liba.c

// exported globals
int lib_global = 1;
int *a_ptr;
typedef void ( *func_ptr_type) ();
func_ptr_type a_fptr;

void stub () {
        return;
}

void liba_init () {
        a_ptr = &lib_global;
        a_fptr = stub;
        lib_global = 3;
}

libb.c

volatile int lib_flag = 1;
int *b_ptr;
typedef void ( *func_ptr_type) ();
func_ptr_type b_fptr;

static void libb_init () {
        b_ptr = &lib_global;
        b_fptr = stub;
} 

void libb_test () {
        libb_init();

        if (a_fptr == b_fptr)
                lib_flag = 2;
        if (a_ptr == b_ptr)
                lib_flag = 3;
}

mian.c

#include <stdio.h>

typedef void ( *func_ptr_type) ();
int *main_ptr;
func_ptr_type main_fptr;

int main () {
        main_ptr = &lib_global;
        main_fptr = stub;

        stub();
        // liba
        liba_init();
        // libb
        libb_test();

        if (main_ptr == b_ptr)
                lib_flag = 4;
        if (main_fptr == b_fptr)
                lib_flag = 5;

        puts("hello\n");
}

        main_ptr = &lib_global;
        // 对应的汇编代码
        movl   $0x804a034,0x804a03c
 
        main_fptr = stub;
        // 对应的汇编代码
        movl   $0x8048520,0x804a040
        
        stub();
        //
        call   0x8048520 <stub@plt>

        liba_init();
        //
        call   0x8048510 <liba_init@plt> 
        
        libb_test();
        //
        call   0x8048540 <libb_test@plt>
        
        if (main_ptr == b_ptr)
        //
        mov    0x804a03c,%edx
        mov    0x804a028,%eax
        cmp    %eax,%edx
        jne    80486b2 <main+0x45>
 
                lib_flag = 4;
                //
                movl   $0x4,0x804a02c

        if (main_fptr == b_fptr)
        //
        mov    0x804a040,%edx
        mov    0x804a030,%eax
        cmp    %eax,%edx
        jne    80486cb <main+0x5e>

                lib_flag = 5;
                //
                movl   $0x5,0x804a02c

Section Headers:
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            00000000 000000 000000 00      0   0  0
  [...]
  [ 9] .rel.dyn          REL             08048484 000484 000028 08   A  5   0  4
  [10] .rel.plt          REL             080484ac 0004ac 000028 08  AI  5  24  4
  [12] .plt              PROGBITS        08048500 000500 000060 04  AX  0   0 16
  [13] .plt.got          PROGBITS        08048560 000560 000008 00  AX  0   0  8
  [14] .text             PROGBITS        08048570 000570 0001e2 00  AX  0   0 16
  [22] .dynamic          DYNAMIC         08049f04 000f04 0000f8 08  WA  6   0  4
  [23] .got              PROGBITS        08049ffc 000ffc 000004 04  WA  0   0  4
  [24] .got.plt          PROGBITS        0804a000 001000 000020 04  WA  0   0  4
  [25] .data             PROGBITS        0804a020 001020 000008 00  WA  0   0  4
  [26] .bss              NOBITS          0804a028 001028 00001c 00  WA  0   0  4
  [...]

glibc-2.23/sysdeps/i386/dl_machine.h

/* Set up the loaded object described by L so its unrelocated PLT
   entries will jump to the on-demand fixup code in dl-runtime.c.  */

static inline int __attribute__ ((unused, always_inline))
elf_machine_runtime_setup (struct link_map *l, int lazy, int profile)
{
  Elf32_Addr *got;
  extern void _dl_runtime_resolve (Elf32_Word) attribute_hidden;
  extern void _dl_runtime_profile (Elf32_Word) attribute_hidden;

  if (l->l_info[DT_JMPREL] && lazy)
    {
      /* The GOT entries for functions in the PLT have not yet been filled
	 in.  Their initial contents will arrange when called to push an
	 offset into the .rel.plt section, push _GLOBAL_OFFSET_TABLE_[1],
	 and then jump to _GLOBAL_OFFSET_TABLE[2].  */
      got = (Elf32_Addr *) D_PTR (l, l_info[DT_PLTGOT]);
      /* If a library is prelinked but we have to relocate anyway,
	 we have to be able to undo the prelinking of .got.plt.
	 The prelinker saved us here address of .plt + 0x16.  */
      if (got[1])
	{
	  l->l_mach.plt = got[1] + l->l_addr;
	  l->l_mach.gotplt = (Elf32_Addr) &got[3];
	}
      //
      // **_GLOBAL_OFFSET_TABLE_[1]的初始化**
      //
      got[1] = (Elf32_Addr) l;	/* Identify this shared object.  */

      /* The got[2] entry contains the address of a function which gets
	 called to get the address of a so far unresolved function and
	 jump to it.  The profiling extension of the dynamic linker allows
	 to intercept the calls to collect information.  In this case we
	 don't store the address in the GOT so that all future calls also
	 end in this function.  */
      if (__glibc_unlikely (profile))
	{
	  got[2] = (Elf32_Addr) &_dl_runtime_profile;

	  if (GLRO(dl_profile) != NULL
	      && _dl_name_match_p (GLRO(dl_profile), l))
	    /* This is the object we are looking for.  Say that we really
	       want profiling and the timers are started.  */
	    GL(dl_profile_map) = l;
	}
      else
	/* This function will get called to fix up the GOT entry indicated by
	   the offset on the stack, and then jump to the resolved address.  */
     
        //
        // **_GLOBAL_OFFSET_TABLE_[2]的初始化**
        //
	got[2] = (Elf32_Addr) &_dl_runtime_resolve;
    }

  return lazy;
}

glibc-2.23/sysdeps/i386/dl-trampoline.S

	.text
	.globl _dl_runtime_resolve
	.type _dl_runtime_resolve, @function
	cfi_startproc
	.align 16
_dl_runtime_resolve:
	cfi_adjust_cfa_offset (8)
	pushl %eax		# Preserve registers otherwise clobbered.
	cfi_adjust_cfa_offset (4)
	pushl %ecx
	cfi_adjust_cfa_offset (4)
	pushl %edx
	cfi_adjust_cfa_offset (4)
	movl 16(%esp), %edx	# Copy args pushed by PLT in register.  Note
	movl 12(%esp), %eax	# that fixup takes its parameters in regs.
	call _dl_fixup		# Call resolver.
	popl %edx		# Get register content back.
	cfi_adjust_cfa_offset (-4)
	movl (%esp), %ecx
	movl %eax, (%esp)	# Store the function address.
	movl 4(%esp), %eax
	ret $12			# Jump to function address.
	cfi_endproc
	.size _dl_runtime_resolve, .-_dl_runtime_resolve

glibc-src/sysdeps/i386/dl-machine.h

.globl _start\n\
.globl _dl_start_user\n\
_start:\n\
	# Note that _dl_start gets the parameter in %eax.\n\
	movl %esp, %eax\n\
	call _dl_start\n\

  if (bootstrap_map.l_addr || ! bootstrap_map.l_info[VALIDX(DT_GNU_PRELINKED)])
    {
      /* Relocate ourselves so we can do normal function calls and
	 data access using the global offset table.  */
      //
      // 解决dl的重定位
      //
      ELF_DYNAMIC_RELOCATE (&bootstrap_map, 0, 0, 0);
    }
  bootstrap_map.l_relocated = 1;

  start_addr = _dl_sysdep_start (arg, &dl_main);

glibc-src/elf/rtld.c

      /* Process the environment variable which control the behaviour.  */
      //
      // 这个函数处理各种影响到executable的环境变量
      //
      process_envvars (&mode);

      /* Create a link_map for the executable itself.
	 This will be what dlopen on "" returns.  */

      //
      // 创建main executable的struct link_map
      //
      main_map = _dl_new_object ((char *) "", "", lt_executable, NULL,
				 __RTLD_OPENEXEC, LM_ID_BASE);
      assert (main_map != NULL);
      main_map->l_phdr = phdr;
      main_map->l_phnum = phnum;
      main_map->l_entry = *user_entry;

          /* List of objects to be preloaded.  */
	  if (memcmp (envline, "PRELOAD", 7) == 0)
	    {
              //
              // 记录LD_PTRLOAD信息
              //
	      preloadlist = &envline[8];
	      break;
	    }

  /* We have two ways to specify objects to preload: via environment
     variable and via the file /etc/ld.so.preload.  The latter can also
     be used when security is enabled.  */
  assert ( *first_preload == NULL);
  //
  // 保存preload library的link_map的指针数组
  //
  struct link_map **preloads = NULL;
  unsigned int npreloads = 0;

  if (__builtin_expect (preloadlist != NULL, 0))
    {
      /* The LD_PRELOAD environment variable gives list of libraries
	 separated by white space or colons that are loaded before the
	 executable's dependencies and prepended to the global scope
	 list.  If the binary is running setuid all elements
	 containing a '/' are ignored since it is insecure.  */
      char *list = strdupa (preloadlist);
      char *p;

      HP_TIMING_NOW (start);

      /* Prevent optimizing strsep.  Speed is not important here.  */
      while ((p = (strsep) (&list, " :")) != NULL)
	if (p[0] != '\0'
	    && (__builtin_expect (! INTUSE(__libc_enable_secure), 1)
		|| strchr (p, '/') == NULL))
          //
          // do_preload()会打开每一个preload library然后构建对应的link_map结构
          // 然后保存在上面的link_map **preloads里
          //
	  npreloads += do_preload (p, main_map, "LD_PRELOAD");

      HP_TIMING_NOW (stop);
      HP_TIMING_DIFF (diff, start, stop);
      HP_TIMING_ACCUM_NT (load_time, diff);
    }

  /* There usually is no ld.so.preload file, it should only be used
     for emergencies and testing.  So the open call etc should usually
     fail.  Using access() on a non-existing file is faster than using
     open().  So we do this first.  If it succeeds we do almost twice
     the work but this does not matter, since it is not for production
     use.  */
  //
  // 正如注释所写的,一般时候并没有*/etc/ld.so.preload*文件,就算是有也不会影响本
  // 文主题的描述.所以略过处理代码.
  //
  static const char preload_file[] = "/etc/ld.so.preload";
  if (__builtin_expect (__access (preload_file, R_OK) == 0, 0))
    {
      ...
    }

  //
  // ...
  //

  /* Load all the libraries specified by DT_NEEDED entries.  If LD_PRELOAD
     specified some libraries to load, these are inserted before the actual
     dependencies in the executable's searchlist for symbol resolution.  */
  HP_TIMING_NOW (start);
  //
  // 这个函数构建symbol搜索集合的也就是本文描述内容的核心部分.
  //
  _dl_map_object_deps (main_map, preloads, npreloads, mode == trace, 0);

glibc-src/elf/dl-deps.c/_dl_map_object_deps()

link_map **main_map->l_searchlist.r_list
        |
        |
        |
        | main_map             npreloads                  nneededs
        |      |                  |                          |
        |      |      +-------------------+      +-----------------------+
        |      |      |                   |      |                       |
        |     +--+   +--+   +--+         +--+   +--+   +--+            +--+
        +---->|  |-->|  |-->|  |-------->|  |-->|  |-->|  |----------->|  |
        +---->|  |<--|  |<--|  |<--------|  |<--|  |<--|  |<-----------|  |
        |     +--+   +--+   +--+         +--+   +--+   +-++            +--+
        |              |      |            |      |      |               |
        |              |      |            |      |      |               |
        |              |      |            |      |      |               |
        |         preload_1   |            |   needed_1  |               |
        |                  preload_2       |           needed_2          |
        |                              preload_n                    needed_n
        |
        |
preloads/neededs->l_scope[0]->r_list

      unsigned i = main_map->l_searchlist.r_nlist;
      while (i-- > 0)
	{
          //
          // 在一般情况下l_initfinit的和l_searchlist.r_list是一样的.也就是遍历的
          // 依旧是上面的那个查找顺序表.
          //
	  struct link_map *l = main_map->l_initfini[i];

	  /* While we are at it, help the memory handling a bit.  We have to
	     mark some data structures as allocated with the fake malloc()
	     implementation in ld.so.  */
	  struct libname_list *lnp = l->l_libname->next;

	  while (__builtin_expect (lnp != NULL, 0))
	    {
	      lnp->dont_free = 1;
	      lnp = lnp->next;
	    }
	  /* Also allocated with the fake malloc().  */
	  l->l_free_initfini = 0;

          //
          // dl_rtld_map就是dynamic-linker本身的link_map指针,在本文的情况下l应该
          // 是指向executable.
          //
	  if (l != &GL(dl_rtld_map))i
            //
            // 调用解决重定位的函数
            //
	    _dl_relocate_object (l, l->l_scope, GLRO(dl_lazy) ? RTLD_LAZY : 0,
				 consider_profiling);

	  /* Add object to slot information data if necessasy.  */
	  if (l->l_tls_blocksize != 0 && tls_init_tp_called)
	    _dl_add_to_slotinfo (l);
	}
 

glibc-src/elf/dl-reloc.c/_dl_relocate_object()

  //
  // 略去跟本文无关系的部分代码
  //

    /* This macro is used as a callback from the ELF_DYNAMIC_RELOCATE code.  */
    //
    // 这个macro是一个回调的macro,并不在本函数调用
    //
#define RESOLVE_MAP(ref, version, r_type) \
    (ELFW(ST_BIND) ((*ref)->st_info) != STB_LOCAL			      \
     ? ((__builtin_expect ((*ref) == l->l_lookup_cache.sym, 0)		      \
	 && elf_machine_type_class (r_type) == l->l_lookup_cache.type_class)  \
	? (bump_num_cache_relocations (),				      \
	   (*ref) = l->l_lookup_cache.ret,				      \
	   l->l_lookup_cache.value)					      \
	: ({ lookup_t _lr;						      \
	     int _tc = elf_machine_type_class (r_type);			      \
	     l->l_lookup_cache.type_class = _tc;			      \
	     l->l_lookup_cache.sym = (*ref);				      \
	     const struct r_found_version *v = NULL;			      \
	     if ((version) != NULL && (version)->hash != 0)		      \
	       v = (version);						      \
            //
            // 这个函数是symbol定义查找的入口,实参scope保存了上面建立的查找表
            //
	     _lr = _dl_lookup_symbol_x (strtab + (*ref)->st_name, l, (ref),   \
					scope, v, _tc,			      \
					DL_LOOKUP_ADD_DEPENDENCY, NULL);      \
	     l->l_lookup_cache.ret = (*ref);				      \
	     l->l_lookup_cache.value = _lr; }))				      \
     : l)

#include "dynamic-link.h"

    //
    // 重定位的实际入口
    //
    ELF_DYNAMIC_RELOCATE (l, lazy, consider_profiling, skip_ifunc);

glibc-src/elf/dynamic-link.h/ELF_DYNAMIC_RELOCATE

/* This can't just be an inline function because GCC is too dumb
   to inline functions containing inlines themselves.  */
# define ELF_DYNAMIC_RELOCATE(map, lazy, consider_profile, skip_ifunc) \
  do {									      \
    int edr_lazy = elf_machine_runtime_setup ((map), (lazy),		      \
					      (consider_profile));	      \
    //
    // 在i386的机器上reloc的addend就是存在于根据reloc的offset计算出来的地址处,所
    // 以只有ELF_DYNAMIC_DO_REL,ELF_DYNAMIC_DO_RELA无定义.
    //
    ELF_DYNAMIC_DO_REL ((map), edr_lazy, skip_ifunc);			      \
    ELF_DYNAMIC_DO_RELA ((map), edr_lazy, skip_ifunc);			      \
  } while (0)

//
// ELF_DYNAMIC_DO_REL的定义也存在于dynamic-link.h这个文件里
// RELOC和reloc都是跟机器是不是有单独的addend有关系的.这个宏的实际效果就是遍历
// reloc表,然后调用elf_dynamic_do_##reloc(经过宏扩张将会调用elf_dynamic_do_Rel)
// 来进行实际的重定位修正.
//
# define _ELF_DYNAMIC_DO_RELOC(RELOC, reloc, map, do_lazy, skip_ifunc, test_rel) \
  do {									      \
    struct { ElfW(Addr) start, size;					      \
	     __typeof (((ElfW(Dyn) *) 0)->d_un.d_val) nrelative; int lazy; }  \
      ranges[2] = { { 0, 0, 0, 0 }, { 0, 0, 0, 0 } };			      \
									      \
    if ((map)->l_info[DT_##RELOC])					      \
      {									      \
	ranges[0].start = D_PTR ((map), l_info[DT_##RELOC]);		      \
	ranges[0].size = (map)->l_info[DT_##RELOC##SZ]->d_un.d_val;	      \
	if (map->l_info[VERSYMIDX (DT_##RELOC##COUNT)] != NULL)		      \
	  ranges[0].nrelative						      \
	    = MIN (map->l_info[VERSYMIDX (DT_##RELOC##COUNT)]->d_un.d_val,    \
		   ranges[0].size / sizeof (ElfW(reloc)));		      \
      }									      \
    if ((map)->l_info[DT_PLTREL]					      \
	&& (!test_rel || (map)->l_info[DT_PLTREL]->d_un.d_val == DT_##RELOC)) \
      {									      \
	ElfW(Addr) start = D_PTR ((map), l_info[DT_JMPREL]);		      \
	ElfW(Addr) size = (map)->l_info[DT_PLTRELSZ]->d_un.d_val;	      \
									      \
	if (ranges[0].start + ranges[0].size == (start + size))		      \
	  ranges[0].size -= size;					      \
	if (! ELF_DURING_STARTUP && ((do_lazy) || ranges[0].size == 0))	      \
	  {								      \
	    ranges[1].start = start;					      \
	    ranges[1].size = size;					      \
	    ranges[1].lazy = (do_lazy);					      \
	  }								      \
	else								      \
	  {								      \
	    /* Combine processing the sections.  */			      \
	    ranges[0].size += size;					      \
	  }								      \
      }									      \
									      \
    if (ELF_DURING_STARTUP)						      \
      elf_dynamic_do_##reloc ((map), ranges[0].start, ranges[0].size,	      \
			      ranges[0].nrelative, 0, skip_ifunc);	      \
    else								      \
      {									      \
	int ranges_index;						      \
	for (ranges_index = 0; ranges_index < 2; ++ranges_index)	      \
	  elf_dynamic_do_##reloc ((map),				      \
				  ranges[ranges_index].start,		      \
				  ranges[ranges_index].size,		      \
				  ranges[ranges_index].nrelative,	      \
				  ranges[ranges_index].lazy,		      \
				  skip_ifunc);				      \
      }									      \
  } while (0)

glibc-src/sysdeps/i386/dl-machine.h

/* Perform the relocation specified by RELOC and SYM (which is fully resolved).
   MAP is the object containing the reloc.  */

auto inline void
__attribute ((always_inline))
elf_machine_rel (struct link_map *map, const Elf32_Rel *reloc,
		 const Elf32_Sym *sym, const struct r_found_version *version,
		 void *const reloc_addr_arg, int skip_ifunc)
{
  Elf32_Addr *const reloc_addr = reloc_addr_arg;
  const unsigned int r_type = ELF32_R_TYPE (reloc->r_info);

      //
      // RESOLVE_MAP是symbol定义查找的实际代码,决定了找到的是哪个symbol
      //
      struct link_map *sym_map = RESOLVE_MAP (&sym, version, r_type);
      Elf32_Addr value = sym_map == NULL ? 0 : sym_map->l_addr + sym->st_value;

      if (sym != NULL
	  && __builtin_expect (ELFW(ST_TYPE) (sym->st_info) == STT_GNU_IFUNC,
			       0)
	  && __builtin_expect (sym->st_shndx != SHN_UNDEF, 1)
	  && __builtin_expect (!skip_ifunc, 1))
	value = ((Elf32_Addr (*) (void)) value) ();

      switch (r_type)
	{
        //
        // 还记得前面说过psABI里面对于这两种类型的计算方式是一样的吗?
        //
	case R_386_GLOB_DAT:
	case R_386_JMP_SLOT:
	  *reloc_addr = value;
	  break;

	case R_386_PC32:
	  *reloc_addr += (value - (Elf32_Addr) reloc_addr);
	  break;
	case R_386_COPY:
	  if (sym == NULL)
	    /* This can happen in trace mode if an object could not be
	       found.  */
	    break;
	  if (__builtin_expect (sym->st_size > refsym->st_size, 0)
	      || (__builtin_expect (sym->st_size < refsym->st_size, 0)
		  && GLRO(dl_verbose)))
	    {
	      const char *strtab;

	      strtab = (const char *) D_PTR (map, l_info[DT_STRTAB]);
	      _dl_error_printf ("\
%s: Symbol `%s' has different size in shared object, consider re-linking\n",
				RTLD_PROGNAME, strtab + refsym->st_name);
	    }

          //
          // 注意这里的memcpy的调用,根据前面描述的查找和解决重定位的时候的处理次
          // 序,以及最开始readelf读取main executable给出的输出,在shared library
          // 里定义的globals在main executable里的.bss段里有一个副本,也就是说同样
          // 的一个global在运行时有两个副本存在于进程空间.只不过shared library里
          // 面的副本存在的最重要的理由就是如有初始化发生在shared library里,那么
          // 初始化至是保存在shared library的副本里的,这也就是R_386_COPY这个
          // reloc类型的本意.就是一个初始值的拷贝.根据上面的分析第一个实参应该是
          // main executable里面的地址.而value应该是symbol定义查找时找到symbol的
          // 值.有意思的是后面的对于定义于shared library里的global的操作,操作的
          // 实体都会是main executable里.bss里的实体,甚至是shared library本身的
          // 代码对本身定义的global的操作.这个模型可以工作的根本原因是shared 
          // library里对本身定义的global的操作也需要引入reloc来解决.
          //
	  memcpy (reloc_addr_arg, (void *) value,
		  MIN (sym->st_size, refsym->st_size));
	  break;

	default:
	  _dl_reloc_bad_type (map, r_type, 0);
	  break;
	}
    }
}

//
// RESOLVE_MAP对于elf_machine_type_class的调用,入参是reloc类型.
//
int _tc = elf_machine_type_class(r_type)

glibc-src/sysdeps/generic/ldsodefs.h

#define ELF_RTYPE_CLASS_PLT 1
#ifndef DL_NO_COPY_RELOCS
//
// 在i386的机器上这个值肯定是2
//
# define ELF_RTYPE_CLASS_COPY 2
#else
# define ELF_RTYPE_CLASS_COPY 0
#endif

glibc-src/sysdeps/i386/dl-machine.h

# define elf_machine_type_class(type) \
  ((((type) == R_386_JMP_SLOT || (type) == R_386_TLS_DTPMOD32		      \
     || (type) == R_386_TLS_DTPOFF32 || (type) == R_386_TLS_TPOFF32	      \
     || (type) == R_386_TLS_TPOFF || (type) == R_386_TLS_DESC)		      \
    * ELF_RTYPE_CLASS_PLT)						      \
   | (((type) == R_386_COPY) * ELF_RTYPE_CLASS_COPY))

glibc-src/elf/dl-lookup.c/do_lookup_x()

static int
__attribute_noinline__
do_lookup_x (const char *undef_name, uint_fast32_t new_hash,
	     unsigned long int *old_hash, const ElfW(Sym) *ref,
	     struct sym_val *result, struct r_scope_elem *scope, size_t i,
	     const struct r_found_version *const version, int flags,
	     struct link_map *skip, int type_class, struct link_map *undef_map)
{
  size_t n = scope->r_nlist;
  //
  // 这个就是前文重点描述的建立的那个symbol定义的搜索列表.
  //
  struct link_map **list = scope->r_list;

  do
    {
      const ElfW(Sym) *versioned_sym = NULL;

      const struct link_map *map = list[i]->l_real;

      /* Here come the eixtra test needed for `_dl_lookup_symbol_skip'.  */
      //
      // skip是需要跳过的link_map
      //
      if (map == skip)
	continue;

      /* Don't search the executable when resolving a copy reloc.  */
      //
      // 这里是本文研究的R_386_COPY的相关的重点,type_class就是前面列表里的的_tc
      // 的值,只有在main executable里map->l_type的值才会是lt_executable,代表是
      // executable,另外的两个可能值是: lt_library和lt_loaded,前面表示是needed 
      // library后者表示运行时额外加载的shared object.
      // 那么注意这里的判断条件,如果重定位类型是R_386_COPY并且当前的link_map是
      // main executable那么跳过当前link_map,回想我们前面描述的symbol定义的查找
      // 列表,main executable永远是位于第一个,而且除了R_386_COPY之外dl是确实想要
      // 找到位于main executable里面的这个位于.bss段里的symbol的.但是如果是
      // R_386_COPY的symbol定义是出现在shared library里面而且有初始值,那么这种情
      // 况下dl因为要知道symbol的初始值,所以想要找到的位于shared library里的
      // symbol.
      //
      if ((type_class & ELF_RTYPE_CLASS_COPY) && map->l_type == lt_executable)
	continue;

      /* Do not look into objects which are going to be removed.  */
      if (map->l_removed)
	continue;

      /* If the hash table is empty there is nothing to do here.  */
      if (map->l_nbuckets == 0)
	continue;

      /* The tables for this map.  */
      const ElfW(Sym) *symtab = (const void *) D_PTR (map, l_info[DT_SYMTAB]);
      const char *strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);


      /* Nested routine to check whether the symbol matches.  */
      //
      // 当前函数do_lookup_x()的主要功能就是遍历前文描述的那个symbol定义查找表里
      // 的每一个elf的动态符号表然后,然后调用下面的这个内嵌函数check_match()来检
      // 查合法性.所以对于本文的研究来说这个函数的至关重要的.
      //
      const ElfW(Sym) *
      __attribute_noinline__
      check_match (const ElfW(Sym) *sym)
      {
	unsigned int stt = ELFW(ST_TYPE) (sym->st_info);
	assert (ELF_RTYPE_CLASS_PLT == 1);
        //
        // stub函数在main executable里的重定位表项的值
        // 0804a010  00000c07 R_386_JUMP_SLOT   08048520   stub
        //
        // 查看定义在shared library里的函数stub在main executable的符号表的值:
        // 12: 08048520     0 FUNC    GLOBAL DEFAULT  UND stub
        //
        // 注意上面的symbol值8048520是main executable里的stub@plt的值.也要注意在
        // 取函数指针的shared library里这个重定位类型是: R_386_GLOB_DAT.上面列出
        // 的重定位是位于exxcutable的.plt里面的根本不是现在解决的重定位,是运行时
        // 由_dl_runtime_reslove()来解决的.
        //
        // 这个判断非常重要,还记得文章的最开始说过的*stub*函数的特殊吗?stub是定义
        // 在shared library里的函数在main executable里面有引用,但是在executable
        // 里面的重定位表里面stub的那一项的symbol是有值的,因为那里我们还取了stub
        // 的函数地址,这是一个非常隐晦的dl实现上的trick,而且一切的解决源头就是这
        // 里.事实上dl确实是想要main executable里的这个symbol,因为ISO C标准里要
        // 求的的是指针比较的相等性,而并不是要求指针就是实际的函数的地址.在这里
        // 如果能够保证所有的(executable和library)里的指针的值都是0x8048520那么
        // 就够了.而且dl里确实是这样做的.
        // 那么这里可能会引发另外一个问题: 实际发生函数调用的时候怎么办?
        // 答案就是: 如果有实际函数调用的发生,在一般的lazy binding的情况下,将会
        // 调用保存在_GLOBAL_OFFSET_TABLE_[2]的函数_dl_runtime_resolve()来解决重
        // 定位问题.已经不在本文的描述范围之内.本文的描述是在dl bootrap之后但是
        // 在main executable实际获得控制权之前.
        // 回到当前代码,我们知道对于main executable里面的符号而言,sym->st_value
        // 的值是: 8048520,type_class的值0(对应于_tc输出值表里的others).
        //
	if (__builtin_expect ((sym->st_value == 0 /* No value.  */
			       && stt != STT_TLS)
			      || (type_class & (sym->st_shndx == SHN_UNDEF)),
			      0))
	  return NULL;

	/* Ignore all but STT_NOTYPE, STT_OBJECT, STT_FUNC,
	   STT_COMMON, STT_TLS, and STT_GNU_IFUNC since these are no
	   code/data definitions.  */
#define ALLOWED_STT \
	((1 << STT_NOTYPE) | (1 << STT_OBJECT) | (1 << STT_FUNC) \
	 | (1 << STT_COMMON) | (1 << STT_TLS) | (1 << STT_GNU_IFUNC))
	if (__builtin_expect (((1 << stt) & ALLOWED_STT) == 0, 0))
	  return NULL;

	if (sym != ref && strcmp (strtab + sym->st_name, undef_name))
	  /* Not the symbol we are looking for.  */
	  return NULL;
        
        //
        // symbol版本信息的检查
        //
	const ElfW(Half) *verstab = map->l_versyms;
	if (version != NULL)
	  {
	    if (__builtin_expect (verstab == NULL, 0))
	      {
		/* We need a versioned symbol but haven't found any.  If
		   this is the object which is referenced in the verneed
		   entry it is a bug in the library since a symbol must
		   not simply disappear.

		   It would also be a bug in the object since it means that
		   the list of required versions is incomplete and so the
		   tests in dl-version.c haven't found a problem.*/
		assert (version->filename == NULL
			|| ! _dl_name_match_p (version->filename, map));

		/* Otherwise we accept the symbol.  */
	      }
	    else
	      {
		/* We can match the version information or use the
		   default one if it is not hidden.  */
		ElfW(Half) ndx = verstab[symidx] & 0x7fff;
		if ((map->l_versions[ndx].hash != version->hash
		     || strcmp (map->l_versions[ndx].name, version->name))
		    && (version->hidden || map->l_versions[ndx].hash
			|| (verstab[symidx] & 0x8000)))
		  /* It's not the version we want.  */
		  return NULL;
	      }
	  }
	else
	  {
	    if (verstab != NULL)
	      {
		if ((verstab[symidx] & 0x7fff)
		    >= ((flags & DL_LOOKUP_RETURN_NEWEST) ? 2 : 3))
		  {
		    /* Don't accept hidden symbols.  */
		    if ((verstab[symidx] & 0x8000) == 0
			&& num_versions++ == 0)
		      /* No version so far.  */
		      versioned_sym = sym;

		    return NULL;
		  }
	      }
	  }

	/* There cannot be another entry for this symbol so stop here.  */
	return sym;
      }

        //
        // 后面的代码逻辑就是检查每一个symbol定义查找表的link_map的动态符号表,然
        // 后调用chenk_match()来检查.
        //