xref: /illumos-gate/usr/src/cmd/sgs/rtld/common/analyze.c (revision 7247f8883be6bcac5fe4735b6f87f873387dbbef)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1988 AT&T
24  *	  All Rights Reserved
25  *
26  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
27  * Use is subject to license terms.
28  */
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 #include	"_synonyms.h"
32 
33 #include	<string.h>
34 #include	<stdio.h>
35 #include	<unistd.h>
36 #include	<sys/stat.h>
37 #include	<sys/mman.h>
38 #include	<fcntl.h>
39 #include	<limits.h>
40 #include	<dlfcn.h>
41 #include	<errno.h>
42 #include	<link.h>
43 #include	<debug.h>
44 #include	<conv.h>
45 #include	"_rtld.h"
46 #include	"_audit.h"
47 #include	"_elf.h"
48 #include	"msg.h"
49 
50 static Fct *	vector[] = {
51 	&elf_fct,
52 #ifdef A_OUT
53 	&aout_fct,
54 #endif
55 	0
56 };
57 
58 /*
59  * If a load filter flag is in effect, and this object is a filter, trigger the
60  * loading of all its filtees.  The load filter flag is in effect when creating
61  * configuration files, or when under the control of ldd(1), or the LD_LOADFLTR
62  * environment variable is set, or this object was built with the -zloadfltr
63  * flag.  Otherwise, filtee loading is deferred until triggered by a relocation.
64  */
65 static void
66 load_filtees(Rt_map *lmp)
67 {
68 	if ((FLAGS1(lmp) & MSK_RT_FILTER) &&
69 	    ((FLAGS(lmp) & FLG_RT_LOADFLTR) ||
70 	    (LIST(lmp)->lm_tflags & LML_TFLG_LOADFLTR))) {
71 		Dyninfo *	dip =  DYNINFO(lmp);
72 		uint_t		cnt, max = DYNINFOCNT(lmp);
73 		Slookup		sl;
74 
75 		sl.sl_name = 0;
76 		sl.sl_hash = 0;
77 		sl.sl_imap = sl.sl_cmap = lmp;
78 
79 		for (cnt = 0; cnt < max; cnt++, dip++) {
80 			if (((dip->di_flags & MSK_DI_FILTER) == 0) ||
81 			    ((dip->di_flags & FLG_DI_AUXFLTR) &&
82 			    (rtld_flags & RT_FL_NOAUXFLTR)))
83 				continue;
84 			(void) elf_lookup_filtee(&sl, 0, 0, cnt);
85 		}
86 	}
87 }
88 
89 /*
90  * Analyze one or more link-maps of a link map control list.  This routine is
91  * called at startup to continue the processing of the main executable.  It is
92  * also called each time a new set of objects are loaded, ie. from filters,
93  * lazy-loaded objects, or dlopen().
94  *
95  * In each instance we traverse the link-map control list starting with the
96  * initial object.  As dependencies are analyzed they are added to the link-map
97  * control list.  Thus the list grows as we traverse it - this results in the
98  * breadth first ordering of all needed objects.
99  */
100 int
101 analyze_lmc(Lm_list *lml, Aliste nlmco, Rt_map *nlmp)
102 {
103 	Rt_map	*lmp = nlmp;
104 	Lm_cntl	*nlmc;
105 	int	ret = 1;
106 
107 	/*
108 	 * If this link-map control list is being analyzed, return.  The object
109 	 * that has just been added will be picked up by the existing analysis
110 	 * thread.  Note, this is only really meaningful during process init-
111 	 * ialization, as objects are added to the main link-map control list.
112 	 * Following this initialization, each family of objects that are loaded
113 	 * are added to a new link-map control list.
114 	 */
115 	/* LINTED */
116 	nlmc = (Lm_cntl *)((char *)lml->lm_lists + nlmco);
117 	if (nlmc->lc_flags & LMC_FLG_ANALYZING)
118 		return (1);
119 
120 	/*
121 	 * If this object doesn't belong to the present link-map control list
122 	 * then it must already have been analyzed, or it is in the process of
123 	 * being analyzed prior to us recursing into this analysis.  In either
124 	 * case, ignore the object as it's already being taken care of.
125 	 */
126 	if (nlmco != CNTL(nlmp))
127 		return (1);
128 
129 	nlmc->lc_flags |= LMC_FLG_ANALYZING;
130 
131 	for (; lmp; lmp = (Rt_map *)NEXT(lmp)) {
132 		if (FLAGS(lmp) &
133 		    (FLG_RT_ANALZING | FLG_RT_ANALYZED | FLG_RT_DELETE))
134 			continue;
135 
136 		/*
137 		 * Indicate that analyzing is under way.
138 		 */
139 		FLAGS(lmp) |= FLG_RT_ANALZING;
140 
141 		/*
142 		 * If this link map represents a relocatable object, then we
143 		 * need to finish the link-editing of the object at this point.
144 		 */
145 		if (FLAGS(lmp) & FLG_RT_OBJECT) {
146 			if (elf_obj_fini(lml, lmp) == 0) {
147 				if (lml->lm_flags & LML_FLG_TRC_ENABLE)
148 					continue;
149 				ret = 0;
150 				break;
151 			}
152 		}
153 
154 		DBG_CALL(Dbg_file_analyze(lmp));
155 
156 		/*
157 		 * Establish any dependencies this object requires.
158 		 */
159 		if (LM_NEEDED(lmp)(lml, nlmco, lmp) == 0) {
160 			if (lml->lm_flags & LML_FLG_TRC_ENABLE)
161 				continue;
162 			ret = 0;
163 			break;
164 		}
165 
166 		FLAGS(lmp) &= ~FLG_RT_ANALZING;
167 		FLAGS(lmp) |= FLG_RT_ANALYZED;
168 
169 		/*
170 		 * If we're building a configuration file, determine if this
171 		 * object is a filter and if so load its filtees.  This
172 		 * traversal is only necessary for crle(1), as typical use of
173 		 * an object will load filters as part of relocation processing.
174 		 */
175 		if (MODE(nlmp) & RTLD_CONFGEN)
176 			load_filtees(lmp);
177 
178 		/*
179 		 * If an interposer has been added, it will have been inserted
180 		 * in the link-map before the link we're presently analyzing.
181 		 * Break out of this analysis loop and return to the head of
182 		 * the link-map control list to analyze the interposer.  Note
183 		 * that this rescan preserves the breadth first loading of
184 		 * dependencies.
185 		 */
186 		/* LINTED */
187 		nlmc = (Lm_cntl *)((char *)lml->lm_lists + nlmco);
188 		if (nlmc->lc_flags & LMC_FLG_REANALYZE) {
189 			nlmc->lc_flags &= ~LMC_FLG_REANALYZE;
190 			lmp = nlmc->lc_head;
191 		}
192 	}
193 
194 	/* LINTED */
195 	nlmc = (Lm_cntl *)((char *)lml->lm_lists + nlmco);
196 	nlmc->lc_flags &= ~LMC_FLG_ANALYZING;
197 
198 	return (ret);
199 }
200 
201 /*
202  * Copy relocation test.  If the symbol definition is within .bss, then it's
203  * zero filled, and as the destination is within .bss, we can skip copying
204  * zero's to zero's.  However, if the destination object has a MOVE table, it's
205  * .bss might contain non-zero data, in which case copy it regardless.
206  */
207 static int
208 copy_zerobits(Rt_map *dlmp, Sym *dsym)
209 {
210 	if ((FLAGS(dlmp) & FLG_RT_MOVE) == 0) {
211 		Mmap	*mmaps;
212 		caddr_t	daddr = (caddr_t)dsym->st_value;
213 
214 		if ((FLAGS(dlmp) & FLG_RT_FIXED) == 0)
215 			daddr += ADDR(dlmp);
216 
217 		for (mmaps = MMAPS(dlmp); mmaps->m_vaddr; mmaps++) {
218 			if ((mmaps->m_fsize != mmaps->m_msize) &&
219 			    (daddr >= (mmaps->m_vaddr + mmaps->m_fsize)) &&
220 			    (daddr < (mmaps->m_vaddr + mmaps->m_msize)))
221 				return (1);
222 		}
223 	}
224 	return (0);
225 }
226 
227 /*
228  * Relocate an individual object.
229  */
230 static int
231 relocate_so(Lm_list *lml, Rt_map *lmp, int *relocated, int now)
232 {
233 	/*
234 	 * If we're running under ldd(1), and haven't been asked to trace any
235 	 * warnings, skip any actual relocation processing.
236 	 */
237 	if (((lml->lm_flags & LML_FLG_TRC_ENABLE) == 0) ||
238 	    (lml->lm_flags & LML_FLG_TRC_WARN)) {
239 
240 		if (relocated)
241 			(*relocated)++;
242 
243 		if ((LM_RELOC(lmp)(lmp, now) == 0) &&
244 		    ((lml->lm_flags & LML_FLG_TRC_ENABLE) == 0))
245 			return (0);
246 	}
247 	return (1);
248 }
249 
250 /*
251  * Relocate the objects on a link-map control list.
252  */
253 static int
254 _relocate_lmc(Lm_list *lml, Rt_map *nlmp, int *relocated)
255 {
256 	Rt_map	*lmp;
257 
258 	for (lmp = nlmp; lmp; lmp = (Rt_map *)NEXT(lmp)) {
259 		/*
260 		 * If this object has already been relocated, we're done.  If
261 		 * this object is being deleted, skip it, there's probably a
262 		 * relocation error somewhere that's causing this deletion.
263 		 */
264 		if (FLAGS(lmp) &
265 		    (FLG_RT_RELOCING | FLG_RT_RELOCED | FLG_RT_DELETE))
266 			continue;
267 
268 		/*
269 		 * Indicate that relocation processing is under way.
270 		 */
271 		FLAGS(lmp) |= FLG_RT_RELOCING;
272 
273 		/*
274 		 * Relocate the object.
275 		 */
276 		if (relocate_so(lml, lmp, relocated, 0) == 0)
277 			return (0);
278 
279 		/*
280 		 * Indicate that the objects relocation is complete.
281 		 */
282 		FLAGS(lmp) &= ~FLG_RT_RELOCING;
283 		FLAGS(lmp) |= FLG_RT_RELOCED;
284 
285 		/*
286 		 * Mark this object's init is available for harvesting.  Under
287 		 * ldd(1) this marking is necessary for -i (tsort) gathering.
288 		 */
289 		lml->lm_init++;
290 		lml->lm_flags |= LML_FLG_OBJADDED;
291 
292 		/*
293 		 * Process any move data (not necessary under ldd()).
294 		 */
295 		if ((FLAGS(lmp) & FLG_RT_MOVE) &&
296 		    ((lml->lm_flags & LML_FLG_TRC_ENABLE) == 0))
297 			move_data(lmp);
298 
299 		/*
300 		 * Determine if this object is a filter, and if a load filter
301 		 * flag is in effect, trigger the loading of all its filtees.
302 		 */
303 		load_filtees(lmp);
304 	}
305 
306 	/*
307 	 * Perform special copy relocations.  These are only meaningful for
308 	 * dynamic executables (fixed and head of their link-map list).  If
309 	 * this ever has to change then the infrastructure of COPY() has to
310 	 * change as presently this element is used to capture both receiver
311 	 * and supplier of copy data.
312 	 */
313 	if ((FLAGS(nlmp) & FLG_RT_FIXED) && (nlmp == LIST(nlmp)->lm_head) &&
314 	    (((lml->lm_flags & LML_FLG_TRC_ENABLE) == 0) ||
315 	    (lml->lm_flags & LML_FLG_TRC_WARN))) {
316 		Rt_map **	lmpp;
317 		Aliste		off1;
318 		Word		tracing;
319 
320 #if	defined(__i386)
321 		if (elf_copy_gen(nlmp) == 0)
322 			return (0);
323 #endif
324 		if (COPY(nlmp) == 0)
325 			return (1);
326 
327 		if ((LIST(nlmp)->lm_flags & LML_FLG_TRC_ENABLE) &&
328 		    (((rtld_flags & RT_FL_SILENCERR) == 0) ||
329 		    (LIST(nlmp)->lm_flags & LML_FLG_TRC_VERBOSE)))
330 			tracing = 1;
331 		else
332 			tracing = 0;
333 
334 		DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
335 
336 		for (ALIST_TRAVERSE(COPY(nlmp), off1, lmpp)) {
337 			Rt_map *	lmp = *lmpp;
338 			Rel_copy *	rcp;
339 			Aliste		off2;
340 
341 			for (ALIST_TRAVERSE(COPY(lmp), off2, rcp)) {
342 				int zero;
343 
344 				/*
345 				 * Only copy the bits if it's from non-zero
346 				 * filled memory.
347 				 */
348 				zero = copy_zerobits(rcp->r_dlmp, rcp->r_dsym);
349 				DBG_CALL(Dbg_reloc_copy(rcp->r_dlmp, nlmp,
350 				    rcp->r_name, zero));
351 				if (zero)
352 					continue;
353 
354 				(void) memcpy(rcp->r_radd, rcp->r_dadd,
355 				    rcp->r_size);
356 
357 				if ((tracing == 0) || ((FLAGS1(rcp->r_dlmp) &
358 				    FL1_RT_DISPREL) == 0))
359 					continue;
360 
361 				(void) printf(MSG_INTL(MSG_LDD_REL_CPYDISP),
362 				    demangle(rcp->r_name), NAME(rcp->r_dlmp));
363 			}
364 		}
365 
366 		DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
367 
368 		free(COPY(nlmp));
369 		COPY(nlmp) = 0;
370 	}
371 	return (1);
372 }
373 
374 int
375 relocate_lmc(Lm_list *lml, Aliste nlmco, Rt_map *clmp, Rt_map *nlmp)
376 {
377 	int	lret = 1, pret = 1;
378 	Alist	*alp;
379 	Aliste	plmco;
380 	Lm_cntl	*plmc, *nlmc;
381 
382 	/*
383 	 * If this link-map control list is being relocated, return.  The object
384 	 * that has just been added will be picked up by the existing relocation
385 	 * thread.  Note, this is only really meaningful during process init-
386 	 * ialization, as objects are added to the main link-map control list.
387 	 * Following this initialization, each family of objects that are loaded
388 	 * are added to a new link-map control list.
389 	 */
390 	/* LINTED */
391 	nlmc = (Lm_cntl *)((char *)lml->lm_lists + nlmco);
392 
393 	if (nlmc->lc_flags & LMC_FLG_RELOCATING)
394 		return (1);
395 
396 	nlmc->lc_flags |= LMC_FLG_RELOCATING;
397 
398 	/*
399 	 * Relocate one or more link-maps of a link map control list.  If this
400 	 * object doesn't belong to the present link-map control list then it
401 	 * must already have been relocated, or it is in the process of being
402 	 * relocated prior to us recursing into this relocation.  In either
403 	 * case, ignore the object as it's already being taken care of, however,
404 	 * fall through and capture any relocation promotions that might have
405 	 * been established from the reference mode of this object.
406 	 *
407 	 * If we're generating a configuration file using crle(1), two passes
408 	 * may be involved.  Under the first pass, RTLD_CONFGEN is set.  Under
409 	 * this pass, crle() loads objects into the process address space.  No
410 	 * relocation is necessary at this point, we simply need to analyze the
411 	 * objects to insure any directly bound dependencies, filtees, etc.
412 	 * get loaded. Although we skip the relocation, fall through to insure
413 	 * any control lists are maintained appropriately.
414 	 *
415 	 * If objects are to be dldump(3c)'ed, crle(1) makes a second pass,
416 	 * using RTLD_NOW and RTLD_CONFGEN.  The RTLD_NOW effectively carries
417 	 * out the relocations of all loaded objects.
418 	 */
419 	if ((nlmco == CNTL(nlmp)) &&
420 	    ((MODE(nlmp) & (RTLD_NOW | RTLD_CONFGEN)) != RTLD_CONFGEN)) {
421 		int	relocated = 0;
422 
423 		/*
424 		 * Determine whether the initial link-map control list has
425 		 * started relocation.  From this point, should any interposing
426 		 * objects be added to this link-map control list, the objects
427 		 * are demoted to standard objects.  Their interposition can't
428 		 * be guaranteed once relocations have been carried out.
429 		 */
430 		if (nlmco == ALO_DATA)
431 			lml->lm_flags |= LML_FLG_STARTREL;
432 
433 		/*
434 		 * Relocate the link-map control list.  Should this relocation
435 		 * fail, clean up this link-map list.  Relocations within this
436 		 * list may have required relocation promotions on other lists,
437 		 * so before acting upon these, and possibly adding more objects
438 		 * to the present link-map control list, try and clean up any
439 		 * failed objects now.
440 		 */
441 		lret = _relocate_lmc(lml, nlmp, &relocated);
442 		if ((lret == 0) && (nlmco != ALO_DATA))
443 			remove_lmc(lml, clmp, nlmc, nlmco, NAME(nlmp));
444 	}
445 
446 	/*
447 	 * Determine the new, and previous link-map control lists.
448 	 */
449 	/* LINTED */
450 	nlmc = (Lm_cntl *)((char *)lml->lm_lists + nlmco);
451 	if (nlmco == ALO_DATA) {
452 		plmco = nlmco;
453 		plmc = nlmc;
454 	} else {
455 		plmco = nlmco - lml->lm_lists->al_size;
456 		/* LINTED */
457 		plmc = (Lm_cntl *)((char *)lml->lm_lists + plmco);
458 	}
459 
460 	/*
461 	 * Having completed this control list of objects, they can now be bound
462 	 * to from other objects.  Move this control list to the control list
463 	 * that precedes it.  Although this control list may have only bound to
464 	 * controls lists much higher up the control list stack, it must only
465 	 * be moved up one control list so as to preserve the link-map order
466 	 * that may have already been traversed in search of symbols.
467 	 */
468 	if (lret && (nlmco != ALO_DATA) && nlmc->lc_head)
469 		lm_move(lml, nlmco, plmco, nlmc, plmc);
470 
471 	/*
472 	 * Determine whether existing objects that have already been relocated,
473 	 * need any additional relocations performed.  This can occur when new
474 	 * objects are loaded with RTLD_NOW, and these new objects have
475 	 * dependencies on objects that are already loaded.  Note, that we peel
476 	 * any relocation promotions off of one control list at a time.  This
477 	 * prevents relocations from being bound to objects that might yet fail
478 	 * to relocate themselves.
479 	 */
480 	while ((alp = plmc->lc_now) != 0) {
481 		Aliste	off;
482 		Rt_map	**lmpp;
483 
484 		/*
485 		 * Remove the relocation promotion list, as performing more
486 		 * relocations may result in discovering more objects that need
487 		 * promotion.
488 		 */
489 		plmc->lc_now = 0;
490 
491 		for (ALIST_TRAVERSE(alp, off, lmpp)) {
492 			Rt_map	*lmp = *lmpp;
493 
494 			/*
495 			 * If the original relocation of the link-map control
496 			 * list failed, or one of the relocation promotions of
497 			 * this loop has failed, demote any pending objects
498 			 * relocation mode.
499 			 */
500 			if ((lret == 0) || (pret == 0)) {
501 				MODE(lmp) &= ~RTLD_NOW;
502 				MODE(lmp) |= RTLD_LAZY;
503 				continue;
504 			}
505 
506 			/*
507 			 * If a relocation fails, save the error condition.
508 			 * It's possible that all new objects on the original
509 			 * link-map control list have been relocated
510 			 * successfully, but if the user request requires
511 			 * promoting objects that have already been loaded, we
512 			 * have to indicate that this operation couldn't be
513 			 * performed.  The unrelocated objects are in use on
514 			 * another control list, and may continue to be used.
515 			 * If the .plt that resulted in the error is called,
516 			 * then the process will receive a fatal error at that
517 			 * time.  But, the .plt may never be called.
518 			 */
519 			if (relocate_so(lml, lmp, 0, 1) == 0)
520 				pret = 0;
521 		}
522 
523 		/*
524 		 * Having promoted any objects, determine whether additional
525 		 * dependencies were added, and if so move them to the previous
526 		 * link-map control list.
527 		 */
528 		/* LINTED */
529 		nlmc = (Lm_cntl *)((char *)lml->lm_lists + nlmco);
530 		/* LINTED */
531 		plmc = (Lm_cntl *)((char *)lml->lm_lists + plmco);
532 		if ((nlmco != ALO_DATA) && nlmc->lc_head)
533 			lm_move(lml, nlmco, plmco, nlmc, plmc);
534 		free(alp);
535 	}
536 
537 	/*
538 	 * If relocations have been successful, indicate that relocations are
539 	 * no longer active for this control list.  Otherwise, leave the
540 	 * relocation flag, as this flag is used to determine the style of
541 	 * cleanup (see remove_lmc()).
542 	 */
543 	if (lret && pret) {
544 		/* LINTED */
545 		nlmc = (Lm_cntl *)((char *)lml->lm_lists + nlmco);
546 		nlmc->lc_flags &= ~LMC_FLG_RELOCATING;
547 
548 		return (1);
549 	}
550 
551 	return (0);
552 }
553 
554 /*
555  * Inherit the first rejection message for possible later diagnostics.
556  *
557  * Any attempt to process a file that is unsuccessful, should be accompanied
558  * with an error diagnostic.  However, some operations like searching for a
559  * simple filename, involve trying numerous paths, and an error message for each
560  * lookup is not required.  Although a multiple search can fail, it's possible
561  * that a file was found, but was rejected because it was the wrong type.
562  * To satisfy these possibilities, the first failure is recorded as a rejection
563  * message, and this message is used later for a more specific diagnostic.
564  *
565  * File searches are focused at load_one(), and from here a rejection descriptor
566  * is passed down to various child routines.  If these child routines can
567  * process multiple files, then they will maintain their own rejection desc-
568  * riptor.  This is filled in for any failures, and a diagnostic produced to
569  * reflect the failure.  The child routines then employ rejection_inherit() to
570  * pass the first rejection message back to load_one().
571  *
572  * Note that the name, and rejection string must be duplicated, as the name
573  * buffer and error string buffer (see conv_ routines) may be reused for
574  * additional processing or rejection messages.
575  */
576 void
577 rejection_inherit(Rej_desc *rej1, Rej_desc *rej2)
578 {
579 	if (rej2->rej_type && (rej1->rej_type == 0)) {
580 		rej1->rej_type = rej2->rej_type;
581 		rej1->rej_info = rej2->rej_info;
582 		rej1->rej_flag = rej2->rej_flag;
583 		if (rej2->rej_name)
584 			rej1->rej_name = strdup(rej2->rej_name);
585 		if (rej2->rej_str) {
586 			if ((rej1->rej_str = strdup(rej2->rej_str)) == NULL)
587 				rej1->rej_str = MSG_ORIG(MSG_EMG_ENOMEM);
588 		}
589 	}
590 }
591 
592 /*
593  * Determine the object type of a file.
594  */
595 Fct *
596 are_u_this(Rej_desc *rej, int fd, struct stat *status, const char *name)
597 {
598 	int	i;
599 	char	*maddr = 0;
600 
601 	fmap->fm_fsize = status->st_size;
602 
603 	/*
604 	 * If this is a directory (which can't be mmap()'ed) generate a precise
605 	 * error message.
606 	 */
607 	if ((status->st_mode & S_IFMT) == S_IFDIR) {
608 		rej->rej_type = SGS_REJ_STR;
609 		rej->rej_str = strerror(EISDIR);
610 		return (0);
611 	}
612 
613 	/*
614 	 * Map in the first page of the file.  When this buffer is first used,
615 	 * the mapping is a single system page.  This is typically enough to
616 	 * inspect the ehdr and phdrs of the file, and can be reused for each
617 	 * file that get loaded.  If a larger mapping is required to read the
618 	 * ehdr and phdrs, a new mapping is created (see elf_map_it()).  This
619 	 * new mapping is again used for each new file loaded.  Some objects,
620 	 * such as filters, only take up one page, and in this case this mapping
621 	 * will suffice for the file.
622 	 */
623 	maddr = mmap(fmap->fm_maddr, fmap->fm_msize, (PROT_READ | PROT_EXEC),
624 	    fmap->fm_mflags, fd, 0);
625 #if defined(MAP_ALIGN)
626 	if ((maddr == MAP_FAILED) && (errno == EINVAL)) {
627 		/*
628 		 * If the mapping failed, and we used MAP_ALIGN, assume we're
629 		 * on a system that doesn't support this option.  Try again
630 		 * without MAP_ALIGN.
631 		 */
632 		if (fmap->fm_mflags & MAP_ALIGN) {
633 			rtld_flags2 |= RT_FL2_NOMALIGN;
634 			fmap_setup();
635 
636 			maddr = (char *)mmap(fmap->fm_maddr, fmap->fm_msize,
637 			    (PROT_READ | PROT_EXEC), fmap->fm_mflags, fd, 0);
638 		}
639 	}
640 #endif
641 	if (maddr == MAP_FAILED) {
642 		rej->rej_type = SGS_REJ_STR;
643 		rej->rej_str = strerror(errno);
644 		return (0);
645 	}
646 
647 	/*
648 	 * From now on we will re-use fmap->fm_maddr as the mapping address
649 	 * so we augment the flags with MAP_FIXED and drop any MAP_ALIGN.
650 	 */
651 	fmap->fm_maddr = maddr;
652 	fmap->fm_mflags |= MAP_FIXED;
653 #if defined(MAP_ALIGN)
654 	fmap->fm_mflags &= ~MAP_ALIGN;
655 #endif
656 
657 	/*
658 	 * Search through the object vectors to determine what kind of
659 	 * object we have.
660 	 */
661 	for (i = 0; vector[i]; i++) {
662 		if ((vector[i]->fct_are_u_this)(rej))
663 			return (vector[i]);
664 		else if (rej->rej_type) {
665 			Rt_map	*lmp;
666 
667 			/*
668 			 * If this object is an explicitly defined shared
669 			 * object under inspection by ldd, and contains a
670 			 * incompatible hardware capabilities requirement, then
671 			 * inform the user, but continue processing.
672 			 *
673 			 * XXXX - ldd -v for any rej failure.
674 			 */
675 			if ((rej->rej_type == SGS_REJ_HWCAP_1) &&
676 			    (lml_main.lm_flags & LML_FLG_TRC_LDDSTUB) &&
677 			    ((lmp = lml_main.lm_head) != 0) &&
678 			    (FLAGS1(lmp) & FL1_RT_LDDSTUB) &&
679 			    (NEXT(lmp) == 0)) {
680 				(void) printf(MSG_INTL(MSG_LDD_GEN_HWCAP_1),
681 				    name, rej->rej_str);
682 				return (vector[i]);
683 			}
684 			return (0);
685 		}
686 	}
687 
688 	/*
689 	 * Unknown file type.
690 	 */
691 	rej->rej_type = SGS_REJ_UNKFILE;
692 	return (0);
693 }
694 
695 /*
696  * Helper routine for is_so_matched() that consolidates matching a path name,
697  * or file name component of a link-map name.
698  */
699 static int
700 _is_so_matched(const char *name, const char *str, int path)
701 {
702 	const char	*_str;
703 
704 	if ((path == 0) && ((_str = strrchr(str, '/')) != NULL))
705 		_str++;
706 	else
707 		_str = str;
708 
709 	return (strcmp(name, _str));
710 }
711 
712 /*
713  * Determine whether a search name matches one of the names associated with a
714  * link-map.  A link-map contains several names:
715  *
716  *  .	a NAME() - typically the full pathname of an object that has been
717  *	loaded.  For example, when looking for the dependency "libc.so.1", a
718  * 	search path is applied, with the eventual NAME() being "/lib/ld.so.1".
719  *	The name of the executable is typically a simple filename, such as
720  *	"main", as this is the name passed to exec() to start the process.
721  *
722  *  .	a PATHNAME() - this is maintained if the resolved NAME() is different
723  * 	to NAME(), ie. the original name is a symbolic link.  This is also
724  * 	the resolved full pathname for a dynamic executable.
725  *
726  *  .	a list of ALIAS() names - these are alternative names by which the
727  *	object has been found, ie. when dependencies are loaded through a
728  * 	variety of different symbolic links.
729  *
730  * The name pattern matching can differ depending on whether we are looking
731  * for a full path name (path != 0), or a simple file name (path == 0).  Full
732  * path names typically match NAME() or PATHNAME() entries, so these link-map
733  * names are inspected first when a full path name is being searched for.
734  * Simple file names typically match ALIAS() names, so these link-map names are
735  * inspected first when a simple file name is being searched for.
736  *
737  * For all full path name searches, the link-map names are taken as is.  For
738  * simple file name searches, only the file name component of any link-map
739  * names are used for comparison.
740  */
741 static Rt_map *
742 is_so_matched(Rt_map *lmp, const char *name, int path)
743 {
744 	Aliste		off;
745 	const char	**cpp;
746 
747 	/*
748 	 * A pathname is typically going to match a NAME() or PATHNAME(), so
749 	 * check these first.
750 	 */
751 	if (path) {
752 		if (strcmp(name, NAME(lmp)) == 0)
753 			return (lmp);
754 
755 		if (PATHNAME(lmp) != NAME(lmp)) {
756 			if (strcmp(name, PATHNAME(lmp)) == 0)
757 				return (lmp);
758 		}
759 	}
760 
761 	/*
762 	 * Typically, dependencies are specified as simple file names
763 	 * (DT_NEEDED == libc.so.1), which are expanded to full pathnames to
764 	 * open the file.  The full pathname is NAME(), and the original name
765 	 * is maintained on the ALIAS() list.
766 	 *
767 	 * If this is a simple filename, or a pathname has failed to match the
768 	 * NAME() and PATHNAME() check above, look through the ALIAS() list.
769 	 */
770 	for (ALIST_TRAVERSE(ALIAS(lmp), off, cpp)) {
771 		/*
772 		 * If we're looking for a simple filename, _is_so_matched()
773 		 * will reduce the ALIAS name to its simple name.
774 		 */
775 		if (_is_so_matched(name, *cpp, path) == 0)
776 			return (lmp);
777 	}
778 
779 	/*
780 	 * Finally, if this is a simple file name, and any ALIAS() search has
781 	 * been completed, match the simple file name of NAME() and PATHNAME().
782 	 */
783 	if (path == 0) {
784 		if (_is_so_matched(name, NAME(lmp), 0) == 0)
785 			return (lmp);
786 
787 		if (PATHNAME(lmp) != NAME(lmp)) {
788 			if (_is_so_matched(name, PATHNAME(lmp), 0) == 0)
789 				return (lmp);
790 		}
791 	}
792 
793 	return (0);
794 }
795 
796 /*
797  * Files are opened by ld.so.1 to satisfy dependencies, filtees and dlopen()
798  * requests.  Each request investigates the file based upon the callers
799  * environment, and once a full path name has been established a check is made
800  * against the FullpathNode AVL tree and a device/inode check, to ensure the
801  * same file isn't mapped multiple times.  See file_open().
802  *
803  * However, there are one of two cases where a test for an existing file name
804  * needs to be carried out, such as dlopen(NOLOAD) requests, dldump() requests,
805  * and as a final fallback to dependency loading.  These requests are handled
806  * by is_so_loaded().
807  *
808  * A traversal through the callers link-map list is carried out, and from each
809  * link-map, a comparison is made against all of the various names by which the
810  * object has been referenced.  The subroutine, is_so_matched() compares the
811  * link-map names against the name being searched for.  Whether the search name
812  * is a full path name or a simple file name, governs what comparisons are made.
813  *
814  * A full path name, which is a fully resolved path name that starts with a "/"
815  * character, or a relative path name that includes a "/" character, must match
816  * the link-map names explicitly.  A simple file name, which is any name *not*
817  * containing a "/" character, are matched against the file name component of
818  * any link-map names.
819  */
820 Rt_map *
821 is_so_loaded(Lm_list *lml, const char *name)
822 {
823 	Rt_map		*lmp;
824 	avl_index_t	where;
825 	Lm_cntl		*lmc;
826 	Aliste		off;
827 	int		path = 0;
828 
829 	/*
830 	 * If the name is a full path name, first determine if the path name is
831 	 * registered in the FullpathNode AVL tree.
832 	 */
833 	if ((name[0] == '/') &&
834 	    ((lmp = fpavl_loaded(lml, name, &where)) != NULL) &&
835 	    ((FLAGS(lmp) & (FLG_RT_OBJECT | FLG_RT_DELETE)) == 0))
836 		return (lmp);
837 
838 	/*
839 	 * Determine whether the name is a simple file name, or a path name.
840 	 */
841 	if (strchr(name, '/'))
842 		path++;
843 
844 	/*
845 	 * Loop through the callers link-map lists.
846 	 */
847 	for (ALIST_TRAVERSE(lml->lm_lists, off, lmc)) {
848 		for (lmp = lmc->lc_head; lmp; lmp = (Rt_map *)NEXT(lmp)) {
849 			if (FLAGS(lmp) & (FLG_RT_OBJECT | FLG_RT_DELETE))
850 				continue;
851 
852 			if (is_so_matched(lmp, name, path))
853 				return (lmp);
854 		}
855 	}
856 	return ((Rt_map *)0);
857 }
858 
859 /*
860  * Tracing is enabled by the LD_TRACE_LOADED_OPTIONS environment variable which
861  * is normally set from ldd(1).  For each link map we load, print the load name
862  * and the full pathname of the shared object.
863  */
864 /* ARGSUSED4 */
865 static void
866 trace_so(Rt_map *clmp, Rej_desc *rej, const char *name, const char *path,
867     int alter, const char *nfound)
868 {
869 	const char	*str = MSG_ORIG(MSG_STR_EMPTY);
870 	const char	*reject = MSG_ORIG(MSG_STR_EMPTY);
871 	char		_reject[PATH_MAX];
872 
873 	/*
874 	 * The first time through trace_so() will only have lddstub on the
875 	 * link-map list and the preloaded shared object is supplied as "path".
876 	 * As we don't want to print this shared object as a dependency, but
877 	 * instead inspect *its* dependencies, return.
878 	 */
879 	if (FLAGS1(clmp) & FL1_RT_LDDSTUB)
880 		return;
881 
882 	/*
883 	 * Without any rejection info, this is a supplied not-found condition.
884 	 */
885 	if (rej && (rej->rej_type == 0)) {
886 		(void) printf(nfound, name);
887 		return;
888 	}
889 
890 	/*
891 	 * If rejection information exists then establish what object was
892 	 * found and the reason for its rejection.
893 	 */
894 	if (rej) {
895 		/* LINTED */
896 		(void) snprintf(_reject, PATH_MAX,
897 		    MSG_INTL(ldd_reject[rej->rej_type]), conv_reject_desc(rej));
898 		if (rej->rej_name)
899 			path = rej->rej_name;
900 		reject = (char *)_reject;
901 
902 		/*
903 		 * Was an alternative pathname defined (from a configuration
904 		 * file).
905 		 */
906 		if (rej->rej_flag & FLG_FD_ALTER)
907 			str = MSG_INTL(MSG_LDD_FIL_ALTER);
908 	} else {
909 		if (alter)
910 			str = MSG_INTL(MSG_LDD_FIL_ALTER);
911 	}
912 
913 	/*
914 	 * If the load name isn't a full pathname print its associated pathname
915 	 * together with all the other information we've gathered.
916 	 */
917 	if (*name == '/')
918 		(void) printf(MSG_ORIG(MSG_LDD_FIL_PATH), path, str, reject);
919 	else
920 		(void) printf(MSG_ORIG(MSG_LDD_FIL_EQUIV), name, path, str,
921 		    reject);
922 }
923 
924 
925 /*
926  * Establish a link-map mode, initializing it if it has just been loaded, or
927  * potentially updating it if it already exists.
928  */
929 int
930 update_mode(Rt_map *lmp, int omode, int nmode)
931 {
932 	Lm_list	*lml = LIST(lmp);
933 	int	pmode = 0;
934 
935 	/*
936 	 * A newly loaded object hasn't had its mode set yet.  Modes are used to
937 	 * load dependencies, so don't propagate any parent or no-load flags, as
938 	 * these would adversely affect this objects ability to load any of its
939 	 * dependencies that aren't already loaded.  RTLD_FIRST is applicable to
940 	 * this objects handle creation only, and should not be propagated.
941 	 */
942 	if ((FLAGS(lmp) & FLG_RT_MODESET) == 0) {
943 		MODE(lmp) |= nmode & ~(RTLD_PARENT | RTLD_NOLOAD | RTLD_FIRST);
944 		FLAGS(lmp) |= FLG_RT_MODESET;
945 		return (1);
946 	}
947 
948 	/*
949 	 * Establish any new overriding modes.  RTLD_LAZY and RTLD_NOW should be
950 	 * represented individually (this is historic, as these two flags were
951 	 * the only flags originally available to dlopen()).  Other flags are
952 	 * accumulative, but have a hierarchy of preference.
953 	 */
954 	if ((omode & RTLD_LAZY) && (nmode & RTLD_NOW)) {
955 		MODE(lmp) &= ~RTLD_LAZY;
956 		pmode |= RTLD_NOW;
957 	}
958 
959 	pmode |= ((~omode & nmode) &
960 	    (RTLD_GLOBAL | RTLD_WORLD | RTLD_NODELETE));
961 	if (pmode) {
962 		DBG_CALL(Dbg_file_mode_promote(lmp, pmode));
963 		MODE(lmp) |= pmode;
964 	}
965 
966 	/*
967 	 * If this load is an RTLD_NOW request and the object has already been
968 	 * loaded non-RTLD_NOW, append this object to the relocation-now list
969 	 * of the objects associated control list.  Note, if the object hasn't
970 	 * yet been relocated, setting its MODE() to RTLD_NOW will establish
971 	 * full relocation processing when it eventually gets relocated.
972 	 */
973 	if ((pmode & RTLD_NOW) &&
974 	    (FLAGS(lmp) & (FLG_RT_RELOCED | FLG_RT_RELOCING))) {
975 		Lm_cntl	*lmc;
976 
977 		/* LINTED */
978 		lmc = (Lm_cntl *)((char *)(LIST(lmp)->lm_lists) + CNTL(lmp));
979 		(void) alist_append(&(lmc->lc_now), &lmp, sizeof (Rt_map *),
980 		    AL_CNT_LMNOW);
981 	}
982 
983 #ifdef	SIEBEL_DISABLE
984 	/*
985 	 * For patch backward compatibility the following .init collection
986 	 * is disabled.
987 	 */
988 	if (rtld_flags & RT_FL_DISFIX_1)
989 		return (pmode);
990 #endif
991 
992 	/*
993 	 * If this objects .init has been collected but has not yet been called,
994 	 * it may be necessary to reevaluate the object using tsort().  For
995 	 * example, a new dlopen() hierarchy may bind to uninitialized objects
996 	 * that are already loaded, or a dlopen(RTLD_NOW) can establish new
997 	 * bindings between already loaded objects that require the tsort()
998 	 * information be recomputed.  If however, no new objects have been
999 	 * added to the process, and this object hasn't been promoted, don't
1000 	 * bother reevaluating the .init.  The present tsort() information is
1001 	 * probably as accurate as necessary, and by not establishing a parallel
1002 	 * tsort() we can help reduce the amount of recursion possible between
1003 	 * .inits.
1004 	 */
1005 	if (((FLAGS(lmp) &
1006 	    (FLG_RT_INITCLCT | FLG_RT_INITCALL)) == FLG_RT_INITCLCT) &&
1007 	    ((lml->lm_flags & LML_FLG_OBJADDED) || ((pmode & RTLD_NOW) &&
1008 	    (FLAGS(lmp) & (FLG_RT_RELOCED | FLG_RT_RELOCING))))) {
1009 		FLAGS(lmp) &= ~FLG_RT_INITCLCT;
1010 		LIST(lmp)->lm_init++;
1011 		LIST(lmp)->lm_flags |= LML_FLG_OBJREEVAL;
1012 	}
1013 
1014 	return (pmode);
1015 }
1016 
1017 /*
1018  * Determine whether an alias name already exists, and if not create one.  This
1019  * is typically used to retain dependency names, such as "libc.so.1", which
1020  * would have been expanded to full path names when they were loaded.  The
1021  * full path names (NAME() and possibly PATHNAME()) are maintained as Fullpath
1022  * AVL nodes, and thus would have been matched by fpavl_loaded() during
1023  * file_open().
1024  */
1025 int
1026 append_alias(Rt_map *lmp, const char *str, int *added)
1027 {
1028 	Aliste	off;
1029 	char	**cpp, *cp;
1030 
1031 	/*
1032 	 * Determine if this filename is already on the alias list.
1033 	 */
1034 	for (ALIST_TRAVERSE(ALIAS(lmp), off, cpp)) {
1035 		if (strcmp(*cpp, str) == 0)
1036 			return (1);
1037 	}
1038 
1039 	/*
1040 	 * This is a new alias, append it to the alias list.
1041 	 */
1042 	if ((cp = strdup(str)) == NULL)
1043 		return (0);
1044 
1045 	if (alist_append(&ALIAS(lmp), &cp, sizeof (char *),
1046 	    AL_CNT_ALIAS) == 0) {
1047 		free(cp);
1048 		return (0);
1049 	}
1050 	if (added)
1051 		*added = 1;
1052 	return (1);
1053 }
1054 
1055 /*
1056  * Determine whether a file is already loaded by comparing device and inode
1057  * values.
1058  */
1059 static Rt_map *
1060 is_devinode_loaded(struct stat *status, Lm_list *lml, const char *name,
1061     uint_t flags)
1062 {
1063 	Lm_cntl	*lmc;
1064 	Aliste	off;
1065 
1066 	/*
1067 	 * If this is an auditor, it will have been opened on a new link-map.
1068 	 * To prevent multiple occurrances of the same auditor on multiple
1069 	 * link-maps, search the head of each link-map list and see if this
1070 	 * object is already loaded as an auditor.
1071 	 */
1072 	if (flags & FLG_RT_AUDIT) {
1073 		Lm_list *	lml;
1074 		Listnode *	lnp;
1075 
1076 		for (LIST_TRAVERSE(&dynlm_list, lnp, lml)) {
1077 			Rt_map	*nlmp = lml->lm_head;
1078 
1079 			if (nlmp && ((FLAGS(nlmp) &
1080 			    (FLG_RT_AUDIT | FLG_RT_DELETE)) == FLG_RT_AUDIT) &&
1081 			    (STDEV(nlmp) == status->st_dev) &&
1082 			    (STINO(nlmp) == status->st_ino))
1083 				return (nlmp);
1084 		}
1085 		return ((Rt_map *)0);
1086 	}
1087 
1088 	/*
1089 	 * If the file has been found determine from the new files status
1090 	 * information if this file is actually linked to one we already have
1091 	 * mapped.  This catches symlink names not caught by is_so_loaded().
1092 	 */
1093 	for (ALIST_TRAVERSE(lml->lm_lists, off, lmc)) {
1094 		Rt_map	*nlmp;
1095 
1096 		for (nlmp = lmc->lc_head; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
1097 			if ((FLAGS(nlmp) & FLG_RT_DELETE) ||
1098 			    (FLAGS1(nlmp) & FL1_RT_LDDSTUB))
1099 				continue;
1100 
1101 			if ((STDEV(nlmp) != status->st_dev) ||
1102 			    (STINO(nlmp) != status->st_ino))
1103 				continue;
1104 
1105 			if (lml->lm_flags & LML_FLG_TRC_VERBOSE) {
1106 				/* BEGIN CSTYLED */
1107 				if (*name == '/')
1108 				    (void) printf(MSG_ORIG(MSG_LDD_FIL_PATH),
1109 					name, MSG_ORIG(MSG_STR_EMPTY),
1110 					MSG_ORIG(MSG_STR_EMPTY));
1111 				else
1112 				    (void) printf(MSG_ORIG(MSG_LDD_FIL_EQUIV),
1113 					name, NAME(nlmp),
1114 					MSG_ORIG(MSG_STR_EMPTY),
1115 					MSG_ORIG(MSG_STR_EMPTY));
1116 				/* END CSTYLED */
1117 			}
1118 			return (nlmp);
1119 		}
1120 	}
1121 	return ((Rt_map *)0);
1122 }
1123 
1124 /*
1125  * Generate any error messages indicating a file could not be found.  When
1126  * preloading or auditing a secure application, it can be a little more helpful
1127  * to indicate that a search of secure directories has failed, so adjust the
1128  * messages accordingly.
1129  */
1130 void
1131 file_notfound(Lm_list *lml, const char *name, Rt_map *clmp, uint_t flags,
1132     Rej_desc * rej)
1133 {
1134 	int	secure = 0;
1135 
1136 	if ((rtld_flags & RT_FL_SECURE) &&
1137 	    (flags & (FLG_RT_PRELOAD | FLG_RT_AUDIT)))
1138 		secure++;
1139 
1140 	if (lml->lm_flags & LML_FLG_TRC_ENABLE) {
1141 		/*
1142 		 * Under ldd(1), auxiliary filtees that can't be loaded are
1143 		 * ignored, unless verbose errors are requested.
1144 		 */
1145 		if ((rtld_flags & RT_FL_SILENCERR) &&
1146 		    ((lml->lm_flags & LML_FLG_TRC_VERBOSE) == 0))
1147 			return;
1148 
1149 		if (secure)
1150 			trace_so(clmp, rej, name, 0, 0,
1151 			    MSG_INTL(MSG_LDD_SEC_NFOUND));
1152 		else
1153 			trace_so(clmp, rej, name, 0, 0,
1154 			    MSG_INTL(MSG_LDD_FIL_NFOUND));
1155 		return;
1156 	}
1157 
1158 	if (rej->rej_type) {
1159 		eprintf(lml, ERR_FATAL, MSG_INTL(err_reject[rej->rej_type]),
1160 		    rej->rej_name ? rej->rej_name : MSG_INTL(MSG_STR_UNKNOWN),
1161 		    conv_reject_desc(rej));
1162 		return;
1163 	}
1164 
1165 	if (secure)
1166 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SEC_OPEN), name);
1167 	else
1168 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN), name,
1169 		    strerror(ENOENT));
1170 }
1171 
1172 static int
1173 file_open(int err, Lm_list *lml, const char *oname, const char *nname,
1174     Rt_map *clmp, uint_t flags, Fdesc *fdesc, Rej_desc *rej)
1175 {
1176 	struct stat	status;
1177 	Rt_map		*nlmp;
1178 	int		resolved = 0;
1179 
1180 	fdesc->fd_oname = oname;
1181 
1182 	if ((err == 0) && (fdesc->fd_flags & FLG_FD_ALTER))
1183 		DBG_CALL(Dbg_file_config_obj(lml, oname, 0, nname));
1184 
1185 	/*
1186 	 * If we're dealing with a full pathname, determine whether this
1187 	 * pathname is already known.  Other pathnames fall through to the
1188 	 * dev/inode check, as even though the pathname may look the same as
1189 	 * one previously used, the process may have changed directory.
1190 	 */
1191 	if ((err == 0) && (nname[0] == '/')) {
1192 		if ((nlmp = fpavl_loaded(lml, nname,
1193 		    &(fdesc->fd_avlwhere))) != NULL) {
1194 			fdesc->fd_nname = nname;
1195 			fdesc->fd_lmp = nlmp;
1196 			return (1);
1197 		}
1198 	}
1199 
1200 	if ((err == 0) && ((stat(nname, &status)) != -1)) {
1201 		char	path[PATH_MAX];
1202 		int	fd, size, added;
1203 
1204 		/*
1205 		 * If this path has been constructed as part of expanding a
1206 		 * HWCAP directory, ignore any subdirectories.  As this is a
1207 		 * silent failure, where no rejection message is created, free
1208 		 * the original name to simplify the life of the caller.  For
1209 		 * any other reference that expands to a directory, fall through
1210 		 * to contruct a meaningful rejection message.
1211 		 */
1212 		if ((flags & FLG_RT_HWCAP) &&
1213 		    ((status.st_mode & S_IFMT) == S_IFDIR)) {
1214 			free((void *)nname);
1215 			return (0);
1216 		}
1217 
1218 		/*
1219 		 * Resolve the filename and determine whether the resolved name
1220 		 * is already known.  Typically, the previous fpavl_loaded()
1221 		 * will have caught this, as both NAME() and PATHNAME() for a
1222 		 * link-map are recorded in the FullNode AVL tree.  However,
1223 		 * instances exist where a file can be replaced (loop-back
1224 		 * mounts, bfu, etc.), and reference is made to the original
1225 		 * file through a symbolic link.  By checking the pathname here,
1226 		 * we don't fall through to the dev/inode check and conclude
1227 		 * that a new file should be loaded.
1228 		 */
1229 		if ((nname[0] == '/') && (rtld_flags & RT_FL_EXECNAME) &&
1230 		    ((size = resolvepath(nname, path, (PATH_MAX - 1))) > 0)) {
1231 			path[size] = '\0';
1232 
1233 			if (strcmp(nname, path)) {
1234 				if ((nlmp =
1235 				    fpavl_loaded(lml, path, 0)) != NULL) {
1236 					added = 0;
1237 
1238 					if (append_alias(nlmp, nname,
1239 					    &added) == 0)
1240 						return (0);
1241 					/* BEGIN CSTYLED */
1242 					if (added)
1243 					    DBG_CALL(Dbg_file_skip(LIST(clmp),
1244 						NAME(nlmp), nname));
1245 					/* END CSTYLED */
1246 					fdesc->fd_nname = nname;
1247 					fdesc->fd_lmp = nlmp;
1248 					return (1);
1249 				}
1250 
1251 				/*
1252 				 * If this pathname hasn't been loaded, save
1253 				 * the resolved pathname so that it doesn't
1254 				 * have to be recomputed as part of fullpath()
1255 				 * processing.
1256 				 */
1257 				if ((fdesc->fd_pname = strdup(path)) == NULL)
1258 					return (0);
1259 				resolved = 1;
1260 			} else {
1261 				/*
1262 				 * If the resolved name doesn't differ from the
1263 				 * original, save it without duplication.
1264 				 * Having fd_pname set indicates that no further
1265 				 * resolvepath processing is necessary.
1266 				 */
1267 				fdesc->fd_pname = nname;
1268 			}
1269 		}
1270 
1271 		if (nlmp = is_devinode_loaded(&status, lml, nname, flags)) {
1272 			if (flags & FLG_RT_AUDIT) {
1273 				/*
1274 				 * If we've been requested to load an auditor,
1275 				 * and an auditor of the same name already
1276 				 * exists, then the original auditor is used.
1277 				 */
1278 				DBG_CALL(Dbg_audit_skip(LIST(clmp),
1279 				    NAME(nlmp), LIST(nlmp)->lm_lmidstr));
1280 			} else {
1281 				/*
1282 				 * Otherwise, if an alternatively named file
1283 				 * has been found for the same dev/inode, add
1284 				 * a new name alias, and insert any alias full
1285 				 * pathname in the link-map lists AVL tree.
1286 				 */
1287 				added = 0;
1288 
1289 				if (append_alias(nlmp, nname, &added) == 0)
1290 					return (0);
1291 				if (added) {
1292 					if ((nname[0] == '/') &&
1293 					    (fpavl_insert(lml, nlmp,
1294 					    nname, 0) == 0))
1295 						return (0);
1296 					DBG_CALL(Dbg_file_skip(LIST(clmp),
1297 					    NAME(nlmp), nname));
1298 				}
1299 			}
1300 
1301 			/*
1302 			 * Record in the file descriptor the existing object
1303 			 * that satisfies this open request.
1304 			 */
1305 			fdesc->fd_nname = nname;
1306 			fdesc->fd_lmp = nlmp;
1307 			return (1);
1308 		}
1309 
1310 		if ((fd = open(nname, O_RDONLY, 0)) == -1) {
1311 			/*
1312 			 * As the file must exist for the previous stat() to
1313 			 * have succeeded, record the error condition.
1314 			 */
1315 			rej->rej_type = SGS_REJ_STR;
1316 			rej->rej_str = strerror(errno);
1317 		} else {
1318 			Fct	*ftp;
1319 
1320 			if ((ftp = are_u_this(rej, fd, &status, nname)) != 0) {
1321 				fdesc->fd_nname = nname;
1322 				fdesc->fd_ftp = ftp;
1323 				fdesc->fd_dev = status.st_dev;
1324 				fdesc->fd_ino = status.st_ino;
1325 				fdesc->fd_fd = fd;
1326 
1327 				/*
1328 				 * Trace that this open has succeeded.
1329 				 */
1330 				if (lml->lm_flags & LML_FLG_TRC_ENABLE) {
1331 					trace_so(clmp, 0, oname, nname,
1332 					    (fdesc->fd_flags & FLG_FD_ALTER),
1333 					    0);
1334 				}
1335 				return (1);
1336 			}
1337 			(void) close(fd);
1338 		}
1339 
1340 	} else if (errno != ENOENT) {
1341 		/*
1342 		 * If the open() failed for anything other than the file not
1343 		 * existing, record the error condition.
1344 		 */
1345 		rej->rej_type = SGS_REJ_STR;
1346 		rej->rej_str = strerror(errno);
1347 	}
1348 
1349 	/*
1350 	 * Indicate any rejection.
1351 	 */
1352 	if (rej->rej_type) {
1353 		/*
1354 		 * If this pathname was resolved and duplicated, remove the
1355 		 * allocated name to simplify the cleanup of the callers.
1356 		 */
1357 		if (resolved) {
1358 			free((void *)fdesc->fd_pname);
1359 			fdesc->fd_pname = NULL;
1360 		}
1361 		rej->rej_name = nname;
1362 		rej->rej_flag = (fdesc->fd_flags & FLG_FD_ALTER);
1363 		DBG_CALL(Dbg_file_rejected(lml, rej));
1364 	}
1365 	return (0);
1366 }
1367 
1368 /*
1369  * Find a full pathname (it contains a "/").
1370  */
1371 int
1372 find_path(Lm_list *lml, const char *oname, Rt_map *clmp, uint_t flags,
1373     Fdesc *fdesc, Rej_desc *rej)
1374 {
1375 	int	err = 0;
1376 
1377 	/*
1378 	 * If directory configuration exists determine if this path is known.
1379 	 */
1380 	if (rtld_flags & RT_FL_DIRCFG) {
1381 		Rtc_obj		*obj;
1382 		const char	*aname;
1383 
1384 		if ((obj = elf_config_ent(oname, (Word)elf_hash(oname),
1385 		    0, &aname)) != 0) {
1386 			/*
1387 			 * If the configuration file states that this path is a
1388 			 * directory, or the path is explicitly defined as
1389 			 * non-existent (ie. a unused platform specific
1390 			 * library), then go no further.
1391 			 */
1392 			if (obj->co_flags & RTC_OBJ_DIRENT) {
1393 				err = EISDIR;
1394 			} else if ((obj->co_flags &
1395 			    (RTC_OBJ_NOEXIST | RTC_OBJ_ALTER)) ==
1396 			    RTC_OBJ_NOEXIST) {
1397 				err = ENOENT;
1398 			} else if ((obj->co_flags & RTC_OBJ_ALTER) &&
1399 			    (rtld_flags & RT_FL_OBJALT) && (lml == &lml_main)) {
1400 				int	ret;
1401 
1402 				fdesc->fd_flags |= FLG_FD_ALTER;
1403 				/*
1404 				 * Attempt to open the alternative path.  If
1405 				 * this fails, and the alternative is flagged
1406 				 * as optional, fall through to open the
1407 				 * original path.
1408 				 */
1409 				DBG_CALL(Dbg_libs_found(lml, aname,
1410 				    FLG_FD_ALTER));
1411 				if (((ret = file_open(0, lml, oname, aname,
1412 				    clmp, flags, fdesc, rej)) != 0) ||
1413 				    ((obj->co_flags & RTC_OBJ_OPTINAL) == 0))
1414 					return (ret);
1415 
1416 				fdesc->fd_flags &= ~FLG_FD_ALTER;
1417 			}
1418 		}
1419 	}
1420 	DBG_CALL(Dbg_libs_found(lml, oname, 0));
1421 	return (file_open(err, lml, oname, oname, clmp, flags, fdesc, rej));
1422 }
1423 
1424 /*
1425  * Find a simple filename (it doesn't contain a "/").
1426  */
1427 static int
1428 _find_file(Lm_list *lml, const char *oname, const char *nname, Rt_map *clmp,
1429     uint_t flags, Fdesc *fdesc, Rej_desc *rej, Pnode *dir, int aflag)
1430 {
1431 	DBG_CALL(Dbg_libs_found(lml, nname, aflag));
1432 	if ((lml->lm_flags & LML_FLG_TRC_SEARCH) &&
1433 	    ((FLAGS1(clmp) & FL1_RT_LDDSTUB) == 0)) {
1434 		(void) printf(MSG_INTL(MSG_LDD_PTH_TRYING), nname, aflag ?
1435 		    MSG_INTL(MSG_LDD_FIL_ALTER) : MSG_ORIG(MSG_STR_EMPTY));
1436 	}
1437 
1438 	/*
1439 	 * If we're being audited tell the audit library of the file we're about
1440 	 * to go search for.  The audit library may offer an alternative
1441 	 * dependency, or indicate that this dependency should be ignored.
1442 	 */
1443 	if ((lml->lm_tflags | FLAGS1(clmp)) & LML_TFLG_AUD_OBJSEARCH) {
1444 		char	*aname = audit_objsearch(clmp, nname, dir->p_orig);
1445 
1446 		if (aname == 0) {
1447 			DBG_CALL(Dbg_audit_terminate(lml, nname));
1448 			return (0);
1449 		}
1450 
1451 		/*
1452 		 * Protect ourselves from auditor mischief, by copying any
1453 		 * alternative name over the present name (the present name is
1454 		 * maintained in a static buffer - see elf_get_so());
1455 		 */
1456 		if (nname != aname)
1457 			(void) strncpy((char *)nname, aname, PATH_MAX);
1458 	}
1459 	return (file_open(0, lml, oname, nname, clmp, flags, fdesc, rej));
1460 }
1461 
1462 static int
1463 find_file(Lm_list *lml, const char *oname, Rt_map *clmp, uint_t flags,
1464     Fdesc *fdesc, Rej_desc *rej, Pnode *dir, Word * strhash, size_t olen)
1465 {
1466 	static Rtc_obj	Obj = { 0 };
1467 	Rtc_obj *	dobj;
1468 	const char	*nname = oname;
1469 
1470 	if (dir->p_name == 0)
1471 		return (0);
1472 	if (dir->p_info) {
1473 		dobj = (Rtc_obj *)dir->p_info;
1474 		if ((dobj->co_flags &
1475 		    (RTC_OBJ_NOEXIST | RTC_OBJ_ALTER)) == RTC_OBJ_NOEXIST)
1476 			return (0);
1477 	} else
1478 		dobj = 0;
1479 
1480 	/*
1481 	 * If configuration information exists see if this directory/file
1482 	 * combination exists.
1483 	 */
1484 	if ((rtld_flags & RT_FL_DIRCFG) &&
1485 	    ((dobj == 0) || (dobj->co_id != 0))) {
1486 		Rtc_obj		*fobj;
1487 		const char	*alt = 0;
1488 
1489 		/*
1490 		 * If this pnode has not yet been searched for in the
1491 		 * configuration file go find it.
1492 		 */
1493 		if (dobj == 0) {
1494 			dobj = elf_config_ent(dir->p_name,
1495 			    (Word)elf_hash(dir->p_name), 0, 0);
1496 			if (dobj == 0)
1497 				dobj = &Obj;
1498 			dir->p_info = (void *)dobj;
1499 
1500 			if ((dobj->co_flags & (RTC_OBJ_NOEXIST |
1501 			    RTC_OBJ_ALTER)) == RTC_OBJ_NOEXIST)
1502 				return (0);
1503 		}
1504 
1505 		/*
1506 		 * If we found a directory search for the file.
1507 		 */
1508 		if (dobj->co_id != 0) {
1509 			if (*strhash == 0)
1510 				*strhash = (Word)elf_hash(nname);
1511 			fobj = elf_config_ent(nname, *strhash,
1512 			    dobj->co_id, &alt);
1513 
1514 			/*
1515 			 * If this object specifically does not exist, or the
1516 			 * object can't be found in a know-all-entries
1517 			 * directory, continue looking.  If the object does
1518 			 * exist determine if an alternative object exists.
1519 			 */
1520 			if (fobj == 0) {
1521 				if (dobj->co_flags & RTC_OBJ_ALLENTS)
1522 					return (0);
1523 			} else {
1524 				if ((fobj->co_flags & (RTC_OBJ_NOEXIST |
1525 				    RTC_OBJ_ALTER)) == RTC_OBJ_NOEXIST)
1526 					return (0);
1527 
1528 				if ((fobj->co_flags & RTC_OBJ_ALTER) &&
1529 				    (rtld_flags & RT_FL_OBJALT) &&
1530 				    (lml == &lml_main)) {
1531 					int	ret;
1532 
1533 					fdesc->fd_flags |= FLG_FD_ALTER;
1534 					/*
1535 					 * Attempt to open the alternative path.
1536 					 * If this fails, and the alternative is
1537 					 * flagged as optional, fall through to
1538 					 * open the original path.
1539 					 */
1540 					ret = _find_file(lml, oname, alt, clmp,
1541 					    flags, fdesc, rej, dir, 1);
1542 					if (ret || ((fobj->co_flags &
1543 					    RTC_OBJ_OPTINAL) == 0))
1544 						return (ret);
1545 
1546 					fdesc->fd_flags &= ~FLG_FD_ALTER;
1547 				}
1548 			}
1549 		}
1550 	}
1551 
1552 	/*
1553 	 * Protect ourselves from building an invalid pathname.
1554 	 */
1555 	if ((olen + dir->p_len + 1) >= PATH_MAX) {
1556 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN), nname,
1557 		    strerror(ENAMETOOLONG));
1558 			return (0);
1559 	}
1560 	if ((nname = (LM_GET_SO(clmp)(dir->p_name, nname))) == 0)
1561 		return (0);
1562 
1563 	return (_find_file(lml, oname, nname, clmp, flags, fdesc, rej, dir, 0));
1564 }
1565 
1566 /*
1567  * A unique file has been opened.  Create a link-map to represent it, and
1568  * process the various names by which it can be referenced.
1569  */
1570 static Rt_map *
1571 load_file(Lm_list *lml, Aliste lmco, Fdesc *fdesc)
1572 {
1573 	const char	*oname = fdesc->fd_oname;
1574 	const char	*nname = fdesc->fd_nname;
1575 	Rt_map		*nlmp;
1576 
1577 	/*
1578 	 * Typically we call fct_map_so() with the full pathname of the opened
1579 	 * file (nname) and the name that started the search (oname), thus for
1580 	 * a typical dependency on libc this would be /usr/lib/libc.so.1 and
1581 	 * libc.so.1 (DT_NEEDED).  The original name is maintained on an ALIAS
1582 	 * list for comparison when bringing in new dependencies.  If the user
1583 	 * specified name as a full path (from a dlopen() for example) then
1584 	 * there's no need to create an ALIAS.
1585 	 */
1586 	if (strcmp(oname, nname) == 0)
1587 		oname = 0;
1588 
1589 	/*
1590 	 * A new file has been opened, now map it into the process.  Close the
1591 	 * original file so as not to accumulate file descriptors.
1592 	 */
1593 	nlmp = ((fdesc->fd_ftp)->fct_map_so)(lml, lmco, nname, oname,
1594 	    fdesc->fd_fd);
1595 	(void) close(fdesc->fd_fd);
1596 	fdesc->fd_fd = 0;
1597 
1598 	if (nlmp == 0)
1599 		return (0);
1600 
1601 	/*
1602 	 * Save the dev/inode information for later comparisons.
1603 	 */
1604 	STDEV(nlmp) = fdesc->fd_dev;
1605 	STINO(nlmp) = fdesc->fd_ino;
1606 
1607 	/*
1608 	 * Insert the names of this link-map into the FullpathNode AVL tree.
1609 	 * Save both the NAME() and PATHNAME() is they differ.
1610 	 *
1611 	 * If this is an OBJECT file, don't insert it yet as this is only a
1612 	 * temporary link-map.  During elf_obj_fini() the final link-map is
1613 	 * created, and its names will be inserted in the FullpathNode AVL
1614 	 * tree at that time.
1615 	 */
1616 	if ((FLAGS(nlmp) & FLG_RT_OBJECT) == 0) {
1617 		/*
1618 		 * Update the objects full path information if necessary.
1619 		 * Note, with pathname expansion in effect, the fd_pname will
1620 		 * be used as PATHNAME().  This allocated string will be freed
1621 		 * should this object be deleted.  However, without pathname
1622 		 * expansion, the fd_name should be freed now, as it is no
1623 		 * longer referenced.
1624 		 */
1625 		if (FLAGS1(nlmp) & FL1_RT_RELATIVE)
1626 			(void) fullpath(nlmp, fdesc->fd_pname);
1627 		else if (fdesc->fd_pname != fdesc->fd_nname)
1628 			free((void *)fdesc->fd_pname);
1629 		fdesc->fd_pname = 0;
1630 
1631 		if ((NAME(nlmp)[0] == '/') && (fpavl_insert(lml, nlmp,
1632 		    NAME(nlmp), fdesc->fd_avlwhere) == 0)) {
1633 			remove_so(lml, nlmp);
1634 			return (0);
1635 		}
1636 		if (((NAME(nlmp)[0] != '/') ||
1637 		    (NAME(nlmp) != PATHNAME(nlmp))) &&
1638 		    (fpavl_insert(lml, nlmp, PATHNAME(nlmp), 0) == 0)) {
1639 			remove_so(lml, nlmp);
1640 			return (0);
1641 		}
1642 	}
1643 
1644 	/*
1645 	 * If we're processing an alternative object reset the original name
1646 	 * for possible $ORIGIN processing.
1647 	 */
1648 	if (fdesc->fd_flags & FLG_FD_ALTER) {
1649 		const char	*odir;
1650 		char		*ndir;
1651 		size_t		olen;
1652 
1653 		FLAGS(nlmp) |= FLG_RT_ALTER;
1654 
1655 		/*
1656 		 * If we were given a pathname containing a slash then the
1657 		 * original name is still in oname.  Otherwise the original
1658 		 * directory is in dir->p_name (which is all we need for
1659 		 * $ORIGIN).
1660 		 */
1661 		if (fdesc->fd_flags & FLG_FD_SLASH) {
1662 			char	*ofil;
1663 
1664 			odir = oname;
1665 			ofil = strrchr(oname, '/');
1666 			olen = ofil - odir + 1;
1667 		} else {
1668 			odir = fdesc->fd_odir;
1669 			olen = strlen(odir) + 1;
1670 		}
1671 
1672 		if ((ndir = (char *)malloc(olen)) == 0) {
1673 			remove_so(lml, nlmp);
1674 			return (0);
1675 		}
1676 		(void) strncpy(ndir, odir, olen);
1677 		ndir[--olen] = '\0';
1678 
1679 		ORIGNAME(nlmp) = ndir;
1680 		DIRSZ(nlmp) = olen;
1681 	}
1682 
1683 	/*
1684 	 * Identify this as a new object.
1685 	 */
1686 	FLAGS(nlmp) |= FLG_RT_NEWLOAD;
1687 
1688 	return (nlmp);
1689 }
1690 
1691 /*
1692  * This function loads the named file and returns a pointer to its link map.
1693  * It is assumed that the caller has already checked that the file is not
1694  * already loaded before calling this function (refer is_so_loaded()).
1695  * Find and open the file, map it into memory, add it to the end of the list
1696  * of link maps and return a pointer to the new link map.  Return 0 on error.
1697  */
1698 static Rt_map *
1699 load_so(Lm_list *lml, Aliste lmco, const char *oname, Rt_map *clmp,
1700     uint_t flags, Fdesc *nfdp, Rej_desc *rej)
1701 {
1702 	char		*name;
1703 	uint_t		slash = 0;
1704 	size_t		olen;
1705 	Fdesc		fdesc = { 0 };
1706 	Pnode		*dir;
1707 
1708 	/*
1709 	 * If the file is the run time linker then it's already loaded.
1710 	 */
1711 	if (interp && (strcmp(oname, NAME(lml_rtld.lm_head)) == 0))
1712 		return (lml_rtld.lm_head);
1713 
1714 	/*
1715 	 * If this isn't a hardware capabilites pathname, which is already a
1716 	 * full, duplicated pathname, determine whether the pathname contains
1717 	 * a slash, and if not determine the input filename (for max path
1718 	 * length verification).
1719 	 */
1720 	if ((flags & FLG_RT_HWCAP) == 0) {
1721 		const char	*str;
1722 
1723 		for (str = oname; *str; str++) {
1724 			if (*str == '/') {
1725 				slash++;
1726 				break;
1727 			}
1728 		}
1729 		if (slash == 0)
1730 			olen = (str - oname) + 1;
1731 	}
1732 
1733 	/*
1734 	 * If we are passed a 'null' link-map this means that this is the first
1735 	 * object to be loaded on this link-map list.  In that case we set the
1736 	 * link-map to ld.so.1's link-map.
1737 	 *
1738 	 * This link-map is referenced to determine what lookup rules to use
1739 	 * when searching for files.  By using ld.so.1's we are defaulting to
1740 	 * ELF look-up rules.
1741 	 *
1742 	 * Note: This case happens when loading the first object onto
1743 	 *	 the plt_tracing link-map.
1744 	 */
1745 	if (clmp == 0)
1746 		clmp = lml_rtld.lm_head;
1747 
1748 	/*
1749 	 * If this path resulted from a $HWCAP specification, then the best
1750 	 * hardware capability object has already been establish, and is
1751 	 * available in the calling file descriptor.  Perform some minor book-
1752 	 * keeping so that we can fall through into common code.
1753 	 */
1754 	if (flags & FLG_RT_HWCAP) {
1755 		/*
1756 		 * If this object is already loaded, we're done.
1757 		 */
1758 		if (nfdp->fd_lmp)
1759 			return (nfdp->fd_lmp);
1760 
1761 		/*
1762 		 * Obtain the avl index for this object.
1763 		 */
1764 		(void) fpavl_loaded(lml, nfdp->fd_nname, &(nfdp->fd_avlwhere));
1765 
1766 		/*
1767 		 * If the name and resolved pathname differ, duplicate the path
1768 		 * name once more to provide for genric cleanup by the caller.
1769 		 */
1770 		if (nfdp->fd_pname && (nfdp->fd_nname != nfdp->fd_pname)) {
1771 			char	*pname;
1772 
1773 			if ((pname = strdup(nfdp->fd_pname)) == NULL)
1774 				return (0);
1775 			nfdp->fd_pname = pname;
1776 		}
1777 	} else if (slash) {
1778 		Rej_desc	_rej = { 0 };
1779 
1780 		*nfdp = fdesc;
1781 		nfdp->fd_flags = FLG_FD_SLASH;
1782 
1783 		if (find_path(lml, oname, clmp, flags, nfdp, &_rej) == 0) {
1784 			rejection_inherit(rej, &_rej);
1785 			return (0);
1786 		}
1787 
1788 		/*
1789 		 * If this object is already loaded, we're done.
1790 		 */
1791 		if (nfdp->fd_lmp)
1792 			return (nfdp->fd_lmp);
1793 
1794 	} else {
1795 		/*
1796 		 * No '/' - for each directory on list, make a pathname using
1797 		 * that directory and filename and try to open that file.
1798 		 */
1799 		Pnode		*dirlist = (Pnode *)0;
1800 		Word		strhash = 0;
1801 #if	!defined(ISSOLOAD_BASENAME_DISABLED)
1802 		Rt_map		*nlmp;
1803 #endif
1804 		DBG_CALL(Dbg_libs_find(lml, oname));
1805 
1806 #if	!defined(ISSOLOAD_BASENAME_DISABLED)
1807 		if ((nlmp = is_so_loaded(lml, oname)))
1808 			return (nlmp);
1809 #endif
1810 		/*
1811 		 * Make sure we clear the file descriptor new name in case the
1812 		 * following directory search doesn't provide any directories
1813 		 * (odd, but this can be forced with a -znodefaultlib test).
1814 		 */
1815 		*nfdp = fdesc;
1816 		for (dir = get_next_dir(&dirlist, clmp, flags); dir;
1817 		    dir = get_next_dir(&dirlist, clmp, flags)) {
1818 			Rej_desc	_rej = { 0 };
1819 
1820 			*nfdp = fdesc;
1821 
1822 			/*
1823 			 * Try and locate this file.  Make sure to clean up
1824 			 * any rejection information should the file have
1825 			 * been found, but not appropriate.
1826 			 */
1827 			if (find_file(lml, oname, clmp, flags, nfdp, &_rej,
1828 			    dir, &strhash, olen) == 0) {
1829 				rejection_inherit(rej, &_rej);
1830 				continue;
1831 			}
1832 
1833 			/*
1834 			 * If this object is already loaded, we're done.
1835 			 */
1836 			if (nfdp->fd_lmp)
1837 				return (nfdp->fd_lmp);
1838 
1839 			nfdp->fd_odir = dir->p_name;
1840 			break;
1841 		}
1842 
1843 		/*
1844 		 * If the file couldn't be loaded, do another comparison of
1845 		 * loaded files using just the basename.  This catches folks
1846 		 * who may have loaded multiple full pathname files (possibly
1847 		 * from setxid applications) to satisfy dependency relationships
1848 		 * (i.e., a file might have a dependency on foo.so.1 which has
1849 		 * already been opened using its full pathname).
1850 		 */
1851 		if (nfdp->fd_nname == NULL)
1852 			return (is_so_loaded(lml, oname));
1853 	}
1854 
1855 	/*
1856 	 * Duplicate the file name so that NAME() is available in core files.
1857 	 * Note, that hardware capability names are already duplicated, but
1858 	 * they get duplicated once more to insure consistent cleanup in the
1859 	 * event of an error condition.
1860 	 */
1861 	if ((name = strdup(nfdp->fd_nname)) == NULL)
1862 		return (0);
1863 
1864 	if (nfdp->fd_nname == nfdp->fd_pname)
1865 		nfdp->fd_nname = nfdp->fd_pname = name;
1866 	else
1867 		nfdp->fd_nname = name;
1868 
1869 	/*
1870 	 * Finish mapping the file and return the link-map descriptor.  Note,
1871 	 * if this request originated from a HWCAP request, re-establish the
1872 	 * fdesc information.  For single paged objects, such as filters, the
1873 	 * original mapping may have been sufficient to capture the file, thus
1874 	 * this mapping needs to be reset to insure it doesn't mistakenly get
1875 	 * unmapped as part of HWCAP cleanup.
1876 	 */
1877 	return (load_file(lml, lmco, nfdp));
1878 }
1879 
1880 /*
1881  * Trace an attempt to load an object.
1882  */
1883 int
1884 load_trace(Lm_list *lml, const char **oname, Rt_map *clmp)
1885 {
1886 	const char	*name = *oname;
1887 
1888 	/*
1889 	 * First generate any ldd(1) diagnostics.
1890 	 */
1891 	if ((lml->lm_flags & (LML_FLG_TRC_VERBOSE | LML_FLG_TRC_SEARCH)) &&
1892 	    ((FLAGS1(clmp) & FL1_RT_LDDSTUB) == 0))
1893 		(void) printf(MSG_INTL(MSG_LDD_FIL_FIND), name, NAME(clmp));
1894 
1895 	/*
1896 	 * If we're being audited tell the audit library of the file we're
1897 	 * about to go search for.
1898 	 */
1899 	if (((lml->lm_tflags | FLAGS1(clmp)) & LML_TFLG_AUD_ACTIVITY) &&
1900 	    (lml == LIST(clmp)))
1901 		audit_activity(clmp, LA_ACT_ADD);
1902 
1903 	if ((lml->lm_tflags | FLAGS1(clmp)) & LML_TFLG_AUD_OBJSEARCH) {
1904 		char	*aname = audit_objsearch(clmp, name, LA_SER_ORIG);
1905 
1906 		/*
1907 		 * The auditor can indicate that this object should be ignored.
1908 		 */
1909 		if (aname == NULL) {
1910 			DBG_CALL(Dbg_audit_terminate(lml, name));
1911 			return (0);
1912 		}
1913 
1914 		/*
1915 		 * Protect ourselves from auditor mischief, by duplicating any
1916 		 * alternative name.  The original name has been allocated from
1917 		 * expand(), so free this allocation before using the audit
1918 		 * alternative.
1919 		 */
1920 		if (name != aname) {
1921 			if ((aname = strdup(aname)) == NULL) {
1922 				eprintf(lml, ERR_FATAL,
1923 				    MSG_INTL(MSG_GEN_AUDITERM), name);
1924 				return (0);
1925 			}
1926 			free((void *)*oname);
1927 			*oname = aname;
1928 		}
1929 	}
1930 	return (1);
1931 }
1932 
1933 /*
1934  * Having loaded an object and created a link-map to describe it, finish
1935  * processing this stage, including verifying any versioning requirements,
1936  * updating the objects mode, creating a handle if necessary, and adding this
1937  * object to existing handles if required.
1938  */
1939 static int
1940 load_finish(Lm_list *lml, const char *name, Rt_map *clmp, int nmode,
1941     uint_t flags, Grp_hdl **hdl, Rt_map *nlmp)
1942 {
1943 	Aliste		off;
1944 	Grp_hdl		*ghp, **ghpp;
1945 	int		promote;
1946 
1947 	/*
1948 	 * If this dependency is associated with a required version insure that
1949 	 * the version is present in the loaded file.
1950 	 */
1951 	if (((rtld_flags & RT_FL_NOVERSION) == 0) &&
1952 	    (FCT(clmp) == &elf_fct) && VERNEED(clmp) &&
1953 	    (LM_VERIFY_VERS(clmp)(name, clmp, nlmp) == 0))
1954 		return (0);
1955 
1956 	/*
1957 	 * If this object has indicated that it should be isolated as a group
1958 	 * (DT_FLAGS_1 contains DF_1_GROUP - object was built with -B group),
1959 	 * or if the callers direct bindings indicate it should be isolated as
1960 	 * a group (DYNINFO flags contains FLG_DI_GROUP - dependency followed
1961 	 * -zgroupperm), establish the appropriate mode.
1962 	 *
1963 	 * The intent of an object defining itself as a group is to isolate the
1964 	 * relocation of the group within its own members, however, unless
1965 	 * opened through dlopen(), in which case we assume dlsym() will be used
1966 	 * to located symbols in the new object, we still need to associate it
1967 	 * with the caller for it to be bound with.  This is equivalent to a
1968 	 * dlopen(RTLD_GROUP) and dlsym() using the returned handle.
1969 	 */
1970 	if ((FLAGS(nlmp) | flags) & FLG_RT_SETGROUP) {
1971 		nmode &= ~RTLD_WORLD;
1972 		nmode |= RTLD_GROUP;
1973 
1974 		/*
1975 		 * If the object wasn't explicitly dlopen()'ed associate it with
1976 		 * the parent.
1977 		 */
1978 		if ((flags & FLG_RT_HANDLE) == 0)
1979 			nmode |= RTLD_PARENT;
1980 	}
1981 
1982 	/*
1983 	 * Establish new mode and flags.
1984 	 *
1985 	 * For patch backward compatibility, the following use of update_mode()
1986 	 * is disabled.
1987 	 */
1988 #ifdef	SIEBEL_DISABLE
1989 	if (rtld_flags & RT_FL_DISFIX_1)
1990 		promote = MODE(nlmp) |=
1991 		    (nmode & ~(RTLD_PARENT | RTLD_NOLOAD | RTLD_FIRST));
1992 	else
1993 #endif
1994 		promote = update_mode(nlmp, MODE(nlmp), nmode);
1995 
1996 	FLAGS(nlmp) |= flags;
1997 
1998 	/*
1999 	 * If this is a global object, ensure the associated link-map list can
2000 	 * be rescanned for global, lazy dependencies.
2001 	 */
2002 	if (MODE(nlmp) & RTLD_GLOBAL)
2003 		LIST(nlmp)->lm_flags &= ~LML_FLG_NOPENDGLBLAZY;
2004 
2005 	/*
2006 	 * If we've been asked to establish a handle create one for this object.
2007 	 * Or, if this object has already been analyzed, but this reference
2008 	 * requires that the mode of the object be promoted, also create a
2009 	 * handle to propagate the new modes to all this objects dependencies.
2010 	 */
2011 	if (((FLAGS(nlmp) | flags) & FLG_RT_HANDLE) || (promote &&
2012 	    (FLAGS(nlmp) & FLG_RT_ANALYZED))) {
2013 		uint_t	oflags, hflags = 0;
2014 
2015 		if (nmode & RTLD_PARENT)
2016 			hflags |=  GPH_PARENT;
2017 		if (nmode & RTLD_FIRST)
2018 			hflags |=  GPH_FIRST;
2019 
2020 		/*
2021 		 * Now that a handle is being created, remove this state from
2022 		 * the object so that it doesn't mistakenly get inherited by
2023 		 * a dependency.
2024 		 */
2025 		oflags = FLAGS(nlmp);
2026 		FLAGS(nlmp) &= ~FLG_RT_HANDLE;
2027 
2028 		if ((ghp = hdl_create(lml, nlmp, clmp, hflags)) == 0)
2029 			return (0);
2030 
2031 		/*
2032 		 * Add any dependencies that are already loaded, to the handle.
2033 		 */
2034 		if (hdl_initialize(ghp, nlmp, nmode, promote) == 0)
2035 			return (0);
2036 
2037 		if (hdl)
2038 			*hdl = ghp;
2039 
2040 		/*
2041 		 * If we were asked to create a handle, we're done.  Otherwise,
2042 		 * remove the handle. The handle was only used to establish this
2043 		 * objects dependencies and promote any modes, so we don't want
2044 		 * this handle preventing the objects deletion.  Fall through to
2045 		 * carry out any group processing.
2046 		 */
2047 		if ((oflags | flags) & FLG_RT_HANDLE)
2048 			return (1);
2049 
2050 		free_hdl(ghp);
2051 	}
2052 
2053 	/*
2054 	 * If the caller isn't part of a group we're done.
2055 	 */
2056 	if (GROUPS(clmp) == 0)
2057 		return (1);
2058 
2059 	/*
2060 	 * Determine if our caller is already associated with a handle, if so
2061 	 * we need to add this object to any handles that already exist.
2062 	 * Traverse the list of groups our caller is a member of and add this
2063 	 * new link-map to those groups.
2064 	 */
2065 	DBG_CALL(Dbg_file_hdl_title(DBG_DEP_ADD));
2066 	for (ALIST_TRAVERSE(GROUPS(clmp), off, ghpp)) {
2067 		Aliste		off1;
2068 		Grp_desc	*gdp;
2069 		int		exist;
2070 		Rt_map		**lmpp;
2071 		Alist		*lmalp = 0;
2072 
2073 		ghp = *ghpp;
2074 
2075 		/*
2076 		 * If the caller doesn't indicate that its dependencies should
2077 		 * be added to a handle, ignore it.  This case identifies a
2078 		 * parent of a dlopen(RTLD_PARENT) request.
2079 		 */
2080 		for (ALIST_TRAVERSE(ghp->gh_depends, off1, gdp)) {
2081 			if (gdp->gd_depend == clmp)
2082 				break;
2083 		}
2084 		if ((gdp->gd_flags & GPD_ADDEPS) == 0)
2085 			continue;
2086 
2087 		if ((exist = hdl_add(ghp, nlmp,
2088 		    (GPD_AVAIL | GPD_ADDEPS))) == 0)
2089 			return (0);
2090 
2091 		/*
2092 		 * If this member already exists then its dependencies will
2093 		 * have already been processed.
2094 		 */
2095 		if (exist == ALE_EXISTS)
2096 			continue;
2097 
2098 		/*
2099 		 * If the object we've added has just been opened, it will not
2100 		 * yet have been processed for its dependencies, these will be
2101 		 * added on later calls to load_one().  If it doesn't have any
2102 		 * dependencies we're also done.
2103 		 */
2104 		if (((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0) ||
2105 		    (DEPENDS(nlmp) == 0))
2106 			continue;
2107 
2108 		/*
2109 		 * Otherwise, this object exists and has dependencies, so add
2110 		 * all of its dependencies to the handle were operating on.
2111 		 */
2112 		if (alist_append(&lmalp, &nlmp, sizeof (Rt_map *),
2113 		    AL_CNT_DEPCLCT) == 0)
2114 			return (0);
2115 
2116 		for (ALIST_TRAVERSE(lmalp, off1, lmpp)) {
2117 			Rt_map *	dlmp1 = *lmpp;
2118 			Aliste		off2;
2119 			Bnd_desc **	bdpp;
2120 
2121 			/*
2122 			 * Add any dependencies of this dependency to the
2123 			 * dynamic dependency list so they can be further
2124 			 * processed.
2125 			 */
2126 			for (ALIST_TRAVERSE(DEPENDS(dlmp1), off2, bdpp)) {
2127 				Bnd_desc *	bdp = *bdpp;
2128 				Rt_map *	dlmp2 = bdp->b_depend;
2129 
2130 				if ((bdp->b_flags & BND_NEEDED) == 0)
2131 					continue;
2132 
2133 				if (alist_test(&lmalp, dlmp2, sizeof (Rt_map *),
2134 				    AL_CNT_DEPCLCT) == 0) {
2135 					free(lmalp);
2136 					return (0);
2137 				}
2138 			}
2139 
2140 			if (nlmp == dlmp1)
2141 				continue;
2142 
2143 			if ((exist = hdl_add(ghp, dlmp1,
2144 			    (GPD_AVAIL | GPD_ADDEPS))) != 0) {
2145 				if (exist == ALE_CREATE) {
2146 					(void) update_mode(dlmp1, MODE(dlmp1),
2147 					    nmode);
2148 				}
2149 				continue;
2150 			}
2151 			free(lmalp);
2152 			return (0);
2153 		}
2154 		free(lmalp);
2155 	}
2156 	return (1);
2157 }
2158 
2159 /*
2160  * The central routine for loading shared objects.  Insures ldd() diagnostics,
2161  * handles and any other related additions are all done in one place.
2162  */
2163 static Rt_map *
2164 _load_path(Lm_list *lml, Aliste lmco, const char **oname, Rt_map *clmp,
2165     int nmode, uint_t flags, Grp_hdl ** hdl, Fdesc *nfdp, Rej_desc *rej)
2166 {
2167 	Rt_map		*nlmp;
2168 	const char	*name = *oname;
2169 
2170 	if ((nmode & RTLD_NOLOAD) == 0) {
2171 		/*
2172 		 * If this isn't a noload request attempt to load the file.
2173 		 * Note, the name of the file may be changed by an auditor.
2174 		 */
2175 		if ((load_trace(lml, oname, clmp)) == 0)
2176 			return (0);
2177 
2178 		name = *oname;
2179 
2180 		if ((nlmp = load_so(lml, lmco, name, clmp, flags,
2181 		    nfdp, rej)) == 0)
2182 			return (0);
2183 
2184 		/*
2185 		 * If we've loaded a library which identifies itself as not
2186 		 * being dlopen()'able catch it here.  Let non-dlopen()'able
2187 		 * objects through under RTLD_CONFGEN as they're only being
2188 		 * mapped to be dldump()'ed.
2189 		 */
2190 		if ((rtld_flags & RT_FL_APPLIC) && ((FLAGS(nlmp) &
2191 		    (FLG_RT_NOOPEN | FLG_RT_RELOCED)) == FLG_RT_NOOPEN) &&
2192 		    ((nmode & RTLD_CONFGEN) == 0)) {
2193 			Rej_desc	_rej = { 0 };
2194 
2195 			_rej.rej_name = name;
2196 			_rej.rej_type = SGS_REJ_STR;
2197 			_rej.rej_str = MSG_INTL(MSG_GEN_NOOPEN);
2198 			DBG_CALL(Dbg_file_rejected(lml, &_rej));
2199 			rejection_inherit(rej, &_rej);
2200 			remove_so(lml, nlmp);
2201 			return (0);
2202 		}
2203 	} else {
2204 		/*
2205 		 * If it's a NOLOAD request - check to see if the object
2206 		 * has already been loaded.
2207 		 */
2208 		/* LINTED */
2209 		if (nlmp = is_so_loaded(lml, name)) {
2210 			if ((lml->lm_flags & LML_FLG_TRC_VERBOSE) &&
2211 			    ((FLAGS1(clmp) & FL1_RT_LDDSTUB) == 0)) {
2212 				(void) printf(MSG_INTL(MSG_LDD_FIL_FIND), name,
2213 				    NAME(clmp));
2214 				/* BEGIN CSTYLED */
2215 				if (*name == '/')
2216 				    (void) printf(MSG_ORIG(MSG_LDD_FIL_PATH),
2217 					name, MSG_ORIG(MSG_STR_EMPTY),
2218 					MSG_ORIG(MSG_STR_EMPTY));
2219 				else
2220 				    (void) printf(MSG_ORIG(MSG_LDD_FIL_EQUIV),
2221 					name, NAME(nlmp),
2222 					MSG_ORIG(MSG_STR_EMPTY),
2223 					MSG_ORIG(MSG_STR_EMPTY));
2224 				/* END CSTYLED */
2225 			}
2226 		} else {
2227 			Rej_desc	_rej = { 0 };
2228 
2229 			_rej.rej_name = name;
2230 			_rej.rej_type = SGS_REJ_STR;
2231 			_rej.rej_str = strerror(ENOENT);
2232 			DBG_CALL(Dbg_file_rejected(lml, &_rej));
2233 			rejection_inherit(rej, &_rej);
2234 			return (0);
2235 		}
2236 	}
2237 
2238 	/*
2239 	 * Finish processing this loaded object.
2240 	 */
2241 	if (load_finish(lml, name, clmp, nmode, flags, hdl, nlmp) == 0) {
2242 		FLAGS(nlmp) &= ~FLG_RT_NEWLOAD;
2243 
2244 		/*
2245 		 * If this object has already been analyzed, then it is in use,
2246 		 * so even though this operation has failed, it should not be
2247 		 * torn down.
2248 		 */
2249 		if ((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0)
2250 			remove_so(lml, nlmp);
2251 		return (0);
2252 	}
2253 
2254 	/*
2255 	 * If this object is new, and we're being audited, tell the audit
2256 	 * library of the file we've just opened.  Note, if the new link-map
2257 	 * requires local auditing of its dependencies we also register its
2258 	 * opening.
2259 	 */
2260 	if (FLAGS(nlmp) & FLG_RT_NEWLOAD) {
2261 		FLAGS(nlmp) &= ~FLG_RT_NEWLOAD;
2262 
2263 		if (((lml->lm_tflags | FLAGS1(clmp) | FLAGS1(nlmp)) &
2264 		    LML_TFLG_AUD_MASK) && (((lml->lm_flags |
2265 		    LIST(clmp)->lm_flags) & LML_FLG_NOAUDIT) == 0)) {
2266 			if (audit_objopen(clmp, nlmp) == 0) {
2267 				remove_so(lml, nlmp);
2268 				return (0);
2269 			}
2270 		}
2271 	}
2272 	return (nlmp);
2273 }
2274 
2275 Rt_map *
2276 load_path(Lm_list *lml, Aliste lmco, const char **name, Rt_map *clmp,
2277     int nmode, uint_t flags, Grp_hdl **hdl, Fdesc *cfdp, Rej_desc *rej)
2278 {
2279 	Rt_map	*lmp;
2280 	Fdesc	nfdp = { 0 };
2281 
2282 	/*
2283 	 * If this path resulted from a $HWCAP specification, then the best
2284 	 * hardware capability object has already been establish, and is
2285 	 * available in the calling file descriptor.
2286 	 */
2287 	if (flags & FLG_RT_HWCAP) {
2288 		if (cfdp->fd_lmp == 0) {
2289 			/*
2290 			 * If this object hasn't yet been mapped, re-establish
2291 			 * the file descriptor structure to reflect this objects
2292 			 * original initial page mapping.  Make sure any present
2293 			 * file descriptor mapping is removed before overwriting
2294 			 * the structure.
2295 			 */
2296 #if	defined(MAP_ALIGN)
2297 			if (fmap->fm_maddr &&
2298 			    ((fmap->fm_mflags & MAP_ALIGN) == 0))
2299 #else
2300 			if (fmap->fm_maddr)
2301 #endif
2302 				(void) munmap(fmap->fm_maddr, fmap->fm_msize);
2303 		}
2304 		nfdp = *cfdp;
2305 		*fmap = cfdp->fd_fmap;
2306 	}
2307 
2308 	lmp = _load_path(lml, lmco, name, clmp, nmode, flags, hdl, &nfdp, rej);
2309 
2310 	/*
2311 	 * If this path originated from a $HWCAP specification, re-establish the
2312 	 * fdesc information.  For single paged objects, such as filters, the
2313 	 * original mapping may have been sufficient to capture the file, thus
2314 	 * this mapping needs to be reset to insure it doesn't mistakenly get
2315 	 * unmapped as part of HWCAP cleanup.
2316 	 */
2317 	if (flags & FLG_RT_HWCAP) {
2318 		cfdp->fd_fmap.fm_maddr = fmap->fm_maddr;
2319 		cfdp->fd_fmap.fm_mflags = fmap->fm_mflags;
2320 		cfdp->fd_fd = nfdp.fd_fd;
2321 	}
2322 
2323 	return (lmp);
2324 }
2325 
2326 /*
2327  * Load one object from a possible list of objects.  Typically, for requests
2328  * such as NEEDED's, only one object is specified.  However, this object could
2329  * be specified using $ISALIST or $HWCAP, in which case only the first object
2330  * that can be loaded is used (ie. the best).
2331  */
2332 Rt_map *
2333 load_one(Lm_list *lml, Aliste lmco, Pnode *pnp, Rt_map *clmp, int mode,
2334     uint_t flags, Grp_hdl ** hdl)
2335 {
2336 	Rej_desc	rej = { 0 };
2337 	Pnode   	*tpnp;
2338 	const char	*name;
2339 
2340 	for (tpnp = pnp; tpnp && tpnp->p_name; tpnp = tpnp->p_next) {
2341 		Rt_map	*tlmp;
2342 
2343 		/*
2344 		 * A Hardware capabilities requirement can itself expand into
2345 		 * a number of candidates.
2346 		 */
2347 		if (tpnp->p_orig & PN_TKN_HWCAP) {
2348 			if ((tlmp = load_hwcap(lml, lmco, tpnp->p_name, clmp,
2349 			    mode, (flags | FLG_RT_HWCAP), hdl, &rej)) != 0) {
2350 				remove_rej(&rej);
2351 				return (tlmp);
2352 			}
2353 		} else {
2354 			if ((tlmp = load_path(lml, lmco, &tpnp->p_name, clmp,
2355 			    mode, flags, hdl, 0, &rej)) != 0) {
2356 				remove_rej(&rej);
2357 				return (tlmp);
2358 			}
2359 		}
2360 	}
2361 
2362 	/*
2363 	 * If this pathname originated from an expanded token, use the original
2364 	 * for any diagnostic output.
2365 	 */
2366 	if ((name = pnp->p_oname) == 0)
2367 		name = pnp->p_name;
2368 
2369 	file_notfound(lml, name, clmp, flags, &rej);
2370 	remove_rej(&rej);
2371 	return (0);
2372 }
2373 
2374 /*
2375  * Determine whether a symbol is defined as an interposer.
2376  */
2377 int
2378 is_sym_interposer(Rt_map *lmp, Sym *sym)
2379 {
2380 	Syminfo	*sip = SYMINFO(lmp);
2381 
2382 	if (sip) {
2383 		ulong_t	ndx;
2384 
2385 		ndx = (((ulong_t)sym - (ulong_t)SYMTAB(lmp)) / SYMENT(lmp));
2386 		/* LINTED */
2387 		sip = (Syminfo *)((char *)sip + (ndx * SYMINENT(lmp)));
2388 		if (sip->si_flags & SYMINFO_FLG_INTERPOSE)
2389 			return (1);
2390 	}
2391 	return (0);
2392 }
2393 
2394 /*
2395  * While processing direct or group bindings, determine whether the object to
2396  * which we've bound can be interposed upon.  In this context, copy relocations
2397  * are a form of interposition.
2398  */
2399 static Sym *
2400 lookup_sym_interpose(Slookup *slp, Rt_map **dlmp, uint_t *binfo, Lm_list *lml,
2401     Sym *sym)
2402 {
2403 	Rt_map		*lmp;
2404 	Slookup		sl;
2405 
2406 	/*
2407 	 * If we've bound to a copy relocation definition then we need to assign
2408 	 * this binding to the original copy reference.  Fabricate an inter-
2409 	 * position diagnostic, as this is a legitimate form of interposition.
2410 	 */
2411 	if (FLAGS1(*dlmp) & FL1_RT_COPYTOOK) {
2412 		Rel_copy	*rcp;
2413 		Aliste		off;
2414 
2415 		for (ALIST_TRAVERSE(COPY(*dlmp), off, rcp)) {
2416 			if ((sym == rcp->r_dsym) || (sym->st_value &&
2417 			    (sym->st_value == rcp->r_dsym->st_value))) {
2418 				*dlmp = rcp->r_rlmp;
2419 				*binfo |=
2420 				    (DBG_BINFO_INTERPOSE | DBG_BINFO_COPYREF);
2421 				return (rcp->r_rsym);
2422 			}
2423 		}
2424 	}
2425 
2426 	if ((lml->lm_flags & LML_FLG_INTRPOSE) == 0)
2427 		return ((Sym *)0);
2428 
2429 	/*
2430 	 * Traverse the list of known interposers to determine whether any
2431 	 * offer the same symbol.  Note, the head of the link-map could be
2432 	 * identified as an interposer.  If it is, make sure we only look for
2433 	 * symbol definitions.  Otherwise, skip the head of the link-map, so
2434 	 * that we don't bind to any .plt references, or copy-relocations
2435 	 * unintentionally.
2436 	 */
2437 	lmp = lml->lm_head;
2438 	sl = *slp;
2439 	if (((FLAGS(lmp) & MSK_RT_INTPOSE) == 0) || (sl.sl_flags & LKUP_COPY))
2440 		lmp = (Rt_map *)NEXT(lmp);
2441 	else
2442 		sl.sl_flags &= ~LKUP_SPEC;
2443 
2444 	for (; lmp; lmp = (Rt_map *)NEXT(lmp)) {
2445 		if (FLAGS(lmp) & FLG_RT_DELETE)
2446 			continue;
2447 		if ((FLAGS(lmp) & MSK_RT_INTPOSE) == 0)
2448 			break;
2449 
2450 		if (callable(lmp, *dlmp, 0)) {
2451 			Rt_map	*ilmp;
2452 
2453 			sl.sl_imap = lmp;
2454 			if (sym = SYMINTP(lmp)(&sl, &ilmp, binfo)) {
2455 				/*
2456 				 * If this object provides individual symbol
2457 				 * interposers, make sure that the symbol we
2458 				 * have found is tagged as an interposer.
2459 				 */
2460 				if ((FLAGS(ilmp) & FLG_RT_SYMINTPO) &&
2461 				    (is_sym_interposer(ilmp, sym) == 0))
2462 					continue;
2463 
2464 				/*
2465 				 * Indicate this binding has occurred to an
2466 				 * interposer, and return the symbol.
2467 				 */
2468 				*binfo |= DBG_BINFO_INTERPOSE;
2469 				*dlmp = ilmp;
2470 				return (sym);
2471 			}
2472 		}
2473 	}
2474 	return ((Sym *)0);
2475 }
2476 
2477 /*
2478  * If an object specifies direct bindings (it contains a syminfo structure
2479  * describing where each binding was established during link-editing, and the
2480  * object was built -Bdirect), then look for the symbol in the specific object.
2481  */
2482 static Sym *
2483 lookup_sym_direct(Slookup *slp, Rt_map **dlmp, uint_t *binfo, Syminfo *sip,
2484     Rt_map *lmp)
2485 {
2486 	Rt_map	*clmp = slp->sl_cmap;
2487 	Sym	*sym;
2488 	Slookup	sl;
2489 
2490 	/*
2491 	 * If a direct binding resolves to the definition of a copy relocated
2492 	 * variable, it must be redirected to the copy (in the executable) that
2493 	 * will eventually be made.  Typically, this redirection occurs in
2494 	 * lookup_sym_interpose().  But, there's an edge condition.  If a
2495 	 * directly bound executable contains pic code, there may be a
2496 	 * reference to a definition that will eventually have a copy made.
2497 	 * However, this copy relocation may not yet have occurred, because
2498 	 * the relocation making this reference comes before the relocation
2499 	 * that will create the copy.
2500 	 * Under direct bindings, the syminfo indicates that a copy will be
2501 	 * taken (SYMINFO_FLG_COPY).  This can only be set in an executable.
2502 	 * Thus, the caller must be the executable, so bind to the destination
2503 	 * of the copy within the executable.
2504 	 */
2505 	if (((slp->sl_flags & LKUP_COPY) == 0) &&
2506 	    (sip->si_flags & SYMINFO_FLG_COPY)) {
2507 
2508 		slp->sl_imap = LIST(clmp)->lm_head;
2509 		if (sym = SYMINTP(clmp)(slp, dlmp, binfo))
2510 			*binfo |= (DBG_BINFO_DIRECT | DBG_BINFO_COPYREF);
2511 		return (sym);
2512 	}
2513 
2514 	/*
2515 	 * If we need to direct bind to our parent start looking in each caller
2516 	 * link map.
2517 	 */
2518 	sl = *slp;
2519 	sl.sl_flags |= LKUP_DIRECT;
2520 	sym = 0;
2521 
2522 	if (sip->si_boundto == SYMINFO_BT_PARENT) {
2523 		Aliste		off;
2524 		Bnd_desc **	bdpp;
2525 
2526 		for (ALIST_TRAVERSE(CALLERS(clmp), off, bdpp)) {
2527 			sl.sl_imap = lmp = (*bdpp)->b_caller;
2528 			if ((sym = SYMINTP(lmp)(&sl, dlmp, binfo)) != 0)
2529 				break;
2530 		}
2531 	} else {
2532 		/*
2533 		 * If we need to direct bind to anything else look in the
2534 		 * link map associated with this symbol reference.
2535 		 */
2536 		if (sip->si_boundto == SYMINFO_BT_SELF)
2537 			sl.sl_imap = lmp = clmp;
2538 		else
2539 			sl.sl_imap = lmp;
2540 
2541 		if (lmp)
2542 			sym = SYMINTP(lmp)(&sl, dlmp, binfo);
2543 	}
2544 
2545 	if (sym)
2546 		*binfo |= DBG_BINFO_DIRECT;
2547 
2548 	/*
2549 	 * If we've bound to an object, determine whether that object can be
2550 	 * interposed upon for this symbol.
2551 	 */
2552 	if (sym && (LIST(*dlmp)->lm_head != *dlmp) &&
2553 	    (LIST(*dlmp) == LIST(clmp))) {
2554 		Sym *	isym;
2555 
2556 		if ((isym = lookup_sym_interpose(slp, dlmp, binfo,
2557 		    LIST(*dlmp), sym)) != 0)
2558 			return (isym);
2559 	}
2560 
2561 	return (sym);
2562 }
2563 
2564 static Sym *
2565 _lookup_sym(Rt_map *ilmp, Slookup *slp, Rt_map **dlmp, uint_t *binfo,
2566     Aliste off)
2567 {
2568 	Rt_map	*lmp;
2569 
2570 	/*
2571 	 * Copy relocations should start their search after the head of the
2572 	 * main link-map control list.
2573 	 */
2574 	if ((off == ALO_DATA) && (slp->sl_flags & LKUP_COPY) && ilmp)
2575 		lmp = (Rt_map *)NEXT(ilmp);
2576 	else
2577 		lmp = ilmp;
2578 
2579 	for (; lmp; lmp = (Rt_map *)NEXT(lmp)) {
2580 		if (callable(slp->sl_cmap, lmp, 0)) {
2581 			Sym	*sym;
2582 
2583 			slp->sl_imap = lmp;
2584 			if ((sym = SYMINTP(lmp)(slp, dlmp, binfo)) != 0)
2585 				return (sym);
2586 		}
2587 	}
2588 	return (0);
2589 }
2590 
2591 static Sym *
2592 _lazy_find_sym(Rt_map *ilmp, Slookup *slp, Rt_map **dlmp, uint_t *binfo)
2593 {
2594 	Rt_map	*lmp;
2595 
2596 	for (lmp = ilmp; lmp; lmp = (Rt_map *)NEXT(lmp)) {
2597 		if (LAZY(lmp) == 0)
2598 			continue;
2599 		if (callable(slp->sl_cmap, lmp, 0)) {
2600 			Sym	*sym;
2601 
2602 			slp->sl_imap = lmp;
2603 			if ((sym = elf_lazy_find_sym(slp, dlmp, binfo)) != 0)
2604 				return (sym);
2605 		}
2606 	}
2607 	return (0);
2608 }
2609 
2610 /*
2611  * Symbol lookup routine.  Takes an ELF symbol name, and a list of link maps to
2612  * search (if the flag indicates LKUP_FIRST only the first link map of the list
2613  * is searched ie. we've been called from dlsym()).
2614  * If successful, return a pointer to the symbol table entry and a pointer to
2615  * the link map of the enclosing object.  Else return a null pointer.
2616  *
2617  * To improve elf performance, we first compute the elf hash value and pass
2618  * it to each find_sym() routine.  The elf function will use this value to
2619  * locate the symbol, the a.out function will simply ignore it.
2620  */
2621 Sym *
2622 lookup_sym(Slookup *slp, Rt_map **dlmp, uint_t *binfo)
2623 {
2624 	const char	*name = slp->sl_name;
2625 	Rt_map		*clmp = slp->sl_cmap;
2626 	Rt_map		*ilmp = slp->sl_imap, *lmp;
2627 	uint_t		flags = slp->sl_flags;
2628 	ulong_t		rsymndx;
2629 	Sym		*sym = 0;
2630 	Syminfo		*sip;
2631 	Slookup		sl;
2632 
2633 	if (slp->sl_hash == 0)
2634 		slp->sl_hash = elf_hash(name);
2635 	*binfo = 0;
2636 
2637 	/*
2638 	 * Search the initial link map for the required symbol (this category is
2639 	 * selected by dlsym(), where individual link maps are searched for a
2640 	 * required symbol.  Therefore, we know we have permission to look at
2641 	 * the link map).
2642 	 */
2643 	if (flags & LKUP_FIRST)
2644 		return (SYMINTP(ilmp)(slp, dlmp, binfo));
2645 
2646 	/*
2647 	 * Determine whether this lookup can be satisfied by an objects direct,
2648 	 * or lazy binding information.  This is triggered by a relocation from
2649 	 * the object (hence rsymndx is set).
2650 	 */
2651 	if (((rsymndx = slp->sl_rsymndx) != 0) &&
2652 	    ((sip = SYMINFO(clmp)) != 0)) {
2653 
2654 		/*
2655 		 * Find the corresponding Syminfo entry for the original
2656 		 * referencing symbol.
2657 		 */
2658 		/* LINTED */
2659 		sip = (Syminfo *)((char *)sip + (rsymndx * SYMINENT(clmp)));
2660 
2661 		/*
2662 		 * If the symbol information indicates a direct binding,
2663 		 * determine the link map that is required to satisfy the
2664 		 * binding.  Note, if the dependency can not be found, but a
2665 		 * direct binding isn't required, we will still fall through
2666 		 * to perform any default symbol search.
2667 		 */
2668 		if (sip->si_flags & SYMINFO_FLG_DIRECT) {
2669 			uint_t	bound = sip->si_boundto;
2670 
2671 			lmp = 0;
2672 			if (bound < SYMINFO_BT_LOWRESERVE)
2673 				lmp = elf_lazy_load(clmp, bound, name);
2674 
2675 			/*
2676 			 * If direct bindings have been disabled, and this isn't
2677 			 * a translator, skip any direct binding now that we've
2678 			 * insured the resolving object has been loaded.
2679 			 *
2680 			 * If we need to direct bind to anything, we look in
2681 			 * ourselves, our parent, or in the link map we've just
2682 			 * loaded.  Otherwise, even though we may have lazily
2683 			 * loaded an object we still continue to search for
2684 			 * symbols from the head of the link map list.
2685 			 */
2686 			if (((FLAGS(clmp) & FLG_RT_TRANS) ||
2687 			    (!(LIST(clmp)->lm_tflags & LML_TFLG_NODIRECT))) &&
2688 			    ((FLAGS1(clmp) & FL1_RT_DIRECT) ||
2689 			    (sip->si_flags & SYMINFO_FLG_DIRECTBIND))) {
2690 				sym = lookup_sym_direct(slp, dlmp, binfo,
2691 				    sip, lmp);
2692 
2693 				/*
2694 				 * If this direct binding has been disabled
2695 				 * (presumably because the symbol definition has
2696 				 * been changed since the referring object was
2697 				 * built), fall back to a standard symbol
2698 				 * search.
2699 				 */
2700 				if ((*binfo & BINFO_DIRECTDIS) == 0)
2701 					return (sym);
2702 			}
2703 		}
2704 	}
2705 
2706 	sl = *slp;
2707 
2708 	/*
2709 	 * If the referencing object has the DF_SYMBOLIC flag set, look in the
2710 	 * referencing object for the symbol first.  Failing that, fall back to
2711 	 * our generic search.
2712 	 */
2713 	if (FLAGS1(clmp) & FL1_RT_SYMBOLIC) {
2714 		sl.sl_imap = clmp;
2715 		if (sym = SYMINTP(clmp)(&sl, dlmp, binfo)) {
2716 			ulong_t	dsymndx = (((ulong_t)sym -
2717 			    (ulong_t)SYMTAB(*dlmp)) / SYMENT(*dlmp));
2718 
2719 			/*
2720 			 * Make sure this symbol hasn't explicitly been defined
2721 			 * as nodirect.
2722 			 */
2723 			if (((sip = SYMINFO(*dlmp)) == 0) ||
2724 			    /* LINTED */
2725 			    ((sip = (Syminfo *)((char *)sip +
2726 			    (dsymndx * SYMINENT(*dlmp)))) == 0) ||
2727 			    ((sip->si_flags & SYMINFO_FLG_NOEXTDIRECT) == 0))
2728 				return (sym);
2729 		}
2730 	}
2731 
2732 	/*
2733 	 * If this lookup originates from a standard relocation, then traverse
2734 	 * all link-map lists inspecting any object that is available to this
2735 	 * caller.  Otherwise, traverse the link-map list associate with the
2736 	 * caller.
2737 	 */
2738 	if (flags & LKUP_ALLCNTLIST) {
2739 		Aliste	off;
2740 		Lm_cntl	*lmc;
2741 
2742 		sym = 0;
2743 
2744 		for (ALIST_TRAVERSE(LIST(clmp)->lm_lists, off, lmc)) {
2745 			if ((sym = _lookup_sym(lmc->lc_head, &sl, dlmp,
2746 			    binfo, off)) != 0)
2747 				break;
2748 		}
2749 	} else
2750 		sym = _lookup_sym(ilmp, &sl, dlmp, binfo, ALO_DATA);
2751 
2752 	/*
2753 	 * To allow transitioning into a world of lazy loading dependencies see
2754 	 * if this link map contains objects that have lazy dependencies still
2755 	 * outstanding.  If so, and we haven't been able to locate a non-weak
2756 	 * symbol reference, start bringing in any lazy dependencies to see if
2757 	 * the reference can be satisfied.  Use of dlsym(RTLD_PROBE) sets the
2758 	 * LKUP_NOFALBACK flag, and this flag disables this fall back.
2759 	 */
2760 	if ((sym == 0) && ((sl.sl_flags & LKUP_NOFALBACK) == 0)) {
2761 		if ((lmp = ilmp) == 0)
2762 			lmp = LIST(clmp)->lm_head;
2763 		if ((flags & LKUP_WEAK) || (LIST(lmp)->lm_lazy == 0))
2764 			return ((Sym *)0);
2765 
2766 		DBG_CALL(Dbg_syms_lazy_rescan(LIST(clmp), name));
2767 
2768 		/*
2769 		 * If this request originated from a dlsym(RTLD_NEXT) then start
2770 		 * looking for dependencies from the caller, otherwise use the
2771 		 * initial link-map.
2772 		 */
2773 		if (flags & LKUP_NEXT)
2774 			sym = _lazy_find_sym(clmp, &sl, dlmp, binfo);
2775 		else {
2776 			Aliste	off;
2777 			Lm_cntl	*lmc;
2778 
2779 			for (ALIST_TRAVERSE(LIST(clmp)->lm_lists, off, lmc)) {
2780 				sl.sl_flags |= LKUP_NOFALBACK;
2781 				if ((sym = _lazy_find_sym(lmc->lc_head, &sl,
2782 				    dlmp, binfo)) != 0)
2783 					break;
2784 			}
2785 		}
2786 	}
2787 
2788 	/*
2789 	 * If the caller is restricted to a symbol search within its group,
2790 	 * determine if it is necessary to follow a binding from outside of
2791 	 * the group.
2792 	 */
2793 	if (sym && ((MODE(clmp) & (RTLD_GROUP | RTLD_WORLD)) == RTLD_GROUP)) {
2794 		Sym *	isym;
2795 
2796 		if ((isym = lookup_sym_interpose(slp, dlmp, binfo, LIST(*dlmp),
2797 		    sym)) != 0)
2798 			return (isym);
2799 	}
2800 	return (sym);
2801 }
2802 
2803 /*
2804  * Associate a binding descriptor with a caller and its dependency, or update
2805  * an existing descriptor.
2806  */
2807 int
2808 bind_one(Rt_map *clmp, Rt_map *dlmp, uint_t flags)
2809 {
2810 	Bnd_desc	**bdpp, *bdp;
2811 	Aliste		off;
2812 	int		found = ALE_CREATE;
2813 
2814 	/*
2815 	 * Determine whether a binding descriptor already exists between the
2816 	 * two objects.
2817 	 */
2818 	for (ALIST_TRAVERSE(DEPENDS(clmp), off, bdpp)) {
2819 		bdp = *bdpp;
2820 
2821 		if (bdp->b_depend == dlmp) {
2822 			found = ALE_EXISTS;
2823 			break;
2824 		}
2825 	}
2826 
2827 	if (found == ALE_CREATE) {
2828 		/*
2829 		 * Create a new binding descriptor.
2830 		 */
2831 		if ((bdp = malloc(sizeof (Bnd_desc))) == 0)
2832 			return (0);
2833 
2834 		bdp->b_caller = clmp;
2835 		bdp->b_depend = dlmp;
2836 		bdp->b_flags = 0;
2837 
2838 		/*
2839 		 * Append the binding descriptor to the caller and the
2840 		 * dependency.
2841 		 */
2842 		if (alist_append(&DEPENDS(clmp), &bdp,
2843 		    sizeof (Bnd_desc *), AL_CNT_DEPENDS) == 0)
2844 			return (0);
2845 
2846 		if (alist_append(&CALLERS(dlmp), &bdp,
2847 		    sizeof (Bnd_desc *), AL_CNT_CALLERS) == 0)
2848 			return (0);
2849 	}
2850 
2851 	if ((found == ALE_CREATE) || ((bdp->b_flags & flags) != flags)) {
2852 		bdp->b_flags |= flags;
2853 
2854 		if (flags & BND_REFER)
2855 			FLAGS1(dlmp) |= FL1_RT_USED;
2856 
2857 		DBG_CALL(Dbg_file_bind_entry(LIST(clmp), bdp));
2858 	}
2859 	return (found);
2860 }
2861 
2862 /*
2863  * Cleanup after relocation processing.
2864  */
2865 int
2866 relocate_finish(Rt_map *lmp, Alist *bound, int textrel, int ret)
2867 {
2868 	DBG_CALL(Dbg_reloc_run(lmp, 0, ret, DBG_REL_FINISH));
2869 
2870 	/*
2871 	 * Establish bindings to all objects that have been bound to.
2872 	 */
2873 	if (bound) {
2874 		Aliste	off;
2875 		Rt_map	**lmpp;
2876 
2877 		if (ret) {
2878 			for (ALIST_TRAVERSE(bound, off, lmpp)) {
2879 				if (bind_one(lmp, *lmpp, BND_REFER) == 0) {
2880 					ret = 0;
2881 					break;
2882 				}
2883 			}
2884 		}
2885 		free(bound);
2886 	}
2887 
2888 	/*
2889 	 * If we write enabled the text segment to perform these relocations
2890 	 * re-protect by disabling writes.
2891 	 */
2892 	if (textrel)
2893 		(void) LM_SET_PROT(lmp)(lmp, 0);
2894 
2895 	return (ret);
2896 }
2897