1	/* Run time dynamic linker.
2	Copyright (C) 1995-2022 Free Software Foundation, Inc.
3	This file is part of the GNU C Library.
4
5	The GNU C Library is free software; you can redistribute it and/or
6	modify it under the terms of the GNU Lesser General Public
7	License as published by the Free Software Foundation; either
8	version 2.1 of the License, or (at your option) any later version.
9
10	The GNU C Library is distributed in the hope that it will be useful,
11	but WITHOUT ANY WARRANTY; without even the implied warranty of
12	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13	Lesser General Public License for more details.
14
15	You should have received a copy of the GNU Lesser General Public
16	License along with the GNU C Library; if not, see
17	<https://www.gnu.org/licenses/>. */
18
19	#include <errno.h>
20	#include <dlfcn.h>
21	#include <fcntl.h>
22	#include <stdbool.h>
23	#include <stdlib.h>
24	#include <string.h>
25	#include <unistd.h>
26	#include <sys/mman.h>
27	#include <sys/param.h>
28	#include <sys/stat.h>
29	#include <ldsodefs.h>
30	#include <_itoa.h>
31	#include <entry.h>
32	#include <fpu_control.h>
33	#include <hp-timing.h>
34	#include <libc-lock.h>
35	#include <dl-librecon.h>
36	#include <unsecvars.h>
37	#include <dl-cache.h>
38	#include <dl-osinfo.h>
39	#include <dl-procinfo.h>
40	#include <dl-prop.h>
41	#include <dl-vdso.h>
42	#include <dl-vdso-setup.h>
43	#include <tls.h>
44	#include <stap-probe.h>
45	#include <stackinfo.h>
46	#include <not-cancel.h>
47	#include <array_length.h>
48	#include <libc-early-init.h>
49	#include <dl-main.h>
50	#include <gnu/lib-names.h>
51	#include <dl-tunables.h>
52	#include <get-dynamic-info.h>
53	#include <dl-execve.h>
54	#include <dl-find_object.h>
55	#include <dl-audit-check.h>
56
57	#include <assert.h>
58
59	/* This #define produces dynamic linking inline functions for
60	bootstrap relocation instead of general-purpose relocation.
61	Since ld.so must not have any undefined symbols the result
62	is trivial: always the map of ld.so itself. */
63	#define RTLD_BOOTSTRAP
64	#define RESOLVE_MAP(map, scope, sym, version, flags) map
65	#include "dynamic-link.h"
66
67	/* Must include after <dl-machine.h> for DT_MIPS definition. */
68	#include <dl-debug.h>
69
70	/* Only enables rtld profiling for architectures which provides non generic
71	hp-timing support. The generic support requires either syscall
72	(clock_gettime), which will incur in extra overhead on loading time.
73	Using vDSO is also an option, but it will require extra support on loader
74	to setup the vDSO pointer before its usage. */
75	#if HP_TIMING_INLINE
76	# define RLTD_TIMING_DECLARE(var, classifier,...) \
77	classifier hp_timing_t var __VA_ARGS__
78	# define RTLD_TIMING_VAR(var) RLTD_TIMING_DECLARE (var, )
79	# define RTLD_TIMING_SET(var, value) (var) = (value)
80	# define RTLD_TIMING_REF(var) &(var)
81
82	static inline void
83	rtld_timer_start (hp_timing_t *var)
84	{
85	HP_TIMING_NOW (*var);
86	}
87
88	static inline void
89	rtld_timer_stop (hp_timing_t *var, hp_timing_t start)
90	{
91	hp_timing_t stop;
92	HP_TIMING_NOW (stop);
93	HP_TIMING_DIFF (*var, start, stop);
94	}
95
96	static inline void
97	rtld_timer_accum (hp_timing_t *sum, hp_timing_t start)
98	{
99	hp_timing_t stop;
100	rtld_timer_stop (var: &stop, start);
101	HP_TIMING_ACCUM_NT(*sum, stop);
102	}
103	#else
104	# define RLTD_TIMING_DECLARE(var, classifier...)
105	# define RTLD_TIMING_SET(var, value)
106	# define RTLD_TIMING_VAR(var)
107	# define RTLD_TIMING_REF(var) 0
108	# define rtld_timer_start(var)
109	# define rtld_timer_stop(var, start)
110	# define rtld_timer_accum(sum, start)
111	#endif
112
113	/* Avoid PLT use for our local calls at startup. */
114	extern __typeof (__mempcpy) __mempcpy attribute_hidden;
115
116	/* GCC has mental blocks about _exit. */
117	extern __typeof (_exit) exit_internal asm ("_exit") attribute_hidden;
118	#define _exit exit_internal
119
120	/* Helper function to handle errors while resolving symbols. */
121	static void print_unresolved (int errcode, const char *objname,
122	const char *errsting);
123
124	/* Helper function to handle errors when a version is missing. */
125	static void print_missing_version (int errcode, const char *objname,
126	const char *errsting);
127
128	/* Print the various times we collected. */
129	static void print_statistics (const hp_timing_t *total_timep);
130
131	/* Creates an empty audit list. */
132	static void audit_list_init (struct audit_list *);
133
134	/* Add a string to the end of the audit list, for later parsing. Must
135	not be called after audit_list_next. */
136	static void audit_list_add_string (struct audit_list *, const char *);
137
138	/* Add the audit strings from the link map, found in the dynamic
139	segment at TG (either DT_AUDIT and DT_DEPAUDIT). Must be called
140	before audit_list_next. */
141	static void audit_list_add_dynamic_tag (struct audit_list *,
142	struct link_map *,
143	unsigned int tag);
144
145	/* Extract the next audit module from the audit list. Only modules
146	for which dso_name_valid_for_suid is true are returned. Must be
147	called after all the audit_list_add_string,
148	audit_list_add_dynamic_tags calls. */
149	static const char *audit_list_next (struct audit_list *);
150
151	/* Initialize *STATE with the defaults. */
152	static void dl_main_state_init (struct dl_main_state *state);
153
154	/* Process all environments variables the dynamic linker must recognize.
155	Since all of them start with `LD_' we are a bit smarter while finding
156	all the entries. */
157	extern char **_environ attribute_hidden;
158	static void process_envvars (struct dl_main_state *state);
159
160	#ifdef DL_ARGV_NOT_RELRO
161	int _dl_argc attribute_hidden;
162	char **_dl_argv = NULL;
163	/* Nonzero if we were run directly. */
164	unsigned int _dl_skip_args attribute_hidden;
165	#else
166	int _dl_argc attribute_relro attribute_hidden;
167	char **_dl_argv attribute_relro = NULL;
168	unsigned int _dl_skip_args attribute_relro attribute_hidden;
169	#endif
170	rtld_hidden_data_def (_dl_argv)
171
172	#ifndef THREAD_SET_STACK_GUARD
173	/* Only exported for architectures that don't store the stack guard canary
174	in thread local area. */
175	uintptr_t __stack_chk_guard attribute_relro;
176	#endif
177
178	/* Only exported for architectures that don't store the pointer guard
179	value in thread local area. */
180	uintptr_t __pointer_chk_guard_local attribute_relro attribute_hidden;
181	#ifndef THREAD_SET_POINTER_GUARD
182	strong_alias (__pointer_chk_guard_local, __pointer_chk_guard)
183	#endif
184
185	/* Check that AT_SECURE=0, or that the passed name does not contain
186	directories and is not overly long. Reject empty names
187	unconditionally. */
188	static bool
189	dso_name_valid_for_suid (const char *p)
190	{
191	if (__glibc_unlikely (__libc_enable_secure))
192	{
193	/* Ignore pathnames with directories for AT_SECURE=1
194	programs, and also skip overlong names. */
195	size_t len = strlen (p);
196	if (len >= SECURE_NAME_LIMIT || memchr (p, '/', len) != NULL)
197	return false;
198	}
199	return *p != '\0';
200	}
201
202	static void
203	audit_list_init (struct audit_list *list)
204	{
205	list->length = 0;
206	list->current_index = 0;
207	list->current_tail = NULL;
208	}
209
210	static void
211	audit_list_add_string (struct audit_list *list, const char *string)
212	{
213	/* Empty strings do not load anything. */
214	if (*string == '\0')
215	return;
216
217	if (list->length == array_length (list->audit_strings))
218	_dl_fatal_printf ("Fatal glibc error: Too many audit modules requested\n");
219
220	list->audit_strings[list->length++] = string;
221
222	/* Initialize processing of the first string for
223	audit_list_next. */
224	if (list->length == 1)
225	list->current_tail = string;
226	}
227
228	static void
229	audit_list_add_dynamic_tag (struct audit_list *list, struct link_map *main_map,
230	unsigned int tag)
231	{
232	ElfW(Dyn) *info = main_map->l_info[ADDRIDX (tag)];
233	const char *strtab = (const char *) D_PTR (main_map, l_info[DT_STRTAB]);
234	if (info != NULL)
235	audit_list_add_string (list, string: strtab + info->d_un.d_val);
236	}
237
238	static const char *
239	audit_list_next (struct audit_list *list)
240	{
241	if (list->current_tail == NULL)
242	return NULL;
243
244	while (true)
245	{
246	/* Advance to the next string in audit_strings if the current
247	string has been exhausted. */
248	while (*list->current_tail == '\0')
249	{
250	++list->current_index;
251	if (list->current_index == list->length)
252	{
253	list->current_tail = NULL;
254	return NULL;
255	}
256	list->current_tail = list->audit_strings[list->current_index];
257	}
258
259	/* Split the in-string audit list at the next colon colon. */
260	size_t len = strcspn (s: list->current_tail, reject: ":");
261	if (len > 0 && len < sizeof (list->fname))
262	{
263	memcpy (list->fname, list->current_tail, len);
264	list->fname[len] = '\0';
265	}
266	else
267	/* Mark the name as unusable for dso_name_valid_for_suid. */
268	list->fname[0] = '\0';
269
270	/* Skip over the substring and the following delimiter. */
271	list->current_tail += len;
272	if (*list->current_tail == ':')
273	++list->current_tail;
274
275	/* If the name is valid, return it. */
276	if (dso_name_valid_for_suid (p: list->fname))
277	return list->fname;
278
279	/* Otherwise wrap around to find the next list element. . */
280	}
281	}
282
283	/* Count audit modules before they are loaded so GLRO(dl_naudit)
284	is not yet usable. */
285	static size_t
286	audit_list_count (struct audit_list *list)
287	{
288	/* Restore the audit_list iterator state at the end. */
289	const char *saved_tail = list->current_tail;
290	size_t naudit = 0;
291
292	assert (list->current_index == 0);
293	while (audit_list_next (list) != NULL)
294	naudit++;
295	list->current_tail = saved_tail;
296	list->current_index = 0;
297	return naudit;
298	}
299
300	static void
301	dl_main_state_init (struct dl_main_state *state)
302	{
303	audit_list_init (list: &state->audit_list);
304	state->library_path = NULL;
305	state->library_path_source = NULL;
306	state->preloadlist = NULL;
307	state->preloadarg = NULL;
308	state->glibc_hwcaps_prepend = NULL;
309	state->glibc_hwcaps_mask = NULL;
310	state->mode = rtld_mode_normal;
311	state->any_debug = false;
312	state->version_info = false;
313	}
314
315	#ifndef HAVE_INLINED_SYSCALLS
316	/* Set nonzero during loading and initialization of executable and
317	libraries, cleared before the executable's entry point runs. This
318	must not be initialized to nonzero, because the unused dynamic
319	linker loaded in for libc.so's "ld.so.1" dep will provide the
320	definition seen by libc.so's initializer; that value must be zero,
321	and will be since that dynamic linker's _dl_start and dl_main will
322	never be called. */
323	int _dl_starting_up = 0;
324	rtld_hidden_def (_dl_starting_up)
325	#endif
326
327	/* This is the structure which defines all variables global to ld.so
328	(except those which cannot be added for some reason). */
329	struct rtld_global _rtld_global =
330	{
331	/* Get architecture specific initializer. */
332	#include <dl-procruntime.c>
333	/* Generally the default presumption without further information is an
334	* executable stack but this is not true for all platforms. */
335	._dl_stack_flags = DEFAULT_STACK_PERMS,
336	#ifdef _LIBC_REENTRANT
337	._dl_load_lock = _RTLD_LOCK_RECURSIVE_INITIALIZER,
338	._dl_load_write_lock = _RTLD_LOCK_RECURSIVE_INITIALIZER,
339	._dl_load_tls_lock = _RTLD_LOCK_RECURSIVE_INITIALIZER,
340	#endif
341	._dl_nns = 1,
342	._dl_ns =
343	{
344	#ifdef _LIBC_REENTRANT
345	[LM_ID_BASE] = { ._ns_unique_sym_table
346	= { .lock = _RTLD_LOCK_RECURSIVE_INITIALIZER } }
347	#endif
348	}
349	};
350	/* If we would use strong_alias here the compiler would see a
351	non-hidden definition. This would undo the effect of the previous
352	declaration. So spell out what strong_alias does plus add the
353	visibility attribute. */
354	extern struct rtld_global _rtld_local
355	__attribute__ ((alias ("_rtld_global"), visibility ("hidden")));
356
357
358	/* This variable is similar to _rtld_local, but all values are
359	read-only after relocation. */
360	struct rtld_global_ro _rtld_global_ro attribute_relro =
361	{
362	/* Get architecture specific initializer. */
363	#include <dl-procinfo.c>
364	#ifdef NEED_DL_SYSINFO
365	._dl_sysinfo = DL_SYSINFO_DEFAULT,
366	#endif
367	._dl_debug_fd = STDERR_FILENO,
368	._dl_use_load_bias = -2,
369	._dl_correct_cache_id = _DL_CACHE_DEFAULT_ID,
370	#if !HAVE_TUNABLES
371	._dl_hwcap_mask = HWCAP_IMPORTANT,
372	#endif
373	._dl_lazy = 1,
374	._dl_fpu_control = _FPU_DEFAULT,
375	._dl_pagesize = EXEC_PAGESIZE,
376	._dl_inhibit_cache = 0,
377
378	/* Function pointers. */
379	._dl_debug_printf = _dl_debug_printf,
380	._dl_mcount = _dl_mcount,
381	._dl_lookup_symbol_x = _dl_lookup_symbol_x,
382	._dl_open = _dl_open,
383	._dl_close = _dl_close,
384	._dl_catch_error = _rtld_catch_error,
385	._dl_error_free = _dl_error_free,
386	._dl_tls_get_addr_soft = _dl_tls_get_addr_soft,
387	._dl_libc_freeres = __rtld_libc_freeres,
388	#ifdef HAVE_DL_DISCOVER_OSVERSION
389	._dl_discover_osversion = _dl_discover_osversion
390	#endif
391	};
392	/* If we would use strong_alias here the compiler would see a
393	non-hidden definition. This would undo the effect of the previous
394	declaration. So spell out was strong_alias does plus add the
395	visibility attribute. */
396	extern struct rtld_global_ro _rtld_local_ro
397	__attribute__ ((alias ("_rtld_global_ro"), visibility ("hidden")));
398
399
400	static void dl_main (const ElfW(Phdr) *phdr, ElfW(Word) phnum,
401	ElfW(Addr) *user_entry, ElfW(auxv_t) *auxv);
402
403	/* These two variables cannot be moved into .data.rel.ro. */
404	static struct libname_list _dl_rtld_libname;
405	static struct libname_list _dl_rtld_libname2;
406
407	/* Variable for statistics. */
408	RLTD_TIMING_DECLARE (relocate_time, static);
409	RLTD_TIMING_DECLARE (load_time, static, attribute_relro);
410	RLTD_TIMING_DECLARE (start_time, static, attribute_relro);
411
412	/* Additional definitions needed by TLS initialization. */
413	#ifdef TLS_INIT_HELPER
414	TLS_INIT_HELPER
415	#endif
416
417	/* Helper function for syscall implementation. */
418	#ifdef DL_SYSINFO_IMPLEMENTATION
419	DL_SYSINFO_IMPLEMENTATION
420	#endif
421
422	/* Before ld.so is relocated we must not access variables which need
423	relocations. This means variables which are exported. Variables
424	declared as static are fine. If we can mark a variable hidden this
425	is fine, too. The latter is important here. We can avoid setting
426	up a temporary link map for ld.so if we can mark _rtld_global as
427	hidden. */
428	#ifdef PI_STATIC_AND_HIDDEN
429	# define DONT_USE_BOOTSTRAP_MAP 1
430	#endif
431
432	#ifdef DONT_USE_BOOTSTRAP_MAP
433	static ElfW(Addr) _dl_start_final (void *arg);
434	#else
435	struct dl_start_final_info
436	{
437	struct link_map l;
438	RTLD_TIMING_VAR (start_time);
439	};
440	static ElfW(Addr) _dl_start_final (void *arg,
441	struct dl_start_final_info *info);
442	#endif
443
444	/* These are defined magically by the linker. */
445	extern const ElfW(Ehdr) __ehdr_start attribute_hidden;
446	extern char _etext[] attribute_hidden;
447	extern char _end[] attribute_hidden;
448
449
450	#ifdef RTLD_START
451	RTLD_START
452	#else
453	# error "sysdeps/MACHINE/dl-machine.h fails to define RTLD_START"
454	#endif
455
456	/* This is the second half of _dl_start (below). It can be inlined safely
457	under DONT_USE_BOOTSTRAP_MAP, where it is careful not to make any GOT
458	references. When the tools don't permit us to avoid using a GOT entry
459	for _dl_rtld_global (no attribute_hidden support), we must make sure
460	this function is not inlined (see below). */
461
462	#ifdef DONT_USE_BOOTSTRAP_MAP
463	static inline ElfW(Addr) __attribute__ ((always_inline))
464	_dl_start_final (void *arg)
465	#else
466	static ElfW(Addr) __attribute__ ((noinline))
467	_dl_start_final (void *arg, struct dl_start_final_info *info)
468	#endif
469	{
470	ElfW(Addr) start_addr;
471
472	/* If it hasn't happen yet record the startup time. */
473	rtld_timer_start (var: &start_time);
474	#if !defined DONT_USE_BOOTSTRAP_MAP
475	RTLD_TIMING_SET (start_time, info->start_time);
476	#endif
477
478	/* Transfer data about ourselves to the permanent link_map structure. */
479	#ifndef DONT_USE_BOOTSTRAP_MAP
480	GL(dl_rtld_map).l_addr = info->l.l_addr;
481	GL(dl_rtld_map).l_ld = info->l.l_ld;
482	GL(dl_rtld_map).l_ld_readonly = info->l.l_ld_readonly;
483	memcpy (GL(dl_rtld_map).l_info, info->l.l_info,
484	sizeof GL(dl_rtld_map).l_info);
485	GL(dl_rtld_map).l_mach = info->l.l_mach;
486	GL(dl_rtld_map).l_relocated = 1;
487	#endif
488	_dl_setup_hash (map: &GL(dl_rtld_map));
489	GL(dl_rtld_map).l_real = &GL(dl_rtld_map);
490	GL(dl_rtld_map).l_map_start = (ElfW(Addr)) &__ehdr_start;
491	GL(dl_rtld_map).l_map_end = (ElfW(Addr)) _end;
492	GL(dl_rtld_map).l_text_end = (ElfW(Addr)) _etext;
493	/* Copy the TLS related data if necessary. */
494	#ifndef DONT_USE_BOOTSTRAP_MAP
495	# if NO_TLS_OFFSET != 0
496	GL(dl_rtld_map).l_tls_offset = NO_TLS_OFFSET;
497	# endif
498	#endif
499
500	/* Initialize the stack end variable. */
501	__libc_stack_end = __builtin_frame_address (0);
502
503	/* Call the OS-dependent function to set up life so we can do things like
504	file access. It will call `dl_main' (below) to do all the real work
505	of the dynamic linker, and then unwind our frame and run the user
506	entry point on the same stack we entered on. */
507	start_addr = _dl_sysdep_start (start_argptr: arg, dl_main: &dl_main);
508
509	if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_STATISTICS))
510	{
511	RTLD_TIMING_VAR (rtld_total_time);
512	rtld_timer_stop (var: &rtld_total_time, start: start_time);
513	print_statistics (RTLD_TIMING_REF(rtld_total_time));
514	}
515
516	return start_addr;
517	}
518
519	#ifdef DONT_USE_BOOTSTRAP_MAP
520	# define bootstrap_map GL(dl_rtld_map)
521	#else
522	# define bootstrap_map info.l
523	#endif
524
525	static ElfW(Addr) __attribute_used__
526	_dl_start (void *arg)
527	{
528	#ifdef DONT_USE_BOOTSTRAP_MAP
529	rtld_timer_start (var: &start_time);
530	#else
531	struct dl_start_final_info info;
532	rtld_timer_start (&info.start_time);
533	#endif
534
535	/* Partly clean the `bootstrap_map' structure up. Don't use
536	`memset' since it might not be built in or inlined and we cannot
537	make function calls at this point. Use '__builtin_memset' if we
538	know it is available. We do not have to clear the memory if we
539	do not have to use the temporary bootstrap_map. Global variables
540	are initialized to zero by default. */
541	#ifndef DONT_USE_BOOTSTRAP_MAP
542	# ifdef HAVE_BUILTIN_MEMSET
543	__builtin_memset (bootstrap_map.l_info, '\0', sizeof (bootstrap_map.l_info));
544	# else
545	for (size_t cnt = 0;
546	cnt < sizeof (bootstrap_map.l_info) / sizeof (bootstrap_map.l_info[0]);
547	++cnt)
548	bootstrap_map.l_info[cnt] = 0;
549	# endif
550	#endif
551
552	/* Figure out the run-time load address of the dynamic linker itself. */
553	bootstrap_map.l_addr = elf_machine_load_address ();
554
555	/* Read our own dynamic section and fill in the info array. */
556	bootstrap_map.l_ld = (void *) bootstrap_map.l_addr + elf_machine_dynamic ();
557	bootstrap_map.l_ld_readonly = DL_RO_DYN_SECTION;
558	elf_get_dynamic_info (l: &bootstrap_map, true, false);
559
560	#if NO_TLS_OFFSET != 0
561	bootstrap_map.l_tls_offset = NO_TLS_OFFSET;
562	#endif
563
564	#ifdef ELF_MACHINE_BEFORE_RTLD_RELOC
565	ELF_MACHINE_BEFORE_RTLD_RELOC (&bootstrap_map, bootstrap_map.l_info);
566	#endif
567
568	if (bootstrap_map.l_addr || ! bootstrap_map.l_info[VALIDX(DT_GNU_PRELINKED)])
569	{
570	/* Relocate ourselves so we can do normal function calls and
571	data access using the global offset table. */
572
573	ELF_DYNAMIC_RELOCATE (&bootstrap_map, NULL, 0, 0, 0);
574	}
575	bootstrap_map.l_relocated = 1;
576
577	/* Please note that we don't allow profiling of this object and
578	therefore need not test whether we have to allocate the array
579	for the relocation results (as done in dl-reloc.c). */
580
581	/* Now life is sane; we can call functions and access global data.
582	Set up to use the operating system facilities, and find out from
583	the operating system's program loader where to find the program
584	header table in core. Put the rest of _dl_start into a separate
585	function, that way the compiler cannot put accesses to the GOT
586	before ELF_DYNAMIC_RELOCATE. */
587
588	__rtld_malloc_init_stubs ();
589
590	/* Do not use an initializer for these members because it would
591	intefere with __rtld_static_init. */
592	GLRO (dl_find_object) = &_dl_find_object;
593
594	{
595	#ifdef DONT_USE_BOOTSTRAP_MAP
596	ElfW(Addr) entry = _dl_start_final (arg);
597	#else
598	ElfW(Addr) entry = _dl_start_final (arg, &info);
599	#endif
600
601	#ifndef ELF_MACHINE_START_ADDRESS
602	# define ELF_MACHINE_START_ADDRESS(map, start) (start)
603	#endif
604
605	return ELF_MACHINE_START_ADDRESS (GL(dl_ns)[LM_ID_BASE]._ns_loaded, entry);
606	}
607	}
608
609
610
611	/* Now life is peachy; we can do all normal operations.
612	On to the real work. */
613
614	/* Some helper functions. */
615
616	/* Arguments to relocate_doit. */
617	struct relocate_args
618	{
619	struct link_map *l;
620	int reloc_mode;
621	};
622
623	struct map_args
624	{
625	/* Argument to map_doit. */
626	const char *str;
627	struct link_map *loader;
628	int mode;
629	/* Return value of map_doit. */
630	struct link_map *map;
631	};
632
633	struct dlmopen_args
634	{
635	const char *fname;
636	struct link_map *map;
637	};
638
639	struct lookup_args
640	{
641	const char *name;
642	struct link_map *map;
643	void *result;
644	};
645
646	/* Arguments to version_check_doit. */
647	struct version_check_args
648	{
649	int doexit;
650	int dotrace;
651	};
652
653	static void
654	relocate_doit (void *a)
655	{
656	struct relocate_args *args = (struct relocate_args *) a;
657
658	_dl_relocate_object (map: args->l, scope: args->l->l_scope, reloc_mode: args->reloc_mode, consider_profiling: 0);
659	}
660
661	static void
662	map_doit (void *a)
663	{
664	struct map_args *args = (struct map_args *) a;
665	int type = (args->mode == __RTLD_OPENEXEC) ? lt_executable : lt_library;
666	args->map = _dl_map_object (loader: args->loader, name: args->str, type, trace_mode: 0,
667	mode: args->mode, LM_ID_BASE);
668	}
669
670	static void
671	dlmopen_doit (void *a)
672	{
673	struct dlmopen_args *args = (struct dlmopen_args *) a;
674	args->map = _dl_open (name: args->fname,
675	mode: (RTLD_LAZY | __RTLD_DLOPEN | __RTLD_AUDIT
676	| __RTLD_SECURE),
677	caller: dl_main, LM_ID_NEWLM, argc: _dl_argc, argv: _dl_argv,
678	env: __environ);
679	}
680
681	static void
682	lookup_doit (void *a)
683	{
684	struct lookup_args *args = (struct lookup_args *) a;
685	const ElfW(Sym) *ref = NULL;
686	args->result = NULL;
687	lookup_t l = _dl_lookup_symbol_x (undef: args->name, undef_map: args->map, sym: &ref,
688	symbol_scope: args->map->l_local_scope, NULL, type_class: 0,
689	flags: DL_LOOKUP_RETURN_NEWEST, NULL);
690	if (ref != NULL)
691	args->result = DL_SYMBOL_ADDRESS (l, ref);
692	}
693
694	static void
695	version_check_doit (void *a)
696	{
697	struct version_check_args *args = (struct version_check_args *) a;
698	if (_dl_check_all_versions (GL(dl_ns)[LM_ID_BASE]._ns_loaded, verbose: 1,
699	trace_mode: args->dotrace) && args->doexit)
700	/* We cannot start the application. Abort now. */
701	_exit (1);
702	}
703
704
705	static inline struct link_map *
706	find_needed (const char *name)
707	{
708	struct r_scope_elem *scope = &GL(dl_ns)[LM_ID_BASE]._ns_loaded->l_searchlist;
709	unsigned int n = scope->r_nlist;
710
711	while (n-- > 0)
712	if (_dl_name_match_p (name: name, map: scope->r_list[n]))
713	return scope->r_list[n];
714
715	/* Should never happen. */
716	return NULL;
717	}
718
719	static int
720	match_version (const char *string, struct link_map *map)
721	{
722	const char *strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
723	ElfW(Verdef) *def;
724
725	#define VERDEFTAG (DT_NUM + DT_THISPROCNUM + DT_VERSIONTAGIDX (DT_VERDEF))
726	if (map->l_info[VERDEFTAG] == NULL)
727	/* The file has no symbol versioning. */
728	return 0;
729
730	def = (ElfW(Verdef) *) ((char *) map->l_addr
731	+ map->l_info[VERDEFTAG]->d_un.d_ptr);
732	while (1)
733	{
734	ElfW(Verdaux) *aux = (ElfW(Verdaux) *) ((char *) def + def->vd_aux);
735
736	/* Compare the version strings. */
737	if (strcmp (string, strtab + aux->vda_name) == 0)
738	/* Bingo! */
739	return 1;
740
741	/* If no more definitions we failed to find what we want. */
742	if (def->vd_next == 0)
743	break;
744
745	/* Next definition. */
746	def = (ElfW(Verdef) *) ((char *) def + def->vd_next);
747	}
748
749	return 0;
750	}
751
752	static bool tls_init_tp_called;
753
754	static void *
755	init_tls (size_t naudit)
756	{
757	/* Number of elements in the static TLS block. */
758	GL(dl_tls_static_nelem) = GL(dl_tls_max_dtv_idx);
759
760	/* Do not do this twice. The audit interface might have required
761	the DTV interfaces to be set up early. */
762	if (GL(dl_initial_dtv) != NULL)
763	return NULL;
764
765	/* Allocate the array which contains the information about the
766	dtv slots. We allocate a few entries more than needed to
767	avoid the need for reallocation. */
768	size_t nelem = GL(dl_tls_max_dtv_idx) + 1 + TLS_SLOTINFO_SURPLUS;
769
770	/* Allocate. */
771	GL(dl_tls_dtv_slotinfo_list) = (struct dtv_slotinfo_list *)
772	calloc (a: sizeof (struct dtv_slotinfo_list)
773	+ nelem * sizeof (struct dtv_slotinfo), b: 1);
774	/* No need to check the return value. If memory allocation failed
775	the program would have been terminated. */
776
777	struct dtv_slotinfo *slotinfo = GL(dl_tls_dtv_slotinfo_list)->slotinfo;
778	GL(dl_tls_dtv_slotinfo_list)->len = nelem;
779	GL(dl_tls_dtv_slotinfo_list)->next = NULL;
780
781	/* Fill in the information from the loaded modules. No namespace
782	but the base one can be filled at this time. */
783	assert (GL(dl_ns)[LM_ID_BASE + 1]._ns_loaded == NULL);
784	int i = 0;
785	for (struct link_map *l = GL(dl_ns)[LM_ID_BASE]._ns_loaded; l != NULL;
786	l = l->l_next)
787	if (l->l_tls_blocksize != 0)
788	{
789	/* This is a module with TLS data. Store the map reference.
790	The generation counter is zero. */
791	slotinfo[i].map = l;
792	/* slotinfo[i].gen = 0; */
793	++i;
794	}
795	assert (i == GL(dl_tls_max_dtv_idx));
796
797	/* Calculate the size of the static TLS surplus. */
798	_dl_tls_static_surplus_init (naudit);
799
800	/* Compute the TLS offsets for the various blocks. */
801	_dl_determine_tlsoffset ();
802
803	/* Construct the static TLS block and the dtv for the initial
804	thread. For some platforms this will include allocating memory
805	for the thread descriptor. The memory for the TLS block will
806	never be freed. It should be allocated accordingly. The dtv
807	array can be changed if dynamic loading requires it. */
808	void *tcbp = _dl_allocate_tls_storage ();
809	if (tcbp == NULL)
810	_dl_fatal_printf ("\
811	cannot allocate TLS data structures for initial thread\n");
812
813	/* Store for detection of the special case by __tls_get_addr
814	so it knows not to pass this dtv to the normal realloc. */
815	GL(dl_initial_dtv) = GET_DTV (tcbp);
816
817	/* And finally install it for the main thread. */
818	const char *lossage = TLS_INIT_TP (tcbp);
819	if (__glibc_unlikely (lossage != NULL))
820	_dl_fatal_printf ("cannot set up thread-local storage: %s\n", lossage);
821	__tls_init_tp ();
822	tls_init_tp_called = true;
823
824	return tcbp;
825	}
826
827	static unsigned int
828	do_preload (const char *fname, struct link_map *main_map, const char *where)
829	{
830	const char *objname;
831	const char *err_str = NULL;
832	struct map_args args;
833	bool malloced;
834
835	args.str = fname;
836	args.loader = main_map;
837	args.mode = __RTLD_SECURE;
838
839	unsigned int old_nloaded = GL(dl_ns)[LM_ID_BASE]._ns_nloaded;
840
841	(void) _dl_catch_error (objname: &objname, errstring: &err_str, mallocedp: &malloced, operate: map_doit, args: &args);
842	if (__glibc_unlikely (err_str != NULL))
843	{
844	_dl_error_printf (fmt: "\
845	ERROR: ld.so: object '%s' from %s cannot be preloaded (%s): ignored.\n",
846	fname, where, err_str);
847	/* No need to call free, this is still before
848	the libc's malloc is used. */
849	}
850	else if (GL(dl_ns)[LM_ID_BASE]._ns_nloaded != old_nloaded)
851	/* It is no duplicate. */
852	return 1;
853
854	/* Nothing loaded. */
855	return 0;
856	}
857
858	static void
859	security_init (void)
860	{
861	/* Set up the stack checker's canary. */
862	uintptr_t stack_chk_guard = _dl_setup_stack_chk_guard (dl_random: _dl_random);
863	#ifdef THREAD_SET_STACK_GUARD
864	THREAD_SET_STACK_GUARD (stack_chk_guard);
865	#else
866	__stack_chk_guard = stack_chk_guard;
867	#endif
868
869	/* Set up the pointer guard as well, if necessary. */
870	uintptr_t pointer_chk_guard
871	= _dl_setup_pointer_guard (dl_random: _dl_random, stack_chk_guard);
872	#ifdef THREAD_SET_POINTER_GUARD
873	THREAD_SET_POINTER_GUARD (pointer_chk_guard);
874	#endif
875	__pointer_chk_guard_local = pointer_chk_guard;
876
877	/* We do not need the _dl_random value anymore. The less
878	information we leave behind, the better, so clear the
879	variable. */
880	_dl_random = NULL;
881	}
882
883	#include <setup-vdso.h>
884
885	/* The LD_PRELOAD environment variable gives list of libraries
886	separated by white space or colons that are loaded before the
887	executable's dependencies and prepended to the global scope list.
888	(If the binary is running setuid all elements containing a '/' are
889	ignored since it is insecure.) Return the number of preloads
890	performed. Ditto for --preload command argument. */
891	unsigned int
892	handle_preload_list (const char *preloadlist, struct link_map *main_map,
893	const char *where)
894	{
895	unsigned int npreloads = 0;
896	const char *p = preloadlist;
897	char fname[SECURE_PATH_LIMIT];
898
899	while (*p != '\0')
900	{
901	/* Split preload list at space/colon. */
902	size_t len = strcspn (s: p, reject: " :");
903	if (len > 0 && len < sizeof (fname))
904	{
905	memcpy (fname, p, len);
906	fname[len] = '\0';
907	}
908	else
909	fname[0] = '\0';
910
911	/* Skip over the substring and the following delimiter. */
912	p += len;
913	if (*p != '\0')
914	++p;
915
916	if (dso_name_valid_for_suid (p: fname))
917	npreloads += do_preload (fname, main_map, where);
918	}
919	return npreloads;
920	}
921
922	/* Called if the audit DSO cannot be used: if it does not have the
923	appropriate interfaces, or it expects a more recent version library
924	version than what the dynamic linker provides. */
925	static void
926	unload_audit_module (struct link_map *map, int original_tls_idx)
927	{
928	#ifndef NDEBUG
929	Lmid_t ns = map->l_ns;
930	#endif
931	_dl_close (map);
932
933	/* Make sure the namespace has been cleared entirely. */
934	assert (GL(dl_ns)[ns]._ns_loaded == NULL);
935	assert (GL(dl_ns)[ns]._ns_nloaded == 0);
936
937	GL(dl_tls_max_dtv_idx) = original_tls_idx;
938	}
939
940	/* Called to print an error message if loading of an audit module
941	failed. */
942	static void
943	report_audit_module_load_error (const char *name, const char *err_str,
944	bool malloced)
945	{
946	_dl_error_printf (fmt: "\
947	ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
948	name, err_str);
949	if (malloced)
950	free (ptr: (char *) err_str);
951	}
952
953	/* Load one audit module. */
954	static void
955	load_audit_module (const char *name, struct audit_ifaces **last_audit)
956	{
957	int original_tls_idx = GL(dl_tls_max_dtv_idx);
958
959	struct dlmopen_args dlmargs;
960	dlmargs.fname = name;
961	dlmargs.map = NULL;
962
963	const char *objname;
964	const char *err_str = NULL;
965	bool malloced;
966	_dl_catch_error (objname: &objname, errstring: &err_str, mallocedp: &malloced, operate: dlmopen_doit, args: &dlmargs);
967	if (__glibc_unlikely (err_str != NULL))
968	{
969	report_audit_module_load_error (name, err_str, malloced);
970	return;
971	}
972
973	struct lookup_args largs;
974	largs.name = "la_version";
975	largs.map = dlmargs.map;
976	_dl_catch_error (objname: &objname, errstring: &err_str, mallocedp: &malloced, operate: lookup_doit, args: &largs);
977	if (__glibc_likely (err_str != NULL))
978	{
979	unload_audit_module (map: dlmargs.map, original_tls_idx);
980	report_audit_module_load_error (name, err_str, malloced);
981	return;
982	}
983
984	unsigned int (*laversion) (unsigned int) = largs.result;
985
986	/* A null symbol indicates that something is very wrong with the
987	loaded object because defined symbols are supposed to have a
988	valid, non-null address. */
989	assert (laversion != NULL);
990
991	unsigned int lav = laversion (LAV_CURRENT);
992	if (lav == 0)
993	{
994	/* Only print an error message if debugging because this can
995	happen deliberately. */
996	if (GLRO(dl_debug_mask) & DL_DEBUG_FILES)
997	_dl_debug_printf (fmt: "\
998	file=%s [%lu]; audit interface function la_version returned zero; ignored.\n",
999	dlmargs.map->l_name, dlmargs.map->l_ns);
1000	unload_audit_module (map: dlmargs.map, original_tls_idx);
1001	return;
1002	}
1003
1004	if (!_dl_audit_check_version (lav))
1005	{
1006	_dl_debug_printf (fmt: "\
1007	ERROR: audit interface '%s' requires version %d (maximum supported version %d); ignored.\n",
1008	name, lav, LAV_CURRENT);
1009	unload_audit_module (map: dlmargs.map, original_tls_idx);
1010	return;
1011	}
1012
1013	enum { naudit_ifaces = 8 };
1014	union
1015	{
1016	struct audit_ifaces ifaces;
1017	void (*fptr[naudit_ifaces]) (void);
1018	} *newp = malloc (size: sizeof (*newp));
1019	if (newp == NULL)
1020	_dl_fatal_printf ("Out of memory while loading audit modules\n");
1021
1022	/* Names of the auditing interfaces. All in one
1023	long string. */
1024	static const char audit_iface_names[] =
1025	"la_activity\0"
1026	"la_objsearch\0"
1027	"la_objopen\0"
1028	"la_preinit\0"
1029	LA_SYMBIND "\0"
1030	#define STRING(s) __STRING (s)
1031	"la_" STRING (ARCH_LA_PLTENTER) "\0"
1032	"la_" STRING (ARCH_LA_PLTEXIT) "\0"
1033	"la_objclose\0";
1034	unsigned int cnt = 0;
1035	const char *cp = audit_iface_names;
1036	do
1037	{
1038	largs.name = cp;
1039	_dl_catch_error (objname: &objname, errstring: &err_str, mallocedp: &malloced, operate: lookup_doit, args: &largs);
1040
1041	/* Store the pointer. */
1042	if (err_str == NULL && largs.result != NULL)
1043	newp->fptr[cnt] = largs.result;
1044	else
1045	newp->fptr[cnt] = NULL;
1046	++cnt;
1047
1048	cp = rawmemchr (cp, '\0') + 1;
1049	}
1050	while (*cp != '\0');
1051	assert (cnt == naudit_ifaces);
1052
1053	/* Now append the new auditing interface to the list. */
1054	newp->ifaces.next = NULL;
1055	if (*last_audit == NULL)
1056	*last_audit = GLRO(dl_audit) = &newp->ifaces;
1057	else
1058	*last_audit = (*last_audit)->next = &newp->ifaces;
1059
1060	/* The dynamic linker link map is statically allocated, so the
1061	cookie in _dl_new_object has not happened. */
1062	link_map_audit_state (l: &GL (dl_rtld_map), GLRO (dl_naudit))->cookie
1063	= (intptr_t) &GL (dl_rtld_map);
1064
1065	++GLRO(dl_naudit);
1066
1067	/* Mark the DSO as being used for auditing. */
1068	dlmargs.map->l_auditing = 1;
1069	}
1070
1071	/* Load all audit modules. */
1072	static void
1073	load_audit_modules (struct link_map *main_map, struct audit_list *audit_list)
1074	{
1075	struct audit_ifaces *last_audit = NULL;
1076
1077	while (true)
1078	{
1079	const char *name = audit_list_next (list: audit_list);
1080	if (name == NULL)
1081	break;
1082	load_audit_module (name, last_audit: &last_audit);
1083	}
1084
1085	/* Notify audit modules of the initially loaded modules (the main
1086	program and the dynamic linker itself). */
1087	if (GLRO(dl_naudit) > 0)
1088	{
1089	_dl_audit_objopen (l: main_map, LM_ID_BASE);
1090	_dl_audit_objopen (l: &GL(dl_rtld_map), LM_ID_BASE);
1091	}
1092	}
1093
1094	/* Check if the executable is not actualy dynamically linked, and
1095	invoke it directly in that case. */
1096	static void
1097	rtld_chain_load (struct link_map *main_map, char *argv0)
1098	{
1099	/* The dynamic loader run against itself. */
1100	const char *rtld_soname
1101	= ((const char *) D_PTR (&GL(dl_rtld_map), l_info[DT_STRTAB])
1102	+ GL(dl_rtld_map).l_info[DT_SONAME]->d_un.d_val);
1103	if (main_map->l_info[DT_SONAME] != NULL
1104	&& strcmp (rtld_soname,
1105	((const char *) D_PTR (main_map, l_info[DT_STRTAB])
1106	+ main_map->l_info[DT_SONAME]->d_un.d_val)) == 0)
1107	_dl_fatal_printf ("%s: loader cannot load itself\n", rtld_soname);
1108
1109	/* With DT_NEEDED dependencies, the executable is dynamically
1110	linked. */
1111	if (__glibc_unlikely (main_map->l_info[DT_NEEDED] != NULL))
1112	return;
1113
1114	/* If the executable has program interpreter, it is dynamically
1115	linked. */
1116	for (size_t i = 0; i < main_map->l_phnum; ++i)
1117	if (main_map->l_phdr[i].p_type == PT_INTERP)
1118	return;
1119
1120	const char *pathname = _dl_argv[0];
1121	if (argv0 != NULL)
1122	_dl_argv[0] = argv0;
1123	int errcode = __rtld_execve (path: pathname, argv: _dl_argv, envp: _environ);
1124	const char *errname = strerrorname_np (err: errcode);
1125	if (errname != NULL)
1126	_dl_fatal_printf("%s: cannot execute %s: %s\n",
1127	rtld_soname, pathname, errname);
1128	else
1129	_dl_fatal_printf("%s: cannot execute %s: %d\n",
1130	rtld_soname, pathname, errcode);
1131	}
1132
1133	/* Called to complete the initialization of the link map for the main
1134	executable. Returns true if there is a PT_INTERP segment. */
1135	static bool
1136	rtld_setup_main_map (struct link_map *main_map)
1137	{
1138	/* This have already been filled in right after _dl_new_object, or
1139	as part of _dl_map_object. */
1140	const ElfW(Phdr) *phdr = main_map->l_phdr;
1141	ElfW(Word) phnum = main_map->l_phnum;
1142
1143	bool has_interp = false;
1144
1145	main_map->l_map_end = 0;
1146	main_map->l_text_end = 0;
1147	/* Perhaps the executable has no PT_LOAD header entries at all. */
1148	main_map->l_map_start = ~0;
1149	/* And it was opened directly. */
1150	++main_map->l_direct_opencount;
1151	main_map->l_contiguous = 1;
1152
1153	/* A PT_LOAD segment at an unexpected address will clear the
1154	l_contiguous flag. The ELF specification says that PT_LOAD
1155	segments need to be sorted in in increasing order, but perhaps
1156	not all executables follow this requirement. Having l_contiguous
1157	equal to 1 is just an optimization, so the code below does not
1158	try to sort the segments in case they are unordered.
1159
1160	There is one corner case in which l_contiguous is not set to 1,
1161	but where it could be set: If a PIE (ET_DYN) binary is loaded by
1162	glibc itself (not the kernel), it is always contiguous due to the
1163	way the glibc loader works. However, the kernel loader may still
1164	create holes in this case, and the code here still uses 0
1165	conservatively for the glibc-loaded case, too. */
1166	ElfW(Addr) expected_load_address = 0;
1167
1168	/* Scan the program header table for the dynamic section. */
1169	for (const ElfW(Phdr) *ph = phdr; ph < &phdr[phnum]; ++ph)
1170	switch (ph->p_type)
1171	{
1172	case PT_PHDR:
1173	/* Find out the load address. */
1174	main_map->l_addr = (ElfW(Addr)) phdr - ph->p_vaddr;
1175	break;
1176	case PT_DYNAMIC:
1177	/* This tells us where to find the dynamic section,
1178	which tells us everything we need to do. */
1179	main_map->l_ld = (void *) main_map->l_addr + ph->p_vaddr;
1180	main_map->l_ld_readonly = (ph->p_flags & PF_W) == 0;
1181	break;
1182	case PT_INTERP:
1183	/* This "interpreter segment" was used by the program loader to
1184	find the program interpreter, which is this program itself, the
1185	dynamic linker. We note what name finds us, so that a future
1186	dlopen call or DT_NEEDED entry, for something that wants to link
1187	against the dynamic linker as a shared library, will know that
1188	the shared object is already loaded. */
1189	_dl_rtld_libname.name = ((const char *) main_map->l_addr
1190	+ ph->p_vaddr);
1191	/* _dl_rtld_libname.next = NULL; Already zero. */
1192	GL(dl_rtld_map).l_libname = &_dl_rtld_libname;
1193
1194	/* Ordinarilly, we would get additional names for the loader from
1195	our DT_SONAME. This can't happen if we were actually linked as
1196	a static executable (detect this case when we have no DYNAMIC).
1197	If so, assume the filename component of the interpreter path to
1198	be our SONAME, and add it to our name list. */
1199	if (GL(dl_rtld_map).l_ld == NULL)
1200	{
1201	const char *p = NULL;
1202	const char *cp = _dl_rtld_libname.name;
1203
1204	/* Find the filename part of the path. */
1205	while (*cp != '\0')
1206	if (*cp++ == '/')
1207	p = cp;
1208
1209	if (p != NULL)
1210	{
1211	_dl_rtld_libname2.name = p;
1212	/* _dl_rtld_libname2.next = NULL; Already zero. */
1213	_dl_rtld_libname.next = &_dl_rtld_libname2;
1214	}
1215	}
1216
1217	has_interp = true;
1218	break;
1219	case PT_LOAD:
1220	{
1221	ElfW(Addr) mapstart;
1222	ElfW(Addr) allocend;
1223
1224	/* Remember where the main program starts in memory. */
1225	mapstart = (main_map->l_addr
1226	+ (ph->p_vaddr & ~(GLRO(dl_pagesize) - 1)));
1227	if (main_map->l_map_start > mapstart)
1228	main_map->l_map_start = mapstart;
1229
1230	if (main_map->l_contiguous && expected_load_address != 0
1231	&& expected_load_address != mapstart)
1232	main_map->l_contiguous = 0;
1233
1234	/* Also where it ends. */
1235	allocend = main_map->l_addr + ph->p_vaddr + ph->p_memsz;
1236	if (main_map->l_map_end < allocend)
1237	main_map->l_map_end = allocend;
1238	if ((ph->p_flags & PF_X) && allocend > main_map->l_text_end)
1239	main_map->l_text_end = allocend;
1240
1241	/* The next expected address is the page following this load
1242	segment. */
1243	expected_load_address = ((allocend + GLRO(dl_pagesize) - 1)
1244	& ~(GLRO(dl_pagesize) - 1));
1245	}
1246	break;
1247
1248	case PT_TLS:
1249	if (ph->p_memsz > 0)
1250	{
1251	/* Note that in the case the dynamic linker we duplicate work
1252	here since we read the PT_TLS entry already in
1253	_dl_start_final. But the result is repeatable so do not
1254	check for this special but unimportant case. */
1255	main_map->l_tls_blocksize = ph->p_memsz;
1256	main_map->l_tls_align = ph->p_align;
1257	if (ph->p_align == 0)
1258	main_map->l_tls_firstbyte_offset = 0;
1259	else
1260	main_map->l_tls_firstbyte_offset = (ph->p_vaddr
1261	& (ph->p_align - 1));
1262	main_map->l_tls_initimage_size = ph->p_filesz;
1263	main_map->l_tls_initimage = (void *) ph->p_vaddr;
1264
1265	/* This image gets the ID one. */
1266	GL(dl_tls_max_dtv_idx) = main_map->l_tls_modid = 1;
1267	}
1268	break;
1269
1270	case PT_GNU_STACK:
1271	GL(dl_stack_flags) = ph->p_flags;
1272	break;
1273
1274	case PT_GNU_RELRO:
1275	main_map->l_relro_addr = ph->p_vaddr;
1276	main_map->l_relro_size = ph->p_memsz;
1277	break;
1278	}
1279	/* Process program headers again, but scan them backwards so
1280	that PT_NOTE can be skipped if PT_GNU_PROPERTY exits. */
1281	for (const ElfW(Phdr) *ph = &phdr[phnum]; ph != phdr; --ph)
1282	switch (ph[-1].p_type)
1283	{
1284	case PT_NOTE:
1285	_dl_process_pt_note (l: main_map, fd: -1, ph: &ph[-1]);
1286	break;
1287	case PT_GNU_PROPERTY:
1288	_dl_process_pt_gnu_property (l: main_map, fd: -1, ph: &ph[-1]);
1289	break;
1290	}
1291
1292	/* Adjust the address of the TLS initialization image in case
1293	the executable is actually an ET_DYN object. */
1294	if (main_map->l_tls_initimage != NULL)
1295	main_map->l_tls_initimage
1296	= (char *) main_map->l_tls_initimage + main_map->l_addr;
1297	if (! main_map->l_map_end)
1298	main_map->l_map_end = ~0;
1299	if (! main_map->l_text_end)
1300	main_map->l_text_end = ~0;
1301	if (! GL(dl_rtld_map).l_libname && GL(dl_rtld_map).l_name)
1302	{
1303	/* We were invoked directly, so the program might not have a
1304	PT_INTERP. */
1305	_dl_rtld_libname.name = GL(dl_rtld_map).l_name;
1306	/* _dl_rtld_libname.next = NULL; Already zero. */
1307	GL(dl_rtld_map).l_libname = &_dl_rtld_libname;
1308	}
1309	else
1310	assert (GL(dl_rtld_map).l_libname); /* How else did we get here? */
1311
1312	return has_interp;
1313	}
1314
1315	/* Adjusts the contents of the stack and related globals for the user
1316	entry point. The ld.so processed skip_args arguments and bumped
1317	_dl_argv and _dl_argc accordingly. Those arguments are removed from
1318	argv here. */
1319	static void
1320	_dl_start_args_adjust (int skip_args)
1321	{
1322	void **sp = (void **) (_dl_argv - skip_args - 1);
1323	void **p = sp + skip_args;
1324
1325	if (skip_args == 0)
1326	return;
1327
1328	/* Sanity check. */
1329	intptr_t argc = (intptr_t) sp[0] - skip_args;
1330	assert (argc == _dl_argc);
1331
1332	/* Adjust argc on stack. */
1333	sp[0] = (void *) (intptr_t) _dl_argc;
1334
1335	/* Update globals in rtld. */
1336	_dl_argv -= skip_args;
1337	_environ -= skip_args;
1338
1339	/* Shuffle argv down. */
1340	do
1341	*++sp = *++p;
1342	while (*p != NULL);
1343
1344	assert (_environ == (char **) (sp + 1));
1345
1346	/* Shuffle envp down. */
1347	do
1348	*++sp = *++p;
1349	while (*p != NULL);
1350
1351	#ifdef HAVE_AUX_VECTOR
1352	void **auxv = (void **) GLRO(dl_auxv) - skip_args;
1353	GLRO(dl_auxv) = (ElfW(auxv_t) *) auxv; /* Aliasing violation. */
1354	assert (auxv == sp + 1);
1355
1356	/* Shuffle auxv down. */
1357	ElfW(auxv_t) ax;
1358	char *oldp = (char *) (p + 1);
1359	char *newp = (char *) (sp + 1);
1360	do
1361	{
1362	memcpy (&ax, oldp, sizeof (ax));
1363	memcpy (newp, &ax, sizeof (ax));
1364	oldp += sizeof (ax);
1365	newp += sizeof (ax);
1366	}
1367	while (ax.a_type != AT_NULL);
1368	#endif
1369	}
1370
1371	static void
1372	dl_main (const ElfW(Phdr) *phdr,
1373	ElfW(Word) phnum,
1374	ElfW(Addr) *user_entry,
1375	ElfW(auxv_t) *auxv)
1376	{
1377	struct link_map *main_map;
1378	size_t file_size;
1379	char *file;
1380	unsigned int i;
1381	bool prelinked = false;
1382	bool rtld_is_main = false;
1383	void *tcbp = NULL;
1384
1385	struct dl_main_state state;
1386	dl_main_state_init (state: &state);
1387
1388	__tls_pre_init_tp ();
1389
1390	#if !PTHREAD_IN_LIBC
1391	/* The explicit initialization here is cheaper than processing the reloc
1392	in the _rtld_local definition's initializer. */
1393	GL(dl_make_stack_executable_hook) = &_dl_make_stack_executable;
1394	#endif
1395
1396	/* Process the environment variable which control the behaviour. */
1397	process_envvars (state: &state);
1398
1399	#ifndef HAVE_INLINED_SYSCALLS
1400	/* Set up a flag which tells we are just starting. */
1401	_dl_starting_up = 1;
1402	#endif
1403
1404	const char *ld_so_name = _dl_argv[0];
1405	if (*user_entry == (ElfW(Addr)) ENTRY_POINT)
1406	{
1407	/* Ho ho. We are not the program interpreter! We are the program
1408	itself! This means someone ran ld.so as a command. Well, that
1409	might be convenient to do sometimes. We support it by
1410	interpreting the args like this:
1411
1412	ld.so PROGRAM ARGS...
1413
1414	The first argument is the name of a file containing an ELF
1415	executable we will load and run with the following arguments.
1416	To simplify life here, PROGRAM is searched for using the
1417	normal rules for shared objects, rather than $PATH or anything
1418	like that. We just load it and use its entry point; we don't
1419	pay attention to its PT_INTERP command (we are the interpreter
1420	ourselves). This is an easy way to test a new ld.so before
1421	installing it. */
1422	rtld_is_main = true;
1423
1424	char *argv0 = NULL;
1425	char **orig_argv = _dl_argv;
1426
1427	/* Note the place where the dynamic linker actually came from. */
1428	GL(dl_rtld_map).l_name = rtld_progname;
1429
1430	while (_dl_argc > 1)
1431	if (! strcmp (_dl_argv[1], "--list"))
1432	{
1433	if (state.mode != rtld_mode_help)
1434	{
1435	state.mode = rtld_mode_list;
1436	/* This means do no dependency analysis. */
1437	GLRO(dl_lazy) = -1;
1438	}
1439
1440	--_dl_argc;
1441	++_dl_argv;
1442	}
1443	else if (! strcmp (_dl_argv[1], "--verify"))
1444	{
1445	if (state.mode != rtld_mode_help)
1446	state.mode = rtld_mode_verify;
1447
1448	--_dl_argc;
1449	++_dl_argv;
1450	}
1451	else if (! strcmp (_dl_argv[1], "--inhibit-cache"))
1452	{
1453	GLRO(dl_inhibit_cache) = 1;
1454	--_dl_argc;
1455	++_dl_argv;
1456	}
1457	else if (! strcmp (_dl_argv[1], "--library-path")
1458	&& _dl_argc > 2)
1459	{
1460	state.library_path = _dl_argv[2];
1461	state.library_path_source = "--library-path";
1462
1463	_dl_argc -= 2;
1464	_dl_argv += 2;
1465	}
1466	else if (! strcmp (_dl_argv[1], "--inhibit-rpath")
1467	&& _dl_argc > 2)
1468	{
1469	GLRO(dl_inhibit_rpath) = _dl_argv[2];
1470
1471	_dl_argc -= 2;
1472	_dl_argv += 2;
1473	}
1474	else if (! strcmp (_dl_argv[1], "--audit") && _dl_argc > 2)
1475	{
1476	audit_list_add_string (list: &state.audit_list, string: _dl_argv[2]);
1477
1478	_dl_argc -= 2;
1479	_dl_argv += 2;
1480	}
1481	else if (! strcmp (_dl_argv[1], "--preload") && _dl_argc > 2)
1482	{
1483	state.preloadarg = _dl_argv[2];
1484	_dl_argc -= 2;
1485	_dl_argv += 2;
1486	}
1487	else if (! strcmp (_dl_argv[1], "--argv0") && _dl_argc > 2)
1488	{
1489	argv0 = _dl_argv[2];
1490
1491	_dl_argc -= 2;
1492	_dl_argv += 2;
1493	}
1494	else if (strcmp (_dl_argv[1], "--glibc-hwcaps-prepend") == 0
1495	&& _dl_argc > 2)
1496	{
1497	state.glibc_hwcaps_prepend = _dl_argv[2];
1498	_dl_argc -= 2;
1499	_dl_argv += 2;
1500	}
1501	else if (strcmp (_dl_argv[1], "--glibc-hwcaps-mask") == 0
1502	&& _dl_argc > 2)
1503	{
1504	state.glibc_hwcaps_mask = _dl_argv[2];
1505	_dl_argc -= 2;
1506	_dl_argv += 2;
1507	}
1508	#if HAVE_TUNABLES
1509	else if (! strcmp (_dl_argv[1], "--list-tunables"))
1510	{
1511	state.mode = rtld_mode_list_tunables;
1512
1513	--_dl_argc;
1514	++_dl_argv;
1515	}
1516	#endif
1517	else if (! strcmp (_dl_argv[1], "--list-diagnostics"))
1518	{
1519	state.mode = rtld_mode_list_diagnostics;
1520
1521	--_dl_argc;
1522	++_dl_argv;
1523	}
1524	else if (strcmp (_dl_argv[1], "--help") == 0)
1525	{
1526	state.mode = rtld_mode_help;
1527	--_dl_argc;
1528	++_dl_argv;
1529	}
1530	else if (strcmp (_dl_argv[1], "--version") == 0)
1531	_dl_version ();
1532	else if (_dl_argv[1][0] == '-' && _dl_argv[1][1] == '-')
1533	{
1534	if (_dl_argv[1][1] == '\0')
1535	/* End of option list. */
1536	break;
1537	else
1538	/* Unrecognized option. */
1539	_dl_usage (argv0: ld_so_name, wrong_option: _dl_argv[1]);
1540	}
1541	else
1542	break;
1543
1544	#if HAVE_TUNABLES
1545	if (__glibc_unlikely (state.mode == rtld_mode_list_tunables))
1546	{
1547	__tunables_print ();
1548	_exit (0);
1549	}
1550	#endif
1551
1552	if (state.mode == rtld_mode_list_diagnostics)
1553	_dl_print_diagnostics (environ: _environ);
1554
1555	/* If we have no further argument the program was called incorrectly.
1556	Grant the user some education. */
1557	if (_dl_argc < 2)
1558	{
1559	if (state.mode == rtld_mode_help)
1560	/* --help without an executable is not an error. */
1561	_dl_help (argv0: ld_so_name, state: &state);
1562	else
1563	_dl_usage (argv0: ld_so_name, NULL);
1564	}
1565
1566	--_dl_argc;
1567	++_dl_argv;
1568
1569	/* The initialization of _dl_stack_flags done below assumes the
1570	executable's PT_GNU_STACK may have been honored by the kernel, and
1571	so a PT_GNU_STACK with PF_X set means the stack started out with
1572	execute permission. However, this is not really true if the
1573	dynamic linker is the executable the kernel loaded. For this
1574	case, we must reinitialize _dl_stack_flags to match the dynamic
1575	linker itself. If the dynamic linker was built with a
1576	PT_GNU_STACK, then the kernel may have loaded us with a
1577	nonexecutable stack that we will have to make executable when we
1578	load the program below unless it has a PT_GNU_STACK indicating
1579	nonexecutable stack is ok. */
1580
1581	for (const ElfW(Phdr) *ph = phdr; ph < &phdr[phnum]; ++ph)
1582	if (ph->p_type == PT_GNU_STACK)
1583	{
1584	GL(dl_stack_flags) = ph->p_flags;
1585	break;
1586	}
1587
1588	if (__glibc_unlikely (state.mode == rtld_mode_verify
1589	|| state.mode == rtld_mode_help))
1590	{
1591	const char *objname;
1592	const char *err_str = NULL;
1593	struct map_args args;
1594	bool malloced;
1595
1596	args.str = rtld_progname;
1597	args.loader = NULL;
1598	args.mode = __RTLD_OPENEXEC;
1599	(void) _dl_catch_error (objname: &objname, errstring: &err_str, mallocedp: &malloced, operate: map_doit,
1600	args: &args);
1601	if (__glibc_unlikely (err_str != NULL))
1602	{
1603	/* We don't free the returned string, the programs stops
1604	anyway. */
1605	if (state.mode == rtld_mode_help)
1606	/* Mask the failure to load the main object. The help
1607	message contains less information in this case. */
1608	_dl_help (argv0: ld_so_name, state: &state);
1609	else
1610	_exit (EXIT_FAILURE);
1611	}
1612	}
1613	else
1614	{
1615	RTLD_TIMING_VAR (start);
1616	rtld_timer_start (var: &start);
1617	_dl_map_object (NULL, rtld_progname, type: lt_executable, trace_mode: 0,
1618	__RTLD_OPENEXEC, LM_ID_BASE);
1619	rtld_timer_stop (var: &load_time, start);
1620	}
1621
1622	/* Now the map for the main executable is available. */
1623	main_map = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
1624
1625	if (__glibc_likely (state.mode == rtld_mode_normal))
1626	rtld_chain_load (main_map, argv0);
1627
1628	phdr = main_map->l_phdr;
1629	phnum = main_map->l_phnum;
1630	/* We overwrite here a pointer to a malloc()ed string. But since
1631	the malloc() implementation used at this point is the dummy
1632	implementations which has no real free() function it does not
1633	makes sense to free the old string first. */
1634	main_map->l_name = (char *) "";
1635	*user_entry = main_map->l_entry;
1636
1637	/* Set bit indicating this is the main program map. */
1638	main_map->l_main_map = 1;
1639
1640	#ifdef HAVE_AUX_VECTOR
1641	/* Adjust the on-stack auxiliary vector so that it looks like the
1642	binary was executed directly. */
1643	for (ElfW(auxv_t) *av = auxv; av->a_type != AT_NULL; av++)
1644	switch (av->a_type)
1645	{
1646	case AT_PHDR:
1647	av->a_un.a_val = (uintptr_t) phdr;
1648	break;
1649	case AT_PHNUM:
1650	av->a_un.a_val = phnum;
1651	break;
1652	case AT_ENTRY:
1653	av->a_un.a_val = *user_entry;
1654	break;
1655	case AT_EXECFN:
1656	av->a_un.a_val = (uintptr_t) _dl_argv[0];
1657	break;
1658	}
1659	#endif
1660
1661	/* Set the argv[0] string now that we've processed the executable. */
1662	if (argv0 != NULL)
1663	_dl_argv[0] = argv0;
1664
1665	/* Adjust arguments for the application entry point. */
1666	_dl_start_args_adjust (skip_args: _dl_argv - orig_argv);
1667	}
1668	else
1669	{
1670	/* Create a link_map for the executable itself.
1671	This will be what dlopen on "" returns. */
1672	main_map = _dl_new_object (realname: (char *) "", libname: "", type: lt_executable, NULL,
1673	__RTLD_OPENEXEC, LM_ID_BASE);
1674	assert (main_map != NULL);
1675	main_map->l_phdr = phdr;
1676	main_map->l_phnum = phnum;
1677	main_map->l_entry = *user_entry;
1678
1679	/* Even though the link map is not yet fully initialized we can add
1680	it to the map list since there are no possible users running yet. */
1681	_dl_add_to_namespace_list (new: main_map, LM_ID_BASE);
1682	assert (main_map == GL(dl_ns)[LM_ID_BASE]._ns_loaded);
1683
1684	/* At this point we are in a bit of trouble. We would have to
1685	fill in the values for l_dev and l_ino. But in general we
1686	do not know where the file is. We also do not handle AT_EXECFD
1687	even if it would be passed up.
1688
1689	We leave the values here defined to 0. This is normally no
1690	problem as the program code itself is normally no shared
1691	object and therefore cannot be loaded dynamically. Nothing
1692	prevent the use of dynamic binaries and in these situations
1693	we might get problems. We might not be able to find out
1694	whether the object is already loaded. But since there is no
1695	easy way out and because the dynamic binary must also not
1696	have an SONAME we ignore this program for now. If it becomes
1697	a problem we can force people using SONAMEs. */
1698
1699	/* We delay initializing the path structure until we got the dynamic
1700	information for the program. */
1701	}
1702
1703	bool has_interp = rtld_setup_main_map (main_map);
1704
1705	/* If the current libname is different from the SONAME, add the
1706	latter as well. */
1707	if (GL(dl_rtld_map).l_info[DT_SONAME] != NULL
1708	&& strcmp (GL(dl_rtld_map).l_libname->name,
1709	(const char *) D_PTR (&GL(dl_rtld_map), l_info[DT_STRTAB])
1710	+ GL(dl_rtld_map).l_info[DT_SONAME]->d_un.d_val) != 0)
1711	{
1712	static struct libname_list newname;
1713	newname.name = ((char *) D_PTR (&GL(dl_rtld_map), l_info[DT_STRTAB])
1714	+ GL(dl_rtld_map).l_info[DT_SONAME]->d_un.d_ptr);
1715	newname.next = NULL;
1716	newname.dont_free = 1;
1717
1718	assert (GL(dl_rtld_map).l_libname->next == NULL);
1719	GL(dl_rtld_map).l_libname->next = &newname;
1720	}
1721	/* The ld.so must be relocated since otherwise loading audit modules
1722	will fail since they reuse the very same ld.so. */
1723	assert (GL(dl_rtld_map).l_relocated);
1724
1725	if (! rtld_is_main)
1726	{
1727	/* Extract the contents of the dynamic section for easy access. */
1728	elf_get_dynamic_info (l: main_map, false, false);
1729
1730	/* If the main map is libc.so, update the base namespace to
1731	refer to this map. If libc.so is loaded later, this happens
1732	in _dl_map_object_from_fd. */
1733	if (main_map->l_info[DT_SONAME] != NULL
1734	&& (strcmp (((const char *) D_PTR (main_map, l_info[DT_STRTAB])
1735	+ main_map->l_info[DT_SONAME]->d_un.d_val), LIBC_SO)
1736	== 0))
1737	GL(dl_ns)[LM_ID_BASE].libc_map = main_map;
1738
1739	/* Set up our cache of pointers into the hash table. */
1740	_dl_setup_hash (map: main_map);
1741	}
1742
1743	if (__glibc_unlikely (state.mode == rtld_mode_verify))
1744	{
1745	/* We were called just to verify that this is a dynamic
1746	executable using us as the program interpreter. Exit with an
1747	error if we were not able to load the binary or no interpreter
1748	is specified (i.e., this is no dynamically linked binary. */
1749	if (main_map->l_ld == NULL)
1750	_exit (1);
1751
1752	/* We allow here some platform specific code. */
1753	#ifdef DISTINGUISH_LIB_VERSIONS
1754	DISTINGUISH_LIB_VERSIONS;
1755	#endif
1756	_exit (has_interp ? 0 : 2);
1757	}
1758
1759	struct link_map **first_preload = &GL(dl_rtld_map).l_next;
1760	/* Set up the data structures for the system-supplied DSO early,
1761	so they can influence _dl_init_paths. */
1762	setup_vdso (main_map, first_preload: &first_preload);
1763
1764	/* With vDSO setup we can initialize the function pointers. */
1765	setup_vdso_pointers ();
1766
1767	#ifdef DL_SYSDEP_OSCHECK
1768	DL_SYSDEP_OSCHECK (_dl_fatal_printf);
1769	#endif
1770
1771	/* Initialize the data structures for the search paths for shared
1772	objects. */
1773	call_init_paths (state: &state);
1774
1775	/* Initialize _r_debug_extended. */
1776	struct r_debug *r = _dl_debug_initialize (GL(dl_rtld_map).l_addr,
1777	LM_ID_BASE);
1778	r->r_state = RT_CONSISTENT;
1779
1780	/* Put the link_map for ourselves on the chain so it can be found by
1781	name. Note that at this point the global chain of link maps contains
1782	exactly one element, which is pointed to by dl_loaded. */
1783	if (! GL(dl_rtld_map).l_name)
1784	/* If not invoked directly, the dynamic linker shared object file was
1785	found by the PT_INTERP name. */
1786	GL(dl_rtld_map).l_name = (char *) GL(dl_rtld_map).l_libname->name;
1787	GL(dl_rtld_map).l_type = lt_library;
1788	main_map->l_next = &GL(dl_rtld_map);
1789	GL(dl_rtld_map).l_prev = main_map;
1790	++GL(dl_ns)[LM_ID_BASE]._ns_nloaded;
1791	++GL(dl_load_adds);
1792
1793	/* If LD_USE_LOAD_BIAS env variable has not been seen, default
1794	to not using bias for non-prelinked PIEs and libraries
1795	and using it for executables or prelinked PIEs or libraries. */
1796	if (GLRO(dl_use_load_bias) == (ElfW(Addr)) -2)
1797	GLRO(dl_use_load_bias) = main_map->l_addr == 0 ? -1 : 0;
1798
1799	/* Starting from binutils-2.23, the linker will define the magic symbol
1800	__ehdr_start to point to our own ELF header if it is visible in a
1801	segment that also includes the phdrs. If that's not available, we use
1802	the old method that assumes the beginning of the file is part of the
1803	lowest-addressed PT_LOAD segment. */
1804
1805	/* Set up the program header information for the dynamic linker
1806	itself. It is needed in the dl_iterate_phdr callbacks. */
1807	const ElfW(Ehdr) *rtld_ehdr = &__ehdr_start;
1808	assert (rtld_ehdr->e_ehsize == sizeof *rtld_ehdr);
1809	assert (rtld_ehdr->e_phentsize == sizeof (ElfW(Phdr)));
1810
1811	const ElfW(Phdr) *rtld_phdr = (const void *) rtld_ehdr + rtld_ehdr->e_phoff;
1812
1813	GL(dl_rtld_map).l_phdr = rtld_phdr;
1814	GL(dl_rtld_map).l_phnum = rtld_ehdr->e_phnum;
1815
1816
1817	/* PT_GNU_RELRO is usually the last phdr. */
1818	size_t cnt = rtld_ehdr->e_phnum;
1819	while (cnt-- > 0)
1820	if (rtld_phdr[cnt].p_type == PT_GNU_RELRO)
1821	{
1822	GL(dl_rtld_map).l_relro_addr = rtld_phdr[cnt].p_vaddr;
1823	GL(dl_rtld_map).l_relro_size = rtld_phdr[cnt].p_memsz;
1824	break;
1825	}
1826
1827	/* Add the dynamic linker to the TLS list if it also uses TLS. */
1828	if (GL(dl_rtld_map).l_tls_blocksize != 0)
1829	/* Assign a module ID. Do this before loading any audit modules. */
1830	_dl_assign_tls_modid (l: &GL(dl_rtld_map));
1831
1832	audit_list_add_dynamic_tag (list: &state.audit_list, main_map, DT_AUDIT);
1833	audit_list_add_dynamic_tag (list: &state.audit_list, main_map, DT_DEPAUDIT);
1834
1835	/* At this point, all data has been obtained that is included in the
1836	--help output. */
1837	if (__glibc_unlikely (state.mode == rtld_mode_help))
1838	_dl_help (argv0: ld_so_name, state: &state);
1839
1840	/* If we have auditing DSOs to load, do it now. */
1841	bool need_security_init = true;
1842	if (state.audit_list.length > 0)
1843	{
1844	size_t naudit = audit_list_count (list: &state.audit_list);
1845
1846	/* Since we start using the auditing DSOs right away we need to
1847	initialize the data structures now. */
1848	tcbp = init_tls (naudit);
1849
1850	/* Initialize security features. We need to do it this early
1851	since otherwise the constructors of the audit libraries will
1852	use different values (especially the pointer guard) and will
1853	fail later on. */
1854	security_init ();
1855	need_security_init = false;
1856
1857	load_audit_modules (main_map, audit_list: &state.audit_list);
1858
1859	/* The count based on audit strings may overestimate the number
1860	of audit modules that got loaded, but not underestimate. */
1861	assert (GLRO(dl_naudit) <= naudit);
1862	}
1863
1864	/* Keep track of the currently loaded modules to count how many
1865	non-audit modules which use TLS are loaded. */
1866	size_t count_modids = _dl_count_modids ();
1867
1868	/* Set up debugging before the debugger is notified for the first time. */
1869	elf_setup_debug_entry (l: main_map, r);
1870
1871	/* We start adding objects. */
1872	r->r_state = RT_ADD;
1873	_dl_debug_state ();
1874	LIBC_PROBE (init_start, 2, LM_ID_BASE, r);
1875
1876	/* Auditing checkpoint: we are ready to signal that the initial map
1877	is being constructed. */
1878	_dl_audit_activity_map (l: main_map, action: LA_ACT_ADD);
1879
1880	/* We have two ways to specify objects to preload: via environment
1881	variable and via the file /etc/ld.so.preload. The latter can also
1882	be used when security is enabled. */
1883	assert (*first_preload == NULL);
1884	struct link_map **preloads = NULL;
1885	unsigned int npreloads = 0;
1886
1887	if (__glibc_unlikely (state.preloadlist != NULL))
1888	{
1889	RTLD_TIMING_VAR (start);
1890	rtld_timer_start (var: &start);
1891	npreloads += handle_preload_list (preloadlist: state.preloadlist, main_map,
1892	where: "LD_PRELOAD");
1893	rtld_timer_accum (sum: &load_time, start);
1894	}
1895
1896	if (__glibc_unlikely (state.preloadarg != NULL))
1897	{
1898	RTLD_TIMING_VAR (start);
1899	rtld_timer_start (var: &start);
1900	npreloads += handle_preload_list (preloadlist: state.preloadarg, main_map,
1901	where: "--preload");
1902	rtld_timer_accum (sum: &load_time, start);
1903	}
1904
1905	/* There usually is no ld.so.preload file, it should only be used
1906	for emergencies and testing. So the open call etc should usually
1907	fail. Using access() on a non-existing file is faster than using
1908	open(). So we do this first. If it succeeds we do almost twice
1909	the work but this does not matter, since it is not for production
1910	use. */
1911	static const char preload_file[] = "/etc/ld.so.preload";
1912	if (__glibc_unlikely (__access (preload_file, R_OK) == 0))
1913	{
1914	/* Read the contents of the file. */
1915	file = _dl_sysdep_read_whole_file (file: preload_file, sizep: &file_size,
1916	PROT_READ | PROT_WRITE);
1917	if (__glibc_unlikely (file != MAP_FAILED))
1918	{
1919	/* Parse the file. It contains names of libraries to be loaded,
1920	separated by white spaces or `:'. It may also contain
1921	comments introduced by `#'. */
1922	char *problem;
1923	char *runp;
1924	size_t rest;
1925
1926	/* Eliminate comments. */
1927	runp = file;
1928	rest = file_size;
1929	while (rest > 0)
1930	{
1931	char *comment = memchr (runp, '#', rest);
1932	if (comment == NULL)
1933	break;
1934
1935	rest -= comment - runp;
1936	do
1937	*comment = ' ';
1938	while (--rest > 0 && *++comment != '\n');
1939	}
1940
1941	/* We have one problematic case: if we have a name at the end of
1942	the file without a trailing terminating characters, we cannot
1943	place the \0. Handle the case separately. */
1944	if (file[file_size - 1] != ' ' && file[file_size - 1] != '\t'
1945	&& file[file_size - 1] != '\n' && file[file_size - 1] != ':')
1946	{
1947	problem = &file[file_size];
1948	while (problem > file && problem[-1] != ' '
1949	&& problem[-1] != '\t'
1950	&& problem[-1] != '\n' && problem[-1] != ':')
1951	--problem;
1952
1953	if (problem > file)
1954	problem[-1] = '\0';
1955	}
1956	else
1957	{
1958	problem = NULL;
1959	file[file_size - 1] = '\0';
1960	}
1961
1962	RTLD_TIMING_VAR (start);
1963	rtld_timer_start (var: &start);
1964
1965	if (file != problem)
1966	{
1967	char *p;
1968	runp = file;
1969	while ((p = strsep (&runp, ": \t\n")) != NULL)
1970	if (p[0] != '\0')
1971	npreloads += do_preload (fname: p, main_map, where: preload_file);
1972	}
1973
1974	if (problem != NULL)
1975	{
1976	char *p = strndupa (problem, file_size - (problem - file));
1977
1978	npreloads += do_preload (fname: p, main_map, where: preload_file);
1979	}
1980
1981	rtld_timer_accum (sum: &load_time, start);
1982
1983	/* We don't need the file anymore. */
1984	__munmap (file, file_size);
1985	}
1986	}
1987
1988	if (__glibc_unlikely (*first_preload != NULL))
1989	{
1990	/* Set up PRELOADS with a vector of the preloaded libraries. */
1991	struct link_map *l = *first_preload;
1992	preloads = __alloca (npreloads * sizeof preloads[0]);
1993	i = 0;
1994	do
1995	{
1996	preloads[i++] = l;
1997	l = l->l_next;
1998	} while (l);
1999	assert (i == npreloads);
2000	}
2001
2002	#ifdef NEED_DL_SYSINFO_DSO
2003	/* Now that the audit modules are opened, call la_objopen for the vDSO. */
2004	if (GLRO(dl_sysinfo_map) != NULL)
2005	_dl_audit_objopen (GLRO(dl_sysinfo_map), LM_ID_BASE);
2006	#endif
2007
2008	/* Load all the libraries specified by DT_NEEDED entries. If LD_PRELOAD
2009	specified some libraries to load, these are inserted before the actual
2010	dependencies in the executable's searchlist for symbol resolution. */
2011	{
2012	RTLD_TIMING_VAR (start);
2013	rtld_timer_start (var: &start);
2014	_dl_map_object_deps (map: main_map, preloads, npreloads,
2015	trace_mode: state.mode == rtld_mode_trace, open_mode: 0);
2016	rtld_timer_accum (sum: &load_time, start);
2017	}
2018
2019	/* Mark all objects as being in the global scope. */
2020	for (i = main_map->l_searchlist.r_nlist; i > 0; )
2021	main_map->l_searchlist.r_list[--i]->l_global = 1;
2022
2023	/* Remove _dl_rtld_map from the chain. */
2024	GL(dl_rtld_map).l_prev->l_next = GL(dl_rtld_map).l_next;
2025	if (GL(dl_rtld_map).l_next != NULL)
2026	GL(dl_rtld_map).l_next->l_prev = GL(dl_rtld_map).l_prev;
2027
2028	for (i = 1; i < main_map->l_searchlist.r_nlist; ++i)
2029	if (main_map->l_searchlist.r_list[i] == &GL(dl_rtld_map))
2030	break;
2031
2032	bool rtld_multiple_ref = false;
2033	if (__glibc_likely (i < main_map->l_searchlist.r_nlist))
2034	{
2035	/* Some DT_NEEDED entry referred to the interpreter object itself, so
2036	put it back in the list of visible objects. We insert it into the
2037	chain in symbol search order because gdb uses the chain's order as
2038	its symbol search order. */
2039	rtld_multiple_ref = true;
2040
2041	GL(dl_rtld_map).l_prev = main_map->l_searchlist.r_list[i - 1];
2042	if (__glibc_likely (state.mode == rtld_mode_normal))
2043	{
2044	GL(dl_rtld_map).l_next = (i + 1 < main_map->l_searchlist.r_nlist
2045	? main_map->l_searchlist.r_list[i + 1]
2046	: NULL);
2047	#ifdef NEED_DL_SYSINFO_DSO
2048	if (GLRO(dl_sysinfo_map) != NULL
2049	&& GL(dl_rtld_map).l_prev->l_next == GLRO(dl_sysinfo_map)
2050	&& GL(dl_rtld_map).l_next != GLRO(dl_sysinfo_map))
2051	GL(dl_rtld_map).l_prev = GLRO(dl_sysinfo_map);
2052	#endif
2053	}
2054	else
2055	/* In trace mode there might be an invisible object (which we
2056	could not find) after the previous one in the search list.
2057	In this case it doesn't matter much where we put the
2058	interpreter object, so we just initialize the list pointer so
2059	that the assertion below holds. */
2060	GL(dl_rtld_map).l_next = GL(dl_rtld_map).l_prev->l_next;
2061
2062	assert (GL(dl_rtld_map).l_prev->l_next == GL(dl_rtld_map).l_next);
2063	GL(dl_rtld_map).l_prev->l_next = &GL(dl_rtld_map);
2064	if (GL(dl_rtld_map).l_next != NULL)
2065	{
2066	assert (GL(dl_rtld_map).l_next->l_prev == GL(dl_rtld_map).l_prev);
2067	GL(dl_rtld_map).l_next->l_prev = &GL(dl_rtld_map);
2068	}
2069	}
2070
2071	/* Now let us see whether all libraries are available in the
2072	versions we need. */
2073	{
2074	struct version_check_args args;
2075	args.doexit = state.mode == rtld_mode_normal;
2076	args.dotrace = state.mode == rtld_mode_trace;
2077	_dl_receive_error (fct: print_missing_version, operate: version_check_doit, args: &args);
2078	}
2079
2080	/* We do not initialize any of the TLS functionality unless any of the
2081	initial modules uses TLS. This makes dynamic loading of modules with
2082	TLS impossible, but to support it requires either eagerly doing setup
2083	now or lazily doing it later. Doing it now makes us incompatible with
2084	an old kernel that can't perform TLS_INIT_TP, even if no TLS is ever
2085	used. Trying to do it lazily is too hairy to try when there could be
2086	multiple threads (from a non-TLS-using libpthread). */
2087	bool was_tls_init_tp_called = tls_init_tp_called;
2088	if (tcbp == NULL)
2089	tcbp = init_tls (naudit: 0);
2090
2091	if (__glibc_likely (need_security_init))
2092	/* Initialize security features. But only if we have not done it
2093	earlier. */
2094	security_init ();
2095
2096	if (__glibc_unlikely (state.mode != rtld_mode_normal))
2097	{
2098	/* We were run just to list the shared libraries. It is
2099	important that we do this before real relocation, because the
2100	functions we call below for output may no longer work properly
2101	after relocation. */
2102	struct link_map *l;
2103
2104	if (GLRO(dl_debug_mask) & DL_DEBUG_PRELINK)
2105	{
2106	struct r_scope_elem *scope = &main_map->l_searchlist;
2107
2108	for (i = 0; i < scope->r_nlist; i++)
2109	{
2110	l = scope->r_list [i];
2111	if (l->l_faked)
2112	{
2113	_dl_printf (fmt: "\t%s => not found\n", l->l_libname->name);
2114	continue;
2115	}
2116	if (_dl_name_match_p (GLRO(dl_trace_prelink), map: l))
2117	GLRO(dl_trace_prelink_map) = l;
2118	_dl_printf (fmt: "\t%s => %s (0x%0*Zx, 0x%0*Zx)",
2119	DSO_FILENAME (l->l_libname->name),
2120	DSO_FILENAME (l->l_name),
2121	(int) sizeof l->l_map_start * 2,
2122	(size_t) l->l_map_start,
2123	(int) sizeof l->l_addr * 2,
2124	(size_t) l->l_addr);
2125
2126	if (l->l_tls_modid)
2127	_dl_printf (fmt: " TLS(0x%Zx, 0x%0*Zx)\n", l->l_tls_modid,
2128	(int) sizeof l->l_tls_offset * 2,
2129	(size_t) l->l_tls_offset);
2130	else
2131	_dl_printf (fmt: "\n");
2132	}
2133	}
2134	else if (GLRO(dl_debug_mask) & DL_DEBUG_UNUSED)
2135	{
2136	/* Look through the dependencies of the main executable
2137	and determine which of them is not actually
2138	required. */
2139	struct link_map *l = main_map;
2140
2141	/* Relocate the main executable. */
2142	struct relocate_args args = { .l = l,
2143	.reloc_mode = ((GLRO(dl_lazy)
2144	? RTLD_LAZY : 0)
2145	| __RTLD_NOIFUNC) };
2146	_dl_receive_error (fct: print_unresolved, operate: relocate_doit, args: &args);
2147
2148	/* This loop depends on the dependencies of the executable to
2149	correspond in number and order to the DT_NEEDED entries. */
2150	ElfW(Dyn) *dyn = main_map->l_ld;
2151	bool first = true;
2152	while (dyn->d_tag != DT_NULL)
2153	{
2154	if (dyn->d_tag == DT_NEEDED)
2155	{
2156	l = l->l_next;
2157	#ifdef NEED_DL_SYSINFO_DSO
2158	/* Skip the VDSO since it's not part of the list
2159	of objects we brought in via DT_NEEDED entries. */
2160	if (l == GLRO(dl_sysinfo_map))
2161	l = l->l_next;
2162	#endif
2163	if (!l->l_used)
2164	{
2165	if (first)
2166	{
2167	_dl_printf (fmt: "Unused direct dependencies:\n");
2168	first = false;
2169	}
2170
2171	_dl_printf (fmt: "\t%s\n", l->l_name);
2172	}
2173	}
2174
2175	++dyn;
2176	}
2177
2178	_exit (first != true);
2179	}
2180	else if (! main_map->l_info[DT_NEEDED])
2181	_dl_printf (fmt: "\tstatically linked\n");
2182	else
2183	{
2184	for (l = main_map->l_next; l; l = l->l_next)
2185	if (l->l_faked)
2186	/* The library was not found. */
2187	_dl_printf (fmt: "\t%s => not found\n", l->l_libname->name);
2188	else if (strcmp (l->l_libname->name, l->l_name) == 0)
2189	_dl_printf (fmt: "\t%s (0x%0*Zx)\n", l->l_libname->name,
2190	(int) sizeof l->l_map_start * 2,
2191	(size_t) l->l_map_start);
2192	else
2193	_dl_printf (fmt: "\t%s => %s (0x%0*Zx)\n", l->l_libname->name,
2194	l->l_name, (int) sizeof l->l_map_start * 2,
2195	(size_t) l->l_map_start);
2196	}
2197
2198	if (__glibc_unlikely (state.mode != rtld_mode_trace))
2199	for (i = 1; i < (unsigned int) _dl_argc; ++i)
2200	{
2201	const ElfW(Sym) *ref = NULL;
2202	ElfW(Addr) loadbase;
2203	lookup_t result;
2204
2205	result = _dl_lookup_symbol_x (undef: _dl_argv[i], undef_map: main_map,
2206	sym: &ref, symbol_scope: main_map->l_scope,
2207	NULL, ELF_RTYPE_CLASS_PLT,
2208	flags: DL_LOOKUP_ADD_DEPENDENCY, NULL);
2209
2210	loadbase = LOOKUP_VALUE_ADDRESS (result, false);
2211
2212	_dl_printf (fmt: "%s found at 0x%0*Zd in object at 0x%0*Zd\n",
2213	_dl_argv[i],
2214	(int) sizeof ref->st_value * 2,
2215	(size_t) ref->st_value,
2216	(int) sizeof loadbase * 2, (size_t) loadbase);
2217	}
2218	else
2219	{
2220	/* If LD_WARN is set, warn about undefined symbols. */
2221	if (GLRO(dl_lazy) >= 0 && GLRO(dl_verbose))
2222	{
2223	/* We have to do symbol dependency testing. */
2224	struct relocate_args args;
2225	unsigned int i;
2226
2227	args.reloc_mode = ((GLRO(dl_lazy) ? RTLD_LAZY : 0)
2228	| __RTLD_NOIFUNC);
2229
2230	i = main_map->l_searchlist.r_nlist;
2231	while (i-- > 0)
2232	{
2233	struct link_map *l = main_map->l_initfini[i];
2234	if (l != &GL(dl_rtld_map) && ! l->l_faked)
2235	{
2236	args.l = l;
2237	_dl_receive_error (fct: print_unresolved, operate: relocate_doit,
2238	args: &args);
2239	}
2240	}
2241
2242	if ((GLRO(dl_debug_mask) & DL_DEBUG_PRELINK)
2243	&& rtld_multiple_ref)
2244	{
2245	/* Mark the link map as not yet relocated again. */
2246	GL(dl_rtld_map).l_relocated = 0;
2247	_dl_relocate_object (map: &GL(dl_rtld_map),
2248	scope: main_map->l_scope, __RTLD_NOIFUNC, consider_profiling: 0);
2249	}
2250	}
2251	#define VERNEEDTAG (DT_NUM + DT_THISPROCNUM + DT_VERSIONTAGIDX (DT_VERNEED))
2252	if (state.version_info)
2253	{
2254	/* Print more information. This means here, print information
2255	about the versions needed. */
2256	int first = 1;
2257	struct link_map *map;
2258
2259	for (map = main_map; map != NULL; map = map->l_next)
2260	{
2261	const char *strtab;
2262	ElfW(Dyn) *dyn = map->l_info[VERNEEDTAG];
2263	ElfW(Verneed) *ent;
2264
2265	if (dyn == NULL)
2266	continue;
2267
2268	strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
2269	ent = (ElfW(Verneed) *) (map->l_addr + dyn->d_un.d_ptr);
2270
2271	if (first)
2272	{
2273	_dl_printf (fmt: "\n\tVersion information:\n");
2274	first = 0;
2275	}
2276
2277	_dl_printf (fmt: "\t%s:\n", DSO_FILENAME (map->l_name));
2278
2279	while (1)
2280	{
2281	ElfW(Vernaux) *aux;
2282	struct link_map *needed;
2283
2284	needed = find_needed (name: strtab + ent->vn_file);
2285	aux = (ElfW(Vernaux) *) ((char *) ent + ent->vn_aux);
2286
2287	while (1)
2288	{
2289	const char *fname = NULL;
2290
2291	if (needed != NULL
2292	&& match_version (string: strtab + aux->vna_name,
2293	map: needed))
2294	fname = needed->l_name;
2295
2296	_dl_printf (fmt: "\t\t%s (%s) %s=> %s\n",
2297	strtab + ent->vn_file,
2298	strtab + aux->vna_name,
2299	aux->vna_flags & VER_FLG_WEAK
2300	? "[WEAK] " : "",
2301	fname ?: "not found");
2302
2303	if (aux->vna_next == 0)
2304	/* No more symbols. */
2305	break;
2306
2307	/* Next symbol. */
2308	aux = (ElfW(Vernaux) *) ((char *) aux
2309	+ aux->vna_next);
2310	}
2311
2312	if (ent->vn_next == 0)
2313	/* No more dependencies. */
2314	break;
2315
2316	/* Next dependency. */
2317	ent = (ElfW(Verneed) *) ((char *) ent + ent->vn_next);
2318	}
2319	}
2320	}
2321	}
2322
2323	_exit (0);
2324	}
2325
2326	if (main_map->l_info[ADDRIDX (DT_GNU_LIBLIST)]
2327	&& ! __builtin_expect (GLRO(dl_profile) != NULL, 0)
2328	&& ! __builtin_expect (GLRO(dl_dynamic_weak), 0))
2329	{
2330	ElfW(Lib) *liblist, *liblistend;
2331	struct link_map **r_list, **r_listend, *l;
2332	const char *strtab = (const void *) D_PTR (main_map, l_info[DT_STRTAB]);
2333
2334	assert (main_map->l_info[VALIDX (DT_GNU_LIBLISTSZ)] != NULL);
2335	liblist = (ElfW(Lib) *)
2336	main_map->l_info[ADDRIDX (DT_GNU_LIBLIST)]->d_un.d_ptr;
2337	liblistend = (ElfW(Lib) *)
2338	((char *) liblist
2339	+ main_map->l_info[VALIDX (DT_GNU_LIBLISTSZ)]->d_un.d_val);
2340	r_list = main_map->l_searchlist.r_list;
2341	r_listend = r_list + main_map->l_searchlist.r_nlist;
2342
2343	for (; r_list < r_listend && liblist < liblistend; r_list++)
2344	{
2345	l = *r_list;
2346
2347	if (l == main_map)
2348	continue;
2349
2350	/* If the library is not mapped where it should, fail. */
2351	if (l->l_addr)
2352	break;
2353
2354	/* Next, check if checksum matches. */
2355	if (l->l_info [VALIDX(DT_CHECKSUM)] == NULL
2356	|| l->l_info [VALIDX(DT_CHECKSUM)]->d_un.d_val
2357	!= liblist->l_checksum)
2358	break;
2359
2360	if (l->l_info [VALIDX(DT_GNU_PRELINKED)] == NULL
2361	|| l->l_info [VALIDX(DT_GNU_PRELINKED)]->d_un.d_val
2362	!= liblist->l_time_stamp)
2363	break;
2364
2365	if (! _dl_name_match_p (name: strtab + liblist->l_name, map: l))
2366	break;
2367
2368	++liblist;
2369	}
2370
2371
2372	if (r_list == r_listend && liblist == liblistend)
2373	prelinked = true;
2374
2375	if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_LIBS))
2376	_dl_debug_printf (fmt: "\nprelink checking: %s\n",
2377	prelinked ? "ok" : "failed");
2378	}
2379
2380
2381	/* Now set up the variable which helps the assembler startup code. */
2382	GL(dl_ns)[LM_ID_BASE]._ns_main_searchlist = &main_map->l_searchlist;
2383
2384	/* Save the information about the original global scope list since
2385	we need it in the memory handling later. */
2386	GLRO(dl_initial_searchlist) = *GL(dl_ns)[LM_ID_BASE]._ns_main_searchlist;
2387
2388	/* Remember the last search directory added at startup, now that
2389	malloc will no longer be the one from dl-minimal.c. As a side
2390	effect, this marks ld.so as initialized, so that the rtld_active
2391	function returns true from now on. */
2392	GLRO(dl_init_all_dirs) = GL(dl_all_dirs);
2393
2394	/* Print scope information. */
2395	if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_SCOPES))
2396	{
2397	_dl_debug_printf (fmt: "\nInitial object scopes\n");
2398
2399	for (struct link_map *l = main_map; l != NULL; l = l->l_next)
2400	_dl_show_scope (new: l, from: 0);
2401	}
2402
2403	_rtld_main_check (m: main_map, program: _dl_argv[0]);
2404
2405	if (prelinked)
2406	{
2407	if (main_map->l_info [ADDRIDX (DT_GNU_CONFLICT)] != NULL)
2408	{
2409	ElfW(Rela) *conflict, *conflictend;
2410
2411	RTLD_TIMING_VAR (start);
2412	rtld_timer_start (var: &start);
2413
2414	assert (main_map->l_info [VALIDX (DT_GNU_CONFLICTSZ)] != NULL);
2415	conflict = (ElfW(Rela) *)
2416	main_map->l_info [ADDRIDX (DT_GNU_CONFLICT)]->d_un.d_ptr;
2417	conflictend = (ElfW(Rela) *)
2418	((char *) conflict
2419	+ main_map->l_info [VALIDX (DT_GNU_CONFLICTSZ)]->d_un.d_val);
2420	_dl_resolve_conflicts (l: main_map, conflict, conflictend);
2421
2422	rtld_timer_stop (var: &relocate_time, start);
2423	}
2424
2425	/* Set up the object lookup structures. */
2426	_dl_find_object_init ();
2427
2428	/* The library defining malloc has already been relocated due to
2429	prelinking. Resolve the malloc symbols for the dynamic
2430	loader. */
2431	__rtld_malloc_init_real (main_map);
2432
2433	/* Likewise for the locking implementation. */
2434	__rtld_mutex_init ();
2435
2436	/* Mark all the objects so we know they have been already relocated. */
2437	for (struct link_map *l = main_map; l != NULL; l = l->l_next)
2438	{
2439	l->l_relocated = 1;
2440	if (l->l_relro_size)
2441	_dl_protect_relro (map: l);
2442
2443	/* Add object to slot information data if necessasy. */
2444	if (l->l_tls_blocksize != 0 && tls_init_tp_called)
2445	_dl_add_to_slotinfo (l, true);
2446	}
2447	}
2448	else
2449	{
2450	/* Now we have all the objects loaded. Relocate them all except for
2451	the dynamic linker itself. We do this in reverse order so that copy
2452	relocs of earlier objects overwrite the data written by later
2453	objects. We do not re-relocate the dynamic linker itself in this
2454	loop because that could result in the GOT entries for functions we
2455	call being changed, and that would break us. It is safe to relocate
2456	the dynamic linker out of order because it has no copy relocs (we
2457	know that because it is self-contained). */
2458
2459	int consider_profiling = GLRO(dl_profile) != NULL;
2460
2461	/* If we are profiling we also must do lazy reloaction. */
2462	GLRO(dl_lazy) |= consider_profiling;
2463
2464	RTLD_TIMING_VAR (start);
2465	rtld_timer_start (var: &start);
2466	unsigned i = main_map->l_searchlist.r_nlist;
2467	while (i-- > 0)
2468	{
2469	struct link_map *l = main_map->l_initfini[i];
2470
2471	/* While we are at it, help the memory handling a bit. We have to
2472	mark some data structures as allocated with the fake malloc()
2473	implementation in ld.so. */
2474	struct libname_list *lnp = l->l_libname->next;
2475
2476	while (__builtin_expect (lnp != NULL, 0))
2477	{
2478	lnp->dont_free = 1;
2479	lnp = lnp->next;
2480	}
2481	/* Also allocated with the fake malloc(). */
2482	l->l_free_initfini = 0;
2483
2484	if (l != &GL(dl_rtld_map))
2485	_dl_relocate_object (map: l, scope: l->l_scope, GLRO(dl_lazy) ? RTLD_LAZY : 0,
2486	consider_profiling);
2487
2488	/* Add object to slot information data if necessasy. */
2489	if (l->l_tls_blocksize != 0 && tls_init_tp_called)
2490	_dl_add_to_slotinfo (l, true);
2491	}
2492	rtld_timer_stop (var: &relocate_time, start);
2493
2494	/* Now enable profiling if needed. Like the previous call,
2495	this has to go here because the calls it makes should use the
2496	rtld versions of the functions (particularly calloc()), but it
2497	needs to have _dl_profile_map set up by the relocator. */
2498	if (__glibc_unlikely (GL(dl_profile_map) != NULL))
2499	/* We must prepare the profiling. */
2500	_dl_start_profile ();
2501	}
2502
2503	if ((!was_tls_init_tp_called && GL(dl_tls_max_dtv_idx) > 0)
2504	|| count_modids != _dl_count_modids ())
2505	++GL(dl_tls_generation);
2506
2507	/* Now that we have completed relocation, the initializer data
2508	for the TLS blocks has its final values and we can copy them
2509	into the main thread's TLS area, which we allocated above.
2510	Note: thread-local variables must only be accessed after completing
2511	the next step. */
2512	_dl_allocate_tls_init (tcbp, false);
2513
2514	/* And finally install it for the main thread. */
2515	if (! tls_init_tp_called)
2516	{
2517	const char *lossage = TLS_INIT_TP (tcbp);
2518	if (__glibc_unlikely (lossage != NULL))
2519	_dl_fatal_printf ("cannot set up thread-local storage: %s\n",
2520	lossage);
2521	__tls_init_tp ();
2522	}
2523
2524	/* Make sure no new search directories have been added. */
2525	assert (GLRO(dl_init_all_dirs) == GL(dl_all_dirs));
2526
2527	if (! prelinked && rtld_multiple_ref)
2528	{
2529	/* There was an explicit ref to the dynamic linker as a shared lib.
2530	Re-relocate ourselves with user-controlled symbol definitions.
2531
2532	We must do this after TLS initialization in case after this
2533	re-relocation, we might call a user-supplied function
2534	(e.g. calloc from _dl_relocate_object) that uses TLS data. */
2535
2536	/* Set up the object lookup structures. */
2537	_dl_find_object_init ();
2538
2539	/* The malloc implementation has been relocated, so resolving
2540	its symbols (and potentially calling IFUNC resolvers) is safe
2541	at this point. */
2542	__rtld_malloc_init_real (main_map);
2543
2544	/* Likewise for the locking implementation. */
2545	__rtld_mutex_init ();
2546
2547	RTLD_TIMING_VAR (start);
2548	rtld_timer_start (var: &start);
2549
2550	/* Mark the link map as not yet relocated again. */
2551	GL(dl_rtld_map).l_relocated = 0;
2552	_dl_relocate_object (map: &GL(dl_rtld_map), scope: main_map->l_scope, reloc_mode: 0, consider_profiling: 0);
2553
2554	rtld_timer_accum (sum: &relocate_time, start);
2555	}
2556
2557	/* Relocation is complete. Perform early libc initialization. This
2558	is the initial libc, even if audit modules have been loaded with
2559	other libcs. */
2560	_dl_call_libc_early_init (GL(dl_ns)[LM_ID_BASE].libc_map, true);
2561
2562	/* Do any necessary cleanups for the startup OS interface code.
2563	We do these now so that no calls are made after rtld re-relocation
2564	which might be resolved to different functions than we expect.
2565	We cannot do this before relocating the other objects because
2566	_dl_relocate_object might need to call `mprotect' for DT_TEXTREL. */
2567	_dl_sysdep_start_cleanup ();
2568
2569	#ifdef SHARED
2570	/* Auditing checkpoint: we have added all objects. */
2571	_dl_audit_activity_nsid (LM_ID_BASE, action: LA_ACT_CONSISTENT);
2572	#endif
2573
2574	/* Notify the debugger all new objects are now ready to go. We must re-get
2575	the address since by now the variable might be in another object. */
2576	r = _dl_debug_update (LM_ID_BASE);
2577	r->r_state = RT_CONSISTENT;
2578	_dl_debug_state ();
2579	LIBC_PROBE (init_complete, 2, LM_ID_BASE, r);
2580
2581	#if defined USE_LDCONFIG && !defined MAP_COPY
2582	/* We must munmap() the cache file. */
2583	_dl_unload_cache ();
2584	#endif
2585
2586	/* Once we return, _dl_sysdep_start will invoke
2587	the DT_INIT functions and then *USER_ENTRY. */
2588	}
2589
2590	/* This is a little helper function for resolving symbols while
2591	tracing the binary. */
2592	static void
2593	print_unresolved (int errcode __attribute__ ((unused)), const char *objname,
2594	const char *errstring)
2595	{
2596	if (objname[0] == '\0')
2597	objname = RTLD_PROGNAME;
2598	_dl_error_printf (fmt: "%s (%s)\n", errstring, objname);
2599	}
2600
2601	/* This is a little helper function for resolving symbols while
2602	tracing the binary. */
2603	static void
2604	print_missing_version (int errcode __attribute__ ((unused)),
2605	const char *objname, const char *errstring)
2606	{
2607	_dl_error_printf (fmt: "%s: %s: %s\n", RTLD_PROGNAME,
2608	objname, errstring);
2609	}
2610
2611	/* Process the string given as the parameter which explains which debugging
2612	options are enabled. */
2613	static void
2614	process_dl_debug (struct dl_main_state *state, const char *dl_debug)
2615	{
2616	/* When adding new entries make sure that the maximal length of a name
2617	is correctly handled in the LD_DEBUG_HELP code below. */
2618	static const struct
2619	{
2620	unsigned char len;
2621	const char name[10];
2622	const char helptext[41];
2623	unsigned short int mask;
2624	} debopts[] =
2625	{
2626	#define LEN_AND_STR(str) sizeof (str) - 1, str
2627	{ LEN_AND_STR ("libs"), "display library search paths",
2628	DL_DEBUG_LIBS | DL_DEBUG_IMPCALLS },
2629	{ LEN_AND_STR ("reloc"), "display relocation processing",
2630	DL_DEBUG_RELOC | DL_DEBUG_IMPCALLS },
2631	{ LEN_AND_STR ("files"), "display progress for input file",
2632	DL_DEBUG_FILES | DL_DEBUG_IMPCALLS },
2633	{ LEN_AND_STR ("symbols"), "display symbol table processing",
2634	DL_DEBUG_SYMBOLS | DL_DEBUG_IMPCALLS },
2635	{ LEN_AND_STR ("bindings"), "display information about symbol binding",
2636	DL_DEBUG_BINDINGS | DL_DEBUG_IMPCALLS },
2637	{ LEN_AND_STR ("versions"), "display version dependencies",
2638	DL_DEBUG_VERSIONS | DL_DEBUG_IMPCALLS },
2639	{ LEN_AND_STR ("scopes"), "display scope information",
2640	DL_DEBUG_SCOPES },
2641	{ LEN_AND_STR ("all"), "all previous options combined",
2642	DL_DEBUG_LIBS | DL_DEBUG_RELOC | DL_DEBUG_FILES | DL_DEBUG_SYMBOLS
2643	| DL_DEBUG_BINDINGS | DL_DEBUG_VERSIONS | DL_DEBUG_IMPCALLS
2644	| DL_DEBUG_SCOPES },
2645	{ LEN_AND_STR ("statistics"), "display relocation statistics",
2646	DL_DEBUG_STATISTICS },
2647	{ LEN_AND_STR ("unused"), "determined unused DSOs",
2648	DL_DEBUG_UNUSED },
2649	{ LEN_AND_STR ("help"), "display this help message and exit",
2650	DL_DEBUG_HELP },
2651	};
2652	#define ndebopts (sizeof (debopts) / sizeof (debopts[0]))
2653
2654	/* Skip separating white spaces and commas. */
2655	while (*dl_debug != '\0')
2656	{
2657	if (*dl_debug != ' ' && *dl_debug != ',' && *dl_debug != ':')
2658	{
2659	size_t cnt;
2660	size_t len = 1;
2661
2662	while (dl_debug[len] != '\0' && dl_debug[len] != ' '
2663	&& dl_debug[len] != ',' && dl_debug[len] != ':')
2664	++len;
2665
2666	for (cnt = 0; cnt < ndebopts; ++cnt)
2667	if (debopts[cnt].len == len
2668	&& memcmp (dl_debug, debopts[cnt].name, len) == 0)
2669	{
2670	GLRO(dl_debug_mask) |= debopts[cnt].mask;
2671	state->any_debug = true;
2672	break;
2673	}
2674
2675	if (cnt == ndebopts)
2676	{
2677	/* Display a warning and skip everything until next
2678	separator. */
2679	char *copy = strndupa (dl_debug, len);
2680	_dl_error_printf (fmt: "\
2681	warning: debug option `%s' unknown; try LD_DEBUG=help\n", copy);
2682	}
2683
2684	dl_debug += len;
2685	continue;
2686	}
2687
2688	++dl_debug;
2689	}
2690
2691	if (GLRO(dl_debug_mask) & DL_DEBUG_UNUSED)
2692	{
2693	/* In order to get an accurate picture of whether a particular
2694	DT_NEEDED entry is actually used we have to process both
2695	the PLT and non-PLT relocation entries. */
2696	GLRO(dl_lazy) = 0;
2697	}
2698
2699	if (GLRO(dl_debug_mask) & DL_DEBUG_HELP)
2700	{
2701	size_t cnt;
2702
2703	_dl_printf (fmt: "\
2704	Valid options for the LD_DEBUG environment variable are:\n\n");
2705
2706	for (cnt = 0; cnt < ndebopts; ++cnt)
2707	_dl_printf (fmt: " %.*s%s%s\n", debopts[cnt].len, debopts[cnt].name,
2708	" " + debopts[cnt].len - 3,
2709	debopts[cnt].helptext);
2710
2711	_dl_printf (fmt: "\n\
2712	To direct the debugging output into a file instead of standard output\n\
2713	a filename can be specified using the LD_DEBUG_OUTPUT environment variable.\n");
2714	_exit (0);
2715	}
2716	}
2717
2718	static void
2719	process_envvars (struct dl_main_state *state)
2720	{
2721	char **runp = _environ;
2722	char *envline;
2723	char *debug_output = NULL;
2724
2725	/* This is the default place for profiling data file. */
2726	GLRO(dl_profile_output)
2727	= &"/var/tmp\0/var/profile"[__libc_enable_secure ? 9 : 0];
2728
2729	while ((envline = _dl_next_ld_env_entry (position: &runp)) != NULL)
2730	{
2731	size_t len = 0;
2732
2733	while (envline[len] != '\0' && envline[len] != '=')
2734	++len;
2735
2736	if (envline[len] != '=')
2737	/* This is a "LD_" variable at the end of the string without
2738	a '=' character. Ignore it since otherwise we will access
2739	invalid memory below. */
2740	continue;
2741
2742	switch (len)
2743	{
2744	case 4:
2745	/* Warning level, verbose or not. */
2746	if (memcmp (envline, "WARN", 4) == 0)
2747	GLRO(dl_verbose) = envline[5] != '\0';
2748	break;
2749
2750	case 5:
2751	/* Debugging of the dynamic linker? */
2752	if (memcmp (envline, "DEBUG", 5) == 0)
2753	{
2754	process_dl_debug (state, dl_debug: &envline[6]);
2755	break;
2756	}
2757	if (memcmp (envline, "AUDIT", 5) == 0)
2758	audit_list_add_string (list: &state->audit_list, string: &envline[6]);
2759	break;
2760
2761	case 7:
2762	/* Print information about versions. */
2763	if (memcmp (envline, "VERBOSE", 7) == 0)
2764	{
2765	state->version_info = envline[8] != '\0';
2766	break;
2767	}
2768
2769	/* List of objects to be preloaded. */
2770	if (memcmp (envline, "PRELOAD", 7) == 0)
2771	{
2772	state->preloadlist = &envline[8];
2773	break;
2774	}
2775
2776	/* Which shared object shall be profiled. */
2777	if (memcmp (envline, "PROFILE", 7) == 0 && envline[8] != '\0')
2778	GLRO(dl_profile) = &envline[8];
2779	break;
2780
2781	case 8:
2782	/* Do we bind early? */
2783	if (memcmp (envline, "BIND_NOW", 8) == 0)
2784	{
2785	GLRO(dl_lazy) = envline[9] == '\0';
2786	break;
2787	}
2788	if (memcmp (envline, "BIND_NOT", 8) == 0)
2789	GLRO(dl_bind_not) = envline[9] != '\0';
2790	break;
2791
2792	case 9:
2793	/* Test whether we want to see the content of the auxiliary
2794	array passed up from the kernel. */
2795	if (!__libc_enable_secure
2796	&& memcmp (envline, "SHOW_AUXV", 9) == 0)
2797	_dl_show_auxv ();
2798	break;
2799
2800	#if !HAVE_TUNABLES
2801	case 10:
2802	/* Mask for the important hardware capabilities. */
2803	if (!__libc_enable_secure
2804	&& memcmp (envline, "HWCAP_MASK", 10) == 0)
2805	GLRO(dl_hwcap_mask) = _dl_strtoul (&envline[11], NULL);
2806	break;
2807	#endif
2808
2809	case 11:
2810	/* Path where the binary is found. */
2811	if (!__libc_enable_secure
2812	&& memcmp (envline, "ORIGIN_PATH", 11) == 0)
2813	GLRO(dl_origin_path) = &envline[12];
2814	break;
2815
2816	case 12:
2817	/* The library search path. */
2818	if (!__libc_enable_secure
2819	&& memcmp (envline, "LIBRARY_PATH", 12) == 0)
2820	{
2821	state->library_path = &envline[13];
2822	state->library_path_source = "LD_LIBRARY_PATH";
2823	break;
2824	}
2825
2826	/* Where to place the profiling data file. */
2827	if (memcmp (envline, "DEBUG_OUTPUT", 12) == 0)
2828	{
2829	debug_output = &envline[13];
2830	break;
2831	}
2832
2833	if (!__libc_enable_secure
2834	&& memcmp (envline, "DYNAMIC_WEAK", 12) == 0)
2835	GLRO(dl_dynamic_weak) = 1;
2836	break;
2837
2838	case 13:
2839	/* We might have some extra environment variable with length 13
2840	to handle. */
2841	#ifdef EXTRA_LD_ENVVARS_13
2842	EXTRA_LD_ENVVARS_13
2843	#endif
2844	if (!__libc_enable_secure
2845	&& memcmp (envline, "USE_LOAD_BIAS", 13) == 0)
2846	{
2847	GLRO(dl_use_load_bias) = envline[14] == '1' ? -1 : 0;
2848	break;
2849	}
2850	break;
2851
2852	case 14:
2853	/* Where to place the profiling data file. */
2854	if (!__libc_enable_secure
2855	&& memcmp (envline, "PROFILE_OUTPUT", 14) == 0
2856	&& envline[15] != '\0')
2857	GLRO(dl_profile_output) = &envline[15];
2858	break;
2859
2860	case 16:
2861	/* The mode of the dynamic linker can be set. */
2862	if (memcmp (envline, "TRACE_PRELINKING", 16) == 0)
2863	{
2864	state->mode = rtld_mode_trace;
2865	GLRO(dl_verbose) = 1;
2866	GLRO(dl_debug_mask) |= DL_DEBUG_PRELINK;
2867	GLRO(dl_trace_prelink) = &envline[17];
2868	}
2869	break;
2870
2871	case 20:
2872	/* The mode of the dynamic linker can be set. */
2873	if (memcmp (envline, "TRACE_LOADED_OBJECTS", 20) == 0)
2874	state->mode = rtld_mode_trace;
2875	break;
2876
2877	/* We might have some extra environment variable to handle. This
2878	is tricky due to the pre-processing of the length of the name
2879	in the switch statement here. The code here assumes that added
2880	environment variables have a different length. */
2881	#ifdef EXTRA_LD_ENVVARS
2882	EXTRA_LD_ENVVARS
2883	#endif
2884	}
2885	}
2886
2887	/* Extra security for SUID binaries. Remove all dangerous environment
2888	variables. */
2889	if (__builtin_expect (__libc_enable_secure, 0))
2890	{
2891	static const char unsecure_envvars[] =
2892	#ifdef EXTRA_UNSECURE_ENVVARS
2893	EXTRA_UNSECURE_ENVVARS
2894	#endif
2895	UNSECURE_ENVVARS;
2896	const char *nextp;
2897
2898	nextp = unsecure_envvars;
2899	do
2900	{
2901	unsetenv (nextp);
2902	/* We could use rawmemchr but this need not be fast. */
2903	nextp = (char *) (strchr) (nextp, '\0') + 1;
2904	}
2905	while (*nextp != '\0');
2906
2907	if (__access ("/etc/suid-debug", F_OK) != 0)
2908	{
2909	#if !HAVE_TUNABLES
2910	unsetenv ("MALLOC_CHECK_");
2911	#endif
2912	GLRO(dl_debug_mask) = 0;
2913	}
2914
2915	if (state->mode != rtld_mode_normal)
2916	_exit (5);
2917	}
2918	/* If we have to run the dynamic linker in debugging mode and the
2919	LD_DEBUG_OUTPUT environment variable is given, we write the debug
2920	messages to this file. */
2921	else if (state->any_debug && debug_output != NULL)
2922	{
2923	const int flags = O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW;
2924	size_t name_len = strlen (debug_output);
2925	char buf[name_len + 12];
2926	char *startp;
2927
2928	buf[name_len + 11] = '\0';
2929	startp = _itoa (__getpid (), &buf[name_len + 11], 10, 0);
2930	*--startp = '.';
2931	startp = memcpy (startp - name_len, debug_output, name_len);
2932
2933	GLRO(dl_debug_fd) = __open64_nocancel (startp, flags, DEFFILEMODE);
2934	if (GLRO(dl_debug_fd) == -1)
2935	/* We use standard output if opening the file failed. */
2936	GLRO(dl_debug_fd) = STDOUT_FILENO;
2937	}
2938	}
2939
2940	#if HP_TIMING_INLINE
2941	static void
2942	print_statistics_item (const char *title, hp_timing_t time,
2943	hp_timing_t total)
2944	{
2945	char cycles[HP_TIMING_PRINT_SIZE];
2946	HP_TIMING_PRINT (cycles, sizeof (cycles), time);
2947
2948	char relative[3 * sizeof (hp_timing_t) + 2];
2949	char *cp = _itoa ((1000ULL * time) / total, relative + sizeof (relative),
2950	10, 0);
2951	/* Sets the decimal point. */
2952	char *wp = relative;
2953	switch (relative + sizeof (relative) - cp)
2954	{
2955	case 3:
2956	*wp++ = *cp++;
2957	/* Fall through. */
2958	case 2:
2959	*wp++ = *cp++;
2960	/* Fall through. */
2961	case 1:
2962	*wp++ = '.';
2963	*wp++ = *cp++;
2964	}
2965	*wp = '\0';
2966	_dl_debug_printf (fmt: "%s: %s cycles (%s%%)\n", title, cycles, relative);
2967	}
2968	#endif
2969
2970	/* Print the various times we collected. */
2971	static void
2972	__attribute ((noinline))
2973	print_statistics (const hp_timing_t *rtld_total_timep)
2974	{
2975	#if HP_TIMING_INLINE
2976	{
2977	char cycles[HP_TIMING_PRINT_SIZE];
2978	HP_TIMING_PRINT (cycles, sizeof (cycles), *rtld_total_timep);
2979	_dl_debug_printf (fmt: "\nruntime linker statistics:\n"
2980	" total startup time in dynamic loader: %s cycles\n",
2981	cycles);
2982	print_statistics_item (title: " time needed for relocation",
2983	time: relocate_time, total: *rtld_total_timep);
2984	}
2985	#endif
2986
2987	unsigned long int num_relative_relocations = 0;
2988	for (Lmid_t ns = 0; ns < GL(dl_nns); ++ns)
2989	{
2990	if (GL(dl_ns)[ns]._ns_loaded == NULL)
2991	continue;
2992
2993	struct r_scope_elem *scope = &GL(dl_ns)[ns]._ns_loaded->l_searchlist;
2994
2995	for (unsigned int i = 0; i < scope->r_nlist; i++)
2996	{
2997	struct link_map *l = scope->r_list [i];
2998
2999	if (l->l_addr != 0 && l->l_info[VERSYMIDX (DT_RELCOUNT)])
3000	num_relative_relocations
3001	+= l->l_info[VERSYMIDX (DT_RELCOUNT)]->d_un.d_val;
3002	#ifndef ELF_MACHINE_REL_RELATIVE
3003	/* Relative relocations are processed on these architectures if
3004	library is loaded to different address than p_vaddr or
3005	if not prelinked. */
3006	if ((l->l_addr != 0 || !l->l_info[VALIDX(DT_GNU_PRELINKED)])
3007	&& l->l_info[VERSYMIDX (DT_RELACOUNT)])
3008	#else
3009	/* On e.g. IA-64 or Alpha, relative relocations are processed
3010	only if library is loaded to different address than p_vaddr. */
3011	if (l->l_addr != 0 && l->l_info[VERSYMIDX (DT_RELACOUNT)])
3012	#endif
3013	num_relative_relocations
3014	+= l->l_info[VERSYMIDX (DT_RELACOUNT)]->d_un.d_val;
3015	}
3016	}
3017
3018	_dl_debug_printf (fmt: " number of relocations: %lu\n"
3019	" number of relocations from cache: %lu\n"
3020	" number of relative relocations: %lu\n",
3021	GL(dl_num_relocations),
3022	GL(dl_num_cache_relocations),
3023	num_relative_relocations);
3024
3025	#if HP_TIMING_INLINE
3026	print_statistics_item (title: " time needed to load objects",
3027	time: load_time, total: *rtld_total_timep);
3028	#endif
3029	}
3030