From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from eggs.gnu.org (eggs.gnu.org [IPv6:2001:470:142:3::10]) by sourceware.org (Postfix) with ESMTPS id 812B63858D32 for ; Wed, 12 Apr 2023 23:47:01 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 812B63858D32 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gnu.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gnu.org Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pmkB3-0001RL-2S; Wed, 12 Apr 2023 19:47:01 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=In-Reply-To:MIME-Version:Subject:To:From:Date: references; bh=q4TvzGsNlCEmYKVsRz0tWqP2ceSFNHh2XwB2xhe2HBI=; b=L7iUd5aaCpk5Lo NWyRSwFjIp5Q4cWSQO7AUKJrMyN06wqpzgZzW4fwiaCfQAQEk+Bowhgy65EN24UNBpnV/OmVzZ/B4 ckj8u7eqro0qcbNhJO8OeywwpM4lhVc4PqN730ydVH+cr1CV8xGDEt7lQl+F3MABFvvAoWsJBqymK AHMpn8bd4+ZFDV/IhWKRPS5tFgEZwdhOvlD28IBA/XyI6GSytjJDQNRc+oHgwHRhMi21idu7CnuMB yiev3/CB7RaW718atbcMlLdHVWZuDB/fgZa2f03KL/35E00kbwJ6QPGF7A9nNe7YxEl/SN1jFueyk YqlO57FUNUe7h4yNEREw==; Received: from [2a01:cb19:4a:a400:de41:a9ff:fe47:ec49] (helo=begin) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pmkB2-0005X2-FC; Wed, 12 Apr 2023 19:47:00 -0400 Received: from samy by begin with local (Exim 4.96) (envelope-from ) id 1pmkAz-00HUTL-1P; Thu, 13 Apr 2023 01:46:57 +0200 Date: Thu, 13 Apr 2023 01:46:57 +0200 From: Samuel Thibault To: Sergey Bugaev Cc: libc-alpha@sourceware.org, bug-hurd@gnu.org Subject: Re: [RFC PATCH glibc 24/34] hurd: Only check for TLS initialization inside rtld or in static builds Message-ID: <20230412234657.ntztyz7iau55lcwt@begin> Mail-Followup-To: Sergey Bugaev , libc-alpha@sourceware.org, bug-hurd@gnu.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: Organization: I am not organized User-Agent: NeoMutt/20170609 (1.8.3) X-Spam-Status: No, score=-5.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_PASS,SPF_PASS,TXREP,URIBL_BLACK autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Sergey Bugaev, le mer. 12 avril 2023 13:42:50 +0300, a ecrit: > before my SSH / network stack died were: (Gmail is surely going to > wrap this, but hopefully not too badly) >=20 > gcc /home/sergey/glibc/build/elf/dso-sort-tests-src/tst-dso-ordering9_42-= bdeca-c.c > -c -std=3Dgnu11 -fgnu89-inline -g -O2 -Wall -Wwrite-strings -Wundef > -Werror -fmerge-all-constants -frounding-math -fno-stack-protector > -fno-common -Wno-parentheses -Wstrict-prototypes > -Wold-style-definition -fmath-errno -fPIC -I../include > -I/home/sergey/glibc/build/elf -I/home/sergey/glibc/build > -I../sysdeps/mach/hurd/i386 -I../sysdeps/mach/hurd/x86 > -I../sysdeps/mach/hurd/i386/htl -I../sysdeps/mach/hurd/htl > -I../sysdeps/hurd/htl -I../sysdeps/mach/htl -I../sysdeps/htl/include > -I../sysdeps/htl -I../sysdeps/pthread -I../sysdeps/mach/hurd/x86/htl > -I../sysdeps/i386/htl -I../sysdeps/x86/htl -I../sysdeps/mach/hurd > -I../sysdeps/gnu -I../sysdeps/unix/bsd -I../sysdeps/unix/inet > -I../sysdeps/mach/i386 -I../sysdeps/mach/x86 > -I../sysdeps/mach/include -I../sysdeps/mach > -I../sysdeps/i386/i686/fpu/multiarch -I../sysdeps/i386/i686/fpu > -I../sysdeps/i386/i686/multiarch -I../sysdeps/i386/i686 > -I../sysdeps/i386/fpu -I../sysdeps/x86/fpu -I../sysdeps/i386 > -I../sysdeps/x86/include -I../sysdeps/x86 -I../sysdeps/wordsize-32 > -I../sysdeps/ieee754/float128 -I../sysdeps/ieee754/ldbl-96/include > -I../sysdeps/ieee754/ldbl-96 -I../sysdeps/ieee754/dbl-64 > -I../sysdeps/ieee754/flt-32 -I../sysdeps/hurd/include > -I../sysdeps/hurd -I../sysdeps/unix -I../sysdeps/posix > -I../sysdeps/ieee754 -I../sysdeps/generic -I../hurd > -I/home/sergey/glibc/build/hurd/ -I../mach > -I/home/sergey/glibc/build/mach/ -I.. -I../libio -I. > -D_LIBC_REENTRANT -include /home/sergey/glibc/build/libc-modules.h > -DMODULE_NAME=3Dtestsuite -include ../include/libc-symbols.h -DPIC > -DSHARED -DTOP_NAMESPACE=3Dglibc -o > /home/sergey/glibc/build/elf/tst-dso-ordering9-dir/tst-dso-ordering9_42-b= deca-c.os > client_loop: send disconnect: Broken pipe >=20 > ...but that doesn't seem useful. Perhaps you can pipe to tee -a build.log? > This is what's shipped in Debian, i.e. prior to my changes. As you can > see, the libc.so version accesses %gs:0x0 without any checks, which > makes sense, since __errno_location is just return &errno, 'errno' > itself being a thread-local. There is no __LIBC_NO_TLS check in the > source code. And yet it works just fine! But possibly that's just because the ld.so code before setting up tls doesn't access errno. > > > Would it have been easy for me to run the full test suite, I would > > > surely do that before submitting any patches. But it's not. > > > > Then it's simple: we have to fix that first. >=20 > If that's simple to fix, great! >=20 > Can you reproduce my issues? No :/ > > > > You can run on master to get the list of current expected failures. > > > > > > But that's the thing, I can not :| > > > > I meant after having fixed the tests that break your testing, by > > disabling them as I hinted. >=20 > Alright, after spending a day trying to make this work, I declare this > a lost cause. Ergl, sorry it ate up that much time :/ > I have disabled the two tests you suggested, and some more that seemed > to behave particularly bad. Which one? I have been running glibc's testsuite safely for several years now. > It still always kills / hard-locks my system, at seemingly random > places. Mmm, what is your system setup in terms of disk drivers and alike? As of now, I am using the the Debian 1.8+git20230410-486-dbg kernel, the gnumach AHCI disk drivers. I have 3635000KB of memory showing up as total ni `free` (kvm -m 3550M, the maximum one can have with <4G phys addressing). Perhaps one thing worth noting: my /tmp is on the real disk, not a tmpfs. > This means fs corruption, each time, so I'm not willing to try doing > this again and again. I understand, but since it's apparently random, this looks like a problem on your system, not related to glibc specifically, that you'll probably want to fix anyway. > Is there any other way for me to reproduce the crashes? If you can > reproduce them, can you see what's going on, maybe enable LD_DEBUG and > see if rtld is getting relocated early for some reason? Or maybe you > could at least get a backtrace, and then we could try to stare at it > and figure out what's going on together? >=20 > Maybe you're building with some flags that affect this? I'm only doing > ../configure. I'm using =2E./configure --prefix=3D --enable-pt_chown I have uploaded the build result of master + b37899d34d2190ef4b454283188f22519f096048 restored on: https://dept-info.labri.fr/~thibault/tmp/libc.so.0.3 https://dept-info.labri.fr/~thibault/tmp/ld.so https://dept-info.labri.fr/~thibault/tmp/test-as-const-rtld-sizes you can run it by hand with =2E/ld.so --library-path $PWD ./test-as-const-rtld-sizes It hangs on my system. I have put the core dump on=20 https://dept-info.labri.fr/~thibault/tmp/core.18601 which can be inspected with=20 gdb ./ld.so core.18601 Running live gdb ./ld.so 18529, I get: (gdb) thread apply all bt Thread 2 (Thread 18529.2): #0 0x0102aa3c in __GI___mach_msg_trap () at /usr/src/glibc-upstream/build/= mach/mach_msg_trap.S:2 #1 0x0102b1d6 in __GI___mach_msg (msg=3D0x1315d10, option=3D3, send_size= =3D64, rcv_size=3D32, rcv_name=3D0, timeout=3D0, notify=3D0) at msg.c:111 #2 0x012c9850 in __gsync_wait (task=3D, addr=3D, val1=3D, val2=3D, msec=3D= , flags=3D) at ./build-tree/hurd-i386-libc/mach/RPC_gsync_wa= it.c:186 #3 0x0104631b in __GI___spin_lock (__lock=3D0x12bb844 <_hurd_siglock>) at = =2E./mach/lock-intern.h:60 #4 __GI___mutex_lock (__lock=3D0x12bb844 <_hurd_siglock>) at ../mach/lock-= intern.h:119 #5 __GI__hurd_thread_sigstate (thread=3D) at hurdsig.c:80 #6 0x0116abb8 in _hurd_critical_section_lock () at ../hurd/hurd/signal.h:2= 30 #7 _hurd_fd_get (fd=3D2) at ../hurd/hurd/fd.h:74 #8 __GI___write_nocancel (fd=3D2, buf=3D0x1315e60, nbytes=3D) at ../sysdeps/mach/hurd/write_nocancel.c:26 #9 0x01149135 in __GI___libc_write (fd=3D2, buf=3D0x1315e60, nbytes=3D41) = at ../sysdeps/mach/hurd/write.c:26 #10 0x0116ff07 in __GI___writev (fd=3D, vector=3D, count=3D) at ../sysdeps/posix/writev.c:87 #11 0x010b9df5 in writev_for_fatal (fd=3D, total=3D, niov=3D, iov=3D) at ../sysdeps/posix/= libc_fatal.c:44 #12 __libc_message (fmt=3D) at ../sysdeps/posix/libc_fatal.c= :124 #13 0x010b9ead in __GI___libc_fatal (message=3D0x12216b4 "hurd: Can't add r= eference on Mach thread\n") at ../sysdeps/posix/libc_fatal.c:159 #14 0x01046524 in __GI__hurd_thread_sigstate (thread=3D) at = hurdsig.c:136 #15 0x0103fd33 in __GI__hurd_self_sigstate () at ../hurd/hurd/signal.h:173 #16 _hurd_msgport_receive (arg=3D) at msgportdemux.c:47 Backtrace stopped: Cannot access memory at address 0x1316000 Thread 1 (Thread 18529.1): #0 0x0102aa3c in __GI___mach_msg_trap () at /usr/src/glibc-upstream/build/= mach/mach_msg_trap.S:2 #1 0x0102b1d6 in __GI___mach_msg (msg=3D0x10018dc, option=3D3, send_size= =3D64, rcv_size=3D32, rcv_name=3D31, timeout=3D0, notify=3D0) at msg.c:111 #2 0x012c9850 in __gsync_wait (task=3D, addr=3D, val1=3D, val2=3D, msec=3D= , flags=3D) at ./build-tree/hurd-i386-libc/mach/RPC_gsync_wa= it.c:186 #3 0x01110cb7 in __GI___spin_lock (__lock=3D) at ../mach/lo= ck-intern.h:60 #4 __GI___mutex_lock (__lock=3D) at ../mach/lock-intern.h:1= 19 #5 __GI__Fork () at ../sysdeps/mach/hurd/_Fork.c:116 #6 0x01110892 in __libc_fork () at fork.c:74 #7 0x010089af in ?? () (gdb) thread apply all bt full Thread 2 (Thread 18529.2): #0 0x0102aa3c in __GI___mach_msg_trap () at /usr/src/glibc-upstream/build/= mach/mach_msg_trap.S:2 No locals. #1 0x0102b1d6 in __GI___mach_msg (msg=3D0x1315d10, option=3D3, send_size= =3D64, rcv_size=3D32, rcv_name=3D0, timeout=3D0, notify=3D0) at msg.c:111 ret =3D #2 0x012c9850 in __gsync_wait (task=3D, addr=3D, val1=3D, val2=3D, msec=3D= , flags=3D) at ./build-tree/hurd-i386-libc/mach/RPC_gsync_wa= it.c:186 Mess =3D {In =3D {Head =3D {msgh_bits =3D 5395, msgh_size =3D 64, {= msgh_remote_port =3D 36, msgh_remote_port_do_not_use =3D 36}, {msgh_local_p= ort =3D 0, msgh_protected_payload =3D 0}, msgh_seqno =3D 0, msgh_id =3D 420= 4}, addrType =3D {msgt_name =3D 2, msgt_size =3D 32, msgt_number =3D 1, msg= t_inline =3D 1, msgt_longform =3D 0, msgt_deallocate =3D 0, msgt_unused =3D= 0}, addr =3D 19642436, val1Type =3D {msgt_name =3D 2, msgt_size =3D 32, ms= gt_number =3D 1, msgt_inline =3D 1, msgt_longform =3D 0, msgt_deallocate = =3D 0, msgt_unused =3D 0}, val1 =3D 2, val2Type =3D {msgt_name =3D 2, msgt_= size =3D 32, msgt_number =3D 1, msgt_inline =3D 1, msgt_longform =3D 0, msg= t_deallocate =3D 0, msgt_unused =3D 0}, val2 =3D 0, msecType =3D {msgt_name= =3D 2, msgt_size =3D 32, msgt_number =3D 1, msgt_inline =3D 1, msgt_longfo= rm =3D 0, msgt_deallocate =3D 0, msgt_unused =3D 0}, msec =3D 0, flagsType = =3D {msgt_name =3D 2, msgt_size =3D 32, msgt_number =3D 1, msgt_inline =3D = 1, msgt_longform =3D 0, msgt_deallocate =3D 0, msgt_unused =3D 0}, flags = =3D 0}, Out =3D {Head =3D {msgh_bits =3D 5395, msgh_size =3D 64, {msgh_remo= te_port =3D 36, msgh_remote_port_do_not_use =3D 36}, {msgh_local_port =3D 0= , msgh_protected_payload =3D 0}, msgh_seqno =3D 0, msgh_id =3D 4204}, RetCo= deType =3D {msgt_name =3D 2, msgt_size =3D 32, msgt_number =3D 1, msgt_inli= ne =3D 1, msgt_longform =3D 0, msgt_deallocate =3D 0, msgt_unused =3D 0}, R= etCode =3D 19642436}} InP =3D 0x1315d10 OutP =3D 0x1315d10 msg_result =3D #3 0x0104631b in __GI___spin_lock (__lock=3D0x12bb844 <_hurd_siglock>) at = =2E./mach/lock-intern.h:60 __iptr =3D 0x12bb844 <_hurd_siglock> __flags =3D 0 #4 __GI___mutex_lock (__lock=3D0x12bb844 <_hurd_siglock>) at ../mach/lock-= intern.h:119 No locals. #5 __GI__hurd_thread_sigstate (thread=3D) at hurdsig.c:80 ss =3D #6 0x0116abb8 in _hurd_critical_section_lock () at ../hurd/hurd/signal.h:2= 30 self =3D 28 ss =3D ss =3D self =3D #7 _hurd_fd_get (fd=3D2) at ../hurd/hurd/fd.h:74 __hurd_critical__ =3D descriptor =3D descriptor =3D __hurd_critical__ =3D cell =3D #8 __GI___write_nocancel (fd=3D2, buf=3D0x1315e60, nbytes=3D) at ../sysdeps/mach/hurd/write_nocancel.c:26 descriptor =3D err =3D #9 0x01149135 in __GI___libc_write (fd=3D2, buf=3D0x1315e60, nbytes=3D41) = at ../sysdeps/mach/hurd/write.c:26 ret =3D cancel_oldtype =3D 0 #10 0x0116ff07 in __GI___writev (fd=3D, vector=3D, count=3D) at ../sysdeps/posix/writev.c:87 bytes =3D buffer =3D malloced_buffer =3D 0x0 to_copy =3D bp =3D bytes_written =3D #11 0x010b9df5 in writev_for_fatal (fd=3D, total=3D, niov=3D, iov=3D) at ../sysdeps/posix/= libc_fatal.c:44 __result =3D #12 __libc_message (fmt=3D) at ../sysdeps/posix/libc_fatal.c= :124 iov =3D total =3D 41 buf =3D ap =3D 0x1315f6c "\001" fd =3D list =3D nlist =3D cp =3D #13 0x010b9ead in __GI___libc_fatal (message=3D0x12216b4 "hurd: Can't add r= eference on Mach thread\n") at ../sysdeps/posix/libc_fatal.c:159 --Type for more, q to quit, c to continue without paging-- No locals. #14 0x01046524 in __GI__hurd_thread_sigstate (thread=3D) at = hurdsig.c:136 err =3D s =3D ss =3D #15 0x0103fd33 in __GI__hurd_self_sigstate () at ../hurd/hurd/signal.h:173 self =3D 28 ss =3D 0x0 ss =3D self =3D #16 _hurd_msgport_receive (arg=3D) at msgportdemux.c:47 No locals. Backtrace stopped: Cannot access memory at address 0x1316000 Thread 1 (Thread 18529.1): #0 0x0102aa3c in __GI___mach_msg_trap () at /usr/src/glibc-upstream/build/= mach/mach_msg_trap.S:2 No locals. #1 0x0102b1d6 in __GI___mach_msg (msg=3D0x10018dc, option=3D3, send_size= =3D64, rcv_size=3D32, rcv_name=3D31, timeout=3D0, notify=3D0) at msg.c:111 ret =3D #2 0x012c9850 in __gsync_wait (task=3D, addr=3D, val1=3D, val2=3D, msec=3D= , flags=3D) at ./build-tree/hurd-i386-libc/mach/RPC_gsync_wa= it.c:186 Mess =3D {In =3D {Head =3D {msgh_bits =3D 4608, msgh_size =3D 32, {= msgh_remote_port =3D 0, msgh_remote_port_do_not_use =3D 0}, {msgh_local_por= t =3D 31, msgh_protected_payload =3D 31}, msgh_seqno =3D 29, msgh_id =3D 43= 04}, addrType =3D {msgt_name =3D 2, msgt_size =3D 32, msgt_number =3D 1, ms= gt_inline =3D 1, msgt_longform =3D 0, msgt_deallocate =3D 0, msgt_unused = =3D 0}, addr =3D 28, val1Type =3D {msgt_name =3D 2, msgt_size =3D 32, msgt_= number =3D 1, msgt_inline =3D 1, msgt_longform =3D 0, msgt_deallocate =3D 0= , msgt_unused =3D 0}, val1 =3D 2, val2Type =3D {msgt_name =3D 2, msgt_size = =3D 32, msgt_number =3D 1, msgt_inline =3D 1, msgt_longform =3D 0, msgt_dea= llocate =3D 0, msgt_unused =3D 0}, val2 =3D 0, msecType =3D {msgt_name =3D = 2, msgt_size =3D 32, msgt_number =3D 1, msgt_inline =3D 1, msgt_longform = =3D 0, msgt_deallocate =3D 0, msgt_unused =3D 0}, msec =3D 0, flagsType =3D= {msgt_name =3D 2, msgt_size =3D 32, msgt_number =3D 1, msgt_inline =3D 1, = msgt_longform =3D 0, msgt_deallocate =3D 0, msgt_unused =3D 0}, flags =3D 0= }, Out =3D {Head =3D {msgh_bits =3D 4608, msgh_size =3D 32, {msgh_remote_po= rt =3D 0, msgh_remote_port_do_not_use =3D 0}, {msgh_local_port =3D 31, msgh= _protected_payload =3D 31}, msgh_seqno =3D 29, msgh_id =3D 4304}, RetCodeTy= pe =3D {msgt_name =3D 2, msgt_size =3D 32, msgt_number =3D 1, msgt_inline = =3D 1, msgt_longform =3D 0, msgt_deallocate =3D 0, msgt_unused =3D 0}, RetC= ode =3D 28}} InP =3D 0x10018dc OutP =3D 0x10018dc msg_result =3D #3 0x01110cb7 in __GI___spin_lock (__lock=3D) at ../mach/lo= ck-intern.h:60 __iptr =3D __flags =3D 0 #4 __GI___mutex_lock (__lock=3D) at ../mach/lock-intern.h:1= 19 No locals. #5 __GI__Fork () at ../sysdeps/mach/hurd/_Fork.c:116 newtask =3D 19675056 thread_refs =3D 16831952 sigthread_refs =3D 19762984 state =3D {gs =3D 16784272, fs =3D 16784276, es =3D 134259806, ds = =3D 16806696, edi =3D 16784276, esi =3D 134441884, ebp =3D 1, esp =3D 16832= 864, ebx =3D 5, edx =3D 0, ecx =3D 1, eax =3D 134441520, eip =3D 16777324, = cs =3D 0, efl =3D 0, uesp =3D 134438900, ss =3D 19640256} threads =3D 0x0 stopped =3D 0 newproc =3D 134438900 nportnames =3D 0 thread =3D 16927252 sigthread =3D 19674880 statecount =3D 19760428 portnames =3D 0x0 nporttypes =3D 0 porttypes =3D 0x0 nthreads =3D 0 ports_locked =3D 0 env =3D {{__jmpbuf =3D {19974152, 19974152, 0, 0, 16783680, 1789416= 3}, __mask_was_saved =3D 0, __saved_mask =3D 134441992}} pid =3D 134438900 i =3D 16807887 err =3D ss =3D 0x130c808 __PRETTY_FUNCTION__ =3D "_Fork" lose =3D #6 0x01110892 in __libc_fork () at fork.c:74 multiple_threads =3D true lastrun =3D 0 --Type for more, q to quit, c to continue without paging-- nss_database_data =3D {nsswitch_conf =3D {size =3D 7540626423238514= 2, ino =3D 84360991733424116, mtime =3D {tv_sec =3D 577421931782412918, tv_= nsec =3D 16826440}, ctime =3D {tv_sec =3D 72187705911477250, tv_nsec =3D 13= 4441520}}, services =3D {0x8036c08, 0x100d960, 0x1, 0x5, 0x0, 0x90, 0x8035f= f4, 0x1007588, 0x16, 0x54, 0x107aaf6 <__GI_getenv+102>, 0x1018cf8, 0x111085= 0 <__libc_fork>, 0xe, 0x0, 0x801033d <_dl_fixup+13>, 0x100bff4}, reload_dis= abled =3D 16784548, initialized =3D false} pid =3D #7 0x010089af in ?? () No symbol table info available. Backtrace stopped: previous frame inner to this frame (corrupt stack?) Interestingly, watching for the $gs update: =E2=82=AC gdb --args ./ld.so --library-path=3D/tmp ./test-as-const-rtld-siz= es (gdb) b _start Breakpoint 1 at 0x1a5a0 (gdb) r Starting program: /tmp/ld.so --library-path /tmp ./test-as-const-rtld-sizes Thread 5 hit Breakpoint 1, 0x0801a5a0 in _start () (gdb) watch $gs Watchpoint 2: $gs (gdb) c Continuing. Thread 5 hit Watchpoint 2: $gs Old value =3D 31 New value =3D 75 _hurd_tls_init (tcb=3D0x100e6c0) at ../sysdeps/mach/hurd/i386/tls.h:179 179 __hurd_reply_port0 =3D MACH_PORT_NULL; (gdb) bt #0 _hurd_tls_init (tcb=3D0x100e6c0) at ../sysdeps/mach/hurd/i386/tls.h:179 #1 call_tls_init_tp (addr=3D0x100e6c0) at ../sysdeps/generic/dl-call_tls_i= nit_tp.h:31 #2 init_tls (naudit=3Dnaudit@entry=3D0) at rtld.c:797 #3 0x0801db49 in dl_main (phdr=3D, phnum=3D,= user_entry=3D, auxv=3D) at rtld.c:2046 #4 0x0801a07d in go (argdata=3D0x1001d50) at ../sysdeps/mach/hurd/dl-sysde= p.c:172 #5 0x0801fa13 in _hurd_startup (argptr=3D, main=3D) at hurdstartup.c:184 #6 0x08019ee5 in _dl_sysdep_start (start_argptr=3D0x1002000, dl_main=3D0x8= 01b810 ) at ../sysdeps/mach/hurd/dl-sysdep.c:229 #7 0x0801b565 in _dl_start_final (arg=3D) at rtld.c:495 #8 _dl_start (arg=3D) at rtld.c:582 #9 0x0801a5ab in _start () from /tmp/ld.so At that point the library loading has happened: (gdb) info sharedlibrary=20 =46rom To Syms Read Shared Object Library 0x08000db0 0x080256e1 Yes /tmp/ld.so 0x0102a650 0x01200d35 No /tmp/libc.so.0.3 0x012c49a0 0x012d0ad4 No /tmp/libmachuser.so.1 0x012e0bc0 0x012fee50 No /tmp/libhurduser.so.0.3 And the function symbols indeed seem to have been overloaded: (gdb) l __write 384 __write (int fd, const void *buf, size_t nbytes) 385 { 386 error_t err; 387 vm_size_t nwrote; 388 389 assert (fd < _hurd_init_dtablesize); That is why I'm thinking that apparently exposing the libc functions happens before setting up TLS, and thus potential for mayhem if libc assumes that TLS is set up. The loading itself is apparently done in the _dl_map_object_deps call of dl_main. Samuel