xref: /titanic_51/usr/src/cmd/sgs/rtld/common/util.c (revision b018c462323433fb125f9b7e871a93d07a5e481d)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1988 AT&T
24  *	  All Rights Reserved
25  *
26  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
27  * Use is subject to license terms.
28  */
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 /*
32  * Utility routines for run-time linker.  some are duplicated here from libc
33  * (with different names) to avoid name space collisions.
34  */
35 #include	"_synonyms.h"
36 #include	<stdio.h>
37 #include	<sys/types.h>
38 #include	<sys/mman.h>
39 #include	<sys/lwp.h>
40 #include	<sys/debug.h>
41 #include	<stdarg.h>
42 #include	<fcntl.h>
43 #include	<string.h>
44 #include	<ctype.h>
45 #include	<dlfcn.h>
46 #include	<unistd.h>
47 #include	<stdlib.h>
48 #include	<sys/auxv.h>
49 #include	<debug.h>
50 #include	<conv.h>
51 #include	"_rtld.h"
52 #include	"_audit.h"
53 #include	"_elf.h"
54 #include	"msg.h"
55 
56 static int ld_flags_env(const char *, Word *, Word *, uint_t, int);
57 
58 /*
59  * All error messages go through eprintf().  During process initialization these
60  * messages should be directed to the standard error, however once control has
61  * been passed to the applications code these messages should be stored in an
62  * internal buffer for use with dlerror().  Note, fatal error conditions that
63  * may occur while running the application will still cause a standard error
64  * message, see rtldexit() in this file for details.
65  * The `application' flag serves to indicate the transition between process
66  * initialization and when the applications code is running.
67  */
68 
69 /*
70  * Null function used as place where a debugger can set a breakpoint.
71  */
72 void
73 rtld_db_dlactivity(Lm_list *lml)
74 {
75 	DBG_CALL(Dbg_util_dbnotify(lml, r_debug.rtd_rdebug.r_rdevent,
76 	    r_debug.rtd_rdebug.r_state));
77 }
78 
79 /*
80  * Null function used as place where debugger can set a pre .init
81  * processing breakpoint.
82  */
83 void
84 rtld_db_preinit(Lm_list *lml)
85 {
86 	DBG_CALL(Dbg_util_dbnotify(lml, r_debug.rtd_rdebug.r_rdevent,
87 	    r_debug.rtd_rdebug.r_state));
88 }
89 
90 /*
91  * Null function used as place where debugger can set a post .init
92  * processing breakpoint.
93  */
94 void
95 rtld_db_postinit(Lm_list *lml)
96 {
97 	DBG_CALL(Dbg_util_dbnotify(lml, r_debug.rtd_rdebug.r_rdevent,
98 	    r_debug.rtd_rdebug.r_state));
99 }
100 
101 /*
102  * Debugger Event Notification
103  *
104  * This function centralizes all debugger event notification (ala rtld_db).
105  *
106  * There's a simple intent, focused on insuring the primary link-map control
107  * list (or each link-map list) is consistent, and the indication that objects
108  * have been added or deleted from this list.  Although an RD_ADD and RD_DELETE
109  * event are posted for each of these, most debuggers don't care, as their
110  * view is that these events simply convey an "inconsistent" state.
111  *
112  * We also don't want to trigger multiple RD_ADD/RD_DELETE events any time we
113  * enter ld.so.1.
114  *
115  * With auditors, we may be in the process of relocating a collection of
116  * objects, and will leave() ld.so.1 to call the auditor.  At this point we
117  * must indicate an RD_CONSISTENT event, but librtld_db will not report an
118  * object to the debuggers until relocation processing has been completed on it.
119  * To allow for the collection of these objects that are pending relocation, an
120  * RD_ADD event is set after completing a series of relocations on the primary
121  * link-map control list.
122  *
123  * Set an RD_ADD/RD_DELETE event and indicate that an RD_CONSISTENT event is
124  * required later (LML_FLG_DBNOTIF):
125  *
126  *  i	the first time we add or delete an object to the primary link-map
127  *	control list.
128  *  ii	the first time we move a secondary link-map control list to the primary
129  *	link-map control list (effectively, this is like adding a group of
130  *	objects to the primary link-map control list).
131  *
132  * Set an RD_CONSISTENT event when it is required (LML_FLG_DBNOTIF is set) and
133  *
134  *  i	each time we leave the runtime linker.
135  */
136 void
137 rd_event(Lm_list *lml, rd_event_e event, r_state_e state)
138 {
139 	void	(*fptr)(Lm_list *);
140 
141 	switch (event) {
142 	case RD_PREINIT:
143 		fptr = rtld_db_preinit;
144 		break;
145 	case RD_POSTINIT:
146 		fptr = rtld_db_postinit;
147 		break;
148 	case RD_DLACTIVITY:
149 		switch (state) {
150 		case RT_CONSISTENT:
151 			lml->lm_flags &= ~LML_FLG_DBNOTIF;
152 
153 			/*
154 			 * Do we need to send a notification?
155 			 */
156 			if ((rtld_flags & RT_FL_DBNOTIF) == 0)
157 				return;
158 			rtld_flags &= ~RT_FL_DBNOTIF;
159 			break;
160 		case RT_ADD:
161 		case RT_DELETE:
162 			lml->lm_flags |= LML_FLG_DBNOTIF;
163 
164 			/*
165 			 * If we are already in an inconsistent state, no
166 			 * notification is required.
167 			 */
168 			if (rtld_flags & RT_FL_DBNOTIF)
169 				return;
170 			rtld_flags |= RT_FL_DBNOTIF;
171 			break;
172 		};
173 		fptr = rtld_db_dlactivity;
174 		break;
175 	default:
176 		/*
177 		 * RD_NONE - do nothing
178 		 */
179 		break;
180 	};
181 
182 	/*
183 	 * Set event state and call 'notification' function.
184 	 *
185 	 * The debugging clients have previously been told about these
186 	 * notification functions and have set breakpoints on them if they
187 	 * are interested in the notification.
188 	 */
189 	r_debug.rtd_rdebug.r_state = state;
190 	r_debug.rtd_rdebug.r_rdevent = event;
191 	fptr(lml);
192 	r_debug.rtd_rdebug.r_rdevent = RD_NONE;
193 }
194 
195 #if	defined(__sparc) || defined(__x86)
196 /*
197  * Stack Cleanup.
198  *
199  * This function is invoked to 'remove' arguments that were passed in on the
200  * stack.  This is most likely if ld.so.1 was invoked directly.  In that case
201  * we want to remove ld.so.1 as well as it's arguments from the argv[] array.
202  * Which means we then need to slide everything above it on the stack down
203  * accordingly.
204  *
205  * While the stack layout is platform specific - it just so happens that __x86,
206  * and __sparc platforms share the following initial stack layout.
207  *
208  *	!_______________________!  high addresses
209  *	!			!
210  *	!	Information	!
211  *	!	Block		!
212  *	!	(size varies)	!
213  *	!_______________________!
214  *	!	0 word		!
215  *	!_______________________!
216  *	!	Auxiliary	!
217  *	!	vector		!
218  *	!	2 word entries	!
219  *	!			!
220  *	!_______________________!
221  *	!	0 word		!
222  *	!_______________________!
223  *	!	Environment	!
224  *	!	pointers	!
225  *	!	...		!
226  *	!	(one word each)	!
227  *	!_______________________!
228  *	!	0 word		!
229  *	!_______________________!
230  *	!	Argument	! low addresses
231  *	!	pointers	!
232  *	!	Argc words	!
233  *	!_______________________!
234  *	!			!
235  *	!	Argc		!
236  *	!_______________________!
237  *	!	...		!
238  *
239  */
240 static void
241 stack_cleanup(char **argv, char ***envp, auxv_t **auxv, int rmcnt)
242 {
243 	int		ndx;
244 	long		*argc;
245 	char		**oargv, **nargv;
246 	char		**oenvp, **nenvp;
247 	auxv_t		*oauxv, *nauxv;
248 
249 	/*
250 	 * Slide ARGV[] and update argc.  The argv pointer remains the same,
251 	 * however slide the applications arguments over the arguments to
252 	 * ld.so.1.
253 	 */
254 	nargv = &argv[0];
255 	oargv = &argv[rmcnt];
256 
257 	for (ndx = 0; oargv[ndx]; ndx++)
258 		nargv[ndx] = oargv[ndx];
259 	nargv[ndx] = oargv[ndx];
260 
261 	argc = (long *)((uintptr_t)argv - sizeof (long *));
262 	*argc -= rmcnt;
263 
264 	/*
265 	 * Slide ENVP[], and update the environment array pointer.
266 	 */
267 	ndx++;
268 	nenvp = &nargv[ndx];
269 	oenvp = &oargv[ndx];
270 	*envp = nenvp;
271 
272 	for (ndx = 0; oenvp[ndx]; ndx++)
273 		nenvp[ndx] = oenvp[ndx];
274 	nenvp[ndx] = oenvp[ndx];
275 
276 	/*
277 	 * Slide AUXV[], and update the aux vector pointer.
278 	 */
279 	ndx++;
280 	nauxv = (auxv_t *)&nenvp[ndx];
281 	oauxv = (auxv_t *)&oenvp[ndx];
282 	*auxv = nauxv;
283 
284 	for (ndx = 0; (oauxv[ndx].a_type != AT_NULL); ndx++)
285 		nauxv[ndx] = oauxv[ndx];
286 	nauxv[ndx] = oauxv[ndx];
287 }
288 #else
289 /*
290  * Verify that the above routine is appropriate for any new platforms.
291  */
292 #error	unsupported architecture!
293 #endif
294 
295 /*
296  * The only command line argument recognized is -e, followed by a runtime
297  * linker environment variable.
298  */
299 int
300 rtld_getopt(char **argv, char ***envp, auxv_t **auxv, Word *lmflags,
301     Word *lmtflags, int aout)
302 {
303 	int	ndx;
304 
305 	for (ndx = 1; argv[ndx]; ndx++) {
306 		char	*str;
307 
308 		if (argv[ndx][0] != '-')
309 			break;
310 
311 		if (argv[ndx][1] == '\0') {
312 			ndx++;
313 			break;
314 		}
315 
316 		if (argv[ndx][1] != 'e')
317 			return (1);
318 
319 		if (argv[ndx][2] == '\0') {
320 			ndx++;
321 			if (argv[ndx] == NULL)
322 				return (1);
323 			str = argv[ndx];
324 		} else
325 			str = &argv[ndx][2];
326 
327 		/*
328 		 * If the environment variable starts with LD_, strip the LD_.
329 		 * Otherwise, take things as is.
330 		 */
331 		if ((str[0] == 'L') && (str[1] == 'D') && (str[2] == '_') &&
332 		    (str[3] != '\0'))
333 			str += 3;
334 		if (ld_flags_env(str, lmflags, lmtflags, 0, aout) == 1)
335 			return (1);
336 	}
337 
338 	/*
339 	 * Make sure an object file has been specified.
340 	 */
341 	if (argv[ndx] == 0)
342 		return (1);
343 
344 	/*
345 	 * Having gotten the arguments, clean ourselves off of the stack.
346 	 */
347 	stack_cleanup(argv, envp, auxv, ndx);
348 	return (0);
349 }
350 
351 /*
352  * Compare function for PathNode AVL tree.
353  */
354 static int
355 pnavl_compare(const void *n1, const void *n2)
356 {
357 	uint_t		hash1, hash2;
358 	const char	*st1, *st2;
359 	int		rc;
360 
361 	hash1 = ((PathNode *)n1)->pn_hash;
362 	hash2 = ((PathNode *)n2)->pn_hash;
363 
364 	if (hash1 > hash2)
365 		return (1);
366 	if (hash1 < hash2)
367 		return (-1);
368 
369 	st1 = ((PathNode *)n1)->pn_name;
370 	st2 = ((PathNode *)n2)->pn_name;
371 
372 	rc = strcmp(st1, st2);
373 	if (rc > 0)
374 		return (1);
375 	if (rc < 0)
376 		return (-1);
377 	return (0);
378 }
379 
380 /*
381  * Determine if a pathname has already been recorded on the full path name
382  * AVL tree.  This tree maintains a node for each path name that ld.so.1 has
383  * successfully loaded.  If the path name does not exist in this AVL tree, then
384  * the next insertion point is deposited in "where".  This value can be used by
385  * fpavl_insert() to expedite the insertion.
386  */
387 Rt_map *
388 fpavl_recorded(Lm_list *lml, const char *name, avl_index_t *where)
389 {
390 	FullPathNode	fpn, *fpnp;
391 	avl_tree_t	*avlt;
392 
393 	/*
394 	 * Create the avl tree if required.
395 	 */
396 	if ((avlt = lml->lm_fpavl) == NULL) {
397 		if ((avlt = calloc(sizeof (avl_tree_t), 1)) == 0)
398 			return (0);
399 		avl_create(avlt, pnavl_compare, sizeof (FullPathNode),
400 		    SGSOFFSETOF(FullPathNode, fpn_node.pn_avl));
401 		lml->lm_fpavl = avlt;
402 	}
403 
404 	fpn.fpn_node.pn_name = name;
405 	fpn.fpn_node.pn_hash = sgs_str_hash(name);
406 
407 	if ((fpnp = avl_find(lml->lm_fpavl, &fpn, where)) == NULL)
408 		return (NULL);
409 
410 	return (fpnp->fpn_lmp);
411 }
412 
413 /*
414  * Insert a name into the FullPathNode AVL tree for the link-map list.  The
415  * objects NAME() is the path that would have originally been searched for, and
416  * is therefore the name to associate with any "where" value.  If the object has
417  * a different PATHNAME(), perhaps because it has resolved to a different file
418  * (see fullpath()), then this name will be recorded as a separate FullPathNode
419  * (see load_file()).
420  */
421 int
422 fpavl_insert(Lm_list *lml, Rt_map *lmp, const char *name, avl_index_t where)
423 {
424 	FullPathNode	*fpnp;
425 
426 	if (where == 0) {
427 		/* LINTED */
428 		Rt_map	*_lmp = fpavl_recorded(lml, name, &where);
429 
430 		/*
431 		 * We better not get a hit now, we do not want duplicates in
432 		 * the tree.
433 		 */
434 		ASSERT(_lmp == 0);
435 	}
436 
437 	/*
438 	 * Insert new node in tree.
439 	 */
440 	if ((fpnp = calloc(sizeof (FullPathNode), 1)) == 0)
441 		return (0);
442 
443 	fpnp->fpn_node.pn_name = name;
444 	fpnp->fpn_node.pn_hash = sgs_str_hash(name);
445 	fpnp->fpn_lmp = lmp;
446 
447 	if (aplist_append(&FPNODE(lmp), fpnp, AL_CNT_FPNODE) == NULL) {
448 		free(fpnp);
449 		return (0);
450 	}
451 
452 	ASSERT(lml->lm_fpavl != NULL);
453 	avl_insert(lml->lm_fpavl, fpnp, where);
454 	return (1);
455 }
456 
457 /*
458  * Remove an object from the FullPath AVL tree.  Note, this is called *before*
459  * the objects link-map is torn down (remove_so), which is where any NAME() and
460  * PATHNAME() strings will be deallocated.
461  */
462 void
463 fpavl_remove(Rt_map *lmp)
464 {
465 	FullPathNode	*fpnp;
466 	Aliste		idx;
467 
468 	for (APLIST_TRAVERSE(FPNODE(lmp), idx, fpnp)) {
469 		avl_remove(LIST(lmp)->lm_fpavl, fpnp);
470 		free(fpnp);
471 	}
472 	free(FPNODE(lmp));
473 	FPNODE(lmp) = NULL;
474 }
475 
476 /*
477  * Determine if a pathname has already been recorded on the not-found AVL tree.
478  * This tree maintains a node for each path name that ld.so.1 has explicitly
479  * inspected, but has failed to load during a single ld.so.1 operation.  If the
480  * path name does not exist in this AVL tree, then the next insertion point is
481  * deposited in "where".  This value can be used by nfavl_insert() to expedite
482  * the insertion.
483  */
484 int
485 nfavl_recorded(const char *name, avl_index_t *where)
486 {
487 	PathNode	pn;
488 	avl_tree_t	*avlt;
489 
490 	/*
491 	 * Create the avl tree if required.
492 	 */
493 	if ((avlt = nfavl) == NULL) {
494 		if ((avlt = calloc(sizeof (avl_tree_t), 1)) == 0)
495 			return (0);
496 		avl_create(avlt, pnavl_compare, sizeof (PathNode),
497 		    SGSOFFSETOF(PathNode, pn_avl));
498 		nfavl = avlt;
499 	}
500 
501 	pn.pn_name = name;
502 	pn.pn_hash = sgs_str_hash(name);
503 
504 	if (avl_find(avlt, &pn, where) == NULL)
505 		return (0);
506 
507 	return (1);
508 }
509 
510 /*
511  * Insert a name into the not-found AVL tree.
512  */
513 void
514 nfavl_insert(const char *name, avl_index_t where)
515 {
516 	PathNode	*pnp;
517 
518 	if (where == 0) {
519 		/* LINTED */
520 		int	in_nfavl = nfavl_recorded(name, &where);
521 
522 		/*
523 		 * We better not get a hit now, we do not want duplicates in
524 		 * the tree.
525 		 */
526 		ASSERT(in_nfavl == 0);
527 	}
528 
529 	/*
530 	 * Insert new node in tree.
531 	 */
532 	if ((pnp = calloc(sizeof (PathNode), 1)) != 0) {
533 		pnp->pn_name = name;
534 		pnp->pn_hash = sgs_str_hash(name);
535 		avl_insert(nfavl, pnp, where);
536 	}
537 }
538 
539 /*
540  * Prior to calling an object, either via a .plt or through dlsym(), make sure
541  * its .init has fired.  Through topological sorting, ld.so.1 attempts to fire
542  * init's in the correct order, however, this order is typically based on needed
543  * dependencies and non-lazy relocation bindings.  Lazy relocations (.plts) can
544  * still occur and result in bindings that were not captured during topological
545  * sorting.  This routine compensates for this lack of binding information, and
546  * provides for dynamic .init firing.
547  */
548 void
549 is_dep_init(Rt_map *dlmp, Rt_map *clmp)
550 {
551 	Rt_map	**tobj;
552 
553 	/*
554 	 * If the caller is an auditor, and the destination isn't, then don't
555 	 * run any .inits (see comments in load_completion()).
556 	 */
557 	if ((LIST(clmp)->lm_flags & LML_FLG_NOAUDIT) &&
558 	    (LIST(clmp) != LIST(dlmp)))
559 		return;
560 
561 	if ((dlmp == clmp) || (rtld_flags & (RT_FL_BREADTH | RT_FL_INITFIRST)))
562 		return;
563 
564 	if ((FLAGS(dlmp) & (FLG_RT_RELOCED | FLG_RT_INITDONE)) ==
565 	    (FLG_RT_RELOCED | FLG_RT_INITDONE))
566 		return;
567 
568 	if ((FLAGS(dlmp) & (FLG_RT_RELOCED | FLG_RT_INITCALL)) ==
569 	    (FLG_RT_RELOCED | FLG_RT_INITCALL)) {
570 		DBG_CALL(Dbg_util_no_init(dlmp));
571 		return;
572 	}
573 
574 	if ((tobj = calloc(2, sizeof (Rt_map *))) != NULL) {
575 		tobj[0] = dlmp;
576 		call_init(tobj, DBG_INIT_DYN);
577 	}
578 }
579 
580 /*
581  * In a threaded environment insure the thread responsible for loading an object
582  * has completed .init processing for that object before any new thread is
583  * allowed to access the object.  This check is only valid with libthread
584  * TI_VERSION 2, where ld.so.1 implements locking through low level mutexes.
585  *
586  * When a new link-map is created, the thread that causes it to be loaded is
587  * identified by THREADID(dlmp).  Compare this with the current thread to
588  * determine if it must be blocked.
589  *
590  * NOTE, there are a number of instances (typically only for .plt processing)
591  * where we must skip this test:
592  *
593  *   .	any thread id of 0 - threads that call thr_exit() may be in this state
594  *	thus we can't deduce what tid they used to be.  Also some of the
595  *	lib/libthread worker threads have this id and must bind (to themselves
596  *	or libc) for libthread to function.
597  *
598  *   .	libthread itself binds to libc, and as libthread is INITFIRST
599  *	libc's .init can't have fired yet.  Luckly libc's .init is not required
600  *	by libthreads binding.
601  *
602  *   .	if the caller is an auditor, and the destination isn't, then don't
603  *	block (see comments in load_completion()).
604  */
605 void
606 is_dep_ready(Rt_map *dlmp, Rt_map *clmp, int what)
607 {
608 	thread_t	tid;
609 
610 	if ((LIST(clmp)->lm_flags & LML_FLG_NOAUDIT) &&
611 	    (LIST(clmp) != LIST(dlmp)))
612 		return;
613 
614 	if ((rtld_flags & RT_FL_CONCUR) &&
615 	    ((FLAGS(dlmp) & FLG_RT_INITDONE) == 0) &&
616 	    ((FLAGS(clmp) & FLG_RT_INITFRST) == 0) &&
617 	    ((tid = rt_thr_self()) != 0) && (THREADID(dlmp) != tid)) {
618 		rtldexit(LIST(dlmp), 1);
619 	}
620 }
621 
622 /*
623  * Execute .{preinit|init|fini}array sections
624  */
625 void
626 call_array(Addr *array, uint_t arraysz, Rt_map *lmp, Word shtype)
627 {
628 	int	start, stop, incr, ndx;
629 	uint_t	arraycnt = (uint_t)(arraysz / sizeof (Addr));
630 
631 	if (array == NULL)
632 		return;
633 
634 	/*
635 	 * initarray & preinitarray are walked from beginning to end - while
636 	 * finiarray is walked from end to beginning.
637 	 */
638 	if (shtype == SHT_FINI_ARRAY) {
639 		start = arraycnt - 1;
640 		stop = incr = -1;
641 	} else {
642 		start = 0;
643 		stop = arraycnt;
644 		incr = 1;
645 	}
646 
647 	/*
648 	 * Call the .*array[] entries
649 	 */
650 	for (ndx = start; ndx != stop; ndx += incr) {
651 		void (*fptr)(void) = (void(*)())array[ndx];
652 
653 		DBG_CALL(Dbg_util_call_array(lmp, (void *)fptr, ndx, shtype));
654 
655 		leave(LIST(lmp), thr_flg_reenter);
656 		(*fptr)();
657 		(void) enter(thr_flg_reenter);
658 	}
659 }
660 
661 
662 /*
663  * Execute any .init sections.  These are passed to us in an lmp array which
664  * (by default) will have been sorted.
665  */
666 void
667 call_init(Rt_map **tobj, int flag)
668 {
669 	Rt_map		**_tobj, **_nobj;
670 	static List	pending = { NULL, NULL };
671 
672 	/*
673 	 * If we're in the middle of an INITFIRST, this must complete before
674 	 * any new init's are fired.  In this case add the object list to the
675 	 * pending queue and return.  We'll pick up the queue after any
676 	 * INITFIRST objects have their init's fired.
677 	 */
678 	if (rtld_flags & RT_FL_INITFIRST) {
679 		(void) list_append(&pending, tobj);
680 		return;
681 	}
682 
683 	/*
684 	 * Traverse the tobj array firing each objects init.
685 	 */
686 	for (_tobj = _nobj = tobj, _nobj++; *_tobj != NULL; _tobj++, _nobj++) {
687 		Rt_map	*lmp = *_tobj;
688 		void	(*iptr)() = INIT(lmp);
689 
690 		if (FLAGS(lmp) & FLG_RT_INITCALL)
691 			continue;
692 
693 		FLAGS(lmp) |= FLG_RT_INITCALL;
694 
695 		/*
696 		 * Establish an initfirst state if necessary - no other inits
697 		 * will be fired (because of additional relocation bindings)
698 		 * when in this state.
699 		 */
700 		if (FLAGS(lmp) & FLG_RT_INITFRST)
701 			rtld_flags |= RT_FL_INITFIRST;
702 
703 		if (INITARRAY(lmp) || iptr) {
704 			Aliste		idx;
705 			Bnd_desc 	*bdp;
706 
707 			/*
708 			 * Make sure that all dependencies that have been
709 			 * relocated to are initialized before this objects
710 			 * .init is executed.  This insures that a dependency
711 			 * on an external item that must first be initialized
712 			 * by its associated object is satisfied.
713 			 */
714 			for (APLIST_TRAVERSE(DEPENDS(lmp), idx, bdp)) {
715 				if ((bdp->b_flags & BND_REFER) == 0)
716 					continue;
717 				is_dep_ready(bdp->b_depend, lmp, DBG_WAIT_INIT);
718 			}
719 			DBG_CALL(Dbg_util_call_init(lmp, flag));
720 		}
721 
722 		if (iptr) {
723 			leave(LIST(lmp), thr_flg_reenter);
724 			(*iptr)();
725 			(void) enter(thr_flg_reenter);
726 		}
727 
728 		call_array(INITARRAY(lmp), INITARRAYSZ(lmp), lmp,
729 		    SHT_INIT_ARRAY);
730 
731 		if (INITARRAY(lmp) || iptr)
732 			DBG_CALL(Dbg_util_call_init(lmp, DBG_INIT_DONE));
733 
734 		/*
735 		 * Set the initdone flag regardless of whether this object
736 		 * actually contains an .init section.  This flag prevents us
737 		 * from processing this section again for an .init and also
738 		 * signifies that a .fini must be called should it exist.
739 		 * Clear the sort field for use in later .fini processing.
740 		 */
741 		FLAGS(lmp) |= FLG_RT_INITDONE;
742 		SORTVAL(lmp) = -1;
743 
744 		/*
745 		 * Wake anyone up who might be waiting on this .init.
746 		 */
747 		if (FLAGS1(lmp) & FL1_RT_INITWAIT) {
748 			DBG_CALL(Dbg_util_broadcast(lmp));
749 			(void) rt_cond_broadcast(CONDVAR(lmp));
750 			FLAGS1(lmp) &= ~FL1_RT_INITWAIT;
751 		}
752 
753 		/*
754 		 * If we're firing an INITFIRST object, and other objects must
755 		 * be fired which are not INITFIRST, make sure we grab any
756 		 * pending objects that might have been delayed as this
757 		 * INITFIRST was processed.
758 		 */
759 		if ((rtld_flags & RT_FL_INITFIRST) &&
760 		    ((*_nobj == NULL) || !(FLAGS(*_nobj) & FLG_RT_INITFRST))) {
761 			Listnode	*lnp;
762 			Rt_map		**pobj;
763 
764 			rtld_flags &= ~RT_FL_INITFIRST;
765 
766 			while ((lnp = pending.head) != NULL) {
767 				if ((pending.head = lnp->next) == NULL)
768 					pending.tail = NULL;
769 				pobj = lnp->data;
770 				free(lnp);
771 
772 				call_init(pobj, DBG_INIT_PEND);
773 			}
774 		}
775 	}
776 	free(tobj);
777 }
778 
779 /*
780  * Function called by atexit(3C).  Calls all .fini sections related with the
781  * mains dependent shared libraries in the order in which the shared libraries
782  * have been loaded.  Skip any .fini defined in the main executable, as this
783  * will be called by crt0 (main was never marked as initdone).
784  */
785 void
786 call_fini(Lm_list * lml, Rt_map ** tobj)
787 {
788 	Rt_map **_tobj;
789 
790 	for (_tobj = tobj; *_tobj != NULL; _tobj++) {
791 		Rt_map		*clmp, * lmp = *_tobj;
792 		Aliste		idx;
793 		Bnd_desc	*bdp;
794 
795 		/*
796 		 * If concurrency checking isn't enabled only fire .fini if
797 		 * .init has completed.  We collect all .fini sections of
798 		 * objects that had their .init collected, but that doesn't
799 		 * mean at the time that the .init had completed.
800 		 */
801 		if ((rtld_flags & RT_FL_CONCUR) ||
802 		    (FLAGS(lmp) & FLG_RT_INITDONE)) {
803 			void	(*fptr)(void) = FINI(lmp);
804 
805 			if (FINIARRAY(lmp) || fptr) {
806 				/*
807 				 * If concurrency checking is enabled make sure
808 				 * this object's .init is completed before
809 				 * calling any .fini.
810 				 */
811 				is_dep_ready(lmp, lmp, DBG_WAIT_FINI);
812 				DBG_CALL(Dbg_util_call_fini(lmp));
813 			}
814 
815 			call_array(FINIARRAY(lmp), FINIARRAYSZ(lmp), lmp,
816 			    SHT_FINI_ARRAY);
817 
818 			if (fptr) {
819 				leave(LIST(lmp), thr_flg_reenter);
820 				(*fptr)();
821 				(void) enter(thr_flg_reenter);
822 			}
823 		}
824 
825 		/*
826 		 * Skip main, this is explicitly called last in atexit_fini().
827 		 */
828 		if (FLAGS(lmp) & FLG_RT_ISMAIN)
829 			continue;
830 
831 		/*
832 		 * Audit `close' operations at this point.  The library has
833 		 * exercised its last instructions (regardless of whether it
834 		 * will be unmapped or not).
835 		 *
836 		 * First call any global auditing.
837 		 */
838 		if (lml->lm_tflags & LML_TFLG_AUD_OBJCLOSE)
839 			_audit_objclose(&(auditors->ad_list), lmp);
840 
841 		/*
842 		 * Finally determine whether this object has local auditing
843 		 * requirements by inspecting itself and then its dependencies.
844 		 */
845 		if ((lml->lm_flags & LML_FLG_LOCAUDIT) == 0)
846 			continue;
847 
848 		if (FLAGS1(lmp) & LML_TFLG_AUD_OBJCLOSE)
849 			_audit_objclose(&(AUDITORS(lmp)->ad_list), lmp);
850 
851 		for (APLIST_TRAVERSE(CALLERS(lmp), idx, bdp)) {
852 			clmp = bdp->b_caller;
853 
854 			if (FLAGS1(clmp) & LML_TFLG_AUD_OBJCLOSE) {
855 				_audit_objclose(&(AUDITORS(clmp)->ad_list),
856 				    lmp);
857 				break;
858 			}
859 		}
860 	}
861 	DBG_CALL(Dbg_bind_plt_summary(lml, M_MACH, pltcnt21d, pltcnt24d,
862 	    pltcntu32, pltcntu44, pltcntfull, pltcntfar));
863 
864 	free(tobj);
865 }
866 
867 void
868 atexit_fini()
869 {
870 	Rt_map		**tobj, *lmp;
871 	Lm_list		*lml;
872 	Listnode	*lnp;
873 
874 	(void) enter(0);
875 
876 	rtld_flags |= RT_FL_ATEXIT;
877 
878 	lml = &lml_main;
879 	lml->lm_flags |= LML_FLG_ATEXIT;
880 	lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
881 	lmp = (Rt_map *)lml->lm_head;
882 
883 	/*
884 	 * Reverse topologically sort the main link-map for .fini execution.
885 	 */
886 	if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != 0) &&
887 	    (tobj != (Rt_map **)S_ERROR))
888 		call_fini(lml, tobj);
889 
890 	/*
891 	 * Add an explicit close to main and ld.so.1.  Although main's .fini is
892 	 * collected in call_fini() to provide for FINITARRAY processing, its
893 	 * audit_objclose is explicitly skipped.  This provides for it to be
894 	 * called last, here.  This is the reverse of the explicit calls to
895 	 * audit_objopen() made in setup().
896 	 */
897 	if ((lml->lm_tflags | FLAGS1(lmp)) & LML_TFLG_AUD_MASK) {
898 		audit_objclose(lmp, (Rt_map *)lml_rtld.lm_head);
899 		audit_objclose(lmp, lmp);
900 	}
901 
902 	/*
903 	 * Now that all .fini code has been run, see what unreferenced objects
904 	 * remain.
905 	 */
906 	unused(lml);
907 
908 	/*
909 	 * Traverse any alternative link-map lists.
910 	 */
911 	for (LIST_TRAVERSE(&dynlm_list, lnp, lml)) {
912 		/*
913 		 * Ignore the base-link-map list, which has already been
914 		 * processed, and the runtime linkers link-map list, which is
915 		 * typically processed last.
916 		 */
917 		if (lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM))
918 			continue;
919 
920 		if ((lmp = (Rt_map *)lml->lm_head) == 0)
921 			continue;
922 
923 		lml->lm_flags |= LML_FLG_ATEXIT;
924 		lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
925 
926 		/*
927 		 * Reverse topologically sort the link-map for .fini execution.
928 		 */
929 		if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != 0) &&
930 		    (tobj != (Rt_map **)S_ERROR))
931 			call_fini(lml, tobj);
932 
933 		unused(lml);
934 	}
935 
936 	/*
937 	 * Finally reverse topologically sort the runtime linkers link-map for
938 	 * .fini execution.
939 	 */
940 	lml = &lml_rtld;
941 	lml->lm_flags |= LML_FLG_ATEXIT;
942 	lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
943 	lmp = (Rt_map *)lml->lm_head;
944 
945 	if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != 0) &&
946 	    (tobj != (Rt_map **)S_ERROR))
947 		call_fini(lml, tobj);
948 
949 	leave(&lml_main, 0);
950 }
951 
952 
953 /*
954  * This routine is called to complete any runtime linker activity which may have
955  * resulted in objects being loaded.  This is called from all user entry points
956  * and from any internal dl*() requests.
957  */
958 void
959 load_completion(Rt_map *nlmp)
960 {
961 	Rt_map	**tobj = 0;
962 	Lm_list	*nlml;
963 
964 	/*
965 	 * Establish any .init processing.  Note, in a world of lazy loading,
966 	 * objects may have been loaded regardless of whether the users request
967 	 * was fulfilled (i.e., a dlsym() request may have failed to find a
968 	 * symbol but objects might have been loaded during its search).  Thus,
969 	 * any tsorting starts from the nlmp (new link-maps) pointer and not
970 	 * necessarily from the link-map that may have satisfied the request.
971 	 *
972 	 * Note, the primary link-map has an initialization phase where dynamic
973 	 * .init firing is suppressed.  This provides for a simple and clean
974 	 * handshake with the primary link-maps libc, which is important for
975 	 * establishing uberdata.  In addition, auditors often obtain handles
976 	 * to primary link-map objects as the objects are loaded, so as to
977 	 * inspect the link-map for symbols.  This inspection is allowed without
978 	 * running any code on the primary link-map, as running this code may
979 	 * reenter the auditor, who may not yet have finished its own
980 	 * initialization.
981 	 */
982 	if (nlmp)
983 		nlml = LIST(nlmp);
984 
985 	if (nlmp && nlml->lm_init && ((nlml != &lml_main) ||
986 	    (rtld_flags2 & (RT_FL2_PLMSETUP | RT_FL2_NOPLM)))) {
987 		if ((tobj = tsort(nlmp, LIST(nlmp)->lm_init,
988 		    RT_SORT_REV)) == (Rt_map **)S_ERROR)
989 			tobj = 0;
990 	}
991 
992 	/*
993 	 * Make sure any alternative link-map retrieves any external interfaces
994 	 * and initializes threads.
995 	 */
996 	if (nlmp && (nlml != &lml_main)) {
997 		(void) rt_get_extern(nlml, nlmp);
998 		rt_thr_init(nlml);
999 	}
1000 
1001 	/*
1002 	 * Traverse the list of new link-maps and register any dynamic TLS.
1003 	 * This storage is established for any objects not on the primary
1004 	 * link-map, and for any objects added to the primary link-map after
1005 	 * static TLS has been registered.
1006 	 */
1007 	if (nlmp && nlml->lm_tls && ((nlml != &lml_main) ||
1008 	    (rtld_flags2 & (RT_FL2_PLMSETUP | RT_FL2_NOPLM)))) {
1009 		Rt_map	*lmp;
1010 
1011 		for (lmp = nlmp; lmp; lmp = (Rt_map *)NEXT(lmp)) {
1012 			if (PTTLS(lmp) && PTTLS(lmp)->p_memsz)
1013 				tls_modaddrem(lmp, TM_FLG_MODADD);
1014 		}
1015 		nlml->lm_tls = 0;
1016 	}
1017 
1018 	/*
1019 	 * Fire any .init's.
1020 	 */
1021 	if (tobj)
1022 		call_init(tobj, DBG_INIT_SORT);
1023 }
1024 
1025 /*
1026  * Append an item to the specified list, and return a pointer to the list
1027  * node created.
1028  */
1029 Listnode *
1030 list_append(List *lst, const void *item)
1031 {
1032 	Listnode	*_lnp;
1033 
1034 	if ((_lnp = malloc(sizeof (Listnode))) == 0)
1035 		return (0);
1036 
1037 	_lnp->data = (void *)item;
1038 	_lnp->next = NULL;
1039 
1040 	if (lst->head == NULL)
1041 		lst->tail = lst->head = _lnp;
1042 	else {
1043 		lst->tail->next = _lnp;
1044 		lst->tail = lst->tail->next;
1045 	}
1046 	return (_lnp);
1047 }
1048 
1049 
1050 /*
1051  * Add an item after specified listnode, and return a pointer to the list
1052  * node created.
1053  */
1054 Listnode *
1055 list_insert(List *lst, const void *item, Listnode *lnp)
1056 {
1057 	Listnode	*_lnp;
1058 
1059 	if ((_lnp = malloc(sizeof (Listnode))) == (Listnode *)0)
1060 		return (0);
1061 
1062 	_lnp->data = (void *)item;
1063 	_lnp->next = lnp->next;
1064 	if (_lnp->next == NULL)
1065 		lst->tail = _lnp;
1066 	lnp->next = _lnp;
1067 	return (_lnp);
1068 }
1069 
1070 /*
1071  * Prepend an item to the specified list, and return a pointer to the
1072  * list node created.
1073  */
1074 Listnode *
1075 list_prepend(List * lst, const void * item)
1076 {
1077 	Listnode	*_lnp;
1078 
1079 	if ((_lnp = malloc(sizeof (Listnode))) == (Listnode *)0)
1080 		return (0);
1081 
1082 	_lnp->data = (void *)item;
1083 
1084 	if (lst->head == NULL) {
1085 		_lnp->next = NULL;
1086 		lst->tail = lst->head = _lnp;
1087 	} else {
1088 		_lnp->next = lst->head;
1089 		lst->head = _lnp;
1090 	}
1091 	return (_lnp);
1092 }
1093 
1094 
1095 /*
1096  * Delete a 'listnode' from a list.
1097  */
1098 void
1099 list_delete(List *lst, void *item)
1100 {
1101 	Listnode	*clnp, *plnp;
1102 
1103 	for (plnp = NULL, clnp = lst->head; clnp; clnp = clnp->next) {
1104 		if (item == clnp->data)
1105 			break;
1106 		plnp = clnp;
1107 	}
1108 
1109 	if (clnp == 0)
1110 		return;
1111 
1112 	if (lst->head == clnp)
1113 		lst->head = clnp->next;
1114 	if (lst->tail == clnp)
1115 		lst->tail = plnp;
1116 
1117 	if (plnp)
1118 		plnp->next = clnp->next;
1119 
1120 	free(clnp);
1121 }
1122 
1123 /*
1124  * Append an item to the specified link map control list.
1125  */
1126 void
1127 lm_append(Lm_list *lml, Aliste lmco, Rt_map *lmp)
1128 {
1129 	Lm_cntl	*lmc;
1130 	int	add = 1;
1131 
1132 	/*
1133 	 * Indicate that this link-map list has a new object.
1134 	 */
1135 	(lml->lm_obj)++;
1136 
1137 	/*
1138 	 * If we're about to add a new object to the main link-map control list,
1139 	 * alert the debuggers that we are about to mess with this list.
1140 	 * Additions of individual objects to the main link-map control list
1141 	 * occur during initial setup as the applications immediate dependencies
1142 	 * are loaded.  Individual objects are also loaded on the main link-map
1143 	 * control list of new alternative link-map control lists.
1144 	 */
1145 	if ((lmco == ALIST_OFF_DATA) &&
1146 	    ((lml->lm_flags & LML_FLG_DBNOTIF) == 0))
1147 		rd_event(lml, RD_DLACTIVITY, RT_ADD);
1148 
1149 	/* LINTED */
1150 	lmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, lmco);
1151 
1152 	/*
1153 	 * A link-map list header points to one of more link-map control lists
1154 	 * (see include/rtld.h).  The initial list, pointed to by lm_cntl, is
1155 	 * the list of relocated objects.  Other lists maintain objects that
1156 	 * are still being analyzed or relocated.  This list provides the core
1157 	 * link-map list information used by all ld.so.1 routines.
1158 	 */
1159 	if (lmc->lc_head == NULL) {
1160 		/*
1161 		 * If this is the first link-map for the given control list,
1162 		 * initialize the list.
1163 		 */
1164 		lmc->lc_head = lmc->lc_tail = lmp;
1165 		add = 0;
1166 
1167 	} else if (FLAGS(lmp) & FLG_RT_OBJINTPO) {
1168 		Rt_map	*tlmp;
1169 
1170 		/*
1171 		 * If this is an interposer then append the link-map following
1172 		 * any other interposers (these are objects that have been
1173 		 * previously preloaded, or were identified with -z interpose).
1174 		 * Interposers can only be inserted on the first link-map
1175 		 * control list, as once relocation has started, interposition
1176 		 * from new interposers can't be guaranteed.
1177 		 *
1178 		 * NOTE: We do not interpose on the head of a list.  This model
1179 		 * evolved because dynamic executables have already been fully
1180 		 * relocated within themselves and thus can't be interposed on.
1181 		 * Nowadays it's possible to have shared objects at the head of
1182 		 * a list, which conceptually means they could be interposed on.
1183 		 * But, shared objects can be created via dldump() and may only
1184 		 * be partially relocated (just relatives), in which case they
1185 		 * are interposable, but are marked as fixed (ET_EXEC).
1186 		 *
1187 		 * Thus we really don't have a clear method of deciding when the
1188 		 * head of a link-map is interposable.  So, to be consistent,
1189 		 * for now only add interposers after the link-map lists head
1190 		 * object.
1191 		 */
1192 		for (tlmp = (Rt_map *)NEXT(lmc->lc_head); tlmp;
1193 		    tlmp = (Rt_map *)NEXT(tlmp)) {
1194 
1195 			if (FLAGS(tlmp) & FLG_RT_OBJINTPO)
1196 				continue;
1197 
1198 			/*
1199 			 * Insert the new link-map before this non-interposer,
1200 			 * and indicate an interposer is found.
1201 			 */
1202 			NEXT((Rt_map *)PREV(tlmp)) = (Link_map *)lmp;
1203 			PREV(lmp) = PREV(tlmp);
1204 
1205 			NEXT(lmp) = (Link_map *)tlmp;
1206 			PREV(tlmp) = (Link_map *)lmp;
1207 
1208 			lmc->lc_flags |= LMC_FLG_REANALYZE;
1209 			add = 0;
1210 			break;
1211 		}
1212 	}
1213 
1214 	/*
1215 	 * Fall through to appending the new link map to the tail of the list.
1216 	 * If we're processing the initial objects of this link-map list, add
1217 	 * them to the backward compatibility list.
1218 	 */
1219 	if (add) {
1220 		NEXT(lmc->lc_tail) = (Link_map *)lmp;
1221 		PREV(lmp) = (Link_map *)lmc->lc_tail;
1222 		lmc->lc_tail = lmp;
1223 	}
1224 
1225 	/*
1226 	 * Having added this link-map to a control list, indicate which control
1227 	 * list the link-map belongs to.  Note, control list information is
1228 	 * always maintained as an offset, as the Alist can be reallocated.
1229 	 */
1230 	CNTL(lmp) = lmco;
1231 
1232 	/*
1233 	 * Indicate if an interposer is found.  Note that the first object on a
1234 	 * link-map can be explicitly defined as an interposer so that it can
1235 	 * provide interposition over direct binding requests.
1236 	 */
1237 	if (FLAGS(lmp) & MSK_RT_INTPOSE)
1238 		lml->lm_flags |= LML_FLG_INTRPOSE;
1239 
1240 	/*
1241 	 * For backward compatibility with debuggers, the link-map list contains
1242 	 * pointers to the main control list.
1243 	 */
1244 	if (lmco == ALIST_OFF_DATA) {
1245 		lml->lm_head = lmc->lc_head;
1246 		lml->lm_tail = lmc->lc_tail;
1247 	}
1248 }
1249 
1250 /*
1251  * Delete an item from the specified link map control list.
1252  */
1253 void
1254 lm_delete(Lm_list *lml, Rt_map *lmp)
1255 {
1256 	Lm_cntl	*lmc;
1257 
1258 	/*
1259 	 * If the control list pointer hasn't been initialized, this object
1260 	 * never got added to a link-map list.
1261 	 */
1262 	if (CNTL(lmp) == 0)
1263 		return;
1264 
1265 	/*
1266 	 * If we're about to delete an object from the main link-map control
1267 	 * list, alert the debuggers that we are about to mess with this list.
1268 	 */
1269 	if ((CNTL(lmp) == ALIST_OFF_DATA) &&
1270 	    ((lml->lm_flags & LML_FLG_DBNOTIF) == 0))
1271 		rd_event(lml, RD_DLACTIVITY, RT_DELETE);
1272 
1273 	/* LINTED */
1274 	lmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, CNTL(lmp));
1275 
1276 	if (lmc->lc_head == lmp)
1277 		lmc->lc_head = (Rt_map *)NEXT(lmp);
1278 	else
1279 		NEXT((Rt_map *)PREV(lmp)) = (void *)NEXT(lmp);
1280 
1281 	if (lmc->lc_tail == lmp)
1282 		lmc->lc_tail = (Rt_map *)PREV(lmp);
1283 	else
1284 		PREV((Rt_map *)NEXT(lmp)) = PREV(lmp);
1285 
1286 	/*
1287 	 * For backward compatibility with debuggers, the link-map list contains
1288 	 * pointers to the main control list.
1289 	 */
1290 	if (lmc == (Lm_cntl *)&lml->lm_lists->al_data) {
1291 		lml->lm_head = lmc->lc_head;
1292 		lml->lm_tail = lmc->lc_tail;
1293 	}
1294 
1295 	/*
1296 	 * Indicate we have one less object on this control list.
1297 	 */
1298 	(lml->lm_obj)--;
1299 }
1300 
1301 /*
1302  * Move a link-map control list to another.  Objects that are being relocated
1303  * are maintained on secondary control lists.  Once their relocation is
1304  * complete, the entire list is appended to the previous control list, as this
1305  * list must have been the trigger for generating the new control list.
1306  */
1307 void
1308 lm_move(Lm_list *lml, Aliste nlmco, Aliste plmco, Lm_cntl *nlmc, Lm_cntl *plmc)
1309 {
1310 	Rt_map	*lmp;
1311 
1312 	/*
1313 	 * If we're about to add a new family of objects to the main link-map
1314 	 * control list, alert the debuggers that we are about to mess with this
1315 	 * list.  Additions of object families to the main link-map control
1316 	 * list occur during lazy loading, filtering and dlopen().
1317 	 */
1318 	if ((plmco == ALIST_OFF_DATA) &&
1319 	    ((lml->lm_flags & LML_FLG_DBNOTIF) == 0))
1320 		rd_event(lml, RD_DLACTIVITY, RT_ADD);
1321 
1322 	DBG_CALL(Dbg_file_cntl(lml, nlmco, plmco));
1323 
1324 	/*
1325 	 * Indicate each new link-map has been moved to the previous link-map
1326 	 * control list.
1327 	 */
1328 	for (lmp = nlmc->lc_head; lmp; lmp = (Rt_map *)NEXT(lmp))
1329 		CNTL(lmp) = plmco;
1330 
1331 	/*
1332 	 * Move the new link-map control list, to the callers link-map control
1333 	 * list.
1334 	 */
1335 	if (plmc->lc_head == 0) {
1336 		plmc->lc_head = nlmc->lc_head;
1337 		PREV(nlmc->lc_head) = 0;
1338 	} else {
1339 		NEXT(plmc->lc_tail) = (Link_map *)nlmc->lc_head;
1340 		PREV(nlmc->lc_head) = (Link_map *)plmc->lc_tail;
1341 	}
1342 
1343 	plmc->lc_tail = nlmc->lc_tail;
1344 	nlmc->lc_head = nlmc->lc_tail = 0;
1345 
1346 	/*
1347 	 * For backward compatibility with debuggers, the link-map list contains
1348 	 * pointers to the main control list.
1349 	 */
1350 	if (plmco == ALIST_OFF_DATA) {
1351 		lml->lm_head = plmc->lc_head;
1352 		lml->lm_tail = plmc->lc_tail;
1353 	}
1354 }
1355 
1356 /*
1357  * Environment variables can have a variety of defined permutations, and thus
1358  * the following infrastructure exists to allow this variety and to select the
1359  * required definition.
1360  *
1361  * Environment variables can be defined as 32- or 64-bit specific, and if so
1362  * they will take precedence over any instruction set neutral form.  Typically
1363  * this is only useful when the environment value is an informational string.
1364  *
1365  * Environment variables may be obtained from the standard user environment or
1366  * from a configuration file.  The latter provides a fallback if no user
1367  * environment setting is found, and can take two forms:
1368  *
1369  *  .	a replaceable definition - this will be used if no user environment
1370  *	setting has been seen, or
1371  *
1372  *  .	an permanent definition - this will be used no matter what user
1373  *	environment setting is seen.  In the case of list variables it will be
1374  *	appended to any process environment setting seen.
1375  *
1376  * Environment variables can be defined without a value (ie. LD_XXXX=) so as to
1377  * override any replaceable environment variables from a configuration file.
1378  */
1379 static	u_longlong_t		rplgen;		/* replaceable generic */
1380 						/*	variables */
1381 static	u_longlong_t		rplisa;		/* replaceable ISA specific */
1382 						/*	variables */
1383 static	u_longlong_t		prmgen;		/* permanent generic */
1384 						/*	variables */
1385 static	u_longlong_t		prmisa;		/* permanent ISA specific */
1386 						/*	variables */
1387 
1388 /*
1389  * Classify an environment variables type.
1390  */
1391 #define	ENV_TYP_IGNORE		0x1		/* ignore - variable is for */
1392 						/*	the wrong ISA */
1393 #define	ENV_TYP_ISA		0x2		/* variable is ISA specific */
1394 #define	ENV_TYP_CONFIG		0x4		/* variable obtained from a */
1395 						/*	config file */
1396 #define	ENV_TYP_PERMANT		0x8		/* variable is permanent */
1397 
1398 /*
1399  * Identify all environment variables.
1400  */
1401 #define	ENV_FLG_AUDIT		0x0000000001ULL
1402 #define	ENV_FLG_AUDIT_ARGS	0x0000000002ULL
1403 #define	ENV_FLG_BIND_NOW	0x0000000004ULL
1404 #define	ENV_FLG_BIND_NOT	0x0000000008ULL
1405 #define	ENV_FLG_BINDINGS	0x0000000010ULL
1406 #define	ENV_FLG_CONCURRENCY	0x0000000020ULL
1407 #define	ENV_FLG_CONFGEN		0x0000000040ULL
1408 #define	ENV_FLG_CONFIG		0x0000000080ULL
1409 #define	ENV_FLG_DEBUG		0x0000000100ULL
1410 #define	ENV_FLG_DEBUG_OUTPUT	0x0000000200ULL
1411 #define	ENV_FLG_DEMANGLE	0x0000000400ULL
1412 #define	ENV_FLG_FLAGS		0x0000000800ULL
1413 #define	ENV_FLG_INIT		0x0000001000ULL
1414 #define	ENV_FLG_LIBPATH		0x0000002000ULL
1415 #define	ENV_FLG_LOADAVAIL	0x0000004000ULL
1416 #define	ENV_FLG_LOADFLTR	0x0000008000ULL
1417 #define	ENV_FLG_NOAUDIT		0x0000010000ULL
1418 #define	ENV_FLG_NOAUXFLTR	0x0000020000ULL
1419 #define	ENV_FLG_NOBAPLT		0x0000040000ULL
1420 #define	ENV_FLG_NOCONFIG	0x0000080000ULL
1421 #define	ENV_FLG_NODIRCONFIG	0x0000100000ULL
1422 #define	ENV_FLG_NODIRECT	0x0000200000ULL
1423 #define	ENV_FLG_NOENVCONFIG	0x0000400000ULL
1424 #define	ENV_FLG_NOLAZY		0x0000800000ULL
1425 #define	ENV_FLG_NOOBJALTER	0x0001000000ULL
1426 #define	ENV_FLG_NOVERSION	0x0002000000ULL
1427 #define	ENV_FLG_PRELOAD		0x0004000000ULL
1428 #define	ENV_FLG_PROFILE		0x0008000000ULL
1429 #define	ENV_FLG_PROFILE_OUTPUT	0x0010000000ULL
1430 #define	ENV_FLG_SIGNAL		0x0020000000ULL
1431 #define	ENV_FLG_TRACE_OBJS	0x0040000000ULL
1432 #define	ENV_FLG_TRACE_PTHS	0x0080000000ULL
1433 #define	ENV_FLG_UNREF		0x0100000000ULL
1434 #define	ENV_FLG_UNUSED		0x0200000000ULL
1435 #define	ENV_FLG_VERBOSE		0x0400000000ULL
1436 #define	ENV_FLG_WARN		0x0800000000ULL
1437 #define	ENV_FLG_NOFLTCONFIG	0x1000000000ULL
1438 #define	ENV_FLG_BIND_LAZY	0x2000000000ULL
1439 #define	ENV_FLG_NOUNRESWEAK	0x4000000000ULL
1440 #define	ENV_FLG_NOPAREXT	0x8000000000ULL
1441 
1442 #ifdef	SIEBEL_DISABLE
1443 #define	ENV_FLG_FIX_1		0x8000000000ULL
1444 #endif
1445 
1446 #define	SEL_REPLACE		0x0001
1447 #define	SEL_PERMANT		0x0002
1448 #define	SEL_ACT_RT		0x0100	/* setting rtld_flags */
1449 #define	SEL_ACT_RT2		0x0200	/* setting rtld_flags2 */
1450 #define	SEL_ACT_STR		0x0400	/* setting string value */
1451 #define	SEL_ACT_LML		0x0800	/* setting lml_flags */
1452 #define	SEL_ACT_LMLT		0x1000	/* setting lml_tflags */
1453 #define	SEL_ACT_SPEC_1		0x2000	/* For FLG_{FLAGS, LIBPATH} */
1454 #define	SEL_ACT_SPEC_2		0x4000	/* need special handling */
1455 
1456 /*
1457  * Pattern match an LD_XXXX environment variable.  s1 points to the XXXX part
1458  * and len specifies its length (comparing a strings length before the string
1459  * itself speed things up).  s2 points to the token itself which has already
1460  * had any leading white-space removed.
1461  */
1462 static void
1463 ld_generic_env(const char *s1, size_t len, const char *s2, Word *lmflags,
1464     Word *lmtflags, uint_t env_flags, int aout)
1465 {
1466 	u_longlong_t	variable = 0;
1467 	ushort_t	select = 0;
1468 	const char	**str;
1469 	Word		val = 0;
1470 
1471 	/*
1472 	 * Determine whether we're dealing with a replaceable or permanent
1473 	 * string.
1474 	 */
1475 	if (env_flags & ENV_TYP_PERMANT) {
1476 		/*
1477 		 * If the string is from a configuration file and defined as
1478 		 * permanent, assign it as permanent.
1479 		 */
1480 		select |= SEL_PERMANT;
1481 	} else
1482 		select |= SEL_REPLACE;
1483 
1484 	/*
1485 	 * Parse the variable given.
1486 	 *
1487 	 * The LD_AUDIT family.
1488 	 */
1489 	if (*s1 == 'A') {
1490 		if ((len == MSG_LD_AUDIT_SIZE) && (strncmp(s1,
1491 		    MSG_ORIG(MSG_LD_AUDIT), MSG_LD_AUDIT_SIZE) == 0)) {
1492 			/*
1493 			 * Replaceable and permanent audit objects can exist.
1494 			 */
1495 			select |= SEL_ACT_STR;
1496 			if (select & SEL_REPLACE)
1497 				str = &rpl_audit;
1498 			else {
1499 				str = &prm_audit;
1500 				rpl_audit = 0;
1501 			}
1502 			variable = ENV_FLG_AUDIT;
1503 		} else if ((len == MSG_LD_AUDIT_ARGS_SIZE) &&
1504 		    (strncmp(s1, MSG_ORIG(MSG_LD_AUDIT_ARGS),
1505 		    MSG_LD_AUDIT_ARGS_SIZE) == 0)) {
1506 			/*
1507 			 * A specialized variable for plt_exit() use, not
1508 			 * documented for general use.
1509 			 */
1510 			select |= SEL_ACT_SPEC_2;
1511 			variable = ENV_FLG_AUDIT_ARGS;
1512 		}
1513 	}
1514 	/*
1515 	 * The LD_BIND family and LD_BREADTH (historic).
1516 	 */
1517 	else if (*s1 == 'B') {
1518 		if ((len == MSG_LD_BIND_LAZY_SIZE) && (strncmp(s1,
1519 		    MSG_ORIG(MSG_LD_BIND_LAZY),
1520 		    MSG_LD_BIND_LAZY_SIZE) == 0)) {
1521 			select |= SEL_ACT_RT2;
1522 			val = RT_FL2_BINDLAZY;
1523 			variable = ENV_FLG_BIND_LAZY;
1524 		} else if ((len == MSG_LD_BIND_NOW_SIZE) && (strncmp(s1,
1525 		    MSG_ORIG(MSG_LD_BIND_NOW), MSG_LD_BIND_NOW_SIZE) == 0)) {
1526 			select |= SEL_ACT_RT2;
1527 			val = RT_FL2_BINDNOW;
1528 			variable = ENV_FLG_BIND_NOW;
1529 		} else if ((len == MSG_LD_BIND_NOT_SIZE) && (strncmp(s1,
1530 		    MSG_ORIG(MSG_LD_BIND_NOT), MSG_LD_BIND_NOT_SIZE) == 0)) {
1531 			/*
1532 			 * Another trick, enabled to help debug AOUT
1533 			 * applications under BCP, but not documented for
1534 			 * general use.
1535 			 */
1536 			select |= SEL_ACT_RT;
1537 			val = RT_FL_NOBIND;
1538 			variable = ENV_FLG_BIND_NOT;
1539 		} else if ((len == MSG_LD_BINDINGS_SIZE) && (strncmp(s1,
1540 		    MSG_ORIG(MSG_LD_BINDINGS), MSG_LD_BINDINGS_SIZE) == 0)) {
1541 			/*
1542 			 * This variable is simply for backward compatibility.
1543 			 * If this and LD_DEBUG are both specified, only one of
1544 			 * the strings is going to get processed.
1545 			 */
1546 			select |= SEL_ACT_SPEC_2;
1547 			variable = ENV_FLG_BINDINGS;
1548 #ifndef LD_BREADTH_DISABLED
1549 		} else if ((len == MSG_LD_BREADTH_SIZE) && (strncmp(s1,
1550 		    MSG_ORIG(MSG_LD_BREADTH), MSG_LD_BREADTH_SIZE) == 0)) {
1551 			/*
1552 			 * Besides some old patches this is no longer available.
1553 			 */
1554 			rtld_flags |= RT_FL_BREADTH;
1555 			return;
1556 #endif
1557 		}
1558 	}
1559 	/*
1560 	 * LD_CONCURRENCY and LD_CONFIG family.
1561 	 */
1562 	else if (*s1 == 'C') {
1563 		if ((len == MSG_LD_CONCURRENCY_SIZE) && (strncmp(s1,
1564 		    MSG_ORIG(MSG_LD_CONCURRENCY),
1565 		    MSG_LD_CONCURRENCY_SIZE) == 0)) {
1566 			/*
1567 			 * Waiting in the wings, as concurrency checking isn't
1568 			 * yet enabled.
1569 			 */
1570 			select |= SEL_ACT_SPEC_2;
1571 			variable = ENV_FLG_CONCURRENCY;
1572 		} else if ((len == MSG_LD_CONFGEN_SIZE) && (strncmp(s1,
1573 		    MSG_ORIG(MSG_LD_CONFGEN), MSG_LD_CONFGEN_SIZE) == 0)) {
1574 			/*
1575 			 * Set by crle(1) to indicate it's building a
1576 			 * configuration file, not documented for general use.
1577 			 */
1578 			select |= SEL_ACT_SPEC_2;
1579 			variable = ENV_FLG_CONFGEN;
1580 		} else if ((len == MSG_LD_CONFIG_SIZE) && (strncmp(s1,
1581 		    MSG_ORIG(MSG_LD_CONFIG), MSG_LD_CONFIG_SIZE) == 0)) {
1582 			/*
1583 			 * Secure applications must use a default configuration
1584 			 * file.  A setting from a configuration file doesn't
1585 			 * make sense (given we must be reading a configuration
1586 			 * file to have gotten this).
1587 			 */
1588 			if ((rtld_flags & RT_FL_SECURE) ||
1589 			    (env_flags & ENV_TYP_CONFIG))
1590 				return;
1591 			select |= SEL_ACT_STR;
1592 			str = &config->c_name;
1593 			variable = ENV_FLG_CONFIG;
1594 		}
1595 	}
1596 	/*
1597 	 * The LD_DEBUG family and LD_DEMANGLE.
1598 	 */
1599 	else if (*s1 == 'D') {
1600 		if ((len == MSG_LD_DEBUG_SIZE) && (strncmp(s1,
1601 		    MSG_ORIG(MSG_LD_DEBUG), MSG_LD_DEBUG_SIZE) == 0)) {
1602 			select |= SEL_ACT_STR;
1603 			if (select & SEL_REPLACE)
1604 				str = &rpl_debug;
1605 			else {
1606 				str = &prm_debug;
1607 				rpl_debug = 0;
1608 			}
1609 			variable = ENV_FLG_DEBUG;
1610 		} else if ((len == MSG_LD_DEBUG_OUTPUT_SIZE) && (strncmp(s1,
1611 		    MSG_ORIG(MSG_LD_DEBUG_OUTPUT),
1612 		    MSG_LD_DEBUG_OUTPUT_SIZE) == 0)) {
1613 			select |= SEL_ACT_STR;
1614 			str = &dbg_file;
1615 			variable = ENV_FLG_DEBUG_OUTPUT;
1616 		} else if ((len == MSG_LD_DEMANGLE_SIZE) && (strncmp(s1,
1617 		    MSG_ORIG(MSG_LD_DEMANGLE), MSG_LD_DEMANGLE_SIZE) == 0)) {
1618 			select |= SEL_ACT_RT;
1619 			val = RT_FL_DEMANGLE;
1620 			variable = ENV_FLG_DEMANGLE;
1621 		}
1622 	}
1623 	/*
1624 	 * LD_FLAGS - collect the best variable definition.  On completion of
1625 	 * environment variable processing pass the result to ld_flags_env()
1626 	 * where they'll be decomposed and passed back to this routine.
1627 	 */
1628 	else if (*s1 == 'F') {
1629 		if ((len == MSG_LD_FLAGS_SIZE) && (strncmp(s1,
1630 		    MSG_ORIG(MSG_LD_FLAGS), MSG_LD_FLAGS_SIZE) == 0)) {
1631 			select |= SEL_ACT_SPEC_1;
1632 			if (select & SEL_REPLACE)
1633 				str = &rpl_ldflags;
1634 			else {
1635 				str = &prm_ldflags;
1636 				rpl_ldflags = 0;
1637 			}
1638 			variable = ENV_FLG_FLAGS;
1639 		}
1640 	}
1641 	/*
1642 	 * LD_INIT (internal, used by ldd(1)).
1643 	 */
1644 	else if (*s1 == 'I') {
1645 		if ((len == MSG_LD_INIT_SIZE) && (strncmp(s1,
1646 		    MSG_ORIG(MSG_LD_INIT), MSG_LD_INIT_SIZE) == 0)) {
1647 			select |= SEL_ACT_LML;
1648 			val = LML_FLG_TRC_INIT;
1649 			variable = ENV_FLG_INIT;
1650 		}
1651 	}
1652 	/*
1653 	 * The LD_LIBRARY_PATH and LD_LOAD families.
1654 	 */
1655 	else if (*s1 == 'L') {
1656 		if ((len == MSG_LD_LIBPATH_SIZE) && (strncmp(s1,
1657 		    MSG_ORIG(MSG_LD_LIBPATH), MSG_LD_LIBPATH_SIZE) == 0)) {
1658 			select |= SEL_ACT_SPEC_1;
1659 			if (select & SEL_REPLACE)
1660 				str = &rpl_libpath;
1661 			else {
1662 				str = &prm_libpath;
1663 				rpl_libpath = 0;
1664 			}
1665 			variable = ENV_FLG_LIBPATH;
1666 		} else if ((len == MSG_LD_LOADAVAIL_SIZE) && (strncmp(s1,
1667 		    MSG_ORIG(MSG_LD_LOADAVAIL), MSG_LD_LOADAVAIL_SIZE) == 0)) {
1668 			/*
1669 			 * Internal use by crle(1), not documented for general
1670 			 * use.
1671 			 */
1672 			select |= SEL_ACT_LML;
1673 			val = LML_FLG_LOADAVAIL;
1674 			variable = ENV_FLG_LOADAVAIL;
1675 		} else if ((len == MSG_LD_LOADFLTR_SIZE) && (strncmp(s1,
1676 		    MSG_ORIG(MSG_LD_LOADFLTR), MSG_LD_LOADFLTR_SIZE) == 0)) {
1677 			select |= SEL_ACT_SPEC_2;
1678 			variable = ENV_FLG_LOADFLTR;
1679 		}
1680 	}
1681 	/*
1682 	 * The LD_NO family.
1683 	 */
1684 	else if (*s1 == 'N') {
1685 		if ((len == MSG_LD_NOAUDIT_SIZE) && (strncmp(s1,
1686 		    MSG_ORIG(MSG_LD_NOAUDIT), MSG_LD_NOAUDIT_SIZE) == 0)) {
1687 			select |= SEL_ACT_RT;
1688 			val = RT_FL_NOAUDIT;
1689 			variable = ENV_FLG_NOAUDIT;
1690 		} else if ((len == MSG_LD_NOAUXFLTR_SIZE) && (strncmp(s1,
1691 		    MSG_ORIG(MSG_LD_NOAUXFLTR), MSG_LD_NOAUXFLTR_SIZE) == 0)) {
1692 			select |= SEL_ACT_RT;
1693 			val = RT_FL_NOAUXFLTR;
1694 			variable = ENV_FLG_NOAUXFLTR;
1695 		} else if ((len == MSG_LD_NOBAPLT_SIZE) && (strncmp(s1,
1696 		    MSG_ORIG(MSG_LD_NOBAPLT), MSG_LD_NOBAPLT_SIZE) == 0)) {
1697 			select |= SEL_ACT_RT;
1698 			val = RT_FL_NOBAPLT;
1699 			variable = ENV_FLG_NOBAPLT;
1700 		} else if ((len == MSG_LD_NOCONFIG_SIZE) && (strncmp(s1,
1701 		    MSG_ORIG(MSG_LD_NOCONFIG), MSG_LD_NOCONFIG_SIZE) == 0)) {
1702 			select |= SEL_ACT_RT;
1703 			val = RT_FL_NOCFG;
1704 			variable = ENV_FLG_NOCONFIG;
1705 		} else if ((len == MSG_LD_NODIRCONFIG_SIZE) && (strncmp(s1,
1706 		    MSG_ORIG(MSG_LD_NODIRCONFIG),
1707 		    MSG_LD_NODIRCONFIG_SIZE) == 0)) {
1708 			select |= SEL_ACT_RT;
1709 			val = RT_FL_NODIRCFG;
1710 			variable = ENV_FLG_NODIRCONFIG;
1711 		} else if ((len == MSG_LD_NODIRECT_SIZE) && (strncmp(s1,
1712 		    MSG_ORIG(MSG_LD_NODIRECT), MSG_LD_NODIRECT_SIZE) == 0)) {
1713 			select |= SEL_ACT_LMLT;
1714 			val = LML_TFLG_NODIRECT;
1715 			variable = ENV_FLG_NODIRECT;
1716 		} else if ((len == MSG_LD_NOENVCONFIG_SIZE) && (strncmp(s1,
1717 		    MSG_ORIG(MSG_LD_NOENVCONFIG),
1718 		    MSG_LD_NOENVCONFIG_SIZE) == 0)) {
1719 			select |= SEL_ACT_RT;
1720 			val = RT_FL_NOENVCFG;
1721 			variable = ENV_FLG_NOENVCONFIG;
1722 		} else if ((len == MSG_LD_NOFLTCONFIG_SIZE) && (strncmp(s1,
1723 		    MSG_ORIG(MSG_LD_NOFLTCONFIG),
1724 		    MSG_LD_NOFLTCONFIG_SIZE) == 0)) {
1725 			select |= SEL_ACT_RT2;
1726 			val = RT_FL2_NOFLTCFG;
1727 			variable = ENV_FLG_NOFLTCONFIG;
1728 		} else if ((len == MSG_LD_NOLAZY_SIZE) && (strncmp(s1,
1729 		    MSG_ORIG(MSG_LD_NOLAZY), MSG_LD_NOLAZY_SIZE) == 0)) {
1730 			select |= SEL_ACT_LMLT;
1731 			val = LML_TFLG_NOLAZYLD;
1732 			variable = ENV_FLG_NOLAZY;
1733 		} else if ((len == MSG_LD_NOOBJALTER_SIZE) && (strncmp(s1,
1734 		    MSG_ORIG(MSG_LD_NOOBJALTER),
1735 		    MSG_LD_NOOBJALTER_SIZE) == 0)) {
1736 			select |= SEL_ACT_RT;
1737 			val = RT_FL_NOOBJALT;
1738 			variable = ENV_FLG_NOOBJALTER;
1739 		} else if ((len == MSG_LD_NOVERSION_SIZE) && (strncmp(s1,
1740 		    MSG_ORIG(MSG_LD_NOVERSION), MSG_LD_NOVERSION_SIZE) == 0)) {
1741 			select |= SEL_ACT_RT;
1742 			val = RT_FL_NOVERSION;
1743 			variable = ENV_FLG_NOVERSION;
1744 		} else if ((len == MSG_LD_NOUNRESWEAK_SIZE) && (strncmp(s1,
1745 		    MSG_ORIG(MSG_LD_NOUNRESWEAK),
1746 		    MSG_LD_NOUNRESWEAK_SIZE) == 0)) {
1747 			/*
1748 			 * LD_NOUNRESWEAK (internal, used by ldd(1)).
1749 			 */
1750 			select |= SEL_ACT_LML;
1751 			val = LML_FLG_TRC_NOUNRESWEAK;
1752 			variable = ENV_FLG_NOUNRESWEAK;
1753 		} else if ((len == MSG_LD_NOPAREXT_SIZE) && (strncmp(s1,
1754 		    MSG_ORIG(MSG_LD_NOPAREXT), MSG_LD_NOPAREXT_SIZE) == 0)) {
1755 			select |= SEL_ACT_LML;
1756 			val = LML_FLG_TRC_NOPAREXT;
1757 			variable = ENV_FLG_NOPAREXT;
1758 		}
1759 	}
1760 	/*
1761 	 * LD_ORIGIN.
1762 	 */
1763 	else if (*s1 == 'O') {
1764 #ifndef	EXPAND_RELATIVE
1765 		if ((len == MSG_LD_ORIGIN_SIZE) && (strncmp(s1,
1766 		    MSG_ORIG(MSG_LD_ORIGIN), MSG_LD_ORIGIN_SIZE) == 0)) {
1767 			/*
1768 			 * Besides some old patches this is no longer required.
1769 			 */
1770 			rtld_flags |= RT_FL_RELATIVE;
1771 		}
1772 #endif
1773 		return;
1774 	}
1775 	/*
1776 	 * LD_PRELOAD and LD_PROFILE family.
1777 	 */
1778 	else if (*s1 == 'P') {
1779 		if ((len == MSG_LD_PRELOAD_SIZE) && (strncmp(s1,
1780 		    MSG_ORIG(MSG_LD_PRELOAD), MSG_LD_PRELOAD_SIZE) == 0)) {
1781 			select |= SEL_ACT_STR;
1782 			if (select & SEL_REPLACE)
1783 				str = &rpl_preload;
1784 			else  {
1785 				str = &prm_preload;
1786 				rpl_preload = 0;
1787 			}
1788 			variable = ENV_FLG_PRELOAD;
1789 		} else if ((len == MSG_LD_PROFILE_SIZE) && (strncmp(s1,
1790 		    MSG_ORIG(MSG_LD_PROFILE), MSG_LD_PROFILE_SIZE) == 0)) {
1791 			/*
1792 			 * Only one user library can be profiled at a time.
1793 			 */
1794 			select |= SEL_ACT_SPEC_2;
1795 			variable = ENV_FLG_PROFILE;
1796 		} else if ((len == MSG_LD_PROFILE_OUTPUT_SIZE) && (strncmp(s1,
1797 		    MSG_ORIG(MSG_LD_PROFILE_OUTPUT),
1798 		    MSG_LD_PROFILE_OUTPUT_SIZE) == 0)) {
1799 			/*
1800 			 * Only one user library can be profiled at a time.
1801 			 */
1802 			select |= SEL_ACT_STR;
1803 			str = &profile_out;
1804 			variable = ENV_FLG_PROFILE_OUTPUT;
1805 		}
1806 	}
1807 	/*
1808 	 * LD_SIGNAL.
1809 	 */
1810 	else if (*s1 == 'S') {
1811 		if (rtld_flags & RT_FL_SECURE)
1812 			return;
1813 		if ((len == MSG_LD_SIGNAL_SIZE) &&
1814 		    (strncmp(s1, MSG_ORIG(MSG_LD_SIGNAL),
1815 		    MSG_LD_SIGNAL_SIZE) == 0)) {
1816 			select |= SEL_ACT_SPEC_2;
1817 			variable = ENV_FLG_SIGNAL;
1818 		}
1819 	}
1820 	/*
1821 	 * The LD_TRACE family (internal, used by ldd(1)).  This definition is
1822 	 * the key to enabling all other ldd(1) specific environment variables.
1823 	 * In case an auditor is called, which in turn might exec(2) a
1824 	 * subprocess, this variable is disabled, so that any subprocess
1825 	 * escapes ldd(1) processing.
1826 	 */
1827 	else if (*s1 == 'T') {
1828 		if (((len == MSG_LD_TRACE_OBJS_SIZE) &&
1829 		    (strncmp(s1, MSG_ORIG(MSG_LD_TRACE_OBJS),
1830 		    MSG_LD_TRACE_OBJS_SIZE) == 0)) ||
1831 		    ((len == MSG_LD_TRACE_OBJS_E_SIZE) &&
1832 		    (((strncmp(s1, MSG_ORIG(MSG_LD_TRACE_OBJS_E),
1833 		    MSG_LD_TRACE_OBJS_E_SIZE) == 0) && !aout) ||
1834 		    ((strncmp(s1, MSG_ORIG(MSG_LD_TRACE_OBJS_A),
1835 		    MSG_LD_TRACE_OBJS_A_SIZE) == 0) && aout)))) {
1836 			char	*s0 = (char *)s1;
1837 
1838 			select |= SEL_ACT_SPEC_2;
1839 			variable = ENV_FLG_TRACE_OBJS;
1840 
1841 #if	defined(__sparc) || defined(__x86)
1842 			/*
1843 			 * The simplest way to "disable" this variable is to
1844 			 * truncate this string to "LD_'\0'". This string is
1845 			 * ignored by any ld.so.1 environment processing.
1846 			 * Use of such interfaces as unsetenv(3c) are overkill,
1847 			 * and would drag too much libc implementation detail
1848 			 * into ld.so.1.
1849 			 */
1850 			*s0 = '\0';
1851 #else
1852 /*
1853  * Verify that the above write is appropriate for any new platforms.
1854  */
1855 #error	unsupported architecture!
1856 #endif
1857 		} else if ((len == MSG_LD_TRACE_PTHS_SIZE) && (strncmp(s1,
1858 		    MSG_ORIG(MSG_LD_TRACE_PTHS),
1859 		    MSG_LD_TRACE_PTHS_SIZE) == 0)) {
1860 			select |= SEL_ACT_LML;
1861 			val = LML_FLG_TRC_SEARCH;
1862 			variable = ENV_FLG_TRACE_PTHS;
1863 		}
1864 	}
1865 	/*
1866 	 * LD_UNREF and LD_UNUSED (internal, used by ldd(1)).
1867 	 */
1868 	else if (*s1 == 'U') {
1869 		if ((len == MSG_LD_UNREF_SIZE) && (strncmp(s1,
1870 		    MSG_ORIG(MSG_LD_UNREF), MSG_LD_UNREF_SIZE) == 0)) {
1871 			select |= SEL_ACT_LML;
1872 			val = LML_FLG_TRC_UNREF;
1873 			variable = ENV_FLG_UNREF;
1874 		} else if ((len == MSG_LD_UNUSED_SIZE) && (strncmp(s1,
1875 		    MSG_ORIG(MSG_LD_UNUSED), MSG_LD_UNUSED_SIZE) == 0)) {
1876 			select |= SEL_ACT_LML;
1877 			val = LML_FLG_TRC_UNUSED;
1878 			variable = ENV_FLG_UNUSED;
1879 		}
1880 	}
1881 	/*
1882 	 * LD_VERBOSE (internal, used by ldd(1)).
1883 	 */
1884 	else if (*s1 == 'V') {
1885 		if ((len == MSG_LD_VERBOSE_SIZE) && (strncmp(s1,
1886 		    MSG_ORIG(MSG_LD_VERBOSE), MSG_LD_VERBOSE_SIZE) == 0)) {
1887 			select |= SEL_ACT_LML;
1888 			val = LML_FLG_TRC_VERBOSE;
1889 			variable = ENV_FLG_VERBOSE;
1890 		}
1891 	}
1892 	/*
1893 	 * LD_WARN (internal, used by ldd(1)).
1894 	 */
1895 	else if (*s1 == 'W') {
1896 		if ((len == MSG_LD_WARN_SIZE) && (strncmp(s1,
1897 		    MSG_ORIG(MSG_LD_WARN), MSG_LD_WARN_SIZE) == 0)) {
1898 			select |= SEL_ACT_LML;
1899 			val = LML_FLG_TRC_WARN;
1900 			variable = ENV_FLG_WARN;
1901 		}
1902 #ifdef	SIEBEL_DISABLE
1903 	}
1904 	/*
1905 	 * LD__FIX__ (undocumented, enable future technology that can't be
1906 	 * delivered in a patch release).
1907 	 */
1908 	else if (*s1 == '_') {
1909 		if ((len == MSG_LD_FIX_1_SIZE) && (strncmp(s1,
1910 		    MSG_ORIG(MSG_LD_FIX_1), MSG_LD_FIX_1_SIZE) == 0)) {
1911 			select |= SEL_ACT_RT;
1912 			val = RT_FL_DISFIX_1;
1913 			variable = ENV_FLG_FIX_1;
1914 		}
1915 #endif
1916 	}
1917 	if (variable == 0)
1918 		return;
1919 
1920 	/*
1921 	 * If the variable is already processed with ISA specific variable,
1922 	 * no further processing needed.
1923 	 */
1924 	if (((select & SEL_REPLACE) && (rplisa & variable)) ||
1925 	    ((select & SEL_PERMANT) && (prmisa & variable)))
1926 		return;
1927 
1928 	/*
1929 	 * Now mark the appropriate variables.
1930 	 * If the replaceable variable is already set, then the
1931 	 * process environment variable must be set. Any replaceable
1932 	 * variable specified in a configuration file can be ignored.
1933 	 */
1934 	if (env_flags & ENV_TYP_ISA) {
1935 		/*
1936 		 * This is ISA setting. We do the setting
1937 		 * even if s2 is NULL.
1938 		 * If s2 is NULL, we might need to undo
1939 		 * the setting.
1940 		 */
1941 		if (select & SEL_REPLACE) {
1942 			if (rplisa & variable)
1943 				return;
1944 			rplisa |= variable;
1945 		} else {
1946 			prmisa |= variable;
1947 		}
1948 	} else if (s2) {
1949 		/*
1950 		 * This is non0-ISA setting
1951 		 */
1952 		if (select & SEL_REPLACE) {
1953 			if (rplgen & variable)
1954 				return;
1955 			rplgen |= variable;
1956 		} else
1957 			prmgen |= variable;
1958 	} else
1959 		/*
1960 		 * This is non-ISA setting which
1961 		 * can be ignored.
1962 		 */
1963 		return;
1964 
1965 	/*
1966 	 * Now perform the setting.
1967 	 */
1968 	if (select & SEL_ACT_RT) {
1969 		if (s2)
1970 			rtld_flags |= val;
1971 		else
1972 			rtld_flags &= ~val;
1973 	} else if (select & SEL_ACT_RT2) {
1974 		if (s2)
1975 			rtld_flags2 |= val;
1976 		else
1977 			rtld_flags2 &= ~val;
1978 	} else if (select & SEL_ACT_STR)
1979 		*str = s2;
1980 	else if (select & SEL_ACT_LML) {
1981 		if (s2)
1982 			*lmflags |= val;
1983 		else
1984 			*lmflags &= ~val;
1985 	} else if (select & SEL_ACT_LMLT) {
1986 		if (s2)
1987 			*lmtflags |= val;
1988 		else
1989 			*lmtflags &= ~val;
1990 	} else if (select & SEL_ACT_SPEC_1) {
1991 		/*
1992 		 * variable is either ENV_FLG_FLAGS or ENV_FLG_LIBPATH
1993 		 */
1994 		*str = s2;
1995 		if ((select & SEL_REPLACE) && (env_flags & ENV_TYP_CONFIG)) {
1996 			if (s2) {
1997 				if (variable == ENV_FLG_FLAGS)
1998 					env_info |= ENV_INF_FLAGCFG;
1999 				else
2000 					env_info |= ENV_INF_PATHCFG;
2001 			} else {
2002 				if (variable == ENV_FLG_FLAGS)
2003 					env_info &= ~ENV_INF_FLAGCFG;
2004 				else
2005 					env_info &= ~ENV_INF_PATHCFG;
2006 			}
2007 		}
2008 	} else if (select & SEL_ACT_SPEC_2) {
2009 		/*
2010 		 * variables can be: ENV_FLG_
2011 		 * 	AUDIT_ARGS, BINDING, CONCURRENCY, CONFGEN,
2012 		 *	LOADFLTR, PROFILE, SIGNAL, TRACE_OBJS
2013 		 */
2014 		if (variable == ENV_FLG_AUDIT_ARGS) {
2015 			if (s2) {
2016 				audit_argcnt = atoi(s2);
2017 				audit_argcnt += audit_argcnt % 2;
2018 			} else
2019 				audit_argcnt = 0;
2020 		} else if (variable == ENV_FLG_BINDINGS) {
2021 			if (s2)
2022 				rpl_debug = MSG_ORIG(MSG_TKN_BINDINGS);
2023 			else
2024 				rpl_debug = 0;
2025 		} else if (variable == ENV_FLG_CONCURRENCY) {
2026 			if (s2)
2027 				rtld_flags &= ~RT_FL_NOCONCUR;
2028 			else
2029 				rtld_flags |= RT_FL_NOCONCUR;
2030 		} else if (variable == ENV_FLG_CONFGEN) {
2031 			if (s2) {
2032 				rtld_flags |= RT_FL_CONFGEN;
2033 				*lmflags |= LML_FLG_IGNRELERR;
2034 			} else {
2035 				rtld_flags &= ~RT_FL_CONFGEN;
2036 				*lmflags &= ~LML_FLG_IGNRELERR;
2037 			}
2038 		} else if (variable == ENV_FLG_LOADFLTR) {
2039 			if (s2) {
2040 				*lmtflags |= LML_TFLG_LOADFLTR;
2041 				if (*s2 == '2')
2042 					rtld_flags |= RT_FL_WARNFLTR;
2043 			} else {
2044 				*lmtflags &= ~LML_TFLG_LOADFLTR;
2045 				rtld_flags &= ~RT_FL_WARNFLTR;
2046 			}
2047 		} else if (variable == ENV_FLG_PROFILE) {
2048 			profile_name = s2;
2049 			if (s2) {
2050 				if (strcmp(s2, MSG_ORIG(MSG_FIL_RTLD)) == 0) {
2051 					return;
2052 				}
2053 				/* BEGIN CSTYLED */
2054 				if (rtld_flags & RT_FL_SECURE) {
2055 					profile_lib =
2056 #if	defined(_ELF64)
2057 					    MSG_ORIG(MSG_PTH_LDPROFSE_64);
2058 #else
2059 					    MSG_ORIG(MSG_PTH_LDPROFSE);
2060 #endif
2061 				} else {
2062 					profile_lib =
2063 #if	defined(_ELF64)
2064 					    MSG_ORIG(MSG_PTH_LDPROF_64);
2065 #else
2066 					    MSG_ORIG(MSG_PTH_LDPROF);
2067 #endif
2068 				}
2069 				/* END CSTYLED */
2070 			} else
2071 				profile_lib = 0;
2072 		} else if (variable == ENV_FLG_SIGNAL) {
2073 			killsig = s2 ? atoi(s2) : SIGKILL;
2074 		} else if (variable == ENV_FLG_TRACE_OBJS) {
2075 			if (s2) {
2076 				*lmflags |= LML_FLG_TRC_ENABLE;
2077 				if (*s2 == '2')
2078 					*lmflags |= LML_FLG_TRC_LDDSTUB;
2079 			} else
2080 				*lmflags &=
2081 				    ~(LML_FLG_TRC_ENABLE|LML_FLG_TRC_LDDSTUB);
2082 		}
2083 	}
2084 }
2085 
2086 /*
2087  * Determine whether we have an architecture specific environment variable.
2088  * If we do, and we're the wrong architecture, it'll just get ignored.
2089  * Otherwise the variable is processed in it's architecture neutral form.
2090  */
2091 static int
2092 ld_arch_env(const char *s1, size_t *len)
2093 {
2094 	size_t	_len = *len - 3;
2095 
2096 	if (s1[_len++] == '_') {
2097 		if ((s1[_len] == '3') && (s1[_len + 1] == '2')) {
2098 #if	defined(_ELF64)
2099 			return (ENV_TYP_IGNORE);
2100 #else
2101 			*len = *len - 3;
2102 			return (ENV_TYP_ISA);
2103 #endif
2104 		}
2105 		if ((s1[_len] == '6') && (s1[_len + 1] == '4')) {
2106 #if	defined(_ELF64)
2107 			*len = *len - 3;
2108 			return (ENV_TYP_ISA);
2109 #else
2110 			return (ENV_TYP_IGNORE);
2111 #endif
2112 		}
2113 	}
2114 	return (0);
2115 }
2116 
2117 
2118 /*
2119  * Process an LD_FLAGS environment variable.  The value can be a comma
2120  * separated set of tokens, which are sent (in upper case) into the generic
2121  * LD_XXXX environment variable engine.  For example:
2122  *
2123  *	LD_FLAGS=bind_now		->	LD_BIND_NOW=1
2124  *	LD_FLAGS=library_path=/foo:.	->	LD_LIBRARY_PATH=/foo:.
2125  *	LD_FLAGS=debug=files:detail	->	LD_DEBUG=files:detail
2126  * or
2127  *	LD_FLAGS=bind_now,library_path=/foo:.,debug=files:detail
2128  */
2129 static int
2130 ld_flags_env(const char *str, Word *lmflags, Word *lmtflags,
2131     uint_t env_flags, int aout)
2132 {
2133 	char	*nstr, *sstr, *estr = 0;
2134 	size_t	nlen, len;
2135 
2136 	if (str == 0)
2137 		return (0);
2138 
2139 	/*
2140 	 * Create a new string as we're going to transform the token(s) into
2141 	 * uppercase and separate tokens with nulls.
2142 	 */
2143 	len = strlen(str);
2144 	if ((nstr = malloc(len + 1)) == 0)
2145 		return (1);
2146 	(void) strcpy(nstr, str);
2147 
2148 	for (sstr = nstr; sstr; sstr++, len--) {
2149 		int	flags;
2150 
2151 		if ((*sstr != '\0') && (*sstr != ',')) {
2152 			if (estr == 0) {
2153 				if (*sstr == '=')
2154 					estr = sstr;
2155 				else {
2156 					/*
2157 					 * Translate token to uppercase.  Don't
2158 					 * use toupper(3C) as including this
2159 					 * code doubles the size of ld.so.1.
2160 					 */
2161 					if ((*sstr >= 'a') && (*sstr <= 'z'))
2162 						*sstr = *sstr - ('a' - 'A');
2163 				}
2164 			}
2165 			continue;
2166 		}
2167 
2168 		*sstr = '\0';
2169 		if (estr) {
2170 			nlen = estr - nstr;
2171 			if ((*++estr == '\0') || (*estr == ','))
2172 				estr = 0;
2173 		} else
2174 			nlen = sstr - nstr;
2175 
2176 		/*
2177 		 * Fabricate a boolean definition for any unqualified variable.
2178 		 * Thus LD_FLAGS=bind_now is represented as BIND_NOW=(null).
2179 		 * The value is sufficient to assert any boolean variables, plus
2180 		 * the term "(null)" is specifically chosen in case someone
2181 		 * mistakenly supplies something like LD_FLAGS=library_path.
2182 		 */
2183 		if (estr == 0)
2184 			estr = (char *)MSG_INTL(MSG_STR_NULL);
2185 
2186 		/*
2187 		 * Determine whether the environment variable is 32- or 64-bit
2188 		 * specific.  The length, len, will reflect the architecture
2189 		 * neutral portion of the string.
2190 		 */
2191 		if ((flags = ld_arch_env(nstr, &nlen)) != ENV_TYP_IGNORE) {
2192 			ld_generic_env(nstr, nlen, estr, lmflags,
2193 			    lmtflags, (env_flags | flags), aout);
2194 		}
2195 		if (len == 0)
2196 			return (0);
2197 
2198 		nstr = sstr + 1;
2199 		estr = 0;
2200 	}
2201 	return (0);
2202 }
2203 
2204 
2205 /*
2206  * Process a single environment string.  Only strings starting with `LD_' are
2207  * reserved for our use.  By convention, all strings should be of the form
2208  * `LD_XXXX=', if the string is followed by a non-null value the appropriate
2209  * functionality is enabled.  Also pick off applicable locale variables.
2210  */
2211 #define	LOC_LANG	1
2212 #define	LOC_MESG	2
2213 #define	LOC_ALL		3
2214 
2215 static void
2216 ld_str_env(const char *s1, Word *lmflags, Word *lmtflags, uint_t env_flags,
2217     int aout)
2218 {
2219 	const char	*s2;
2220 	static		size_t	loc = 0;
2221 
2222 	if (*s1++ != 'L')
2223 		return;
2224 
2225 	/*
2226 	 * See if we have any locale environment settings.  These environment
2227 	 * variables have a precedence, LC_ALL is higher than LC_MESSAGES which
2228 	 * is higher than LANG.
2229 	 */
2230 	s2 = s1;
2231 	if ((*s2++ == 'C') && (*s2++ == '_') && (*s2 != '\0')) {
2232 		if (strncmp(s2, MSG_ORIG(MSG_LC_ALL), MSG_LC_ALL_SIZE) == 0) {
2233 			s2 += MSG_LC_ALL_SIZE;
2234 			if ((*s2 != '\0') && (loc < LOC_ALL)) {
2235 				glcs[CI_LCMESSAGES].lc_un.lc_ptr = (char *)s2;
2236 				loc = LOC_ALL;
2237 			}
2238 		} else if (strncmp(s2, MSG_ORIG(MSG_LC_MESSAGES),
2239 		    MSG_LC_MESSAGES_SIZE) == 0) {
2240 			s2 += MSG_LC_MESSAGES_SIZE;
2241 			if ((*s2 != '\0') && (loc < LOC_MESG)) {
2242 				glcs[CI_LCMESSAGES].lc_un.lc_ptr = (char *)s2;
2243 				loc = LOC_MESG;
2244 			}
2245 		}
2246 		return;
2247 	}
2248 
2249 	s2 = s1;
2250 	if ((*s2++ == 'A') && (*s2++ == 'N') && (*s2++ == 'G') &&
2251 	    (*s2++ == '=') && (*s2 != '\0') && (loc < LOC_LANG)) {
2252 		glcs[CI_LCMESSAGES].lc_un.lc_ptr = (char *)s2;
2253 		loc = LOC_LANG;
2254 		return;
2255 	}
2256 
2257 	/*
2258 	 * Pick off any LD_XXXX environment variables.
2259 	 */
2260 	if ((*s1++ == 'D') && (*s1++ == '_') && (*s1 != '\0')) {
2261 		size_t	len;
2262 		int	flags;
2263 
2264 		/*
2265 		 * In a branded process we must ignore all LD_XXXX env vars
2266 		 * because they are intended for the brand's linker.
2267 		 * To affect the Solaris linker, use LD_BRAND_XXXX instead.
2268 		 */
2269 		if (rtld_flags2 & RT_FL2_BRANDED) {
2270 			if (strncmp(s1, MSG_ORIG(MSG_LD_BRAND_PREFIX),
2271 			    MSG_LD_BRAND_PREFIX_SIZE) != 0)
2272 				return;
2273 			s1 += MSG_LD_BRAND_PREFIX_SIZE;
2274 		}
2275 
2276 		/*
2277 		 * Environment variables with no value (ie. LD_XXXX=) typically
2278 		 * have no impact, however if environment variables are defined
2279 		 * within a configuration file, these null user settings can be
2280 		 * used to disable any configuration replaceable definitions.
2281 		 */
2282 		if ((s2 = strchr(s1, '=')) == 0) {
2283 			len = strlen(s1);
2284 			s2 = 0;
2285 		} else if (*++s2 == '\0') {
2286 			len = strlen(s1) - 1;
2287 			s2 = 0;
2288 		} else {
2289 			len = s2 - s1 - 1;
2290 			while (isspace(*s2))
2291 				s2++;
2292 		}
2293 
2294 		/*
2295 		 * Determine whether the environment variable is 32- or 64-bit
2296 		 * specific.  The length, len, will reflect the architecture
2297 		 * neutral portion of the string.
2298 		 */
2299 		if ((flags = ld_arch_env(s1, &len)) == ENV_TYP_IGNORE)
2300 			return;
2301 		env_flags |= flags;
2302 
2303 		ld_generic_env(s1, len, s2, lmflags, lmtflags, env_flags, aout);
2304 	}
2305 }
2306 
2307 /*
2308  * Internal getenv routine.  Called immediately after ld.so.1 initializes
2309  * itself.
2310  */
2311 int
2312 readenv_user(const char ** envp, Word *lmflags, Word *lmtflags, int aout)
2313 {
2314 	char	*locale;
2315 
2316 	if (envp == (const char **)0)
2317 		return (0);
2318 
2319 	while (*envp != (const char *)0)
2320 		ld_str_env(*envp++, lmflags, lmtflags, 0, aout);
2321 
2322 	/*
2323 	 * Having collected the best representation of any LD_FLAGS, process
2324 	 * these strings.
2325 	 */
2326 	if (ld_flags_env(rpl_ldflags, lmflags, lmtflags, 0, aout) == 1)
2327 		return (1);
2328 
2329 	/*
2330 	 * Don't allow environment controlled auditing when tracing or if
2331 	 * explicitly disabled.  Trigger all tracing modes from
2332 	 * LML_FLG_TRC_ENABLE.
2333 	 */
2334 	if ((*lmflags & LML_FLG_TRC_ENABLE) || (rtld_flags & RT_FL_NOAUDIT))
2335 		rpl_audit = profile_lib = profile_name = 0;
2336 	if ((*lmflags & LML_FLG_TRC_ENABLE) == 0)
2337 		*lmflags &= ~LML_MSK_TRC;
2338 
2339 	/*
2340 	 * If both LD_BIND_NOW and LD_BIND_LAZY are specified, the former wins.
2341 	 */
2342 	if ((rtld_flags2 & (RT_FL2_BINDNOW | RT_FL2_BINDLAZY)) ==
2343 	    (RT_FL2_BINDNOW | RT_FL2_BINDLAZY))
2344 		rtld_flags2 &= ~RT_FL2_BINDLAZY;
2345 
2346 	/*
2347 	 * When using ldd(1) -r or -d against an executable, assert -p.
2348 	 */
2349 	if ((*lmflags &
2350 	    (LML_FLG_TRC_WARN | LML_FLG_TRC_LDDSTUB)) == LML_FLG_TRC_WARN)
2351 		*lmflags |= LML_FLG_TRC_NOPAREXT;
2352 
2353 	/*
2354 	 * If we have a locale setting make sure its worth processing further.
2355 	 * C and POSIX locales don't need any processing.  In addition, to
2356 	 * ensure no one escapes the /usr/lib/locale hierarchy, don't allow
2357 	 * the locale to contain a segment that leads upward in the file system
2358 	 * hierarchy (i.e. no '..' segments).   Given that we'll be confined to
2359 	 * the /usr/lib/locale hierarchy, there is no need to extensively
2360 	 * validate the mode or ownership of any message file (as libc's
2361 	 * generic handling of message files does).  Duplicate the string so
2362 	 * that new locale setting can generically cleanup any previous locales.
2363 	 */
2364 	if ((locale = glcs[CI_LCMESSAGES].lc_un.lc_ptr) != 0) {
2365 		if (((*locale == 'C') && (*(locale + 1) == '\0')) ||
2366 		    (strcmp(locale, MSG_ORIG(MSG_TKN_POSIX)) == 0) ||
2367 		    (strstr(locale, MSG_ORIG(MSG_TKN_DOTDOT)) != NULL))
2368 			glcs[CI_LCMESSAGES].lc_un.lc_ptr = 0;
2369 		else
2370 			glcs[CI_LCMESSAGES].lc_un.lc_ptr = strdup(locale);
2371 	}
2372 	return (0);
2373 }
2374 
2375 /*
2376  * Configuration environment processing.  Called after the a.out has been
2377  * processed (as the a.out can specify its own configuration file).
2378  */
2379 int
2380 readenv_config(Rtc_env * envtbl, Addr addr, int aout)
2381 {
2382 	Word	*lmflags = &(lml_main.lm_flags);
2383 	Word	*lmtflags = &(lml_main.lm_tflags);
2384 
2385 	if (envtbl == (Rtc_env *)0)
2386 		return (0);
2387 
2388 	while (envtbl->env_str) {
2389 		uint_t	env_flags = ENV_TYP_CONFIG;
2390 
2391 		if (envtbl->env_flags & RTC_ENV_PERMANT)
2392 			env_flags |= ENV_TYP_PERMANT;
2393 
2394 		ld_str_env((const char *)(envtbl->env_str + addr),
2395 		    lmflags, lmtflags, env_flags, 0);
2396 		envtbl++;
2397 	}
2398 
2399 	/*
2400 	 * Having collected the best representation of any LD_FLAGS, process
2401 	 * these strings.
2402 	 */
2403 	if (ld_flags_env(rpl_ldflags, lmflags, lmtflags, 0, aout) == 1)
2404 		return (1);
2405 	if (ld_flags_env(prm_ldflags, lmflags, lmtflags, ENV_TYP_CONFIG,
2406 	    aout) == 1)
2407 		return (1);
2408 
2409 	/*
2410 	 * Don't allow environment controlled auditing when tracing or if
2411 	 * explicitly disabled.  Trigger all tracing modes from
2412 	 * LML_FLG_TRC_ENABLE.
2413 	 */
2414 	if ((*lmflags & LML_FLG_TRC_ENABLE) || (rtld_flags & RT_FL_NOAUDIT))
2415 		prm_audit = profile_lib = profile_name = 0;
2416 	if ((*lmflags & LML_FLG_TRC_ENABLE) == 0)
2417 		*lmflags &= ~LML_MSK_TRC;
2418 
2419 	return (0);
2420 }
2421 
2422 int
2423 dowrite(Prfbuf * prf)
2424 {
2425 	/*
2426 	 * We do not have a valid file descriptor, so we are unable
2427 	 * to flush the buffer.
2428 	 */
2429 	if (prf->pr_fd == -1)
2430 		return (0);
2431 	(void) write(prf->pr_fd, prf->pr_buf, prf->pr_cur - prf->pr_buf);
2432 	prf->pr_cur = prf->pr_buf;
2433 	return (1);
2434 }
2435 
2436 /*
2437  * Simplified printing.  The following conversion specifications are supported:
2438  *
2439  *	% [#] [-] [min field width] [. precision] s|d|x|c
2440  *
2441  *
2442  * dorprf takes the output buffer in the form of Prfbuf which permits
2443  * the verification of the output buffer size and the concatenation
2444  * of data to an already existing output buffer.  The Prfbuf
2445  * structure contains the following:
2446  *
2447  *  pr_buf	pointer to the beginning of the output buffer.
2448  *  pr_cur	pointer to the next available byte in the output buffer.  By
2449  *		setting pr_cur ahead of pr_buf you can append to an already
2450  *		existing buffer.
2451  *  pr_len	the size of the output buffer.  By setting pr_len to '0' you
2452  *		disable protection from overflows in the output buffer.
2453  *  pr_fd	a pointer to the file-descriptor the buffer will eventually be
2454  *		output to.  If pr_fd is set to '-1' then it's assumed there is
2455  *		no output buffer, and doprf() will return with an error to
2456  *		indicate an output buffer overflow.  If pr_fd is > -1 then when
2457  *		the output buffer is filled it will be flushed to pr_fd and will
2458  *		then be	available for additional data.
2459  */
2460 #define	FLG_UT_MINUS	0x0001	/* - */
2461 #define	FLG_UT_SHARP	0x0002	/* # */
2462 #define	FLG_UT_DOTSEEN	0x0008	/* dot appeared in format spec */
2463 
2464 /*
2465  * This macro is for use from within doprf only.  It is to be used for checking
2466  * the output buffer size and placing characters into the buffer.
2467  */
2468 #define	PUTC(c) \
2469 	{ \
2470 		char tmpc; \
2471 		\
2472 		tmpc = (c); \
2473 		if (bufsiz && (bp >= bufend)) { \
2474 			prf->pr_cur = bp; \
2475 			if (dowrite(prf) == 0) \
2476 				return (0); \
2477 			bp = prf->pr_cur; \
2478 		} \
2479 		*bp++ = tmpc; \
2480 	}
2481 
2482 /*
2483  * Define a local buffer size for building a numeric value - large enough to
2484  * hold a 64-bit value.
2485  */
2486 #define	NUM_SIZE	22
2487 
2488 size_t
2489 doprf(const char *format, va_list args, Prfbuf *prf)
2490 {
2491 	char	c;
2492 	char	*bp = prf->pr_cur;
2493 	char	*bufend = prf->pr_buf + prf->pr_len;
2494 	size_t	bufsiz = prf->pr_len;
2495 
2496 	while ((c = *format++) != '\0') {
2497 		if (c != '%') {
2498 			PUTC(c);
2499 		} else {
2500 			int	base = 0, flag = 0, width = 0, prec = 0;
2501 			size_t	_i;
2502 			int	_c, _n;
2503 			char	*_s;
2504 			int	ls = 0;
2505 again:
2506 			c = *format++;
2507 			switch (c) {
2508 			case '-':
2509 				flag |= FLG_UT_MINUS;
2510 				goto again;
2511 			case '#':
2512 				flag |= FLG_UT_SHARP;
2513 				goto again;
2514 			case '.':
2515 				flag |= FLG_UT_DOTSEEN;
2516 				goto again;
2517 			case '0':
2518 			case '1':
2519 			case '2':
2520 			case '3':
2521 			case '4':
2522 			case '5':
2523 			case '6':
2524 			case '7':
2525 			case '8':
2526 			case '9':
2527 				if (flag & FLG_UT_DOTSEEN)
2528 					prec = (prec * 10) + c - '0';
2529 				else
2530 					width = (width * 10) + c - '0';
2531 				goto again;
2532 			case 'x':
2533 			case 'X':
2534 				base = 16;
2535 				break;
2536 			case 'd':
2537 			case 'D':
2538 			case 'u':
2539 				base = 10;
2540 				flag &= ~FLG_UT_SHARP;
2541 				break;
2542 			case 'l':
2543 				base = 10;
2544 				ls++; /* number of l's (long or long long) */
2545 				if ((*format == 'l') ||
2546 				    (*format == 'd') || (*format == 'D') ||
2547 				    (*format == 'x') || (*format == 'X') ||
2548 				    (*format == 'o') || (*format == 'O'))
2549 					goto again;
2550 				break;
2551 			case 'o':
2552 			case 'O':
2553 				base = 8;
2554 				break;
2555 			case 'c':
2556 				_c = va_arg(args, int);
2557 
2558 				for (_i = 24; _i > 0; _i -= 8) {
2559 					if ((c = ((_c >> _i) & 0x7f)) != 0) {
2560 						PUTC(c);
2561 					}
2562 				}
2563 				if ((c = ((_c >> _i) & 0x7f)) != 0) {
2564 					PUTC(c);
2565 				}
2566 				break;
2567 			case 's':
2568 				_s = va_arg(args, char *);
2569 				_i = strlen(_s);
2570 				/* LINTED */
2571 				_n = (int)(width - _i);
2572 				if (!prec)
2573 					/* LINTED */
2574 					prec = (int)_i;
2575 
2576 				if (width && !(flag & FLG_UT_MINUS)) {
2577 					while (_n-- > 0)
2578 						PUTC(' ');
2579 				}
2580 				while (((c = *_s++) != 0) && prec--) {
2581 					PUTC(c);
2582 				}
2583 				if (width && (flag & FLG_UT_MINUS)) {
2584 					while (_n-- > 0)
2585 						PUTC(' ');
2586 				}
2587 				break;
2588 			case '%':
2589 				PUTC('%');
2590 				break;
2591 			default:
2592 				break;
2593 			}
2594 
2595 			/*
2596 			 * Numeric processing
2597 			 */
2598 			if (base) {
2599 				char		local[NUM_SIZE];
2600 				size_t		ssize = 0, psize = 0;
2601 				const char	*string =
2602 				    MSG_ORIG(MSG_STR_HEXNUM);
2603 				const char	*prefix =
2604 				    MSG_ORIG(MSG_STR_EMPTY);
2605 				u_longlong_t	num;
2606 
2607 				switch (ls) {
2608 				case 0:	/* int */
2609 					num = (u_longlong_t)
2610 					    va_arg(args, uint_t);
2611 					break;
2612 				case 1:	/* long */
2613 					num = (u_longlong_t)
2614 					    va_arg(args, ulong_t);
2615 					break;
2616 				case 2:	/* long long */
2617 					num = va_arg(args, u_longlong_t);
2618 					break;
2619 				}
2620 
2621 				if (flag & FLG_UT_SHARP) {
2622 					if (base == 16) {
2623 						prefix = MSG_ORIG(MSG_STR_HEX);
2624 						psize = 2;
2625 					} else {
2626 						prefix = MSG_ORIG(MSG_STR_ZERO);
2627 						psize = 1;
2628 					}
2629 				}
2630 				if ((base == 10) && (long)num < 0) {
2631 					prefix = MSG_ORIG(MSG_STR_NEGATE);
2632 					psize = MSG_STR_NEGATE_SIZE;
2633 					num = (u_longlong_t)(-(longlong_t)num);
2634 				}
2635 
2636 				/*
2637 				 * Convert the numeric value into a local
2638 				 * string (stored in reverse order).
2639 				 */
2640 				_s = local;
2641 				do {
2642 					*_s++ = string[num % base];
2643 					num /= base;
2644 					ssize++;
2645 				} while (num);
2646 
2647 				ASSERT(ssize < sizeof (local));
2648 
2649 				/*
2650 				 * Provide any precision or width padding.
2651 				 */
2652 				if (prec) {
2653 					/* LINTED */
2654 					_n = (int)(prec - ssize);
2655 					while ((_n-- > 0) &&
2656 					    (ssize < sizeof (local))) {
2657 						*_s++ = '0';
2658 						ssize++;
2659 					}
2660 				}
2661 				if (width && !(flag & FLG_UT_MINUS)) {
2662 					/* LINTED */
2663 					_n = (int)(width - ssize - psize);
2664 					while (_n-- > 0) {
2665 						PUTC(' ');
2666 					}
2667 				}
2668 
2669 				/*
2670 				 * Print any prefix and the numeric string
2671 				 */
2672 				while (*prefix)
2673 					PUTC(*prefix++);
2674 				do {
2675 					PUTC(*--_s);
2676 				} while (_s > local);
2677 
2678 				/*
2679 				 * Provide any width padding.
2680 				 */
2681 				if (width && (flag & FLG_UT_MINUS)) {
2682 					/* LINTED */
2683 					_n = (int)(width - ssize - psize);
2684 					while (_n-- > 0)
2685 						PUTC(' ');
2686 				}
2687 			}
2688 		}
2689 	}
2690 
2691 	PUTC('\0');
2692 	prf->pr_cur = bp;
2693 	return (1);
2694 }
2695 
2696 static int
2697 doprintf(const char *format, va_list args, Prfbuf *prf)
2698 {
2699 	char	*ocur = prf->pr_cur;
2700 
2701 	if (doprf(format, args, prf) == 0)
2702 		return (0);
2703 	/* LINTED */
2704 	return ((int)(prf->pr_cur - ocur));
2705 }
2706 
2707 /* VARARGS2 */
2708 int
2709 sprintf(char *buf, const char *format, ...)
2710 {
2711 	va_list	args;
2712 	int	len;
2713 	Prfbuf	prf;
2714 
2715 	va_start(args, format);
2716 	prf.pr_buf = prf.pr_cur = buf;
2717 	prf.pr_len = 0;
2718 	prf.pr_fd = -1;
2719 	len = doprintf(format, args, &prf);
2720 	va_end(args);
2721 
2722 	/*
2723 	 * sprintf() return value excludes the terminating null byte.
2724 	 */
2725 	return (len - 1);
2726 }
2727 
2728 /* VARARGS3 */
2729 int
2730 snprintf(char *buf, size_t n, const char *format, ...)
2731 {
2732 	va_list	args;
2733 	int	len;
2734 	Prfbuf	prf;
2735 
2736 	va_start(args, format);
2737 	prf.pr_buf = prf.pr_cur = buf;
2738 	prf.pr_len = n;
2739 	prf.pr_fd = -1;
2740 	len = doprintf(format, args, &prf);
2741 	va_end(args);
2742 
2743 	return (len);
2744 }
2745 
2746 /* VARARGS2 */
2747 int
2748 bufprint(Prfbuf *prf, const char *format, ...)
2749 {
2750 	va_list	args;
2751 	int	len;
2752 
2753 	va_start(args, format);
2754 	len = doprintf(format, args, prf);
2755 	va_end(args);
2756 
2757 	return (len);
2758 }
2759 
2760 /*PRINTFLIKE1*/
2761 int
2762 printf(const char *format, ...)
2763 {
2764 	va_list	args;
2765 	char 	buffer[ERRSIZE];
2766 	Prfbuf	prf;
2767 
2768 	va_start(args, format);
2769 	prf.pr_buf = prf.pr_cur = buffer;
2770 	prf.pr_len = ERRSIZE;
2771 	prf.pr_fd = 1;
2772 	(void) doprf(format, args, &prf);
2773 	va_end(args);
2774 	/*
2775 	 * Trim trailing '\0' form buffer
2776 	 */
2777 	prf.pr_cur--;
2778 	return (dowrite(&prf));
2779 }
2780 
2781 static char	errbuf[ERRSIZE], *nextptr = errbuf, *prevptr = 0;
2782 
2783 /*PRINTFLIKE3*/
2784 void
2785 eprintf(Lm_list *lml, Error error, const char *format, ...)
2786 {
2787 	va_list		args;
2788 	int		overflow = 0;
2789 	static int	lock = 0;
2790 	Prfbuf		prf;
2791 
2792 	if (lock || (nextptr == (errbuf + ERRSIZE)))
2793 		return;
2794 
2795 	/*
2796 	 * Note: this lock is here to prevent the same thread from recursively
2797 	 * entering itself during a eprintf.  ie: during eprintf malloc() fails
2798 	 * and we try and call eprintf ... and then malloc() fails ....
2799 	 */
2800 	lock = 1;
2801 
2802 	/*
2803 	 * If we have completed startup initialization, all error messages
2804 	 * must be saved.  These are reported through dlerror().  If we're
2805 	 * still in the initialization stage, output the error directly and
2806 	 * add a newline.
2807 	 */
2808 	va_start(args, format);
2809 
2810 	prf.pr_buf = prf.pr_cur = nextptr;
2811 	prf.pr_len = ERRSIZE - (nextptr - errbuf);
2812 
2813 	if (!(rtld_flags & RT_FL_APPLIC))
2814 		prf.pr_fd = 2;
2815 	else
2816 		prf.pr_fd = -1;
2817 
2818 	if (error > ERR_NONE) {
2819 		if ((error == ERR_FATAL) && (rtld_flags2 & RT_FL2_FTL2WARN))
2820 			error = ERR_WARNING;
2821 		if (error == ERR_WARNING) {
2822 			if (err_strs[ERR_WARNING] == 0)
2823 				err_strs[ERR_WARNING] =
2824 				    MSG_INTL(MSG_ERR_WARNING);
2825 		} else if (error == ERR_FATAL) {
2826 			if (err_strs[ERR_FATAL] == 0)
2827 				err_strs[ERR_FATAL] = MSG_INTL(MSG_ERR_FATAL);
2828 		} else if (error == ERR_ELF) {
2829 			if (err_strs[ERR_ELF] == 0)
2830 				err_strs[ERR_ELF] = MSG_INTL(MSG_ERR_ELF);
2831 		}
2832 		if (procname) {
2833 			if (bufprint(&prf, MSG_ORIG(MSG_STR_EMSGFOR1),
2834 			    rtldname, procname, err_strs[error]) == 0)
2835 				overflow = 1;
2836 		} else {
2837 			if (bufprint(&prf, MSG_ORIG(MSG_STR_EMSGFOR2),
2838 			    rtldname, err_strs[error]) == 0)
2839 				overflow = 1;
2840 		}
2841 		if (overflow == 0) {
2842 			/*
2843 			 * Remove the terminating '\0'.
2844 			 */
2845 			prf.pr_cur--;
2846 		}
2847 	}
2848 
2849 	if ((overflow == 0) && doprf(format, args, &prf) == 0)
2850 		overflow = 1;
2851 
2852 	/*
2853 	 * If this is an ELF error, it will have been generated by a support
2854 	 * object that has a dependency on libelf.  ld.so.1 doesn't generate any
2855 	 * ELF error messages as it doesn't interact with libelf.  Determine the
2856 	 * ELF error string.
2857 	 */
2858 	if ((overflow == 0) && (error == ERR_ELF)) {
2859 		static int		(*elfeno)() = 0;
2860 		static const char	*(*elfemg)();
2861 		const char		*emsg;
2862 		Rt_map			*dlmp, *lmp = lml_rtld.lm_head;
2863 
2864 		if (NEXT(lmp) && (elfeno == 0)) {
2865 			if (((elfemg = (const char *(*)())dlsym_intn(RTLD_NEXT,
2866 			    MSG_ORIG(MSG_SYM_ELFERRMSG), lmp, &dlmp)) == 0) ||
2867 			    ((elfeno = (int (*)())dlsym_intn(RTLD_NEXT,
2868 			    MSG_ORIG(MSG_SYM_ELFERRNO), lmp, &dlmp)) == 0))
2869 				elfeno = 0;
2870 		}
2871 
2872 		/*
2873 		 * Lookup the message; equivalent to elf_errmsg(elf_errno()).
2874 		 */
2875 		if (elfeno && ((emsg = (* elfemg)((* elfeno)())) != 0)) {
2876 			prf.pr_cur--;
2877 			if (bufprint(&prf, MSG_ORIG(MSG_STR_EMSGFOR2),
2878 			    emsg) == 0)
2879 				overflow = 1;
2880 		}
2881 	}
2882 
2883 	/*
2884 	 * Push out any message that's been built.  Note, in the case of an
2885 	 * overflow condition, this message may be incomplete, in which case
2886 	 * make sure any partial string is null terminated.
2887 	 */
2888 	if (overflow)
2889 		*(prf.pr_cur) = '\0';
2890 	if ((rtld_flags & (RT_FL_APPLIC | RT_FL_SILENCERR)) == 0) {
2891 		*(prf.pr_cur - 1) = '\n';
2892 		(void) dowrite(&prf);
2893 	}
2894 
2895 	DBG_CALL(Dbg_util_str(lml, nextptr));
2896 	va_end(args);
2897 
2898 	/*
2899 	 * Determine if there was insufficient space left in the buffer to
2900 	 * complete the message.  If so, we'll have printed out as much as had
2901 	 * been processed if we're not yet executing the application.
2902 	 * Otherwise, there will be some debugging diagnostic indicating
2903 	 * as much of the error message as possible.  Write out a final buffer
2904 	 * overflow diagnostic - unlocalized, so we don't chance more errors.
2905 	 */
2906 	if (overflow) {
2907 		char	*str = (char *)MSG_INTL(MSG_EMG_BUFOVRFLW);
2908 
2909 		if ((rtld_flags & RT_FL_SILENCERR) == 0) {
2910 			lasterr = str;
2911 
2912 			if ((rtld_flags & RT_FL_APPLIC) == 0) {
2913 				(void) write(2, str, strlen(str));
2914 				(void) write(2, MSG_ORIG(MSG_STR_NL),
2915 				    MSG_STR_NL_SIZE);
2916 			}
2917 		}
2918 		DBG_CALL(Dbg_util_str(lml, str));
2919 
2920 		lock = 0;
2921 		nextptr = errbuf + ERRSIZE;
2922 		return;
2923 	}
2924 
2925 	/*
2926 	 * If the application has started, then error messages are being saved
2927 	 * for retrieval by dlerror(), or possible flushing from rtldexit() in
2928 	 * the case of a fatal error.  In this case, establish the next error
2929 	 * pointer.  If we haven't started the application, the whole message
2930 	 * buffer can be reused.
2931 	 */
2932 	if ((rtld_flags & RT_FL_SILENCERR) == 0) {
2933 		lasterr = nextptr;
2934 
2935 		/*
2936 		 * Note, should we encounter an error such as ENOMEM, there may
2937 		 * be a number of the same error messages (ie. an operation
2938 		 * fails with ENOMEM, and then the attempts to construct the
2939 		 * error message itself, which incurs additional ENOMEM errors).
2940 		 * Compare any previous error message with the one we've just
2941 		 * created to prevent any duplication clutter.
2942 		 */
2943 		if ((rtld_flags & RT_FL_APPLIC) &&
2944 		    ((prevptr == 0) || (strcmp(prevptr, nextptr) != 0))) {
2945 			prevptr = nextptr;
2946 			nextptr = prf.pr_cur;
2947 			*nextptr = '\0';
2948 		}
2949 	}
2950 	lock = 0;
2951 }
2952 
2953 
2954 #if	DEBUG
2955 /*
2956  * Provide assfail() for ASSERT() statements,
2957  * see <sys/debug.h> for further details.
2958  */
2959 int
2960 assfail(const char *a, const char *f, int l)
2961 {
2962 	(void) printf("assertion failed: %s, file: %s, line: %d\n", a, f, l);
2963 	(void) _lwp_kill(_lwp_self(), SIGABRT);
2964 	return (0);
2965 }
2966 #endif
2967 
2968 /*
2969  * Exit.  If we arrive here with a non zero status it's because of a fatal
2970  * error condition (most commonly a relocation error).  If the application has
2971  * already had control, then the actual fatal error message will have been
2972  * recorded in the dlerror() message buffer.  Print the message before really
2973  * exiting.
2974  */
2975 void
2976 rtldexit(Lm_list * lml, int status)
2977 {
2978 	if (status) {
2979 		if (rtld_flags & RT_FL_APPLIC) {
2980 			/*
2981 			 * If the error buffer has been used, write out all
2982 			 * pending messages - lasterr is simply a pointer to
2983 			 * the last message in this buffer.  However, if the
2984 			 * buffer couldn't be created at all, lasterr points
2985 			 * to a constant error message string.
2986 			 */
2987 			if (*errbuf) {
2988 				char	*errptr = errbuf;
2989 				char	*errend = errbuf + ERRSIZE;
2990 
2991 				while ((errptr < errend) && *errptr) {
2992 					size_t	size = strlen(errptr);
2993 					(void) write(2, errptr, size);
2994 					(void) write(2, MSG_ORIG(MSG_STR_NL),
2995 					    MSG_STR_NL_SIZE);
2996 					errptr += (size + 1);
2997 				}
2998 			}
2999 			if (lasterr && ((lasterr < errbuf) ||
3000 			    (lasterr > (errbuf + ERRSIZE)))) {
3001 				(void) write(2, lasterr, strlen(lasterr));
3002 				(void) write(2, MSG_ORIG(MSG_STR_NL),
3003 				    MSG_STR_NL_SIZE);
3004 			}
3005 		}
3006 		leave(lml, 0);
3007 		(void) _lwp_kill(_lwp_self(), killsig);
3008 	}
3009 	_exit(status);
3010 }
3011 
3012 /*
3013  * Routines to co-ordinate the opening of /dev/zero and /proc.
3014  * dz_fd is exported for possible use by libld.so, and to insure it gets
3015  * closed on leaving ld.so.1.
3016  */
3017 int	dz_fd = FD_UNAVAIL;
3018 
3019 void
3020 dz_init(int fd)
3021 {
3022 	dz_fd = fd;
3023 }
3024 
3025 
3026 /*
3027  * mmap() a page from MAP_ANON
3028  *
3029  * Note: MAP_ANON is only on Solaris8++, we use this routine to
3030  *       not only mmap(MAP_ANON) but to also probe if it is available
3031  *	 on the current OS.
3032  */
3033 Am_ret
3034 anon_map(Lm_list *lml, caddr_t *addr, size_t len, int prot, int flags)
3035 {
3036 #if defined(MAP_ANON)
3037 	static int	noanon = 0;
3038 	caddr_t		va;
3039 
3040 	if (noanon == 0) {
3041 		if ((va = (caddr_t)mmap(*addr, len, prot,
3042 		    (flags | MAP_ANON), -1, 0)) != MAP_FAILED) {
3043 			*addr = va;
3044 			return (AM_OK);
3045 		}
3046 
3047 		if ((errno != EBADF) && (errno != EINVAL)) {
3048 			int	err = errno;
3049 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_MMAPANON),
3050 			    MSG_ORIG(MSG_PTH_DEVZERO), strerror(err));
3051 			return (AM_ERROR);
3052 		} else
3053 			noanon = 1;
3054 	}
3055 #endif
3056 	return (AM_NOSUP);
3057 }
3058 
3059 /*
3060  * Map anonymous memory from /dev/zero, or via MAP_ANON.
3061  *
3062  * (MAP_ANON only appears on Solaris 8, so we need fall-back
3063  * behavior for older systems.)
3064  */
3065 caddr_t
3066 dz_map(Lm_list *lml, caddr_t addr, size_t len, int prot, int flags)
3067 {
3068 	caddr_t	va;
3069 	int	err;
3070 	Am_ret	amret;
3071 
3072 	amret = anon_map(lml, &addr, len, prot, flags);
3073 
3074 	if (amret == AM_OK)
3075 		return (addr);
3076 	if (amret == AM_ERROR)
3077 		return (MAP_FAILED);
3078 
3079 	/* amret == AM_NOSUP -> fallback to a devzero mmaping */
3080 
3081 	if (dz_fd == FD_UNAVAIL) {
3082 		if ((dz_fd = open(MSG_ORIG(MSG_PTH_DEVZERO),
3083 		    O_RDONLY)) == FD_UNAVAIL) {
3084 			err = errno;
3085 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN),
3086 			    MSG_ORIG(MSG_PTH_DEVZERO), strerror(err));
3087 			return (MAP_FAILED);
3088 		}
3089 	}
3090 
3091 	if ((va = mmap(addr, len, prot, flags, dz_fd, 0)) == MAP_FAILED) {
3092 		err = errno;
3093 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_MMAP),
3094 		    MSG_ORIG(MSG_PTH_DEVZERO), strerror(err));
3095 	}
3096 	return (va);
3097 }
3098 
3099 static int	pr_fd = FD_UNAVAIL;
3100 
3101 int
3102 pr_open(Lm_list *lml)
3103 {
3104 	char	proc[16];
3105 
3106 	if (pr_fd == FD_UNAVAIL) {
3107 		(void) snprintf(proc, 16, MSG_ORIG(MSG_FMT_PROC),
3108 		    (int)getpid());
3109 		if ((pr_fd = open(proc, O_RDONLY)) == FD_UNAVAIL) {
3110 			int	err = errno;
3111 
3112 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN), proc,
3113 			    strerror(err));
3114 		}
3115 	}
3116 	return (pr_fd);
3117 }
3118 
3119 static int	nu_fd = FD_UNAVAIL;
3120 
3121 caddr_t
3122 nu_map(Lm_list *lml, caddr_t addr, size_t len, int prot, int flags)
3123 {
3124 	caddr_t	va;
3125 	int	err;
3126 
3127 	if (nu_fd == FD_UNAVAIL) {
3128 		if ((nu_fd = open(MSG_ORIG(MSG_PTH_DEVNULL),
3129 		    O_RDONLY)) == FD_UNAVAIL) {
3130 			err = errno;
3131 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN),
3132 			    MSG_ORIG(MSG_PTH_DEVNULL), strerror(err));
3133 			return (MAP_FAILED);
3134 		}
3135 	}
3136 
3137 	if ((va = (caddr_t)mmap(addr, len, prot, flags, nu_fd, 0)) ==
3138 	    MAP_FAILED) {
3139 		err = errno;
3140 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_MMAP),
3141 		    MSG_ORIG(MSG_PTH_DEVNULL), strerror(err));
3142 	}
3143 	return (va);
3144 }
3145 
3146 /*
3147  * Generic entry point from user code - simply grabs a lock, and bumps the
3148  * entrance count.
3149  */
3150 int
3151 enter(int flags)
3152 {
3153 	if (rt_bind_guard(THR_FLG_RTLD | thr_flg_nolock | flags)) {
3154 		if (!thr_flg_nolock)
3155 			(void) rt_mutex_lock(&rtldlock);
3156 		if (rtld_flags & RT_FL_OPERATION)
3157 			ld_entry_cnt++;
3158 		return (1);
3159 	}
3160 	return (0);
3161 }
3162 
3163 /*
3164  * Determine whether a search path has been used.
3165  */
3166 static void
3167 is_path_used(Lm_list *lml, Word unref, int *nl, Pnode *pnp, const char *obj)
3168 {
3169 	for (; pnp; pnp = pnp->p_next) {
3170 		const char	*fmt, *name;
3171 
3172 		if ((pnp->p_len == 0) || (pnp->p_orig & PN_FLG_USED))
3173 			continue;
3174 
3175 		/*
3176 		 * If this pathname originated from an expanded token, use the
3177 		 * original for any diagnostic output.
3178 		 */
3179 		if ((name = pnp->p_oname) == 0)
3180 			name = pnp->p_name;
3181 
3182 		if (unref == 0) {
3183 			if ((*nl)++ == 0)
3184 				DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
3185 			DBG_CALL(Dbg_unused_path(lml, name, pnp->p_orig,
3186 			    (pnp->p_orig & PN_FLG_DUPLICAT), obj));
3187 			continue;
3188 		}
3189 
3190 		/*
3191 		 * For now, disable any unused search path processing that has
3192 		 * been triggered for ldd(1).
3193 		 */
3194 		if (unref)
3195 			continue;
3196 
3197 		if (pnp->p_orig & LA_SER_LIBPATH) {
3198 			if (pnp->p_orig & LA_SER_CONFIG) {
3199 				if (pnp->p_orig & PN_FLG_DUPLICAT)
3200 					fmt = MSG_INTL(MSG_DUP_LDLIBPATHC);
3201 				else
3202 					fmt = MSG_INTL(MSG_USD_LDLIBPATHC);
3203 			} else {
3204 				if (pnp->p_orig & PN_FLG_DUPLICAT)
3205 					fmt = MSG_INTL(MSG_DUP_LDLIBPATH);
3206 				else
3207 					fmt = MSG_INTL(MSG_USD_LDLIBPATH);
3208 			}
3209 		} else if (pnp->p_orig & LA_SER_RUNPATH) {
3210 			fmt = MSG_INTL(MSG_USD_RUNPATH);
3211 		} else
3212 			continue;
3213 
3214 		if ((*nl)++ == 0)
3215 			(void) printf(MSG_ORIG(MSG_STR_NL));
3216 		(void) printf(fmt, name, obj);
3217 	}
3218 }
3219 
3220 /*
3221  * Generate diagnostics as to whether an object has been used.  A symbolic
3222  * reference that gets bound to an object marks it as used.  Dependencies that
3223  * are unused when RTLD_NOW is in effect should be removed from future builds
3224  * of an object.  Dependencies that are unused without RTLD_NOW in effect are
3225  * candidates for lazy-loading.
3226  *
3227  * Unreferenced objects identify objects that are defined as dependencies but
3228  * are unreferenced by the caller.  These unreferenced objects may however be
3229  * referenced by other objects within the process, and therefore don't qualify
3230  * as completely unused.  They are still an unnecessary overhead.
3231  *
3232  * Unreferenced runpaths are also captured under ldd -U, or "unused,detail"
3233  * debugging.
3234  */
3235 void
3236 unused(Lm_list *lml)
3237 {
3238 	Rt_map		*lmp;
3239 	int		nl = 0;
3240 	Word		unref, unuse;
3241 
3242 	/*
3243 	 * If we're not tracing unused references or dependencies, or debugging
3244 	 * there's nothing to do.
3245 	 */
3246 	unref = lml->lm_flags & LML_FLG_TRC_UNREF;
3247 	unuse = lml->lm_flags & LML_FLG_TRC_UNUSED;
3248 
3249 	if ((unref == 0) && (unuse == 0) && (DBG_ENABLED == 0))
3250 		return;
3251 
3252 	/*
3253 	 * Detect unused global search paths.
3254 	 */
3255 	if (rpl_libdirs)
3256 		is_path_used(lml, unref, &nl, rpl_libdirs, config->c_name);
3257 	if (prm_libdirs)
3258 		is_path_used(lml, unref, &nl, prm_libdirs, config->c_name);
3259 
3260 	nl = 0;
3261 	lmp = lml->lm_head;
3262 	if (RLIST(lmp))
3263 		is_path_used(lml, unref, &nl, RLIST(lmp), NAME(lmp));
3264 
3265 	/*
3266 	 * Traverse the link-maps looking for unreferenced or unused
3267 	 * dependencies.  Ignore the first object on a link-map list, as this
3268 	 * is always used.
3269 	 */
3270 	nl = 0;
3271 	for (lmp = (Rt_map *)NEXT(lmp); lmp; lmp = (Rt_map *)NEXT(lmp)) {
3272 		/*
3273 		 * Determine if this object contains any runpaths that have
3274 		 * not been used.
3275 		 */
3276 		if (RLIST(lmp))
3277 			is_path_used(lml, unref, &nl, RLIST(lmp), NAME(lmp));
3278 
3279 		/*
3280 		 * If tracing unreferenced objects, or under debugging,
3281 		 * determine whether any of this objects callers haven't
3282 		 * referenced it.
3283 		 */
3284 		if (unref || DBG_ENABLED) {
3285 			Bnd_desc	*bdp;
3286 			Aliste		idx;
3287 
3288 			for (APLIST_TRAVERSE(CALLERS(lmp), idx, bdp)) {
3289 				Rt_map	*clmp;
3290 
3291 				if (bdp->b_flags & BND_REFER)
3292 					continue;
3293 
3294 				clmp = bdp->b_caller;
3295 				if (FLAGS1(clmp) & FL1_RT_LDDSTUB)
3296 					continue;
3297 
3298 				/* BEGIN CSTYLED */
3299 				if (nl++ == 0) {
3300 					if (unref)
3301 					    (void) printf(MSG_ORIG(MSG_STR_NL));
3302 					else
3303 					    DBG_CALL(Dbg_util_nl(lml,
3304 						DBG_NL_STD));
3305 				}
3306 
3307 				if (unref)
3308 				    (void) printf(MSG_INTL(MSG_LDD_UNREF_FMT),
3309 					NAME(lmp), NAME(clmp));
3310 				else
3311 				    DBG_CALL(Dbg_unused_unref(lmp, NAME(clmp)));
3312 				/* END CSTYLED */
3313 			}
3314 		}
3315 
3316 		/*
3317 		 * If tracing unused objects simply display those objects that
3318 		 * haven't been referenced by anyone.
3319 		 */
3320 		if (FLAGS1(lmp) & FL1_RT_USED)
3321 			continue;
3322 
3323 		if (nl++ == 0) {
3324 			if (unref || unuse)
3325 				(void) printf(MSG_ORIG(MSG_STR_NL));
3326 			else
3327 				DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
3328 		}
3329 		if (CYCGROUP(lmp)) {
3330 			if (unref || unuse)
3331 				(void) printf(MSG_INTL(MSG_LDD_UNCYC_FMT),
3332 				    NAME(lmp), CYCGROUP(lmp));
3333 			else
3334 				DBG_CALL(Dbg_unused_file(lml, NAME(lmp), 0,
3335 				    CYCGROUP(lmp)));
3336 		} else {
3337 			if (unref || unuse)
3338 				(void) printf(MSG_INTL(MSG_LDD_UNUSED_FMT),
3339 				    NAME(lmp));
3340 			else
3341 				DBG_CALL(Dbg_unused_file(lml, NAME(lmp), 0, 0));
3342 		}
3343 	}
3344 
3345 	DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
3346 }
3347 
3348 /*
3349  * Initialization routine for the Fmap structure.  If the fmap structure is
3350  * already in use, any mapping is released.  The structure is then initialized
3351  * in preparation for further use.
3352  */
3353 void
3354 fmap_setup()
3355 {
3356 #if defined(MAP_ALIGN)
3357 	/*
3358 	 * If MAP_ALIGN is set, the fm_addr has been seeded with an alignment
3359 	 * value.  Otherwise, if fm_addr is non-null it indicates a mapping that
3360 	 * should now be freed.
3361 	 */
3362 	if (fmap->fm_maddr && ((fmap->fm_mflags & MAP_ALIGN) == 0))
3363 		(void) munmap((caddr_t)fmap->fm_maddr, fmap->fm_msize);
3364 
3365 	/*
3366 	 * Providing we haven't determined that this system doesn't support
3367 	 * MAP_ALIGN, initialize the mapping address with the default segment
3368 	 * alignment.
3369 	 */
3370 	if ((rtld_flags2 & RT_FL2_NOMALIGN) == 0) {
3371 		fmap->fm_maddr = (char *)M_SEGM_ALIGN;
3372 		fmap->fm_mflags = MAP_PRIVATE | MAP_ALIGN;
3373 	} else {
3374 		fmap->fm_maddr = 0;
3375 		fmap->fm_mflags = MAP_PRIVATE;
3376 	}
3377 #else
3378 	if (fmap->fm_maddr)
3379 		(void) munmap((caddr_t)fmap->fm_maddr, fmap->fm_msize);
3380 
3381 	fmap->fm_maddr = 0;
3382 	fmap->fm_mflags = MAP_PRIVATE;
3383 #endif
3384 
3385 	fmap->fm_msize = FMAP_SIZE;
3386 	fmap->fm_hwptr = 0;
3387 }
3388 
3389 /*
3390  * Generic cleanup routine called prior to returning control to the user.
3391  * Insures that any ld.so.1 specific file descriptors or temporary mapping are
3392  * released, and any locks dropped.
3393  */
3394 void
3395 leave(Lm_list *lml, int flags)
3396 {
3397 	Lm_list	*elml = lml;
3398 	Rt_map	*clmp;
3399 	Aliste	idx;
3400 
3401 	/*
3402 	 * Alert the debuggers that the link-maps are consistent.  Note, in the
3403 	 * case of tearing down a whole link-map list, lml will be null.  In
3404 	 * this case use the main link-map list to test for a notification.
3405 	 */
3406 	if (elml == 0)
3407 		elml = &lml_main;
3408 	if (elml->lm_flags & LML_FLG_DBNOTIF)
3409 		rd_event(elml, RD_DLACTIVITY, RT_CONSISTENT);
3410 
3411 	/*
3412 	 * Alert any auditors that the link-maps are consistent.
3413 	 */
3414 	for (APLIST_TRAVERSE(elml->lm_actaudit, idx, clmp)) {
3415 		audit_activity(clmp, LA_ACT_CONSISTENT);
3416 
3417 		aplist_delete(elml->lm_actaudit, &idx);
3418 	}
3419 
3420 	if (dz_fd != FD_UNAVAIL) {
3421 		(void) close(dz_fd);
3422 		dz_fd = FD_UNAVAIL;
3423 	}
3424 
3425 	if (pr_fd != FD_UNAVAIL) {
3426 		(void) close(pr_fd);
3427 		pr_fd = FD_UNAVAIL;
3428 	}
3429 
3430 	if (nu_fd != FD_UNAVAIL) {
3431 		(void) close(nu_fd);
3432 		nu_fd = FD_UNAVAIL;
3433 	}
3434 
3435 	fmap_setup();
3436 
3437 	/*
3438 	 * Reinitialize error message pointer, and any overflow indication.
3439 	 */
3440 	nextptr = errbuf;
3441 	prevptr = 0;
3442 
3443 	/*
3444 	 * Don't drop our lock if we are running on our link-map list as
3445 	 * there's little point in doing so since we are single-threaded.
3446 	 *
3447 	 * LML_FLG_HOLDLOCK is set for:
3448 	 *	*) The ld.so.1's link-map list.
3449 	 *	*) The auditor's link-map if the environment is
3450 	 *	   libc/libthread un-unified.
3451 	 */
3452 	if (lml && (lml->lm_flags & LML_FLG_HOLDLOCK))
3453 		return;
3454 
3455 	if (rt_bind_clear(0) & THR_FLG_RTLD) {
3456 		if (!thr_flg_nolock)
3457 			(void) rt_mutex_unlock(&rtldlock);
3458 		(void) rt_bind_clear(THR_FLG_RTLD | thr_flg_nolock | flags);
3459 	}
3460 }
3461 
3462 int
3463 callable(Rt_map *clmp, Rt_map *dlmp, Grp_hdl *ghp, uint_t slflags)
3464 {
3465 	APlist		*calp, *dalp;
3466 	Aliste		idx1, idx2;
3467 	Grp_hdl		*ghp1, *ghp2;
3468 
3469 	/*
3470 	 * An object can always find symbols within itself.
3471 	 */
3472 	if (clmp == dlmp)
3473 		return (1);
3474 
3475 	/*
3476 	 * The search for a singleton must look in every loaded object.
3477 	 */
3478 	if (slflags & LKUP_SINGLETON)
3479 		return (1);
3480 
3481 	/*
3482 	 * Don't allow an object to bind to an object that is being deleted
3483 	 * unless the binder is also being deleted.
3484 	 */
3485 	if ((FLAGS(dlmp) & FLG_RT_DELETE) &&
3486 	    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
3487 		return (0);
3488 
3489 	/*
3490 	 * An object with world access can always bind to an object with global
3491 	 * visibility.
3492 	 */
3493 	if ((MODE(clmp) & RTLD_WORLD) && (MODE(dlmp) & RTLD_GLOBAL))
3494 		return (1);
3495 
3496 	/*
3497 	 * An object with local access can only bind to an object that is a
3498 	 * member of the same group.
3499 	 */
3500 	if (((MODE(clmp) & RTLD_GROUP) == 0) ||
3501 	    ((calp = GROUPS(clmp)) == NULL) || ((dalp = GROUPS(dlmp)) == NULL))
3502 		return (0);
3503 
3504 	/*
3505 	 * Traverse the list of groups the caller is a part of.
3506 	 */
3507 	for (APLIST_TRAVERSE(calp, idx1, ghp1)) {
3508 		/*
3509 		 * If we're testing for the ability of two objects to bind to
3510 		 * each other regardless of a specific group, ignore that group.
3511 		 */
3512 		if (ghp && (ghp1 == ghp))
3513 			continue;
3514 
3515 		/*
3516 		 * Traverse the list of groups the destination is a part of.
3517 		 */
3518 		for (APLIST_TRAVERSE(dalp, idx2, ghp2)) {
3519 			Grp_desc	*gdp;
3520 			Aliste		idx3;
3521 
3522 			if (ghp1 != ghp2)
3523 				continue;
3524 
3525 			/*
3526 			 * Make sure the relationship between the destination
3527 			 * and the caller provide symbols for relocation.
3528 			 * Parents are maintained as callers, but unless the
3529 			 * destination object was opened with RTLD_PARENT, the
3530 			 * parent doesn't provide symbols for the destination
3531 			 * to relocate against.
3532 			 */
3533 			for (ALIST_TRAVERSE(ghp2->gh_depends, idx3, gdp)) {
3534 				if (dlmp != gdp->gd_depend)
3535 					continue;
3536 
3537 				if (gdp->gd_flags & GPD_RELOC)
3538 					return (1);
3539 			}
3540 		}
3541 	}
3542 	return (0);
3543 }
3544 
3545 /*
3546  * Initialize the environ symbol.  Traditionally this is carried out by the crt
3547  * code prior to jumping to main.  However, init sections get fired before this
3548  * variable is initialized, so ld.so.1 sets this directly from the AUX vector
3549  * information.  In addition, a process may have multiple link-maps (ld.so.1's
3550  * debugging and preloading objects), and link auditing, and each may need an
3551  * environ variable set.
3552  *
3553  * This routine is called after a relocation() pass, and thus provides for:
3554  *
3555  *  o	setting environ on the main link-map after the initial application and
3556  *	its dependencies have been established.  Typically environ lives in the
3557  *	application (provided by its crt), but in older applications it might
3558  *	be in libc.  Who knows what's expected of applications not built on
3559  *	Solaris.
3560  *
3561  *  o	after loading a new shared object.  We can add shared objects to various
3562  *	link-maps, and any link-map dependencies requiring getopt() require
3563  *	their own environ.  In addition, lazy loading might bring in the
3564  *	supplier of environ (libc used to be a lazy loading candidate) after
3565  *	the link-map has been established and other objects are present.
3566  *
3567  * This routine handles all these scenarios, without adding unnecessary overhead
3568  * to ld.so.1.
3569  */
3570 void
3571 set_environ(Lm_list *lml)
3572 {
3573 	Rt_map		*dlmp;
3574 	Sym		*sym;
3575 	Slookup		sl;
3576 	uint_t		binfo;
3577 
3578 	/*
3579 	 * Initialize the symbol lookup data structure.
3580 	 */
3581 	SLOOKUP_INIT(sl, MSG_ORIG(MSG_SYM_ENVIRON), lml->lm_head, lml->lm_head,
3582 	    ld_entry_cnt, 0, 0, 0, 0, LKUP_WEAK);
3583 
3584 	if (sym = LM_LOOKUP_SYM(lml->lm_head)(&sl, &dlmp, &binfo, 0)) {
3585 		lml->lm_environ = (char ***)sym->st_value;
3586 
3587 		if (!(FLAGS(dlmp) & FLG_RT_FIXED))
3588 			lml->lm_environ =
3589 			    (char ***)((uintptr_t)lml->lm_environ +
3590 			    (uintptr_t)ADDR(dlmp));
3591 		*(lml->lm_environ) = (char **)environ;
3592 		lml->lm_flags |= LML_FLG_ENVIRON;
3593 	}
3594 }
3595 
3596 /*
3597  * Determine whether we have a secure executable.  Uid and gid information
3598  * can be passed to us via the aux vector, however if these values are -1
3599  * then use the appropriate system call to obtain them.
3600  *
3601  *  o	If the user is the root they can do anything
3602  *
3603  *  o	If the real and effective uid's don't match, or the real and
3604  *	effective gid's don't match then this is determined to be a `secure'
3605  *	application.
3606  *
3607  * This function is called prior to any dependency processing (see _setup.c).
3608  * Any secure setting will remain in effect for the life of the process.
3609  */
3610 void
3611 security(uid_t uid, uid_t euid, gid_t gid, gid_t egid, int auxflags)
3612 {
3613 #ifdef AT_SUN_AUXFLAGS
3614 	if (auxflags != -1) {
3615 		if ((auxflags & AF_SUN_SETUGID) != 0)
3616 			rtld_flags |= RT_FL_SECURE;
3617 		return;
3618 	}
3619 #endif
3620 	if (uid == (uid_t)-1)
3621 		uid = getuid();
3622 	if (uid) {
3623 		if (euid == (uid_t)-1)
3624 			euid = geteuid();
3625 		if (uid != euid)
3626 			rtld_flags |= RT_FL_SECURE;
3627 		else {
3628 			if (gid == (gid_t)-1)
3629 				gid = getgid();
3630 			if (egid == (gid_t)-1)
3631 				egid = getegid();
3632 			if (gid != egid)
3633 				rtld_flags |= RT_FL_SECURE;
3634 		}
3635 	}
3636 }
3637 
3638 /*
3639  * _REENTRANT code gets errno redefined to a function so provide for return
3640  * of the thread errno if applicable.  This has no meaning in ld.so.1 which
3641  * is basically singled threaded.  Provide the interface for our dependencies.
3642  */
3643 #undef errno
3644 #pragma weak _private___errno = ___errno
3645 int *
3646 ___errno()
3647 {
3648 	extern	int	errno;
3649 
3650 	return (&errno);
3651 }
3652 
3653 /*
3654  * The interface with the c library which is supplied through libdl.so.1.
3655  * A non-null argument allows a function pointer array to be passed to us which
3656  * is used to re-initialize the linker libc table.
3657  */
3658 void
3659 _ld_libc(void * ptr)
3660 {
3661 	get_lcinterface(_caller(caller(), CL_EXECDEF), (Lc_interface *)ptr);
3662 }
3663 
3664 /*
3665  * Determine whether a symbol name should be demangled.
3666  */
3667 const char *
3668 demangle(const char *name)
3669 {
3670 	if (rtld_flags & RT_FL_DEMANGLE)
3671 		return (conv_demangle_name(name));
3672 	else
3673 		return (name);
3674 }
3675