newbie: dl_open crashes, arg passing problem to dl_catch_error

[dank at kegel dot com]

I'm building glibc2.2.5 from scratch with a gcc3.0.4 also
built from scratch, all for the ppc405. (See http://www.kegel.com/xgcc3/
for a slightly out of date copy of the build script I'm using. )

The result seems to work in general, and even boots Linux,
but functions like getpwent are failing with SIGSEGV.  I've tracked it down to a curious 
problem passing arguments from _dl_open to _dl_catch_error:
the latter thinks all its arguments are zero.  

I guess my next step is to disassemble _dl_open and see why the
parameter passing is broken, but I thought I'd post here to see
if this situation was something others have run into.  Any suggestions?

Here's a backtrace from gdb:

#0  _dl_catch_error (objname=0x0, errstring=0x0, operate=0, args=0x0)
    at dl-error.c:145
#1  0x10046b44 in _dl_open (file=0x7ffffc40 "libnss_compat.so.2", mode=1,
    caller=0x0) at dl-open.c:411
#2  0x1002bb24 in do_dlopen (ptr=0x7ffffc20) at dl-libc.c:78
#3  0x1000c878 in _dl_catch_error (objname=0x7ffffc00, errstring=0x7ffffc04,
    operate=0x1002bb00 <do_dlopen>, args=0x7ffffc20) at dl-error.c:152
#4  0x1002bac0 in dlerror_run (operate=0x10046520 <dl_open_worker>,
    args=0x7ffffa00) at dl-libc.c:42
#5  0x1002bbd0 in __libc_dlopen (__name=0x10046b44 "||\exKü59= ")
    at dl-libc.c:104
#6  0x10029748 in __nss_lookup_function (ni=0x1007e700,
    fct_name=0x10058ae8 "setpwent") at nsswitch.c:340
#7  0x10028cec in __nss_lookup (ni=0x1007d310, fct_name=0x10058ae8 "setpwent",
    fctp=0x7ffffdf8) at nsswitch.c:147
#8  0x10006b20 in __nss_passwd_lookup (ni=0x1007d310,
    fct_name=0x10058ae8 "setpwent", fctp=0x7ffffdf8) at XXX-lookup.c:70
#9  0x100064c8 in setup (func_name=0x1007d310 "\020\aç",
    lookup_fct=0x10006ab8 <__nss_passwd_lookup>, fctp=0x7ffffdf8,
    nip=0x7ffffdf8, startp=0x10058ae8, all=1) at getnssent_r.c:34
#10 0x10006580 in __nss_setent (func_name=0x10058ae8 "setpwent",
    lookup_fct=0x10006ab8 <__nss_passwd_lookup>, nip=0x1007d310,
    startp=0x1007d318, last_nip=0x1007d314, stayopen=268462776,
    stayopen_tmp=0x0, res=50) at getnssent_r.c:69
#11 0x10005f10 in setpwent () at ../nss/getXXent_r.c:120
#12 0x100002e4 in main () at test.c:8
#13 0x10000470 in __libc_start_main (argc=1, ubp_av=0x7ffffea4,
    ubp_ev=0x7ffffeac, auxvec=0x7ffffec9, rtld_fini=0x7ffffa10,
    stinfo=0x100002cc, stack_on_entry=0x10080000)
    at ../sysdeps/powerpc/elf/libc-start.c:119
(gdb) frame 1
#1  0x10046b44 in _dl_open (file=0x7ffffc40 "libnss_compat.so.2", mode=1,
    caller=0x0) at dl-open.c:411
411       errcode = _dl_catch_error (&objname, &errstring, dl_open_worker, &args);
(gdb) print &objname
$5 = (char **) 0x7ffffa10
(gdb) print &errstring
$6 = (char **) 0x7ffffa14
(gdb) print dl_open_worker
$7 = {void (void *)} 0x10046520 <dl_open_worker>
(gdb) print &args
$8 = (struct dl_open_args *) 0x7ffffa00
(gdb) frame 0
#0  _dl_catch_error (objname=0x0, errstring=0x0, operate=0, args=0x0)
    at dl-error.c:145
145       c.errstring = NULL;

I believe internal_function is defined to nothing, so this is just
using the plain old calling conventions.

Thanks,
Dan