * Fill in a DoneList with an allocation large enough to hold all of
238 * the currently-loaded objects. Keep this as a macro since it calls
239 * alloca and we want that to occur within the scope of the caller.
240 */
241#define donelist_init(dlp) \
242 ((dlp)->objs = alloca(obj_count * sizeof (dlp)->objs[0]), \
243 assert((dlp)->objs != NULL), \
244 (dlp)->num_alloc = obj_count, \
245 (dlp)->num_used = 0)
246
247#define UTRACE_DLOPEN_START 1
248#define UTRACE_DLOPEN_STOP 2
249#define UTRACE_DLCLOSE_START 3
250#define UTRACE_DLCLOSE_STOP 4
251#define UTRACE_LOAD_OBJECT 5
252#define UTRACE_UNLOAD_OBJECT 6
253#define UTRACE_ADD_RUNDEP 7
254#define UTRACE_PRELOAD_FINISHED 8
255#define UTRACE_INIT_CALL 9
256#define UTRACE_FINI_CALL 10
257
258struct utrace_rtld {
259 char sig[4]; /* 'RTLD' */
260 int event;
261 void *handle;
262 void *mapbase; /* Used for 'parent' and 'init/fini' */
263 size_t mapsize;
264 int refcnt; /* Used for 'mode' */
265 char name[MAXPATHLEN];
266};
267
268#define LD_UTRACE(e, h, mb, ms, r, n) do { \
269 if (ld_utrace != NULL) \
270 ld_utrace_log(e, h, mb, ms, r, n); \
271} while (0)
272
273static void
274ld_utrace_log(int event, void *handle, void *mapbase, size_t mapsize,
275 int refcnt, const char *name)
276{
277 struct utrace_rtld ut;
278
279 ut.sig[0] = 'R';
280 ut.sig[1] = 'T';
281 ut.sig[2] = 'L';
282 ut.sig[3] = 'D';
283 ut.event = event;
284 ut.handle = handle;
285 ut.mapbase = mapbase;
286 ut.mapsize = mapsize;
287 ut.refcnt = refcnt;
288 bzero(ut.name, sizeof(ut.name));
289 if (name)
290 strlcpy(ut.name, name, sizeof(ut.name));
291 utrace(&ut, sizeof(ut));
292}
293
294/*
295 * Main entry point for dynamic linking. The first argument is the
296 * stack pointer. The stack is expected to be laid out as described
297 * in the SVR4 ABI specification, Intel 386 Processor Supplement.
298 * Specifically, the stack pointer points to a word containing
299 * ARGC. Following that in the stack is a null-terminated sequence
300 * of pointers to argument strings. Then comes a null-terminated
301 * sequence of pointers to environment strings. Finally, there is a
302 * sequence of "auxiliary vector" entries.
303 *
304 * The second argument points to a place to store the dynamic linker's
305 * exit procedure pointer and the third to a place to store the main
306 * program's object.
307 *
308 * The return value is the main program's entry point.
309 */
310func_ptr_type
311_rtld(Elf_Addr *sp, func_ptr_type *exit_proc, Obj_Entry **objp)
312{
313 Elf_Auxinfo *aux_info[AT_COUNT];
314 int i;
315 int argc;
316 char **argv;
317 char **env;
318 Elf_Auxinfo *aux;
319 Elf_Auxinfo *auxp;
320 const char *argv0;
321 Objlist_Entry *entry;
322 Obj_Entry *obj;
323 Obj_Entry **preload_tail;
324 Objlist initlist;
325 int lockstate;
326
327 /*
328 * On entry, the dynamic linker itself has not been relocated yet.
329 * Be very careful not to reference any global data until after
330 * init_rtld has returned. It is OK to reference file-scope statics
331 * and string constants, and to call static and global functions.
332 */
333
334 /* Find the auxiliary vector on the stack. */
335 argc = *sp++;
336 argv = (char **) sp;
337 sp += argc + 1; /* Skip over arguments and NULL terminator */
338 env = (char **) sp;
339 while (*sp++ != 0) /* Skip over environment, and NULL terminator */
340 ;
341 aux = (Elf_Auxinfo *) sp;
342
343 /* Digest the auxiliary vector. */
344 for (i = 0; i < AT_COUNT; i++)
345 aux_info[i] = NULL;
346 for (auxp = aux; auxp->a_type != AT_NULL; auxp++) {
347 if (auxp->a_type < AT_COUNT)
348 aux_info[auxp->a_type] = auxp;
349 }
350
351 /* Initialize and relocate ourselves. */
352 assert(aux_info[AT_BASE] != NULL);
353 init_rtld((caddr_t) aux_info[AT_BASE]->a_un.a_ptr);
354
355 __progname = obj_rtld.path;
356 argv0 = argv[0] != NULL ? argv[0] : "(null)";
357 environ = env;
358
359 trust = !issetugid();
360
361 ld_bind_now = getenv(LD_ "BIND_NOW");
362 /*
363 * If the process is tainted, then we un-set the dangerous environment
364 * variables. The process will be marked as tainted until setuid(2)
365 * is called. If any child process calls setuid(2) we do not want any
366 * future processes to honor the potentially un-safe variables.
367 */
368 if (!trust) {
369 if (unsetenv(LD_ "PRELOAD") || unsetenv(LD_ "LIBMAP") ||
370 unsetenv(LD_ "LIBRARY_PATH") || unsetenv(LD_ "LIBMAP_DISABLE") ||
371 unsetenv(LD_ "DEBUG") || unsetenv(LD_ "ELF_HINTS_PATH")) {
372 _rtld_error("environment corrupt; aborting");
373 die();
374 }
375 }
376 ld_debug = getenv(LD_ "DEBUG");
377 libmap_disable = getenv(LD_ "LIBMAP_DISABLE") != NULL;
378 libmap_override = getenv(LD_ "LIBMAP");
379 ld_library_path = getenv(LD_ "LIBRARY_PATH");
380 ld_preload = getenv(LD_ "PRELOAD");
381 ld_elf_hints_path = getenv(LD_ "ELF_HINTS_PATH");
382 dangerous_ld_env = libmap_disable || (libmap_override != NULL) ||
383 (ld_library_path != NULL) || (ld_preload != NULL) ||
384 (ld_elf_hints_path != NULL);
385 ld_tracing = getenv(LD_ "TRACE_LOADED_OBJECTS");
386 ld_utrace = getenv(LD_ "UTRACE");
387
388 if ((ld_elf_hints_path == NULL) || strlen(ld_elf_hints_path) == 0)
389 ld_elf_hints_path = _PATH_ELF_HINTS;
390
391 if (ld_debug != NULL && *ld_debug != '\0')
392 debug = 1;
393 dbg("%s is initialized, base address = %p", __progname,
394 (caddr_t) aux_info[AT_BASE]->a_un.a_ptr);
395 dbg("RTLD dynamic = %p", obj_rtld.dynamic);
396 dbg("RTLD pltgot = %p", obj_rtld.pltgot);
397
398 /*
399 * Load the main program, or process its program header if it is
400 * already loaded.
401 */
402 if (aux_info[AT_EXECFD] != NULL) { /* Load the main program. */
403 int fd = aux_info[AT_EXECFD]->a_un.a_val;
404 dbg("loading main program");
405 obj_main = map_object(fd, argv0, NULL);
406 close(fd);
407 if (obj_main == NULL)
408 die();
409 } else { /* Main program already loaded. */
410 const Elf_Phdr *phdr;
411 int phnum;
412 caddr_t entry;
413
414 dbg("processing main program's program header");
415 assert(aux_info[AT_PHDR] != NULL);
416 phdr = (const Elf_Phdr *) aux_info[AT_PHDR]->a_un.a_ptr;
417 assert(aux_info[AT_PHNUM] != NULL);
418 phnum = aux_info[AT_PHNUM]->a_un.a_val;
419 assert(aux_info[AT_PHENT] != NULL);
420 assert(aux_info[AT_PHENT]->a_un.a_val == sizeof(Elf_Phdr));
421 assert(aux_info[AT_ENTRY] != NULL);
422 entry = (caddr_t) aux_info[AT_ENTRY]->a_un.a_ptr;
423 if ((obj_main = digest_phdr(phdr, phnum, entry, argv0)) == NULL)
424 die();
425 }
426
427 if (aux_info[AT_EXECPATH] != 0) {
428 char *kexecpath;
429 char buf[MAXPATHLEN];
430
431 kexecpath = aux_info[AT_EXECPATH]->a_un.a_ptr;
432 dbg("AT_EXECPATH %p %s", kexecpath, kexecpath);
433 if (kexecpath[0] == '/')
434 obj_main->path = kexecpath;
435 else if (getcwd(buf, sizeof(buf)) == NULL ||
436 strlcat(buf, "/", sizeof(buf)) >= sizeof(buf) ||
437 strlcat(buf, kexecpath, sizeof(buf)) >= sizeof(buf))
438 obj_main->path = xstrdup(argv0);
439 else
440 obj_main->path = xstrdup(buf);
441 } else {
442 dbg("No AT_EXECPATH");
443 obj_main->path = xstrdup(argv0);
444 }
445 dbg("obj_main path %s", obj_main->path);
446 obj_main->mainprog = true;
447
448 /*
449 * Get the actual dynamic linker pathname from the executable if
450 * possible. (It should always be possible.) That ensures that
451 * gdb will find the right dynamic linker even if a non-standard
452 * one is being used.
453 */
454 if (obj_main->interp != NULL &&
455 strcmp(obj_main->interp, obj_rtld.path) != 0) {
456 free(obj_rtld.path);
457 obj_rtld.path = xstrdup(obj_main->interp);
458 __progname = obj_rtld.path;
459 }
460
461 digest_dynamic(obj_main, 0);
462
463 linkmap_add(obj_main);
464 linkmap_add(&obj_rtld);
465
466 /* Link the main program into the list of objects. */
467 *obj_tail = obj_main;
468 obj_tail = &obj_main->next;
469 obj_count++;
470 obj_loads++;
471 /* Make sure we don't call the main program's init and fini functions. */
472 obj_main->init = obj_main->fini = (Elf_Addr)NULL;
473
474 /* Initialize a fake symbol for resolving undefined weak references. */
475 sym_zero.st_info = ELF_ST_INFO(STB_GLOBAL, STT_NOTYPE);
476 sym_zero.st_shndx = SHN_UNDEF;
477 sym_zero.st_value = -(uintptr_t)obj_main->relocbase;
478
479 if (!libmap_disable)
480 libmap_disable = (bool)lm_init(libmap_override);
481
482 dbg("loading LD_PRELOAD libraries");
483 if (load_preload_objects() == -1)
484 die();
485 preload_tail = obj_tail;
486
487 dbg("loading needed objects");
488 if (load_needed_objects(obj_main, 0) == -1)
489 die();
490
491 /* Make a list of all objects loaded at startup. */
492 for (obj = obj_list; obj != NULL; obj = obj->next) {
493 objlist_push_tail(&list_main, obj);
494 obj->refcount++;
495 }
496
497 dbg("checking for required versions");
498 if (rtld_verify_versions(&list_main) == -1 && !ld_tracing)
499 die();
500
501 if (ld_tracing) { /* We're done */
502 trace_loaded_objects(obj_main);
503 exit(0);
504 }
505
506 if (getenv(LD_ "DUMP_REL_PRE") != NULL) {
507 dump_relocations(obj_main);
508 exit (0);
509 }
510
511 /* setup TLS for main thread */
512 dbg("initializing initial thread local storage");
513 STAILQ_FOREACH(entry, &list_main, link) {
514 /*
515 * Allocate all the initial objects out of the static TLS
516 * block even if they didn't ask for it.
517 */
518 allocate_tls_offset(entry->obj);
519 }
520 allocate_initial_tls(obj_list);
521
522 if (relocate_objects(obj_main,
523 ld_bind_now != NULL && *ld_bind_now != '\0', &obj_rtld) == -1)
524 die();
525
526 dbg("doing copy relocations");
527 if (do_copy_relocations(obj_main) == -1)
528 die();
529
530 if (getenv(LD_ "DUMP_REL_POST") != NULL) {
531 dump_relocations(obj_main);
532 exit (0);
533 }
534
535 dbg("initializing key program variables");
536 set_program_var("__progname", argv[0] != NULL ? basename(argv[0]) : "");
537 set_program_var("environ", env);
538
539 dbg("initializing thread locks");
540 lockdflt_init();
541
542 /* Make a list of init functions to call. */
543 objlist_init(&initlist);
544 initlist_add_objects(obj_list, preload_tail, &initlist);
545
546 r_debug_state(NULL, &obj_main->linkmap); /* say hello to gdb! */
547
548 lockstate = wlock_acquire(rtld_bind_lock);
549 objlist_call_init(&initlist, &lockstate);
550 objlist_clear(&initlist);
551 wlock_release(rtld_bind_lock, lockstate);
552
553 dbg("transferring control to program entry point = %p", obj_main->entry);
554
555 /* Return the exit procedure and the program entry point. */
556 *exit_proc = rtld_exit;
557 *objp = obj_main;
558 return (func_ptr_type) obj_main->entry;
559}
560
561Elf_Addr
562_rtld_bind(Obj_Entry *obj, Elf_Size reloff)
563{
564 const Elf_Rel *rel;
565 const Elf_Sym *def;
566 const Obj_Entry *defobj;
567 Elf_Addr *where;
568 Elf_Addr target;
569 int lockstate;
570
571 lockstate = rlock_acquire(rtld_bind_lock);
572 if (obj->pltrel)
573 rel = (const Elf_Rel *) ((caddr_t) obj->pltrel + reloff);
574 else
575 rel = (const Elf_Rel *) ((caddr_t) obj->pltrela + reloff);
576
577 where = (Elf_Addr *) (obj->relocbase + rel->r_offset);
578 def = find_symdef(ELF_R_SYM(rel->r_info), obj, &defobj, true, NULL);
579 if (def == NULL)
580 die();
581
582 target = (Elf_Addr)(defobj->relocbase + def->st_value);
583
584 dbg("\"%s\" in \"%s\" ==> %p in \"%s\"",
585 defobj->strtab + def->st_name, basename(obj->path),
586 (void *)target, basename(defobj->path));
587
588 /*
589 * Write the new contents for the jmpslot. Note that depending on
590 * architecture, the value which we need to return back to the
591 * lazy binding trampoline may or may not be the target
592 * address. The value returned from reloc_jmpslot() is the value
593 * that the trampoline needs.
594 */
595 target = reloc_jmpslot(where, target, defobj, obj, rel);
596 rlock_release(rtld_bind_lock, lockstate);
597 return target;
598}
599
600/*
601 * Error reporting function. Use it like printf. If formats the message
602 * into a buffer, and sets things up so that the next call to dlerror()
603 * will return the message.
604 */
605void
606_rtld_error(const char *fmt, ...)
607{
608 static char buf[512];
609 va_list ap;
610
611 va_start(ap, fmt);
612 vsnprintf(buf, sizeof buf, fmt, ap);
613 error_message = buf;
614 va_end(ap);
615}
616
617/*
618 * Return a dynamically-allocated copy of the current error message, if any.
619 */
620static char *
621errmsg_save(void)
622{
623 return error_message == NULL ? NULL : xstrdup(error_message);
624}
625
626/*
627 * Restore the current error message from a copy which was previously saved
628 * by errmsg_save(). The copy is freed.
629 */
630static void
631errmsg_restore(char *saved_msg)
632{
633 if (saved_msg == NULL)
634 error_message = NULL;
635 else {
636 _rtld_error("%s", saved_msg);
637 free(saved_msg);
638 }
639}
640
641static const char *
642basename(const char *name)
643{
644 const char *p = strrchr(name, '/');
645 return p != NULL ? p + 1 : name;
646}
647
648static struct utsname uts;
649
650static int
651origin_subst_one(char **res, const char *real, const char *kw, const char *subst,
652 char *may_free)
653{
654 const char *p, *p1;
655 char *res1;
656 int subst_len;
657 int kw_len;
658
659 res1 = *res = NULL;
660 p = real;
661 subst_len = kw_len = 0;
662 for (;;) {
663 p1 = strstr(p, kw);
664 if (p1 != NULL) {
665 if (subst_len == 0) {
666 subst_len = strlen(subst);
667 kw_len = strlen(kw);
668 }
669 if (*res == NULL) {
670 *res = xmalloc(PATH_MAX);
671 res1 = *res;
672 }
673 if ((res1 - *res) + subst_len + (p1 - p) >= PATH_MAX) {
674 _rtld_error("Substitution of %s in %s cannot be performed",
675 kw, real);
676 if (may_free != NULL)
677 free(may_free);
678 free(res);
679 return (false);
680 }
681 memcpy(res1, p, p1 - p);
682 res1 += p1 - p;
683 memcpy(res1, subst, subst_len);
684 res1 += subst_len;
685 p = p1 + kw_len;
686 } else {
687 if (*res == NULL) {
688 if (may_free != NULL)
689 *res = may_free;
690 else
691 *res = xstrdup(real);
692 return (true);
693 }
694 *res1 = '\0';
695 if (may_free != NULL)
696 free(may_free);
697 if (strlcat(res1, p, PATH_MAX - (res1 - *res)) >= PATH_MAX) {
698 free(res);
699 return (false);
700 }
701 return (true);
702 }
703 }
704}
705
706static char *
707origin_subst(const char *real, const char *origin_path)
708{
709 char *res1, *res2, *res3, *res4;
710
711 if (uts.sysname[0] == '\0') {
712 if (uname(&uts) != 0) {
713 _rtld_error("utsname failed: %d", errno);
714 return (NULL);
715 }
716 }
717 if (!origin_subst_one(&res1, real, "$ORIGIN", origin_path, NULL) ||
718 !origin_subst_one(&res2, res1, "$OSNAME", uts.sysname, res1) ||
719 !origin_subst_one(&res3, res2, "$OSREL", uts.release, res2) ||
720 !origin_subst_one(&res4, res3, "$PLATFORM", uts.machine, res3))
721 return (NULL);
722 return (res4);
723}
724
725static void
726die(void)
727{
728 const char *msg = dlerror();
729
730 if (msg == NULL)
731 msg = "Fatal error";
732 errx(1, "%s", msg);
733}
734
735/*
736 * Process a shared object's DYNAMIC section, and save the important
737 * information in its Obj_Entry structure.
738 */
739static void
740digest_dynamic(Obj_Entry *obj, int early)
741{
742 const Elf_Dyn *dynp;
743 Needed_Entry **needed_tail = &obj->needed;
744 const Elf_Dyn *dyn_rpath = NULL;
745 const Elf_Dyn *dyn_soname = NULL;
746 int plttype = DT_REL;
747
748 obj->bind_now = false;
749 for (dynp = obj->dynamic; dynp->d_tag != DT_NULL; dynp++) {
750 switch (dynp->d_tag) {
751
752 case DT_REL:
753 obj->rel = (const Elf_Rel *) (obj->relocbase + dynp->d_un.d_ptr);
754 break;
755
756 case DT_RELSZ:
757 obj->relsize = dynp->d_un.d_val;
758 break;
759
760 case DT_RELENT:
761 assert(dynp->d_un.d_val == sizeof(Elf_Rel));
762 break;
763
764 case DT_JMPREL:
765 obj->pltrel = (const Elf_Rel *)
766 (obj->relocbase + dynp->d_un.d_ptr);
767 break;
768
769 case DT_PLTRELSZ:
770 obj->pltrelsize = dynp->d_un.d_val;
771 break;
772
773 case DT_RELA:
774 obj->rela = (const Elf_Rela *) (obj->relocbase + dynp->d_un.d_ptr);
775 break;
776
777 case DT_RELASZ:
778 obj->relasize = dynp->d_un.d_val;
779 break;
780
781 case DT_RELAENT:
782 assert(dynp->d_un.d_val == sizeof(Elf_Rela));
783 break;
784
785 case DT_PLTREL:
786 plttype = dynp->d_un.d_val;
787 assert(dynp->d_un.d_val == DT_REL || plttype == DT_RELA);
788 break;
789
790 case DT_SYMTAB:
791 obj->symtab = (const Elf_Sym *)
792 (obj->relocbase + dynp->d_un.d_ptr);
793 break;
794
795 case DT_SYMENT:
796 assert(dynp->d_un.d_val == sizeof(Elf_Sym));
797 break;
798
799 case DT_STRTAB:
800 obj->strtab = (const char *) (obj->relocbase + dynp->d_un.d_ptr);
801 break;
802
803 case DT_STRSZ:
804 obj->strsize = dynp->d_un.d_val;
805 break;
806
807 case DT_VERNEED:
808 obj->verneed = (const Elf_Verneed *) (obj->relocbase +
809 dynp->d_un.d_val);
810 break;
811
812 case DT_VERNEEDNUM:
813 obj->verneednum = dynp->d_un.d_val;
814 break;
815
816 case DT_VERDEF:
817 obj->verdef = (const Elf_Verdef *) (obj->relocbase +
818 dynp->d_un.d_val);
819 break;
820
821 case DT_VERDEFNUM:
822 obj->verdefnum = dynp->d_un.d_val;
823 break;
824
825 case DT_VERSYM:
826 obj->versyms = (const Elf_Versym *)(obj->relocbase +
827 dynp->d_un.d_val);
828 break;
829
830 case DT_HASH:
831 {
832 const Elf_Hashelt *hashtab = (const Elf_Hashelt *)
833 (obj->relocbase + dynp->d_un.d_ptr);
834 obj->nbuckets = hashtab[0];
835 obj->nchains = hashtab[1];
836 obj->buckets = hashtab + 2;
837 obj->chains = obj->buckets + obj->nbuckets;
838 }
839 break;
840
841 case DT_NEEDED:
842 if (!obj->rtld) {
843 Needed_Entry *nep = NEW(Needed_Entry);
844 nep->name = dynp->d_un.d_val;
845 nep->obj = NULL;
846 nep->next = NULL;
847
848 *needed_tail = nep;
849 needed_tail = &nep->next;
850 }
851 break;
852
853 case DT_PLTGOT:
854 obj->pltgot = (Elf_Addr *) (obj->relocbase + dynp->d_un.d_ptr);
855 break;
856
857 case DT_TEXTREL:
858 obj->textrel = true;
859 break;
860
861 case DT_SYMBOLIC:
862 obj->symbolic = true;
863 break;
864
865 case DT_RPATH:
866 case DT_RUNPATH: /* XXX: process separately */
867 /*
868 * We have to wait until later to process this, because we
869 * might not have gotten the address of the string table yet.
870 */
871 dyn_rpath = dynp;
872 break;
873
874 case DT_SONAME:
875 dyn_soname = dynp;
876 break;
877
878 case DT_INIT:
879 obj->init = (Elf_Addr) (obj->relocbase + dynp->d_un.d_ptr);
880 break;
881
882 case DT_FINI:
883 obj->fini = (Elf_Addr) (obj->relocbase + dynp->d_un.d_ptr);
884 break;
885
886 /*
887 * Don't process DT_DEBUG on MIPS as the dynamic section
888 * is mapped read-only. DT_MIPS_RLD_MAP is used instead.
889 */
890
891#ifndef __mips__
892 case DT_DEBUG:
893 /* XXX - not implemented yet */
894 if (!early)
895 dbg("Filling in DT_DEBUG entry");
896 ((Elf_Dyn*)dynp)->d_un.d_ptr = (Elf_Addr) &r_debug;
897 break;
898#endif
899
900 case DT_FLAGS:
901 if ((dynp->d_un.d_val & DF_ORIGIN) && trust)
902 obj->z_origin = true;
903 if (dynp->d_un.d_val & DF_SYMBOLIC)
904 obj->symbolic = true;
905 if (dynp->d_un.d_val & DF_TEXTREL)
906 obj->textrel = true;
907 if (dynp->d_un.d_val & DF_BIND_NOW)
908 obj->bind_now = true;
909 if (dynp->d_un.d_val & DF_STATIC_TLS)
910 ;
911 break;
912#ifdef __mips__
913 case DT_MIPS_LOCAL_GOTNO:
914 obj->local_gotno = dynp->d_un.d_val;
915 break;
916
917 case DT_MIPS_SYMTABNO:
918 obj->symtabno = dynp->d_un.d_val;
919 break;
920
921 case DT_MIPS_GOTSYM:
922 obj->gotsym = dynp->d_un.d_val;
923 break;
924
925 case DT_MIPS_RLD_MAP:
926#ifdef notyet
927 if (!early)
928 dbg("Filling in DT_DEBUG entry");
929 ((Elf_Dyn*)dynp)->d_un.d_ptr = (Elf_Addr) &r_debug;
930#endif
931 break;
932#endif
933
934 case DT_FLAGS_1:
935 if (dynp->d_un.d_val & DF_1_NOOPEN)
936 obj->z_noopen = true;
937 if ((dynp->d_un.d_val & DF_1_ORIGIN) && trust)
938 obj->z_origin = true;
939 if (dynp->d_un.d_val & DF_1_GLOBAL)
940 /* XXX */;
941 if (dynp->d_un.d_val & DF_1_BIND_NOW)
942 obj->bind_now = true;
943 if (dynp->d_un.d_val & DF_1_NODELETE)
944 obj->z_nodelete = true;
945 break;
946
947 default:
948 if (!early) {
949 dbg("Ignoring d_tag %ld = %#lx", (long)dynp->d_tag,
950 (long)dynp->d_tag);
951 }
952 break;
953 }
954 }
955
956 obj->traced = false;
957
958 if (plttype == DT_RELA) {
959 obj->pltrela = (const Elf_Rela *) obj->pltrel;
960 obj->pltrel = NULL;
961 obj->pltrelasize = obj->pltrelsize;
962 obj->pltrelsize = 0;
963 }
964
965 if (obj->z_origin && obj->origin_path == NULL) {
966 obj->origin_path = xmalloc(PATH_MAX);
967 if (rtld_dirname_abs(obj->path, obj->origin_path) == -1)
968 die();
969 }
970
971 if (dyn_rpath != NULL) {
972 obj->rpath = (char *)obj->strtab + dyn_rpath->d_un.d_val;
973 if (obj->z_origin)
974 obj->rpath = origin_subst(obj->rpath, obj->origin_path);
975 }
976
977 if (dyn_soname != NULL)
978 object_add_name(obj, obj->strtab + dyn_soname->d_un.d_val);
979}
980
981/*
982 * Process a shared object's program header. This is used only for the
983 * main program, when the kernel has already loaded the main program
984 * into memory before calling the dynamic linker. It creates and
985 * returns an Obj_Entry structure.
986 */
987static Obj_Entry *
988digest_phdr(const Elf_Phdr *phdr, int phnum, caddr_t entry, const char *path)
989{
990 Obj_Entry *obj;
991 const Elf_Phdr *phlimit = phdr + phnum;
992 const Elf_Phdr *ph;
993 int nsegs = 0;
994
995 obj = obj_new();
996 for (ph = phdr; ph < phlimit; ph++) {
997 if (ph->p_type != PT_PHDR)
998 continue;
999
1000 obj->phdr = phdr;
1001 obj->phsize = ph->p_memsz;
1002 obj->relocbase = (caddr_t)phdr - ph->p_vaddr;
1003 break;
1004 }
1005
1006 for (ph = phdr; ph < phlimit; ph++) {
1007 switch (ph->p_type) {
1008
1009 case PT_INTERP:
1010 obj->interp = (const char *)(ph->p_vaddr + obj->relocbase);
1011 break;
1012
1013 case PT_LOAD:
1014 if (nsegs == 0) { /* First load segment */
1015 obj->vaddrbase = trunc_page(ph->p_vaddr);
1016 obj->mapbase = obj->vaddrbase + obj->relocbase;
1017 obj->textsize = round_page(ph->p_vaddr + ph->p_memsz) -
1018 obj->vaddrbase;
1019 } else { /* Last load segment */
1020 obj->mapsize = round_page(ph->p_vaddr + ph->p_memsz) -
1021 obj->vaddrbase;
1022 }
1023 nsegs++;
1024 break;
1025
1026 case PT_DYNAMIC:
1027 obj->dynamic = (const Elf_Dyn *)(ph->p_vaddr + obj->relocbase);
1028 break;
1029
1030 case PT_TLS:
1031 obj->tlsindex = 1;
1032 obj->tlssize = ph->p_memsz;
1033 obj->tlsalign = ph->p_align;
1034 obj->tlsinitsize = ph->p_filesz;
1035 obj->tlsinit = (void*)(ph->p_vaddr + obj->relocbase);
1036 break;
1037 }
1038 }
1039 if (nsegs < 1) {
1040 _rtld_error("%s: too few PT_LOAD segments", path);
1041 return NULL;
1042 }
1043
1044 obj->entry = entry;
1045 return obj;
1046}
1047
1048static Obj_Entry *
1049dlcheck(void *handle)
1050{
1051 Obj_Entry *obj;
1052
1053 for (obj = obj_list; obj != NULL; obj = obj->next)
1054 if (obj == (Obj_Entry *) handle)
1055 break;
1056
1057 if (obj == NULL || obj->refcount == 0 || obj->dl_refcount == 0) {
1058 _rtld_error("Invalid shared object handle %p", handle);
1059 return NULL;
1060 }
1061 return obj;
1062}
1063
1064/*
1065 * If the given object is already in the donelist, return true. Otherwise
1066 * add the object to the list and return false.
1067 */
1068static bool
1069donelist_check(DoneList *dlp, const Obj_Entry *obj)
1070{
1071 unsigned int i;
1072
1073 for (i = 0; i < dlp->num_used; i++)
1074 if (dlp->objs[i] == obj)
1075 return true;
1076 /*
1077 * Our donelist allocation should always be sufficient. But if
1078 * our threads locking isn't working properly, more shared objects
1079 * could have been loaded since we allocated the list. That should
1080 * never happen, but we'll handle it properly just in case it does.
1081 */
1082 if (dlp->num_used < dlp->num_alloc)
1083 dlp->objs[dlp->num_used++] = obj;
1084 return false;
1085}
1086
1087/*
1088 * Hash function for symbol table lookup. Don't even think about changing
1089 * this. It is specified by the System V ABI.
1090 */
1091unsigned long
1092elf_hash(const char *name)
1093{
1094 const unsigned char *p = (const unsigned char *) name;
1095 unsigned long h = 0;
1096 unsigned long g;
1097
1098 while (*p != '\0') {
1099 h = (h << 4) + *p++;
1100 if ((g = h & 0xf0000000) != 0)
1101 h ^= g >> 24;
1102 h &= ~g;
1103 }
1104 return h;
1105}
1106
1107/*
1108 * Find the library with the given name, and return its full pathname.
1109 * The returned string is dynamically allocated. Generates an error
1110 * message and returns NULL if the library cannot be found.
1111 *
1112 * If the second argument is non-NULL, then it refers to an already-
1113 * loaded shared object, whose library search path will be searched.
1114 *
1115 * The search order is:
1116 * LD_LIBRARY_PATH
1117 * rpath in the referencing file
1118 * ldconfig hints
1119 * /lib:/usr/lib
1120 */
1121static char *
1122find_library(const char *xname, const Obj_Entry *refobj)
1123{
1124 char *pathname;
1125 char *name;
1126
1127 if (strchr(xname, '/') != NULL) { /* Hard coded pathname */
1128 if (xname[0] != '/' && !trust) {
1129 _rtld_error("Absolute pathname required for shared object \"%s\"",
1130 xname);
1131 return NULL;
1132 }
1133 if (refobj != NULL && refobj->z_origin)
1134 return origin_subst(xname, refobj->origin_path);
1135 else
1136 return xstrdup(xname);
1137 }
1138
1139 if (libmap_disable || (refobj == NULL) ||
1140 (name = lm_find(refobj->path, xname)) == NULL)
1141 name = (char *)xname;
1142
1143 dbg(" Searching for \"%s\"", name);
1144
1145 if ((pathname = search_library_path(name, ld_library_path)) != NULL ||
1146 (refobj != NULL &&
1147 (pathname = search_library_path(name, refobj->rpath)) != NULL) ||
1148 (pathname = search_library_path(name, gethints())) != NULL ||
1149 (pathname = search_library_path(name, STANDARD_LIBRARY_PATH)) != NULL)
1150 return pathname;
1151
1152 if(refobj != NULL && refobj->path != NULL) {
1153 _rtld_error("Shared object \"%s\" not found, required by \"%s\"",
1154 name, basename(refobj->path));
1155 } else {
1156 _rtld_error("Shared object \"%s\" not found", name);
1157 }
1158 return NULL;
1159}
1160
1161/*
1162 * Given a symbol number in a referencing object, find the corresponding
1163 * definition of the symbol. Returns a pointer to the symbol, or NULL if
1164 * no definition was found. Returns a pointer to the Obj_Entry of the
1165 * defining object via the reference parameter DEFOBJ_OUT.
1166 */
1167const Elf_Sym *
1168find_symdef(unsigned long symnum, const Obj_Entry *refobj,
1169 const Obj_Entry **defobj_out, int flags, SymCache *cache)
1170{
1171 const Elf_Sym *ref;
1172 const Elf_Sym *def;
1173 const Obj_Entry *defobj;
1174 const Ver_Entry *ventry;
1175 const char *name;
1176 unsigned long hash;
1177
1178 /*
1179 * If we have already found this symbol, get the information from
1180 * the cache.
1181 */
1182 if (symnum >= refobj->nchains)
1183 return NULL; /* Bad object */
1184 if (cache != NULL && cache[symnum].sym != NULL) {
1185 *defobj_out = cache[symnum].obj;
1186 return cache[symnum].sym;
1187 }
1188
1189 ref = refobj->symtab + symnum;
1190 name = refobj->strtab + ref->st_name;
1191 defobj = NULL;
1192
1193 /*
1194 * We don't have to do a full scale lookup if the symbol is local.
1195 * We know it will bind to the instance in this load module; to
1196 * which we already have a pointer (ie ref). By not doing a lookup,
1197 * we not only improve performance, but it also avoids unresolvable
1198 * symbols when local symbols are not in the hash table. This has
1199 * been seen with the ia64 toolchain.
1200 */
1201 if (ELF_ST_BIND(ref->st_info) != STB_LOCAL) {
1202 if (ELF_ST_TYPE(ref->st_info) == STT_SECTION) {
1203 _rtld_error("%s: Bogus symbol table entry %lu", refobj->path,
1204 symnum);
1205 }
1206 ventry = fetch_ventry(refobj, symnum);
1207 hash = elf_hash(name);
1208 def = symlook_default(name, hash, refobj, &defobj, ventry, flags);
1209 } else {
1210 def = ref;
1211 defobj = refobj;
1212 }
1213
1214 /*
1215 * If we found no definition and the reference is weak, treat the
1216 * symbol as having the value zero.
1217 */
1218 if (def == NULL && ELF_ST_BIND(ref->st_info) == STB_WEAK) {
1219 def = &sym_zero;
1220 defobj = obj_main;
1221 }
1222
1223 if (def != NULL) {
1224 *defobj_out = defobj;
1225 /* Record the information in the cache to avoid subsequent lookups. */
1226 if (cache != NULL) {
1227 cache[symnum].sym = def;
1228 cache[symnum].obj = defobj;
1229 }
1230 } else {
1231 if (refobj != &obj_rtld)
1232 _rtld_error("%s: Undefined symbol \"%s\"", refobj->path, name);
1233 }
1234 return def;
1235}
1236
1237/*
1238 * Return the search path from the ldconfig hints file, reading it if
1239 * necessary. Returns NULL if there are problems with the hints file,
1240 * or if the search path there is empty.
1241 */
1242static const char *
1243gethints(void)
1244{
1245 static char *hints;
1246
1247 if (hints == NULL) {
1248 int fd;
1249 struct elfhints_hdr hdr;
1250 char *p;
1251
1252 /* Keep from trying again in case the hints file is bad. */
1253 hints = "";
1254
1255 if ((fd = open(ld_elf_hints_path, O_RDONLY)) == -1)
1256 return NULL;
1257 if (read(fd, &hdr, sizeof hdr) != sizeof hdr ||
1258 hdr.magic != ELFHINTS_MAGIC ||
1259 hdr.version != 1) {
1260 close(fd);
1261 return NULL;
1262 }
1263 p = xmalloc(hdr.dirlistlen + 1);
1264 if (lseek(fd, hdr.strtab + hdr.dirlist, SEEK_SET) == -1 ||
1265 read(fd, p, hdr.dirlistlen + 1) != (ssize_t)hdr.dirlistlen + 1) {
1266 free(p);
1267 close(fd);
1268 return NULL;
1269 }
1270 hints = p;
1271 close(fd);
1272 }
1273 return hints[0] != '\0' ? hints : NULL;
1274}
1275
1276static void
1277init_dag(Obj_Entry *root)
1278{
1279 DoneList donelist;
1280
1281 donelist_init(&donelist);
1282 init_dag1(root, root, &donelist);
1283}
1284
1285static void
1286init_dag1(Obj_Entry *root, Obj_Entry *obj, DoneList *dlp)
1287{
1288 const Needed_Entry *needed;
1289
1290 if (donelist_check(dlp, obj))
1291 return;
1292
1293 obj->refcount++;
1294 objlist_push_tail(&obj->dldags, root);
1295 objlist_push_tail(&root->dagmembers, obj);
1296 for (needed = obj->needed; needed != NULL; needed = needed->next)
1297 if (needed->obj != NULL)
1298 init_dag1(root, needed->obj, dlp);
1299}
1300
1301/*
1302 * Initialize the dynamic linker. The argument is the address at which
1303 * the dynamic linker has been mapped into memory. The primary task of
1304 * this function is to relocate the dynamic linker.
1305 */
1306static void
1307init_rtld(caddr_t mapbase)
1308{
1309 Obj_Entry objtmp; /* Temporary rtld object */
1310
1311 /*
1312 * Conjure up an Obj_Entry structure for the dynamic linker.
1313 *
1314 * The "path" member can't be initialized yet because string constants
1315 * cannot yet be accessed. Below we will set it correctly.
1316 */
1317 memset(&objtmp, 0, sizeof(objtmp));
1318 objtmp.path = NULL;
1319 objtmp.rtld = true;
1320 objtmp.mapbase = mapbase;
1321#ifdef PIC
1322 objtmp.relocbase = mapbase;
1323#endif
1324 if (RTLD_IS_DYNAMIC()) {
1325 objtmp.dynamic = rtld_dynamic(&objtmp);
1326 digest_dynamic(&objtmp, 1);
1327 assert(objtmp.needed == NULL);
1328#if !defined(__mips__)
1329 /* MIPS and SH{3,5} have a bogus DT_TEXTREL. */
1330 assert(!objtmp.textrel);
1331#endif
1332
1333 /*
1334 * Temporarily put the dynamic linker entry into the object list, so
1335 * that symbols can be found.
1336 */
1337
1338 relocate_objects(&objtmp, true, &objtmp);
1339 }
1340
1341 /* Initialize the object list. */
1342 obj_tail = &obj_list;
1343
1344 /* Now that non-local variables can be accesses, copy out obj_rtld. */
1345 memcpy(&obj_rtld, &objtmp, sizeof(obj_rtld));
1346
1347 /* Replace the path with a dynamically allocated copy. */
1348 obj_rtld.path = xstrdup(PATH_RTLD);
1349
1350 r_debug.r_brk = r_debug_state;
1351 r_debug.r_state = RT_CONSISTENT;
1352}
1353
1354/*
1355 * Add the init functions from a needed object list (and its recursive
1356 * needed objects) to "list". This is not used directly; it is a helper
1357 * function for initlist_add_objects(). The write lock must be held
1358 * when this function is called.
1359 */
1360static void
1361initlist_add_neededs(Needed_Entry *needed, Objlist *list)
1362{
1363 /* Recursively process the successor needed objects. */
1364 if (needed->next != NULL)
1365 initlist_add_neededs(needed->next, list);
1366
1367 /* Process the current needed object. */
1368 if (needed->obj != NULL)
1369 initlist_add_objects(needed->obj, &needed->obj->next, list);
1370}
1371
1372/*
1373 * Scan all of the DAGs rooted in the range of objects from "obj" to
1374 * "tail" and add their init functions to "list". This recurses over
1375 * the DAGs and ensure the proper init ordering such that each object's
1376 * needed libraries are initialized before the object itself. At the
1377 * same time, this function adds the objects to the global finalization
1378 * list "list_fini" in the opposite order. The write lock must be
1379 * held when this function is called.
1380 */
1381static void
1382initlist_add_objects(Obj_Entry *obj, Obj_Entry **tail, Objlist *list)
1383{
1384 if (obj->init_scanned || obj->init_done)
1385 return;
1386 obj->init_scanned = true;
1387
1388 /* Recursively process the successor objects. */
1389 if (&obj->next != tail)
1390 initlist_add_objects(obj->next, tail, list);
1391
1392 /* Recursively process the needed objects. */
1393 if (obj->needed != NULL)
1394 initlist_add_neededs(obj->needed, list);
1395
1396 /* Add the object to the init list. */
1397 if (obj->init != (Elf_Addr)NULL)
1398 objlist_push_tail(list, obj);
1399
1400 /* Add the object to the global fini list in the reverse order. */
1401 if (obj->fini != (Elf_Addr)NULL && !obj->on_fini_list) {
1402 objlist_push_head(&list_fini, obj);
1403 obj->on_fini_list = true;
1404 }
1405}
1406
1407#ifndef FPTR_TARGET
1408#define FPTR_TARGET(f) ((Elf_Addr) (f))
1409#endif
1410
1411static bool
1412is_exported(const Elf_Sym *def)
1413{
1414 Elf_Addr value;
1415 const func_ptr_type *p;
1416
1417 value = (Elf_Addr)(obj_rtld.relocbase + def->st_value);
1418 for (p = exports; *p != NULL; p++)
1419 if (FPTR_TARGET(*p) == value)
1420 return true;
1421 return false;
1422}
1423
1424/*
1425 * Given a shared object, traverse its list of needed objects, and load
1426 * each of them. Returns 0 on success. Generates an error message and
1427 * returns -1 on failure.
1428 */
1429static int
1430load_needed_objects(Obj_Entry *first, int flags)
1431{
1432 Obj_Entry *obj, *obj1;
1433
1434 for (obj = first; obj != NULL; obj = obj->next) {
1435 Needed_Entry *needed;
1436
1437 for (needed = obj->needed; needed != NULL; needed = needed->next) {
1438 obj1 = needed->obj = load_object(obj->strtab + needed->name, obj,
1439 flags & ~RTLD_LO_NOLOAD);
1440 if (obj1 == NULL && !ld_tracing)
1441 return -1;
1442 if (obj1 != NULL && obj1->z_nodelete && !obj1->ref_nodel) {
1443 dbg("obj %s nodelete", obj1->path);
1444 init_dag(obj1);
1445 ref_dag(obj1);
1446 obj1->ref_nodel = true;
1447 }
1448 }
1449 }
1450
1451 return 0;
1452}
1453
1454static int
1455load_preload_objects(void)
1456{
1457 char *p = ld_preload;
1458 static const char delim[] = " \t:;";
1459
1460 if (p == NULL)
1461 return 0;
1462
1463 p += strspn(p, delim);
1464 while (*p != '\0') {
1465 size_t len = strcspn(p, delim);
1466 char savech;
1467
1468 savech = p[len];
1469 p[len] = '\0';
1470 if (load_object(p, NULL, 0) == NULL)
1471 return -1; /* XXX - cleanup */
1472 p[len] = savech;
1473 p += len;
1474 p += strspn(p, delim);
1475 }
1476 LD_UTRACE(UTRACE_PRELOAD_FINISHED, NULL, NULL, 0, 0, NULL);
1477 return 0;
1478}
1479
1480/*
1481 * Load a shared object into memory, if it is not already loaded.
1482 *
1483 * Returns a pointer to the Obj_Entry for the object. Returns NULL
1484 * on failure.
1485 */
1486static Obj_Entry *
1487load_object(const char *name, const Obj_Entry *refobj, int flags)
1488{
1489 Obj_Entry *obj;
1490 int fd = -1;
1491 struct stat sb;
1492 char *path;
1493
1494 for (obj = obj_list->next; obj != NULL; obj = obj->next)
1495 if (object_match_name(obj, name))
1496 return obj;
1497
1498 path = find_library(name, refobj);
1499 if (path == NULL)
1500 return NULL;
1501
1502 /*
1503 * If we didn't find a match by pathname, open the file and check
1504 * again by device and inode. This avoids false mismatches caused
1505 * by multiple links or ".." in pathnames.
1506 *
1507 * To avoid a race, we open the file and use fstat() rather than
1508 * using stat().
1509 */
1510 if ((fd = open(path, O_RDONLY)) == -1) {
1511 _rtld_error("Cannot open \"%s\"", path);
1512 free(path);
1513 return NULL;
1514 }
1515 if (fstat(fd, &sb) == -1) {
1516 _rtld_error("Cannot fstat \"%s\"", path);
1517 close(fd);
1518 free(path);
1519 return NULL;
1520 }
1521 for (obj = obj_list->next; obj != NULL; obj = obj->next) {
1522 if (obj->ino == sb.st_ino && obj->dev == sb.st_dev) {
1523 close(fd);
1524 break;
1525 }
1526 }
1527 if (obj != NULL) {
1528 object_add_name(obj, name);
1529 free(path);
1530 close(fd);
1531 return obj;
1532 }
1533 if (flags & RTLD_LO_NOLOAD)
1534 return (NULL);
1535
1536 /* First use of this object, so we must map it in */
1537 obj = do_load_object(fd, name, path, &sb, flags);
1538 if (obj == NULL)
1539 free(path);
1540 close(fd);
1541
1542 return obj;
1543}
1544
1545static Obj_Entry *
1546do_load_object(int fd, const char *name, char *path, struct stat *sbp,
1547 int flags)
1548{
1549 Obj_Entry *obj;
1550 struct statfs fs;
1551
1552 /*
1553 * but first, make sure that environment variables haven't been
1554 * used to circumvent the noexec flag on a filesystem.
1555 */
1556 if (dangerous_ld_env) {
1557 if (fstatfs(fd, &fs) != 0) {
1558 _rtld_error("Cannot fstatfs \"%s\"", path);
1559 return NULL;
1560 }
1561 if (fs.f_flags & MNT_NOEXEC) {
1562 _rtld_error("Cannot execute objects on %s\n", fs.f_mntonname);
1563 return NULL;
1564 }
1565 }
1566 dbg("loading \"%s\"", path);
1567 obj = map_object(fd, path, sbp);
1568 if (obj == NULL)
1569 return NULL;
1570
1571 object_add_name(obj, name);
1572 obj->path = path;
1573 digest_dynamic(obj, 0);
1574 if (obj->z_noopen && (flags & (RTLD_LO_DLOPEN | RTLD_LO_TRACE)) ==
1575 RTLD_LO_DLOPEN) {
1576 dbg("refusing to load non-loadable \"%s\"", obj->path);
1577 _rtld_error("Cannot dlopen non-loadable %s", obj->path);
1578 munmap(obj->mapbase, obj->mapsize);
1579 obj_free(obj);
1580 return (NULL);
1581 }
1582
1583 *obj_tail = obj;
1584 obj_tail = &obj->next;
1585 obj_count++;
1586 obj_loads++;
1587 linkmap_add(obj); /* for GDB & dlinfo() */
1588
1589 dbg(" %p .. %p: %s", obj->mapbase,
1590 obj->mapbase + obj->mapsize - 1, obj->path);
1591 if (obj->textrel)
1592 dbg(" WARNING: %s has impure text", obj->path);
1593 LD_UTRACE(UTRACE_LOAD_OBJECT, obj, obj->mapbase, obj->mapsize, 0,
1594 obj->path);
1595
1596 return obj;
1597}
1598
1599static Obj_Entry *
1600obj_from_addr(const void *addr)
1601{
1602 Obj_Entry *obj;
1603
1604 for (obj = obj_list; obj != NULL; obj = obj->next) {
1605 if (addr < (void *) obj->mapbase)
1606 continue;
1607 if (addr < (void *) (obj->mapbase + obj->mapsize))
1608 return obj;
1609 }
1610 return NULL;
1611}
1612
1613/*
1614 * Call the finalization functions for each of the objects in "list"
1615 * which are unreferenced. All of the objects are expected to have
1616 * non-NULL fini functions.
1617 */
1618static void
1619objlist_call_fini(Objlist *list, bool force, int *lockstate)
1620{
1621 Objlist_Entry *elm, *elm_tmp;
1622 char *saved_msg;
1623
1624 /*
1625 * Preserve the current error message since a fini function might
1626 * call into the dynamic linker and overwrite it.
1627 */
1628 saved_msg = errmsg_save();
1629 STAILQ_FOREACH_SAFE(elm, list, link, elm_tmp) {
1630 if (elm->obj->refcount == 0 || force) {
1631 dbg("calling fini function for %s at %p", elm->obj->path,
1632 (void *)elm->obj->fini);
1633 LD_UTRACE(UTRACE_FINI_CALL, elm->obj, (void *)elm->obj->fini, 0, 0,
1634 elm->obj->path);
1635 /* Remove object from fini list to prevent recursive invocation. */
1636 STAILQ_REMOVE(list, elm, Struct_Objlist_Entry, link);
1637 wlock_release(rtld_bind_lock, *lockstate);
1638 call_initfini_pointer(elm->obj, elm->obj->fini);
1639 *lockstate = wlock_acquire(rtld_bind_lock);
1640 /* No need to free anything if process is going down. */
1641 if (!force)
1642 free(elm);
1643 }
1644 }
1645 errmsg_restore(saved_msg);
1646}
1647
1648/*
1649 * Call the initialization functions for each of the objects in
1650 * "list". All of the objects are expected to have non-NULL init
1651 * functions.
1652 */
1653static void
1654objlist_call_init(Objlist *list, int *lockstate)
1655{
1656 Objlist_Entry *elm;
1657 Obj_Entry *obj;
1658 char *saved_msg;
1659
1660 /*
1661 * Clean init_scanned flag so that objects can be rechecked and
1662 * possibly initialized earlier if any of vectors called below
1663 * cause the change by using dlopen.
1664 */
1665 for (obj = obj_list; obj != NULL; obj = obj->next)
1666 obj->init_scanned = false;
1667
1668 /*
1669 * Preserve the current error message since an init function might
1670 * call into the dynamic linker and overwrite it.
1671 */
1672 saved_msg = errmsg_save();
1673 STAILQ_FOREACH(elm, list, link) {
1674 if (elm->obj->init_done) /* Initialized early. */
1675 continue;
1676 dbg("calling init function for %s at %p", elm->obj->path,
1677 (void *)elm->obj->init);
1678 LD_UTRACE(UTRACE_INIT_CALL, elm->obj, (void *)elm->obj->init, 0, 0,
1679 elm->obj->path);
1680 /*
1681 * Race: other thread might try to use this object before current
1682 * one completes the initilization. Not much can be done here
1683 * without better locking.
1684 */
1685 elm->obj->init_done = true;
1686 wlock_release(rtld_bind_lock, *lockstate);
1687 call_initfini_pointer(elm->obj, elm->obj->init);
1688 *lockstate = wlock_acquire(rtld_bind_lock);
1689 }
1690 errmsg_restore(saved_msg);
1691}
1692
1693static void
1694objlist_clear(Objlist *list)
1695{
1696 Objlist_Entry *elm;
1697
1698 while (!STAILQ_EMPTY(list)) {
1699 elm = STAILQ_FIRST(list);
1700 STAILQ_REMOVE_HEAD(list, link);
1701 free(elm);
1702 }
1703}
1704
1705static Objlist_Entry *
1706objlist_find(Objlist *list, const Obj_Entry *obj)
1707{
1708 Objlist_Entry *elm;
1709
1710 STAILQ_FOREACH(elm, list, link)
1711 if (elm->obj == obj)
1712 return elm;
1713 return NULL;
1714}
1715
1716static void
1717objlist_init(Objlist *list)
1718{
1719 STAILQ_INIT(list);
1720}
1721
1722static void
1723objlist_push_head(Objlist *list, Obj_Entry *obj)
1724{
1725 Objlist_Entry *elm;
1726
1727 elm = NEW(Objlist_Entry);
1728 elm->obj = obj;
1729 STAILQ_INSERT_HEAD(list, elm, link);
1730}
1731
1732static void
1733objlist_push_tail(Objlist *list, Obj_Entry *obj)
1734{
1735 Objlist_Entry *elm;
1736
1737 elm = NEW(Objlist_Entry);
1738 elm->obj = obj;
1739 STAILQ_INSERT_TAIL(list, elm, link);
1740}
1741
1742static void
1743objlist_remove(Objlist *list, Obj_Entry *obj)
1744{
1745 Objlist_Entry *elm;
1746
1747 if ((elm = objlist_find(list, obj)) != NULL) {
1748 STAILQ_REMOVE(list, elm, Struct_Objlist_Entry, link);
1749 free(elm);
1750 }
1751}
1752
1753/*
1754 * Relocate newly-loaded shared objects. The argument is a pointer to
1755 * the Obj_Entry for the first such object. All objects from the first
1756 * to the end of the list of objects are relocated. Returns 0 on success,
1757 * or -1 on failure.
1758 */
1759static int
1760relocate_objects(Obj_Entry *first, bool bind_now, Obj_Entry *rtldobj)
1761{
1762 Obj_Entry *obj;
1763
1764 for (obj = first; obj != NULL; obj = obj->next) {
1765 if (obj != rtldobj)
1766 dbg("relocating \"%s\"", obj->path);
1767 if (obj->nbuckets == 0 || obj->nchains == 0 || obj->buckets == NULL ||
1768 obj->symtab == NULL || obj->strtab == NULL) {
1769 _rtld_error("%s: Shared object has no run-time symbol table",
1770 obj->path);
1771 return -1;
1772 }
1773
1774 if (obj->textrel) {
1775 /* There are relocations to the write-protected text segment. */
1776 if (mprotect(obj->mapbase, obj->textsize,
1777 PROT_READ|PROT_WRITE|PROT_EXEC) == -1) {
1778 _rtld_error("%s: Cannot write-enable text segment: %s",
1779 obj->path, strerror(errno));
1780 return -1;
1781 }
1782 }
1783
1784 /* Process the non-PLT relocations. */
1785 if (reloc_non_plt(obj, rtldobj))
1786 return -1;
1787
1788 if (obj->textrel) { /* Re-protected the text segment. */
1789 if (mprotect(obj->mapbase, obj->textsize,
1790 PROT_READ|PROT_EXEC) == -1) {
1791 _rtld_error("%s: Cannot write-protect text segment: %s",
1792 obj->path, strerror(errno));
1793 return -1;
1794 }
1795 }
1796
1797 /* Process the PLT relocations. */
1798 if (reloc_plt(obj) == -1)
1799 return -1;
1800 /* Relocate the jump slots if we are doing immediate binding. */
1801 if (obj->bind_now || bind_now)
1802 if (reloc_jmpslots(obj) == -1)
1803 return -1;
1804
1805
1806 /*
1807 * Set up the magic number and version in the Obj_Entry. These
1808 * were checked in the crt1.o from the original ElfKit, so we
1809 * set them for backward compatibility.
1810 */
1811 obj->magic = RTLD_MAGIC;
1812 obj->version = RTLD_VERSION;
1813
1814 /* Set the special PLT or GOT entries. */
1815 init_pltgot(obj);
1816 }
1817
1818 return 0;
1819}
1820
1821/*
1822 * Cleanup procedure. It will be called (by the atexit mechanism) just
1823 * before the process exits.
1824 */
1825static void
1826rtld_exit(void)
1827{
1828 int lockstate;
1829
1830 lockstate = wlock_acquire(rtld_bind_lock);
1831 dbg("rtld_exit()");
1832 objlist_call_fini(&list_fini, true, &lockstate);
1833 /* No need to remove the items from the list, since we are exiting. */
1834 if (!libmap_disable)
1835 lm_fini();
1836 wlock_release(rtld_bind_lock, lockstate);
1837}
1838
1839static void *
1840path_enumerate(const char *path, path_enum_proc callback, void *arg)
1841{
1842#ifdef COMPAT_32BIT
1843 const char *trans;
1844#endif
1845 if (path == NULL)
1846 return (NULL);
1847
1848 path += strspn(path, ":;");
1849 while (*path != '\0') {
1850 size_t len;
1851 char *res;
1852
1853 len = strcspn(path, ":;");
1854#ifdef COMPAT_32BIT
1855 trans = lm_findn(NULL, path, len);
1856 if (trans)
1857 res = callback(trans, strlen(trans), arg);
1858 else
1859#endif
1860 res = callback(path, len, arg);
1861
1862 if (res != NULL)
1863 return (res);
1864
1865 path += len;
1866 path += strspn(path, ":;");
1867 }
1868
1869 return (NULL);
1870}
1871
1872struct try_library_args {
1873 const char *name;
1874 size_t namelen;
1875 char *buffer;
1876 size_t buflen;
1877};
1878
1879static void *
1880try_library_path(const char *dir, size_t dirlen, void *param)
1881{
1882 struct try_library_args *arg;
1883
1884 arg = param;
1885 if (*dir == '/' || trust) {
1886 char *pathname;
1887
1888 if (dirlen + 1 + arg->namelen + 1 > arg->buflen)
1889 return (NULL);
1890
1891 pathname = arg->buffer;
1892 strncpy(pathname, dir, dirlen);
1893 pathname[dirlen] = '/';
1894 strcpy(pathname + dirlen + 1, arg->name);
1895
1896 dbg(" Trying \"%s\"", pathname);
1897 if (access(pathname, F_OK) == 0) { /* We found it */
1898 pathname = xmalloc(dirlen + 1 + arg->namelen + 1);
1899 strcpy(pathname, arg->buffer);
1900 return (pathname);
1901 }
1902 }
1903 return (NULL);
1904}
1905
1906static char *
1907search_library_path(const char *name, const char *path)
1908{
1909 char *p;
1910 struct try_library_args arg;
1911
1912 if (path == NULL)
1913 return NULL;
1914
1915 arg.name = name;
1916 arg.namelen = strlen(name);
1917 arg.buffer = xmalloc(PATH_MAX);
1918 arg.buflen = PATH_MAX;
1919
1920 p = path_enumerate(path, try_library_path, &arg);
1921
1922 free(arg.buffer);
1923
1924 return (p);
1925}
1926
1927int
1928dlclose(void *handle)
1929{
1930 Obj_Entry *root;
1931 int lockstate;
1932
1933 lockstate = wlock_acquire(rtld_bind_lock);
1934 root = dlcheck(handle);
1935 if (root == NULL) {
1936 wlock_release(rtld_bind_lock, lockstate);
1937 return -1;
1938 }
1939 LD_UTRACE(UTRACE_DLCLOSE_START, handle, NULL, 0, root->dl_refcount,
1940 root->path);
1941
1942 /* Unreference the object and its dependencies. */
1943 root->dl_refcount--;
1944
1945 unref_dag(root);
1946
1947 if (root->refcount == 0) {
1948 /*
1949 * The object is no longer referenced, so we must unload it.
1950 * First, call the fini functions.
1951 */
1952 objlist_call_fini(&list_fini, false, &lockstate);
1953
1954 /* Finish cleaning up the newly-unreferenced objects. */
1955 GDB_STATE(RT_DELETE,&root->linkmap);
1956 unload_object(root);
1957 GDB_STATE(RT_CONSISTENT,NULL);
1958 }
1959 LD_UTRACE(UTRACE_DLCLOSE_STOP, handle, NULL, 0, 0, NULL);
1960 wlock_release(rtld_bind_lock, lockstate);
1961 return 0;
1962}
1963
1964char *
1965dlerror(void)
1966{
1967 char *msg = error_message;
1968 error_message = NULL;
1969 return msg;
1970}
1971
1972/*
1973 * This function is deprecated and has no effect.
1974 */
1975void
1976dllockinit(void *context,
1977 void *(*lock_create)(void *context),
1978 void (*rlock_acquire)(void *lock),
1979 void (*wlock_acquire)(void *lock),
1980 void (*lock_release)(void *lock),
1981 void (*lock_destroy)(void *lock),
1982 void (*context_destroy)(void *context))
1983{
1984 static void *cur_context;
1985 static void (*cur_context_destroy)(void *);
1986
1987 /* Just destroy the context from the previous call, if necessary. */
1988 if (cur_context_destroy != NULL)
1989 cur_context_destroy(cur_context);
1990 cur_context = context;
1991 cur_context_destroy = context_destroy;
1992}
1993
1994void *
1995dlopen(const char *name, int mode)
1996{
1997 Obj_Entry **old_obj_tail;
1998 Obj_Entry *obj;
1999 Objlist initlist;
2000 int result, lockstate, nodelete, lo_flags;
2001
2002 LD_UTRACE(UTRACE_DLOPEN_START, NULL, NULL, 0, mode, name);
2003 ld_tracing = (mode & RTLD_TRACE) == 0 ? NULL : "1";
2004 if (ld_tracing != NULL)
2005 environ = (char **)*get_program_var_addr("environ");
2006 nodelete = mode & RTLD_NODELETE;
2007 lo_flags = RTLD_LO_DLOPEN;
2008 if (mode & RTLD_NOLOAD)
2009 lo_flags |= RTLD_LO_NOLOAD;
2010 if (ld_tracing != NULL)
2011 lo_flags |= RTLD_LO_TRACE;
2012
2013 objlist_init(&initlist);
2014
2015 lockstate = wlock_acquire(rtld_bind_lock);
2016 GDB_STATE(RT_ADD,NULL);
2017
2018 old_obj_tail = obj_tail;
2019 obj = NULL;
2020 if (name == NULL) {
2021 obj = obj_main;
2022 obj->refcount++;
2023 } else {
2024 obj = load_object(name, obj_main, lo_flags);
2025 }
2026
2027 if (obj) {
2028 obj->dl_refcount++;
2029 if (mode & RTLD_GLOBAL && objlist_find(&list_global, obj) == NULL)
2030 objlist_push_tail(&list_global, obj);
2031 mode &= RTLD_MODEMASK;
2032 if (*old_obj_tail != NULL) { /* We loaded something new. */
2033 assert(*old_obj_tail == obj);
2034 result = load_needed_objects(obj, RTLD_LO_DLOPEN);
2035 init_dag(obj);
2036 if (result != -1)
2037 result = rtld_verify_versions(&obj->dagmembers);
2038 if (result != -1 && ld_tracing)
2039 goto trace;
2040 if (result == -1 ||
2041 (relocate_objects(obj, mode == RTLD_NOW, &obj_rtld)) == -1) {
2042 obj->dl_refcount--;
2043 unref_dag(obj);
2044 if (obj->refcount == 0)
2045 unload_object(obj);
2046 obj = NULL;
2047 } else {
2048 /* Make list of init functions to call. */
2049 initlist_add_objects(obj, &obj->next, &initlist);
2050 }
2051 } else {
2052
2053 /* Bump the reference counts for objects on this DAG. */
2054 ref_dag(obj);
2055
2056 if (ld_tracing)
2057 goto trace;
2058 }
2059 if (obj != NULL && (nodelete || obj->z_nodelete) && !obj->ref_nodel) {
2060 dbg("obj %s nodelete", obj->path);
2061 ref_dag(obj);
2062 obj->z_nodelete = obj->ref_nodel = true;
2063 }
2064 }
2065
2066 LD_UTRACE(UTRACE_DLOPEN_STOP, obj, NULL, 0, obj ? obj->dl_refcount : 0,
2067 name);
2068 GDB_STATE(RT_CONSISTENT,obj ? &obj->linkmap : NULL);
2069
2070 /* Call the init functions. */
2071 objlist_call_init(&initlist, &lockstate);
2072 objlist_clear(&initlist);
2073 wlock_release(rtld_bind_lock, lockstate);
2074 return obj;
2075trace:
2076 trace_loaded_objects(obj);
2077 wlock_release(rtld_bind_lock, lockstate);
2078 exit(0);
2079}
2080
2081static void *
2082do_dlsym(void *handle, const char *name, void *retaddr, const Ver_Entry *ve,
2083 int flags)
2084{
2085 DoneList donelist;
2086 const Obj_Entry *obj, *defobj;
2087 const Elf_Sym *def, *symp;
2088 unsigned long hash;
2089 int lockstate;
2090
2091 hash = elf_hash(name);
2092 def = NULL;
2093 defobj = NULL;
2094 flags |= SYMLOOK_IN_PLT;
2095
2096 lockstate = rlock_acquire(rtld_bind_lock);
2097 if (handle == NULL || handle == RTLD_NEXT ||
2098 handle == RTLD_DEFAULT || handle == RTLD_SELF) {
2099
2100 if ((obj = obj_from_addr(retaddr)) == NULL) {
2101 _rtld_error("Cannot determine caller's shared object");
2102 rlock_release(rtld_bind_lock, lockstate);
2103 return NULL;
2104 }
2105 if (handle == NULL) { /* Just the caller's shared object. */
2106 def = symlook_obj(name, hash, obj, ve, flags);
2107 defobj = obj;
2108 } else if (handle == RTLD_NEXT || /* Objects after caller's */
2109 handle == RTLD_SELF) { /* ... caller included */
2110 if (handle == RTLD_NEXT)
2111 obj = obj->next;
2112 for (; obj != NULL; obj = obj->next) {
2113 if ((symp = symlook_obj(name, hash, obj, ve, flags)) != NULL) {
2114 if (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK) {
2115 def = symp;
2116 defobj = obj;
2117 if (ELF_ST_BIND(def->st_info) != STB_WEAK)
2118 break;
2119 }
2120 }
2121 }
2122 /*
2123 * Search the dynamic linker itself, and possibly resolve the
2124 * symbol from there. This is how the application links to
2125 * dynamic linker services such as dlopen. Only the values listed
2126 * in the "exports" array can be resolved from the dynamic linker.
2127 */
2128 if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) {
2129 symp = symlook_obj(name, hash, &obj_rtld, ve, flags);
2130 if (symp != NULL && is_exported(symp)) {
2131 def = symp;
2132 defobj = &obj_rtld;
2133 }
2134 }
2135 } else {
2136 assert(handle == RTLD_DEFAULT);
2137 def = symlook_default(name, hash, obj, &defobj, ve, flags);
2138 }
2139 } else {
2140 if ((obj = dlcheck(handle)) == NULL) {
2141 rlock_release(rtld_bind_lock, lockstate);
2142 return NULL;
2143 }
2144
2145 donelist_init(&donelist);
2146 if (obj->mainprog) {
2147 /* Search main program and all libraries loaded by it. */
2148 def = symlook_list(name, hash, &list_main, &defobj, ve, flags,
2149 &donelist);
2150
2151 /*
2152 * We do not distinguish between 'main' object and global scope.
2153 * If symbol is not defined by objects loaded at startup, continue
2154 * search among dynamically loaded objects with RTLD_GLOBAL
2155 * scope.
2156 */
2157 if (def == NULL)
2158 def = symlook_list(name, hash, &list_global, &defobj, ve,
2159 flags, &donelist);
2160 } else {
2161 Needed_Entry fake;
2162
2163 /* Search the whole DAG rooted at the given object. */
2164 fake.next = NULL;
2165 fake.obj = (Obj_Entry *)obj;
2166 fake.name = 0;
2167 def = symlook_needed(name, hash, &fake, &defobj, ve, flags,
2168 &donelist);
2169 }
2170 }
2171
2172 if (def != NULL) {
2173 rlock_release(rtld_bind_lock, lockstate);
2174
2175 /*
2176 * The value required by the caller is derived from the value
2177 * of the symbol. For the ia64 architecture, we need to
2178 * construct a function descriptor which the caller can use to
2179 * call the function with the right 'gp' value. For other
2180 * architectures and for non-functions, the value is simply
2181 * the relocated value of the symbol.
2182 */
2183 if (ELF_ST_TYPE(def->st_info) == STT_FUNC)
2184 return make_function_pointer(def, defobj);
2185 else
2186 return defobj->relocbase + def->st_value;
2187 }
2188
2189 _rtld_error("Undefined symbol \"%s\"", name);
2190 rlock_release(rtld_bind_lock, lockstate);
2191 return NULL;
2192}
2193
2194void *
2195dlsym(void *handle, const char *name)
2196{
2197 return do_dlsym(handle, name, __builtin_return_address(0), NULL,
2198 SYMLOOK_DLSYM);
2199}
2200
2201dlfunc_t
2202dlfunc(void *handle, const char *name)
2203{
2204 union {
2205 void *d;
2206 dlfunc_t f;
2207 } rv;
2208
2209 rv.d = do_dlsym(handle, name, __builtin_return_address(0), NULL,
2210 SYMLOOK_DLSYM);
2211 return (rv.f);
2212}
2213
2214void *
2215dlvsym(void *handle, const char *name, const char *version)
2216{
2217 Ver_Entry ventry;
2218
2219 ventry.name = version;
2220 ventry.file = NULL;
2221 ventry.hash = elf_hash(version);
2222 ventry.flags= 0;
2223 return do_dlsym(handle, name, __builtin_return_address(0), &ventry,
2224 SYMLOOK_DLSYM);
2225}
2226
2227int
2228dladdr(const void *addr, Dl_info *info)
2229{
2230 const Obj_Entry *obj;
2231 const Elf_Sym *def;
2232 void *symbol_addr;
2233 unsigned long symoffset;
2234 int lockstate;
2235
2236 lockstate = rlock_acquire(rtld_bind_lock);
2237 obj = obj_from_addr(addr);
2238 if (obj == NULL) {
2239 _rtld_error("No shared object contains address");
2240 rlock_release(rtld_bind_lock, lockstate);
2241 return 0;
2242 }
2243 info->dli_fname = obj->path;
2244 info->dli_fbase = obj->mapbase;
2245 info->dli_saddr = (void *)0;
2246 info->dli_sname = NULL;
2247
2248 /*
2249 * Walk the symbol list looking for the symbol whose address is
2250 * closest to the address sent in.
2251 */
2252 for (symoffset = 0; symoffset < obj->nchains; symoffset++) {
2253 def = obj->symtab + symoffset;
2254
2255 /*
2256 * For skip the symbol if st_shndx is either SHN_UNDEF or
2257 * SHN_COMMON.
2258 */
2259 if (def->st_shndx == SHN_UNDEF || def->st_shndx == SHN_COMMON)
2260 continue;
2261
2262 /*
2263 * If the symbol is greater than the specified address, or if it
2264 * is further away from addr than the current nearest symbol,
2265 * then reject it.
2266 */
2267 symbol_addr = obj->relocbase + def->st_value;
2268 if (symbol_addr > addr || symbol_addr < info->dli_saddr)
2269 continue;
2270
2271 /* Update our idea of the nearest symbol. */
2272 info->dli_sname = obj->strtab + def->st_name;
2273 info->dli_saddr = symbol_addr;
2274
2275 /* Exact match? */
2276 if (info->dli_saddr == addr)
2277 break;
2278 }
2279 rlock_release(rtld_bind_lock, lockstate);
2280 return 1;
2281}
2282
2283int
2284dlinfo(void *handle, int request, void *p)
2285{
2286 const Obj_Entry *obj;
2287 int error, lockstate;
2288
2289 lockstate = rlock_acquire(rtld_bind_lock);
2290
2291 if (handle == NULL || handle == RTLD_SELF) {
2292 void *retaddr;
2293
2294 retaddr = __builtin_return_address(0); /* __GNUC__ only */
2295 if ((obj = obj_from_addr(retaddr)) == NULL)
2296 _rtld_error("Cannot determine caller's shared object");
2297 } else
2298 obj = dlcheck(handle);
2299
2300 if (obj == NULL) {
2301 rlock_release(rtld_bind_lock, lockstate);
2302 return (-1);
2303 }
2304
2305 error = 0;
2306 switch (request) {
2307 case RTLD_DI_LINKMAP:
2308 *((struct link_map const **)p) = &obj->linkmap;
2309 break;
2310 case RTLD_DI_ORIGIN:
2311 error = rtld_dirname(obj->path, p);
2312 break;
2313
2314 case RTLD_DI_SERINFOSIZE:
2315 case RTLD_DI_SERINFO:
2316 error = do_search_info(obj, request, (struct dl_serinfo *)p);
2317 break;
2318
2319 default:
2320 _rtld_error("Invalid request %d passed to dlinfo()", request);
2321 error = -1;
2322 }
2323
2324 rlock_release(rtld_bind_lock, lockstate);
2325
2326 return (error);
2327}
2328
2329int
2330dl_iterate_phdr(__dl_iterate_hdr_callback callback, void *param)
2331{
2332 struct dl_phdr_info phdr_info;
2333 const Obj_Entry *obj;
2334 int error, bind_lockstate, phdr_lockstate;
2335
2336 phdr_lockstate = wlock_acquire(rtld_phdr_lock);
2337 bind_lockstate = rlock_acquire(rtld_bind_lock);
2338
2339 error = 0;
2340
2341 for (obj = obj_list; obj != NULL; obj = obj->next) {
2342 phdr_info.dlpi_addr = (Elf_Addr)obj->relocbase;
2343 phdr_info.dlpi_name = STAILQ_FIRST(&obj->names) ?
2344 STAILQ_FIRST(&obj->names)->name : obj->path;
2345 phdr_info.dlpi_phdr = obj->phdr;
2346 phdr_info.dlpi_phnum = obj->phsize / sizeof(obj->phdr[0]);
2347 phdr_info.dlpi_tls_modid = obj->tlsindex;
2348 phdr_info.dlpi_tls_data = obj->tlsinit;
2349 phdr_info.dlpi_adds = obj_loads;
2350 phdr_info.dlpi_subs = obj_loads - obj_count;
2351
2352 if ((error = callback(&phdr_info, sizeof phdr_info, param)) != 0)
2353 break;
2354
2355 }
2356 rlock_release(rtld_bind_lock, bind_lockstate);
2357 wlock_release(rtld_phdr_lock, phdr_lockstate);
2358
2359 return (error);
2360}
2361
2362struct fill_search_info_args {
2363 int request;
2364 unsigned int flags;
2365 Dl_serinfo *serinfo;
2366 Dl_serpath *serpath;
2367 char *strspace;
2368};
2369
2370static void *
2371fill_search_info(const char *dir, size_t dirlen, void *param)
2372{
2373 struct fill_search_info_args *arg;
2374
2375 arg = param;
2376
2377 if (arg->request == RTLD_DI_SERINFOSIZE) {
2378 arg->serinfo->dls_cnt ++;
2379 arg->serinfo->dls_size += sizeof(Dl_serpath) + dirlen + 1;
2380 } else {
2381 struct dl_serpath *s_entry;
2382
2383 s_entry = arg->serpath;
2384 s_entry->dls_name = arg->strspace;
2385 s_entry->dls_flags = arg->flags;
2386
2387 strncpy(arg->strspace, dir, dirlen);
2388 arg->strspace[dirlen] = '\0';
2389
2390 arg->strspace += dirlen + 1;
2391 arg->serpath++;
2392 }
2393
2394 return (NULL);
2395}
2396
2397static int
2398do_search_info(const Obj_Entry *obj, int request, struct dl_serinfo *info)
2399{
2400 struct dl_serinfo _info;
2401 struct fill_search_info_args args;
2402
2403 args.request = RTLD_DI_SERINFOSIZE;
2404 args.serinfo = &_info;
2405
2406 _info.dls_size = __offsetof(struct dl_serinfo, dls_serpath);
2407 _info.dls_cnt = 0;
2408
2409 path_enumerate(ld_library_path, fill_search_info, &args);
2410 path_enumerate(obj->rpath, fill_search_info, &args);
2411 path_enumerate(gethints(), fill_search_info, &args);
2412 path_enumerate(STANDARD_LIBRARY_PATH, fill_search_info, &args);
2413
2414
2415 if (request == RTLD_DI_SERINFOSIZE) {
2416 info->dls_size = _info.dls_size;
2417 info->dls_cnt = _info.dls_cnt;
2418 return (0);
2419 }
2420
2421 if (info->dls_cnt != _info.dls_cnt || info->dls_size != _info.dls_size) {
2422 _rtld_error("Uninitialized Dl_serinfo struct passed to dlinfo()");
2423 return (-1);
2424 }
2425
2426 args.request = RTLD_DI_SERINFO;
2427 args.serinfo = info;
2428 args.serpath = &info->dls_serpath[0];
2429 args.strspace = (char *)&info->dls_serpath[_info.dls_cnt];
2430
2431 args.flags = LA_SER_LIBPATH;
2432 if (path_enumerate(ld_library_path, fill_search_info, &args) != NULL)
2433 return (-1);
2434
2435 args.flags = LA_SER_RUNPATH;
2436 if (path_enumerate(obj->rpath, fill_search_info, &args) != NULL)
2437 return (-1);
2438
2439 args.flags = LA_SER_CONFIG;
2440 if (path_enumerate(gethints(), fill_search_info, &args) != NULL)
2441 return (-1);
2442
2443 args.flags = LA_SER_DEFAULT;
2444 if (path_enumerate(STANDARD_LIBRARY_PATH, fill_search_info, &args) != NULL)
2445 return (-1);
2446 return (0);
2447}
2448
2449static int
2450rtld_dirname(const char *path, char *bname)
2451{
2452 const char *endp;
2453
2454 /* Empty or NULL string gets treated as "." */
2455 if (path == NULL || *path == '\0') {
2456 bname[0] = '.';
2457 bname[1] = '\0';
2458 return (0);
2459 }
2460
2461 /* Strip trailing slashes */
2462 endp = path + strlen(path) - 1;
2463 while (endp > path && *endp == '/')
2464 endp--;
2465
2466 /* Find the start of the dir */
2467 while (endp > path && *endp != '/')
2468 endp--;
2469
2470 /* Either the dir is "/" or there are no slashes */
2471 if (endp == path) {
2472 bname[0] = *endp == '/' ? '/' : '.';
2473 bname[1] = '\0';
2474 return (0);
2475 } else {
2476 do {
2477 endp--;
2478 } while (endp > path && *endp == '/');
2479 }
2480
2481 if (endp - path + 2 > PATH_MAX)
2482 {
2483 _rtld_error("Filename is too long: %s", path);
2484 return(-1);
2485 }
2486
2487 strncpy(bname, path, endp - path + 1);
2488 bname[endp - path + 1] = '\0';
2489 return (0);
2490}
2491
2492static int
2493rtld_dirname_abs(const char *path, char *base)
2494{
2495 char base_rel[PATH_MAX];
2496
2497 if (rtld_dirname(path, base) == -1)
2498 return (-1);
2499 if (base[0] == '/')
2500 return (0);
2501 if (getcwd(base_rel, sizeof(base_rel)) == NULL ||
2502 strlcat(base_rel, "/", sizeof(base_rel)) >= sizeof(base_rel) ||
2503 strlcat(base_rel, base, sizeof(base_rel)) >= sizeof(base_rel))
2504 return (-1);
2505 strcpy(base, base_rel);
2506 return (0);
2507}
2508
2509static void
2510linkmap_add(Obj_Entry *obj)
2511{
2512 struct link_map *l = &obj->linkmap;
2513 struct link_map *prev;
2514
2515 obj->linkmap.l_name = obj->path;
2516 obj->linkmap.l_addr = obj->mapbase;
2517 obj->linkmap.l_ld = obj->dynamic;
2518#ifdef __mips__
2519 /* GDB needs load offset on MIPS to use the symbols */
2520 obj->linkmap.l_offs = obj->relocbase;
2521#endif
2522
2523 if (r_debug.r_map == NULL) {
2524 r_debug.r_map = l;
2525 return;
2526 }
2527
2528 /*
2529 * Scan to the end of the list, but not past the entry for the
2530 * dynamic linker, which we want to keep at the very end.
2531 */
2532 for (prev = r_debug.r_map;
2533 prev->l_next != NULL && prev->l_next != &obj_rtld.linkmap;
2534 prev = prev->l_next)
2535 ;
2536
2537 /* Link in the new entry. */
2538 l->l_prev = prev;
2539 l->l_next = prev->l_next;
2540 if (l->l_next != NULL)
2541 l->l_next->l_prev = l;
2542 prev->l_next = l;
2543}
2544
2545static void
2546linkmap_delete(Obj_Entry *obj)
2547{
2548 struct link_map *l = &obj->linkmap;
2549
2550 if (l->l_prev == NULL) {
2551 if ((r_debug.r_map = l->l_next) != NULL)
2552 l->l_next->l_prev = NULL;
2553 return;
2554 }
2555
2556 if ((l->l_prev->l_next = l->l_next) != NULL)
2557 l->l_next->l_prev = l->l_prev;
2558}
2559
2560/*
2561 * Function for the debugger to set a breakpoint on to gain control.
2562 *
2563 * The two parameters allow the debugger to easily find and determine
2564 * what the runtime loader is doing and to whom it is doing it.
2565 *
2566 * When the loadhook trap is hit (r_debug_state, set at program
2567 * initialization), the arguments can be found on the stack:
2568 *
2569 * +8 struct link_map *m
2570 * +4 struct r_debug *rd
2571 * +0 RetAddr
2572 */
2573void
2574r_debug_state(struct r_debug* rd, struct link_map *m)
2575{
2576}
2577
2578/*
2579 * Get address of the pointer variable in the main program.
2580 */
2581static const void **
2582get_program_var_addr(const char *name)
2583{
2584 const Obj_Entry *obj;
2585 unsigned long hash;
2586
2587 hash = elf_hash(name);
2588 for (obj = obj_main; obj != NULL; obj = obj->next) {
2589 const Elf_Sym *def;
2590
2591 if ((def = symlook_obj(name, hash, obj, NULL, 0)) != NULL) {
2592 const void **addr;
2593
2594 addr = (const void **)(obj->relocbase + def->st_value);
2595 return addr;
2596 }
2597 }
2598 return NULL;
2599}
2600
2601/*
2602 * Set a pointer variable in the main program to the given value. This
2603 * is used to set key variables such as "environ" before any of the
2604 * init functions are called.
2605 */
2606static void
2607set_program_var(const char *name, const void *value)
2608{
2609 const void **addr;
2610
2611 if ((addr = get_program_var_addr(name)) != NULL) {
2612 dbg("\"%s\": *%p <-- %p", name, addr, value);
2613 *addr = value;
2614 }
2615}
2616
2617/*
2618 * Given a symbol name in a referencing object, find the corresponding
2619 * definition of the symbol. Returns a pointer to the symbol, or NULL if
2620 * no definition was found. Returns a pointer to the Obj_Entry of the
2621 * defining object via the reference parameter DEFOBJ_OUT.
2622 */
2623static const Elf_Sym *
2624symlook_default(const char *name, unsigned long hash, const Obj_Entry *refobj,
2625 const Obj_Entry **defobj_out, const Ver_Entry *ventry, int flags)
2626{
2627 DoneList donelist;
2628 const Elf_Sym *def;
2629 const Elf_Sym *symp;
2630 const Obj_Entry *obj;
2631 const Obj_Entry *defobj;
2632 const Objlist_Entry *elm;
2633 def = NULL;
2634 defobj = NULL;
2635 donelist_init(&donelist);
2636
2637 /* Look first in the referencing object if linked symbolically. */
2638 if (refobj->symbolic && !donelist_check(&donelist, refobj)) {
2639 symp = symlook_obj(name, hash, refobj, ventry, flags);
2640 if (symp != NULL) {
2641 def = symp;
2642 defobj = refobj;
2643 }
2644 }
2645
2646 /* Search all objects loaded at program start up. */
2647 if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) {
2648 symp = symlook_list(name, hash, &list_main, &obj, ventry, flags,
2649 &donelist);
2650 if (symp != NULL &&
2651 (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) {
2652 def = symp;
2653 defobj = obj;
2654 }
2655 }
2656
2657 /* Search all DAGs whose roots are RTLD_GLOBAL objects. */
2658 STAILQ_FOREACH(elm, &list_global, link) {
2659 if (def != NULL && ELF_ST_BIND(def->st_info) != STB_WEAK)
2660 break;
2661 symp = symlook_list(name, hash, &elm->obj->dagmembers, &obj, ventry,
2662 flags, &donelist);
2663 if (symp != NULL &&
2664 (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) {
2665 def = symp;
2666 defobj = obj;
2667 }
2668 }
2669
2670 /* Search all dlopened DAGs containing the referencing object. */
2671 STAILQ_FOREACH(elm, &refobj->dldags, link) {
2672 if (def != NULL && ELF_ST_BIND(def->st_info) != STB_WEAK)
2673 break;
2674 symp = symlook_list(name, hash, &elm->obj->dagmembers, &obj, ventry,
2675 flags, &donelist);
2676 if (symp != NULL &&
2677 (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) {
2678 def = symp;
2679 defobj = obj;
2680 }
2681 }
2682
2683 /*
2684 * Search the dynamic linker itself, and possibly resolve the
2685 * symbol from there. This is how the application links to
2686 * dynamic linker services such as dlopen. Only the values listed
2687 * in the "exports" array can be resolved from the dynamic linker.
2688 */
2689 if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) {
2690 symp = symlook_obj(name, hash, &obj_rtld, ventry, flags);
2691 if (symp != NULL && is_exported(symp)) {
2692 def = symp;
2693 defobj = &obj_rtld;
2694 }
2695 }
2696
2697 if (def != NULL)
2698 *defobj_out = defobj;
2699 return def;
2700}
2701
2702static const Elf_Sym *
2703symlook_list(const char *name, unsigned long hash, const Objlist *objlist,
2704 const Obj_Entry **defobj_out, const Ver_Entry *ventry, int flags,
2705 DoneList *dlp)
2706{
2707 const Elf_Sym *symp;
2708 const Elf_Sym *def;
2709 const Obj_Entry *defobj;
2710 const Objlist_Entry *elm;
2711
2712 def = NULL;
2713 defobj = NULL;
2714 STAILQ_FOREACH(elm, objlist, link) {
2715 if (donelist_check(dlp, elm->obj))
2716 continue;
2717 if ((symp = symlook_obj(name, hash, elm->obj, ventry, flags)) != NULL) {
2718 if (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK) {
2719 def = symp;
2720 defobj = elm->obj;
2721 if (ELF_ST_BIND(def->st_info) != STB_WEAK)
2722 break;
2723 }
2724 }
2725 }
2726 if (def != NULL)
2727 *defobj_out = defobj;
2728 return def;
2729}
2730
2731/*
2732 * Search the symbol table of a shared object and all objects needed
2733 * by it for a symbol of the given name. Search order is
2734 * breadth-first. Returns a pointer to the symbol, or NULL if no
2735 * definition was found.
2736 */
2737static const Elf_Sym *
2738symlook_needed(const char *name, unsigned long hash, const Needed_Entry *needed,
2739 const Obj_Entry **defobj_out, const Ver_Entry *ventry, int flags,
2740 DoneList *dlp)
2741{
2742 const Elf_Sym *def, *def_w;
2743 const Needed_Entry *n;
2744 const Obj_Entry *obj, *defobj, *defobj1;
2745
2746 def = def_w = NULL;
2747 defobj = NULL;
2748 for (n = needed; n != NULL; n = n->next) {
2749 if ((obj = n->obj) == NULL ||
2750 donelist_check(dlp, obj) ||
2751 (def = symlook_obj(name, hash, obj, ventry, flags)) == NULL)
2752 continue;
2753 defobj = obj;
2754 if (ELF_ST_BIND(def->st_info) != STB_WEAK) {
2755 *defobj_out = defobj;
2756 return (def);
2757 }
2758 }
2759 /*
2760 * There we come when either symbol definition is not found in
2761 * directly needed objects, or found symbol is weak.
2762 */
2763 for (n = needed; n != NULL; n = n->next) {
2764 if ((obj = n->obj) == NULL)
2765 continue;
2766 def_w = symlook_needed(name, hash, obj->needed, &defobj1,
2767 ventry, flags, dlp);
2768 if (def_w == NULL)
2769 continue;
2770 if (def == NULL || ELF_ST_BIND(def_w->st_info) != STB_WEAK) {
2771 def = def_w;
2772 defobj = defobj1;
2773 }
2774 if (ELF_ST_BIND(def_w->st_info) != STB_WEAK)
2775 break;
2776 }
2777 if (def != NULL)
2778 *defobj_out = defobj;
2779 return (def);
2780}
2781
2782/*
2783 * Search the symbol table of a single shared object for a symbol of
2784 * the given name and version, if requested. Returns a pointer to the
2785 * symbol, or NULL if no definition was found.
2786 *
2787 * The symbol's hash value is passed in for efficiency reasons; that
2788 * eliminates many recomputations of the hash value.
2789 */
2790const Elf_Sym *
2791symlook_obj(const char *name, unsigned long hash, const Obj_Entry *obj,
2792 const Ver_Entry *ventry, int flags)
2793{
2794 unsigned long symnum;
2795 const Elf_Sym *vsymp;
2796 Elf_Versym verndx;
2797 int vcount;
2798
2799 if (obj->buckets == NULL)
2800 return NULL;
2801
2802 vsymp = NULL;
2803 vcount = 0;
2804 symnum = obj->buckets[hash % obj->nbuckets];
2805
2806 for (; symnum != STN_UNDEF; symnum = obj->chains[symnum]) {
2807 const Elf_Sym *symp;
2808 const char *strp;
2809
2810 if (symnum >= obj->nchains)
2811 return NULL; /* Bad object */
2812
2813 symp = obj->symtab + symnum;
2814 strp = obj->strtab + symp->st_name;
2815
2816 switch (ELF_ST_TYPE(symp->st_info)) {
2817 case STT_FUNC:
2818 case STT_NOTYPE:
2819 case STT_OBJECT:
2820 if (symp->st_value == 0)
2821 continue;
2822 /* fallthrough */
2823 case STT_TLS:
2824 if (symp->st_shndx != SHN_UNDEF)
2825 break;
2826#ifndef __mips__
2827 else if (((flags & SYMLOOK_IN_PLT) == 0) &&
2828 (ELF_ST_TYPE(symp->st_info) == STT_FUNC))
2829 break;
2830 /* fallthrough */
2831#endif
2832 default:
2833 continue;
2834 }
2835 if (name[0] != strp[0] || strcmp(name, strp) != 0)
2836 continue;
2837
2838 if (ventry == NULL) {
2839 if (obj->versyms != NULL) {
2840 verndx = VER_NDX(obj->versyms[symnum]);
2841 if (verndx > obj->vernum) {
2842 _rtld_error("%s: symbol %s references wrong version %d",
2843 obj->path, obj->strtab + symnum, verndx);
2844 continue;
2845 }
2846 /*
2847 * If we are not called from dlsym (i.e. this is a normal
2848 * relocation from unversioned binary, accept the symbol
2849 * immediately if it happens to have first version after
2850 * this shared object became versioned. Otherwise, if
2851 * symbol is versioned and not hidden, remember it. If it
2852 * is the only symbol with this name exported by the
2853 * shared object, it will be returned as a match at the
2854 * end of the function. If symbol is global (verndx < 2)
2855 * accept it unconditionally.
2856 */
2857 if ((flags & SYMLOOK_DLSYM) == 0 && verndx == VER_NDX_GIVEN)
2858 return symp;
2859 else if (verndx >= VER_NDX_GIVEN) {
2860 if ((obj->versyms[symnum] & VER_NDX_HIDDEN) == 0) {
2861 if (vsymp == NULL)
2862 vsymp = symp;
2863 vcount ++;
2864 }
2865 continue;
2866 }
2867 }
2868 return symp;
2869 } else {
2870 if (obj->versyms == NULL) {
2871 if (object_match_name(obj, ventry->name)) {
2872 _rtld_error("%s: object %s should provide version %s for "
2873 "symbol %s", obj_rtld.path, obj->path, ventry->name,
2874 obj->strtab + symnum);
2875 continue;
2876 }
2877 } else {
2878 verndx = VER_NDX(obj->versyms[symnum]);
2879 if (verndx > obj->vernum) {
2880 _rtld_error("%s: symbol %s references wrong version %d",
2881 obj->path, obj->strtab + symnum, verndx);
2882 continue;
2883 }
2884 if (obj->vertab[verndx].hash != ventry->hash ||
2885 strcmp(obj->vertab[verndx].name, ventry->name)) {
2886 /*
2887 * Version does not match. Look if this is a global symbol
2888 * and if it is not hidden. If global symbol (verndx < 2)
2889 * is available, use it. Do not return symbol if we are
2890 * called by dlvsym, because dlvsym looks for a specific
2891 * version and default one is not what dlvsym wants.
2892 */
2893 if ((flags & SYMLOOK_DLSYM) ||
2894 (obj->versyms[symnum] & VER_NDX_HIDDEN) ||
2895 (verndx >= VER_NDX_GIVEN))
2896 continue;
2897 }
2898 }
2899 return symp;
2900 }
2901 }
2902 return (vcount == 1) ? vsymp : NULL;
2903}
2904
2905static void
2906trace_loaded_objects(Obj_Entry *obj)
2907{
2908 char *fmt1, *fmt2, *fmt, *main_local, *list_containers;
2909 int c;
2910
2911 if ((main_local = getenv(LD_ "TRACE_LOADED_OBJECTS_PROGNAME")) == NULL)
2912 main_local = "";
2913
2914 if ((fmt1 = getenv(LD_ "TRACE_LOADED_OBJECTS_FMT1")) == NULL)
2915 fmt1 = "\t%o => %p (%x)\n";
2916
2917 if ((fmt2 = getenv(LD_ "TRACE_LOADED_OBJECTS_FMT2")) == NULL)
2918 fmt2 = "\t%o (%x)\n";
2919
2920 list_containers = getenv(LD_ "TRACE_LOADED_OBJECTS_ALL");
2921
2922 for (; obj; obj = obj->next) {
2923 Needed_Entry *needed;
2924 char *name, *path;
2925 bool is_lib;
2926
2927 if (list_containers && obj->needed != NULL)
2928 printf("%s:\n", obj->path);
2929 for (needed = obj->needed; needed; needed = needed->next) {
2930 if (needed->obj != NULL) {
2931 if (needed->obj->traced && !list_containers)
2932 continue;
2933 needed->obj->traced = true;
2934 path = needed->obj->path;
2935 } else
2936 path = "not found";
2937
2938 name = (char *)obj->strtab + needed->name;
2939 is_lib = strncmp(name, "lib", 3) == 0; /* XXX - bogus */
2940
2941 fmt = is_lib ? fmt1 : fmt2;
2942 while ((c = *fmt++) != '\0') {
2943 switch (c) {
2944 default:
2945 putchar(c);
2946 continue;
2947 case '\\':
2948 switch (c = *fmt) {
2949 case '\0':
2950 continue;
2951 case 'n':
2952 putchar('\n');
2953 break;
2954 case 't':
2955 putchar('\t');
2956 break;
2957 }
2958 break;
2959 case '%':
2960 switch (c = *fmt) {
2961 case '\0':
2962 continue;
2963 case '%':
2964 default:
2965 putchar(c);
2966 break;
2967 case 'A':
2968 printf("%s", main_local);
2969 break;
2970 case 'a':
2971 printf("%s", obj_main->path);
2972 break;
2973 case 'o':
2974 printf("%s", name);
2975 break;
2976#if 0
2977 case 'm':
2978 printf("%d", sodp->sod_major);
2979 break;
2980 case 'n':
2981 printf("%d", sodp->sod_minor);
2982 break;
2983#endif
2984 case 'p':
2985 printf("%s", path);
2986 break;
2987 case 'x':
2988 printf("%p", needed->obj ? needed->obj->mapbase : 0);
2989 break;
2990 }
2991 break;
2992 }
2993 ++fmt;
2994 }
2995 }
2996 }
2997}
2998
2999/*
3000 * Unload a dlopened object and its dependencies from memory and from
3001 * our data structures. It is assumed that the DAG rooted in the
3002 * object has already been unreferenced, and that the object has a
3003 * reference count of 0.
3004 */
3005static void
3006unload_object(Obj_Entry *root)
3007{
3008 Obj_Entry *obj;
3009 Obj_Entry **linkp;
3010
3011 assert(root->refcount == 0);
3012
3013 /*
3014 * Pass over the DAG removing unreferenced objects from
3015 * appropriate lists.
3016 */
3017 unlink_object(root);
3018
3019 /* Unmap all objects that are no longer referenced. */
3020 linkp = &obj_list->next;
3021 while ((obj = *linkp) != NULL) {
3022 if (obj->refcount == 0) {
3023 LD_UTRACE(UTRACE_UNLOAD_OBJECT, obj, obj->mapbase, obj->mapsize, 0,
3024 obj->path);
3025 dbg("unloading \"%s\"", obj->path);
3026 munmap(obj->mapbase, obj->mapsize);
3027 linkmap_delete(obj);
3028 *linkp = obj->next;
3029 obj_count--;
3030 obj_free(obj);
3031 } else
3032 linkp = &obj->next;
3033 }
3034 obj_tail = linkp;
3035}
3036
3037static void
3038unlink_object(Obj_Entry *root)
3039{
3040 Objlist_Entry *elm;
3041
3042 if (root->refcount == 0) {
3043 /* Remove the object from the RTLD_GLOBAL list. */
3044 objlist_remove(&list_global, root);
3045
3046 /* Remove the object from all objects' DAG lists. */
3047 STAILQ_FOREACH(elm, &root->dagmembers, link) {
3048 objlist_remove(&elm->obj->dldags, root);
3049 if (elm->obj != root)
3050 unlink_object(elm->obj);
3051 }
3052 }
3053}
3054
3055static void
3056ref_dag(Obj_Entry *root)
3057{
3058 Objlist_Entry *elm;
3059
3060 STAILQ_FOREACH(elm, &root->dagmembers, link)
3061 elm->obj->refcount++;
3062}
3063
3064static void
3065unref_dag(Obj_Entry *root)
3066{
3067 Objlist_Entry *elm;
3068
3069 STAILQ_FOREACH(elm, &root->dagmembers, link)
3070 elm->obj->refcount--;
3071}
3072
3073/*
3074 * Common code for MD __tls_get_addr().
3075 */
3076void *
3077tls_get_addr_common(Elf_Addr** dtvp, int index, size_t offset)
3078{
3079 Elf_Addr* dtv = *dtvp;
3080 int lockstate;
3081
3082 /* Check dtv generation in case new modules have arrived */
3083 if (dtv[0] != tls_dtv_generation) {
3084 Elf_Addr* newdtv;
3085 int to_copy;
3086
3087 lockstate = wlock_acquire(rtld_bind_lock);
3088 newdtv = calloc(1, (tls_max_index + 2) * sizeof(Elf_Addr));
3089 to_copy = dtv[1];
3090 if (to_copy > tls_max_index)
3091 to_copy = tls_max_index;
3092 memcpy(&newdtv[2], &dtv[2], to_copy * sizeof(Elf_Addr));
3093 newdtv[0] = tls_dtv_generation;
3094 newdtv[1] = tls_max_index;
3095 free(dtv);
3096 wlock_release(rtld_bind_lock, lockstate);
3097 *dtvp = newdtv;
3098 }
3099
3100 /* Dynamically allocate module TLS if necessary */
3101 if (!dtv[index + 1]) {
3102 /* Signal safe, wlock will block out signals. */
3103 lockstate = wlock_acquire(rtld_bind_lock);
3104 if (!dtv[index + 1])
3105 dtv[index + 1] = (Elf_Addr)allocate_module_tls(index);
3106 wlock_release(rtld_bind_lock, lockstate);
3107 }
3108 return (void*) (dtv[index + 1] + offset);
3109}
3110
3111/* XXX not sure what variants to use for arm. */
3112
3113#if defined(__ia64__) || defined(__powerpc__)
3114
3115/*
3116 * Allocate Static TLS using the Variant I method.
3117 */
3118void *
3119allocate_tls(Obj_Entry *objs, void *oldtcb, size_t tcbsize, size_t tcbalign)
3120{
3121 Obj_Entry *obj;
3122 char *tcb;
3123 Elf_Addr **tls;
3124 Elf_Addr *dtv;
3125 Elf_Addr addr;
3126 int i;
3127
3128 if (oldtcb != NULL && tcbsize == TLS_TCB_SIZE)
3129 return (oldtcb);
3130
3131 assert(tcbsize >= TLS_TCB_SIZE);
3132 tcb = calloc(1, tls_static_space - TLS_TCB_SIZE + tcbsize);
3133 tls = (Elf_Addr **)(tcb + tcbsize - TLS_TCB_SIZE);
3134
3135 if (oldtcb != NULL) {
3136 memcpy(tls, oldtcb, tls_static_space);
3137 free(oldtcb);
3138
3139 /* Adjust the DTV. */
3140 dtv = tls[0];
3141 for (i = 0; i < dtv[1]; i++) {
3142 if (dtv[i+2] >= (Elf_Addr)oldtcb &&
3143 dtv[i+2] < (Elf_Addr)oldtcb + tls_static_space) {
3144 dtv[i+2] = dtv[i+2] - (Elf_Addr)oldtcb + (Elf_Addr)tls;
3145 }
3146 }
3147 } else {
3148 dtv = calloc(tls_max_index + 2, sizeof(Elf_Addr));
3149 tls[0] = dtv;
3150 dtv[0] = tls_dtv_generation;
3151 dtv[1] = tls_max_index;
3152
3153 for (obj = objs; obj; obj = obj->next) {
3154 if (obj->tlsoffset > 0) {
3155 addr = (Elf_Addr)tls + obj->tlsoffset;
3156 if (obj->tlsinitsize > 0)
3157 memcpy((void*) addr, obj->tlsinit, obj->tlsinitsize);
3158 if (obj->tlssize > obj->tlsinitsize)
3159 memset((void*) (addr + obj->tlsinitsize), 0,
3160 obj->tlssize - obj->tlsinitsize);
3161 dtv[obj->tlsindex + 1] = addr;
3162 }
3163 }
3164 }
3165
3166 return (tcb);
3167}
3168
3169void
3170free_tls(void *tcb, size_t tcbsize, size_t tcbalign)
3171{
3172 Elf_Addr *dtv;
3173 Elf_Addr tlsstart, tlsend;
3174 int dtvsize, i;
3175
3176 assert(tcbsize >= TLS_TCB_SIZE);
3177
3178 tlsstart = (Elf_Addr)tcb + tcbsize - TLS_TCB_SIZE;
3179 tlsend = tlsstart + tls_static_space;
3180
3181 dtv = *(Elf_Addr **)tlsstart;
3182 dtvsize = dtv[1];
3183 for (i = 0; i < dtvsize; i++) {
3184 if (dtv[i+2] && (dtv[i+2] < tlsstart || dtv[i+2] >= tlsend)) {
3185 free((void*)dtv[i+2]);
3186 }
3187 }
3188 free(dtv);
3189 free(tcb);
3190}
3191
3192#endif
3193
3194#if defined(__i386__) || defined(__amd64__) || defined(__sparc64__) || \
3195 defined(__arm__) || defined(__mips__)
3196
3197/*
3198 * Allocate Static TLS using the Variant II method.
3199 */
3200void *
3201allocate_tls(Obj_Entry *objs, void *oldtls, size_t tcbsize, size_t tcbalign)
3202{
3203 Obj_Entry *obj;
3204 size_t size;
3205 char *tls;
3206 Elf_Addr *dtv, *olddtv;
3207 Elf_Addr segbase, oldsegbase, addr;
3208 int i;
3209
3210 size = round(tls_static_space, tcbalign);
3211
3212 assert(tcbsize >= 2*sizeof(Elf_Addr));
3213 tls = calloc(1, size + tcbsize);
3214 dtv = calloc(1, (tls_max_index + 2) * sizeof(Elf_Addr));
3215
3216 segbase = (Elf_Addr)(tls + size);
3217 ((Elf_Addr*)segbase)[0] = segbase;
3218 ((Elf_Addr*)segbase)[1] = (Elf_Addr) dtv;
3219
3220 dtv[0] = tls_dtv_generation;
3221 dtv[1] = tls_max_index;
3222
3223 if (oldtls) {
3224 /*
3225 * Copy the static TLS block over whole.
3226 */
3227 oldsegbase = (Elf_Addr) oldtls;
3228 memcpy((void *)(segbase - tls_static_space),
3229 (const void *)(oldsegbase - tls_static_space),
3230 tls_static_space);
3231
3232 /*
3233 * If any dynamic TLS blocks have been created tls_get_addr(),
3234 * move them over.
3235 */
3236 olddtv = ((Elf_Addr**)oldsegbase)[1];
3237 for (i = 0; i < olddtv[1]; i++) {
3238 if (olddtv[i+2] < oldsegbase - size || olddtv[i+2] > oldsegbase) {
3239 dtv[i+2] = olddtv[i+2];
3240 olddtv[i+2] = 0;
3241 }
3242 }
3243
3244 /*
3245 * We assume that this block was the one we created with
3246 * allocate_initial_tls().
3247 */
3248 free_tls(oldtls, 2*sizeof(Elf_Addr), sizeof(Elf_Addr));
3249 } else {
3250 for (obj = objs; obj; obj = obj->next) {
3251 if (obj->tlsoffset) {
3252 addr = segbase - obj->tlsoffset;
3253 memset((void*) (addr + obj->tlsinitsize),
3254 0, obj->tlssize - obj->tlsinitsize);
3255 if (obj->tlsinit)
3256 memcpy((void*) addr, obj->tlsinit, obj->tlsinitsize);
3257 dtv[obj->tlsindex + 1] = addr;
3258 }
3259 }
3260 }
3261
3262 return (void*) segbase;
3263}
3264
3265void
3266free_tls(void *tls, size_t tcbsize, size_t tcbalign)
3267{
3268 size_t size;
3269 Elf_Addr* dtv;
3270 int dtvsize, i;
3271 Elf_Addr tlsstart, tlsend;
3272
3273 /*
3274 * Figure out the size of the initial TLS block so that we can
3275 * find stuff which ___tls_get_addr() allocated dynamically.
3276 */
3277 size = round(tls_static_space, tcbalign);
3278
3279 dtv = ((Elf_Addr**)tls)[1];
3280 dtvsize = dtv[1];
3281 tlsend = (Elf_Addr) tls;
3282 tlsstart = tlsend - size;
3283 for (i = 0; i < dtvsize; i++) {
3284 if (dtv[i+2] && (dtv[i+2] < tlsstart || dtv[i+2] > tlsend)) {
3285 free((void*) dtv[i+2]);
3286 }
3287 }
3288
3289 free((void*) tlsstart);
3290 free((void*) dtv);
3291}
3292
3293#endif
3294
3295/*
3296 * Allocate TLS block for module with given index.
3297 */
3298void *
3299allocate_module_tls(int index)
3300{
3301 Obj_Entry* obj;
3302 char* p;
3303
3304 for (obj = obj_list; obj; obj = obj->next) {
3305 if (obj->tlsindex == index)
3306 break;
3307 }
3308 if (!obj) {
3309 _rtld_error("Can't find module with TLS index %d", index);
3310 die();
3311 }
3312
3313 p = malloc(obj->tlssize);
|