xref: /titanic_44/usr/src/cmd/sgs/rtld/common/util.c (revision 98157a7002f4f2cf7978f3084ca5577f0a1d72b2)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1988 AT&T
24  *	  All Rights Reserved
25  *
26  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
27  * Use is subject to license terms.
28  */
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 /*
32  * Utility routines for run-time linker.  some are duplicated here from libc
33  * (with different names) to avoid name space collisions.
34  */
35 #include	"_synonyms.h"
36 #include	<stdio.h>
37 #include	<sys/types.h>
38 #include	<sys/mman.h>
39 #include	<sys/lwp.h>
40 #include	<sys/debug.h>
41 #include	<stdarg.h>
42 #include	<fcntl.h>
43 #include	<string.h>
44 #include	<ctype.h>
45 #include	<dlfcn.h>
46 #include	<unistd.h>
47 #include	<stdlib.h>
48 #include	<sys/auxv.h>
49 #include	<debug.h>
50 #include	<conv.h>
51 #include	"_rtld.h"
52 #include	"_audit.h"
53 #include	"_elf.h"
54 #include	"msg.h"
55 
56 static int ld_flags_env(const char *, Word *, Word *, uint_t, int);
57 
58 /*
59  * All error messages go through eprintf().  During process initialization these
60  * messages should be directed to the standard error, however once control has
61  * been passed to the applications code these messages should be stored in an
62  * internal buffer for use with dlerror().  Note, fatal error conditions that
63  * may occur while running the application will still cause a standard error
64  * message, see rtldexit() in this file for details.
65  * The `application' flag serves to indicate the transition between process
66  * initialization and when the applications code is running.
67  */
68 
69 /*
70  * Null function used as place where a debugger can set a breakpoint.
71  */
72 void
73 rtld_db_dlactivity(Lm_list *lml)
74 {
75 	DBG_CALL(Dbg_util_dbnotify(lml, r_debug.rtd_rdebug.r_rdevent,
76 	    r_debug.rtd_rdebug.r_state));
77 }
78 
79 /*
80  * Null function used as place where debugger can set a pre .init
81  * processing breakpoint.
82  */
83 void
84 rtld_db_preinit(Lm_list *lml)
85 {
86 	DBG_CALL(Dbg_util_dbnotify(lml, r_debug.rtd_rdebug.r_rdevent,
87 	    r_debug.rtd_rdebug.r_state));
88 }
89 
90 /*
91  * Null function used as place where debugger can set a post .init
92  * processing breakpoint.
93  */
94 void
95 rtld_db_postinit(Lm_list *lml)
96 {
97 	DBG_CALL(Dbg_util_dbnotify(lml, r_debug.rtd_rdebug.r_rdevent,
98 	    r_debug.rtd_rdebug.r_state));
99 }
100 
101 /*
102  * Debugger Event Notification
103  *
104  * This function centralizes all debugger event notification (ala rtld_db).
105  *
106  * There's a simple intent, focused on insuring the primary link-map control
107  * list (or each link-map list) is consistent, and the indication that objects
108  * have been added or deleted from this list.  Although an RD_ADD and RD_DELETE
109  * event are posted for each of these, most debuggers don't care, as their
110  * view is that these events simply convey an "inconsistent" state.
111  *
112  * We also don't want to trigger multiple RD_ADD/RD_DELETE events any time we
113  * enter ld.so.1.
114  *
115  * With auditors, we may be in the process of relocating a collection of
116  * objects, and will leave() ld.so.1 to call the auditor.  At this point we
117  * must indicate an RD_CONSISTENT event, but librtld_db will not report an
118  * object to the debuggers until relocation processing has been completed on it.
119  * To allow for the collection of these objects that are pending relocation, an
120  * RD_ADD event is set after completing a series of relocations on the primary
121  * link-map control list.
122  *
123  * Set an RD_ADD/RD_DELETE event and indicate that an RD_CONSISTENT event is
124  * required later (LML_FLG_DBNOTIF):
125  *
126  *  i	the first time we add or delete an object to the primary link-map
127  *	control list.
128  *  ii	the first time we move a secondary link-map control list to the primary
129  *	link-map control list (effectively, this is like adding a group of
130  *	objects to the primary link-map control list).
131  *
132  * Set an RD_CONSISTENT event when it is required (LML_FLG_DBNOTIF is set) and
133  *
134  *  i	each time we leave the runtime linker.
135  */
136 void
137 rd_event(Lm_list *lml, rd_event_e event, r_state_e state)
138 {
139 	void	(*fptr)(Lm_list *);
140 
141 	switch (event) {
142 	case RD_PREINIT:
143 		fptr = rtld_db_preinit;
144 		break;
145 	case RD_POSTINIT:
146 		fptr = rtld_db_postinit;
147 		break;
148 	case RD_DLACTIVITY:
149 		switch (state) {
150 		case RT_CONSISTENT:
151 			lml->lm_flags &= ~LML_FLG_DBNOTIF;
152 
153 			/*
154 			 * Do we need to send a notification?
155 			 */
156 			if ((rtld_flags & RT_FL_DBNOTIF) == 0)
157 				return;
158 			rtld_flags &= ~RT_FL_DBNOTIF;
159 			break;
160 		case RT_ADD:
161 		case RT_DELETE:
162 			lml->lm_flags |= LML_FLG_DBNOTIF;
163 
164 			/*
165 			 * If we are already in an inconsistent state, no
166 			 * notification is required.
167 			 */
168 			if (rtld_flags & RT_FL_DBNOTIF)
169 				return;
170 			rtld_flags |= RT_FL_DBNOTIF;
171 			break;
172 		};
173 		fptr = rtld_db_dlactivity;
174 		break;
175 	default:
176 		/*
177 		 * RD_NONE - do nothing
178 		 */
179 		break;
180 	};
181 
182 	/*
183 	 * Set event state and call 'notification' function.
184 	 *
185 	 * The debugging clients have previously been told about these
186 	 * notification functions and have set breakpoints on them if they
187 	 * are interested in the notification.
188 	 */
189 	r_debug.rtd_rdebug.r_state = state;
190 	r_debug.rtd_rdebug.r_rdevent = event;
191 	fptr(lml);
192 	r_debug.rtd_rdebug.r_rdevent = RD_NONE;
193 }
194 
195 #if	defined(__sparc) || defined(__x86)
196 /*
197  * Stack Cleanup.
198  *
199  * This function is invoked to 'remove' arguments that were passed in on the
200  * stack.  This is most likely if ld.so.1 was invoked directly.  In that case
201  * we want to remove ld.so.1 as well as it's arguments from the argv[] array.
202  * Which means we then need to slide everything above it on the stack down
203  * accordingly.
204  *
205  * While the stack layout is platform specific - it just so happens that __x86,
206  * and __sparc platforms share the following initial stack layout.
207  *
208  *	!_______________________!  high addresses
209  *	!			!
210  *	!	Information	!
211  *	!	Block		!
212  *	!	(size varies)	!
213  *	!_______________________!
214  *	!	0 word		!
215  *	!_______________________!
216  *	!	Auxiliary	!
217  *	!	vector		!
218  *	!	2 word entries	!
219  *	!			!
220  *	!_______________________!
221  *	!	0 word		!
222  *	!_______________________!
223  *	!	Environment	!
224  *	!	pointers	!
225  *	!	...		!
226  *	!	(one word each)	!
227  *	!_______________________!
228  *	!	0 word		!
229  *	!_______________________!
230  *	!	Argument	! low addresses
231  *	!	pointers	!
232  *	!	Argc words	!
233  *	!_______________________!
234  *	!			!
235  *	!	Argc		!
236  *	!_______________________!
237  *	!	...		!
238  *
239  */
240 static void
241 stack_cleanup(char **argv, char ***envp, auxv_t **auxv, int rmcnt)
242 {
243 	int		ndx;
244 	long		*argc;
245 	char		**oargv, **nargv;
246 	char		**oenvp, **nenvp;
247 	auxv_t		*oauxv, *nauxv;
248 
249 	/*
250 	 * Slide ARGV[] and update argc.  The argv pointer remains the same,
251 	 * however slide the applications arguments over the arguments to
252 	 * ld.so.1.
253 	 */
254 	nargv = &argv[0];
255 	oargv = &argv[rmcnt];
256 
257 	for (ndx = 0; oargv[ndx]; ndx++)
258 		nargv[ndx] = oargv[ndx];
259 	nargv[ndx] = oargv[ndx];
260 
261 	argc = (long *)((uintptr_t)argv - sizeof (long *));
262 	*argc -= rmcnt;
263 
264 	/*
265 	 * Slide ENVP[], and update the environment array pointer.
266 	 */
267 	ndx++;
268 	nenvp = &nargv[ndx];
269 	oenvp = &oargv[ndx];
270 	*envp = nenvp;
271 
272 	for (ndx = 0; oenvp[ndx]; ndx++)
273 		nenvp[ndx] = oenvp[ndx];
274 	nenvp[ndx] = oenvp[ndx];
275 
276 	/*
277 	 * Slide AUXV[], and update the aux vector pointer.
278 	 */
279 	ndx++;
280 	nauxv = (auxv_t *)&nenvp[ndx];
281 	oauxv = (auxv_t *)&oenvp[ndx];
282 	*auxv = nauxv;
283 
284 	for (ndx = 0; (oauxv[ndx].a_type != AT_NULL); ndx++)
285 		nauxv[ndx] = oauxv[ndx];
286 	nauxv[ndx] = oauxv[ndx];
287 }
288 #else
289 /*
290  * Verify that the above routine is appropriate for any new platforms.
291  */
292 #error	unsupported architecture!
293 #endif
294 
295 /*
296  * The only command line argument recognized is -e, followed by a runtime
297  * linker environment variable.
298  */
299 int
300 rtld_getopt(char **argv, char ***envp, auxv_t **auxv, Word *lmflags,
301     Word *lmtflags, int aout)
302 {
303 	int	ndx;
304 
305 	for (ndx = 1; argv[ndx]; ndx++) {
306 		char	*str;
307 
308 		if (argv[ndx][0] != '-')
309 			break;
310 
311 		if (argv[ndx][1] == '\0') {
312 			ndx++;
313 			break;
314 		}
315 
316 		if (argv[ndx][1] != 'e')
317 			return (1);
318 
319 		if (argv[ndx][2] == '\0') {
320 			ndx++;
321 			if (argv[ndx] == NULL)
322 				return (1);
323 			str = argv[ndx];
324 		} else
325 			str = &argv[ndx][2];
326 
327 		/*
328 		 * If the environment variable starts with LD_, strip the LD_.
329 		 * Otherwise, take things as is.
330 		 */
331 		if ((str[0] == 'L') && (str[1] == 'D') && (str[2] == '_') &&
332 		    (str[3] != '\0'))
333 			str += 3;
334 		if (ld_flags_env(str, lmflags, lmtflags, 0, aout) == 1)
335 			return (1);
336 	}
337 
338 	/*
339 	 * Make sure an object file has been specified.
340 	 */
341 	if (argv[ndx] == 0)
342 		return (1);
343 
344 	/*
345 	 * Having gotten the arguments, clean ourselves off of the stack.
346 	 */
347 	stack_cleanup(argv, envp, auxv, ndx);
348 	return (0);
349 }
350 
351 /*
352  * Compare function for FullpathNode AVL tree.
353  */
354 static int
355 fpavl_compare(const void * n1, const void * n2)
356 {
357 	uint_t		hash1, hash2;
358 	const char	*st1, *st2;
359 	int		rc;
360 
361 	hash1 = ((FullpathNode *)n1)->fpn_hash;
362 	hash2 = ((FullpathNode *)n2)->fpn_hash;
363 
364 	if (hash1 > hash2)
365 		return (1);
366 	if (hash1 < hash2)
367 		return (-1);
368 
369 	st1 = ((FullpathNode *)n1)->fpn_name;
370 	st2 = ((FullpathNode *)n2)->fpn_name;
371 
372 	rc = strcmp(st1, st2);
373 	if (rc > 0)
374 		return (1);
375 	if (rc < 0)
376 		return (-1);
377 	return (0);
378 }
379 
380 
381 /*
382  * Determine if a given pathname has already been loaded in the AVL tree.
383  * If the pathname does not exist in the AVL tree, the next insertion point
384  * is deposited in "where".  This value can be used by fpavl_insert() to
385  * expedite the insertion.
386  */
387 Rt_map *
388 fpavl_loaded(Lm_list *lml, const char *name, avl_index_t *where)
389 {
390 	FullpathNode	fpn, *fpnp;
391 	avl_tree_t	*avlt;
392 
393 	/*
394 	 * Create the avl tree if required.
395 	 */
396 	if ((avlt = lml->lm_fpavl) == NULL) {
397 		if ((avlt = calloc(sizeof (avl_tree_t), 1)) == 0)
398 			return (0);
399 		avl_create(avlt, fpavl_compare, sizeof (FullpathNode),
400 		    SGSOFFSETOF(FullpathNode, fpn_avl));
401 		lml->lm_fpavl = avlt;
402 	}
403 
404 	fpn.fpn_name = name;
405 	fpn.fpn_hash = sgs_str_hash(name);
406 
407 	if ((fpnp = avl_find(lml->lm_fpavl, &fpn, where)) == NULL)
408 		return (NULL);
409 
410 	return (fpnp->fpn_lmp);
411 }
412 
413 
414 /*
415  * Insert a name into the FullpathNode AVL tree for the link-map list.  The
416  * objects NAME() is the path that would have originally been searched for, and
417  * is therefore the name to associate with any "where" value.  If the object has
418  * a different PATHNAME(), perhaps because it has resolved to a different file
419  * (see fullpath), then this name is recorded also.  See load_file().
420  */
421 int
422 fpavl_insert(Lm_list *lml, Rt_map *lmp, const char *name, avl_index_t where)
423 {
424 	FullpathNode	*fpnp;
425 
426 	if (where == 0) {
427 		/* LINTED */
428 		Rt_map	*_lmp = fpavl_loaded(lml, name, &where);
429 
430 		/*
431 		 * We better not get a hit now, we do not want duplicates in
432 		 * the tree.
433 		 */
434 		ASSERT(_lmp == 0);
435 	}
436 
437 	/*
438 	 * Insert new node in tree
439 	 */
440 	if ((fpnp = calloc(sizeof (FullpathNode), 1)) == 0)
441 		return (0);
442 
443 	fpnp->fpn_name = name;
444 	fpnp->fpn_hash = sgs_str_hash(name);
445 	fpnp->fpn_lmp = lmp;
446 
447 	if (aplist_append(&FPNODE(lmp), fpnp, AL_CNT_FPNODE) == NULL) {
448 		free(fpnp);
449 		return (0);
450 	}
451 
452 	ASSERT(lml->lm_fpavl != NULL);
453 	avl_insert(lml->lm_fpavl, fpnp, where);
454 	return (1);
455 }
456 
457 /*
458  * Remove an object from the Fullpath AVL tree.  Note, this is called *before*
459  * the objects link-map is torn down (remove_so), which is where any NAME() and
460  * PATHNAME() strings will be deallocated.
461  */
462 void
463 fpavl_remove(Rt_map *lmp)
464 {
465 	FullpathNode	*fpnp;
466 	Aliste		idx;
467 
468 	for (APLIST_TRAVERSE(FPNODE(lmp), idx, fpnp)) {
469 		avl_remove(LIST(lmp)->lm_fpavl, fpnp);
470 		free(fpnp);
471 	}
472 	free(FPNODE(lmp));
473 	FPNODE(lmp) = NULL;
474 }
475 
476 
477 /*
478  * Prior to calling an object, either via a .plt or through dlsym(), make sure
479  * its .init has fired.  Through topological sorting, ld.so.1 attempts to fire
480  * init's in the correct order, however, this order is typically based on needed
481  * dependencies and non-lazy relocation bindings.  Lazy relocations (.plts) can
482  * still occur and result in bindings that were not captured during topological
483  * sorting.  This routine compensates for this lack of binding information, and
484  * provides for dynamic .init firing.
485  */
486 void
487 is_dep_init(Rt_map * dlmp, Rt_map * clmp)
488 {
489 	Rt_map **	tobj;
490 
491 	/*
492 	 * If the caller is an auditor, and the destination isn't, then don't
493 	 * run any .inits (see comments in load_completion()).
494 	 */
495 	if ((LIST(clmp)->lm_flags & LML_FLG_NOAUDIT) &&
496 	    (LIST(clmp) != LIST(dlmp)))
497 		return;
498 
499 	if ((dlmp == clmp) || (rtld_flags & (RT_FL_BREADTH | RT_FL_INITFIRST)))
500 		return;
501 
502 	if ((FLAGS(dlmp) & (FLG_RT_RELOCED | FLG_RT_INITDONE)) ==
503 	    (FLG_RT_RELOCED | FLG_RT_INITDONE))
504 		return;
505 
506 	if ((FLAGS(dlmp) & (FLG_RT_RELOCED | FLG_RT_INITCALL)) ==
507 	    (FLG_RT_RELOCED | FLG_RT_INITCALL)) {
508 		DBG_CALL(Dbg_util_no_init(dlmp));
509 		return;
510 	}
511 
512 	if ((tobj = calloc(2, sizeof (Rt_map *))) != NULL) {
513 		tobj[0] = dlmp;
514 		call_init(tobj, DBG_INIT_DYN);
515 	}
516 }
517 
518 /*
519  * In a threaded environment insure the thread responsible for loading an object
520  * has completed .init processing for that object before any new thread is
521  * allowed to access the object.  This check is only valid with libthread
522  * TI_VERSION 2, where ld.so.1 implements locking through low level mutexes.
523  *
524  * When a new link-map is created, the thread that causes it to be loaded is
525  * identified by THREADID(dlmp).  Compare this with the current thread to
526  * determine if it must be blocked.
527  *
528  * NOTE, there are a number of instances (typically only for .plt processing)
529  * where we must skip this test:
530  *
531  *   .	any thread id of 0 - threads that call thr_exit() may be in this state
532  *	thus we can't deduce what tid they used to be.  Also some of the
533  *	lib/libthread worker threads have this id and must bind (to themselves
534  *	or libc) for libthread to function.
535  *
536  *   .	libthread itself binds to libc, and as libthread is INITFIRST
537  *	libc's .init can't have fired yet.  Luckly libc's .init is not required
538  *	by libthreads binding.
539  *
540  *   .	if the caller is an auditor, and the destination isn't, then don't
541  *	block (see comments in load_completion()).
542  */
543 void
544 is_dep_ready(Rt_map * dlmp, Rt_map * clmp, int what)
545 {
546 	thread_t	tid;
547 
548 	if ((LIST(clmp)->lm_flags & LML_FLG_NOAUDIT) &&
549 	    (LIST(clmp) != LIST(dlmp)))
550 		return;
551 
552 	if ((rtld_flags & RT_FL_CONCUR) &&
553 	    ((FLAGS(dlmp) & FLG_RT_INITDONE) == 0) &&
554 	    ((FLAGS(clmp) & FLG_RT_INITFRST) == 0) &&
555 	    ((tid = rt_thr_self()) != 0) && (THREADID(dlmp) != tid)) {
556 		while ((FLAGS(dlmp) & FLG_RT_INITDONE) == 0) {
557 			FLAGS1(dlmp) |= FL1_RT_INITWAIT;
558 			DBG_CALL(Dbg_util_wait(clmp, dlmp, what));
559 			(void) rt_cond_wait(CONDVAR(dlmp), &rtldlock);
560 		}
561 	}
562 }
563 
564 /*
565  * Execute .{preinit|init|fini}array sections
566  */
567 void
568 call_array(Addr *array, uint_t arraysz, Rt_map *lmp, Word shtype)
569 {
570 	int	start, stop, incr, ndx;
571 	uint_t	arraycnt = (uint_t)(arraysz / sizeof (Addr));
572 
573 	if (array == NULL)
574 		return;
575 
576 	/*
577 	 * initarray & preinitarray are walked from beginning to end - while
578 	 * finiarray is walked from end to beginning.
579 	 */
580 	if (shtype == SHT_FINI_ARRAY) {
581 		start = arraycnt - 1;
582 		stop = incr = -1;
583 	} else {
584 		start = 0;
585 		stop = arraycnt;
586 		incr = 1;
587 	}
588 
589 	/*
590 	 * Call the .*array[] entries
591 	 */
592 	for (ndx = start; ndx != stop; ndx += incr) {
593 		void (*fptr)(void) = (void(*)())array[ndx];
594 
595 		DBG_CALL(Dbg_util_call_array(lmp, (void *)fptr, ndx, shtype));
596 
597 		leave(LIST(lmp));
598 		(*fptr)();
599 		(void) enter();
600 	}
601 }
602 
603 
604 /*
605  * Execute any .init sections.  These are passed to us in an lmp array which
606  * (by default) will have been sorted.
607  */
608 void
609 call_init(Rt_map ** tobj, int flag)
610 {
611 	Rt_map **	_tobj, ** _nobj;
612 	static List	pending = { NULL, NULL };
613 
614 	/*
615 	 * If we're in the middle of an INITFIRST, this must complete before
616 	 * any new init's are fired.  In this case add the object list to the
617 	 * pending queue and return.  We'll pick up the queue after any
618 	 * INITFIRST objects have their init's fired.
619 	 */
620 	if (rtld_flags & RT_FL_INITFIRST) {
621 		(void) list_append(&pending, tobj);
622 		return;
623 	}
624 
625 	/*
626 	 * Traverse the tobj array firing each objects init.
627 	 */
628 	for (_tobj = _nobj = tobj, _nobj++; *_tobj != NULL; _tobj++, _nobj++) {
629 		Rt_map *	lmp = *_tobj;
630 		void (*		iptr)() = INIT(lmp);
631 
632 		if (FLAGS(lmp) & FLG_RT_INITCALL)
633 			continue;
634 
635 		FLAGS(lmp) |= FLG_RT_INITCALL;
636 
637 		/*
638 		 * Establish an initfirst state if necessary - no other inits
639 		 * will be fired (because of additional relocation bindings)
640 		 * when in this state.
641 		 */
642 		if (FLAGS(lmp) & FLG_RT_INITFRST)
643 			rtld_flags |= RT_FL_INITFIRST;
644 
645 		if (INITARRAY(lmp) || iptr) {
646 			Aliste		idx;
647 			Bnd_desc 	*bdp;
648 
649 			/*
650 			 * Make sure that all dependencies that have been
651 			 * relocated to are initialized before this objects
652 			 * .init is executed.  This insures that a dependency
653 			 * on an external item that must first be initialized
654 			 * by its associated object is satisfied.
655 			 */
656 			for (APLIST_TRAVERSE(DEPENDS(lmp), idx, bdp)) {
657 				if ((bdp->b_flags & BND_REFER) == 0)
658 					continue;
659 				is_dep_ready(bdp->b_depend, lmp, DBG_WAIT_INIT);
660 			}
661 			DBG_CALL(Dbg_util_call_init(lmp, flag));
662 		}
663 
664 		if (iptr) {
665 			leave(LIST(lmp));
666 			(*iptr)();
667 			(void) enter();
668 		}
669 
670 		call_array(INITARRAY(lmp), INITARRAYSZ(lmp), lmp,
671 		    SHT_INIT_ARRAY);
672 
673 		if (INITARRAY(lmp) || iptr)
674 			DBG_CALL(Dbg_util_call_init(lmp, DBG_INIT_DONE));
675 
676 		/*
677 		 * Set the initdone flag regardless of whether this object
678 		 * actually contains an .init section.  This flag prevents us
679 		 * from processing this section again for an .init and also
680 		 * signifies that a .fini must be called should it exist.
681 		 * Clear the sort field for use in later .fini processing.
682 		 */
683 		FLAGS(lmp) |= FLG_RT_INITDONE;
684 		SORTVAL(lmp) = -1;
685 
686 		/*
687 		 * Wake anyone up who might be waiting on this .init.
688 		 */
689 		if (FLAGS1(lmp) & FL1_RT_INITWAIT) {
690 			DBG_CALL(Dbg_util_broadcast(lmp));
691 			(void) rt_cond_broadcast(CONDVAR(lmp));
692 			FLAGS1(lmp) &= ~FL1_RT_INITWAIT;
693 		}
694 
695 		/*
696 		 * If we're firing an INITFIRST object, and other objects must
697 		 * be fired which are not INITFIRST, make sure we grab any
698 		 * pending objects that might have been delayed as this
699 		 * INITFIRST was processed.
700 		 */
701 		if ((rtld_flags & RT_FL_INITFIRST) &&
702 		    ((*_nobj == NULL) || !(FLAGS(*_nobj) & FLG_RT_INITFRST))) {
703 			Listnode *	lnp;
704 			Rt_map **	pobj;
705 
706 			rtld_flags &= ~RT_FL_INITFIRST;
707 
708 			while ((lnp = pending.head) != NULL) {
709 				if ((pending.head = lnp->next) == NULL)
710 					pending.tail = NULL;
711 				pobj = lnp->data;
712 				free(lnp);
713 
714 				call_init(pobj, DBG_INIT_PEND);
715 			}
716 		}
717 	}
718 	free(tobj);
719 }
720 
721 /*
722  * Function called by atexit(3C).  Calls all .fini sections related with the
723  * mains dependent shared libraries in the order in which the shared libraries
724  * have been loaded.  Skip any .fini defined in the main executable, as this
725  * will be called by crt0 (main was never marked as initdone).
726  */
727 void
728 call_fini(Lm_list * lml, Rt_map ** tobj)
729 {
730 	Rt_map **_tobj;
731 
732 	for (_tobj = tobj; *_tobj != NULL; _tobj++) {
733 		Rt_map		*clmp, * lmp = *_tobj;
734 		Aliste		idx;
735 		Bnd_desc	*bdp;
736 
737 		/*
738 		 * If concurrency checking isn't enabled only fire .fini if
739 		 * .init has completed.  We collect all .fini sections of
740 		 * objects that had their .init collected, but that doesn't
741 		 * mean at the time that the .init had completed.
742 		 */
743 		if ((rtld_flags & RT_FL_CONCUR) ||
744 		    (FLAGS(lmp) & FLG_RT_INITDONE)) {
745 			void	(*fptr)(void) = FINI(lmp);
746 
747 			if (FINIARRAY(lmp) || fptr) {
748 				/*
749 				 * If concurrency checking is enabled make sure
750 				 * this object's .init is completed before
751 				 * calling any .fini.
752 				 */
753 				is_dep_ready(lmp, lmp, DBG_WAIT_FINI);
754 				DBG_CALL(Dbg_util_call_fini(lmp));
755 			}
756 
757 			call_array(FINIARRAY(lmp), FINIARRAYSZ(lmp), lmp,
758 			    SHT_FINI_ARRAY);
759 
760 			if (fptr) {
761 				leave(LIST(lmp));
762 				(*fptr)();
763 				(void) enter();
764 			}
765 		}
766 
767 		/*
768 		 * Skip main, this is explicitly called last in atexit_fini().
769 		 */
770 		if (FLAGS(lmp) & FLG_RT_ISMAIN)
771 			continue;
772 
773 		/*
774 		 * Audit `close' operations at this point.  The library has
775 		 * exercised its last instructions (regardless of whether it
776 		 * will be unmapped or not).
777 		 *
778 		 * First call any global auditing.
779 		 */
780 		if (lml->lm_tflags & LML_TFLG_AUD_OBJCLOSE)
781 			_audit_objclose(&(auditors->ad_list), lmp);
782 
783 		/*
784 		 * Finally determine whether this object has local auditing
785 		 * requirements by inspecting itself and then its dependencies.
786 		 */
787 		if ((lml->lm_flags & LML_FLG_LOCAUDIT) == 0)
788 			continue;
789 
790 		if (FLAGS1(lmp) & LML_TFLG_AUD_OBJCLOSE)
791 			_audit_objclose(&(AUDITORS(lmp)->ad_list), lmp);
792 
793 		for (APLIST_TRAVERSE(CALLERS(lmp), idx, bdp)) {
794 			clmp = bdp->b_caller;
795 
796 			if (FLAGS1(clmp) & LML_TFLG_AUD_OBJCLOSE) {
797 				_audit_objclose(&(AUDITORS(clmp)->ad_list),
798 				    lmp);
799 				break;
800 			}
801 		}
802 	}
803 	DBG_CALL(Dbg_bind_plt_summary(lml, M_MACH, pltcnt21d, pltcnt24d,
804 	    pltcntu32, pltcntu44, pltcntfull, pltcntfar));
805 
806 	free(tobj);
807 }
808 
809 void
810 atexit_fini()
811 {
812 	Rt_map **	tobj, * lmp;
813 	Lm_list *	lml;
814 	Listnode *	lnp;
815 
816 	(void) enter();
817 
818 	rtld_flags |= RT_FL_ATEXIT;
819 
820 	lml = &lml_main;
821 	lml->lm_flags |= LML_FLG_ATEXIT;
822 	lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
823 	lmp = (Rt_map *)lml->lm_head;
824 
825 	/*
826 	 * Display any objects that haven't been referenced so far.
827 	 */
828 	unused(lml);
829 
830 	/*
831 	 * Reverse topologically sort the main link-map for .fini execution.
832 	 */
833 	if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != 0) &&
834 	    (tobj != (Rt_map **)S_ERROR))
835 		call_fini(lml, tobj);
836 
837 	/*
838 	 * Add an explicit close to main and ld.so.1.  Although main's .fini is
839 	 * collected in call_fini() to provide for FINITARRAY processing, its
840 	 * audit_objclose is explicitly skipped.  This provides for it to be
841 	 * called last, here.  This is the reverse of the explicit calls to
842 	 * audit_objopen() made in setup().
843 	 */
844 	if ((lml->lm_tflags | FLAGS1(lmp)) & LML_TFLG_AUD_MASK) {
845 		audit_objclose(lmp, (Rt_map *)lml_rtld.lm_head);
846 		audit_objclose(lmp, lmp);
847 	}
848 
849 	/*
850 	 * Now that all .fini code has been run, see what unreferenced objects
851 	 * remain.  Any difference between this and the above unused() would
852 	 * indicate an object is only being used for .fini processing, which
853 	 * might be fine, but might also indicate an overhead whose removal
854 	 * would be worth considering.
855 	 */
856 	unused(lml);
857 
858 	/*
859 	 * Traverse any alternative link-map lists.
860 	 */
861 	for (LIST_TRAVERSE(&dynlm_list, lnp, lml)) {
862 		/*
863 		 * Ignore the base-link-map list, which has already been
864 		 * processed, and the runtime linkers link-map list, which is
865 		 * typically processed last.
866 		 */
867 		if (lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM))
868 			continue;
869 
870 		if ((lmp = (Rt_map *)lml->lm_head) == 0)
871 			continue;
872 
873 		lml->lm_flags |= LML_FLG_ATEXIT;
874 		lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
875 
876 		/*
877 		 * Reverse topologically sort the link-map for .fini execution.
878 		 */
879 		if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != 0) &&
880 		    (tobj != (Rt_map **)S_ERROR))
881 			call_fini(lml, tobj);
882 
883 		unused(lml);
884 	}
885 
886 	/*
887 	 * Finally reverse topologically sort the runtime linkers link-map for
888 	 * .fini execution.
889 	 */
890 	lml = &lml_rtld;
891 	lml->lm_flags |= LML_FLG_ATEXIT;
892 	lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
893 	lmp = (Rt_map *)lml->lm_head;
894 
895 	if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != 0) &&
896 	    (tobj != (Rt_map **)S_ERROR))
897 		call_fini(lml, tobj);
898 
899 	leave(&lml_main);
900 }
901 
902 
903 /*
904  * This routine is called to complete any runtime linker activity which may have
905  * resulted in objects being loaded.  This is called from all user entry points
906  * and from any internal dl*() requests.
907  */
908 void
909 load_completion(Rt_map *nlmp)
910 {
911 	Rt_map	**tobj = 0;
912 	Lm_list	*nlml;
913 
914 	/*
915 	 * Establish any .init processing.  Note, in a world of lazy loading,
916 	 * objects may have been loaded regardless of whether the users request
917 	 * was fulfilled (i.e., a dlsym() request may have failed to find a
918 	 * symbol but objects might have been loaded during its search).  Thus,
919 	 * any tsorting starts from the nlmp (new link-maps) pointer and not
920 	 * necessarily from the link-map that may have satisfied the request.
921 	 *
922 	 * Note, the primary link-map has an initialization phase where dynamic
923 	 * .init firing is suppressed.  This provides for a simple and clean
924 	 * handshake with the primary link-maps libc, which is important for
925 	 * establishing uberdata.  In addition, auditors often obtain handles
926 	 * to primary link-map objects as the objects are loaded, so as to
927 	 * inspect the link-map for symbols.  This inspection is allowed without
928 	 * running any code on the primary link-map, as running this code may
929 	 * reenter the auditor, who may not yet have finished its own
930 	 * initialization.
931 	 */
932 	if (nlmp)
933 		nlml = LIST(nlmp);
934 
935 	if (nlmp && nlml->lm_init &&
936 	    ((nlml != &lml_main) || (rtld_flags2 & RT_FL2_PLMSETUP))) {
937 		if ((tobj = tsort(nlmp, LIST(nlmp)->lm_init,
938 		    RT_SORT_REV)) == (Rt_map **)S_ERROR)
939 			tobj = 0;
940 	}
941 
942 	/*
943 	 * Make sure any alternative link-map retrieves any external interfaces
944 	 * and initializes threads.
945 	 */
946 	if (nlmp && (nlml != &lml_main)) {
947 		(void) rt_get_extern(nlml, nlmp);
948 		rt_thr_init(nlml);
949 	}
950 
951 	/*
952 	 * Traverse the list of new link-maps and register any dynamic TLS.
953 	 * This storage is established for any objects not on the primary
954 	 * link-map, and for any objects added to the primary link-map after
955 	 * static TLS has been registered.
956 	 */
957 	if (nlmp && nlml->lm_tls &&
958 	    ((nlml != &lml_main) || (rtld_flags2 & RT_FL2_PLMSETUP))) {
959 		Rt_map	*lmp;
960 
961 		for (lmp = nlmp; lmp; lmp = (Rt_map *)NEXT(lmp)) {
962 			if (PTTLS(lmp) && PTTLS(lmp)->p_memsz)
963 				tls_modaddrem(lmp, TM_FLG_MODADD);
964 		}
965 		nlml->lm_tls = 0;
966 	}
967 
968 	/*
969 	 * Fire any .init's.
970 	 */
971 	if (tobj)
972 		call_init(tobj, DBG_INIT_SORT);
973 }
974 
975 /*
976  * Append an item to the specified list, and return a pointer to the list
977  * node created.
978  */
979 Listnode *
980 list_append(List *lst, const void *item)
981 {
982 	Listnode *	_lnp;
983 
984 	if ((_lnp = malloc(sizeof (Listnode))) == 0)
985 		return (0);
986 
987 	_lnp->data = (void *)item;
988 	_lnp->next = NULL;
989 
990 	if (lst->head == NULL)
991 		lst->tail = lst->head = _lnp;
992 	else {
993 		lst->tail->next = _lnp;
994 		lst->tail = lst->tail->next;
995 	}
996 	return (_lnp);
997 }
998 
999 
1000 /*
1001  * Add an item after specified listnode, and return a pointer to the list
1002  * node created.
1003  */
1004 Listnode *
1005 list_insert(List *lst, const void *item, Listnode *lnp)
1006 {
1007 	Listnode *	_lnp;
1008 
1009 	if ((_lnp = malloc(sizeof (Listnode))) == (Listnode *)0)
1010 		return (0);
1011 
1012 	_lnp->data = (void *)item;
1013 	_lnp->next = lnp->next;
1014 	if (_lnp->next == NULL)
1015 		lst->tail = _lnp;
1016 	lnp->next = _lnp;
1017 	return (_lnp);
1018 }
1019 
1020 /*
1021  * Prepend an item to the specified list, and return a pointer to the
1022  * list node created.
1023  */
1024 Listnode *
1025 list_prepend(List * lst, const void * item)
1026 {
1027 	Listnode *	_lnp;
1028 
1029 	if ((_lnp = malloc(sizeof (Listnode))) == (Listnode *)0)
1030 		return (0);
1031 
1032 	_lnp->data = (void *)item;
1033 
1034 	if (lst->head == NULL) {
1035 		_lnp->next = NULL;
1036 		lst->tail = lst->head = _lnp;
1037 	} else {
1038 		_lnp->next = lst->head;
1039 		lst->head = _lnp;
1040 	}
1041 	return (_lnp);
1042 }
1043 
1044 
1045 /*
1046  * Delete a 'listnode' from a list.
1047  */
1048 void
1049 list_delete(List *lst, void *item)
1050 {
1051 	Listnode	*clnp, *plnp;
1052 
1053 	for (plnp = NULL, clnp = lst->head; clnp; clnp = clnp->next) {
1054 		if (item == clnp->data)
1055 			break;
1056 		plnp = clnp;
1057 	}
1058 
1059 	if (clnp == 0)
1060 		return;
1061 
1062 	if (lst->head == clnp)
1063 		lst->head = clnp->next;
1064 	if (lst->tail == clnp)
1065 		lst->tail = plnp;
1066 
1067 	if (plnp)
1068 		plnp->next = clnp->next;
1069 
1070 	free(clnp);
1071 }
1072 
1073 /*
1074  * Append an item to the specified link map control list.
1075  */
1076 void
1077 lm_append(Lm_list *lml, Aliste lmco, Rt_map *lmp)
1078 {
1079 	Lm_cntl	*lmc;
1080 	int	add = 1;
1081 
1082 	/*
1083 	 * Indicate that this link-map list has a new object.
1084 	 */
1085 	(lml->lm_obj)++;
1086 
1087 	/*
1088 	 * If we're about to add a new object to the main link-map control list,
1089 	 * alert the debuggers that we are about to mess with this list.
1090 	 * Additions of individual objects to the main link-map control list
1091 	 * occur during initial setup as the applications immediate dependencies
1092 	 * are loaded.  Individual objects are also loaded on the main link-map
1093 	 * control list of new alternative link-map control lists.
1094 	 */
1095 	if ((lmco == ALIST_OFF_DATA) &&
1096 	    ((lml->lm_flags & LML_FLG_DBNOTIF) == 0))
1097 		rd_event(lml, RD_DLACTIVITY, RT_ADD);
1098 
1099 	/* LINTED */
1100 	lmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, lmco);
1101 
1102 	/*
1103 	 * A link-map list header points to one of more link-map control lists
1104 	 * (see include/rtld.h).  The initial list, pointed to by lm_cntl, is
1105 	 * the list of relocated objects.  Other lists maintain objects that
1106 	 * are still being analyzed or relocated.  This list provides the core
1107 	 * link-map list information used by all ld.so.1 routines.
1108 	 */
1109 	if (lmc->lc_head == NULL) {
1110 		/*
1111 		 * If this is the first link-map for the given control list,
1112 		 * initialize the list.
1113 		 */
1114 		lmc->lc_head = lmc->lc_tail = lmp;
1115 		add = 0;
1116 
1117 	} else if (FLAGS(lmp) & FLG_RT_OBJINTPO) {
1118 		Rt_map	*tlmp;
1119 
1120 		/*
1121 		 * If this is an interposer then append the link-map following
1122 		 * any other interposers (these are objects that have been
1123 		 * previously preloaded, or were identified with -z interpose).
1124 		 * Interposers can only be inserted on the first link-map
1125 		 * control list, as once relocation has started, interposition
1126 		 * from new interposers can't be guaranteed.
1127 		 *
1128 		 * NOTE: We do not interpose on the head of a list.  This model
1129 		 * evolved because dynamic executables have already been fully
1130 		 * relocated within themselves and thus can't be interposed on.
1131 		 * Nowadays it's possible to have shared objects at the head of
1132 		 * a list, which conceptually means they could be interposed on.
1133 		 * But, shared objects can be created via dldump() and may only
1134 		 * be partially relocated (just relatives), in which case they
1135 		 * are interposable, but are marked as fixed (ET_EXEC).
1136 		 *
1137 		 * Thus we really don't have a clear method of deciding when the
1138 		 * head of a link-map is interposable.  So, to be consistent,
1139 		 * for now only add interposers after the link-map lists head
1140 		 * object.
1141 		 */
1142 		for (tlmp = (Rt_map *)NEXT(lmc->lc_head); tlmp;
1143 		    tlmp = (Rt_map *)NEXT(tlmp)) {
1144 
1145 			if (FLAGS(tlmp) & FLG_RT_OBJINTPO)
1146 				continue;
1147 
1148 			/*
1149 			 * Insert the new link-map before this non-interposer,
1150 			 * and indicate an interposer is found.
1151 			 */
1152 			NEXT((Rt_map *)PREV(tlmp)) = (Link_map *)lmp;
1153 			PREV(lmp) = PREV(tlmp);
1154 
1155 			NEXT(lmp) = (Link_map *)tlmp;
1156 			PREV(tlmp) = (Link_map *)lmp;
1157 
1158 			lmc->lc_flags |= LMC_FLG_REANALYZE;
1159 			add = 0;
1160 			break;
1161 		}
1162 	}
1163 
1164 	/*
1165 	 * Fall through to appending the new link map to the tail of the list.
1166 	 * If we're processing the initial objects of this link-map list, add
1167 	 * them to the backward compatibility list.
1168 	 */
1169 	if (add) {
1170 		NEXT(lmc->lc_tail) = (Link_map *)lmp;
1171 		PREV(lmp) = (Link_map *)lmc->lc_tail;
1172 		lmc->lc_tail = lmp;
1173 	}
1174 
1175 	/*
1176 	 * Having added this link-map to a control list, indicate which control
1177 	 * list the link-map belongs to.  Note, control list information is
1178 	 * always maintained as an offset, as the Alist can be reallocated.
1179 	 */
1180 	CNTL(lmp) = lmco;
1181 
1182 	/*
1183 	 * Indicate if an interposer is found.  Note that the first object on a
1184 	 * link-map can be explicitly defined as an interposer so that it can
1185 	 * provide interposition over direct binding requests.
1186 	 */
1187 	if (FLAGS(lmp) & MSK_RT_INTPOSE)
1188 		lml->lm_flags |= LML_FLG_INTRPOSE;
1189 
1190 	/*
1191 	 * For backward compatibility with debuggers, the link-map list contains
1192 	 * pointers to the main control list.
1193 	 */
1194 	if (lmco == ALIST_OFF_DATA) {
1195 		lml->lm_head = lmc->lc_head;
1196 		lml->lm_tail = lmc->lc_tail;
1197 	}
1198 }
1199 
1200 /*
1201  * Delete an item from the specified link map control list.
1202  */
1203 void
1204 lm_delete(Lm_list *lml, Rt_map *lmp)
1205 {
1206 	Lm_cntl	*lmc;
1207 
1208 	/*
1209 	 * If the control list pointer hasn't been initialized, this object
1210 	 * never got added to a link-map list.
1211 	 */
1212 	if (CNTL(lmp) == 0)
1213 		return;
1214 
1215 	/*
1216 	 * If we're about to delete an object from the main link-map control
1217 	 * list, alert the debuggers that we are about to mess with this list.
1218 	 */
1219 	if ((CNTL(lmp) == ALIST_OFF_DATA) &&
1220 	    ((lml->lm_flags & LML_FLG_DBNOTIF) == 0))
1221 		rd_event(lml, RD_DLACTIVITY, RT_DELETE);
1222 
1223 	/* LINTED */
1224 	lmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, CNTL(lmp));
1225 
1226 	if (lmc->lc_head == lmp)
1227 		lmc->lc_head = (Rt_map *)NEXT(lmp);
1228 	else
1229 		NEXT((Rt_map *)PREV(lmp)) = (void *)NEXT(lmp);
1230 
1231 	if (lmc->lc_tail == lmp)
1232 		lmc->lc_tail = (Rt_map *)PREV(lmp);
1233 	else
1234 		PREV((Rt_map *)NEXT(lmp)) = PREV(lmp);
1235 
1236 	/*
1237 	 * For backward compatibility with debuggers, the link-map list contains
1238 	 * pointers to the main control list.
1239 	 */
1240 	if (lmc == (Lm_cntl *)&lml->lm_lists->al_data) {
1241 		lml->lm_head = lmc->lc_head;
1242 		lml->lm_tail = lmc->lc_tail;
1243 	}
1244 
1245 	/*
1246 	 * Indicate we have one less object on this control list.
1247 	 */
1248 	(lml->lm_obj)--;
1249 }
1250 
1251 /*
1252  * Move a link-map control list to another.  Objects that are being relocated
1253  * are maintained on secondary control lists.  Once their relocation is
1254  * complete, the entire list is appended to the previous control list, as this
1255  * list must have been the trigger for generating the new control list.
1256  */
1257 void
1258 lm_move(Lm_list *lml, Aliste nlmco, Aliste plmco, Lm_cntl *nlmc, Lm_cntl *plmc)
1259 {
1260 	Rt_map	*lmp;
1261 
1262 	/*
1263 	 * If we're about to add a new family of objects to the main link-map
1264 	 * control list, alert the debuggers that we are about to mess with this
1265 	 * list.  Additions of object families to the main link-map control
1266 	 * list occur during lazy loading, filtering and dlopen().
1267 	 */
1268 	if ((plmco == ALIST_OFF_DATA) &&
1269 	    ((lml->lm_flags & LML_FLG_DBNOTIF) == 0))
1270 		rd_event(lml, RD_DLACTIVITY, RT_ADD);
1271 
1272 	DBG_CALL(Dbg_file_cntl(lml, nlmco, plmco));
1273 
1274 	/*
1275 	 * Indicate each new link-map has been moved to the previous link-map
1276 	 * control list.
1277 	 */
1278 	for (lmp = nlmc->lc_head; lmp; lmp = (Rt_map *)NEXT(lmp))
1279 		CNTL(lmp) = plmco;
1280 
1281 	/*
1282 	 * Move the new link-map control list, to the callers link-map control
1283 	 * list.
1284 	 */
1285 	if (plmc->lc_head == 0) {
1286 		plmc->lc_head = nlmc->lc_head;
1287 		PREV(nlmc->lc_head) = 0;
1288 	} else {
1289 		NEXT(plmc->lc_tail) = (Link_map *)nlmc->lc_head;
1290 		PREV(nlmc->lc_head) = (Link_map *)plmc->lc_tail;
1291 	}
1292 
1293 	plmc->lc_tail = nlmc->lc_tail;
1294 	nlmc->lc_head = nlmc->lc_tail = 0;
1295 
1296 	/*
1297 	 * For backward compatibility with debuggers, the link-map list contains
1298 	 * pointers to the main control list.
1299 	 */
1300 	if (plmco == ALIST_OFF_DATA) {
1301 		lml->lm_head = plmc->lc_head;
1302 		lml->lm_tail = plmc->lc_tail;
1303 	}
1304 }
1305 
1306 /*
1307  * Environment variables can have a variety of defined permutations, and thus
1308  * the following infrastructure exists to allow this variety and to select the
1309  * required definition.
1310  *
1311  * Environment variables can be defined as 32- or 64-bit specific, and if so
1312  * they will take precedence over any instruction set neutral form.  Typically
1313  * this is only useful when the environment value is an informational string.
1314  *
1315  * Environment variables may be obtained from the standard user environment or
1316  * from a configuration file.  The latter provides a fallback if no user
1317  * environment setting is found, and can take two forms:
1318  *
1319  *  .	a replaceable definition - this will be used if no user environment
1320  *	setting has been seen, or
1321  *
1322  *  .	an permanent definition - this will be used no matter what user
1323  *	environment setting is seen.  In the case of list variables it will be
1324  *	appended to any process environment setting seen.
1325  *
1326  * Environment variables can be defined without a value (ie. LD_XXXX=) so as to
1327  * override any replaceable environment variables from a configuration file.
1328  */
1329 static	u_longlong_t		rplgen;		/* replaceable generic */
1330 						/*	variables */
1331 static	u_longlong_t		rplisa;		/* replaceable ISA specific */
1332 						/*	variables */
1333 static	u_longlong_t		prmgen;		/* permanent generic */
1334 						/*	variables */
1335 static	u_longlong_t		prmisa;		/* permanent ISA specific */
1336 						/*	variables */
1337 
1338 /*
1339  * Classify an environment variables type.
1340  */
1341 #define	ENV_TYP_IGNORE		0x1		/* ignore - variable is for */
1342 						/*	the wrong ISA */
1343 #define	ENV_TYP_ISA		0x2		/* variable is ISA specific */
1344 #define	ENV_TYP_CONFIG		0x4		/* variable obtained from a */
1345 						/*	config file */
1346 #define	ENV_TYP_PERMANT		0x8		/* variable is permanent */
1347 
1348 /*
1349  * Identify all environment variables.
1350  */
1351 #define	ENV_FLG_AUDIT		0x0000000001ULL
1352 #define	ENV_FLG_AUDIT_ARGS	0x0000000002ULL
1353 #define	ENV_FLG_BIND_NOW	0x0000000004ULL
1354 #define	ENV_FLG_BIND_NOT	0x0000000008ULL
1355 #define	ENV_FLG_BINDINGS	0x0000000010ULL
1356 #define	ENV_FLG_CONCURRENCY	0x0000000020ULL
1357 #define	ENV_FLG_CONFGEN		0x0000000040ULL
1358 #define	ENV_FLG_CONFIG		0x0000000080ULL
1359 #define	ENV_FLG_DEBUG		0x0000000100ULL
1360 #define	ENV_FLG_DEBUG_OUTPUT	0x0000000200ULL
1361 #define	ENV_FLG_DEMANGLE	0x0000000400ULL
1362 #define	ENV_FLG_FLAGS		0x0000000800ULL
1363 #define	ENV_FLG_INIT		0x0000001000ULL
1364 #define	ENV_FLG_LIBPATH		0x0000002000ULL
1365 #define	ENV_FLG_LOADAVAIL	0x0000004000ULL
1366 #define	ENV_FLG_LOADFLTR	0x0000008000ULL
1367 #define	ENV_FLG_NOAUDIT		0x0000010000ULL
1368 #define	ENV_FLG_NOAUXFLTR	0x0000020000ULL
1369 #define	ENV_FLG_NOBAPLT		0x0000040000ULL
1370 #define	ENV_FLG_NOCONFIG	0x0000080000ULL
1371 #define	ENV_FLG_NODIRCONFIG	0x0000100000ULL
1372 #define	ENV_FLG_NODIRECT	0x0000200000ULL
1373 #define	ENV_FLG_NOENVCONFIG	0x0000400000ULL
1374 #define	ENV_FLG_NOLAZY		0x0000800000ULL
1375 #define	ENV_FLG_NOOBJALTER	0x0001000000ULL
1376 #define	ENV_FLG_NOVERSION	0x0002000000ULL
1377 #define	ENV_FLG_PRELOAD		0x0004000000ULL
1378 #define	ENV_FLG_PROFILE		0x0008000000ULL
1379 #define	ENV_FLG_PROFILE_OUTPUT	0x0010000000ULL
1380 #define	ENV_FLG_SIGNAL		0x0020000000ULL
1381 #define	ENV_FLG_TRACE_OBJS	0x0040000000ULL
1382 #define	ENV_FLG_TRACE_PTHS	0x0080000000ULL
1383 #define	ENV_FLG_UNREF		0x0100000000ULL
1384 #define	ENV_FLG_UNUSED		0x0200000000ULL
1385 #define	ENV_FLG_VERBOSE		0x0400000000ULL
1386 #define	ENV_FLG_WARN		0x0800000000ULL
1387 #define	ENV_FLG_NOFLTCONFIG	0x1000000000ULL
1388 #define	ENV_FLG_BIND_LAZY	0x2000000000ULL
1389 #define	ENV_FLG_NOUNRESWEAK	0x4000000000ULL
1390 
1391 #ifdef	SIEBEL_DISABLE
1392 #define	ENV_FLG_FIX_1		0x8000000000ULL
1393 #endif
1394 
1395 #define	SEL_REPLACE		0x0001
1396 #define	SEL_PERMANT		0x0002
1397 #define	SEL_ACT_RT		0x0100	/* setting rtld_flags */
1398 #define	SEL_ACT_RT2		0x0200	/* setting rtld_flags2 */
1399 #define	SEL_ACT_STR		0x0400	/* setting string value */
1400 #define	SEL_ACT_LML		0x0800	/* setting lml_flags */
1401 #define	SEL_ACT_LMLT		0x1000	/* setting lml_tflags */
1402 #define	SEL_ACT_SPEC_1		0x2000	/* For FLG_{FLAGS, LIBPATH} */
1403 #define	SEL_ACT_SPEC_2		0x4000	/* need special handling */
1404 
1405 /*
1406  * Pattern match an LD_XXXX environment variable.  s1 points to the XXXX part
1407  * and len specifies its length (comparing a strings length before the string
1408  * itself speed things up).  s2 points to the token itself which has already
1409  * had any leading white-space removed.
1410  */
1411 static void
1412 ld_generic_env(const char *s1, size_t len, const char *s2, Word *lmflags,
1413     Word *lmtflags, uint_t env_flags, int aout)
1414 {
1415 	u_longlong_t	variable = 0;
1416 	ushort_t	select = 0;
1417 	const char	**str;
1418 	Word		val = 0;
1419 
1420 	/*
1421 	 * Determine whether we're dealing with a replaceable or permanent
1422 	 * string.
1423 	 */
1424 	if (env_flags & ENV_TYP_PERMANT) {
1425 		/*
1426 		 * If the string is from a configuration file and defined as
1427 		 * permanent, assign it as permanent.
1428 		 */
1429 		select |= SEL_PERMANT;
1430 	} else
1431 		select |= SEL_REPLACE;
1432 
1433 	/*
1434 	 * Parse the variable given.
1435 	 *
1436 	 * The LD_AUDIT family.
1437 	 */
1438 	if (*s1 == 'A') {
1439 		if ((len == MSG_LD_AUDIT_SIZE) && (strncmp(s1,
1440 		    MSG_ORIG(MSG_LD_AUDIT), MSG_LD_AUDIT_SIZE) == 0)) {
1441 			/*
1442 			 * Replaceable and permanent audit objects can exist.
1443 			 */
1444 			select |= SEL_ACT_STR;
1445 			if (select & SEL_REPLACE)
1446 				str = &rpl_audit;
1447 			else {
1448 				str = &prm_audit;
1449 				rpl_audit = 0;
1450 			}
1451 			variable = ENV_FLG_AUDIT;
1452 		} else if ((len == MSG_LD_AUDIT_ARGS_SIZE) &&
1453 		    (strncmp(s1, MSG_ORIG(MSG_LD_AUDIT_ARGS),
1454 		    MSG_LD_AUDIT_ARGS_SIZE) == 0)) {
1455 			/*
1456 			 * A specialized variable for plt_exit() use, not
1457 			 * documented for general use.
1458 			 */
1459 			select |= SEL_ACT_SPEC_2;
1460 			variable = ENV_FLG_AUDIT_ARGS;
1461 		}
1462 	}
1463 	/*
1464 	 * The LD_BIND family and LD_BREADTH (historic).
1465 	 */
1466 	else if (*s1 == 'B') {
1467 		if ((len == MSG_LD_BIND_LAZY_SIZE) && (strncmp(s1,
1468 		    MSG_ORIG(MSG_LD_BIND_LAZY),
1469 		    MSG_LD_BIND_LAZY_SIZE) == 0)) {
1470 			select |= SEL_ACT_RT2;
1471 			val = RT_FL2_BINDLAZY;
1472 			variable = ENV_FLG_BIND_LAZY;
1473 		} else if ((len == MSG_LD_BIND_NOW_SIZE) && (strncmp(s1,
1474 		    MSG_ORIG(MSG_LD_BIND_NOW), MSG_LD_BIND_NOW_SIZE) == 0)) {
1475 			select |= SEL_ACT_RT2;
1476 			val = RT_FL2_BINDNOW;
1477 			variable = ENV_FLG_BIND_NOW;
1478 		} else if ((len == MSG_LD_BIND_NOT_SIZE) && (strncmp(s1,
1479 		    MSG_ORIG(MSG_LD_BIND_NOT), MSG_LD_BIND_NOT_SIZE) == 0)) {
1480 			/*
1481 			 * Another trick, enabled to help debug AOUT
1482 			 * applications under BCP, but not documented for
1483 			 * general use.
1484 			 */
1485 			select |= SEL_ACT_RT;
1486 			val = RT_FL_NOBIND;
1487 			variable = ENV_FLG_BIND_NOT;
1488 		} else if ((len == MSG_LD_BINDINGS_SIZE) && (strncmp(s1,
1489 		    MSG_ORIG(MSG_LD_BINDINGS), MSG_LD_BINDINGS_SIZE) == 0)) {
1490 			/*
1491 			 * This variable is simply for backward compatibility.
1492 			 * If this and LD_DEBUG are both specified, only one of
1493 			 * the strings is going to get processed.
1494 			 */
1495 			select |= SEL_ACT_SPEC_2;
1496 			variable = ENV_FLG_BINDINGS;
1497 #ifndef LD_BREADTH_DISABLED
1498 		} else if ((len == MSG_LD_BREADTH_SIZE) && (strncmp(s1,
1499 		    MSG_ORIG(MSG_LD_BREADTH), MSG_LD_BREADTH_SIZE) == 0)) {
1500 			/*
1501 			 * Besides some old patches this is no longer available.
1502 			 */
1503 			rtld_flags |= RT_FL_BREADTH;
1504 			return;
1505 #endif
1506 		}
1507 	}
1508 	/*
1509 	 * LD_CONCURRENCY and LD_CONFIG family.
1510 	 */
1511 	else if (*s1 == 'C') {
1512 		if ((len == MSG_LD_CONCURRENCY_SIZE) && (strncmp(s1,
1513 		    MSG_ORIG(MSG_LD_CONCURRENCY),
1514 		    MSG_LD_CONCURRENCY_SIZE) == 0)) {
1515 			/*
1516 			 * Waiting in the wings, as concurrency checking isn't
1517 			 * yet enabled.
1518 			 */
1519 			select |= SEL_ACT_SPEC_2;
1520 			variable = ENV_FLG_CONCURRENCY;
1521 		} else if ((len == MSG_LD_CONFGEN_SIZE) && (strncmp(s1,
1522 		    MSG_ORIG(MSG_LD_CONFGEN), MSG_LD_CONFGEN_SIZE) == 0)) {
1523 			/*
1524 			 * Set by crle(1) to indicate it's building a
1525 			 * configuration file, not documented for general use.
1526 			 */
1527 			select |= SEL_ACT_SPEC_2;
1528 			variable = ENV_FLG_CONFGEN;
1529 		} else if ((len == MSG_LD_CONFIG_SIZE) && (strncmp(s1,
1530 		    MSG_ORIG(MSG_LD_CONFIG), MSG_LD_CONFIG_SIZE) == 0)) {
1531 			/*
1532 			 * Secure applications must use a default configuration
1533 			 * file.  A setting from a configuration file doesn't
1534 			 * make sense (given we must be reading a configuration
1535 			 * file to have gotten this).
1536 			 */
1537 			if ((rtld_flags & RT_FL_SECURE) ||
1538 			    (env_flags & ENV_TYP_CONFIG))
1539 				return;
1540 			select |= SEL_ACT_STR;
1541 			str = &config->c_name;
1542 			variable = ENV_FLG_CONFIG;
1543 		}
1544 	}
1545 	/*
1546 	 * The LD_DEBUG family and LD_DEMANGLE.
1547 	 */
1548 	else if (*s1 == 'D') {
1549 		if ((len == MSG_LD_DEBUG_SIZE) && (strncmp(s1,
1550 		    MSG_ORIG(MSG_LD_DEBUG), MSG_LD_DEBUG_SIZE) == 0)) {
1551 			select |= SEL_ACT_STR;
1552 			if (select & SEL_REPLACE)
1553 				str = &rpl_debug;
1554 			else {
1555 				str = &prm_debug;
1556 				rpl_debug = 0;
1557 			}
1558 			variable = ENV_FLG_DEBUG;
1559 		} else if ((len == MSG_LD_DEBUG_OUTPUT_SIZE) && (strncmp(s1,
1560 		    MSG_ORIG(MSG_LD_DEBUG_OUTPUT),
1561 		    MSG_LD_DEBUG_OUTPUT_SIZE) == 0)) {
1562 			select |= SEL_ACT_STR;
1563 			str = &dbg_file;
1564 			variable = ENV_FLG_DEBUG_OUTPUT;
1565 		} else if ((len == MSG_LD_DEMANGLE_SIZE) && (strncmp(s1,
1566 		    MSG_ORIG(MSG_LD_DEMANGLE), MSG_LD_DEMANGLE_SIZE) == 0)) {
1567 			select |= SEL_ACT_RT;
1568 			val = RT_FL_DEMANGLE;
1569 			variable = ENV_FLG_DEMANGLE;
1570 		}
1571 	}
1572 	/*
1573 	 * LD_FLAGS - collect the best variable definition.  On completion of
1574 	 * environment variable processing pass the result to ld_flags_env()
1575 	 * where they'll be decomposed and passed back to this routine.
1576 	 */
1577 	else if (*s1 == 'F') {
1578 		if ((len == MSG_LD_FLAGS_SIZE) && (strncmp(s1,
1579 		    MSG_ORIG(MSG_LD_FLAGS), MSG_LD_FLAGS_SIZE) == 0)) {
1580 			select |= SEL_ACT_SPEC_1;
1581 			if (select & SEL_REPLACE)
1582 				str = &rpl_ldflags;
1583 			else {
1584 				str = &prm_ldflags;
1585 				rpl_ldflags = 0;
1586 			}
1587 			variable = ENV_FLG_FLAGS;
1588 		}
1589 	}
1590 	/*
1591 	 * LD_INIT (internal, used by ldd(1)).
1592 	 */
1593 	else if (*s1 == 'I') {
1594 		if ((len == MSG_LD_INIT_SIZE) && (strncmp(s1,
1595 		    MSG_ORIG(MSG_LD_INIT), MSG_LD_INIT_SIZE) == 0)) {
1596 			select |= SEL_ACT_LML;
1597 			val = LML_FLG_TRC_INIT;
1598 			variable = ENV_FLG_INIT;
1599 		}
1600 	}
1601 	/*
1602 	 * The LD_LIBRARY_PATH and LD_LOAD families.
1603 	 */
1604 	else if (*s1 == 'L') {
1605 		if ((len == MSG_LD_LIBPATH_SIZE) && (strncmp(s1,
1606 		    MSG_ORIG(MSG_LD_LIBPATH), MSG_LD_LIBPATH_SIZE) == 0)) {
1607 			select |= SEL_ACT_SPEC_1;
1608 			if (select & SEL_REPLACE)
1609 				str = &rpl_libpath;
1610 			else {
1611 				str = &prm_libpath;
1612 				rpl_libpath = 0;
1613 			}
1614 			variable = ENV_FLG_LIBPATH;
1615 		} else if ((len == MSG_LD_LOADAVAIL_SIZE) && (strncmp(s1,
1616 		    MSG_ORIG(MSG_LD_LOADAVAIL), MSG_LD_LOADAVAIL_SIZE) == 0)) {
1617 			/*
1618 			 * Internal use by crle(1), not documented for general
1619 			 * use.
1620 			 */
1621 			select |= SEL_ACT_LML;
1622 			val = LML_FLG_LOADAVAIL;
1623 			variable = ENV_FLG_LOADAVAIL;
1624 		} else if ((len == MSG_LD_LOADFLTR_SIZE) && (strncmp(s1,
1625 		    MSG_ORIG(MSG_LD_LOADFLTR), MSG_LD_LOADFLTR_SIZE) == 0)) {
1626 			select |= SEL_ACT_SPEC_2;
1627 			variable = ENV_FLG_LOADFLTR;
1628 		}
1629 	}
1630 	/*
1631 	 * The LD_NO family.
1632 	 */
1633 	else if (*s1 == 'N') {
1634 		if ((len == MSG_LD_NOAUDIT_SIZE) && (strncmp(s1,
1635 		    MSG_ORIG(MSG_LD_NOAUDIT), MSG_LD_NOAUDIT_SIZE) == 0)) {
1636 			select |= SEL_ACT_RT;
1637 			val = RT_FL_NOAUDIT;
1638 			variable = ENV_FLG_NOAUDIT;
1639 		} else if ((len == MSG_LD_NOAUXFLTR_SIZE) && (strncmp(s1,
1640 		    MSG_ORIG(MSG_LD_NOAUXFLTR), MSG_LD_NOAUXFLTR_SIZE) == 0)) {
1641 			select |= SEL_ACT_RT;
1642 			val = RT_FL_NOAUXFLTR;
1643 			variable = ENV_FLG_NOAUXFLTR;
1644 		} else if ((len == MSG_LD_NOBAPLT_SIZE) && (strncmp(s1,
1645 		    MSG_ORIG(MSG_LD_NOBAPLT), MSG_LD_NOBAPLT_SIZE) == 0)) {
1646 			select |= SEL_ACT_RT;
1647 			val = RT_FL_NOBAPLT;
1648 			variable = ENV_FLG_NOBAPLT;
1649 		} else if ((len == MSG_LD_NOCONFIG_SIZE) && (strncmp(s1,
1650 		    MSG_ORIG(MSG_LD_NOCONFIG), MSG_LD_NOCONFIG_SIZE) == 0)) {
1651 			select |= SEL_ACT_RT;
1652 			val = RT_FL_NOCFG;
1653 			variable = ENV_FLG_NOCONFIG;
1654 		} else if ((len == MSG_LD_NODIRCONFIG_SIZE) && (strncmp(s1,
1655 		    MSG_ORIG(MSG_LD_NODIRCONFIG),
1656 		    MSG_LD_NODIRCONFIG_SIZE) == 0)) {
1657 			select |= SEL_ACT_RT;
1658 			val = RT_FL_NODIRCFG;
1659 			variable = ENV_FLG_NODIRCONFIG;
1660 		} else if ((len == MSG_LD_NODIRECT_SIZE) && (strncmp(s1,
1661 		    MSG_ORIG(MSG_LD_NODIRECT), MSG_LD_NODIRECT_SIZE) == 0)) {
1662 			select |= SEL_ACT_LMLT;
1663 			val = LML_TFLG_NODIRECT;
1664 			variable = ENV_FLG_NODIRECT;
1665 		} else if ((len == MSG_LD_NOENVCONFIG_SIZE) && (strncmp(s1,
1666 		    MSG_ORIG(MSG_LD_NOENVCONFIG),
1667 		    MSG_LD_NOENVCONFIG_SIZE) == 0)) {
1668 			select |= SEL_ACT_RT;
1669 			val = RT_FL_NOENVCFG;
1670 			variable = ENV_FLG_NOENVCONFIG;
1671 		} else if ((len == MSG_LD_NOFLTCONFIG_SIZE) && (strncmp(s1,
1672 		    MSG_ORIG(MSG_LD_NOFLTCONFIG),
1673 		    MSG_LD_NOFLTCONFIG_SIZE) == 0)) {
1674 			select |= SEL_ACT_RT2;
1675 			val = RT_FL2_NOFLTCFG;
1676 			variable = ENV_FLG_NOFLTCONFIG;
1677 		} else if ((len == MSG_LD_NOLAZY_SIZE) && (strncmp(s1,
1678 		    MSG_ORIG(MSG_LD_NOLAZY), MSG_LD_NOLAZY_SIZE) == 0)) {
1679 			select |= SEL_ACT_LMLT;
1680 			val = LML_TFLG_NOLAZYLD;
1681 			variable = ENV_FLG_NOLAZY;
1682 		} else if ((len == MSG_LD_NOOBJALTER_SIZE) && (strncmp(s1,
1683 		    MSG_ORIG(MSG_LD_NOOBJALTER),
1684 		    MSG_LD_NOOBJALTER_SIZE) == 0)) {
1685 			select |= SEL_ACT_RT;
1686 			val = RT_FL_NOOBJALT;
1687 			variable = ENV_FLG_NOOBJALTER;
1688 		} else if ((len == MSG_LD_NOVERSION_SIZE) && (strncmp(s1,
1689 		    MSG_ORIG(MSG_LD_NOVERSION), MSG_LD_NOVERSION_SIZE) == 0)) {
1690 			select |= SEL_ACT_RT;
1691 			val = RT_FL_NOVERSION;
1692 			variable = ENV_FLG_NOVERSION;
1693 		} else if ((len == MSG_LD_NOUNRESWEAK_SIZE) && (strncmp(s1,
1694 		    MSG_ORIG(MSG_LD_NOUNRESWEAK),
1695 		    MSG_LD_NOUNRESWEAK_SIZE) == 0)) {
1696 			/*
1697 			 * LD_NOUNRESWEAK (internal, used by ldd(1)).
1698 			 */
1699 			select |= SEL_ACT_LML;
1700 			val = LML_FLG_TRC_NOUNRESWEAK;
1701 			variable = ENV_FLG_NOUNRESWEAK;
1702 		}
1703 	}
1704 	/*
1705 	 * LD_ORIGIN.
1706 	 */
1707 	else if (*s1 == 'O') {
1708 #ifndef	EXPAND_RELATIVE
1709 		if ((len == MSG_LD_ORIGIN_SIZE) && (strncmp(s1,
1710 		    MSG_ORIG(MSG_LD_ORIGIN), MSG_LD_ORIGIN_SIZE) == 0)) {
1711 			/*
1712 			 * Besides some old patches this is no longer required.
1713 			 */
1714 			rtld_flags |= RT_FL_RELATIVE;
1715 		}
1716 #endif
1717 		return;
1718 	}
1719 	/*
1720 	 * LD_PRELOAD and LD_PROFILE family.
1721 	 */
1722 	else if (*s1 == 'P') {
1723 		if ((len == MSG_LD_PRELOAD_SIZE) && (strncmp(s1,
1724 		    MSG_ORIG(MSG_LD_PRELOAD), MSG_LD_PRELOAD_SIZE) == 0)) {
1725 			select |= SEL_ACT_STR;
1726 			if (select & SEL_REPLACE)
1727 				str = &rpl_preload;
1728 			else  {
1729 				str = &prm_preload;
1730 				rpl_preload = 0;
1731 			}
1732 			variable = ENV_FLG_PRELOAD;
1733 		} else if ((len == MSG_LD_PROFILE_SIZE) && (strncmp(s1,
1734 		    MSG_ORIG(MSG_LD_PROFILE), MSG_LD_PROFILE_SIZE) == 0)) {
1735 			/*
1736 			 * Only one user library can be profiled at a time.
1737 			 */
1738 			select |= SEL_ACT_SPEC_2;
1739 			variable = ENV_FLG_PROFILE;
1740 		} else if ((len == MSG_LD_PROFILE_OUTPUT_SIZE) && (strncmp(s1,
1741 		    MSG_ORIG(MSG_LD_PROFILE_OUTPUT),
1742 		    MSG_LD_PROFILE_OUTPUT_SIZE) == 0)) {
1743 			/*
1744 			 * Only one user library can be profiled at a time.
1745 			 */
1746 			select |= SEL_ACT_STR;
1747 			str = &profile_out;
1748 			variable = ENV_FLG_PROFILE_OUTPUT;
1749 		}
1750 	}
1751 	/*
1752 	 * LD_SIGNAL.
1753 	 */
1754 	else if (*s1 == 'S') {
1755 		if (rtld_flags & RT_FL_SECURE)
1756 			return;
1757 		if ((len == MSG_LD_SIGNAL_SIZE) &&
1758 		    (strncmp(s1, MSG_ORIG(MSG_LD_SIGNAL),
1759 		    MSG_LD_SIGNAL_SIZE) == 0)) {
1760 			select |= SEL_ACT_SPEC_2;
1761 			variable = ENV_FLG_SIGNAL;
1762 		}
1763 	}
1764 	/*
1765 	 * The LD_TRACE family (internal, used by ldd(1)).  This definition is
1766 	 * the key to enabling all other ldd(1) specific environment variables.
1767 	 * In case an auditor is called, which in turn might exec(2) a
1768 	 * subprocess, this variable is disabled, so that any subprocess
1769 	 * escapes ldd(1) processing.
1770 	 */
1771 	else if (*s1 == 'T') {
1772 		if (((len == MSG_LD_TRACE_OBJS_SIZE) &&
1773 		    (strncmp(s1, MSG_ORIG(MSG_LD_TRACE_OBJS),
1774 		    MSG_LD_TRACE_OBJS_SIZE) == 0)) ||
1775 		    ((len == MSG_LD_TRACE_OBJS_E_SIZE) &&
1776 		    (((strncmp(s1, MSG_ORIG(MSG_LD_TRACE_OBJS_E),
1777 		    MSG_LD_TRACE_OBJS_E_SIZE) == 0) && !aout) ||
1778 		    ((strncmp(s1, MSG_ORIG(MSG_LD_TRACE_OBJS_A),
1779 		    MSG_LD_TRACE_OBJS_A_SIZE) == 0) && aout)))) {
1780 			char	*s0 = (char *)s1;
1781 
1782 			select |= SEL_ACT_SPEC_2;
1783 			variable = ENV_FLG_TRACE_OBJS;
1784 
1785 #if	defined(__sparc) || defined(__x86)
1786 			/*
1787 			 * The simplest way to "disable" this variable is to
1788 			 * truncate this string to "LD_'\0'". This string is
1789 			 * ignored by any ld.so.1 environment processing.
1790 			 * Use of such interfaces as unsetenv(3c) are overkill,
1791 			 * and would drag too much libc implementation detail
1792 			 * into ld.so.1.
1793 			 */
1794 			*s0 = '\0';
1795 #else
1796 /*
1797  * Verify that the above write is appropriate for any new platforms.
1798  */
1799 #error	unsupported architecture!
1800 #endif
1801 		} else if ((len == MSG_LD_TRACE_PTHS_SIZE) && (strncmp(s1,
1802 		    MSG_ORIG(MSG_LD_TRACE_PTHS),
1803 		    MSG_LD_TRACE_PTHS_SIZE) == 0)) {
1804 			select |= SEL_ACT_LML;
1805 			val = LML_FLG_TRC_SEARCH;
1806 			variable = ENV_FLG_TRACE_PTHS;
1807 		}
1808 	}
1809 	/*
1810 	 * LD_UNREF and LD_UNUSED (internal, used by ldd(1)).
1811 	 */
1812 	else if (*s1 == 'U') {
1813 		if ((len == MSG_LD_UNREF_SIZE) && (strncmp(s1,
1814 		    MSG_ORIG(MSG_LD_UNREF), MSG_LD_UNREF_SIZE) == 0)) {
1815 			select |= SEL_ACT_LML;
1816 			val = LML_FLG_TRC_UNREF;
1817 			variable = ENV_FLG_UNREF;
1818 		} else if ((len == MSG_LD_UNUSED_SIZE) && (strncmp(s1,
1819 		    MSG_ORIG(MSG_LD_UNUSED), MSG_LD_UNUSED_SIZE) == 0)) {
1820 			select |= SEL_ACT_LML;
1821 			val = LML_FLG_TRC_UNUSED;
1822 			variable = ENV_FLG_UNUSED;
1823 		}
1824 	}
1825 	/*
1826 	 * LD_VERBOSE (internal, used by ldd(1)).
1827 	 */
1828 	else if (*s1 == 'V') {
1829 		if ((len == MSG_LD_VERBOSE_SIZE) && (strncmp(s1,
1830 		    MSG_ORIG(MSG_LD_VERBOSE), MSG_LD_VERBOSE_SIZE) == 0)) {
1831 			select |= SEL_ACT_LML;
1832 			val = LML_FLG_TRC_VERBOSE;
1833 			variable = ENV_FLG_VERBOSE;
1834 		}
1835 	}
1836 	/*
1837 	 * LD_WARN (internal, used by ldd(1)).
1838 	 */
1839 	else if (*s1 == 'W') {
1840 		if ((len == MSG_LD_WARN_SIZE) && (strncmp(s1,
1841 		    MSG_ORIG(MSG_LD_WARN), MSG_LD_WARN_SIZE) == 0)) {
1842 			select |= SEL_ACT_LML;
1843 			val = LML_FLG_TRC_WARN;
1844 			variable = ENV_FLG_WARN;
1845 		}
1846 #ifdef	SIEBEL_DISABLE
1847 	}
1848 	/*
1849 	 * LD__FIX__ (undocumented, enable future technology that can't be
1850 	 * delivered in a patch release).
1851 	 */
1852 	else if (*s1 == '_') {
1853 		if ((len == MSG_LD_FIX_1_SIZE) && (strncmp(s1,
1854 		    MSG_ORIG(MSG_LD_FIX_1), MSG_LD_FIX_1_SIZE) == 0)) {
1855 			select |= SEL_ACT_RT;
1856 			val = RT_FL_DISFIX_1;
1857 			variable = ENV_FLG_FIX_1;
1858 		}
1859 #endif
1860 	}
1861 	if (variable == 0)
1862 		return;
1863 
1864 	/*
1865 	 * If the variable is already processed with ISA specific variable,
1866 	 * no further processing needed.
1867 	 */
1868 	if (((select & SEL_REPLACE) && (rplisa & variable)) ||
1869 	    ((select & SEL_PERMANT) && (prmisa & variable)))
1870 		return;
1871 
1872 	/*
1873 	 * Now mark the appropriate variables.
1874 	 * If the replaceable variable is already set, then the
1875 	 * process environment variable must be set. Any replaceable
1876 	 * variable specified in a configuration file can be ignored.
1877 	 */
1878 	if (env_flags & ENV_TYP_ISA) {
1879 		/*
1880 		 * This is ISA setting. We do the setting
1881 		 * even if s2 is NULL.
1882 		 * If s2 is NULL, we might need to undo
1883 		 * the setting.
1884 		 */
1885 		if (select & SEL_REPLACE) {
1886 			if (rplisa & variable)
1887 				return;
1888 			rplisa |= variable;
1889 		} else {
1890 			prmisa |= variable;
1891 		}
1892 	} else if (s2) {
1893 		/*
1894 		 * This is non0-ISA setting
1895 		 */
1896 		if (select & SEL_REPLACE) {
1897 			if (rplgen & variable)
1898 				return;
1899 			rplgen |= variable;
1900 		} else
1901 			prmgen |= variable;
1902 	} else
1903 		/*
1904 		 * This is non-ISA setting which
1905 		 * can be ignored.
1906 		 */
1907 		return;
1908 
1909 	/*
1910 	 * Now perform the setting.
1911 	 */
1912 	if (select & SEL_ACT_RT) {
1913 		if (s2)
1914 			rtld_flags |= val;
1915 		else
1916 			rtld_flags &= ~val;
1917 	} else if (select & SEL_ACT_RT2) {
1918 		if (s2)
1919 			rtld_flags2 |= val;
1920 		else
1921 			rtld_flags2 &= ~val;
1922 	} else if (select & SEL_ACT_STR)
1923 		*str = s2;
1924 	else if (select & SEL_ACT_LML) {
1925 		if (s2)
1926 			*lmflags |= val;
1927 		else
1928 			*lmflags &= ~val;
1929 	} else if (select & SEL_ACT_LMLT) {
1930 		if (s2)
1931 			*lmtflags |= val;
1932 		else
1933 			*lmtflags &= ~val;
1934 	} else if (select & SEL_ACT_SPEC_1) {
1935 		/*
1936 		 * variable is either ENV_FLG_FLAGS or ENV_FLG_LIBPATH
1937 		 */
1938 		*str = s2;
1939 		if ((select & SEL_REPLACE) && (env_flags & ENV_TYP_CONFIG)) {
1940 			if (s2) {
1941 				if (variable == ENV_FLG_FLAGS)
1942 					env_info |= ENV_INF_FLAGCFG;
1943 				else
1944 					env_info |= ENV_INF_PATHCFG;
1945 			} else {
1946 				if (variable == ENV_FLG_FLAGS)
1947 					env_info &= ~ENV_INF_FLAGCFG;
1948 				else
1949 					env_info &= ~ENV_INF_PATHCFG;
1950 			}
1951 		}
1952 	} else if (select & SEL_ACT_SPEC_2) {
1953 		/*
1954 		 * variables can be: ENV_FLG_
1955 		 * 	AUDIT_ARGS, BINDING, CONCURRENCY, CONFGEN,
1956 		 *	LOADFLTR, PROFILE, SIGNAL, TRACE_OBJS
1957 		 */
1958 		if (variable == ENV_FLG_AUDIT_ARGS) {
1959 			if (s2) {
1960 				audit_argcnt = atoi(s2);
1961 				audit_argcnt += audit_argcnt % 2;
1962 			} else
1963 				audit_argcnt = 0;
1964 		} else if (variable == ENV_FLG_BINDINGS) {
1965 			if (s2)
1966 				rpl_debug = MSG_ORIG(MSG_TKN_BINDINGS);
1967 			else
1968 				rpl_debug = 0;
1969 		} else if (variable == ENV_FLG_CONCURRENCY) {
1970 			if (s2)
1971 				rtld_flags &= ~RT_FL_NOCONCUR;
1972 			else
1973 				rtld_flags |= RT_FL_NOCONCUR;
1974 		} else if (variable == ENV_FLG_CONFGEN) {
1975 			if (s2) {
1976 				rtld_flags |= RT_FL_CONFGEN;
1977 				*lmflags |= LML_FLG_IGNRELERR;
1978 			} else {
1979 				rtld_flags &= ~RT_FL_CONFGEN;
1980 				*lmflags &= ~LML_FLG_IGNRELERR;
1981 			}
1982 		} else if (variable == ENV_FLG_LOADFLTR) {
1983 			if (s2) {
1984 				*lmtflags |= LML_TFLG_LOADFLTR;
1985 				if (*s2 == '2')
1986 					rtld_flags |= RT_FL_WARNFLTR;
1987 			} else {
1988 				*lmtflags &= ~LML_TFLG_LOADFLTR;
1989 				rtld_flags &= ~RT_FL_WARNFLTR;
1990 			}
1991 		} else if (variable == ENV_FLG_PROFILE) {
1992 			profile_name = s2;
1993 			if (s2) {
1994 				if (strcmp(s2, MSG_ORIG(MSG_FIL_RTLD)) == 0) {
1995 					return;
1996 				}
1997 				/* BEGIN CSTYLED */
1998 				if (rtld_flags & RT_FL_SECURE) {
1999 					profile_lib =
2000 #if	defined(_ELF64)
2001 					    MSG_ORIG(MSG_PTH_LDPROFSE_64);
2002 #else
2003 					    MSG_ORIG(MSG_PTH_LDPROFSE);
2004 #endif
2005 				} else {
2006 					profile_lib =
2007 #if	defined(_ELF64)
2008 					    MSG_ORIG(MSG_PTH_LDPROF_64);
2009 #else
2010 					    MSG_ORIG(MSG_PTH_LDPROF);
2011 #endif
2012 				}
2013 				/* END CSTYLED */
2014 			} else
2015 				profile_lib = 0;
2016 		} else if (variable == ENV_FLG_SIGNAL) {
2017 			killsig = s2 ? atoi(s2) : SIGKILL;
2018 		} else if (variable == ENV_FLG_TRACE_OBJS) {
2019 			if (s2) {
2020 				*lmflags |= LML_FLG_TRC_ENABLE;
2021 				if (*s2 == '2')
2022 					*lmflags |= LML_FLG_TRC_LDDSTUB;
2023 			} else
2024 				*lmflags &=
2025 				    ~(LML_FLG_TRC_ENABLE|LML_FLG_TRC_LDDSTUB);
2026 		}
2027 	}
2028 }
2029 
2030 /*
2031  * Determine whether we have an architecture specific environment variable.
2032  * If we do, and we're the wrong architecture, it'll just get ignored.
2033  * Otherwise the variable is processed in it's architecture neutral form.
2034  */
2035 static int
2036 ld_arch_env(const char *s1, size_t *len)
2037 {
2038 	size_t	_len = *len - 3;
2039 
2040 	if (s1[_len++] == '_') {
2041 		if ((s1[_len] == '3') && (s1[_len + 1] == '2')) {
2042 #if	defined(_ELF64)
2043 			return (ENV_TYP_IGNORE);
2044 #else
2045 			*len = *len - 3;
2046 			return (ENV_TYP_ISA);
2047 #endif
2048 		}
2049 		if ((s1[_len] == '6') && (s1[_len + 1] == '4')) {
2050 #if	defined(_ELF64)
2051 			*len = *len - 3;
2052 			return (ENV_TYP_ISA);
2053 #else
2054 			return (ENV_TYP_IGNORE);
2055 #endif
2056 		}
2057 	}
2058 	return (0);
2059 }
2060 
2061 
2062 /*
2063  * Process an LD_FLAGS environment variable.  The value can be a comma
2064  * separated set of tokens, which are sent (in upper case) into the generic
2065  * LD_XXXX environment variable engine.  For example:
2066  *
2067  *	LD_FLAGS=bind_now		->	LD_BIND_NOW=1
2068  *	LD_FLAGS=library_path=/foo:.	->	LD_LIBRARY_PATH=/foo:.
2069  *	LD_FLAGS=debug=files:detail	->	LD_DEBUG=files:detail
2070  * or
2071  *	LD_FLAGS=bind_now,library_path=/foo:.,debug=files:detail
2072  */
2073 static int
2074 ld_flags_env(const char *str, Word *lmflags, Word *lmtflags,
2075     uint_t env_flags, int aout)
2076 {
2077 	char	*nstr, *sstr, *estr = 0;
2078 	size_t	nlen, len;
2079 
2080 	if (str == 0)
2081 		return (0);
2082 
2083 	/*
2084 	 * Create a new string as we're going to transform the token(s) into
2085 	 * uppercase and separate tokens with nulls.
2086 	 */
2087 	len = strlen(str);
2088 	if ((nstr = malloc(len + 1)) == 0)
2089 		return (1);
2090 	(void) strcpy(nstr, str);
2091 
2092 	for (sstr = nstr; sstr; sstr++, len--) {
2093 		int	flags;
2094 
2095 		if ((*sstr != '\0') && (*sstr != ',')) {
2096 			if (estr == 0) {
2097 				if (*sstr == '=')
2098 					estr = sstr;
2099 				else {
2100 					/*
2101 					 * Translate token to uppercase.  Don't
2102 					 * use toupper(3C) as including this
2103 					 * code doubles the size of ld.so.1.
2104 					 */
2105 					if ((*sstr >= 'a') && (*sstr <= 'z'))
2106 						*sstr = *sstr - ('a' - 'A');
2107 				}
2108 			}
2109 			continue;
2110 		}
2111 
2112 		*sstr = '\0';
2113 		if (estr) {
2114 			nlen = estr - nstr;
2115 			if ((*++estr == '\0') || (*estr == ','))
2116 				estr = 0;
2117 		} else
2118 			nlen = sstr - nstr;
2119 
2120 		/*
2121 		 * Fabricate a boolean definition for any unqualified variable.
2122 		 * Thus LD_FLAGS=bind_now is represented as BIND_NOW=(null).
2123 		 * The value is sufficient to assert any boolean variables, plus
2124 		 * the term "(null)" is specifically chosen in case someone
2125 		 * mistakenly supplies something like LD_FLAGS=library_path.
2126 		 */
2127 		if (estr == 0)
2128 			estr = (char *)MSG_INTL(MSG_STR_NULL);
2129 
2130 		/*
2131 		 * Determine whether the environment variable is 32- or 64-bit
2132 		 * specific.  The length, len, will reflect the architecture
2133 		 * neutral portion of the string.
2134 		 */
2135 		if ((flags = ld_arch_env(nstr, &nlen)) != ENV_TYP_IGNORE) {
2136 			ld_generic_env(nstr, nlen, estr, lmflags,
2137 			    lmtflags, (env_flags | flags), aout);
2138 		}
2139 		if (len == 0)
2140 			return (0);
2141 
2142 		nstr = sstr + 1;
2143 		estr = 0;
2144 	}
2145 	return (0);
2146 }
2147 
2148 
2149 /*
2150  * Process a single environment string.  Only strings starting with `LD_' are
2151  * reserved for our use.  By convention, all strings should be of the form
2152  * `LD_XXXX=', if the string is followed by a non-null value the appropriate
2153  * functionality is enabled.  Also pick off applicable locale variables.
2154  */
2155 #define	LOC_LANG	1
2156 #define	LOC_MESG	2
2157 #define	LOC_ALL		3
2158 
2159 static void
2160 ld_str_env(const char *s1, Word *lmflags, Word *lmtflags, uint_t env_flags,
2161     int aout)
2162 {
2163 	const char	*s2;
2164 	static		size_t	loc = 0;
2165 
2166 	if (*s1++ != 'L')
2167 		return;
2168 
2169 	/*
2170 	 * See if we have any locale environment settings.  These environment
2171 	 * variables have a precedence, LC_ALL is higher than LC_MESSAGES which
2172 	 * is higher than LANG.
2173 	 */
2174 	s2 = s1;
2175 	if ((*s2++ == 'C') && (*s2++ == '_') && (*s2 != '\0')) {
2176 		if (strncmp(s2, MSG_ORIG(MSG_LC_ALL), MSG_LC_ALL_SIZE) == 0) {
2177 			s2 += MSG_LC_ALL_SIZE;
2178 			if ((*s2 != '\0') && (loc < LOC_ALL)) {
2179 				glcs[CI_LCMESSAGES].lc_un.lc_ptr = (char *)s2;
2180 				loc = LOC_ALL;
2181 			}
2182 		} else if (strncmp(s2, MSG_ORIG(MSG_LC_MESSAGES),
2183 		    MSG_LC_MESSAGES_SIZE) == 0) {
2184 			s2 += MSG_LC_MESSAGES_SIZE;
2185 			if ((*s2 != '\0') && (loc < LOC_MESG)) {
2186 				glcs[CI_LCMESSAGES].lc_un.lc_ptr = (char *)s2;
2187 				loc = LOC_MESG;
2188 			}
2189 		}
2190 		return;
2191 	}
2192 
2193 	s2 = s1;
2194 	if ((*s2++ == 'A') && (*s2++ == 'N') && (*s2++ == 'G') &&
2195 	    (*s2++ == '=') && (*s2 != '\0') && (loc < LOC_LANG)) {
2196 		glcs[CI_LCMESSAGES].lc_un.lc_ptr = (char *)s2;
2197 		loc = LOC_LANG;
2198 		return;
2199 	}
2200 
2201 	/*
2202 	 * Pick off any LD_XXXX environment variables.
2203 	 */
2204 	if ((*s1++ == 'D') && (*s1++ == '_') && (*s1 != '\0')) {
2205 		size_t	len;
2206 		int	flags;
2207 
2208 		/*
2209 		 * In a branded process we must ignore all LD_XXXX env vars
2210 		 * because they are intended for the brand's linker.
2211 		 * To affect the Solaris linker, use LD_BRAND_XXXX instead.
2212 		 */
2213 		if (rtld_flags2 & RT_FL2_BRANDED) {
2214 			if (strncmp(s1, MSG_ORIG(MSG_LD_BRAND_PREFIX),
2215 			    MSG_LD_BRAND_PREFIX_SIZE) != 0)
2216 				return;
2217 			s1 += MSG_LD_BRAND_PREFIX_SIZE;
2218 		}
2219 
2220 		/*
2221 		 * Environment variables with no value (ie. LD_XXXX=) typically
2222 		 * have no impact, however if environment variables are defined
2223 		 * within a configuration file, these null user settings can be
2224 		 * used to disable any configuration replaceable definitions.
2225 		 */
2226 		if ((s2 = strchr(s1, '=')) == 0) {
2227 			len = strlen(s1);
2228 			s2 = 0;
2229 		} else if (*++s2 == '\0') {
2230 			len = strlen(s1) - 1;
2231 			s2 = 0;
2232 		} else {
2233 			len = s2 - s1 - 1;
2234 			while (isspace(*s2))
2235 				s2++;
2236 		}
2237 
2238 		/*
2239 		 * Determine whether the environment variable is 32- or 64-bit
2240 		 * specific.  The length, len, will reflect the architecture
2241 		 * neutral portion of the string.
2242 		 */
2243 		if ((flags = ld_arch_env(s1, &len)) == ENV_TYP_IGNORE)
2244 			return;
2245 		env_flags |= flags;
2246 
2247 		ld_generic_env(s1, len, s2, lmflags, lmtflags, env_flags, aout);
2248 	}
2249 }
2250 
2251 /*
2252  * Internal getenv routine.  Called immediately after ld.so.1 initializes
2253  * itself.
2254  */
2255 int
2256 readenv_user(const char ** envp, Word *lmflags, Word *lmtflags, int aout)
2257 {
2258 	char	*locale;
2259 
2260 	if (envp == (const char **)0)
2261 		return (0);
2262 
2263 	while (*envp != (const char *)0)
2264 		ld_str_env(*envp++, lmflags, lmtflags, 0, aout);
2265 
2266 	/*
2267 	 * Having collected the best representation of any LD_FLAGS, process
2268 	 * these strings.
2269 	 */
2270 	if (ld_flags_env(rpl_ldflags, lmflags, lmtflags, 0, aout) == 1)
2271 		return (1);
2272 
2273 	/*
2274 	 * Don't allow environment controlled auditing when tracing or if
2275 	 * explicitly disabled.  Trigger all tracing modes from
2276 	 * LML_FLG_TRC_ENABLE.
2277 	 */
2278 	if ((*lmflags & LML_FLG_TRC_ENABLE) || (rtld_flags & RT_FL_NOAUDIT))
2279 		rpl_audit = profile_lib = profile_name = 0;
2280 	if ((*lmflags & LML_FLG_TRC_ENABLE) == 0)
2281 		*lmflags &= ~LML_MSK_TRC;
2282 
2283 	/*
2284 	 * If both LD_BIND_NOW and LD_BIND_LAZY are specified, the former wins.
2285 	 */
2286 	if ((rtld_flags2 & (RT_FL2_BINDNOW | RT_FL2_BINDLAZY)) ==
2287 	    (RT_FL2_BINDNOW | RT_FL2_BINDLAZY))
2288 		rtld_flags2 &= ~RT_FL2_BINDLAZY;
2289 
2290 	/*
2291 	 * If we have a locale setting make sure its worth processing further.
2292 	 * C and POSIX locales don't need any processing.  In addition, to
2293 	 * ensure no one escapes the /usr/lib/locale hierarchy, don't allow
2294 	 * the locale to contain a segment that leads upward in the file system
2295 	 * hierarchy (i.e. no '..' segments).   Given that we'll be confined to
2296 	 * the /usr/lib/locale hierarchy, there is no need to extensively
2297 	 * validate the mode or ownership of any message file (as libc's
2298 	 * generic handling of message files does).  Duplicate the string so
2299 	 * that new locale setting can generically cleanup any previous locales.
2300 	 */
2301 	if ((locale = glcs[CI_LCMESSAGES].lc_un.lc_ptr) != 0) {
2302 		if (((*locale == 'C') && (*(locale + 1) == '\0')) ||
2303 		    (strcmp(locale, MSG_ORIG(MSG_TKN_POSIX)) == 0) ||
2304 		    (strstr(locale, MSG_ORIG(MSG_TKN_DOTDOT)) != NULL))
2305 			glcs[CI_LCMESSAGES].lc_un.lc_ptr = 0;
2306 		else
2307 			glcs[CI_LCMESSAGES].lc_un.lc_ptr = strdup(locale);
2308 	}
2309 	return (0);
2310 }
2311 
2312 /*
2313  * Configuration environment processing.  Called after the a.out has been
2314  * processed (as the a.out can specify its own configuration file).
2315  */
2316 int
2317 readenv_config(Rtc_env * envtbl, Addr addr, int aout)
2318 {
2319 	Word *	lmflags = &(lml_main.lm_flags);
2320 	Word *	lmtflags = &(lml_main.lm_tflags);
2321 
2322 	if (envtbl == (Rtc_env *)0)
2323 		return (0);
2324 
2325 	while (envtbl->env_str) {
2326 		uint_t	env_flags = ENV_TYP_CONFIG;
2327 
2328 		if (envtbl->env_flags & RTC_ENV_PERMANT)
2329 			env_flags |= ENV_TYP_PERMANT;
2330 
2331 		ld_str_env((const char *)(envtbl->env_str + addr),
2332 		    lmflags, lmtflags, env_flags, 0);
2333 		envtbl++;
2334 	}
2335 
2336 	/*
2337 	 * Having collected the best representation of any LD_FLAGS, process
2338 	 * these strings.
2339 	 */
2340 	if (ld_flags_env(rpl_ldflags, lmflags, lmtflags, 0, aout) == 1)
2341 		return (1);
2342 	if (ld_flags_env(prm_ldflags, lmflags, lmtflags, ENV_TYP_CONFIG,
2343 	    aout) == 1)
2344 		return (1);
2345 
2346 	/*
2347 	 * Don't allow environment controlled auditing when tracing or if
2348 	 * explicitly disabled.  Trigger all tracing modes from
2349 	 * LML_FLG_TRC_ENABLE.
2350 	 */
2351 	if ((*lmflags & LML_FLG_TRC_ENABLE) || (rtld_flags & RT_FL_NOAUDIT))
2352 		prm_audit = profile_lib = profile_name = 0;
2353 	if ((*lmflags & LML_FLG_TRC_ENABLE) == 0)
2354 		*lmflags &= ~LML_MSK_TRC;
2355 
2356 	return (0);
2357 }
2358 
2359 int
2360 dowrite(Prfbuf * prf)
2361 {
2362 	/*
2363 	 * We do not have a valid file descriptor, so we are unable
2364 	 * to flush the buffer.
2365 	 */
2366 	if (prf->pr_fd == -1)
2367 		return (0);
2368 	(void) write(prf->pr_fd, prf->pr_buf, prf->pr_cur - prf->pr_buf);
2369 	prf->pr_cur = prf->pr_buf;
2370 	return (1);
2371 }
2372 
2373 /*
2374  * Simplified printing.  The following conversion specifications are supported:
2375  *
2376  *	% [#] [-] [min field width] [. precision] s|d|x|c
2377  *
2378  *
2379  * dorprf takes the output buffer in the form of Prfbuf which permits
2380  * the verification of the output buffer size and the concatenation
2381  * of data to an already existing output buffer.  The Prfbuf
2382  * structure contains the following:
2383  *
2384  *  pr_buf	pointer to the beginning of the output buffer.
2385  *  pr_cur	pointer to the next available byte in the output buffer.  By
2386  *		setting pr_cur ahead of pr_buf you can append to an already
2387  *		existing buffer.
2388  *  pr_len	the size of the output buffer.  By setting pr_len to '0' you
2389  *		disable protection from overflows in the output buffer.
2390  *  pr_fd	a pointer to the file-descriptor the buffer will eventually be
2391  *		output to.  If pr_fd is set to '-1' then it's assumed there is
2392  *		no output buffer, and doprf() will return with an error to
2393  *		indicate an output buffer overflow.  If pr_fd is > -1 then when
2394  *		the output buffer is filled it will be flushed to pr_fd and will
2395  *		then be	available for additional data.
2396  */
2397 #define	FLG_UT_MINUS	0x0001	/* - */
2398 #define	FLG_UT_SHARP	0x0002	/* # */
2399 #define	FLG_UT_DOTSEEN	0x0008	/* dot appeared in format spec */
2400 
2401 /*
2402  * This macro is for use from within doprf only.  It is to be used for checking
2403  * the output buffer size and placing characters into the buffer.
2404  */
2405 #define	PUTC(c) \
2406 	{ \
2407 		char tmpc; \
2408 		\
2409 		tmpc = (c); \
2410 		if (bufsiz && (bp >= bufend)) { \
2411 			prf->pr_cur = bp; \
2412 			if (dowrite(prf) == 0) \
2413 				return (0); \
2414 			bp = prf->pr_cur; \
2415 		} \
2416 		*bp++ = tmpc; \
2417 	}
2418 
2419 /*
2420  * Define a local buffer size for building a numeric value - large enough to
2421  * hold a 64-bit value.
2422  */
2423 #define	NUM_SIZE	22
2424 
2425 size_t
2426 doprf(const char *format, va_list args, Prfbuf *prf)
2427 {
2428 	char	c;
2429 	char	*bp = prf->pr_cur;
2430 	char	*bufend = prf->pr_buf + prf->pr_len;
2431 	size_t	bufsiz = prf->pr_len;
2432 
2433 	while ((c = *format++) != '\0') {
2434 		if (c != '%') {
2435 			PUTC(c);
2436 		} else {
2437 			int	base = 0, flag = 0, width = 0, prec = 0;
2438 			size_t	_i;
2439 			int	_c, _n;
2440 			char	*_s;
2441 			int	ls = 0;
2442 again:
2443 			c = *format++;
2444 			switch (c) {
2445 			case '-':
2446 				flag |= FLG_UT_MINUS;
2447 				goto again;
2448 			case '#':
2449 				flag |= FLG_UT_SHARP;
2450 				goto again;
2451 			case '.':
2452 				flag |= FLG_UT_DOTSEEN;
2453 				goto again;
2454 			case '0':
2455 			case '1':
2456 			case '2':
2457 			case '3':
2458 			case '4':
2459 			case '5':
2460 			case '6':
2461 			case '7':
2462 			case '8':
2463 			case '9':
2464 				if (flag & FLG_UT_DOTSEEN)
2465 					prec = (prec * 10) + c - '0';
2466 				else
2467 					width = (width * 10) + c - '0';
2468 				goto again;
2469 			case 'x':
2470 			case 'X':
2471 				base = 16;
2472 				break;
2473 			case 'd':
2474 			case 'D':
2475 			case 'u':
2476 				base = 10;
2477 				flag &= ~FLG_UT_SHARP;
2478 				break;
2479 			case 'l':
2480 				base = 10;
2481 				ls++; /* number of l's (long or long long) */
2482 				if ((*format == 'l') ||
2483 				    (*format == 'd') || (*format == 'D') ||
2484 				    (*format == 'x') || (*format == 'X') ||
2485 				    (*format == 'o') || (*format == 'O'))
2486 					goto again;
2487 				break;
2488 			case 'o':
2489 			case 'O':
2490 				base = 8;
2491 				break;
2492 			case 'c':
2493 				_c = va_arg(args, int);
2494 
2495 				for (_i = 24; _i > 0; _i -= 8) {
2496 					if ((c = ((_c >> _i) & 0x7f)) != 0) {
2497 						PUTC(c);
2498 					}
2499 				}
2500 				if ((c = ((_c >> _i) & 0x7f)) != 0) {
2501 					PUTC(c);
2502 				}
2503 				break;
2504 			case 's':
2505 				_s = va_arg(args, char *);
2506 				_i = strlen(_s);
2507 				/* LINTED */
2508 				_n = (int)(width - _i);
2509 				if (!prec)
2510 					/* LINTED */
2511 					prec = (int)_i;
2512 
2513 				if (width && !(flag & FLG_UT_MINUS)) {
2514 					while (_n-- > 0)
2515 						PUTC(' ');
2516 				}
2517 				while (((c = *_s++) != 0) && prec--) {
2518 					PUTC(c);
2519 				}
2520 				if (width && (flag & FLG_UT_MINUS)) {
2521 					while (_n-- > 0)
2522 						PUTC(' ');
2523 				}
2524 				break;
2525 			case '%':
2526 				PUTC('%');
2527 				break;
2528 			default:
2529 				break;
2530 			}
2531 
2532 			/*
2533 			 * Numeric processing
2534 			 */
2535 			if (base) {
2536 				char		local[NUM_SIZE];
2537 				size_t		ssize = 0, psize = 0;
2538 				const char	*string =
2539 				    MSG_ORIG(MSG_STR_HEXNUM);
2540 				const char	*prefix =
2541 				    MSG_ORIG(MSG_STR_EMPTY);
2542 				u_longlong_t	num;
2543 
2544 				switch (ls) {
2545 				case 0:	/* int */
2546 					num = (u_longlong_t)
2547 					    va_arg(args, uint_t);
2548 					break;
2549 				case 1:	/* long */
2550 					num = (u_longlong_t)
2551 					    va_arg(args, ulong_t);
2552 					break;
2553 				case 2:	/* long long */
2554 					num = va_arg(args, u_longlong_t);
2555 					break;
2556 				}
2557 
2558 				if (flag & FLG_UT_SHARP) {
2559 					if (base == 16) {
2560 						prefix = MSG_ORIG(MSG_STR_HEX);
2561 						psize = 2;
2562 					} else {
2563 						prefix = MSG_ORIG(MSG_STR_ZERO);
2564 						psize = 1;
2565 					}
2566 				}
2567 				if ((base == 10) && (long)num < 0) {
2568 					prefix = MSG_ORIG(MSG_STR_NEGATE);
2569 					psize = MSG_STR_NEGATE_SIZE;
2570 					num = (u_longlong_t)(-(longlong_t)num);
2571 				}
2572 
2573 				/*
2574 				 * Convert the numeric value into a local
2575 				 * string (stored in reverse order).
2576 				 */
2577 				_s = local;
2578 				do {
2579 					*_s++ = string[num % base];
2580 					num /= base;
2581 					ssize++;
2582 				} while (num);
2583 
2584 				ASSERT(ssize < sizeof (local));
2585 
2586 				/*
2587 				 * Provide any precision or width padding.
2588 				 */
2589 				if (prec) {
2590 					/* LINTED */
2591 					_n = (int)(prec - ssize);
2592 					while ((_n-- > 0) &&
2593 					    (ssize < sizeof (local))) {
2594 						*_s++ = '0';
2595 						ssize++;
2596 					}
2597 				}
2598 				if (width && !(flag & FLG_UT_MINUS)) {
2599 					/* LINTED */
2600 					_n = (int)(width - ssize - psize);
2601 					while (_n-- > 0) {
2602 						PUTC(' ');
2603 					}
2604 				}
2605 
2606 				/*
2607 				 * Print any prefix and the numeric string
2608 				 */
2609 				while (*prefix)
2610 					PUTC(*prefix++);
2611 				do {
2612 					PUTC(*--_s);
2613 				} while (_s > local);
2614 
2615 				/*
2616 				 * Provide any width padding.
2617 				 */
2618 				if (width && (flag & FLG_UT_MINUS)) {
2619 					/* LINTED */
2620 					_n = (int)(width - ssize - psize);
2621 					while (_n-- > 0)
2622 						PUTC(' ');
2623 				}
2624 			}
2625 		}
2626 	}
2627 
2628 	PUTC('\0');
2629 	prf->pr_cur = bp;
2630 	return (1);
2631 }
2632 
2633 static int
2634 doprintf(const char *format, va_list args, Prfbuf *prf)
2635 {
2636 	char	*ocur = prf->pr_cur;
2637 
2638 	if (doprf(format, args, prf) == 0)
2639 		return (0);
2640 	/* LINTED */
2641 	return ((int)(prf->pr_cur - ocur));
2642 }
2643 
2644 /* VARARGS2 */
2645 int
2646 sprintf(char *buf, const char *format, ...)
2647 {
2648 	va_list	args;
2649 	int	len;
2650 	Prfbuf	prf;
2651 
2652 	va_start(args, format);
2653 	prf.pr_buf = prf.pr_cur = buf;
2654 	prf.pr_len = 0;
2655 	prf.pr_fd = -1;
2656 	len = doprintf(format, args, &prf);
2657 	va_end(args);
2658 
2659 	/*
2660 	 * sprintf() return value excludes the terminating null byte.
2661 	 */
2662 	return (len - 1);
2663 }
2664 
2665 /* VARARGS3 */
2666 int
2667 snprintf(char *buf, size_t n, const char *format, ...)
2668 {
2669 	va_list	args;
2670 	int	len;
2671 	Prfbuf	prf;
2672 
2673 	va_start(args, format);
2674 	prf.pr_buf = prf.pr_cur = buf;
2675 	prf.pr_len = n;
2676 	prf.pr_fd = -1;
2677 	len = doprintf(format, args, &prf);
2678 	va_end(args);
2679 
2680 	return (len);
2681 }
2682 
2683 /* VARARGS2 */
2684 int
2685 bufprint(Prfbuf *prf, const char *format, ...)
2686 {
2687 	va_list	args;
2688 	int	len;
2689 
2690 	va_start(args, format);
2691 	len = doprintf(format, args, prf);
2692 	va_end(args);
2693 
2694 	return (len);
2695 }
2696 
2697 /*PRINTFLIKE1*/
2698 int
2699 printf(const char *format, ...)
2700 {
2701 	va_list	args;
2702 	char 	buffer[ERRSIZE];
2703 	Prfbuf	prf;
2704 
2705 	va_start(args, format);
2706 	prf.pr_buf = prf.pr_cur = buffer;
2707 	prf.pr_len = ERRSIZE;
2708 	prf.pr_fd = 1;
2709 	(void) doprf(format, args, &prf);
2710 	va_end(args);
2711 	/*
2712 	 * Trim trailing '\0' form buffer
2713 	 */
2714 	prf.pr_cur--;
2715 	return (dowrite(&prf));
2716 }
2717 
2718 static char	errbuf[ERRSIZE], *nextptr = errbuf, *prevptr = 0;
2719 
2720 /*PRINTFLIKE3*/
2721 void
2722 eprintf(Lm_list *lml, Error error, const char *format, ...)
2723 {
2724 	va_list		args;
2725 	int		overflow = 0;
2726 	static int	lock = 0;
2727 	Prfbuf		prf;
2728 
2729 	if (lock || (nextptr == (errbuf + ERRSIZE)))
2730 		return;
2731 
2732 	/*
2733 	 * Note: this lock is here to prevent the same thread from recursively
2734 	 * entering itself during a eprintf.  ie: during eprintf malloc() fails
2735 	 * and we try and call eprintf ... and then malloc() fails ....
2736 	 */
2737 	lock = 1;
2738 
2739 	/*
2740 	 * If we have completed startup initialization, all error messages
2741 	 * must be saved.  These are reported through dlerror().  If we're
2742 	 * still in the initialization stage, output the error directly and
2743 	 * add a newline.
2744 	 */
2745 	va_start(args, format);
2746 
2747 	prf.pr_buf = prf.pr_cur = nextptr;
2748 	prf.pr_len = ERRSIZE - (nextptr - errbuf);
2749 
2750 	if (!(rtld_flags & RT_FL_APPLIC))
2751 		prf.pr_fd = 2;
2752 	else
2753 		prf.pr_fd = -1;
2754 
2755 	if (error > ERR_NONE) {
2756 		if ((error == ERR_FATAL) && (rtld_flags2 & RT_FL2_FTL2WARN))
2757 			error = ERR_WARNING;
2758 		if (error == ERR_WARNING) {
2759 			if (err_strs[ERR_WARNING] == 0)
2760 				err_strs[ERR_WARNING] =
2761 				    MSG_INTL(MSG_ERR_WARNING);
2762 		} else if (error == ERR_FATAL) {
2763 			if (err_strs[ERR_FATAL] == 0)
2764 				err_strs[ERR_FATAL] = MSG_INTL(MSG_ERR_FATAL);
2765 		} else if (error == ERR_ELF) {
2766 			if (err_strs[ERR_ELF] == 0)
2767 				err_strs[ERR_ELF] = MSG_INTL(MSG_ERR_ELF);
2768 		}
2769 		if (procname) {
2770 			if (bufprint(&prf, MSG_ORIG(MSG_STR_EMSGFOR1),
2771 			    rtldname, procname, err_strs[error]) == 0)
2772 				overflow = 1;
2773 		} else {
2774 			if (bufprint(&prf, MSG_ORIG(MSG_STR_EMSGFOR2),
2775 			    rtldname, err_strs[error]) == 0)
2776 				overflow = 1;
2777 		}
2778 		if (overflow == 0) {
2779 			/*
2780 			 * Remove the terminating '\0'.
2781 			 */
2782 			prf.pr_cur--;
2783 		}
2784 	}
2785 
2786 	if ((overflow == 0) && doprf(format, args, &prf) == 0)
2787 		overflow = 1;
2788 
2789 	/*
2790 	 * If this is an ELF error, it will have been generated by a support
2791 	 * object that has a dependency on libelf.  ld.so.1 doesn't generate any
2792 	 * ELF error messages as it doesn't interact with libelf.  Determine the
2793 	 * ELF error string.
2794 	 */
2795 	if ((overflow == 0) && (error == ERR_ELF)) {
2796 		static int		(*elfeno)() = 0;
2797 		static const char	*(*elfemg)();
2798 		const char		*emsg;
2799 		Rt_map			*dlmp, *lmp = lml_rtld.lm_head;
2800 
2801 		if (NEXT(lmp) && (elfeno == 0)) {
2802 			if (((elfemg = (const char *(*)())dlsym_intn(RTLD_NEXT,
2803 			    MSG_ORIG(MSG_SYM_ELFERRMSG), lmp, &dlmp)) == 0) ||
2804 			    ((elfeno = (int (*)())dlsym_intn(RTLD_NEXT,
2805 			    MSG_ORIG(MSG_SYM_ELFERRNO), lmp, &dlmp)) == 0))
2806 				elfeno = 0;
2807 		}
2808 
2809 		/*
2810 		 * Lookup the message; equivalent to elf_errmsg(elf_errno()).
2811 		 */
2812 		if (elfeno && ((emsg = (* elfemg)((* elfeno)())) != 0)) {
2813 			prf.pr_cur--;
2814 			if (bufprint(&prf, MSG_ORIG(MSG_STR_EMSGFOR2),
2815 			    emsg) == 0)
2816 				overflow = 1;
2817 		}
2818 	}
2819 
2820 	/*
2821 	 * Push out any message that's been built.  Note, in the case of an
2822 	 * overflow condition, this message may be incomplete, in which case
2823 	 * make sure any partial string is null terminated.
2824 	 */
2825 	if (overflow)
2826 		*(prf.pr_cur) = '\0';
2827 	if ((rtld_flags & (RT_FL_APPLIC | RT_FL_SILENCERR)) == 0) {
2828 		*(prf.pr_cur - 1) = '\n';
2829 		(void) dowrite(&prf);
2830 	}
2831 
2832 	DBG_CALL(Dbg_util_str(lml, nextptr));
2833 	va_end(args);
2834 
2835 	/*
2836 	 * Determine if there was insufficient space left in the buffer to
2837 	 * complete the message.  If so, we'll have printed out as much as had
2838 	 * been processed if we're not yet executing the application.
2839 	 * Otherwise, there will be some debugging diagnostic indicating
2840 	 * as much of the error message as possible.  Write out a final buffer
2841 	 * overflow diagnostic - unlocalized, so we don't chance more errors.
2842 	 */
2843 	if (overflow) {
2844 		char	*str = (char *)MSG_INTL(MSG_EMG_BUFOVRFLW);
2845 
2846 		if ((rtld_flags & RT_FL_SILENCERR) == 0) {
2847 			lasterr = str;
2848 
2849 			if ((rtld_flags & RT_FL_APPLIC) == 0) {
2850 				(void) write(2, str, strlen(str));
2851 				(void) write(2, MSG_ORIG(MSG_STR_NL),
2852 				    MSG_STR_NL_SIZE);
2853 			}
2854 		}
2855 		DBG_CALL(Dbg_util_str(lml, str));
2856 
2857 		lock = 0;
2858 		nextptr = errbuf + ERRSIZE;
2859 		return;
2860 	}
2861 
2862 	/*
2863 	 * If the application has started, then error messages are being saved
2864 	 * for retrieval by dlerror(), or possible flushing from rtldexit() in
2865 	 * the case of a fatal error.  In this case, establish the next error
2866 	 * pointer.  If we haven't started the application, the whole message
2867 	 * buffer can be reused.
2868 	 */
2869 	if ((rtld_flags & RT_FL_SILENCERR) == 0) {
2870 		lasterr = nextptr;
2871 
2872 		/*
2873 		 * Note, should we encounter an error such as ENOMEM, there may
2874 		 * be a number of the same error messages (ie. an operation
2875 		 * fails with ENOMEM, and then the attempts to construct the
2876 		 * error message itself, which incurs additional ENOMEM errors).
2877 		 * Compare any previous error message with the one we've just
2878 		 * created to prevent any duplication clutter.
2879 		 */
2880 		if ((rtld_flags & RT_FL_APPLIC) &&
2881 		    ((prevptr == 0) || (strcmp(prevptr, nextptr) != 0))) {
2882 			prevptr = nextptr;
2883 			nextptr = prf.pr_cur;
2884 			*nextptr = '\0';
2885 		}
2886 	}
2887 	lock = 0;
2888 }
2889 
2890 
2891 #if	DEBUG
2892 /*
2893  * Provide assfail() for ASSERT() statements,
2894  * see <sys/debug.h> for further details.
2895  */
2896 int
2897 assfail(const char *a, const char *f, int l)
2898 {
2899 	(void) printf("assertion failed: %s, file: %s, line: %d\n", a, f, l);
2900 	(void) _lwp_kill(_lwp_self(), SIGABRT);
2901 	return (0);
2902 }
2903 #endif
2904 
2905 /*
2906  * Exit.  If we arrive here with a non zero status it's because of a fatal
2907  * error condition (most commonly a relocation error).  If the application has
2908  * already had control, then the actual fatal error message will have been
2909  * recorded in the dlerror() message buffer.  Print the message before really
2910  * exiting.
2911  */
2912 void
2913 rtldexit(Lm_list * lml, int status)
2914 {
2915 	if (status) {
2916 		if (rtld_flags & RT_FL_APPLIC) {
2917 			/*
2918 			 * If the error buffer has been used, write out all
2919 			 * pending messages - lasterr is simply a pointer to
2920 			 * the last message in this buffer.  However, if the
2921 			 * buffer couldn't be created at all, lasterr points
2922 			 * to a constant error message string.
2923 			 */
2924 			if (*errbuf) {
2925 				char	*errptr = errbuf;
2926 				char	*errend = errbuf + ERRSIZE;
2927 
2928 				while ((errptr < errend) && *errptr) {
2929 					size_t	size = strlen(errptr);
2930 					(void) write(2, errptr, size);
2931 					(void) write(2, MSG_ORIG(MSG_STR_NL),
2932 					    MSG_STR_NL_SIZE);
2933 					errptr += (size + 1);
2934 				}
2935 			}
2936 			if (lasterr && ((lasterr < errbuf) ||
2937 			    (lasterr > (errbuf + ERRSIZE)))) {
2938 				(void) write(2, lasterr, strlen(lasterr));
2939 				(void) write(2, MSG_ORIG(MSG_STR_NL),
2940 				    MSG_STR_NL_SIZE);
2941 			}
2942 		}
2943 		leave(lml);
2944 		(void) _lwp_kill(_lwp_self(), killsig);
2945 	}
2946 	_exit(status);
2947 }
2948 
2949 /*
2950  * Routines to co-ordinate the opening of /dev/zero and /proc.
2951  * dz_fd is exported for possible use by libld.so, and to insure it gets
2952  * closed on leaving ld.so.1.
2953  */
2954 int	dz_fd = FD_UNAVAIL;
2955 
2956 void
2957 dz_init(int fd)
2958 {
2959 	dz_fd = fd;
2960 }
2961 
2962 
2963 /*
2964  * mmap() a page from MAP_ANON
2965  *
2966  * Note: MAP_ANON is only on Solaris8++, we use this routine to
2967  *       not only mmap(MAP_ANON) but to also probe if it is available
2968  *	 on the current OS.
2969  */
2970 Am_ret
2971 anon_map(Lm_list *lml, caddr_t *addr, size_t len, int prot, int flags)
2972 {
2973 #if defined(MAP_ANON)
2974 	static int	noanon = 0;
2975 	caddr_t		va;
2976 
2977 	if (noanon == 0) {
2978 		if ((va = (caddr_t)mmap(*addr, len, prot,
2979 		    (flags | MAP_ANON), -1, 0)) != MAP_FAILED) {
2980 			*addr = va;
2981 			return (AM_OK);
2982 		}
2983 
2984 		if ((errno != EBADF) && (errno != EINVAL)) {
2985 			int	err = errno;
2986 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_MMAPANON),
2987 			    MSG_ORIG(MSG_PTH_DEVZERO), strerror(err));
2988 			return (AM_ERROR);
2989 		} else
2990 			noanon = 1;
2991 	}
2992 #endif
2993 	return (AM_NOSUP);
2994 }
2995 
2996 /*
2997  * Map anonymous memory from /dev/zero, or via MAP_ANON.
2998  *
2999  * (MAP_ANON only appears on Solaris 8, so we need fall-back
3000  * behavior for older systems.)
3001  */
3002 caddr_t
3003 dz_map(Lm_list *lml, caddr_t addr, size_t len, int prot, int flags)
3004 {
3005 	caddr_t	va;
3006 	int	err;
3007 	Am_ret	amret;
3008 
3009 	amret = anon_map(lml, &addr, len, prot, flags);
3010 
3011 	if (amret == AM_OK)
3012 		return (addr);
3013 	if (amret == AM_ERROR)
3014 		return (MAP_FAILED);
3015 
3016 	/* amret == AM_NOSUP -> fallback to a devzero mmaping */
3017 
3018 	if (dz_fd == FD_UNAVAIL) {
3019 		if ((dz_fd = open(MSG_ORIG(MSG_PTH_DEVZERO),
3020 		    O_RDONLY)) == FD_UNAVAIL) {
3021 			err = errno;
3022 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN),
3023 			    MSG_ORIG(MSG_PTH_DEVZERO), strerror(err));
3024 			return (MAP_FAILED);
3025 		}
3026 	}
3027 
3028 	if ((va = mmap(addr, len, prot, flags, dz_fd, 0)) == MAP_FAILED) {
3029 		err = errno;
3030 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_MMAP),
3031 		    MSG_ORIG(MSG_PTH_DEVZERO), strerror(err));
3032 	}
3033 	return (va);
3034 }
3035 
3036 static int	pr_fd = FD_UNAVAIL;
3037 
3038 int
3039 pr_open(Lm_list *lml)
3040 {
3041 	char	proc[16];
3042 
3043 	if (pr_fd == FD_UNAVAIL) {
3044 		(void) snprintf(proc, 16, MSG_ORIG(MSG_FMT_PROC),
3045 		    (int)getpid());
3046 		if ((pr_fd = open(proc, O_RDONLY)) == FD_UNAVAIL) {
3047 			int	err = errno;
3048 
3049 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN), proc,
3050 			    strerror(err));
3051 		}
3052 	}
3053 	return (pr_fd);
3054 }
3055 
3056 static int	nu_fd = FD_UNAVAIL;
3057 
3058 caddr_t
3059 nu_map(Lm_list *lml, caddr_t addr, size_t len, int prot, int flags)
3060 {
3061 	caddr_t	va;
3062 	int	err;
3063 
3064 	if (nu_fd == FD_UNAVAIL) {
3065 		if ((nu_fd = open(MSG_ORIG(MSG_PTH_DEVNULL),
3066 		    O_RDONLY)) == FD_UNAVAIL) {
3067 			err = errno;
3068 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN),
3069 			    MSG_ORIG(MSG_PTH_DEVNULL), strerror(err));
3070 			return (MAP_FAILED);
3071 		}
3072 	}
3073 
3074 	if ((va = (caddr_t)mmap(addr, len, prot, flags, nu_fd, 0)) ==
3075 	    MAP_FAILED) {
3076 		err = errno;
3077 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_MMAP),
3078 		    MSG_ORIG(MSG_PTH_DEVNULL), strerror(err));
3079 	}
3080 	return (va);
3081 }
3082 
3083 /*
3084  * Generic entry point from user code - simply grabs a lock, and bumps the
3085  * entrance count.
3086  */
3087 int
3088 enter(void)
3089 {
3090 	if (rt_bind_guard(THR_FLG_RTLD)) {
3091 		(void) rt_mutex_lock(&rtldlock);
3092 		ld_entry_cnt++;
3093 		return (1);
3094 	}
3095 	return (0);
3096 }
3097 
3098 /*
3099  * Generate diagnostics as to whether an object has been used.  A symbolic
3100  * reference that gets bound to an object marks it as used.  Dependencies that
3101  * are unused when RTLD_NOW is in effect should be removed from future builds
3102  * of an object.  Dependencies that are unused without RTLD_NOW in effect are
3103  * candidates for lazy-loading.
3104  * Unreferenced objects identify objects that are defined as dependencies but
3105  * are unreferenced by the caller (they may however be referenced by other
3106  * objects within the process, and therefore don't qualify as completely unused.
3107  */
3108 void
3109 unused(Lm_list *lml)
3110 {
3111 	Rt_map		*lmp;
3112 	int		nl = 0;
3113 	Word		tracing;
3114 
3115 	/*
3116 	 * If we're not tracing unused references or dependencies, or debugging
3117 	 * there's nothing to do.
3118 	 */
3119 	tracing = lml->lm_flags & (LML_FLG_TRC_UNREF | LML_FLG_TRC_UNUSED);
3120 
3121 	if ((tracing == 0) && (DBG_ENABLED == 0))
3122 		return;
3123 
3124 	/*
3125 	 * Traverse the link-maps looking for unreferenced or unused
3126 	 * dependencies.  Ignore the first object on a link-map list, as this
3127 	 * is effectively always used.
3128 	 */
3129 	for (lmp = (Rt_map *)NEXT(lml->lm_head); lmp;
3130 	    lmp = (Rt_map *)NEXT(lmp)) {
3131 		/*
3132 		 * If tracing unreferenced objects, or under debugging,
3133 		 * determine whether any of this objects callers haven't
3134 		 * referenced it.
3135 		 */
3136 		if ((tracing & LML_FLG_TRC_UNREF) || DBG_ENABLED) {
3137 			Bnd_desc	*bdp;
3138 			Aliste		idx;
3139 
3140 			for (APLIST_TRAVERSE(CALLERS(lmp), idx, bdp)) {
3141 				Rt_map *	clmp;
3142 
3143 				if (bdp->b_flags & BND_REFER)
3144 					continue;
3145 
3146 				clmp = bdp->b_caller;
3147 				if (FLAGS1(clmp) & FL1_RT_LDDSTUB)
3148 					continue;
3149 
3150 				/* BEGIN CSTYLED */
3151 				if (nl++ == 0) {
3152 					if (tracing & LML_FLG_TRC_UNREF)
3153 					    (void) printf(MSG_ORIG(MSG_STR_NL));
3154 					else
3155 					    DBG_CALL(Dbg_util_nl(lml,
3156 						DBG_NL_STD));
3157 				}
3158 
3159 				if (tracing & LML_FLG_TRC_UNREF)
3160 				    (void) printf(MSG_INTL(MSG_LDD_UNREF_FMT),
3161 					NAME(lmp), NAME(clmp));
3162 				else
3163 				    DBG_CALL(Dbg_unused_unref(lmp, NAME(clmp)));
3164 				/* END CSTYLED */
3165 			}
3166 		}
3167 
3168 		/*
3169 		 * If tracing unused objects simply display those objects that
3170 		 * haven't been referenced by anyone.
3171 		 */
3172 		if (FLAGS1(lmp) & FL1_RT_USED)
3173 			continue;
3174 
3175 		if (nl++ == 0) {
3176 			if (tracing)
3177 				(void) printf(MSG_ORIG(MSG_STR_NL));
3178 			else
3179 				DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
3180 		}
3181 		if (CYCGROUP(lmp)) {
3182 			if (tracing)
3183 				(void) printf(MSG_INTL(MSG_LDD_UNCYC_FMT),
3184 				    NAME(lmp), CYCGROUP(lmp));
3185 			else
3186 				DBG_CALL(Dbg_unused_file(lml, NAME(lmp), 0,
3187 				    CYCGROUP(lmp)));
3188 		} else {
3189 			if (tracing)
3190 				(void) printf(MSG_INTL(MSG_LDD_UNUSED_FMT),
3191 				    NAME(lmp));
3192 			else
3193 				DBG_CALL(Dbg_unused_file(lml, NAME(lmp), 0, 0));
3194 		}
3195 	}
3196 
3197 	DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
3198 }
3199 
3200 /*
3201  * Initialization routine for the Fmap structure.  If the fmap structure is
3202  * already in use, any mapping is released.  The structure is then initialized
3203  * in preparation for further use.
3204  */
3205 void
3206 fmap_setup()
3207 {
3208 #if defined(MAP_ALIGN)
3209 	/*
3210 	 * If MAP_ALIGN is set, the fm_addr has been seeded with an alignment
3211 	 * value.  Otherwise, if fm_addr is non-null it indicates a mapping that
3212 	 * should now be freed.
3213 	 */
3214 	if (fmap->fm_maddr && ((fmap->fm_mflags & MAP_ALIGN) == 0))
3215 		(void) munmap((caddr_t)fmap->fm_maddr, fmap->fm_msize);
3216 
3217 	/*
3218 	 * Providing we haven't determined that this system doesn't support
3219 	 * MAP_ALIGN, initialize the mapping address with the default segment
3220 	 * alignment.
3221 	 */
3222 	if ((rtld_flags2 & RT_FL2_NOMALIGN) == 0) {
3223 		fmap->fm_maddr = (char *)M_SEGM_ALIGN;
3224 		fmap->fm_mflags = MAP_PRIVATE | MAP_ALIGN;
3225 	} else {
3226 		fmap->fm_maddr = 0;
3227 		fmap->fm_mflags = MAP_PRIVATE;
3228 	}
3229 #else
3230 	if (fmap->fm_maddr)
3231 		(void) munmap((caddr_t)fmap->fm_maddr, fmap->fm_msize);
3232 
3233 	fmap->fm_maddr = 0;
3234 	fmap->fm_mflags = MAP_PRIVATE;
3235 #endif
3236 
3237 	fmap->fm_msize = FMAP_SIZE;
3238 	fmap->fm_hwptr = 0;
3239 }
3240 
3241 /*
3242  * Generic cleanup routine called prior to returning control to the user.
3243  * Insures that any ld.so.1 specific file descriptors or temporary mapping are
3244  * released, and any locks dropped.
3245  */
3246 void
3247 leave(Lm_list *lml)
3248 {
3249 	Lm_list	*elml = lml;
3250 	Rt_map	*clmp;
3251 	Aliste	idx;
3252 
3253 	/*
3254 	 * Alert the debuggers that the link-maps are consistent.  Note, in the
3255 	 * case of tearing down a whole link-map list, lml will be null.  In
3256 	 * this case use the main link-map list to test for a notification.
3257 	 */
3258 	if (elml == 0)
3259 		elml = &lml_main;
3260 	if (elml->lm_flags & LML_FLG_DBNOTIF)
3261 		rd_event(elml, RD_DLACTIVITY, RT_CONSISTENT);
3262 
3263 	/*
3264 	 * Alert any auditors that the link-maps are consistent.
3265 	 */
3266 	for (APLIST_TRAVERSE(elml->lm_actaudit, idx, clmp)) {
3267 		audit_activity(clmp, LA_ACT_CONSISTENT);
3268 
3269 		aplist_delete(elml->lm_actaudit, &idx);
3270 	}
3271 
3272 	if (dz_fd != FD_UNAVAIL) {
3273 		(void) close(dz_fd);
3274 		dz_fd = FD_UNAVAIL;
3275 	}
3276 
3277 	if (pr_fd != FD_UNAVAIL) {
3278 		(void) close(pr_fd);
3279 		pr_fd = FD_UNAVAIL;
3280 	}
3281 
3282 	if (nu_fd != FD_UNAVAIL) {
3283 		(void) close(nu_fd);
3284 		nu_fd = FD_UNAVAIL;
3285 	}
3286 
3287 	fmap_setup();
3288 
3289 	/*
3290 	 * Reinitialize error message pointer, and any overflow indication.
3291 	 */
3292 	nextptr = errbuf;
3293 	prevptr = 0;
3294 
3295 	/*
3296 	 * Don't drop our lock if we are running on our link-map list as
3297 	 * there's little point in doing so since we are single-threaded.
3298 	 *
3299 	 * LML_FLG_HOLDLOCK is set for:
3300 	 *	*) The ld.so.1's link-map list.
3301 	 *	*) The auditor's link-map if the environment is
3302 	 *	   libc/libthread un-unified.
3303 	 */
3304 	if (lml && (lml->lm_flags & LML_FLG_HOLDLOCK))
3305 		return;
3306 
3307 	if (rt_bind_clear(0) & THR_FLG_RTLD) {
3308 		(void) rt_mutex_unlock(&rtldlock);
3309 		(void) rt_bind_clear(THR_FLG_RTLD);
3310 	}
3311 }
3312 
3313 int
3314 callable(Rt_map *clmp, Rt_map *dlmp, Grp_hdl *ghp, uint_t slflags)
3315 {
3316 	APlist		*calp, *dalp;
3317 	Aliste		idx1, idx2;
3318 	Grp_hdl		*ghp1, *ghp2;
3319 
3320 	/*
3321 	 * An object can always find symbols within itself.
3322 	 */
3323 	if (clmp == dlmp)
3324 		return (1);
3325 
3326 	/*
3327 	 * The search for a singleton must look in every loaded object.
3328 	 */
3329 	if (slflags & LKUP_SINGLETON)
3330 		return (1);
3331 
3332 	/*
3333 	 * Don't allow an object to bind to an object that is being deleted
3334 	 * unless the binder is also being deleted.
3335 	 */
3336 	if ((FLAGS(dlmp) & FLG_RT_DELETE) &&
3337 	    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
3338 		return (0);
3339 
3340 	/*
3341 	 * An object with world access can always bind to an object with global
3342 	 * visibility.
3343 	 */
3344 	if ((MODE(clmp) & RTLD_WORLD) && (MODE(dlmp) & RTLD_GLOBAL))
3345 		return (1);
3346 
3347 	/*
3348 	 * An object with local access can only bind to an object that is a
3349 	 * member of the same group.
3350 	 */
3351 	if (((MODE(clmp) & RTLD_GROUP) == 0) ||
3352 	    ((calp = GROUPS(clmp)) == NULL) || ((dalp = GROUPS(dlmp)) == NULL))
3353 		return (0);
3354 
3355 	/*
3356 	 * Traverse the list of groups the caller is a part of.
3357 	 */
3358 	for (APLIST_TRAVERSE(calp, idx1, ghp1)) {
3359 		/*
3360 		 * If we're testing for the ability of two objects to bind to
3361 		 * each other regardless of a specific group, ignore that group.
3362 		 */
3363 		if (ghp && (ghp1 == ghp))
3364 			continue;
3365 
3366 		/*
3367 		 * Traverse the list of groups the destination is a part of.
3368 		 */
3369 		for (APLIST_TRAVERSE(dalp, idx2, ghp2)) {
3370 			Grp_desc	*gdp;
3371 			Aliste		idx3;
3372 
3373 			if (ghp1 != ghp2)
3374 				continue;
3375 
3376 			/*
3377 			 * Make sure the relationship between the destination
3378 			 * and the caller provide symbols for relocation.
3379 			 * Parents are maintained as callers, but unless the
3380 			 * destination object was opened with RTLD_PARENT, the
3381 			 * parent doesn't provide symbols for the destination
3382 			 * to relocate against.
3383 			 */
3384 			for (ALIST_TRAVERSE(ghp2->gh_depends, idx3, gdp)) {
3385 				if (dlmp != gdp->gd_depend)
3386 					continue;
3387 
3388 				if (gdp->gd_flags & GPD_RELOC)
3389 					return (1);
3390 			}
3391 		}
3392 	}
3393 	return (0);
3394 }
3395 
3396 /*
3397  * Initialize the environ symbol.  Traditionally this is carried out by the crt
3398  * code prior to jumping to main.  However, init sections get fired before this
3399  * variable is initialized, so ld.so.1 sets this directly from the AUX vector
3400  * information.  In addition, a process may have multiple link-maps (ld.so.1's
3401  * debugging and preloading objects), and link auditing, and each may need an
3402  * environ variable set.
3403  *
3404  * This routine is called after a relocation() pass, and thus provides for:
3405  *
3406  *  o	setting environ on the main link-map after the initial application and
3407  *	its dependencies have been established.  Typically environ lives in the
3408  *	application (provided by its crt), but in older applications it might
3409  *	be in libc.  Who knows what's expected of applications not built on
3410  *	Solaris.
3411  *
3412  *  o	after loading a new shared object.  We can add shared objects to various
3413  *	link-maps, and any link-map dependencies requiring getopt() require
3414  *	their own environ.  In addition, lazy loading might bring in the
3415  *	supplier of environ (libc used to be a lazy loading candidate) after
3416  *	the link-map has been established and other objects are present.
3417  *
3418  * This routine handles all these scenarios, without adding unnecessary overhead
3419  * to ld.so.1.
3420  */
3421 void
3422 set_environ(Lm_list *lml)
3423 {
3424 	Rt_map		*dlmp;
3425 	Sym		*sym;
3426 	Slookup		sl;
3427 	uint_t		binfo;
3428 
3429 	/*
3430 	 * Initialize the symbol lookup data structure.
3431 	 */
3432 	SLOOKUP_INIT(sl, MSG_ORIG(MSG_SYM_ENVIRON), lml->lm_head, lml->lm_head,
3433 	    ld_entry_cnt, 0, 0, 0, 0, LKUP_WEAK);
3434 
3435 	if (sym = LM_LOOKUP_SYM(lml->lm_head)(&sl, &dlmp, &binfo)) {
3436 		lml->lm_environ = (char ***)sym->st_value;
3437 
3438 		if (!(FLAGS(dlmp) & FLG_RT_FIXED))
3439 			lml->lm_environ =
3440 			    (char ***)((uintptr_t)lml->lm_environ +
3441 			    (uintptr_t)ADDR(dlmp));
3442 		*(lml->lm_environ) = (char **)environ;
3443 		lml->lm_flags |= LML_FLG_ENVIRON;
3444 	}
3445 }
3446 
3447 /*
3448  * Determine whether we have a secure executable.  Uid and gid information
3449  * can be passed to us via the aux vector, however if these values are -1
3450  * then use the appropriate system call to obtain them.
3451  *
3452  *  o	If the user is the root they can do anything
3453  *
3454  *  o	If the real and effective uid's don't match, or the real and
3455  *	effective gid's don't match then this is determined to be a `secure'
3456  *	application.
3457  *
3458  * This function is called prior to any dependency processing (see _setup.c).
3459  * Any secure setting will remain in effect for the life of the process.
3460  */
3461 void
3462 security(uid_t uid, uid_t euid, gid_t gid, gid_t egid, int auxflags)
3463 {
3464 #ifdef AT_SUN_AUXFLAGS
3465 	if (auxflags != -1) {
3466 		if ((auxflags & AF_SUN_SETUGID) != 0)
3467 			rtld_flags |= RT_FL_SECURE;
3468 		return;
3469 	}
3470 #endif
3471 	if (uid == (uid_t)-1)
3472 		uid = getuid();
3473 	if (uid) {
3474 		if (euid == (uid_t)-1)
3475 			euid = geteuid();
3476 		if (uid != euid)
3477 			rtld_flags |= RT_FL_SECURE;
3478 		else {
3479 			if (gid == (gid_t)-1)
3480 				gid = getgid();
3481 			if (egid == (gid_t)-1)
3482 				egid = getegid();
3483 			if (gid != egid)
3484 				rtld_flags |= RT_FL_SECURE;
3485 		}
3486 	}
3487 }
3488 
3489 /*
3490  * _REENTRANT code gets errno redefined to a function so provide for return
3491  * of the thread errno if applicable.  This has no meaning in ld.so.1 which
3492  * is basically singled threaded.  Provide the interface for our dependencies.
3493  */
3494 #undef errno
3495 #pragma weak _private___errno = ___errno
3496 int *
3497 ___errno()
3498 {
3499 	extern	int	errno;
3500 
3501 	return (&errno);
3502 }
3503 
3504 /*
3505  * The interface with the c library which is supplied through libdl.so.1.
3506  * A non-null argument allows a function pointer array to be passed to us which
3507  * is used to re-initialize the linker libc table.
3508  */
3509 void
3510 _ld_libc(void * ptr)
3511 {
3512 	get_lcinterface(_caller(caller(), CL_EXECDEF), (Lc_interface *)ptr);
3513 }
3514 
3515 /*
3516  * Determine whether a symbol name should be demangled.
3517  */
3518 const char *
3519 demangle(const char *name)
3520 {
3521 	if (rtld_flags & RT_FL_DEMANGLE)
3522 		return (conv_demangle_name(name));
3523 	else
3524 		return (name);
3525 }
3526