xref: /titanic_52/usr/src/cmd/sgs/rtld/common/analyze.c (revision 03494a9880d80f834bec10a1e8f0a2f8f7c97bf4)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  *	Copyright (c) 1988 AT&T
29  *	  All Rights Reserved
30  */
31 
32 #include	<string.h>
33 #include	<stdio.h>
34 #include	<unistd.h>
35 #include	<sys/stat.h>
36 #include	<sys/mman.h>
37 #include	<fcntl.h>
38 #include	<limits.h>
39 #include	<dlfcn.h>
40 #include	<errno.h>
41 #include	<link.h>
42 #include	<debug.h>
43 #include	<conv.h>
44 #include	"_rtld.h"
45 #include	"_audit.h"
46 #include	"_elf.h"
47 #include	"msg.h"
48 
49 static Fct	*vector[] = {
50 	&elf_fct,
51 #ifdef A_OUT
52 	&aout_fct,
53 #endif
54 	0
55 };
56 
57 /*
58  * If a load filter flag is in effect, and this object is a filter, trigger the
59  * loading of all its filtees.  The load filter flag is in effect when creating
60  * configuration files, or when under the control of ldd(1), or the LD_LOADFLTR
61  * environment variable is set, or this object was built with the -zloadfltr
62  * flag.  Otherwise, filtee loading is deferred until triggered by a relocation.
63  */
64 static void
65 load_filtees(Rt_map *lmp, int *in_nfavl)
66 {
67 	if ((FLAGS1(lmp) & MSK_RT_FILTER) &&
68 	    ((FLAGS(lmp) & FLG_RT_LOADFLTR) ||
69 	    (LIST(lmp)->lm_tflags & LML_TFLG_LOADFLTR))) {
70 		Dyninfo		*dip =  DYNINFO(lmp);
71 		uint_t		cnt, max = DYNINFOCNT(lmp);
72 		Slookup		sl;
73 
74 		/*
75 		 * Initialize the symbol lookup data structure.
76 		 */
77 		SLOOKUP_INIT(sl, 0, lmp, lmp, ld_entry_cnt, 0, 0, 0, 0, 0);
78 
79 		for (cnt = 0; cnt < max; cnt++, dip++) {
80 			if (((dip->di_flags & MSK_DI_FILTER) == 0) ||
81 			    ((dip->di_flags & FLG_DI_AUXFLTR) &&
82 			    (rtld_flags & RT_FL_NOAUXFLTR)))
83 				continue;
84 			(void) elf_lookup_filtee(&sl, 0, 0, cnt, in_nfavl);
85 		}
86 	}
87 }
88 
89 /*
90  * Analyze one or more link-maps of a link map control list.  This routine is
91  * called at startup to continue the processing of the main executable.  It is
92  * also called each time a new set of objects are loaded, ie. from filters,
93  * lazy-loaded objects, or dlopen().
94  *
95  * In each instance we traverse the link-map control list starting with the
96  * initial object.  As dependencies are analyzed they are added to the link-map
97  * control list.  Thus the list grows as we traverse it - this results in the
98  * breadth first ordering of all needed objects.
99  */
100 int
101 analyze_lmc(Lm_list *lml, Aliste nlmco, Rt_map *nlmp, int *in_nfavl)
102 {
103 	Rt_map	*lmp = nlmp;
104 	Lm_cntl	*nlmc;
105 	int	ret = 1;
106 
107 	/*
108 	 * If this link-map control list is being analyzed, return.  The object
109 	 * that has just been added will be picked up by the existing analysis
110 	 * thread.  Note, this is only really meaningful during process init-
111 	 * ialization, as objects are added to the main link-map control list.
112 	 * Following this initialization, each family of objects that are loaded
113 	 * are added to a new link-map control list.
114 	 */
115 	/* LINTED */
116 	nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco);
117 	if (nlmc->lc_flags & LMC_FLG_ANALYZING)
118 		return (1);
119 
120 	/*
121 	 * If this object doesn't belong to the present link-map control list
122 	 * then it must already have been analyzed, or it is in the process of
123 	 * being analyzed prior to us recursing into this analysis.  In either
124 	 * case, ignore the object as it's already being taken care of.
125 	 */
126 	if (nlmco != CNTL(nlmp))
127 		return (1);
128 
129 	nlmc->lc_flags |= LMC_FLG_ANALYZING;
130 
131 	for (; lmp; lmp = NEXT_RT_MAP(lmp)) {
132 		if (FLAGS(lmp) &
133 		    (FLG_RT_ANALZING | FLG_RT_ANALYZED | FLG_RT_DELETE))
134 			continue;
135 
136 		/*
137 		 * Indicate that analyzing is under way.
138 		 */
139 		FLAGS(lmp) |= FLG_RT_ANALZING;
140 
141 		/*
142 		 * If this link map represents a relocatable object, then we
143 		 * need to finish the link-editing of the object at this point.
144 		 */
145 		if (FLAGS(lmp) & FLG_RT_OBJECT) {
146 			if (elf_obj_fini(lml, lmp, in_nfavl) == 0) {
147 				if (lml->lm_flags & LML_FLG_TRC_ENABLE)
148 					continue;
149 				ret = 0;
150 				break;
151 			}
152 		}
153 
154 		DBG_CALL(Dbg_file_analyze(lmp));
155 
156 		/*
157 		 * Establish any dependencies this object requires.
158 		 */
159 		if (LM_NEEDED(lmp)(lml, nlmco, lmp, in_nfavl) == 0) {
160 			if (lml->lm_flags & LML_FLG_TRC_ENABLE)
161 				continue;
162 			ret = 0;
163 			break;
164 		}
165 
166 		FLAGS(lmp) &= ~FLG_RT_ANALZING;
167 		FLAGS(lmp) |= FLG_RT_ANALYZED;
168 
169 		/*
170 		 * If we're building a configuration file, determine if this
171 		 * object is a filter and if so load its filtees.  This
172 		 * traversal is only necessary for crle(1), as typical use of
173 		 * an object will load filters as part of relocation processing.
174 		 */
175 		if (MODE(nlmp) & RTLD_CONFGEN)
176 			load_filtees(lmp, in_nfavl);
177 
178 		/*
179 		 * If an interposer has been added, it will have been inserted
180 		 * in the link-map before the link we're presently analyzing.
181 		 * Break out of this analysis loop and return to the head of
182 		 * the link-map control list to analyze the interposer.  Note
183 		 * that this rescan preserves the breadth first loading of
184 		 * dependencies.
185 		 */
186 		/* LINTED */
187 		nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco);
188 		if (nlmc->lc_flags & LMC_FLG_REANALYZE) {
189 			nlmc->lc_flags &= ~LMC_FLG_REANALYZE;
190 			lmp = nlmc->lc_head;
191 		}
192 	}
193 
194 	/* LINTED */
195 	nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco);
196 	nlmc->lc_flags &= ~LMC_FLG_ANALYZING;
197 
198 	return (ret);
199 }
200 
201 /*
202  * Determine whether a symbol represents zero, .bss, bits.  Most commonly this
203  * function is used to determine whether the data for a copy relocation refers
204  * to initialized data or .bss.  If the data definition is within .bss, then the
205  * data is zero filled, and as the copy destination within the executable is
206  * .bss, we can skip copying zero's to zero's.
207  *
208  * However, if the defining object has MOVE data, it's .bss might contain
209  * non-zero data, in which case copy the definition regardless.
210  *
211  * For backward compatibility copy relocation processing, this routine can be
212  * used to determine precisely if a copy destination is a move record recipient.
213  */
214 static int
215 are_bits_zero(Rt_map *dlmp, Sym *dsym, int dest)
216 {
217 	Mmap	*mmap = NULL, *mmaps;
218 	caddr_t	daddr = (caddr_t)dsym->st_value;
219 
220 	if ((FLAGS(dlmp) & FLG_RT_FIXED) == 0)
221 		daddr += ADDR(dlmp);
222 
223 	/*
224 	 * Determine the segment that contains the copy definition.  Given that
225 	 * the copy relocation records have already been captured and verified,
226 	 * a segment must be found (but we add an escape clause never the less).
227 	 */
228 	for (mmaps = MMAPS(dlmp); mmaps->m_vaddr; mmaps++) {
229 		if ((daddr >= mmaps->m_vaddr) &&
230 		    (daddr < (mmaps->m_vaddr + mmaps->m_msize))) {
231 			mmap = mmaps;
232 			break;
233 		}
234 	}
235 	if (mmap == NULL)
236 		return (1);
237 
238 	/*
239 	 * If the definition is not within .bss, indicate this is not zero data.
240 	 */
241 	if (daddr < (mmap->m_vaddr + mmaps->m_fsize))
242 		return (0);
243 
244 	/*
245 	 * If the definition is within .bss, make sure the definition isn't the
246 	 * recipient of a move record.  Note, we don't precisely analyze whether
247 	 * the address is a move record recipient, as the infrastructure to
248 	 * prepare for, and carry out this analysis, is probably more costly
249 	 * than just copying the bytes regardless.
250 	 */
251 	if ((FLAGS(dlmp) & FLG_RT_MOVE) == 0)
252 		return (1);
253 
254 	/*
255 	 * However, for backward compatibility copy relocation processing, we
256 	 * can afford to work a little harder.  Here, determine precisely
257 	 * whether the destination in the executable is a move record recipient.
258 	 * See comments in lookup_sym_interpose(), below.
259 	 */
260 	if (dest && is_move_data(daddr))
261 		return (0);
262 
263 	return (1);
264 }
265 
266 /*
267  * Relocate an individual object.
268  */
269 static int
270 relocate_so(Lm_list *lml, Rt_map *lmp, int *relocated, int now, int *in_nfavl)
271 {
272 	/*
273 	 * If we're running under ldd(1), and haven't been asked to trace any
274 	 * warnings, skip any actual relocation processing.
275 	 */
276 	if (((lml->lm_flags & LML_FLG_TRC_ENABLE) == 0) ||
277 	    (lml->lm_flags & LML_FLG_TRC_WARN)) {
278 
279 		if (relocated)
280 			(*relocated)++;
281 
282 		if ((LM_RELOC(lmp)(lmp, now, in_nfavl) == 0) &&
283 		    ((lml->lm_flags & LML_FLG_TRC_ENABLE) == 0))
284 			return (0);
285 	}
286 	return (1);
287 }
288 
289 /*
290  * Relocate the objects on a link-map control list.
291  */
292 static int
293 _relocate_lmc(Lm_list *lml, Rt_map *nlmp, int *relocated, int *in_nfavl)
294 {
295 	Rt_map	*lmp;
296 
297 	for (lmp = nlmp; lmp; lmp = NEXT_RT_MAP(lmp)) {
298 		/*
299 		 * If this object has already been relocated, we're done.  If
300 		 * this object is being deleted, skip it, there's probably a
301 		 * relocation error somewhere that's causing this deletion.
302 		 */
303 		if (FLAGS(lmp) &
304 		    (FLG_RT_RELOCING | FLG_RT_RELOCED | FLG_RT_DELETE))
305 			continue;
306 
307 		/*
308 		 * Indicate that relocation processing is under way.
309 		 */
310 		FLAGS(lmp) |= FLG_RT_RELOCING;
311 
312 		/*
313 		 * Relocate the object.
314 		 */
315 		if (relocate_so(lml, lmp, relocated, 0, in_nfavl) == 0)
316 			return (0);
317 
318 		/*
319 		 * Indicate that the objects relocation is complete.
320 		 */
321 		FLAGS(lmp) &= ~FLG_RT_RELOCING;
322 		FLAGS(lmp) |= FLG_RT_RELOCED;
323 
324 		/*
325 		 * Mark this object's init is available for harvesting.  Under
326 		 * ldd(1) this marking is necessary for -i (tsort) gathering.
327 		 */
328 		lml->lm_init++;
329 		lml->lm_flags |= LML_FLG_OBJADDED;
330 
331 		/*
332 		 * Process any move data.  Note, this is carried out under ldd
333 		 * under relocation processing too, as it can flush out move
334 		 * errors, and enables lari(1) to provide a true representation
335 		 * of the runtime bindings.
336 		 */
337 		if ((FLAGS(lmp) & FLG_RT_MOVE) &&
338 		    (((lml->lm_flags & LML_FLG_TRC_ENABLE) == 0) ||
339 		    (lml->lm_flags & LML_FLG_TRC_WARN))) {
340 			if (move_data(lmp) == 0)
341 				return (0);
342 		}
343 
344 		/*
345 		 * Determine if this object is a filter, and if a load filter
346 		 * flag is in effect, trigger the loading of all its filtees.
347 		 */
348 		load_filtees(lmp, in_nfavl);
349 	}
350 
351 	/*
352 	 * Perform special copy relocations.  These are only meaningful for
353 	 * dynamic executables (fixed and head of their link-map list).  If
354 	 * this ever has to change then the infrastructure of COPY() has to
355 	 * change. Presently, a given link map can only have a receiver or
356 	 * supplier of copy data, so a union is used to overlap the storage
357 	 * for the COPY_R() and COPY_S() lists. These lists would need to
358 	 * be separated.
359 	 */
360 	if ((FLAGS(nlmp) & FLG_RT_FIXED) && (nlmp == LIST(nlmp)->lm_head) &&
361 	    (((lml->lm_flags & LML_FLG_TRC_ENABLE) == 0) ||
362 	    (lml->lm_flags & LML_FLG_TRC_WARN))) {
363 		Rt_map		*lmp;
364 		Aliste		idx1;
365 		Word		tracing;
366 
367 #if	defined(__i386)
368 		if (elf_copy_gen(nlmp) == 0)
369 			return (0);
370 #endif
371 		if (COPY_S(nlmp) == NULL)
372 			return (1);
373 
374 		if ((LIST(nlmp)->lm_flags & LML_FLG_TRC_ENABLE) &&
375 		    (((rtld_flags & RT_FL_SILENCERR) == 0) ||
376 		    (LIST(nlmp)->lm_flags & LML_FLG_TRC_VERBOSE)))
377 			tracing = 1;
378 		else
379 			tracing = 0;
380 
381 		DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
382 
383 		for (APLIST_TRAVERSE(COPY_S(nlmp), idx1, lmp)) {
384 			Rel_copy	*rcp;
385 			Aliste		idx2;
386 
387 			for (ALIST_TRAVERSE(COPY_R(lmp), idx2, rcp)) {
388 				int zero;
389 
390 				/*
391 				 * Only copy the data if the data is from
392 				 * a non-zero definition (ie. not .bss).
393 				 */
394 				zero = are_bits_zero(rcp->r_dlmp,
395 				    rcp->r_dsym, 0);
396 				DBG_CALL(Dbg_reloc_copy(rcp->r_dlmp, nlmp,
397 				    rcp->r_name, zero));
398 				if (zero)
399 					continue;
400 
401 				(void) memcpy(rcp->r_radd, rcp->r_dadd,
402 				    rcp->r_size);
403 
404 				if ((tracing == 0) || ((FLAGS1(rcp->r_dlmp) &
405 				    FL1_RT_DISPREL) == 0))
406 					continue;
407 
408 				(void) printf(MSG_INTL(MSG_LDD_REL_CPYDISP),
409 				    demangle(rcp->r_name), NAME(rcp->r_dlmp));
410 			}
411 		}
412 
413 		DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
414 
415 		free(COPY_S(nlmp));
416 		COPY_S(nlmp) = 0;
417 	}
418 	return (1);
419 }
420 
421 int
422 relocate_lmc(Lm_list *lml, Aliste nlmco, Rt_map *clmp, Rt_map *nlmp,
423     int *in_nfavl)
424 {
425 	int	lret = 1, pret = 1;
426 	APlist	*alp;
427 	Aliste	plmco;
428 	Lm_cntl	*plmc, *nlmc;
429 
430 	/*
431 	 * If this link-map control list is being relocated, return.  The object
432 	 * that has just been added will be picked up by the existing relocation
433 	 * thread.  Note, this is only really meaningful during process init-
434 	 * ialization, as objects are added to the main link-map control list.
435 	 * Following this initialization, each family of objects that are loaded
436 	 * are added to a new link-map control list.
437 	 */
438 	/* LINTED */
439 	nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco);
440 
441 	if (nlmc->lc_flags & LMC_FLG_RELOCATING)
442 		return (1);
443 
444 	nlmc->lc_flags |= LMC_FLG_RELOCATING;
445 
446 	/*
447 	 * Relocate one or more link-maps of a link map control list.  If this
448 	 * object doesn't belong to the present link-map control list then it
449 	 * must already have been relocated, or it is in the process of being
450 	 * relocated prior to us recursing into this relocation.  In either
451 	 * case, ignore the object as it's already being taken care of, however,
452 	 * fall through and capture any relocation promotions that might have
453 	 * been established from the reference mode of this object.
454 	 *
455 	 * If we're generating a configuration file using crle(1), two passes
456 	 * may be involved.  Under the first pass, RTLD_CONFGEN is set.  Under
457 	 * this pass, crle() loads objects into the process address space.  No
458 	 * relocation is necessary at this point, we simply need to analyze the
459 	 * objects to insure any directly bound dependencies, filtees, etc.
460 	 * get loaded. Although we skip the relocation, fall through to insure
461 	 * any control lists are maintained appropriately.
462 	 *
463 	 * If objects are to be dldump(3c)'ed, crle(1) makes a second pass,
464 	 * using RTLD_NOW and RTLD_CONFGEN.  The RTLD_NOW effectively carries
465 	 * out the relocations of all loaded objects.
466 	 */
467 	if ((nlmco == CNTL(nlmp)) &&
468 	    ((MODE(nlmp) & (RTLD_NOW | RTLD_CONFGEN)) != RTLD_CONFGEN)) {
469 		int	relocated = 0;
470 
471 		/*
472 		 * Determine whether the initial link-map control list has
473 		 * started relocation.  From this point, should any interposing
474 		 * objects be added to this link-map control list, the objects
475 		 * are demoted to standard objects.  Their interposition can't
476 		 * be guaranteed once relocations have been carried out.
477 		 */
478 		if (nlmco == ALIST_OFF_DATA)
479 			lml->lm_flags |= LML_FLG_STARTREL;
480 
481 		/*
482 		 * Relocate the link-map control list.  Should this relocation
483 		 * fail, clean up this link-map list.  Relocations within this
484 		 * list may have required relocation promotions on other lists,
485 		 * so before acting upon these, and possibly adding more objects
486 		 * to the present link-map control list, try and clean up any
487 		 * failed objects now.
488 		 */
489 		lret = _relocate_lmc(lml, nlmp, &relocated, in_nfavl);
490 		if ((lret == 0) && (nlmco != ALIST_OFF_DATA))
491 			remove_lmc(lml, clmp, nlmc, nlmco, NAME(nlmp));
492 	}
493 
494 	/*
495 	 * Determine the new, and previous link-map control lists.
496 	 */
497 	/* LINTED */
498 	nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco);
499 	if (nlmco == ALIST_OFF_DATA) {
500 		plmco = nlmco;
501 		plmc = nlmc;
502 	} else {
503 		plmco = nlmco - lml->lm_lists->al_size;
504 		/* LINTED */
505 		plmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, plmco);
506 	}
507 
508 	/*
509 	 * Having completed this control list of objects, they can now be bound
510 	 * to from other objects.  Move this control list to the control list
511 	 * that precedes it.  Although this control list may have only bound to
512 	 * controls lists much higher up the control list stack, it must only
513 	 * be moved up one control list so as to preserve the link-map order
514 	 * that may have already been traversed in search of symbols.
515 	 */
516 	if (lret && (nlmco != ALIST_OFF_DATA) && nlmc->lc_head)
517 		lm_move(lml, nlmco, plmco, nlmc, plmc);
518 
519 	/*
520 	 * Determine whether existing objects that have already been relocated,
521 	 * need any additional relocations performed.  This can occur when new
522 	 * objects are loaded with RTLD_NOW, and these new objects have
523 	 * dependencies on objects that are already loaded.  Note, that we peel
524 	 * any relocation promotions off of one control list at a time.  This
525 	 * prevents relocations from being bound to objects that might yet fail
526 	 * to relocate themselves.
527 	 */
528 	while ((alp = plmc->lc_now) != NULL) {
529 		Aliste	idx;
530 		Rt_map	*lmp;
531 
532 		/*
533 		 * Remove the relocation promotion list, as performing more
534 		 * relocations may result in discovering more objects that need
535 		 * promotion.
536 		 */
537 		plmc->lc_now = NULL;
538 
539 		for (APLIST_TRAVERSE(alp, idx, lmp)) {
540 			/*
541 			 * If the original relocation of the link-map control
542 			 * list failed, or one of the relocation promotions of
543 			 * this loop has failed, demote any pending objects
544 			 * relocation mode.
545 			 */
546 			if ((lret == 0) || (pret == 0)) {
547 				MODE(lmp) &= ~RTLD_NOW;
548 				MODE(lmp) |= RTLD_LAZY;
549 				continue;
550 			}
551 
552 			/*
553 			 * If a relocation fails, save the error condition.
554 			 * It's possible that all new objects on the original
555 			 * link-map control list have been relocated
556 			 * successfully, but if the user request requires
557 			 * promoting objects that have already been loaded, we
558 			 * have to indicate that this operation couldn't be
559 			 * performed.  The unrelocated objects are in use on
560 			 * another control list, and may continue to be used.
561 			 * If the .plt that resulted in the error is called,
562 			 * then the process will receive a fatal error at that
563 			 * time.  But, the .plt may never be called.
564 			 */
565 			if (relocate_so(lml, lmp, 0, 1, in_nfavl) == 0)
566 				pret = 0;
567 		}
568 
569 		/*
570 		 * Having promoted any objects, determine whether additional
571 		 * dependencies were added, and if so move them to the previous
572 		 * link-map control list.
573 		 */
574 		/* LINTED */
575 		nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco);
576 		/* LINTED */
577 		plmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, plmco);
578 		if ((nlmco != ALIST_OFF_DATA) && nlmc->lc_head)
579 			lm_move(lml, nlmco, plmco, nlmc, plmc);
580 		free(alp);
581 	}
582 
583 	/*
584 	 * If relocations have been successful, indicate that relocations are
585 	 * no longer active for this control list.  Otherwise, leave the
586 	 * relocation flag, as this flag is used to determine the style of
587 	 * cleanup (see remove_lmc()).
588 	 */
589 	if (lret && pret) {
590 		/* LINTED */
591 		nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco);
592 		nlmc->lc_flags &= ~LMC_FLG_RELOCATING;
593 
594 		return (1);
595 	}
596 
597 	return (0);
598 }
599 
600 /*
601  * Inherit the first rejection message for possible later diagnostics.
602  *
603  * Any attempt to process a file that is unsuccessful, should be accompanied
604  * with an error diagnostic.  However, some operations like searching for a
605  * simple filename, involve trying numerous paths, and an error message for each
606  * lookup is not required.  Although a multiple search can fail, it's possible
607  * that a file was found, but was rejected because it was the wrong type.
608  * To satisfy these possibilities, the first failure is recorded as a rejection
609  * message, and this message is used later for a more specific diagnostic.
610  *
611  * File searches are focused at load_one(), and from here a rejection descriptor
612  * is passed down to various child routines.  If these child routines can
613  * process multiple files, then they will maintain their own rejection desc-
614  * riptor.  This is filled in for any failures, and a diagnostic produced to
615  * reflect the failure.  The child routines then employ rejection_inherit() to
616  * pass the first rejection message back to load_one().
617  *
618  * Note that the name, and rejection string must be duplicated, as the name
619  * buffer and error string buffer (see conv_ routines) may be reused for
620  * additional processing or rejection messages.
621  */
622 void
623 rejection_inherit(Rej_desc *rej1, Rej_desc *rej2)
624 {
625 	if (rej2->rej_type && (rej1->rej_type == 0)) {
626 		rej1->rej_type = rej2->rej_type;
627 		rej1->rej_info = rej2->rej_info;
628 		rej1->rej_flag = rej2->rej_flag;
629 		if (rej2->rej_name)
630 			rej1->rej_name = strdup(rej2->rej_name);
631 		if (rej2->rej_str) {
632 			if ((rej1->rej_str = strdup(rej2->rej_str)) == NULL)
633 				rej1->rej_str = MSG_ORIG(MSG_EMG_ENOMEM);
634 		}
635 	}
636 }
637 
638 /*
639  * Determine the object type of a file.
640  */
641 Fct *
642 are_u_this(Rej_desc *rej, int fd, rtld_stat_t *status, const char *name)
643 {
644 	int	i;
645 	char	*maddr = 0;
646 
647 	fmap->fm_fsize = status->st_size;
648 
649 	/*
650 	 * If this is a directory (which can't be mmap()'ed) generate a precise
651 	 * error message.
652 	 */
653 	if ((status->st_mode & S_IFMT) == S_IFDIR) {
654 		rej->rej_type = SGS_REJ_STR;
655 		rej->rej_str = strerror(EISDIR);
656 		return (NULL);
657 	}
658 
659 	/*
660 	 * Map in the first page of the file.  When this buffer is first used,
661 	 * the mapping is a single system page.  This is typically enough to
662 	 * inspect the ehdr and phdrs of the file, and can be reused for each
663 	 * file that get loaded.  If a larger mapping is required to read the
664 	 * ehdr and phdrs, a new mapping is created (see elf_map_it()).  This
665 	 * new mapping is again used for each new file loaded.  Some objects,
666 	 * such as filters, only take up one page, and in this case this mapping
667 	 * will suffice for the file.
668 	 */
669 	maddr = mmap(fmap->fm_maddr, fmap->fm_msize, (PROT_READ | PROT_EXEC),
670 	    fmap->fm_mflags, fd, 0);
671 #if defined(MAP_ALIGN)
672 	if ((maddr == MAP_FAILED) && (errno == EINVAL)) {
673 		/*
674 		 * If the mapping failed, and we used MAP_ALIGN, assume we're
675 		 * on a system that doesn't support this option.  Try again
676 		 * without MAP_ALIGN.
677 		 */
678 		if (fmap->fm_mflags & MAP_ALIGN) {
679 			rtld_flags2 |= RT_FL2_NOMALIGN;
680 			fmap_setup();
681 
682 			maddr = (char *)mmap(fmap->fm_maddr, fmap->fm_msize,
683 			    (PROT_READ | PROT_EXEC), fmap->fm_mflags, fd, 0);
684 		}
685 	}
686 #endif
687 	if (maddr == MAP_FAILED) {
688 		rej->rej_type = SGS_REJ_STR;
689 		rej->rej_str = strerror(errno);
690 		return (NULL);
691 	}
692 
693 	/*
694 	 * From now on we will re-use fmap->fm_maddr as the mapping address
695 	 * so we augment the flags with MAP_FIXED and drop any MAP_ALIGN.
696 	 */
697 	fmap->fm_maddr = maddr;
698 	fmap->fm_mflags |= MAP_FIXED;
699 #if defined(MAP_ALIGN)
700 	fmap->fm_mflags &= ~MAP_ALIGN;
701 #endif
702 
703 	/*
704 	 * Search through the object vectors to determine what kind of
705 	 * object we have.
706 	 */
707 	for (i = 0; vector[i]; i++) {
708 		if ((vector[i]->fct_are_u_this)(rej))
709 			return (vector[i]);
710 		else if (rej->rej_type) {
711 			Rt_map	*lmp;
712 
713 			/*
714 			 * If this object is an explicitly defined shared
715 			 * object under inspection by ldd, and contains a
716 			 * incompatible capabilities requirement, then
717 			 * inform the user, but continue processing.
718 			 *
719 			 * XXXX - ldd -v for any rej failure.
720 			 */
721 			if (((rej->rej_type == SGS_REJ_HWCAP_1) ||
722 			    (rej->rej_type == SGS_REJ_SFCAP_1)) &&
723 			    (lml_main.lm_flags & LML_FLG_TRC_LDDSTUB) &&
724 			    ((lmp = lml_main.lm_head) != 0) &&
725 			    (FLAGS1(lmp) & FL1_RT_LDDSTUB) &&
726 			    (NEXT(lmp) == 0)) {
727 				const char	*fmt;
728 				if (rej->rej_type == SGS_REJ_HWCAP_1)
729 					fmt = MSG_INTL(MSG_LDD_GEN_HWCAP_1);
730 				else
731 					fmt = MSG_INTL(MSG_LDD_GEN_SFCAP_1);
732 				(void) printf(fmt, name, rej->rej_str);
733 				return (vector[i]);
734 			}
735 			return (NULL);
736 		}
737 	}
738 
739 	/*
740 	 * Unknown file type.
741 	 */
742 	rej->rej_type = SGS_REJ_UNKFILE;
743 	return (NULL);
744 }
745 
746 /*
747  * Helper routine for is_so_matched() that consolidates matching a path name,
748  * or file name component of a link-map name.
749  */
750 static int
751 _is_so_matched(const char *name, const char *str, int path)
752 {
753 	const char	*_str;
754 
755 	if ((path == 0) && ((_str = strrchr(str, '/')) != NULL))
756 		_str++;
757 	else
758 		_str = str;
759 
760 	return (strcmp(name, _str));
761 }
762 
763 /*
764  * Determine whether a search name matches one of the names associated with a
765  * link-map.  A link-map contains several names:
766  *
767  *  .	a NAME() - typically the full pathname of an object that has been
768  *	loaded.  For example, when looking for the dependency "libc.so.1", a
769  *	search path is applied, with the eventual NAME() being "/lib/ld.so.1".
770  *	The name of the executable is typically a simple filename, such as
771  *	"main", as this is the name passed to exec() to start the process.
772  *
773  *  .	a PATHNAME() - this is maintained if the resolved NAME() is different
774  * 	to NAME(), ie. the original name is a symbolic link.  This is also
775  * 	the resolved full pathname for a dynamic executable.
776  *
777  *  .	a list of ALIAS() names - these are alternative names by which the
778  *	object has been found, ie. when dependencies are loaded through a
779  * 	variety of different symbolic links.
780  *
781  * The name pattern matching can differ depending on whether we are looking
782  * for a full path name (path != 0), or a simple file name (path == 0).  Full
783  * path names typically match NAME() or PATHNAME() entries, so these link-map
784  * names are inspected first when a full path name is being searched for.
785  * Simple file names typically match ALIAS() names, so these link-map names are
786  * inspected first when a simple file name is being searched for.
787  *
788  * For all full path name searches, the link-map names are taken as is.  For
789  * simple file name searches, only the file name component of any link-map
790  * names are used for comparison.
791  */
792 static Rt_map *
793 is_so_matched(Rt_map *lmp, const char *name, int path)
794 {
795 	Aliste		idx;
796 	const char	*cp;
797 
798 	/*
799 	 * A pathname is typically going to match a NAME() or PATHNAME(), so
800 	 * check these first.
801 	 */
802 	if (path) {
803 		if (strcmp(name, NAME(lmp)) == 0)
804 			return (lmp);
805 
806 		if (PATHNAME(lmp) != NAME(lmp)) {
807 			if (strcmp(name, PATHNAME(lmp)) == 0)
808 				return (lmp);
809 		}
810 	}
811 
812 	/*
813 	 * Typically, dependencies are specified as simple file names
814 	 * (DT_NEEDED == libc.so.1), which are expanded to full pathnames to
815 	 * open the file.  The full pathname is NAME(), and the original name
816 	 * is maintained on the ALIAS() list.
817 	 *
818 	 * If this is a simple filename, or a pathname has failed to match the
819 	 * NAME() and PATHNAME() check above, look through the ALIAS() list.
820 	 */
821 	for (APLIST_TRAVERSE(ALIAS(lmp), idx, cp)) {
822 		/*
823 		 * If we're looking for a simple filename, _is_so_matched()
824 		 * will reduce the ALIAS name to its simple name.
825 		 */
826 		if (_is_so_matched(name, cp, path) == 0)
827 			return (lmp);
828 	}
829 
830 	/*
831 	 * Finally, if this is a simple file name, and any ALIAS() search has
832 	 * been completed, match the simple file name of NAME() and PATHNAME().
833 	 */
834 	if (path == 0) {
835 		if (_is_so_matched(name, NAME(lmp), 0) == 0)
836 			return (lmp);
837 
838 		if (PATHNAME(lmp) != NAME(lmp)) {
839 			if (_is_so_matched(name, PATHNAME(lmp), 0) == 0)
840 				return (lmp);
841 		}
842 	}
843 
844 	return (NULL);
845 }
846 
847 /*
848  * Files are opened by ld.so.1 to satisfy dependencies, filtees and dlopen()
849  * requests.  Each request investigates the file based upon the callers
850  * environment.  Once a full path name has been established, the following
851  * checks are made:
852  *
853  *  .	does the path exist in the link-map lists FullPathNode AVL tree?  if
854  *	so, the file is already loaded, and its associated link-map pointer
855  *	is returned.
856  *  .	does the path exist in the not-found AVL tree?  if so, this path has
857  *	already been determined to not exist, and a failure is returned.
858  *  .	a device/inode check, to ensure the same file isn't mapped multiple
859  *	times through different paths.  See file_open().
860  *
861  * However, there are cases where a test for an existing file name needs to be
862  * carried out, such as dlopen(NOLOAD) requests, dldump() requests, and as a
863  * final fallback to dependency loading.  These requests are handled by
864  * is_so_loaded().
865  *
866  * A traversal through the callers link-map list is carried out, and from each
867  * link-map, a comparison is made against all of the various names by which the
868  * object has been referenced.  is_so_matched() is used to compares the link-map
869  * names against the name being searched for.  Whether the search name is a full
870  * path name or a simple file name, governs what comparisons are made.
871  *
872  * A full path name, which is a fully resolved path name that starts with a "/"
873  * character, or a relative path name that includes a "/" character, must match
874  * the link-map names explicitly.  A simple file name, which is any name *not*
875  * containing a "/" character, are matched against the file name component of
876  * any link-map names.
877  */
878 Rt_map *
879 is_so_loaded(Lm_list *lml, const char *name, int *in_nfavl)
880 {
881 	Rt_map		*lmp;
882 	avl_index_t	where;
883 	Lm_cntl		*lmc;
884 	Aliste		idx;
885 	int		path = 0;
886 
887 	/*
888 	 * If the name is a full path name, first determine if the path name is
889 	 * registered on the FullPathNode AVL, or not-found AVL trees.
890 	 */
891 	if (name[0] == '/') {
892 		if (((lmp = fpavl_recorded(lml, name, &where)) != NULL) &&
893 		    ((FLAGS(lmp) & (FLG_RT_OBJECT | FLG_RT_DELETE)) == 0))
894 			return (lmp);
895 		if (nfavl_recorded(name, 0)) {
896 			/*
897 			 * For dlopen() and dlsym() fall backs, indicate that
898 			 * a registered not-found path has indicated that this
899 			 * object does not exist.
900 			 */
901 			if (in_nfavl)
902 				(*in_nfavl)++;
903 			return (NULL);
904 		}
905 	}
906 
907 	/*
908 	 * Determine whether the name is a simple file name, or a path name.
909 	 */
910 	if (strchr(name, '/'))
911 		path++;
912 
913 	/*
914 	 * Loop through the callers link-map lists.
915 	 */
916 	for (ALIST_TRAVERSE(lml->lm_lists, idx, lmc)) {
917 		for (lmp = lmc->lc_head; lmp; lmp = NEXT_RT_MAP(lmp)) {
918 			if (FLAGS(lmp) & (FLG_RT_OBJECT | FLG_RT_DELETE))
919 				continue;
920 
921 			if (is_so_matched(lmp, name, path))
922 				return (lmp);
923 		}
924 	}
925 	return (NULL);
926 }
927 
928 /*
929  * Tracing is enabled by the LD_TRACE_LOADED_OPTIONS environment variable which
930  * is normally set from ldd(1).  For each link map we load, print the load name
931  * and the full pathname of the shared object.
932  */
933 /* ARGSUSED4 */
934 static void
935 trace_so(Rt_map *clmp, Rej_desc *rej, const char *name, const char *path,
936     int alter, const char *nfound)
937 {
938 	const char	*str = MSG_ORIG(MSG_STR_EMPTY);
939 	const char	*reject = MSG_ORIG(MSG_STR_EMPTY);
940 	char		_reject[PATH_MAX];
941 
942 	/*
943 	 * The first time through trace_so() will only have lddstub on the
944 	 * link-map list and the preloaded shared object is supplied as "path".
945 	 * As we don't want to print this shared object as a dependency, but
946 	 * instead inspect *its* dependencies, return.
947 	 */
948 	if (FLAGS1(clmp) & FL1_RT_LDDSTUB)
949 		return;
950 
951 	/*
952 	 * Without any rejection info, this is a supplied not-found condition.
953 	 */
954 	if (rej && (rej->rej_type == 0)) {
955 		(void) printf(nfound, name);
956 		return;
957 	}
958 
959 	/*
960 	 * If rejection information exists then establish what object was
961 	 * found and the reason for its rejection.
962 	 */
963 	if (rej) {
964 		Conv_reject_desc_buf_t rej_buf;
965 
966 		/* LINTED */
967 		(void) snprintf(_reject, PATH_MAX,
968 		    MSG_INTL(ldd_reject[rej->rej_type]),
969 		    conv_reject_desc(rej, &rej_buf, M_MACH));
970 		if (rej->rej_name)
971 			path = rej->rej_name;
972 		reject = (char *)_reject;
973 
974 		/*
975 		 * Was an alternative pathname defined (from a configuration
976 		 * file).
977 		 */
978 		if (rej->rej_flag & FLG_FD_ALTER)
979 			str = MSG_INTL(MSG_LDD_FIL_ALTER);
980 	} else {
981 		if (alter)
982 			str = MSG_INTL(MSG_LDD_FIL_ALTER);
983 	}
984 
985 	/*
986 	 * If the load name isn't a full pathname print its associated pathname
987 	 * together with all the other information we've gathered.
988 	 */
989 	if (*name == '/')
990 		(void) printf(MSG_ORIG(MSG_LDD_FIL_PATH), path, str, reject);
991 	else
992 		(void) printf(MSG_ORIG(MSG_LDD_FIL_EQUIV), name, path, str,
993 		    reject);
994 }
995 
996 
997 /*
998  * Establish a link-map mode, initializing it if it has just been loaded, or
999  * potentially updating it if it already exists.
1000  */
1001 int
1002 update_mode(Rt_map *lmp, int omode, int nmode)
1003 {
1004 	Lm_list	*lml = LIST(lmp);
1005 	int	pmode = 0;
1006 
1007 	/*
1008 	 * A newly loaded object hasn't had its mode set yet.  Modes are used to
1009 	 * load dependencies, so don't propagate any parent or no-load flags, as
1010 	 * these would adversely affect this objects ability to load any of its
1011 	 * dependencies that aren't already loaded.  RTLD_FIRST is applicable to
1012 	 * this objects handle creation only, and should not be propagated.
1013 	 */
1014 	if ((FLAGS(lmp) & FLG_RT_MODESET) == 0) {
1015 		MODE(lmp) |= nmode & ~(RTLD_PARENT | RTLD_NOLOAD | RTLD_FIRST);
1016 		FLAGS(lmp) |= FLG_RT_MODESET;
1017 		return (1);
1018 	}
1019 
1020 	/*
1021 	 * Establish any new overriding modes.  RTLD_LAZY and RTLD_NOW should be
1022 	 * represented individually (this is historic, as these two flags were
1023 	 * the only flags originally available to dlopen()).  Other flags are
1024 	 * accumulative, but have a hierarchy of preference.
1025 	 */
1026 	if ((omode & RTLD_LAZY) && (nmode & RTLD_NOW)) {
1027 		MODE(lmp) &= ~RTLD_LAZY;
1028 		pmode |= RTLD_NOW;
1029 	}
1030 
1031 	pmode |= ((~omode & nmode) &
1032 	    (RTLD_GLOBAL | RTLD_WORLD | RTLD_NODELETE));
1033 	if (pmode) {
1034 		DBG_CALL(Dbg_file_mode_promote(lmp, pmode));
1035 		MODE(lmp) |= pmode;
1036 	}
1037 
1038 	/*
1039 	 * If this load is an RTLD_NOW request and the object has already been
1040 	 * loaded non-RTLD_NOW, append this object to the relocation-now list
1041 	 * of the objects associated control list.  Note, if the object hasn't
1042 	 * yet been relocated, setting its MODE() to RTLD_NOW will establish
1043 	 * full relocation processing when it eventually gets relocated.
1044 	 */
1045 	if ((pmode & RTLD_NOW) &&
1046 	    (FLAGS(lmp) & (FLG_RT_RELOCED | FLG_RT_RELOCING))) {
1047 		Lm_cntl	*lmc;
1048 
1049 		/* LINTED */
1050 		lmc = (Lm_cntl *)alist_item_by_offset(LIST(lmp)->lm_lists,
1051 		    CNTL(lmp));
1052 		(void) aplist_append(&lmc->lc_now, lmp, AL_CNT_LMNOW);
1053 	}
1054 
1055 #ifdef	SIEBEL_DISABLE
1056 	/*
1057 	 * For patch backward compatibility the following .init collection
1058 	 * is disabled.
1059 	 */
1060 	if (rtld_flags & RT_FL_DISFIX_1)
1061 		return (pmode);
1062 #endif
1063 
1064 	/*
1065 	 * If this objects .init has been collected but has not yet been called,
1066 	 * it may be necessary to reevaluate the object using tsort().  For
1067 	 * example, a new dlopen() hierarchy may bind to uninitialized objects
1068 	 * that are already loaded, or a dlopen(RTLD_NOW) can establish new
1069 	 * bindings between already loaded objects that require the tsort()
1070 	 * information be recomputed.  If however, no new objects have been
1071 	 * added to the process, and this object hasn't been promoted, don't
1072 	 * bother reevaluating the .init.  The present tsort() information is
1073 	 * probably as accurate as necessary, and by not establishing a parallel
1074 	 * tsort() we can help reduce the amount of recursion possible between
1075 	 * .inits.
1076 	 */
1077 	if (((FLAGS(lmp) &
1078 	    (FLG_RT_INITCLCT | FLG_RT_INITCALL)) == FLG_RT_INITCLCT) &&
1079 	    ((lml->lm_flags & LML_FLG_OBJADDED) || ((pmode & RTLD_NOW) &&
1080 	    (FLAGS(lmp) & (FLG_RT_RELOCED | FLG_RT_RELOCING))))) {
1081 		FLAGS(lmp) &= ~FLG_RT_INITCLCT;
1082 		LIST(lmp)->lm_init++;
1083 		LIST(lmp)->lm_flags |= LML_FLG_OBJREEVAL;
1084 	}
1085 
1086 	return (pmode);
1087 }
1088 
1089 /*
1090  * Determine whether an alias name already exists, and if not create one.  This
1091  * is typically used to retain dependency names, such as "libc.so.1", which
1092  * would have been expanded to full path names when they were loaded.  The
1093  * full path names (NAME() and possibly PATHNAME()) are maintained as Fullpath
1094  * AVL nodes, and thus would have been matched by fpavl_loaded() during
1095  * file_open().
1096  */
1097 int
1098 append_alias(Rt_map *lmp, const char *str, int *added)
1099 {
1100 	Aliste	idx;
1101 	char	*cp;
1102 
1103 	/*
1104 	 * Determine if this filename is already on the alias list.
1105 	 */
1106 	for (APLIST_TRAVERSE(ALIAS(lmp), idx, cp)) {
1107 		if (strcmp(cp, str) == 0)
1108 			return (1);
1109 	}
1110 
1111 	/*
1112 	 * This is a new alias, append it to the alias list.
1113 	 */
1114 	if ((cp = strdup(str)) == NULL)
1115 		return (0);
1116 
1117 	if (aplist_append(&ALIAS(lmp), cp, AL_CNT_ALIAS) == NULL) {
1118 		free(cp);
1119 		return (0);
1120 	}
1121 	if (added)
1122 		*added = 1;
1123 	return (1);
1124 }
1125 
1126 /*
1127  * Determine whether a file is already loaded by comparing device and inode
1128  * values.
1129  */
1130 static Rt_map *
1131 is_devinode_loaded(rtld_stat_t *status, Lm_list *lml, const char *name,
1132     uint_t flags)
1133 {
1134 	Lm_cntl	*lmc;
1135 	Aliste	idx;
1136 
1137 	/*
1138 	 * If this is an auditor, it will have been opened on a new link-map.
1139 	 * To prevent multiple occurrences of the same auditor on multiple
1140 	 * link-maps, search the head of each link-map list and see if this
1141 	 * object is already loaded as an auditor.
1142 	 */
1143 	if (flags & FLG_RT_AUDIT) {
1144 		Lm_list		*lml;
1145 		Listnode	*lnp;
1146 
1147 		for (LIST_TRAVERSE(&dynlm_list, lnp, lml)) {
1148 			Rt_map	*nlmp = lml->lm_head;
1149 
1150 			if (nlmp && ((FLAGS(nlmp) &
1151 			    (FLG_RT_AUDIT | FLG_RT_DELETE)) == FLG_RT_AUDIT) &&
1152 			    (STDEV(nlmp) == status->st_dev) &&
1153 			    (STINO(nlmp) == status->st_ino))
1154 				return (nlmp);
1155 		}
1156 		return (NULL);
1157 	}
1158 
1159 	/*
1160 	 * If the file has been found determine from the new files status
1161 	 * information if this file is actually linked to one we already have
1162 	 * mapped.  This catches symlink names not caught by is_so_loaded().
1163 	 */
1164 	for (ALIST_TRAVERSE(lml->lm_lists, idx, lmc)) {
1165 		Rt_map	*nlmp;
1166 
1167 		for (nlmp = lmc->lc_head; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
1168 			if ((FLAGS(nlmp) & FLG_RT_DELETE) ||
1169 			    (FLAGS1(nlmp) & FL1_RT_LDDSTUB))
1170 				continue;
1171 
1172 			if ((STDEV(nlmp) != status->st_dev) ||
1173 			    (STINO(nlmp) != status->st_ino))
1174 				continue;
1175 
1176 			if (lml->lm_flags & LML_FLG_TRC_VERBOSE) {
1177 				/* BEGIN CSTYLED */
1178 				if (*name == '/')
1179 				    (void) printf(MSG_ORIG(MSG_LDD_FIL_PATH),
1180 					name, MSG_ORIG(MSG_STR_EMPTY),
1181 					MSG_ORIG(MSG_STR_EMPTY));
1182 				else
1183 				    (void) printf(MSG_ORIG(MSG_LDD_FIL_EQUIV),
1184 					name, NAME(nlmp),
1185 					MSG_ORIG(MSG_STR_EMPTY),
1186 					MSG_ORIG(MSG_STR_EMPTY));
1187 				/* END CSTYLED */
1188 			}
1189 			return (nlmp);
1190 		}
1191 	}
1192 	return (NULL);
1193 }
1194 
1195 /*
1196  * Generate any error messages indicating a file could not be found.  When
1197  * preloading or auditing a secure application, it can be a little more helpful
1198  * to indicate that a search of secure directories has failed, so adjust the
1199  * messages accordingly.
1200  */
1201 void
1202 file_notfound(Lm_list *lml, const char *name, Rt_map *clmp, uint_t flags,
1203     Rej_desc * rej)
1204 {
1205 	int	secure = 0;
1206 
1207 	if ((rtld_flags & RT_FL_SECURE) &&
1208 	    (flags & (FLG_RT_PRELOAD | FLG_RT_AUDIT)))
1209 		secure++;
1210 
1211 	if (lml->lm_flags & LML_FLG_TRC_ENABLE) {
1212 		/*
1213 		 * Under ldd(1), auxiliary filtees that can't be loaded are
1214 		 * ignored, unless verbose errors are requested.
1215 		 */
1216 		if ((rtld_flags & RT_FL_SILENCERR) &&
1217 		    ((lml->lm_flags & LML_FLG_TRC_VERBOSE) == 0))
1218 			return;
1219 
1220 		if (secure)
1221 			trace_so(clmp, rej, name, 0, 0,
1222 			    MSG_INTL(MSG_LDD_SEC_NFOUND));
1223 		else
1224 			trace_so(clmp, rej, name, 0, 0,
1225 			    MSG_INTL(MSG_LDD_FIL_NFOUND));
1226 		return;
1227 	}
1228 
1229 	if (rej->rej_type) {
1230 		Conv_reject_desc_buf_t rej_buf;
1231 
1232 		eprintf(lml, ERR_FATAL, MSG_INTL(err_reject[rej->rej_type]),
1233 		    rej->rej_name ? rej->rej_name : MSG_INTL(MSG_STR_UNKNOWN),
1234 		    conv_reject_desc(rej, &rej_buf, M_MACH));
1235 		return;
1236 	}
1237 
1238 	if (secure)
1239 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SEC_OPEN), name);
1240 	else
1241 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN), name,
1242 		    strerror(ENOENT));
1243 }
1244 
1245 static int
1246 file_open(int err, Lm_list *lml, const char *oname, const char *nname,
1247     Rt_map *clmp, uint_t flags, Fdesc *fdesc, Rej_desc *rej, int *in_nfavl)
1248 {
1249 	rtld_stat_t	status;
1250 	Rt_map		*nlmp;
1251 	int		resolved = 0;
1252 	char		*name;
1253 	avl_index_t	nfavlwhere = 0;
1254 
1255 	fdesc->fd_oname = oname;
1256 
1257 	if ((err == 0) && (fdesc->fd_flags & FLG_FD_ALTER))
1258 		DBG_CALL(Dbg_file_config_obj(lml, oname, 0, nname));
1259 
1260 	/*
1261 	 * If we're dealing with a full pathname, determine whether this
1262 	 * pathname is already known.  Other pathnames fall through to the
1263 	 * dev/inode check, as even though the pathname may look the same as
1264 	 * one previously used, the process may have changed directory.
1265 	 */
1266 	if ((err == 0) && (nname[0] == '/')) {
1267 		if ((nlmp = fpavl_recorded(lml, nname,
1268 		    &(fdesc->fd_avlwhere))) != NULL) {
1269 			fdesc->fd_nname = nname;
1270 			fdesc->fd_lmp = nlmp;
1271 			return (1);
1272 		}
1273 		if (nfavl_recorded(nname, &nfavlwhere)) {
1274 			/*
1275 			 * For dlopen() and dlsym() fall backs, indicate that
1276 			 * a registered not-found path has indicated that this
1277 			 * object does not exist.  If this path has been
1278 			 * constructed as part of expanding a HWCAP directory,
1279 			 * and as this is a silent failure, where no rejection
1280 			 * message is created, free the original name to
1281 			 * simplify the life of the caller.
1282 			 */
1283 			if (in_nfavl)
1284 				(*in_nfavl)++;
1285 			if (flags & FLG_RT_HWCAP)
1286 				free((void *)nname);
1287 			return (0);
1288 		}
1289 	}
1290 
1291 	if ((err == 0) && ((rtld_stat(nname, &status)) != -1)) {
1292 		char	path[PATH_MAX];
1293 		int	fd, size, added;
1294 
1295 		/*
1296 		 * If this path has been constructed as part of expanding a
1297 		 * HWCAP directory, ignore any subdirectories.  As this is a
1298 		 * silent failure, where no rejection message is created, free
1299 		 * the original name to simplify the life of the caller.  For
1300 		 * any other reference that expands to a directory, fall through
1301 		 * to construct a meaningful rejection message.
1302 		 */
1303 		if ((flags & FLG_RT_HWCAP) &&
1304 		    ((status.st_mode & S_IFMT) == S_IFDIR)) {
1305 			free((void *)nname);
1306 			return (0);
1307 		}
1308 
1309 		/*
1310 		 * Resolve the filename and determine whether the resolved name
1311 		 * is already known.  Typically, the previous fpavl_loaded()
1312 		 * will have caught this, as both NAME() and PATHNAME() for a
1313 		 * link-map are recorded in the FullNode AVL tree.  However,
1314 		 * instances exist where a file can be replaced (loop-back
1315 		 * mounts, bfu, etc.), and reference is made to the original
1316 		 * file through a symbolic link.  By checking the pathname here,
1317 		 * we don't fall through to the dev/inode check and conclude
1318 		 * that a new file should be loaded.
1319 		 */
1320 		if ((nname[0] == '/') && (rtld_flags & RT_FL_EXECNAME) &&
1321 		    ((size = resolvepath(nname, path, (PATH_MAX - 1))) > 0)) {
1322 			path[size] = '\0';
1323 
1324 			if (strcmp(nname, path)) {
1325 				if ((nlmp =
1326 				    fpavl_recorded(lml, path, 0)) != NULL) {
1327 					added = 0;
1328 
1329 					if (append_alias(nlmp, nname,
1330 					    &added) == 0)
1331 						return (0);
1332 					/* BEGIN CSTYLED */
1333 					if (added)
1334 					    DBG_CALL(Dbg_file_skip(LIST(clmp),
1335 						NAME(nlmp), nname));
1336 					/* END CSTYLED */
1337 					fdesc->fd_nname = nname;
1338 					fdesc->fd_lmp = nlmp;
1339 					return (1);
1340 				}
1341 
1342 				/*
1343 				 * If this pathname hasn't been loaded, save
1344 				 * the resolved pathname so that it doesn't
1345 				 * have to be recomputed as part of fullpath()
1346 				 * processing.
1347 				 */
1348 				if ((fdesc->fd_pname = strdup(path)) == NULL)
1349 					return (0);
1350 				resolved = 1;
1351 			} else {
1352 				/*
1353 				 * If the resolved name doesn't differ from the
1354 				 * original, save it without duplication.
1355 				 * Having fd_pname set indicates that no further
1356 				 * resolvepath processing is necessary.
1357 				 */
1358 				fdesc->fd_pname = nname;
1359 			}
1360 		}
1361 
1362 		if (nlmp = is_devinode_loaded(&status, lml, nname, flags)) {
1363 			if (flags & FLG_RT_AUDIT) {
1364 				/*
1365 				 * If we've been requested to load an auditor,
1366 				 * and an auditor of the same name already
1367 				 * exists, then the original auditor is used.
1368 				 */
1369 				DBG_CALL(Dbg_audit_skip(LIST(clmp),
1370 				    NAME(nlmp), LIST(nlmp)->lm_lmidstr));
1371 			} else {
1372 				/*
1373 				 * Otherwise, if an alternatively named file
1374 				 * has been found for the same dev/inode, add
1375 				 * a new name alias, and insert any alias full
1376 				 * pathname in the link-map lists AVL tree.
1377 				 */
1378 				added = 0;
1379 
1380 				if (append_alias(nlmp, nname, &added) == 0)
1381 					return (0);
1382 				if (added) {
1383 					if ((nname[0] == '/') &&
1384 					    (fpavl_insert(lml, nlmp,
1385 					    nname, 0) == 0))
1386 						return (0);
1387 					DBG_CALL(Dbg_file_skip(LIST(clmp),
1388 					    NAME(nlmp), nname));
1389 				}
1390 			}
1391 
1392 			/*
1393 			 * Record in the file descriptor the existing object
1394 			 * that satisfies this open request.
1395 			 */
1396 			fdesc->fd_nname = nname;
1397 			fdesc->fd_lmp = nlmp;
1398 			return (1);
1399 		}
1400 
1401 		if ((fd = open(nname, O_RDONLY, 0)) == -1) {
1402 			/*
1403 			 * As the file must exist for the previous stat() to
1404 			 * have succeeded, record the error condition.
1405 			 */
1406 			rej->rej_type = SGS_REJ_STR;
1407 			rej->rej_str = strerror(errno);
1408 		} else {
1409 			Fct	*ftp;
1410 
1411 			if ((ftp = are_u_this(rej, fd, &status, nname)) != 0) {
1412 				fdesc->fd_nname = nname;
1413 				fdesc->fd_ftp = ftp;
1414 				fdesc->fd_dev = status.st_dev;
1415 				fdesc->fd_ino = status.st_ino;
1416 				fdesc->fd_fd = fd;
1417 
1418 				/*
1419 				 * Trace that this open has succeeded.
1420 				 */
1421 				if (lml->lm_flags & LML_FLG_TRC_ENABLE) {
1422 					trace_so(clmp, 0, oname, nname,
1423 					    (fdesc->fd_flags & FLG_FD_ALTER),
1424 					    0);
1425 				}
1426 				return (1);
1427 			}
1428 			(void) close(fd);
1429 		}
1430 
1431 	} else if (errno != ENOENT) {
1432 		/*
1433 		 * If the open() failed for anything other than the file not
1434 		 * existing, record the error condition.
1435 		 */
1436 		rej->rej_type = SGS_REJ_STR;
1437 		rej->rej_str = strerror(errno);
1438 	}
1439 
1440 	/*
1441 	 * Regardless of error, duplicate and record any full path names that
1442 	 * can't be used on the "not-found" AVL tree.
1443 	 */
1444 	if ((nname[0] == '/') && ((name = strdup(nname)) != NULL))
1445 		nfavl_insert(name, nfavlwhere);
1446 
1447 	/*
1448 	 * Indicate any rejection.
1449 	 */
1450 	if (rej->rej_type) {
1451 		/*
1452 		 * If this pathname was resolved and duplicated, remove the
1453 		 * allocated name to simplify the cleanup of the callers.
1454 		 */
1455 		if (resolved) {
1456 			free((void *)fdesc->fd_pname);
1457 			fdesc->fd_pname = NULL;
1458 		}
1459 		rej->rej_name = nname;
1460 		rej->rej_flag = (fdesc->fd_flags & FLG_FD_ALTER);
1461 		DBG_CALL(Dbg_file_rejected(lml, rej, M_MACH));
1462 	}
1463 	return (0);
1464 }
1465 
1466 /*
1467  * Find a full pathname (it contains a "/").
1468  */
1469 int
1470 find_path(Lm_list *lml, const char *oname, Rt_map *clmp, uint_t flags,
1471     Fdesc *fdesc, Rej_desc *rej, int *in_nfavl)
1472 {
1473 	int	err = 0;
1474 
1475 	/*
1476 	 * If directory configuration exists determine if this path is known.
1477 	 */
1478 	if (rtld_flags & RT_FL_DIRCFG) {
1479 		Rtc_obj		*obj;
1480 		const char	*aname;
1481 
1482 		if ((obj = elf_config_ent(oname, (Word)elf_hash(oname),
1483 		    0, &aname)) != 0) {
1484 			/*
1485 			 * If the configuration file states that this path is a
1486 			 * directory, or the path is explicitly defined as
1487 			 * non-existent (ie. a unused platform specific
1488 			 * library), then go no further.
1489 			 */
1490 			if (obj->co_flags & RTC_OBJ_DIRENT) {
1491 				err = EISDIR;
1492 			} else if ((obj->co_flags &
1493 			    (RTC_OBJ_NOEXIST | RTC_OBJ_ALTER)) ==
1494 			    RTC_OBJ_NOEXIST) {
1495 				err = ENOENT;
1496 			} else if ((obj->co_flags & RTC_OBJ_ALTER) &&
1497 			    (rtld_flags & RT_FL_OBJALT) && (lml == &lml_main)) {
1498 				int	ret;
1499 
1500 				fdesc->fd_flags |= FLG_FD_ALTER;
1501 				/*
1502 				 * Attempt to open the alternative path.  If
1503 				 * this fails, and the alternative is flagged
1504 				 * as optional, fall through to open the
1505 				 * original path.
1506 				 */
1507 				DBG_CALL(Dbg_libs_found(lml, aname,
1508 				    FLG_FD_ALTER));
1509 				if (((ret = file_open(0, lml, oname, aname,
1510 				    clmp, flags, fdesc, rej, in_nfavl)) != 0) ||
1511 				    ((obj->co_flags & RTC_OBJ_OPTINAL) == 0))
1512 					return (ret);
1513 
1514 				fdesc->fd_flags &= ~FLG_FD_ALTER;
1515 			}
1516 		}
1517 	}
1518 	DBG_CALL(Dbg_libs_found(lml, oname, 0));
1519 	return (file_open(err, lml, oname, oname, clmp, flags, fdesc,
1520 	    rej, in_nfavl));
1521 }
1522 
1523 /*
1524  * Find a simple filename (it doesn't contain a "/").
1525  */
1526 static int
1527 _find_file(Lm_list *lml, const char *oname, const char *nname, Rt_map *clmp,
1528     uint_t flags, Fdesc *fdesc, Rej_desc *rej, Pnode *dir, int aflag,
1529     int *in_nfavl)
1530 {
1531 	DBG_CALL(Dbg_libs_found(lml, nname, aflag));
1532 	if ((lml->lm_flags & LML_FLG_TRC_SEARCH) &&
1533 	    ((FLAGS1(clmp) & FL1_RT_LDDSTUB) == 0)) {
1534 		(void) printf(MSG_INTL(MSG_LDD_PTH_TRYING), nname, aflag ?
1535 		    MSG_INTL(MSG_LDD_FIL_ALTER) : MSG_ORIG(MSG_STR_EMPTY));
1536 	}
1537 
1538 	/*
1539 	 * If we're being audited tell the audit library of the file we're about
1540 	 * to go search for.  The audit library may offer an alternative
1541 	 * dependency, or indicate that this dependency should be ignored.
1542 	 */
1543 	if ((lml->lm_tflags | FLAGS1(clmp)) & LML_TFLG_AUD_OBJSEARCH) {
1544 		char	*aname;
1545 
1546 		if ((aname = audit_objsearch(clmp, nname,
1547 		    (dir->p_orig & LA_SER_MASK))) == 0) {
1548 			DBG_CALL(Dbg_audit_terminate(lml, nname));
1549 			return (0);
1550 		}
1551 
1552 		/*
1553 		 * Protect ourselves from auditor mischief, by copying any
1554 		 * alternative name over the present name (the present name is
1555 		 * maintained in a static buffer - see elf_get_so());
1556 		 */
1557 		if (nname != aname)
1558 			(void) strncpy((char *)nname, aname, PATH_MAX);
1559 	}
1560 	return (file_open(0, lml, oname, nname, clmp, flags, fdesc,
1561 	    rej, in_nfavl));
1562 }
1563 
1564 static int
1565 find_file(Lm_list *lml, const char *oname, Rt_map *clmp, uint_t flags,
1566     Fdesc *fdesc, Rej_desc *rej, Pnode *dir, Word * strhash, size_t olen,
1567     int *in_nfavl)
1568 {
1569 	static Rtc_obj	Obj = { 0 };
1570 	Rtc_obj		*dobj;
1571 	const char	*nname = oname;
1572 
1573 	if (dir->p_name == 0)
1574 		return (0);
1575 	if (dir->p_info) {
1576 		dobj = (Rtc_obj *)dir->p_info;
1577 		if ((dobj->co_flags &
1578 		    (RTC_OBJ_NOEXIST | RTC_OBJ_ALTER)) == RTC_OBJ_NOEXIST)
1579 			return (0);
1580 	} else
1581 		dobj = 0;
1582 
1583 	/*
1584 	 * If configuration information exists see if this directory/file
1585 	 * combination exists.
1586 	 */
1587 	if ((rtld_flags & RT_FL_DIRCFG) &&
1588 	    ((dobj == 0) || (dobj->co_id != 0))) {
1589 		Rtc_obj		*fobj;
1590 		const char	*alt = 0;
1591 
1592 		/*
1593 		 * If this pnode has not yet been searched for in the
1594 		 * configuration file go find it.
1595 		 */
1596 		if (dobj == 0) {
1597 			dobj = elf_config_ent(dir->p_name,
1598 			    (Word)elf_hash(dir->p_name), 0, 0);
1599 			if (dobj == 0)
1600 				dobj = &Obj;
1601 			dir->p_info = (void *)dobj;
1602 
1603 			if ((dobj->co_flags & (RTC_OBJ_NOEXIST |
1604 			    RTC_OBJ_ALTER)) == RTC_OBJ_NOEXIST)
1605 				return (0);
1606 		}
1607 
1608 		/*
1609 		 * If we found a directory search for the file.
1610 		 */
1611 		if (dobj->co_id != 0) {
1612 			if (*strhash == 0)
1613 				*strhash = (Word)elf_hash(nname);
1614 			fobj = elf_config_ent(nname, *strhash,
1615 			    dobj->co_id, &alt);
1616 
1617 			/*
1618 			 * If this object specifically does not exist, or the
1619 			 * object can't be found in a know-all-entries
1620 			 * directory, continue looking.  If the object does
1621 			 * exist determine if an alternative object exists.
1622 			 */
1623 			if (fobj == 0) {
1624 				if (dobj->co_flags & RTC_OBJ_ALLENTS)
1625 					return (0);
1626 			} else {
1627 				if ((fobj->co_flags & (RTC_OBJ_NOEXIST |
1628 				    RTC_OBJ_ALTER)) == RTC_OBJ_NOEXIST)
1629 					return (0);
1630 
1631 				if ((fobj->co_flags & RTC_OBJ_ALTER) &&
1632 				    (rtld_flags & RT_FL_OBJALT) &&
1633 				    (lml == &lml_main)) {
1634 					int	ret;
1635 
1636 					fdesc->fd_flags |= FLG_FD_ALTER;
1637 					/*
1638 					 * Attempt to open the alternative path.
1639 					 * If this fails, and the alternative is
1640 					 * flagged as optional, fall through to
1641 					 * open the original path.
1642 					 */
1643 					ret = _find_file(lml, oname, alt, clmp,
1644 					    flags, fdesc, rej, dir, 1,
1645 					    in_nfavl);
1646 					if (ret || ((fobj->co_flags &
1647 					    RTC_OBJ_OPTINAL) == 0))
1648 						return (ret);
1649 
1650 					fdesc->fd_flags &= ~FLG_FD_ALTER;
1651 				}
1652 			}
1653 		}
1654 	}
1655 
1656 	/*
1657 	 * Protect ourselves from building an invalid pathname.
1658 	 */
1659 	if ((olen + dir->p_len + 1) >= PATH_MAX) {
1660 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN), nname,
1661 		    strerror(ENAMETOOLONG));
1662 			return (0);
1663 	}
1664 	if ((nname = (LM_GET_SO(clmp)(dir->p_name, nname))) == 0)
1665 		return (0);
1666 
1667 	return (_find_file(lml, oname, nname, clmp, flags, fdesc, rej,
1668 	    dir, 0, in_nfavl));
1669 }
1670 
1671 /*
1672  * A unique file has been opened.  Create a link-map to represent it, and
1673  * process the various names by which it can be referenced.
1674  */
1675 static Rt_map *
1676 load_file(Lm_list *lml, Aliste lmco, Fdesc *fdesc, int *in_nfavl)
1677 {
1678 	const char	*oname = fdesc->fd_oname;
1679 	const char	*nname = fdesc->fd_nname;
1680 	Rt_map		*nlmp;
1681 
1682 	/*
1683 	 * Typically we call fct_map_so() with the full pathname of the opened
1684 	 * file (nname) and the name that started the search (oname), thus for
1685 	 * a typical dependency on libc this would be /usr/lib/libc.so.1 and
1686 	 * libc.so.1 (DT_NEEDED).  The original name is maintained on an ALIAS
1687 	 * list for comparison when bringing in new dependencies.  If the user
1688 	 * specified name as a full path (from a dlopen() for example) then
1689 	 * there's no need to create an ALIAS.
1690 	 */
1691 	if (strcmp(oname, nname) == 0)
1692 		oname = 0;
1693 
1694 	/*
1695 	 * A new file has been opened, now map it into the process.  Close the
1696 	 * original file so as not to accumulate file descriptors.
1697 	 */
1698 	nlmp = ((fdesc->fd_ftp)->fct_map_so)(lml, lmco, nname, oname,
1699 	    fdesc->fd_fd, in_nfavl);
1700 	(void) close(fdesc->fd_fd);
1701 	fdesc->fd_fd = 0;
1702 
1703 	if (nlmp == 0)
1704 		return (NULL);
1705 
1706 	/*
1707 	 * Save the dev/inode information for later comparisons.
1708 	 */
1709 	STDEV(nlmp) = fdesc->fd_dev;
1710 	STINO(nlmp) = fdesc->fd_ino;
1711 
1712 	/*
1713 	 * Insert the names of this link-map into the FullpathNode AVL tree.
1714 	 * Save both the NAME() and PATHNAME() is they differ.
1715 	 *
1716 	 * If this is an OBJECT file, don't insert it yet as this is only a
1717 	 * temporary link-map.  During elf_obj_fini() the final link-map is
1718 	 * created, and its names will be inserted in the FullpathNode AVL
1719 	 * tree at that time.
1720 	 */
1721 	if ((FLAGS(nlmp) & FLG_RT_OBJECT) == 0) {
1722 		/*
1723 		 * Update the objects full path information if necessary.
1724 		 * Note, with pathname expansion in effect, the fd_pname will
1725 		 * be used as PATHNAME().  This allocated string will be freed
1726 		 * should this object be deleted.  However, without pathname
1727 		 * expansion, the fd_name should be freed now, as it is no
1728 		 * longer referenced.
1729 		 */
1730 		if (FLAGS1(nlmp) & FL1_RT_RELATIVE)
1731 			(void) fullpath(nlmp, fdesc->fd_pname);
1732 		else if (fdesc->fd_pname != fdesc->fd_nname)
1733 			free((void *)fdesc->fd_pname);
1734 		fdesc->fd_pname = 0;
1735 
1736 		if ((NAME(nlmp)[0] == '/') && (fpavl_insert(lml, nlmp,
1737 		    NAME(nlmp), fdesc->fd_avlwhere) == 0)) {
1738 			remove_so(lml, nlmp);
1739 			return (NULL);
1740 		}
1741 		if (((NAME(nlmp)[0] != '/') ||
1742 		    (NAME(nlmp) != PATHNAME(nlmp))) &&
1743 		    (fpavl_insert(lml, nlmp, PATHNAME(nlmp), 0) == 0)) {
1744 			remove_so(lml, nlmp);
1745 			return (NULL);
1746 		}
1747 
1748 		/*
1749 		 * If this is a secure application, record any full path name
1750 		 * directory in which this dependency has been found.  This
1751 		 * directory can be deemed safe (as we've already found a
1752 		 * dependency here).  This recording provides a fall-back
1753 		 * should another objects $ORIGIN definition expands to this
1754 		 * directory, an expansion that would ordinarily be deemed
1755 		 * insecure.
1756 		 */
1757 		if (rtld_flags & RT_FL_SECURE) {
1758 			if (NAME(nlmp)[0] == '/')
1759 				spavl_insert(NAME(nlmp));
1760 			if ((NAME(nlmp) != PATHNAME(nlmp)) &&
1761 			    (PATHNAME(nlmp)[0] == '/'))
1762 				spavl_insert(PATHNAME(nlmp));
1763 		}
1764 	}
1765 
1766 	/*
1767 	 * If we're processing an alternative object reset the original name
1768 	 * for possible $ORIGIN processing.
1769 	 */
1770 	if (fdesc->fd_flags & FLG_FD_ALTER) {
1771 		const char	*odir;
1772 		char		*ndir;
1773 		size_t		olen;
1774 
1775 		FLAGS(nlmp) |= FLG_RT_ALTER;
1776 
1777 		/*
1778 		 * If we were given a pathname containing a slash then the
1779 		 * original name is still in oname.  Otherwise the original
1780 		 * directory is in dir->p_name (which is all we need for
1781 		 * $ORIGIN).
1782 		 */
1783 		if (fdesc->fd_flags & FLG_FD_SLASH) {
1784 			char	*ofil;
1785 
1786 			odir = oname;
1787 			ofil = strrchr(oname, '/');
1788 			olen = ofil - odir + 1;
1789 		} else {
1790 			odir = fdesc->fd_odir;
1791 			olen = strlen(odir) + 1;
1792 		}
1793 
1794 		if ((ndir = (char *)malloc(olen)) == 0) {
1795 			remove_so(lml, nlmp);
1796 			return (NULL);
1797 		}
1798 		(void) strncpy(ndir, odir, olen);
1799 		ndir[--olen] = '\0';
1800 
1801 		ORIGNAME(nlmp) = ndir;
1802 		DIRSZ(nlmp) = olen;
1803 	}
1804 
1805 	/*
1806 	 * Identify this as a new object.
1807 	 */
1808 	FLAGS(nlmp) |= FLG_RT_NEWLOAD;
1809 
1810 	return (nlmp);
1811 }
1812 
1813 /*
1814  * This function loads the named file and returns a pointer to its link map.
1815  * It is assumed that the caller has already checked that the file is not
1816  * already loaded before calling this function (refer is_so_loaded()).
1817  * Find and open the file, map it into memory, add it to the end of the list
1818  * of link maps and return a pointer to the new link map.  Return 0 on error.
1819  */
1820 static Rt_map *
1821 load_so(Lm_list *lml, Aliste lmco, const char *oname, Rt_map *clmp,
1822     uint_t flags, Fdesc *nfdp, Rej_desc *rej, int *in_nfavl)
1823 {
1824 	char		*name;
1825 	uint_t		slash = 0;
1826 	size_t		olen;
1827 	Fdesc		fdesc = { 0 };
1828 	Pnode		*dir;
1829 
1830 	/*
1831 	 * If the file is the run time linker then it's already loaded.
1832 	 */
1833 	if (interp && (strcmp(oname, NAME(lml_rtld.lm_head)) == 0))
1834 		return (lml_rtld.lm_head);
1835 
1836 	/*
1837 	 * If this isn't a hardware capabilities pathname, which is already a
1838 	 * full, duplicated pathname, determine whether the pathname contains
1839 	 * a slash, and if not determine the input filename (for max path
1840 	 * length verification).
1841 	 */
1842 	if ((flags & FLG_RT_HWCAP) == 0) {
1843 		const char	*str;
1844 
1845 		for (str = oname; *str; str++) {
1846 			if (*str == '/') {
1847 				slash++;
1848 				break;
1849 			}
1850 		}
1851 		if (slash == 0)
1852 			olen = (str - oname) + 1;
1853 	}
1854 
1855 	/*
1856 	 * If we are passed a 'null' link-map this means that this is the first
1857 	 * object to be loaded on this link-map list.  In that case we set the
1858 	 * link-map to ld.so.1's link-map.
1859 	 *
1860 	 * This link-map is referenced to determine what lookup rules to use
1861 	 * when searching for files.  By using ld.so.1's we are defaulting to
1862 	 * ELF look-up rules.
1863 	 *
1864 	 * Note: This case happens when loading the first object onto
1865 	 *	 the plt_tracing link-map.
1866 	 */
1867 	if (clmp == 0)
1868 		clmp = lml_rtld.lm_head;
1869 
1870 	/*
1871 	 * If this path resulted from a $HWCAP specification, then the best
1872 	 * hardware capability object has already been establish, and is
1873 	 * available in the calling file descriptor.  Perform some minor book-
1874 	 * keeping so that we can fall through into common code.
1875 	 */
1876 	if (flags & FLG_RT_HWCAP) {
1877 		/*
1878 		 * If this object is already loaded, we're done.
1879 		 */
1880 		if (nfdp->fd_lmp)
1881 			return (nfdp->fd_lmp);
1882 
1883 		/*
1884 		 * Obtain the avl index for this object.
1885 		 */
1886 		(void) fpavl_recorded(lml, nfdp->fd_nname,
1887 		    &(nfdp->fd_avlwhere));
1888 
1889 		/*
1890 		 * If the name and resolved pathname differ, duplicate the path
1891 		 * name once more to provide for generic cleanup by the caller.
1892 		 */
1893 		if (nfdp->fd_pname && (nfdp->fd_nname != nfdp->fd_pname)) {
1894 			char	*pname;
1895 
1896 			if ((pname = strdup(nfdp->fd_pname)) == NULL)
1897 				return (NULL);
1898 			nfdp->fd_pname = pname;
1899 		}
1900 
1901 		nfdp->fd_flags |= FLG_FD_SLASH;
1902 
1903 	} else if (slash) {
1904 		Rej_desc	_rej = { 0 };
1905 
1906 		*nfdp = fdesc;
1907 		nfdp->fd_flags = FLG_FD_SLASH;
1908 
1909 		if (find_path(lml, oname, clmp, flags, nfdp,
1910 		    &_rej, in_nfavl) == 0) {
1911 			rejection_inherit(rej, &_rej);
1912 			return (NULL);
1913 		}
1914 
1915 		/*
1916 		 * If this object is already loaded, we're done.
1917 		 */
1918 		if (nfdp->fd_lmp)
1919 			return (nfdp->fd_lmp);
1920 
1921 	} else {
1922 		/*
1923 		 * No '/' - for each directory on list, make a pathname using
1924 		 * that directory and filename and try to open that file.
1925 		 */
1926 		Pnode		*dirlist = (Pnode *)0;
1927 		Word		strhash = 0;
1928 #if	!defined(ISSOLOAD_BASENAME_DISABLED)
1929 		Rt_map		*nlmp;
1930 #endif
1931 		DBG_CALL(Dbg_libs_find(lml, oname));
1932 
1933 #if	!defined(ISSOLOAD_BASENAME_DISABLED)
1934 		if ((nlmp = is_so_loaded(lml, oname, in_nfavl)))
1935 			return (nlmp);
1936 #endif
1937 		/*
1938 		 * Make sure we clear the file descriptor new name in case the
1939 		 * following directory search doesn't provide any directories
1940 		 * (odd, but this can be forced with a -znodefaultlib test).
1941 		 */
1942 		*nfdp = fdesc;
1943 		for (dir = get_next_dir(&dirlist, clmp, flags); dir;
1944 		    dir = get_next_dir(&dirlist, clmp, flags)) {
1945 			Rej_desc	_rej = { 0 };
1946 
1947 			*nfdp = fdesc;
1948 
1949 			/*
1950 			 * Under debugging, duplicate path name entries are
1951 			 * tagged but remain part of the search path list so
1952 			 * that they can be diagnosed under "unused" processing.
1953 			 * Skip these entries, as this path would have already
1954 			 * been attempted.
1955 			 */
1956 			if (dir->p_orig & PN_FLG_DUPLICAT)
1957 				continue;
1958 
1959 			/*
1960 			 * Try and locate this file.  Make sure to clean up
1961 			 * any rejection information should the file have
1962 			 * been found, but not appropriate.
1963 			 */
1964 			if (find_file(lml, oname, clmp, flags, nfdp, &_rej,
1965 			    dir, &strhash, olen, in_nfavl) == 0) {
1966 				rejection_inherit(rej, &_rej);
1967 				continue;
1968 			}
1969 
1970 			/*
1971 			 * Indicate that this search path has been used.  If
1972 			 * this is an LD_LIBRARY_PATH setting, ignore any use
1973 			 * by ld.so.1 itself.
1974 			 */
1975 			if (((dir->p_orig & LA_SER_LIBPATH) == 0) ||
1976 			    ((lml->lm_flags & LML_FLG_RTLDLM) == 0))
1977 				dir->p_orig |= PN_FLG_USED;
1978 
1979 			/*
1980 			 * If this object is already loaded, we're done.
1981 			 */
1982 			if (nfdp->fd_lmp)
1983 				return (nfdp->fd_lmp);
1984 
1985 			nfdp->fd_odir = dir->p_name;
1986 			break;
1987 		}
1988 
1989 		/*
1990 		 * If the file couldn't be loaded, do another comparison of
1991 		 * loaded files using just the basename.  This catches folks
1992 		 * who may have loaded multiple full pathname files (possibly
1993 		 * from setxid applications) to satisfy dependency relationships
1994 		 * (i.e., a file might have a dependency on foo.so.1 which has
1995 		 * already been opened using its full pathname).
1996 		 */
1997 		if (nfdp->fd_nname == NULL)
1998 			return (is_so_loaded(lml, oname, in_nfavl));
1999 	}
2000 
2001 	/*
2002 	 * Duplicate the file name so that NAME() is available in core files.
2003 	 * Note, that hardware capability names are already duplicated, but
2004 	 * they get duplicated once more to insure consistent cleanup in the
2005 	 * event of an error condition.
2006 	 */
2007 	if ((name = strdup(nfdp->fd_nname)) == NULL)
2008 		return (NULL);
2009 
2010 	if (nfdp->fd_nname == nfdp->fd_pname)
2011 		nfdp->fd_nname = nfdp->fd_pname = name;
2012 	else
2013 		nfdp->fd_nname = name;
2014 
2015 	/*
2016 	 * Finish mapping the file and return the link-map descriptor.  Note,
2017 	 * if this request originated from a HWCAP request, re-establish the
2018 	 * fdesc information.  For single paged objects, such as filters, the
2019 	 * original mapping may have been sufficient to capture the file, thus
2020 	 * this mapping needs to be reset to insure it doesn't mistakenly get
2021 	 * unmapped as part of HWCAP cleanup.
2022 	 */
2023 	return (load_file(lml, lmco, nfdp, in_nfavl));
2024 }
2025 
2026 /*
2027  * Trace an attempt to load an object.
2028  */
2029 int
2030 load_trace(Lm_list *lml, const char **oname, Rt_map *clmp)
2031 {
2032 	const char	*name = *oname;
2033 
2034 	/*
2035 	 * First generate any ldd(1) diagnostics.
2036 	 */
2037 	if ((lml->lm_flags & (LML_FLG_TRC_VERBOSE | LML_FLG_TRC_SEARCH)) &&
2038 	    ((FLAGS1(clmp) & FL1_RT_LDDSTUB) == 0))
2039 		(void) printf(MSG_INTL(MSG_LDD_FIL_FIND), name, NAME(clmp));
2040 
2041 	/*
2042 	 * If we're being audited tell the audit library of the file we're
2043 	 * about to go search for.
2044 	 */
2045 	if (((lml->lm_tflags | FLAGS1(clmp)) & LML_TFLG_AUD_ACTIVITY) &&
2046 	    (lml == LIST(clmp)))
2047 		audit_activity(clmp, LA_ACT_ADD);
2048 
2049 	if ((lml->lm_tflags | FLAGS1(clmp)) & LML_TFLG_AUD_OBJSEARCH) {
2050 		char	*aname = audit_objsearch(clmp, name, LA_SER_ORIG);
2051 
2052 		/*
2053 		 * The auditor can indicate that this object should be ignored.
2054 		 */
2055 		if (aname == NULL) {
2056 			DBG_CALL(Dbg_audit_terminate(lml, name));
2057 			return (0);
2058 		}
2059 
2060 		/*
2061 		 * Protect ourselves from auditor mischief, by duplicating any
2062 		 * alternative name.  The original name has been allocated from
2063 		 * expand(), so free this allocation before using the audit
2064 		 * alternative.
2065 		 */
2066 		if (name != aname) {
2067 			if ((aname = strdup(aname)) == NULL) {
2068 				eprintf(lml, ERR_FATAL,
2069 				    MSG_INTL(MSG_GEN_AUDITERM), name);
2070 				return (0);
2071 			}
2072 			free((void *)*oname);
2073 			*oname = aname;
2074 		}
2075 	}
2076 	return (1);
2077 }
2078 
2079 /*
2080  * Having loaded an object and created a link-map to describe it, finish
2081  * processing this stage, including verifying any versioning requirements,
2082  * updating the objects mode, creating a handle if necessary, and adding this
2083  * object to existing handles if required.
2084  */
2085 static int
2086 load_finish(Lm_list *lml, const char *name, Rt_map *clmp, int nmode,
2087     uint_t flags, Grp_hdl **hdl, Rt_map *nlmp)
2088 {
2089 	Aliste		idx;
2090 	Grp_hdl		*ghp;
2091 	int		promote;
2092 
2093 	/*
2094 	 * If this dependency is associated with a required version insure that
2095 	 * the version is present in the loaded file.
2096 	 */
2097 	if (((rtld_flags & RT_FL_NOVERSION) == 0) &&
2098 	    (FCT(clmp) == &elf_fct) && VERNEED(clmp) &&
2099 	    (LM_VERIFY_VERS(clmp)(name, clmp, nlmp) == 0))
2100 		return (0);
2101 
2102 	/*
2103 	 * If this object has indicated that it should be isolated as a group
2104 	 * (DT_FLAGS_1 contains DF_1_GROUP - object was built with -B group),
2105 	 * or if the callers direct bindings indicate it should be isolated as
2106 	 * a group (DYNINFO flags contains FLG_DI_GROUP - dependency followed
2107 	 * -zgroupperm), establish the appropriate mode.
2108 	 *
2109 	 * The intent of an object defining itself as a group is to isolate the
2110 	 * relocation of the group within its own members, however, unless
2111 	 * opened through dlopen(), in which case we assume dlsym() will be used
2112 	 * to located symbols in the new object, we still need to associate it
2113 	 * with the caller for it to be bound with.  This is equivalent to a
2114 	 * dlopen(RTLD_GROUP) and dlsym() using the returned handle.
2115 	 */
2116 	if ((FLAGS(nlmp) | flags) & FLG_RT_SETGROUP) {
2117 		nmode &= ~RTLD_WORLD;
2118 		nmode |= RTLD_GROUP;
2119 
2120 		/*
2121 		 * If the object wasn't explicitly dlopen()'ed associate it with
2122 		 * the parent.
2123 		 */
2124 		if ((flags & FLG_RT_HANDLE) == 0)
2125 			nmode |= RTLD_PARENT;
2126 	}
2127 
2128 	/*
2129 	 * Establish new mode and flags.
2130 	 *
2131 	 * For patch backward compatibility, the following use of update_mode()
2132 	 * is disabled.
2133 	 */
2134 #ifdef	SIEBEL_DISABLE
2135 	if (rtld_flags & RT_FL_DISFIX_1)
2136 		promote = MODE(nlmp) |=
2137 		    (nmode & ~(RTLD_PARENT | RTLD_NOLOAD | RTLD_FIRST));
2138 	else
2139 #endif
2140 		promote = update_mode(nlmp, MODE(nlmp), nmode);
2141 
2142 	FLAGS(nlmp) |= flags;
2143 
2144 	/*
2145 	 * If this is a global object, ensure the associated link-map list can
2146 	 * be rescanned for global, lazy dependencies.
2147 	 */
2148 	if (MODE(nlmp) & RTLD_GLOBAL)
2149 		LIST(nlmp)->lm_flags &= ~LML_FLG_NOPENDGLBLAZY;
2150 
2151 	/*
2152 	 * If we've been asked to establish a handle create one for this object.
2153 	 * Or, if this object has already been analyzed, but this reference
2154 	 * requires that the mode of the object be promoted, also create a
2155 	 * handle to propagate the new modes to all this objects dependencies.
2156 	 */
2157 	if (((FLAGS(nlmp) | flags) & FLG_RT_HANDLE) || (promote &&
2158 	    (FLAGS(nlmp) & FLG_RT_ANALYZED))) {
2159 		uint_t	oflags, hflags = 0, cdflags;
2160 
2161 		/*
2162 		 * Establish any flags for the handle (Grp_hdl).
2163 		 *
2164 		 *  .	Use of the RTLD_FIRST flag indicates that only the first
2165 		 *	dependency on the handle (the new object) can be used
2166 		 *	to satisfy dlsym() requests.
2167 		 */
2168 		if (nmode & RTLD_FIRST)
2169 			hflags = GPH_FIRST;
2170 
2171 		/*
2172 		 * Establish the flags for this callers dependency descriptor
2173 		 * (Grp_desc).
2174 		 *
2175 		 *  .	The creation of a handle associated a descriptor for the
2176 		 *	new object and descriptor for the parent (caller).
2177 		 *	Typically, the handle is created for dlopen() or for
2178 		 *	filtering.  A handle may also be created to promote
2179 		 *	the callers modes (RTLD_NOW) to the new object.  In this
2180 		 *	latter case, the handle/descriptor are torn down once
2181 		 *	the mode propagation has occurred.
2182 		 *
2183 		 *  .	Use of the RTLD_PARENT flag indicates that the parent
2184 		 *	can be relocated against.
2185 		 */
2186 		if (((FLAGS(nlmp) | flags) & FLG_RT_HANDLE) == 0)
2187 			cdflags = GPD_PROMOTE;
2188 		else
2189 			cdflags = GPD_PARENT;
2190 		if (nmode & RTLD_PARENT)
2191 			cdflags |= GPD_RELOC;
2192 
2193 		/*
2194 		 * Now that a handle is being created, remove this state from
2195 		 * the object so that it doesn't mistakenly get inherited by
2196 		 * a dependency.
2197 		 */
2198 		oflags = FLAGS(nlmp);
2199 		FLAGS(nlmp) &= ~FLG_RT_HANDLE;
2200 
2201 		DBG_CALL(Dbg_file_hdl_title(DBG_HDL_ADD));
2202 		if ((ghp = hdl_create(lml, nlmp, clmp, hflags,
2203 		    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS), cdflags)) == 0)
2204 			return (0);
2205 
2206 		/*
2207 		 * Add any dependencies that are already loaded, to the handle.
2208 		 */
2209 		if (hdl_initialize(ghp, nlmp, nmode, promote) == 0)
2210 			return (0);
2211 
2212 		if (hdl)
2213 			*hdl = ghp;
2214 
2215 		/*
2216 		 * If we were asked to create a handle, we're done.
2217 		 */
2218 		if ((oflags | flags) & FLG_RT_HANDLE)
2219 			return (1);
2220 
2221 		/*
2222 		 * If the handle was created to promote modes from the parent
2223 		 * (caller) to the new object, then this relationship needs to
2224 		 * be removed to ensure the handle doesn't prevent the new
2225 		 * objects from being deleted if required.  If the parent is
2226 		 * the only dependency on the handle, then the handle can be
2227 		 * completely removed.  However, the handle may have already
2228 		 * existed, in which case only the parent descriptor can be
2229 		 * deleted from the handle, or at least the GPD_PROMOTE flag
2230 		 * removed from the descriptor.
2231 		 *
2232 		 * Fall through to carry out any group processing.
2233 		 */
2234 		free_hdl(ghp, clmp, GPD_PROMOTE);
2235 	}
2236 
2237 	/*
2238 	 * If the caller isn't part of a group we're done.
2239 	 */
2240 	if (GROUPS(clmp) == NULL)
2241 		return (1);
2242 
2243 	/*
2244 	 * Determine if our caller is already associated with a handle, if so
2245 	 * we need to add this object to any handles that already exist.
2246 	 * Traverse the list of groups our caller is a member of and add this
2247 	 * new link-map to those groups.
2248 	 */
2249 	DBG_CALL(Dbg_file_hdl_title(DBG_HDL_ADD));
2250 	for (APLIST_TRAVERSE(GROUPS(clmp), idx, ghp)) {
2251 		Aliste		idx1;
2252 		Grp_desc	*gdp;
2253 		int		exist;
2254 		Rt_map		*dlmp1;
2255 		APlist		*lmalp = NULL;
2256 
2257 		/*
2258 		 * If the caller doesn't indicate that its dependencies should
2259 		 * be added to a handle, ignore it.  This case identifies a
2260 		 * parent of a dlopen(RTLD_PARENT) request.
2261 		 */
2262 		for (ALIST_TRAVERSE(ghp->gh_depends, idx1, gdp)) {
2263 			if (gdp->gd_depend == clmp)
2264 				break;
2265 		}
2266 		if ((gdp->gd_flags & GPD_ADDEPS) == 0)
2267 			continue;
2268 
2269 		if ((exist = hdl_add(ghp, nlmp,
2270 		    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS))) == 0)
2271 			return (0);
2272 
2273 		/*
2274 		 * If this member already exists then its dependencies will
2275 		 * have already been processed.
2276 		 */
2277 		if (exist == ALE_EXISTS)
2278 			continue;
2279 
2280 		/*
2281 		 * If the object we've added has just been opened, it will not
2282 		 * yet have been processed for its dependencies, these will be
2283 		 * added on later calls to load_one().  If it doesn't have any
2284 		 * dependencies we're also done.
2285 		 */
2286 		if (((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0) ||
2287 		    (DEPENDS(nlmp) == NULL))
2288 			continue;
2289 
2290 		/*
2291 		 * Otherwise, this object exists and has dependencies, so add
2292 		 * all of its dependencies to the handle were operating on.
2293 		 */
2294 		if (aplist_append(&lmalp, nlmp, AL_CNT_DEPCLCT) == 0)
2295 			return (0);
2296 
2297 		for (APLIST_TRAVERSE(lmalp, idx1, dlmp1)) {
2298 			Aliste		idx2;
2299 			Bnd_desc 	*bdp;
2300 
2301 			/*
2302 			 * Add any dependencies of this dependency to the
2303 			 * dynamic dependency list so they can be further
2304 			 * processed.
2305 			 */
2306 			for (APLIST_TRAVERSE(DEPENDS(dlmp1), idx2, bdp)) {
2307 				Rt_map	*dlmp2 = bdp->b_depend;
2308 
2309 				if ((bdp->b_flags & BND_NEEDED) == 0)
2310 					continue;
2311 
2312 				if (aplist_test(&lmalp, dlmp2,
2313 				    AL_CNT_DEPCLCT) == 0) {
2314 					free(lmalp);
2315 					return (0);
2316 				}
2317 			}
2318 
2319 			if (nlmp == dlmp1)
2320 				continue;
2321 
2322 			if ((exist = hdl_add(ghp, dlmp1,
2323 			    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS))) != 0) {
2324 				if (exist == ALE_CREATE) {
2325 					(void) update_mode(dlmp1, MODE(dlmp1),
2326 					    nmode);
2327 				}
2328 				continue;
2329 			}
2330 			free(lmalp);
2331 			return (0);
2332 		}
2333 		free(lmalp);
2334 	}
2335 	return (1);
2336 }
2337 
2338 /*
2339  * The central routine for loading shared objects.  Insures ldd() diagnostics,
2340  * handles and any other related additions are all done in one place.
2341  */
2342 static Rt_map *
2343 _load_path(Lm_list *lml, Aliste lmco, const char **oname, Rt_map *clmp,
2344     int nmode, uint_t flags, Grp_hdl ** hdl, Fdesc *nfdp, Rej_desc *rej,
2345     int *in_nfavl)
2346 {
2347 	Rt_map		*nlmp;
2348 	const char	*name = *oname;
2349 
2350 	if ((nmode & RTLD_NOLOAD) == 0) {
2351 		/*
2352 		 * If this isn't a noload request attempt to load the file.
2353 		 * Note, the name of the file may be changed by an auditor.
2354 		 */
2355 		if ((load_trace(lml, oname, clmp)) == 0)
2356 			return (NULL);
2357 
2358 		name = *oname;
2359 
2360 		if ((nlmp = load_so(lml, lmco, name, clmp, flags,
2361 		    nfdp, rej, in_nfavl)) == 0)
2362 			return (NULL);
2363 
2364 		/*
2365 		 * If we've loaded a library which identifies itself as not
2366 		 * being dlopen()'able catch it here.  Let non-dlopen()'able
2367 		 * objects through under RTLD_CONFGEN as they're only being
2368 		 * mapped to be dldump()'ed.
2369 		 */
2370 		if ((rtld_flags & RT_FL_APPLIC) && ((FLAGS(nlmp) &
2371 		    (FLG_RT_NOOPEN | FLG_RT_RELOCED)) == FLG_RT_NOOPEN) &&
2372 		    ((nmode & RTLD_CONFGEN) == 0)) {
2373 			Rej_desc	_rej = { 0 };
2374 
2375 			_rej.rej_name = name;
2376 			_rej.rej_type = SGS_REJ_STR;
2377 			_rej.rej_str = MSG_INTL(MSG_GEN_NOOPEN);
2378 			DBG_CALL(Dbg_file_rejected(lml, &_rej, M_MACH));
2379 			rejection_inherit(rej, &_rej);
2380 			remove_so(lml, nlmp);
2381 			return (NULL);
2382 		}
2383 	} else {
2384 		/*
2385 		 * If it's a NOLOAD request - check to see if the object
2386 		 * has already been loaded.
2387 		 */
2388 		/* LINTED */
2389 		if (nlmp = is_so_loaded(lml, name, in_nfavl)) {
2390 			if ((lml->lm_flags & LML_FLG_TRC_VERBOSE) &&
2391 			    ((FLAGS1(clmp) & FL1_RT_LDDSTUB) == 0)) {
2392 				(void) printf(MSG_INTL(MSG_LDD_FIL_FIND), name,
2393 				    NAME(clmp));
2394 				/* BEGIN CSTYLED */
2395 				if (*name == '/')
2396 				    (void) printf(MSG_ORIG(MSG_LDD_FIL_PATH),
2397 					name, MSG_ORIG(MSG_STR_EMPTY),
2398 					MSG_ORIG(MSG_STR_EMPTY));
2399 				else
2400 				    (void) printf(MSG_ORIG(MSG_LDD_FIL_EQUIV),
2401 					name, NAME(nlmp),
2402 					MSG_ORIG(MSG_STR_EMPTY),
2403 					MSG_ORIG(MSG_STR_EMPTY));
2404 				/* END CSTYLED */
2405 			}
2406 		} else {
2407 			Rej_desc	_rej = { 0 };
2408 
2409 			_rej.rej_name = name;
2410 			_rej.rej_type = SGS_REJ_STR;
2411 			_rej.rej_str = strerror(ENOENT);
2412 			DBG_CALL(Dbg_file_rejected(lml, &_rej, M_MACH));
2413 			rejection_inherit(rej, &_rej);
2414 			return (NULL);
2415 		}
2416 	}
2417 
2418 	/*
2419 	 * Finish processing this loaded object.
2420 	 */
2421 	if (load_finish(lml, name, clmp, nmode, flags, hdl, nlmp) == 0) {
2422 		FLAGS(nlmp) &= ~FLG_RT_NEWLOAD;
2423 
2424 		/*
2425 		 * If this object has already been analyzed, then it is in use,
2426 		 * so even though this operation has failed, it should not be
2427 		 * torn down.
2428 		 */
2429 		if ((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0)
2430 			remove_so(lml, nlmp);
2431 		return (NULL);
2432 	}
2433 
2434 	/*
2435 	 * If this object is new, and we're being audited, tell the audit
2436 	 * library of the file we've just opened.  Note, if the new link-map
2437 	 * requires local auditing of its dependencies we also register its
2438 	 * opening.
2439 	 */
2440 	if (FLAGS(nlmp) & FLG_RT_NEWLOAD) {
2441 		FLAGS(nlmp) &= ~FLG_RT_NEWLOAD;
2442 
2443 		if (((lml->lm_tflags | FLAGS1(clmp) | FLAGS1(nlmp)) &
2444 		    LML_TFLG_AUD_MASK) && (((lml->lm_flags |
2445 		    LIST(clmp)->lm_flags) & LML_FLG_NOAUDIT) == 0)) {
2446 			if (audit_objopen(clmp, nlmp) == 0) {
2447 				remove_so(lml, nlmp);
2448 				return (NULL);
2449 			}
2450 		}
2451 	}
2452 	return (nlmp);
2453 }
2454 
2455 Rt_map *
2456 load_path(Lm_list *lml, Aliste lmco, const char **name, Rt_map *clmp, int nmode,
2457     uint_t flags, Grp_hdl **hdl, Fdesc *cfdp, Rej_desc *rej, int *in_nfavl)
2458 {
2459 	Rt_map	*lmp;
2460 	Fdesc	nfdp = { 0 };
2461 
2462 	/*
2463 	 * If this path resulted from a $HWCAP specification, then the best
2464 	 * hardware capability object has already been establish, and is
2465 	 * available in the calling file descriptor.
2466 	 */
2467 	if (flags & FLG_RT_HWCAP) {
2468 		if (cfdp->fd_lmp == 0) {
2469 			/*
2470 			 * If this object hasn't yet been mapped, re-establish
2471 			 * the file descriptor structure to reflect this objects
2472 			 * original initial page mapping.  Make sure any present
2473 			 * file descriptor mapping is removed before overwriting
2474 			 * the structure.
2475 			 */
2476 #if	defined(MAP_ALIGN)
2477 			if (fmap->fm_maddr &&
2478 			    ((fmap->fm_mflags & MAP_ALIGN) == 0))
2479 #else
2480 			if (fmap->fm_maddr)
2481 #endif
2482 				(void) munmap(fmap->fm_maddr, fmap->fm_msize);
2483 
2484 			*fmap = cfdp->fd_fmap;
2485 		}
2486 		nfdp = *cfdp;
2487 	}
2488 
2489 	lmp = _load_path(lml, lmco, name, clmp, nmode, flags, hdl, &nfdp,
2490 	    rej, in_nfavl);
2491 
2492 	/*
2493 	 * If this path originated from a $HWCAP specification, re-establish the
2494 	 * fdesc information.  For single paged objects, such as filters, the
2495 	 * original mapping may have been sufficient to capture the file, thus
2496 	 * this mapping needs to be reset to insure it doesn't mistakenly get
2497 	 * unmapped as part of HWCAP cleanup.
2498 	 */
2499 	if ((flags & FLG_RT_HWCAP) && (cfdp->fd_lmp == 0)) {
2500 		cfdp->fd_fmap.fm_maddr = fmap->fm_maddr;
2501 		cfdp->fd_fmap.fm_mflags = fmap->fm_mflags;
2502 		cfdp->fd_fd = nfdp.fd_fd;
2503 	}
2504 
2505 	return (lmp);
2506 }
2507 
2508 /*
2509  * Load one object from a possible list of objects.  Typically, for requests
2510  * such as NEEDED's, only one object is specified.  However, this object could
2511  * be specified using $ISALIST or $HWCAP, in which case only the first object
2512  * that can be loaded is used (ie. the best).
2513  */
2514 Rt_map *
2515 load_one(Lm_list *lml, Aliste lmco, Pnode *pnp, Rt_map *clmp, int mode,
2516     uint_t flags, Grp_hdl **hdl, int *in_nfavl)
2517 {
2518 	Rej_desc	rej = { 0 };
2519 	Pnode   	*tpnp;
2520 	const char	*name;
2521 
2522 	for (tpnp = pnp; tpnp && tpnp->p_name; tpnp = tpnp->p_next) {
2523 		Rt_map	*tlmp;
2524 
2525 		/*
2526 		 * A Hardware capabilities requirement can itself expand into
2527 		 * a number of candidates.
2528 		 */
2529 		if (tpnp->p_orig & PN_TKN_HWCAP) {
2530 			if ((tlmp = load_hwcap(lml, lmco, tpnp->p_name, clmp,
2531 			    mode, (flags | FLG_RT_HWCAP), hdl, &rej,
2532 			    in_nfavl)) != 0) {
2533 				remove_rej(&rej);
2534 				return (tlmp);
2535 			}
2536 		} else {
2537 			if ((tlmp = load_path(lml, lmco, &tpnp->p_name, clmp,
2538 			    mode, flags, hdl, 0, &rej, in_nfavl)) != 0) {
2539 				remove_rej(&rej);
2540 				return (tlmp);
2541 			}
2542 		}
2543 	}
2544 
2545 	/*
2546 	 * If this pathname originated from an expanded token, use the original
2547 	 * for any diagnostic output.
2548 	 */
2549 	if ((name = pnp->p_oname) == 0)
2550 		name = pnp->p_name;
2551 
2552 	file_notfound(lml, name, clmp, flags, &rej);
2553 	remove_rej(&rej);
2554 	return (NULL);
2555 }
2556 
2557 /*
2558  * Determine whether a symbol is defined as an interposer.
2559  */
2560 int
2561 is_sym_interposer(Rt_map *lmp, Sym *sym)
2562 {
2563 	Syminfo	*sip = SYMINFO(lmp);
2564 
2565 	if (sip) {
2566 		ulong_t	ndx;
2567 
2568 		ndx = (((ulong_t)sym - (ulong_t)SYMTAB(lmp)) / SYMENT(lmp));
2569 		/* LINTED */
2570 		sip = (Syminfo *)((char *)sip + (ndx * SYMINENT(lmp)));
2571 		if (sip->si_flags & SYMINFO_FLG_INTERPOSE)
2572 			return (1);
2573 	}
2574 	return (0);
2575 }
2576 
2577 /*
2578  * While processing direct or group bindings, determine whether the object to
2579  * which we've bound can be interposed upon.  In this context, copy relocations
2580  * are a form of interposition.
2581  */
2582 static Sym *
2583 lookup_sym_interpose(Slookup *slp, Rt_map **dlmp, uint_t *binfo, Sym *osym,
2584     int *in_nfavl)
2585 {
2586 	Rt_map		*lmp, *clmp;
2587 	Slookup		sl;
2588 	Lm_list		*lml;
2589 
2590 	/*
2591 	 * If we've bound to a copy relocation definition then we need to assign
2592 	 * this binding to the original copy reference.  Fabricate an inter-
2593 	 * position diagnostic, as this is a legitimate form of interposition.
2594 	 */
2595 	if (osym && (FLAGS1(*dlmp) & FL1_RT_COPYTOOK)) {
2596 		Rel_copy	*rcp;
2597 		Aliste		idx;
2598 
2599 		for (ALIST_TRAVERSE(COPY_R(*dlmp), idx, rcp)) {
2600 			if ((osym == rcp->r_dsym) || (osym->st_value &&
2601 			    (osym->st_value == rcp->r_dsym->st_value))) {
2602 				*dlmp = rcp->r_rlmp;
2603 				*binfo |=
2604 				    (DBG_BINFO_INTERPOSE | DBG_BINFO_COPYREF);
2605 				return (rcp->r_rsym);
2606 			}
2607 		}
2608 	}
2609 
2610 	/*
2611 	 * If a symbol binding has been established, inspect the link-map list
2612 	 * of the destination object, otherwise use the link-map list of the
2613 	 * original caller.
2614 	 */
2615 	if (osym)
2616 		clmp = *dlmp;
2617 	else
2618 		clmp = slp->sl_cmap;
2619 
2620 	lml = LIST(clmp);
2621 	lmp = lml->lm_head;
2622 
2623 	/*
2624 	 * Prior to Solaris 8, external references from an executable that were
2625 	 * bound to an uninitialized variable (.bss) within a shared object did
2626 	 * not establish a copy relocation.  This was thought to be an
2627 	 * optimization, to prevent copying zero's to zero's.  Typically,
2628 	 * interposition took its course, with the shared object binding to the
2629 	 * executables data definition.
2630 	 *
2631 	 * This scenario can be broken when this old executable runs against a
2632 	 * new shared object that is directly bound.  With no copy-relocation
2633 	 * record, ld.so.1 has no data to trigger the normal vectoring of the
2634 	 * binding to the executable.
2635 	 *
2636 	 * Starting with Solaris 8, a DT_FLAGS entry is written to all objects,
2637 	 * regardless of there being any DF_ flags entries.  Therefore, an
2638 	 * object without this dynamic tag is susceptible to the copy relocation
2639 	 * issue.  If the executable has no DT_FLAGS tag, and contains the same
2640 	 * .bss symbol definition as has been directly bound to, redirect the
2641 	 * binding to the executables data definition.
2642 	 */
2643 	if (osym && ((FLAGS2(lmp) & FL2_RT_DTFLAGS) == 0) &&
2644 	    (FCT(lmp) == &elf_fct) &&
2645 	    (ELF_ST_TYPE(osym->st_info) != STT_FUNC) &&
2646 	    are_bits_zero(*dlmp, osym, 0)) {
2647 		Rt_map	*ilmp;
2648 		Sym	*isym;
2649 
2650 		sl = *slp;
2651 		sl.sl_imap = lmp;
2652 
2653 		/*
2654 		 * Determine whether the same symbol name exists within the
2655 		 * executable, that the size and type of symbol are the same,
2656 		 * and that the symbol is also associated with .bss.
2657 		 */
2658 		if (((isym = SYMINTP(lmp)(&sl, &ilmp, binfo,
2659 		    in_nfavl)) != NULL) && (isym->st_size == osym->st_size) &&
2660 		    (isym->st_info == osym->st_info) &&
2661 		    are_bits_zero(lmp, isym, 1)) {
2662 			*dlmp = lmp;
2663 			*binfo |= (DBG_BINFO_INTERPOSE | DBG_BINFO_COPYREF);
2664 			return (isym);
2665 		}
2666 	}
2667 
2668 	if ((lml->lm_flags & LML_FLG_INTRPOSE) == 0)
2669 		return (NULL);
2670 
2671 	/*
2672 	 * Traverse the list of known interposers to determine whether any
2673 	 * offer the same symbol.  Note, the head of the link-map could be
2674 	 * identified as an interposer.  Otherwise, skip the head of the
2675 	 * link-map, so that we don't bind to any .plt references, or
2676 	 * copy-relocation destinations unintentionally.
2677 	 */
2678 	lmp = lml->lm_head;
2679 	sl = *slp;
2680 
2681 	if (((FLAGS(lmp) & MSK_RT_INTPOSE) == 0) || (sl.sl_flags & LKUP_COPY))
2682 		lmp = NEXT_RT_MAP(lmp);
2683 
2684 	for (; lmp; lmp = NEXT_RT_MAP(lmp)) {
2685 		if (FLAGS(lmp) & FLG_RT_DELETE)
2686 			continue;
2687 		if ((FLAGS(lmp) & MSK_RT_INTPOSE) == 0)
2688 			break;
2689 
2690 		if (callable(lmp, clmp, 0, sl.sl_flags)) {
2691 			Rt_map	*ilmp;
2692 			Sym	*isym;
2693 
2694 			sl.sl_imap = lmp;
2695 			if (isym = SYMINTP(lmp)(&sl, &ilmp, binfo, in_nfavl)) {
2696 				/*
2697 				 * If this object provides individual symbol
2698 				 * interposers, make sure that the symbol we
2699 				 * have found is tagged as an interposer.
2700 				 */
2701 				if ((FLAGS(ilmp) & FLG_RT_SYMINTPO) &&
2702 				    (is_sym_interposer(ilmp, isym) == 0))
2703 					continue;
2704 
2705 				/*
2706 				 * Indicate this binding has occurred to an
2707 				 * interposer, and return the symbol.
2708 				 */
2709 				*binfo |= DBG_BINFO_INTERPOSE;
2710 				*dlmp = ilmp;
2711 				return (isym);
2712 			}
2713 		}
2714 	}
2715 	return (NULL);
2716 }
2717 
2718 /*
2719  * If an object specifies direct bindings (it contains a syminfo structure
2720  * describing where each binding was established during link-editing, and the
2721  * object was built -Bdirect), then look for the symbol in the specific object.
2722  */
2723 static Sym *
2724 lookup_sym_direct(Slookup *slp, Rt_map **dlmp, uint_t *binfo, Syminfo *sip,
2725     Rt_map *lmp, int *in_nfavl)
2726 {
2727 	Rt_map	*clmp = slp->sl_cmap;
2728 	Sym	*sym;
2729 	Slookup	sl;
2730 
2731 	/*
2732 	 * If a direct binding resolves to the definition of a copy relocated
2733 	 * variable, it must be redirected to the copy (in the executable) that
2734 	 * will eventually be made.  Typically, this redirection occurs in
2735 	 * lookup_sym_interpose().  But, there's an edge condition.  If a
2736 	 * directly bound executable contains pic code, there may be a
2737 	 * reference to a definition that will eventually have a copy made.
2738 	 * However, this copy relocation may not yet have occurred, because
2739 	 * the relocation making this reference comes before the relocation
2740 	 * that will create the copy.
2741 	 * Under direct bindings, the syminfo indicates that a copy will be
2742 	 * taken (SYMINFO_FLG_COPY).  This can only be set in an executable.
2743 	 * Thus, the caller must be the executable, so bind to the destination
2744 	 * of the copy within the executable.
2745 	 */
2746 	if (((slp->sl_flags & LKUP_COPY) == 0) &&
2747 	    (sip->si_flags & SYMINFO_FLG_COPY)) {
2748 
2749 		slp->sl_imap = LIST(clmp)->lm_head;
2750 		if (sym = SYMINTP(clmp)(slp, dlmp, binfo, in_nfavl))
2751 			*binfo |= (DBG_BINFO_DIRECT | DBG_BINFO_COPYREF);
2752 		return (sym);
2753 	}
2754 
2755 	/*
2756 	 * If we need to directly bind to our parent, start looking in each
2757 	 * callers link map.
2758 	 */
2759 	sl = *slp;
2760 	sl.sl_flags |= LKUP_DIRECT;
2761 	sym = NULL;
2762 
2763 	if (sip->si_boundto == SYMINFO_BT_PARENT) {
2764 		Aliste		idx1;
2765 		Bnd_desc	*bdp;
2766 		Grp_hdl		*ghp;
2767 
2768 		/*
2769 		 * Determine the parent of this explicit dependency from its
2770 		 * CALLERS()'s list.
2771 		 */
2772 		for (APLIST_TRAVERSE(CALLERS(clmp), idx1, bdp)) {
2773 			sl.sl_imap = lmp = bdp->b_caller;
2774 			if ((sym = SYMINTP(lmp)(&sl, dlmp, binfo,
2775 			    in_nfavl)) != NULL)
2776 				goto found;
2777 		}
2778 
2779 		/*
2780 		 * A caller can also be defined as the parent of a dlopen()
2781 		 * call.  Determine whether this object has any handles.  The
2782 		 * dependencies maintained with the handle represent the
2783 		 * explicit dependencies of the dlopen()'ed object, and the
2784 		 * calling parent.
2785 		 */
2786 		for (APLIST_TRAVERSE(HANDLES(clmp), idx1, ghp)) {
2787 			Grp_desc	*gdp;
2788 			Aliste		idx2;
2789 
2790 			for (ALIST_TRAVERSE(ghp->gh_depends, idx2, gdp)) {
2791 				if ((gdp->gd_flags & GPD_PARENT) == 0)
2792 					continue;
2793 				sl.sl_imap = lmp = gdp->gd_depend;
2794 				if ((sym = SYMINTP(lmp)(&sl, dlmp,
2795 				    binfo, in_nfavl)) != NULL)
2796 					goto found;
2797 			}
2798 		}
2799 	} else {
2800 		/*
2801 		 * If we need to direct bind to anything else look in the
2802 		 * link map associated with this symbol reference.
2803 		 */
2804 		if (sip->si_boundto == SYMINFO_BT_SELF)
2805 			sl.sl_imap = lmp = clmp;
2806 		else
2807 			sl.sl_imap = lmp;
2808 
2809 		if (lmp)
2810 			sym = SYMINTP(lmp)(&sl, dlmp, binfo, in_nfavl);
2811 	}
2812 found:
2813 	if (sym)
2814 		*binfo |= DBG_BINFO_DIRECT;
2815 
2816 	/*
2817 	 * If a reference to a directly bound symbol can't be satisfied, then
2818 	 * determine whether an interposer can provide the missing symbol.  If
2819 	 * a reference to a directly bound symbol is satisfied, then determine
2820 	 * whether that object can be interposed upon for this symbol.
2821 	 */
2822 	if ((sym == NULL) || ((LIST(*dlmp)->lm_head != *dlmp) &&
2823 	    (LIST(*dlmp) == LIST(clmp)))) {
2824 		Sym	*isym;
2825 
2826 		if ((isym = lookup_sym_interpose(slp, dlmp, binfo, sym,
2827 		    in_nfavl)) != 0)
2828 			return (isym);
2829 	}
2830 
2831 	return (sym);
2832 }
2833 
2834 static Sym *
2835 core_lookup_sym(Rt_map *ilmp, Slookup *slp, Rt_map **dlmp, uint_t *binfo,
2836     Aliste off, int *in_nfavl)
2837 {
2838 	Rt_map	*lmp;
2839 
2840 	/*
2841 	 * Copy relocations should start their search after the head of the
2842 	 * main link-map control list.
2843 	 */
2844 	if ((off == ALIST_OFF_DATA) && (slp->sl_flags & LKUP_COPY) && ilmp)
2845 		lmp = NEXT_RT_MAP(ilmp);
2846 	else
2847 		lmp = ilmp;
2848 
2849 	for (; lmp; lmp = NEXT_RT_MAP(lmp)) {
2850 		if (callable(slp->sl_cmap, lmp, 0, slp->sl_flags)) {
2851 			Sym	*sym;
2852 
2853 			slp->sl_imap = lmp;
2854 			if (((sym = SYMINTP(lmp)(slp, dlmp, binfo,
2855 			    in_nfavl)) != NULL) ||
2856 			    (*binfo & BINFO_MSK_TRYAGAIN))
2857 				return (sym);
2858 		}
2859 	}
2860 	return (NULL);
2861 }
2862 
2863 static Sym *
2864 _lazy_find_sym(Rt_map *ilmp, Slookup *slp, Rt_map **dlmp, uint_t *binfo,
2865     int *in_nfavl)
2866 {
2867 	Rt_map	*lmp;
2868 
2869 	for (lmp = ilmp; lmp; lmp = NEXT_RT_MAP(lmp)) {
2870 		if (LAZY(lmp) == 0)
2871 			continue;
2872 		if (callable(slp->sl_cmap, lmp, 0, slp->sl_flags)) {
2873 			Sym	*sym;
2874 
2875 			slp->sl_imap = lmp;
2876 			if ((sym = elf_lazy_find_sym(slp, dlmp, binfo,
2877 			    in_nfavl)) != 0)
2878 				return (sym);
2879 		}
2880 	}
2881 	return (NULL);
2882 }
2883 
2884 static Sym *
2885 _lookup_sym(Slookup *slp, Rt_map **dlmp, uint_t *binfo, int *in_nfavl)
2886 {
2887 	const char	*name = slp->sl_name;
2888 	Rt_map		*clmp = slp->sl_cmap;
2889 	Lm_list		*lml = LIST(clmp);
2890 	Rt_map		*ilmp = slp->sl_imap, *lmp;
2891 	ulong_t		rsymndx;
2892 	Sym		*sym;
2893 	Syminfo		*sip;
2894 	Slookup		sl;
2895 
2896 	/*
2897 	 * Search the initial link map for the required symbol (this category is
2898 	 * selected by dlsym(), where individual link maps are searched for a
2899 	 * required symbol.  Therefore, we know we have permission to look at
2900 	 * the link map).
2901 	 */
2902 	if (slp->sl_flags & LKUP_FIRST)
2903 		return (SYMINTP(ilmp)(slp, dlmp, binfo, in_nfavl));
2904 
2905 	/*
2906 	 * Determine whether this lookup can be satisfied by an objects direct,
2907 	 * or lazy binding information.  This is triggered by a relocation from
2908 	 * the object (hence rsymndx is set).
2909 	 */
2910 	if (((rsymndx = slp->sl_rsymndx) != 0) &&
2911 	    ((sip = SYMINFO(clmp)) != NULL)) {
2912 		uint_t	bound;
2913 
2914 		/*
2915 		 * Find the corresponding Syminfo entry for the original
2916 		 * referencing symbol.
2917 		 */
2918 		/* LINTED */
2919 		sip = (Syminfo *)((char *)sip + (rsymndx * SYMINENT(clmp)));
2920 		bound = sip->si_boundto;
2921 
2922 		/*
2923 		 * Identify any EXTERN or PARENT references for ldd(1).
2924 		 */
2925 		if ((lml->lm_flags & LML_FLG_TRC_WARN) &&
2926 		    (bound > SYMINFO_BT_LOWRESERVE)) {
2927 			if (bound == SYMINFO_BT_PARENT)
2928 				*binfo |= DBG_BINFO_REF_PARENT;
2929 			if (bound == SYMINFO_BT_EXTERN)
2930 				*binfo |= DBG_BINFO_REF_EXTERN;
2931 		}
2932 
2933 		/*
2934 		 * If the symbol information indicates a direct binding,
2935 		 * determine the link map that is required to satisfy the
2936 		 * binding.  Note, if the dependency can not be found, but a
2937 		 * direct binding isn't required, we will still fall through
2938 		 * to perform any default symbol search.
2939 		 */
2940 		if (sip->si_flags & SYMINFO_FLG_DIRECT) {
2941 
2942 			lmp = 0;
2943 			if (bound < SYMINFO_BT_LOWRESERVE)
2944 				lmp = elf_lazy_load(clmp, slp, bound,
2945 				    name, in_nfavl);
2946 
2947 			/*
2948 			 * If direct bindings have been disabled, and this isn't
2949 			 * a translator, skip any direct binding now that we've
2950 			 * ensured the resolving object has been loaded.
2951 			 *
2952 			 * If we need to direct bind to anything, we look in
2953 			 * ourselves, our parent, or in the link map we've just
2954 			 * loaded.  Otherwise, even though we may have lazily
2955 			 * loaded an object we still continue to search for
2956 			 * symbols from the head of the link map list.
2957 			 */
2958 			if (((FLAGS(clmp) & FLG_RT_TRANS) ||
2959 			    (((lml->lm_tflags & LML_TFLG_NODIRECT) == 0) &&
2960 			    ((slp->sl_flags & LKUP_SINGLETON) == 0))) &&
2961 			    ((FLAGS1(clmp) & FL1_RT_DIRECT) ||
2962 			    (sip->si_flags & SYMINFO_FLG_DIRECTBIND))) {
2963 				sym = lookup_sym_direct(slp, dlmp, binfo,
2964 				    sip, lmp, in_nfavl);
2965 
2966 				/*
2967 				 * Determine whether this direct binding has
2968 				 * been rejected.  If we've bound to a singleton
2969 				 * without following a singleton search, then
2970 				 * return.  The caller detects this condition
2971 				 * and will trigger a new singleton search.
2972 				 *
2973 				 * For any other rejection (such as binding to
2974 				 * a symbol labeled as nodirect - presumably
2975 				 * because the symbol definition has been
2976 				 * changed since the referring object was last
2977 				 * built), fall through to a standard symbol
2978 				 * search.
2979 				 */
2980 				if (((*binfo & BINFO_MSK_REJECTED) == 0) ||
2981 				    (*binfo & BINFO_MSK_TRYAGAIN))
2982 					return (sym);
2983 
2984 				*binfo &= ~BINFO_MSK_REJECTED;
2985 			}
2986 		}
2987 	}
2988 
2989 	/*
2990 	 * Duplicate the lookup information, as we'll need to modify this
2991 	 * information for some of the following searches.
2992 	 */
2993 	sl = *slp;
2994 
2995 	/*
2996 	 * If the referencing object has the DF_SYMBOLIC flag set, look in the
2997 	 * referencing object for the symbol first.  Failing that, fall back to
2998 	 * our generic search.
2999 	 */
3000 	if ((FLAGS1(clmp) & FL1_RT_SYMBOLIC) &&
3001 	    ((sl.sl_flags & LKUP_SINGLETON) == 0)) {
3002 		sl.sl_imap = clmp;
3003 		if (sym = SYMINTP(clmp)(&sl, dlmp, binfo, in_nfavl)) {
3004 			ulong_t	dsymndx = (((ulong_t)sym -
3005 			    (ulong_t)SYMTAB(*dlmp)) / SYMENT(*dlmp));
3006 
3007 			/*
3008 			 * Make sure this symbol hasn't explicitly been defined
3009 			 * as nodirect.
3010 			 */
3011 			if (((sip = SYMINFO(*dlmp)) == 0) ||
3012 			    /* LINTED */
3013 			    ((sip = (Syminfo *)((char *)sip +
3014 			    (dsymndx * SYMINENT(*dlmp)))) == 0) ||
3015 			    ((sip->si_flags & SYMINFO_FLG_NOEXTDIRECT) == 0))
3016 				return (sym);
3017 		}
3018 	}
3019 
3020 	sl.sl_flags |= LKUP_STANDARD;
3021 
3022 	/*
3023 	 * If this lookup originates from a standard relocation, then traverse
3024 	 * all link-map control lists, inspecting any object that is available
3025 	 * to this caller.  Otherwise, traverse the link-map control list
3026 	 * associated with the caller.
3027 	 */
3028 	if (sl.sl_flags & LKUP_STDRELOC) {
3029 		Aliste	off;
3030 		Lm_cntl	*lmc;
3031 
3032 		sym = NULL;
3033 
3034 		for (ALIST_TRAVERSE_BY_OFFSET(lml->lm_lists, off, lmc)) {
3035 			if (((sym = core_lookup_sym(lmc->lc_head, &sl, dlmp,
3036 			    binfo, off, in_nfavl)) != NULL) ||
3037 			    (*binfo & BINFO_MSK_TRYAGAIN))
3038 				break;
3039 		}
3040 	} else
3041 		sym = core_lookup_sym(ilmp, &sl, dlmp, binfo, ALIST_OFF_DATA,
3042 		    in_nfavl);
3043 
3044 	/*
3045 	 * If a symbol binding should be retried, return so that the search can
3046 	 * be repeated.
3047 	 */
3048 	if (*binfo & BINFO_MSK_TRYAGAIN)
3049 		return (sym);
3050 
3051 	/*
3052 	 * To allow transitioning into a world of lazy loading dependencies see
3053 	 * if this link map contains objects that have lazy dependencies still
3054 	 * outstanding.  If so, and we haven't been able to locate a non-weak
3055 	 * symbol reference, start bringing in any lazy dependencies to see if
3056 	 * the reference can be satisfied.  Use of dlsym(RTLD_PROBE) sets the
3057 	 * LKUP_NOFALLBACK flag, and this flag disables this fall back.
3058 	 */
3059 	if ((sym == NULL) && ((sl.sl_flags & LKUP_NOFALLBACK) == 0)) {
3060 		if ((lmp = ilmp) == 0)
3061 			lmp = LIST(clmp)->lm_head;
3062 
3063 		lml = LIST(lmp);
3064 		if ((sl.sl_flags & LKUP_WEAK) || (lml->lm_lazy == 0))
3065 			return (NULL);
3066 
3067 		DBG_CALL(Dbg_syms_lazy_rescan(lml, name));
3068 
3069 		/*
3070 		 * If this request originated from a dlsym(RTLD_NEXT) then start
3071 		 * looking for dependencies from the caller, otherwise use the
3072 		 * initial link-map.
3073 		 */
3074 		if (sl.sl_flags & LKUP_NEXT)
3075 			sym = _lazy_find_sym(clmp, &sl, dlmp, binfo, in_nfavl);
3076 		else {
3077 			Aliste	idx;
3078 			Lm_cntl	*lmc;
3079 
3080 			for (ALIST_TRAVERSE(lml->lm_lists, idx, lmc)) {
3081 				sl.sl_flags |= LKUP_NOFALLBACK;
3082 				if ((sym = _lazy_find_sym(lmc->lc_head, &sl,
3083 				    dlmp, binfo, in_nfavl)) != 0)
3084 					break;
3085 			}
3086 		}
3087 	}
3088 	return (sym);
3089 }
3090 
3091 /*
3092  * Symbol lookup routine.  Takes an ELF symbol name, and a list of link maps to
3093  * search.  If successful, return a pointer to the symbol table entry, a
3094  * pointer to the link map of the enclosing object, and information relating
3095  * to the type of binding.  Else return a null pointer.
3096  *
3097  * To improve elf performance, we first compute the elf hash value and pass
3098  * it to each find_sym() routine.  The elf function will use this value to
3099  * locate the symbol, the a.out function will simply ignore it.
3100  */
3101 Sym *
3102 lookup_sym(Slookup *slp, Rt_map **dlmp, uint_t *binfo, int *in_nfavl)
3103 {
3104 	Rt_map		*clmp = slp->sl_cmap;
3105 	Sym		*rsym = slp->sl_rsym, *sym = 0;
3106 	uchar_t		rtype = slp->sl_rtype;
3107 	int		mode;
3108 
3109 	if (slp->sl_hash == 0)
3110 		slp->sl_hash = elf_hash(slp->sl_name);
3111 	*binfo = 0;
3112 
3113 	/*
3114 	 * Establish any state that might be associated with a symbol reference.
3115 	 */
3116 	if (rsym) {
3117 		if ((slp->sl_flags & LKUP_STDRELOC) &&
3118 		    (ELF_ST_BIND(rsym->st_info) == STB_WEAK))
3119 			slp->sl_flags |= LKUP_WEAK;
3120 
3121 		if (ELF_ST_VISIBILITY(rsym->st_other) == STV_SINGLETON)
3122 			slp->sl_flags |= LKUP_SINGLETON;
3123 	}
3124 
3125 	/*
3126 	 * Establish any lookup state required for this type of relocation.
3127 	 */
3128 	if ((slp->sl_flags & LKUP_STDRELOC) && rtype) {
3129 		if (rtype == M_R_COPY)
3130 			slp->sl_flags |= LKUP_COPY;
3131 
3132 		if (rtype != M_R_JMP_SLOT)
3133 			slp->sl_flags |= LKUP_SPEC;
3134 	}
3135 
3136 	/*
3137 	 * Under ldd -w, any unresolved weak references are diagnosed.  Set the
3138 	 * symbol binding as global to trigger a relocation error if the symbol
3139 	 * can not be found.
3140 	 */
3141 	if (rsym) {
3142 		if (LIST(slp->sl_cmap)->lm_flags & LML_FLG_TRC_NOUNRESWEAK)
3143 			slp->sl_bind = STB_GLOBAL;
3144 		else if ((slp->sl_bind = ELF_ST_BIND(rsym->st_info)) ==
3145 		    STB_WEAK)
3146 			slp->sl_flags |= LKUP_WEAK;
3147 	}
3148 
3149 	/*
3150 	 * Save the callers MODE().
3151 	 */
3152 	mode = MODE(clmp);
3153 
3154 	/*
3155 	 * Carry out an initial symbol search.  This search takes into account
3156 	 * all the modes of the requested search.
3157 	 */
3158 	if (((sym = _lookup_sym(slp, dlmp, binfo, in_nfavl)) == NULL) &&
3159 	    (*binfo & BINFO_MSK_TRYAGAIN)) {
3160 		Slookup	sl = *slp;
3161 
3162 		/*
3163 		 * Try the symbol search again.  This retry can be necessary if:
3164 		 *
3165 		 *  .	a binding has been rejected because of binding to a
3166 		 *	singleton without going through a singleton search.
3167 		 *  .	a group binding has resulted in binding to a symbol
3168 		 *	that indicates no-direct binding.
3169 		 *
3170 		 * Reset the lookup data, and try again.
3171 		 */
3172 		sl.sl_imap = LIST(sl.sl_cmap)->lm_head;
3173 		sl.sl_flags &= ~(LKUP_FIRST | LKUP_SELF | LKUP_NEXT);
3174 		sl.sl_rsymndx = 0;
3175 
3176 		if (*binfo & BINFO_REJSINGLE)
3177 			sl.sl_flags |= LKUP_SINGLETON;
3178 		if (*binfo & BINFO_REJGROUP) {
3179 			sl.sl_flags |= LKUP_WORLD;
3180 			mode |= RTLD_WORLD;
3181 		}
3182 		*binfo &= ~BINFO_MSK_REJECTED;
3183 
3184 		sym = _lookup_sym(&sl, dlmp, binfo, in_nfavl);
3185 	}
3186 
3187 	/*
3188 	 * If the caller is restricted to a symbol search within its group,
3189 	 * determine if it is necessary to follow a binding from outside of
3190 	 * the group.
3191 	 */
3192 	if ((mode & (RTLD_GROUP | RTLD_WORLD)) == RTLD_GROUP) {
3193 		Sym	*isym;
3194 
3195 		if ((isym = lookup_sym_interpose(slp, dlmp, binfo, sym,
3196 		    in_nfavl)) != NULL)
3197 			return (isym);
3198 	}
3199 	return (sym);
3200 }
3201 
3202 /*
3203  * Associate a binding descriptor with a caller and its dependency, or update
3204  * an existing descriptor.
3205  */
3206 int
3207 bind_one(Rt_map *clmp, Rt_map *dlmp, uint_t flags)
3208 {
3209 	Bnd_desc	*bdp;
3210 	Aliste		idx;
3211 	int		found = ALE_CREATE;
3212 
3213 	/*
3214 	 * Determine whether a binding descriptor already exists between the
3215 	 * two objects.
3216 	 */
3217 	for (APLIST_TRAVERSE(DEPENDS(clmp), idx, bdp)) {
3218 		if (bdp->b_depend == dlmp) {
3219 			found = ALE_EXISTS;
3220 			break;
3221 		}
3222 	}
3223 
3224 	if (found == ALE_CREATE) {
3225 		/*
3226 		 * Create a new binding descriptor.
3227 		 */
3228 		if ((bdp = malloc(sizeof (Bnd_desc))) == NULL)
3229 			return (0);
3230 
3231 		bdp->b_caller = clmp;
3232 		bdp->b_depend = dlmp;
3233 		bdp->b_flags = 0;
3234 
3235 		/*
3236 		 * Append the binding descriptor to the caller and the
3237 		 * dependency.
3238 		 */
3239 		if (aplist_append(&DEPENDS(clmp), bdp, AL_CNT_DEPENDS) == 0)
3240 			return (0);
3241 
3242 		if (aplist_append(&CALLERS(dlmp), bdp, AL_CNT_CALLERS) == 0)
3243 			return (0);
3244 	}
3245 
3246 	if ((found == ALE_CREATE) || ((bdp->b_flags & flags) != flags)) {
3247 		bdp->b_flags |= flags;
3248 
3249 		if (flags & BND_REFER)
3250 			FLAGS1(dlmp) |= FL1_RT_USED;
3251 
3252 		DBG_CALL(Dbg_file_bind_entry(LIST(clmp), bdp));
3253 	}
3254 	return (found);
3255 }
3256 
3257 /*
3258  * Cleanup after relocation processing.
3259  */
3260 int
3261 relocate_finish(Rt_map *lmp, APlist *bound, int textrel, int ret)
3262 {
3263 	DBG_CALL(Dbg_reloc_run(lmp, 0, ret, DBG_REL_FINISH));
3264 
3265 	/*
3266 	 * Establish bindings to all objects that have been bound to.
3267 	 */
3268 	if (bound) {
3269 		Aliste	idx;
3270 		Rt_map	*_lmp;
3271 		Word	used;
3272 
3273 		/*
3274 		 * Only create bindings if the callers relocation was
3275 		 * successful (ret != 0), otherwise the object will eventually
3276 		 * be torn down.  Create these bindings if running under ldd(1)
3277 		 * with the -U/-u options regardless of relocation errors, as
3278 		 * the unused processing needs to traverse these bindings to
3279 		 * diagnose unused objects.
3280 		 */
3281 		used = LIST(lmp)->lm_flags &
3282 		    (LML_FLG_TRC_UNREF | LML_FLG_TRC_UNUSED);
3283 
3284 		if (ret || used) {
3285 			for (APLIST_TRAVERSE(bound, idx, _lmp)) {
3286 				if (bind_one(lmp, _lmp, BND_REFER) || used)
3287 					continue;
3288 
3289 				ret = 0;
3290 				break;
3291 			}
3292 		}
3293 		free(bound);
3294 	}
3295 
3296 	/*
3297 	 * If we write enabled the text segment to perform these relocations
3298 	 * re-protect by disabling writes.
3299 	 */
3300 	if (textrel)
3301 		(void) LM_SET_PROT(lmp)(lmp, 0);
3302 
3303 	return (ret);
3304 }
3305