xref: /illumos-gate/usr/src/cmd/sgs/rtld/common/elf.c (revision 7e16fca0)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  *	Copyright (c) 1988 AT&T
29  *	  All Rights Reserved
30  */
31 
32 /*
33  * Object file dependent support for ELF objects.
34  */
35 
36 #include	<stdio.h>
37 #include	<sys/procfs.h>
38 #include	<sys/mman.h>
39 #include	<sys/debug.h>
40 #include	<string.h>
41 #include	<limits.h>
42 #include	<dlfcn.h>
43 #include	<debug.h>
44 #include	<conv.h>
45 #include	"_rtld.h"
46 #include	"_audit.h"
47 #include	"_elf.h"
48 #include	"_inline.h"
49 #include	"msg.h"
50 
51 /*
52  * Default and secure dependency search paths.
53  */
54 static Spath_defn _elf_def_dirs[] = {
55 #if	defined(_ELF64)
56 	{ MSG_ORIG(MSG_PTH_LIB_64),		MSG_PTH_LIB_64_SIZE },
57 	{ MSG_ORIG(MSG_PTH_USRLIB_64),		MSG_PTH_USRLIB_64_SIZE },
58 #else
59 	{ MSG_ORIG(MSG_PTH_LIB),		MSG_PTH_LIB_SIZE },
60 	{ MSG_ORIG(MSG_PTH_USRLIB),		MSG_PTH_USRLIB_SIZE },
61 #endif
62 	{ 0, 0 }
63 };
64 
65 static Spath_defn _elf_sec_dirs[] = {
66 #if	defined(_ELF64)
67 	{ MSG_ORIG(MSG_PTH_LIBSE_64),		MSG_PTH_LIBSE_64_SIZE },
68 	{ MSG_ORIG(MSG_PTH_USRLIBSE_64),	MSG_PTH_USRLIBSE_64_SIZE },
69 #else
70 	{ MSG_ORIG(MSG_PTH_LIBSE),		MSG_PTH_LIBSE_SIZE },
71 	{ MSG_ORIG(MSG_PTH_USRLIBSE),		MSG_PTH_USRLIBSE_SIZE },
72 #endif
73 	{ 0, 0 }
74 };
75 
76 Alist	*elf_def_dirs = NULL;
77 Alist	*elf_sec_dirs = NULL;
78 
79 /*
80  * Defines for local functions.
81  */
82 static void	elf_dladdr(ulong_t, Rt_map *, Dl_info *, void **, int);
83 static Addr	elf_entry_point(void);
84 static int	elf_fix_name(const char *, Rt_map *, Alist **, Aliste, uint_t);
85 static Alist	**elf_get_def_dirs(void);
86 static Alist	**elf_get_sec_dirs(void);
87 static char	*elf_get_so(const char *, const char *, size_t, size_t);
88 static int	elf_needed(Lm_list *, Aliste, Rt_map *, int *);
89 
90 /*
91  * Functions and data accessed through indirect pointers.
92  */
93 Fct elf_fct = {
94 	elf_verify,
95 	elf_new_lmp,
96 	elf_entry_point,
97 	elf_needed,
98 	lookup_sym,
99 	elf_reloc,
100 	elf_get_def_dirs,
101 	elf_get_sec_dirs,
102 	elf_fix_name,
103 	elf_get_so,
104 	elf_dladdr,
105 	dlsym_handle
106 };
107 
108 /*
109  * Default and secure dependency search paths.
110  */
111 static Alist **
112 elf_get_def_dirs()
113 {
114 	if (elf_def_dirs == NULL)
115 		set_dirs(&elf_def_dirs, _elf_def_dirs, LA_SER_DEFAULT);
116 	return (&elf_def_dirs);
117 }
118 
119 static Alist **
120 elf_get_sec_dirs()
121 {
122 	if (elf_sec_dirs == NULL)
123 		set_dirs(&elf_sec_dirs, _elf_sec_dirs, LA_SER_SECURE);
124 	return (&elf_sec_dirs);
125 }
126 
127 /*
128  * Redefine NEEDED name if necessary.
129  */
130 static int
131 elf_fix_name(const char *name, Rt_map *clmp, Alist **alpp, Aliste alni,
132     uint_t orig)
133 {
134 	/*
135 	 * For ABI compliance, if we are asked for ld.so.1, then really give
136 	 * them libsys.so.1 (the SONAME of libsys.so.1 is ld.so.1).
137 	 */
138 	if (((*name == '/') &&
139 	/* BEGIN CSTYLED */
140 #if	defined(_ELF64)
141 	    (strcmp(name, MSG_ORIG(MSG_PTH_RTLD_64)) == 0)) ||
142 #else
143 	    (strcmp(name, MSG_ORIG(MSG_PTH_RTLD)) == 0)) ||
144 #endif
145 	    (strcmp(name, MSG_ORIG(MSG_FIL_RTLD)) == 0)) {
146 		/* END CSTYLED */
147 		Pdesc	*pdp;
148 
149 		DBG_CALL(Dbg_file_fixname(LIST(clmp), name,
150 		    MSG_ORIG(MSG_PTH_LIBSYS)));
151 		if ((pdp = alist_append(alpp, 0, sizeof (Pdesc), alni)) == NULL)
152 			return (0);
153 
154 		pdp->pd_pname = (char *)MSG_ORIG(MSG_PTH_LIBSYS);
155 		pdp->pd_plen = MSG_PTH_LIBSYS_SIZE;
156 		pdp->pd_flags = PD_FLG_PNSLASH;
157 
158 		return (1);
159 	}
160 
161 	return (expand_paths(clmp, name, alpp, alni, orig, 0));
162 }
163 
164 /*
165  * Determine whether this object requires any hardware or software capabilities.
166  */
167 static int
168 elf_cap_check(Fdesc *fdp, Ehdr *ehdr, Rej_desc *rej)
169 {
170 	Phdr	*phdr;
171 	int	cnt;
172 
173 	/* LINTED */
174 	phdr = (Phdr *)((char *)ehdr + ehdr->e_phoff);
175 	for (cnt = 0; cnt < ehdr->e_phnum; cnt++, phdr++) {
176 		Cap	*cptr;
177 
178 		if (phdr->p_type != PT_SUNWCAP)
179 			continue;
180 
181 		/* LINTED */
182 		cptr = (Cap *)((char *)ehdr + phdr->p_offset);
183 		while (cptr->c_tag != CA_SUNW_NULL) {
184 			if (cptr->c_tag == CA_SUNW_HW_1) {
185 				/*
186 				 * Verify the hardware capabilities.
187 				 */
188 				if (hwcap_check(cptr->c_un.c_val, rej) == 0)
189 					return (0);
190 
191 				/*
192 				 * Retain this hardware capabilities value for
193 				 * possible later inspection should this object
194 				 * be processed as a filtee.
195 				 */
196 				fdp->fd_hwcap = cptr->c_un.c_val;
197 			}
198 			if (cptr->c_tag == CA_SUNW_SF_1) {
199 				/*
200 				 * Verify the software capabilities.
201 				 */
202 				if (sfcap_check(cptr->c_un.c_val, rej) == 0)
203 					return (0);
204 			}
205 			cptr++;
206 		}
207 	}
208 	return (1);
209 }
210 
211 /*
212  * Determine if we have been given an ELF file and if so determine if the file
213  * is compatible.  Returns 1 if true, else 0 and sets the reject descriptor
214  * with associated error information.
215  */
216 Fct *
217 elf_verify(caddr_t addr, size_t size, Fdesc *fdp, const char *name,
218     Rej_desc *rej)
219 {
220 	Ehdr	*ehdr;
221 	char	*caddr = (char *)addr;
222 
223 	/*
224 	 * Determine if we're an elf file.  If not simply return, we don't set
225 	 * any rejection information as this test allows use to scroll through
226 	 * the objects we support (ELF, AOUT).
227 	 */
228 	if (size < sizeof (Ehdr) ||
229 	    caddr[EI_MAG0] != ELFMAG0 ||
230 	    caddr[EI_MAG1] != ELFMAG1 ||
231 	    caddr[EI_MAG2] != ELFMAG2 ||
232 	    caddr[EI_MAG3] != ELFMAG3) {
233 		return (NULL);
234 	}
235 
236 	/*
237 	 * Check class and encoding.
238 	 */
239 	/* LINTED */
240 	ehdr = (Ehdr *)addr;
241 	if (ehdr->e_ident[EI_CLASS] != M_CLASS) {
242 		rej->rej_type = SGS_REJ_CLASS;
243 		rej->rej_info = (uint_t)ehdr->e_ident[EI_CLASS];
244 		return (NULL);
245 	}
246 	if (ehdr->e_ident[EI_DATA] != M_DATA) {
247 		rej->rej_type = SGS_REJ_DATA;
248 		rej->rej_info = (uint_t)ehdr->e_ident[EI_DATA];
249 		return (NULL);
250 	}
251 	if ((ehdr->e_type != ET_REL) && (ehdr->e_type != ET_EXEC) &&
252 	    (ehdr->e_type != ET_DYN)) {
253 		rej->rej_type = SGS_REJ_TYPE;
254 		rej->rej_info = (uint_t)ehdr->e_type;
255 		return (NULL);
256 	}
257 
258 	/*
259 	 * Verify ELF version.
260 	 */
261 	if (ehdr->e_version > EV_CURRENT) {
262 		rej->rej_type = SGS_REJ_VERSION;
263 		rej->rej_info = (uint_t)ehdr->e_version;
264 		return (NULL);
265 	}
266 
267 	/*
268 	 * Verify machine specific flags.
269 	 */
270 	if (elf_mach_flags_check(rej, ehdr) == 0)
271 		return (NULL);
272 
273 	/*
274 	 * Verify any hardware/software capability requirements.  Note, if this
275 	 * object is an explicitly defined shared object under inspection by
276 	 * ldd(1), and contains an incompatible hardware capabilities
277 	 * requirement, then inform the user, but continue processing.
278 	 */
279 	if (elf_cap_check(fdp, ehdr, rej) == 0) {
280 		Rt_map	*lmp = lml_main.lm_head;
281 
282 		if ((lml_main.lm_flags & LML_FLG_TRC_LDDSTUB) &&
283 		    (lmp != NULL) && (FLAGS1(lmp) & FL1_RT_LDDSTUB) &&
284 		    (NEXT(lmp) == NULL)) {
285 			const char	*fmt;
286 
287 			if (rej->rej_type == SGS_REJ_HWCAP_1)
288 				fmt = MSG_INTL(MSG_LDD_GEN_HWCAP_1);
289 			else
290 				fmt = MSG_INTL(MSG_LDD_GEN_SFCAP_1);
291 			(void) printf(fmt, name, rej->rej_str);
292 			return (&elf_fct);
293 		}
294 		return (NULL);
295 	}
296 	return (&elf_fct);
297 }
298 
299 /*
300  * The runtime linker employs lazy loading to provide the libraries needed for
301  * debugging, preloading .o's and dldump().  As these are seldom used, the
302  * standard startup of ld.so.1 doesn't initialize all the information necessary
303  * to perform plt relocation on ld.so.1's link-map.  The first time lazy loading
304  * is called we get here to perform these initializations:
305  *
306  *  o	elf_needed() is called to set up the DYNINFO() indexes for each lazy
307  *	dependency.  Typically, for all other objects, this is called during
308  *	analyze_so(), but as ld.so.1 is set-contained we skip this processing.
309  *
310  *  o	For intel, ld.so.1's JMPSLOT relocations need relative updates. These
311  *	are by default skipped thus delaying all relative relocation processing
312  * 	on every invocation of ld.so.1.
313  */
314 int
315 elf_rtld_load()
316 {
317 	Lm_list	*lml = &lml_rtld;
318 	Rt_map	*lmp = lml->lm_head;
319 
320 	if (lml->lm_flags & LML_FLG_PLTREL)
321 		return (1);
322 
323 	/*
324 	 * As we need to refer to the DYNINFO() information, insure that it has
325 	 * been initialized.
326 	 */
327 	if (elf_needed(lml, ALIST_OFF_DATA, lmp, NULL) == 0)
328 		return (0);
329 
330 #if	defined(__i386)
331 	/*
332 	 * This is a kludge to give ld.so.1 a performance benefit on i386.
333 	 * It's based around two factors.
334 	 *
335 	 *  o	JMPSLOT relocations (PLT's) actually need a relative relocation
336 	 *	applied to the GOT entry so that they can find PLT0.
337 	 *
338 	 *  o	ld.so.1 does not exercise *any* PLT's before it has made a call
339 	 *	to elf_lazy_load().  This is because all dynamic dependencies
340 	 * 	are recorded as lazy dependencies.
341 	 */
342 	(void) elf_reloc_relative_count((ulong_t)JMPREL(lmp),
343 	    (ulong_t)(PLTRELSZ(lmp) / RELENT(lmp)), (ulong_t)RELENT(lmp),
344 	    (ulong_t)ADDR(lmp), lmp, NULL);
345 #endif
346 
347 	lml->lm_flags |= LML_FLG_PLTREL;
348 	return (1);
349 }
350 
351 /*
352  * Lazy load an object.
353  */
354 Rt_map *
355 elf_lazy_load(Rt_map *clmp, Slookup *slp, uint_t ndx, const char *sym,
356     int *in_nfavl)
357 {
358 	Alist		*palp = NULL;
359 	Rt_map		*nlmp, *hlmp;
360 	Dyninfo		*dip = &DYNINFO(clmp)[ndx], *pdip;
361 	uint_t		flags = 0;
362 	const char	*name;
363 	Lm_list		*lml = LIST(clmp);
364 	Aliste		lmco;
365 
366 	/*
367 	 * If this dependency has already been processed, we're done.
368 	 */
369 	if (((nlmp = (Rt_map *)dip->di_info) != NULL) ||
370 	    (dip->di_flags & FLG_DI_LDD_DONE))
371 		return (nlmp);
372 
373 	/*
374 	 * If we're running under ldd(1), indicate that this dependency has been
375 	 * processed (see test above).  It doesn't matter whether the object is
376 	 * successfully loaded or not, this flag simply ensures that we don't
377 	 * repeatedly attempt to load an object that has already failed to load.
378 	 * To do so would create multiple failure diagnostics for the same
379 	 * object under ldd(1).
380 	 */
381 	if (lml->lm_flags & LML_FLG_TRC_ENABLE)
382 		dip->di_flags |= FLG_DI_LDD_DONE;
383 
384 	/*
385 	 * Determine the initial dependency name.
386 	 */
387 	name = STRTAB(clmp) + DYN(clmp)[ndx].d_un.d_val;
388 	DBG_CALL(Dbg_file_lazyload(clmp, name, sym));
389 
390 	/*
391 	 * If this object needs to establish its own group, make sure a handle
392 	 * is created.
393 	 */
394 	if (dip->di_flags & FLG_DI_GROUP)
395 		flags |= (FLG_RT_SETGROUP | FLG_RT_HANDLE);
396 
397 	/*
398 	 * Lazy dependencies are identified as DT_NEEDED entries with a
399 	 * DF_P1_LAZYLOAD flag in the previous DT_POSFLAG_1 element.  The
400 	 * dynamic information element that corresponds to the DT_POSFLAG_1
401 	 * entry is free, and thus used to store the present entrance
402 	 * identifier.  This identifier is used to prevent multiple attempts to
403 	 * load a failed lazy loadable dependency within the same runtime linker
404 	 * operation.  However, future attempts to reload this dependency are
405 	 * still possible.
406 	 */
407 	if (ndx && (pdip = dip - 1) && (pdip->di_flags & FLG_DI_POSFLAG1))
408 		pdip->di_info = (void *)slp->sl_id;
409 
410 	/*
411 	 * Expand the requested name if necessary.
412 	 */
413 	if (elf_fix_name(name, clmp, &palp, AL_CNT_NEEDED, 0) == 0)
414 		return (NULL);
415 
416 	/*
417 	 * Provided the object on the head of the link-map has completed its
418 	 * relocation, create a new link-map control list for this request.
419 	 */
420 	hlmp = lml->lm_head;
421 	if (FLAGS(hlmp) & FLG_RT_RELOCED) {
422 		Lm_cntl	*lmc;
423 
424 		if ((lmc = alist_append(&lml->lm_lists, 0, sizeof (Lm_cntl),
425 		    AL_CNT_LMLISTS)) == NULL) {
426 			remove_plist(&palp, 1);
427 			return (NULL);
428 		}
429 		lmco = (Aliste)((char *)lmc - (char *)lml->lm_lists);
430 	} else
431 		lmco = ALIST_OFF_DATA;
432 
433 	/*
434 	 * Load the associated object.
435 	 */
436 	dip->di_info = nlmp =
437 	    load_one(lml, lmco, palp, clmp, MODE(clmp), flags, 0, in_nfavl);
438 
439 	/*
440 	 * Remove any expanded pathname infrastructure.  Reduce the pending lazy
441 	 * dependency count of the caller, together with the link-map lists
442 	 * count of objects that still have lazy dependencies pending.
443 	 */
444 	remove_plist(&palp, 1);
445 	if (--LAZY(clmp) == 0)
446 		LIST(clmp)->lm_lazy--;
447 
448 	/*
449 	 * Finish processing the objects associated with this request, and
450 	 * create an association between the caller and this dependency.
451 	 */
452 	if (nlmp && ((bind_one(clmp, nlmp, BND_NEEDED) == 0) ||
453 	    ((nlmp = analyze_lmc(lml, lmco, nlmp, in_nfavl)) == NULL) ||
454 	    (relocate_lmc(lml, lmco, clmp, nlmp, in_nfavl) == 0)))
455 		dip->di_info = nlmp = NULL;
456 
457 	/*
458 	 * If this lazyload has failed, and we've created a new link-map
459 	 * control list to which this request has added objects, then remove
460 	 * all the objects that have been associated to this request.
461 	 */
462 	if ((nlmp == NULL) && (lmco != ALIST_OFF_DATA))
463 		remove_lmc(lml, clmp, lmco, name);
464 
465 	/*
466 	 * Finally, remove any link-map control list that was created.
467 	 */
468 	if (lmco != ALIST_OFF_DATA)
469 		remove_cntl(lml, lmco);
470 
471 	/*
472 	 * If this lazy loading failed, record the fact, and bump the lazy
473 	 * counts.
474 	 */
475 	if (nlmp == NULL) {
476 		dip->di_flags |= FLG_DI_LAZYFAIL;
477 		if (LAZY(clmp)++ == 0)
478 			LIST(clmp)->lm_lazy++;
479 	}
480 
481 	return (nlmp);
482 }
483 
484 /*
485  * Return the entry point of the ELF executable.
486  */
487 static Addr
488 elf_entry_point(void)
489 {
490 	Rt_map	*lmp = lml_main.lm_head;
491 	Ehdr	*ehdr = (Ehdr *)ADDR(lmp);
492 	Addr	addr = (Addr)(ehdr->e_entry);
493 
494 	if ((FLAGS(lmp) & FLG_RT_FIXED) == 0)
495 		addr += ADDR(lmp);
496 
497 	return (addr);
498 }
499 
500 /*
501  * Determine if a dependency requires a particular version and if so verify
502  * that the version exists in the dependency.
503  */
504 int
505 elf_verify_vers(const char *name, Rt_map *clmp, Rt_map *nlmp)
506 {
507 	Verneed		*vnd = VERNEED(clmp);
508 	int		_num, num = VERNEEDNUM(clmp);
509 	char		*cstrs = (char *)STRTAB(clmp);
510 	Lm_list		*lml = LIST(clmp);
511 
512 	/*
513 	 * Traverse the callers version needed information and determine if any
514 	 * specific versions are required from the dependency.
515 	 */
516 	DBG_CALL(Dbg_ver_need_title(LIST(clmp), NAME(clmp)));
517 	for (_num = 1; _num <= num; _num++,
518 	    vnd = (Verneed *)((Xword)vnd + vnd->vn_next)) {
519 		Half		cnt = vnd->vn_cnt;
520 		Vernaux		*vnap;
521 		char		*nstrs, *need;
522 
523 		/*
524 		 * Determine if a needed entry matches this dependency.
525 		 */
526 		need = (char *)(cstrs + vnd->vn_file);
527 		if (strcmp(name, need) != 0)
528 			continue;
529 
530 		if ((lml->lm_flags & LML_FLG_TRC_VERBOSE) &&
531 		    ((FLAGS1(clmp) & FL1_RT_LDDSTUB) == 0))
532 			(void) printf(MSG_INTL(MSG_LDD_VER_FIND), name);
533 
534 		/*
535 		 * Validate that each version required actually exists in the
536 		 * dependency.
537 		 */
538 		nstrs = (char *)STRTAB(nlmp);
539 
540 		for (vnap = (Vernaux *)((Xword)vnd + vnd->vn_aux); cnt;
541 		    cnt--, vnap = (Vernaux *)((Xword)vnap + vnap->vna_next)) {
542 			char		*version, *define;
543 			Verdef		*vdf = VERDEF(nlmp);
544 			ulong_t		_num, num = VERDEFNUM(nlmp);
545 			int		found = 0;
546 
547 			/*
548 			 * Skip validation of versions that are marked
549 			 * INFO. This optimization is used for versions
550 			 * that are inherited by another version. Verification
551 			 * of the inheriting version is sufficient.
552 			 *
553 			 * Such versions are recorded in the object for the
554 			 * benefit of VERSYM entries that refer to them. This
555 			 * provides a purely diagnositic benefit.
556 			 */
557 			if (vnap->vna_flags & VER_FLG_INFO)
558 				continue;
559 
560 			version = (char *)(cstrs + vnap->vna_name);
561 			DBG_CALL(Dbg_ver_need_entry(lml, 0, need, version));
562 
563 			for (_num = 1; _num <= num; _num++,
564 			    vdf = (Verdef *)((Xword)vdf + vdf->vd_next)) {
565 				Verdaux		*vdap;
566 
567 				if (vnap->vna_hash != vdf->vd_hash)
568 					continue;
569 
570 				vdap = (Verdaux *)((Xword)vdf + vdf->vd_aux);
571 				define = (char *)(nstrs + vdap->vda_name);
572 				if (strcmp(version, define) != 0)
573 					continue;
574 
575 				found++;
576 				break;
577 			}
578 
579 			/*
580 			 * If we're being traced print out any matched version
581 			 * when the verbose (-v) option is in effect.  Always
582 			 * print any unmatched versions.
583 			 */
584 			if (lml->lm_flags & LML_FLG_TRC_ENABLE) {
585 				/* BEGIN CSTYLED */
586 				if (found) {
587 				    if (!(lml->lm_flags & LML_FLG_TRC_VERBOSE))
588 					continue;
589 
590 				    (void) printf(MSG_ORIG(MSG_LDD_VER_FOUND),
591 					need, version, NAME(nlmp));
592 				} else {
593 				    if (rtld_flags & RT_FL_SILENCERR)
594 					continue;
595 
596 				    (void) printf(MSG_INTL(MSG_LDD_VER_NFOUND),
597 					need, version);
598 				}
599 				/* END CSTYLED */
600 				continue;
601 			}
602 
603 			/*
604 			 * If the version hasn't been found then this is a
605 			 * candidate for a fatal error condition.  Weak
606 			 * version definition requirements are silently
607 			 * ignored.  Also, if the image inspected for a version
608 			 * definition has no versioning recorded at all then
609 			 * silently ignore this (this provides better backward
610 			 * compatibility to old images created prior to
611 			 * versioning being available).  Both of these skipped
612 			 * diagnostics are available under tracing (see above).
613 			 */
614 			if ((found == 0) && (num != 0) &&
615 			    (!(vnap->vna_flags & VER_FLG_WEAK))) {
616 				eprintf(lml, ERR_FATAL,
617 				    MSG_INTL(MSG_VER_NFOUND), need, version,
618 				    NAME(clmp));
619 				return (0);
620 			}
621 		}
622 	}
623 	DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
624 	return (1);
625 }
626 
627 /*
628  * Search through the dynamic section for DT_NEEDED entries and perform one
629  * of two functions.  If only the first argument is specified then load the
630  * defined shared object, otherwise add the link map representing the defined
631  * link map the the dlopen list.
632  */
633 static int
634 elf_needed(Lm_list *lml, Aliste lmco, Rt_map *clmp, int *in_nfavl)
635 {
636 	Alist		*palp = NULL;
637 	Dyn		*dyn, *pdyn;
638 	ulong_t		ndx = 0;
639 	uint_t		lazy, flags;
640 	Word		lmflags = lml->lm_flags;
641 	Word		lmtflags = lml->lm_tflags;
642 
643 	/*
644 	 * Process each shared object on needed list.
645 	 */
646 	if (DYN(clmp) == NULL)
647 		return (1);
648 
649 	for (dyn = (Dyn *)DYN(clmp), pdyn = NULL; dyn->d_tag != DT_NULL;
650 	    pdyn = dyn++, ndx++) {
651 		Dyninfo	*dip = &DYNINFO(clmp)[ndx];
652 		Rt_map	*nlmp = NULL;
653 		char	*name;
654 		int	silent = 0;
655 
656 		switch (dyn->d_tag) {
657 		case DT_POSFLAG_1:
658 			dip->di_flags |= FLG_DI_POSFLAG1;
659 			continue;
660 		case DT_NEEDED:
661 		case DT_USED:
662 			lazy = flags = 0;
663 			dip->di_flags |= FLG_DI_NEEDED;
664 
665 			if (pdyn && (pdyn->d_tag == DT_POSFLAG_1)) {
666 				if ((pdyn->d_un.d_val & DF_P1_LAZYLOAD) &&
667 				    ((lmtflags & LML_TFLG_NOLAZYLD) == 0)) {
668 					dip->di_flags |= FLG_DI_LAZY;
669 					lazy = 1;
670 				}
671 				if (pdyn->d_un.d_val & DF_P1_GROUPPERM) {
672 					dip->di_flags |= FLG_DI_GROUP;
673 					flags =
674 					    (FLG_RT_SETGROUP | FLG_RT_HANDLE);
675 				}
676 			}
677 
678 			name = (char *)STRTAB(clmp) + dyn->d_un.d_val;
679 
680 			/*
681 			 * NOTE, libc.so.1 can't be lazy loaded.  Although a
682 			 * lazy position flag won't be produced when a RTLDINFO
683 			 * .dynamic entry is found (introduced with the UPM in
684 			 * Solaris 10), it was possible to mark libc for lazy
685 			 * loading on previous releases.  To reduce the overhead
686 			 * of testing for this occurrence, only carry out this
687 			 * check for the first object on the link-map list
688 			 * (there aren't many applications built without libc).
689 			 */
690 			if (lazy && (lml->lm_head == clmp) &&
691 			    (strcmp(name, MSG_ORIG(MSG_FIL_LIBC)) == 0))
692 				lazy = 0;
693 
694 			/*
695 			 * Don't bring in lazy loaded objects yet unless we've
696 			 * been asked to attempt to load all available objects
697 			 * (crle(1) sets LD_FLAGS=loadavail).  Even under
698 			 * RTLD_NOW we don't process this - RTLD_NOW will cause
699 			 * relocation processing which in turn might trigger
700 			 * lazy loading, but its possible that the object has a
701 			 * lazy loaded file with no bindings (i.e., it should
702 			 * never have been a dependency in the first place).
703 			 */
704 			if (lazy) {
705 				if ((lmflags & LML_FLG_LOADAVAIL) == 0) {
706 					LAZY(clmp)++;
707 					lazy = flags = 0;
708 					continue;
709 				}
710 
711 				/*
712 				 * Silence any error messages - see description
713 				 * under elf_lookup_filtee().
714 				 */
715 				if ((rtld_flags & RT_FL_SILENCERR) == 0) {
716 					rtld_flags |= RT_FL_SILENCERR;
717 					silent = 1;
718 				}
719 			}
720 			break;
721 		case DT_AUXILIARY:
722 			dip->di_flags |= FLG_DI_AUXFLTR;
723 			continue;
724 		case DT_SUNW_AUXILIARY:
725 			dip->di_flags |= (FLG_DI_AUXFLTR | FLG_DI_SYMFLTR);
726 			continue;
727 		case DT_FILTER:
728 			dip->di_flags |= FLG_DI_STDFLTR;
729 			continue;
730 		case DT_SUNW_FILTER:
731 			dip->di_flags |= (FLG_DI_STDFLTR | FLG_DI_SYMFLTR);
732 			continue;
733 		default:
734 			continue;
735 		}
736 
737 		DBG_CALL(Dbg_file_needed(clmp, name));
738 
739 		/*
740 		 * If we're running under ldd(1), indicate that this dependency
741 		 * has been processed.  It doesn't matter whether the object is
742 		 * successfully loaded or not, this flag simply ensures that we
743 		 * don't repeatedly attempt to load an object that has already
744 		 * failed to load.  To do so would create multiple failure
745 		 * diagnostics for the same object under ldd(1).
746 		 */
747 		if (lml->lm_flags & LML_FLG_TRC_ENABLE)
748 			dip->di_flags |= FLG_DI_LDD_DONE;
749 
750 		/*
751 		 * Establish the objects name, load it and establish a binding
752 		 * with the caller.
753 		 */
754 		if ((elf_fix_name(name, clmp, &palp, AL_CNT_NEEDED, 0) == 0) ||
755 		    ((nlmp = load_one(lml, lmco, palp, clmp, MODE(clmp),
756 		    flags, 0, in_nfavl)) == NULL) ||
757 		    (bind_one(clmp, nlmp, BND_NEEDED) == 0))
758 			nlmp = NULL;
759 
760 		/*
761 		 * Clean up any infrastructure, including the removal of the
762 		 * error suppression state, if it had been previously set in
763 		 * this routine.
764 		 */
765 		remove_plist(&palp, 0);
766 
767 		if (silent)
768 			rtld_flags &= ~RT_FL_SILENCERR;
769 
770 		if ((dip->di_info = (void *)nlmp) == NULL) {
771 			/*
772 			 * If the object could not be mapped, continue if error
773 			 * suppression is established or we're here with ldd(1).
774 			 */
775 			if ((MODE(clmp) & RTLD_CONFGEN) || (lmflags &
776 			    (LML_FLG_LOADAVAIL | LML_FLG_TRC_ENABLE)))
777 				continue;
778 			else {
779 				remove_plist(&palp, 1);
780 				return (0);
781 			}
782 		}
783 	}
784 
785 	if (LAZY(clmp))
786 		lml->lm_lazy++;
787 
788 	remove_plist(&palp, 1);
789 	return (1);
790 }
791 
792 /*
793  * A null symbol interpretor.  Used if a filter has no associated filtees.
794  */
795 /* ARGSUSED0 */
796 static Sym *
797 elf_null_find_sym(Slookup *slp, Rt_map **dlmp, uint_t *binfo, int *in_nfavl)
798 {
799 	return (NULL);
800 }
801 
802 /*
803  * Disable filtee use.
804  */
805 static void
806 elf_disable_filtee(Rt_map *lmp, Dyninfo *dip)
807 {
808 	if ((dip->di_flags & FLG_DI_SYMFLTR) == 0) {
809 		/*
810 		 * If this is an object filter, null out the reference name.
811 		 */
812 		if (OBJFLTRNDX(lmp) != FLTR_DISABLED) {
813 			REFNAME(lmp) = NULL;
814 			OBJFLTRNDX(lmp) = FLTR_DISABLED;
815 
816 			/*
817 			 * Indicate that this filtee is no longer available.
818 			 */
819 			if (dip->di_flags & FLG_DI_STDFLTR)
820 				SYMINTP(lmp) = elf_null_find_sym;
821 
822 		}
823 	} else if (dip->di_flags & FLG_DI_STDFLTR) {
824 		/*
825 		 * Indicate that this standard filtee is no longer available.
826 		 */
827 		if (SYMSFLTRCNT(lmp))
828 			SYMSFLTRCNT(lmp)--;
829 	} else {
830 		/*
831 		 * Indicate that this auxiliary filtee is no longer available.
832 		 */
833 		if (SYMAFLTRCNT(lmp))
834 			SYMAFLTRCNT(lmp)--;
835 	}
836 	dip->di_flags &= ~MSK_DI_FILTER;
837 }
838 
839 /*
840  * Find symbol interpreter - filters.
841  * This function is called when the symbols from a shared object should
842  * be resolved from the shared objects filtees instead of from within itself.
843  *
844  * A symbol name of 0 is used to trigger filtee loading.
845  */
846 static Sym *
847 _elf_lookup_filtee(Slookup *slp, Rt_map **dlmp, uint_t *binfo, uint_t ndx,
848     int *in_nfavl)
849 {
850 	const char	*name = slp->sl_name, *filtees;
851 	Rt_map		*clmp = slp->sl_cmap;
852 	Rt_map		*ilmp = slp->sl_imap;
853 	Pdesc		*pdp;
854 	int		any;
855 	Dyninfo		*dip = &DYNINFO(ilmp)[ndx];
856 	Lm_list		*lml = LIST(ilmp);
857 	Aliste		idx;
858 
859 	/*
860 	 * Indicate that the filter has been used.  If a binding already exists
861 	 * to the caller, indicate that this object is referenced.  This insures
862 	 * we don't generate false unreferenced diagnostics from ldd -u/U or
863 	 * debugging.  Don't create a binding regardless, as this filter may
864 	 * have been dlopen()'ed.
865 	 */
866 	if (name && (ilmp != clmp)) {
867 		Word	tracing = (LIST(clmp)->lm_flags &
868 		    (LML_FLG_TRC_UNREF | LML_FLG_TRC_UNUSED));
869 
870 		if (tracing || DBG_ENABLED) {
871 			Bnd_desc 	*bdp;
872 			Aliste		idx;
873 
874 			FLAGS1(ilmp) |= FL1_RT_USED;
875 
876 			if ((tracing & LML_FLG_TRC_UNREF) || DBG_ENABLED) {
877 				for (APLIST_TRAVERSE(CALLERS(ilmp), idx, bdp)) {
878 					if (bdp->b_caller == clmp) {
879 						bdp->b_flags |= BND_REFER;
880 						break;
881 					}
882 				}
883 			}
884 		}
885 	}
886 
887 	/*
888 	 * If this is the first call to process this filter, establish the
889 	 * filtee list.  If a configuration file exists, determine if any
890 	 * filtee associations for this filter, and its filtee reference, are
891 	 * defined.  Otherwise, process the filtee reference.  Any token
892 	 * expansion is also completed at this point (i.e., $PLATFORM).
893 	 */
894 	filtees = (char *)STRTAB(ilmp) + DYN(ilmp)[ndx].d_un.d_val;
895 	if (dip->di_info == NULL) {
896 		if (rtld_flags2 & RT_FL2_FLTCFG)
897 			elf_config_flt(lml, PATHNAME(ilmp), filtees,
898 			    (Alist **)&dip->di_info, AL_CNT_FILTEES);
899 
900 		if (dip->di_info == NULL) {
901 			DBG_CALL(Dbg_file_filter(lml, NAME(ilmp), filtees, 0));
902 			if ((lml->lm_flags &
903 			    (LML_FLG_TRC_VERBOSE | LML_FLG_TRC_SEARCH)) &&
904 			    ((FLAGS1(ilmp) & FL1_RT_LDDSTUB) == 0))
905 				(void) printf(MSG_INTL(MSG_LDD_FIL_FILTER),
906 				    NAME(ilmp), filtees);
907 
908 			if (expand_paths(ilmp, filtees, (Alist **)&dip->di_info,
909 			    AL_CNT_FILTEES, 0, 0) == 0) {
910 				elf_disable_filtee(ilmp, dip);
911 				return (NULL);
912 			}
913 		}
914 	}
915 
916 	/*
917 	 * Traverse the filtee list, dlopen()'ing any objects specified and
918 	 * using their group handle to lookup the symbol.
919 	 */
920 	any = 0;
921 	for (ALIST_TRAVERSE((Alist *)dip->di_info, idx, pdp)) {
922 		int	mode;
923 		Grp_hdl	*ghp;
924 		Rt_map	*nlmp = NULL;
925 
926 		if (pdp->pd_plen == 0)
927 			continue;
928 
929 		/*
930 		 * Establish the mode of the filtee from the filter.  As filtees
931 		 * are loaded via a dlopen(), make sure that RTLD_GROUP is set
932 		 * and the filtees aren't global.  It would be nice to have
933 		 * RTLD_FIRST used here also, but as filters got out long before
934 		 * RTLD_FIRST was introduced it's a little too late now.
935 		 */
936 		mode = MODE(ilmp) | RTLD_GROUP;
937 		mode &= ~RTLD_GLOBAL;
938 
939 		/*
940 		 * Insure that any auxiliary filter can locate symbols from its
941 		 * caller.
942 		 */
943 		if (dip->di_flags & FLG_DI_AUXFLTR)
944 			mode |= RTLD_PARENT;
945 
946 		/*
947 		 * Process any hardware capability directory.  Establish a new
948 		 * link-map control list from which to analyze any newly added
949 		 * objects.
950 		 */
951 		if ((pdp->pd_info == NULL) && (pdp->pd_flags & PD_TKN_HWCAP)) {
952 			const char	*dir = pdp->pd_pname;
953 			Aliste		lmco;
954 
955 			if (FLAGS(lml->lm_head) & FLG_RT_RELOCED) {
956 				Lm_cntl	*lmc;
957 
958 				if ((lmc = alist_append(&lml->lm_lists, 0,
959 				    sizeof (Lm_cntl), AL_CNT_LMLISTS)) == NULL)
960 					return (NULL);
961 				lmco = (Aliste)((char *)lmc -
962 				    (char *)lml->lm_lists);
963 			} else
964 				lmco = ALIST_OFF_DATA;
965 
966 			/*
967 			 * Determine the hardware capability filtees.  If none
968 			 * can be found, provide suitable diagnostics.
969 			 */
970 			DBG_CALL(Dbg_cap_hw_filter(lml, dir, ilmp));
971 			if (hwcap_filtees((Alist **)&dip->di_info, idx, dir,
972 			    lmco, ilmp, filtees, mode,
973 			    (FLG_RT_HANDLE | FLG_RT_HWCAP), in_nfavl) == 0) {
974 				if ((lml->lm_flags & LML_FLG_TRC_ENABLE) &&
975 				    (dip->di_flags & FLG_DI_AUXFLTR) &&
976 				    (rtld_flags & RT_FL_WARNFLTR)) {
977 					(void) printf(
978 					    MSG_INTL(MSG_LDD_HWCAP_NFOUND),
979 					    dir);
980 				}
981 				DBG_CALL(Dbg_cap_hw_filter(lml, dir, 0));
982 			}
983 
984 			/*
985 			 * Re-establish the originating path name descriptor, as
986 			 * the expansion of hardware capabilities filtees may
987 			 * have re-allocated the controlling Alist.  Mark this
988 			 * original pathname descriptor as unused so that the
989 			 * descriptor isn't revisited for processing.  Any real
990 			 * hardware capabilities filtees have been added as new
991 			 * pathname descriptors following this descriptor.
992 			 */
993 			pdp = alist_item((Alist *)dip->di_info, idx);
994 			pdp->pd_flags &= ~PD_TKN_HWCAP;
995 			pdp->pd_plen = 0;
996 
997 			/*
998 			 * Now that any hardware capability objects have been
999 			 * processed, remove any link-map control list.
1000 			 */
1001 			if (lmco != ALIST_OFF_DATA)
1002 				remove_cntl(lml, lmco);
1003 		}
1004 
1005 		if (pdp->pd_plen == 0)
1006 			continue;
1007 
1008 		/*
1009 		 * Process an individual filtee.
1010 		 */
1011 		if (pdp->pd_info == NULL) {
1012 			const char	*filtee = pdp->pd_pname;
1013 			int		audit = 0;
1014 
1015 			DBG_CALL(Dbg_file_filtee(lml, NAME(ilmp), filtee, 0));
1016 
1017 			ghp = NULL;
1018 
1019 			/*
1020 			 * Determine if the reference link map is already
1021 			 * loaded.  As an optimization compare the filtee with
1022 			 * our interpretor.  The most common filter is
1023 			 * libdl.so.1, which is a filter on ld.so.1.
1024 			 */
1025 #if	defined(_ELF64)
1026 			if (strcmp(filtee, MSG_ORIG(MSG_PTH_RTLD_64)) == 0) {
1027 #else
1028 			if (strcmp(filtee, MSG_ORIG(MSG_PTH_RTLD)) == 0) {
1029 #endif
1030 				/*
1031 				 * Create an association between ld.so.1 and the
1032 				 * filter.  As an optimization, a handle for
1033 				 * ld.so.1 itself (required for the dlopen()
1034 				 * family filtering mechanism) shouldn't search
1035 				 * any dependencies of ld.so.1.  Omitting
1036 				 * GPD_ADDEPS prevents the addition of any
1037 				 * ld.so.1 dependencies to this handle.
1038 				 */
1039 				nlmp = lml_rtld.lm_head;
1040 				if ((ghp = hdl_create(&lml_rtld, nlmp, ilmp,
1041 				    (GPH_LDSO | GPH_FIRST | GPH_FILTEE),
1042 				    (GPD_DLSYM | GPD_RELOC), GPD_PARENT)) ==
1043 				    NULL)
1044 					nlmp = NULL;
1045 
1046 				/*
1047 				 * Establish the filter handle to prevent any
1048 				 * recursion.
1049 				 */
1050 				if (nlmp && ghp)
1051 					pdp->pd_info = (void *)ghp;
1052 
1053 				/*
1054 				 * Audit the filter/filtee established.  Ignore
1055 				 * any return from the auditor, as we can't
1056 				 * allow ignore filtering to ld.so.1, otherwise
1057 				 * nothing is going to work.
1058 				 */
1059 				if (nlmp && ((lml->lm_tflags | AFLAGS(ilmp)) &
1060 				    LML_TFLG_AUD_OBJFILTER))
1061 					(void) audit_objfilter(ilmp, filtees,
1062 					    nlmp, 0);
1063 
1064 			} else {
1065 				Rej_desc	rej = { 0 };
1066 				Fdesc		fd = { 0 };
1067 				Aliste		lmco;
1068 
1069 				/*
1070 				 * Trace the inspection of this file, determine
1071 				 * any auditor substitution, and seed the file
1072 				 * descriptor with the originating name.
1073 				 */
1074 				if (load_trace(lml, pdp, clmp, &fd) == NULL)
1075 					continue;
1076 
1077 				/*
1078 				 * Establish a new link-map control list from
1079 				 * which to analyze any newly added objects.
1080 				 */
1081 				if (FLAGS(lml->lm_head) & FLG_RT_RELOCED) {
1082 					Lm_cntl	*lmc;
1083 
1084 					if ((lmc =
1085 					    alist_append(&lml->lm_lists, 0,
1086 					    sizeof (Lm_cntl),
1087 					    AL_CNT_LMLISTS)) == NULL)
1088 						return (NULL);
1089 					lmco = (Aliste)((char *)lmc -
1090 					    (char *)lml->lm_lists);
1091 				} else
1092 					lmco = ALIST_OFF_DATA;
1093 
1094 				/*
1095 				 * Locate and load the filtee.
1096 				 */
1097 				if ((nlmp = load_path(lml, lmco, ilmp, mode,
1098 				    FLG_RT_HANDLE, &ghp, &fd, &rej,
1099 				    in_nfavl)) == NULL)
1100 					file_notfound(LIST(ilmp), filtee, ilmp,
1101 					    FLG_RT_HANDLE, &rej);
1102 
1103 				filtee = pdp->pd_pname;
1104 
1105 				/*
1106 				 * Establish the filter handle to prevent any
1107 				 * recursion.
1108 				 */
1109 				if (nlmp && ghp) {
1110 					ghp->gh_flags |= GPH_FILTEE;
1111 					pdp->pd_info = (void *)ghp;
1112 
1113 					FLAGS1(nlmp) |= FL1_RT_USED;
1114 				}
1115 
1116 				/*
1117 				 * Audit the filter/filtee established.  A
1118 				 * return of 0 indicates the auditor wishes to
1119 				 * ignore this filtee.
1120 				 */
1121 				if (nlmp && ((lml->lm_tflags | FLAGS1(ilmp)) &
1122 				    LML_TFLG_AUD_OBJFILTER)) {
1123 					if (audit_objfilter(ilmp, filtees,
1124 					    nlmp, 0) == 0) {
1125 						audit = 1;
1126 						nlmp = NULL;
1127 					}
1128 				}
1129 
1130 				/*
1131 				 * Finish processing the objects associated with
1132 				 * this request.  Create an association between
1133 				 * this object and the originating filter to
1134 				 * provide sufficient information to tear down
1135 				 * this filtee if necessary.
1136 				 */
1137 				if (nlmp && ghp && (((nlmp = analyze_lmc(lml,
1138 				    lmco, nlmp, in_nfavl)) == NULL) ||
1139 				    (relocate_lmc(lml, lmco, ilmp, nlmp,
1140 				    in_nfavl) == 0)))
1141 					nlmp = NULL;
1142 
1143 				/*
1144 				 * If the filtee has been successfully
1145 				 * processed, then create an association
1146 				 * between the filter and filtee.  This
1147 				 * association provides sufficient information
1148 				 * to tear down the filter and filtee if
1149 				 * necessary.
1150 				 */
1151 				DBG_CALL(Dbg_file_hdl_title(DBG_HDL_ADD));
1152 				if (nlmp && ghp &&
1153 				    (hdl_add(ghp, ilmp, GPD_FILTER) == 0))
1154 					nlmp = NULL;
1155 
1156 				/*
1157 				 * Generate a diagnostic if the filtee couldn't
1158 				 * be loaded.
1159 				 */
1160 				if (nlmp == NULL)
1161 					DBG_CALL(Dbg_file_filtee(lml, 0, filtee,
1162 					    audit));
1163 
1164 				/*
1165 				 * If this filtee loading has failed, and we've
1166 				 * created a new link-map control list to which
1167 				 * this request has added objects, then remove
1168 				 * all the objects that have been associated to
1169 				 * this request.
1170 				 */
1171 				if ((nlmp == NULL) && (lmco != ALIST_OFF_DATA))
1172 					remove_lmc(lml, clmp, lmco, name);
1173 
1174 				/*
1175 				 * Remove any link-map control list that was
1176 				 * created.
1177 				 */
1178 				if (lmco != ALIST_OFF_DATA)
1179 					remove_cntl(lml, lmco);
1180 			}
1181 
1182 			/*
1183 			 * If the filtee couldn't be loaded, null out the
1184 			 * path name descriptor entry, and continue the search.
1185 			 * Otherwise, the group handle is retained for future
1186 			 * symbol searches.
1187 			 */
1188 			if (nlmp == NULL) {
1189 				pdp->pd_info = NULL;
1190 				pdp->pd_plen = 0;
1191 				continue;
1192 			}
1193 		}
1194 
1195 		ghp = (Grp_hdl *)pdp->pd_info;
1196 
1197 		/*
1198 		 * If we're just here to trigger filtee loading skip the symbol
1199 		 * lookup so we'll continue looking for additional filtees.
1200 		 */
1201 		if (name) {
1202 			Grp_desc	*gdp;
1203 			Sym		*sym = NULL;
1204 			Aliste		idx;
1205 			Slookup		sl = *slp;
1206 
1207 			sl.sl_flags |= LKUP_FIRST;
1208 			any++;
1209 
1210 			/*
1211 			 * Look for the symbol in the handles dependencies.
1212 			 */
1213 			for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1214 				if ((gdp->gd_flags & GPD_DLSYM) == 0)
1215 					continue;
1216 
1217 				/*
1218 				 * If our parent is a dependency don't look at
1219 				 * it (otherwise we are in a recursive loop).
1220 				 * This situation can occur with auxiliary
1221 				 * filters if the filtee has a dependency on the
1222 				 * filter.  This dependency isn't necessary as
1223 				 * auxiliary filters are opened RTLD_PARENT, but
1224 				 * users may still unknowingly add an explicit
1225 				 * dependency to the parent.
1226 				 */
1227 				if ((sl.sl_imap = gdp->gd_depend) == ilmp)
1228 					continue;
1229 
1230 				if (((sym = SYMINTP(sl.sl_imap)(&sl, dlmp,
1231 				    binfo, in_nfavl)) != NULL) ||
1232 				    (ghp->gh_flags & GPH_FIRST))
1233 					break;
1234 			}
1235 
1236 			/*
1237 			 * If a symbol has been found, indicate the binding
1238 			 * and return the symbol.
1239 			 */
1240 			if (sym) {
1241 				*binfo |= DBG_BINFO_FILTEE;
1242 				return (sym);
1243 			}
1244 		}
1245 
1246 		/*
1247 		 * If this object is tagged to terminate filtee processing we're
1248 		 * done.
1249 		 */
1250 		if (FLAGS1(ghp->gh_ownlmp) & FL1_RT_ENDFILTE)
1251 			break;
1252 	}
1253 
1254 	/*
1255 	 * If we're just here to trigger filtee loading then we're done.
1256 	 */
1257 	if (name == NULL)
1258 		return (NULL);
1259 
1260 	/*
1261 	 * If no filtees have been found for a filter, clean up any path name
1262 	 * descriptors and disable their search completely.  For auxiliary
1263 	 * filters we can reselect the symbol search function so that we never
1264 	 * enter this routine again for this object.  For standard filters we
1265 	 * use the null symbol routine.
1266 	 */
1267 	if (any == 0) {
1268 		remove_plist((Alist **)&(dip->di_info), 1);
1269 		elf_disable_filtee(ilmp, dip);
1270 		return (NULL);
1271 	}
1272 
1273 	return (NULL);
1274 }
1275 
1276 /*
1277  * Focal point for disabling error messages for auxiliary filters.  As an
1278  * auxiliary filter allows for filtee use, but provides a fallback should a
1279  * filtee not exist (or fail to load), any errors generated as a consequence of
1280  * trying to load the filtees are typically suppressed.  Setting RT_FL_SILENCERR
1281  * suppresses errors generated by eprint(), but insures a debug diagnostic is
1282  * produced.  ldd(1) employs printf(), and here, the selection of whether to
1283  * print a diagnostic in regards to auxiliary filters is a little more complex.
1284  *
1285  *   .	The determination of whether to produce an ldd message, or a fatal
1286  *	error message is driven by LML_FLG_TRC_ENABLE.
1287  *   .	More detailed ldd messages may also be driven off of LML_FLG_TRC_WARN,
1288  *	(ldd -d/-r), LML_FLG_TRC_VERBOSE (ldd -v), LML_FLG_TRC_SEARCH (ldd -s),
1289  *	and LML_FLG_TRC_UNREF/LML_FLG_TRC_UNUSED (ldd -U/-u).
1290  *
1291  *   .	If the calling object is lddstub, then several classes of message are
1292  *	suppressed.  The user isn't trying to diagnose lddstub, this is simply
1293  *	a stub executable employed to preload a user specified library against.
1294  *
1295  *   .	If RT_FL_SILENCERR is in effect then any generic ldd() messages should
1296  *	be suppressed.  All detailed ldd messages should still be produced.
1297  */
1298 Sym *
1299 elf_lookup_filtee(Slookup *slp, Rt_map **dlmp, uint_t *binfo, uint_t ndx,
1300     int *in_nfavl)
1301 {
1302 	Sym	*sym;
1303 	Dyninfo	*dip = &DYNINFO(slp->sl_imap)[ndx];
1304 	int	silent = 0;
1305 
1306 	/*
1307 	 * Make sure this entry is still acting as a filter.  We may have tried
1308 	 * to process this previously, and disabled it if the filtee couldn't
1309 	 * be processed.  However, other entries may provide different filtees
1310 	 * that are yet to be completed.
1311 	 */
1312 	if (dip->di_flags == 0)
1313 		return (NULL);
1314 
1315 	/*
1316 	 * Indicate whether an error message is required should this filtee not
1317 	 * be found, based on the type of filter.
1318 	 */
1319 	if ((dip->di_flags & FLG_DI_AUXFLTR) &&
1320 	    ((rtld_flags & (RT_FL_WARNFLTR | RT_FL_SILENCERR)) == 0)) {
1321 		rtld_flags |= RT_FL_SILENCERR;
1322 		silent = 1;
1323 	}
1324 
1325 	sym = _elf_lookup_filtee(slp, dlmp, binfo, ndx, in_nfavl);
1326 
1327 	if (silent)
1328 		rtld_flags &= ~RT_FL_SILENCERR;
1329 
1330 	return (sym);
1331 }
1332 
1333 /*
1334  * Compute the elf hash value (as defined in the ELF access library).
1335  * The form of the hash table is:
1336  *
1337  *	|--------------|
1338  *	| # of buckets |
1339  *	|--------------|
1340  *	| # of chains  |
1341  *	|--------------|
1342  *	|   bucket[]   |
1343  *	|--------------|
1344  *	|   chain[]    |
1345  *	|--------------|
1346  */
1347 ulong_t
1348 elf_hash(const char *name)
1349 {
1350 	uint_t	hval = 0;
1351 
1352 	while (*name) {
1353 		uint_t	g;
1354 		hval = (hval << 4) + *name++;
1355 		if ((g = (hval & 0xf0000000)) != 0)
1356 			hval ^= g >> 24;
1357 		hval &= ~g;
1358 	}
1359 	return ((ulong_t)hval);
1360 }
1361 
1362 /*
1363  * If flag argument has LKUP_SPEC set, we treat undefined symbols of type
1364  * function specially in the executable - if they have a value, even though
1365  * undefined, we use that value.  This allows us to associate all references
1366  * to a function's address to a single place in the process: the plt entry
1367  * for that function in the executable.  Calls to lookup from plt binding
1368  * routines do NOT set LKUP_SPEC in the flag.
1369  */
1370 Sym *
1371 elf_find_sym(Slookup *slp, Rt_map **dlmp, uint_t *binfo, int *in_nfavl)
1372 {
1373 	const char	*name = slp->sl_name;
1374 	Rt_map		*ilmp = slp->sl_imap;
1375 	ulong_t		hash = slp->sl_hash;
1376 	uint_t		ndx, htmp, buckets, *chainptr;
1377 	Sym		*sym, *symtabptr;
1378 	char		*strtabptr, *strtabname;
1379 	uint_t		flags1;
1380 	Syminfo		*sip;
1381 
1382 	/*
1383 	 * If we're only here to establish a symbols index, skip the diagnostic
1384 	 * used to trace a symbol search.
1385 	 */
1386 	if ((slp->sl_flags & LKUP_SYMNDX) == 0)
1387 		DBG_CALL(Dbg_syms_lookup(ilmp, name, MSG_ORIG(MSG_STR_ELF)));
1388 
1389 	if (HASH(ilmp) == NULL)
1390 		return (NULL);
1391 
1392 	buckets = HASH(ilmp)[0];
1393 	/* LINTED */
1394 	htmp = (uint_t)hash % buckets;
1395 
1396 	/*
1397 	 * Get the first symbol on hash chain and initialize the string
1398 	 * and symbol table pointers.
1399 	 */
1400 	if ((ndx = HASH(ilmp)[htmp + 2]) == 0)
1401 		return (NULL);
1402 
1403 	chainptr = HASH(ilmp) + 2 + buckets;
1404 	strtabptr = STRTAB(ilmp);
1405 	symtabptr = SYMTAB(ilmp);
1406 
1407 	while (ndx) {
1408 		sym = symtabptr + ndx;
1409 		strtabname = strtabptr + sym->st_name;
1410 
1411 		/*
1412 		 * Compare the symbol found with the name required.  If the
1413 		 * names don't match continue with the next hash entry.
1414 		 */
1415 		if ((*strtabname++ != *name) || strcmp(strtabname, &name[1])) {
1416 			if ((ndx = chainptr[ndx]) != 0)
1417 				continue;
1418 			return (NULL);
1419 		}
1420 
1421 		/*
1422 		 * The Solaris ld does not put DT_VERSYM in the dynamic
1423 		 * section, but the GNU ld does. The GNU runtime linker
1424 		 * interprets the top bit of the 16-bit Versym value
1425 		 * (0x8000) as the "hidden" bit. If this bit is set,
1426 		 * the linker is supposed to act as if that symbol does
1427 		 * not exist. The hidden bit supports their versioning
1428 		 * scheme, which allows multiple incompatible functions
1429 		 * with the same name to exist at different versions
1430 		 * within an object. The Solaris linker does not support this
1431 		 * mechanism, or the model of interface evolution that
1432 		 * it allows, but we honor the hidden bit in GNU ld
1433 		 * produced objects in order to interoperate with them.
1434 		 */
1435 		if ((VERSYM(ilmp) != NULL) &&
1436 		    ((VERSYM(ilmp)[ndx] & 0x8000) != 0)) {
1437 			DBG_CALL(Dbg_syms_ignore_gnuver(ilmp, name,
1438 			    ndx, VERSYM(ilmp)[ndx]));
1439 			if ((ndx = chainptr[ndx]) != 0)
1440 				continue;
1441 			return (NULL);
1442 		}
1443 
1444 		/*
1445 		 * If we're only here to establish a symbols index, we're done.
1446 		 */
1447 		if (slp->sl_flags & LKUP_SYMNDX)
1448 			return (sym);
1449 
1450 		/*
1451 		 * If we find a match and the symbol is defined, return the
1452 		 * symbol pointer and the link map in which it was found.
1453 		 */
1454 		if (sym->st_shndx != SHN_UNDEF) {
1455 			*dlmp = ilmp;
1456 			*binfo |= DBG_BINFO_FOUND;
1457 			if ((FLAGS(ilmp) & FLG_RT_OBJINTPO) ||
1458 			    ((FLAGS(ilmp) & FLG_RT_SYMINTPO) &&
1459 			    is_sym_interposer(ilmp, sym)))
1460 				*binfo |= DBG_BINFO_INTERPOSE;
1461 			break;
1462 
1463 		/*
1464 		 * If we find a match and the symbol is undefined, the
1465 		 * symbol type is a function, and the value of the symbol
1466 		 * is non zero, then this is a special case.  This allows
1467 		 * the resolution of a function address to the plt[] entry.
1468 		 * See SPARC ABI, Dynamic Linking, Function Addresses for
1469 		 * more details.
1470 		 */
1471 		} else if ((slp->sl_flags & LKUP_SPEC) &&
1472 		    (FLAGS(ilmp) & FLG_RT_ISMAIN) && (sym->st_value != 0) &&
1473 		    (ELF_ST_TYPE(sym->st_info) == STT_FUNC)) {
1474 			*dlmp = ilmp;
1475 			*binfo |= (DBG_BINFO_FOUND | DBG_BINFO_PLTADDR);
1476 			if ((FLAGS(ilmp) & FLG_RT_OBJINTPO) ||
1477 			    ((FLAGS(ilmp) & FLG_RT_SYMINTPO) &&
1478 			    is_sym_interposer(ilmp, sym)))
1479 				*binfo |= DBG_BINFO_INTERPOSE;
1480 			return (sym);
1481 		}
1482 
1483 		/*
1484 		 * Undefined symbol.
1485 		 */
1486 		return (NULL);
1487 	}
1488 
1489 	/*
1490 	 * We've found a match.  Determine if the defining object contains
1491 	 * symbol binding information.
1492 	 */
1493 	if ((sip = SYMINFO(ilmp)) != NULL)
1494 		sip += ndx;
1495 
1496 	/*
1497 	 * If this definition is a singleton, and we haven't followed a default
1498 	 * symbol search knowing that we're looking for a singleton (presumably
1499 	 * because the symbol definition has been changed since the referring
1500 	 * object was built), then reject this binding so that the caller can
1501 	 * fall back to a standard symbol search.
1502 	 */
1503 	if ((ELF_ST_VISIBILITY(sym->st_other) == STV_SINGLETON) &&
1504 	    (((slp->sl_flags & LKUP_STANDARD) == 0) ||
1505 	    (((slp->sl_flags & LKUP_SINGLETON) == 0) &&
1506 	    (LIST(ilmp)->lm_flags & LML_FLG_GROUPSEXIST)))) {
1507 		DBG_CALL(Dbg_bind_reject(slp->sl_cmap, ilmp, name,
1508 		    DBG_BNDREJ_SINGLE));
1509 		*binfo |= BINFO_REJSINGLE;
1510 		*binfo &= ~DBG_BINFO_MSK;
1511 		return (NULL);
1512 	}
1513 
1514 	/*
1515 	 * If this is a direct binding request, but the symbol definition has
1516 	 * disabled directly binding to it (presumably because the symbol
1517 	 * definition has been changed since the referring object was built),
1518 	 * reject this binding so that the caller can fall back to a standard
1519 	 * symbol search.
1520 	 */
1521 	if (sip && (slp->sl_flags & LKUP_DIRECT) &&
1522 	    (sip->si_flags & SYMINFO_FLG_NOEXTDIRECT)) {
1523 		DBG_CALL(Dbg_bind_reject(slp->sl_cmap, ilmp, name,
1524 		    DBG_BNDREJ_DIRECT));
1525 		*binfo |= BINFO_REJDIRECT;
1526 		*binfo &= ~DBG_BINFO_MSK;
1527 		return (NULL);
1528 	}
1529 
1530 	/*
1531 	 * If this is a binding request within an RTLD_GROUP family, and the
1532 	 * symbol has disabled directly binding to it, reject this binding so
1533 	 * that the caller can fall back to a standard symbol search.
1534 	 *
1535 	 * Effectively, an RTLD_GROUP family achieves what can now be
1536 	 * established with direct bindings.  However, various symbols have
1537 	 * been tagged as inappropriate for direct binding to (ie. libc:malloc).
1538 	 *
1539 	 * A symbol marked as no-direct cannot be used within a group without
1540 	 * first ensuring that the symbol has not been interposed upon outside
1541 	 * of the group.  A common example occurs when users implement their own
1542 	 * version of malloc() in the executable.  Such a malloc() interposes on
1543 	 * the libc:malloc, and this interposition must be honored within the
1544 	 * group as well.
1545 	 *
1546 	 * Following any rejection, LKUP_WORLD is established as a means of
1547 	 * overriding this test as we return to a standard search.
1548 	 */
1549 	if (sip && (sip->si_flags & SYMINFO_FLG_NOEXTDIRECT) &&
1550 	    ((MODE(slp->sl_cmap) & (RTLD_GROUP | RTLD_WORLD)) == RTLD_GROUP) &&
1551 	    ((slp->sl_flags & LKUP_WORLD) == 0)) {
1552 		DBG_CALL(Dbg_bind_reject(slp->sl_cmap, ilmp, name,
1553 		    DBG_BNDREJ_GROUP));
1554 		*binfo |= BINFO_REJGROUP;
1555 		*binfo &= ~DBG_BINFO_MSK;
1556 		return (NULL);
1557 	}
1558 
1559 	/*
1560 	 * Determine whether this object is acting as a filter.
1561 	 */
1562 	if (((flags1 = FLAGS1(ilmp)) & MSK_RT_FILTER) == 0)
1563 		return (sym);
1564 
1565 	/*
1566 	 * Determine if this object offers per-symbol filtering, and if so,
1567 	 * whether this symbol references a filtee.
1568 	 */
1569 	if (sip && (flags1 & (FL1_RT_SYMSFLTR | FL1_RT_SYMAFLTR))) {
1570 		/*
1571 		 * If this is a standard filter reference, and no standard
1572 		 * filtees remain to be inspected, we're done.  If this is an
1573 		 * auxiliary filter reference, and no auxiliary filtees remain,
1574 		 * we'll fall through in case any object filtering is available.
1575 		 */
1576 		if ((sip->si_flags & SYMINFO_FLG_FILTER) &&
1577 		    (SYMSFLTRCNT(ilmp) == 0))
1578 			return (NULL);
1579 
1580 		if ((sip->si_flags & SYMINFO_FLG_FILTER) ||
1581 		    ((sip->si_flags & SYMINFO_FLG_AUXILIARY) &&
1582 		    SYMAFLTRCNT(ilmp))) {
1583 			Sym	*fsym;
1584 
1585 			/*
1586 			 * This symbol has an associated filtee.  Lookup the
1587 			 * symbol in the filtee, and if it is found return it.
1588 			 * If the symbol doesn't exist, and this is a standard
1589 			 * filter, return an error, otherwise fall through to
1590 			 * catch any object filtering that may be available.
1591 			 */
1592 			if ((fsym = elf_lookup_filtee(slp, dlmp, binfo,
1593 			    sip->si_boundto, in_nfavl)) != NULL)
1594 				return (fsym);
1595 			if (sip->si_flags & SYMINFO_FLG_FILTER)
1596 				return (NULL);
1597 		}
1598 	}
1599 
1600 	/*
1601 	 * Determine if this object provides global filtering.
1602 	 */
1603 	if (flags1 & (FL1_RT_OBJSFLTR | FL1_RT_OBJAFLTR)) {
1604 		Sym	*fsym;
1605 
1606 		if (OBJFLTRNDX(ilmp) != FLTR_DISABLED) {
1607 			/*
1608 			 * This object has an associated filtee.  Lookup the
1609 			 * symbol in the filtee, and if it is found return it.
1610 			 * If the symbol doesn't exist, and this is a standard
1611 			 * filter, return and error, otherwise return the symbol
1612 			 * within the filter itself.
1613 			 */
1614 			if ((fsym = elf_lookup_filtee(slp, dlmp, binfo,
1615 			    OBJFLTRNDX(ilmp), in_nfavl)) != NULL)
1616 				return (fsym);
1617 		}
1618 
1619 		if (flags1 & FL1_RT_OBJSFLTR)
1620 			return (NULL);
1621 	}
1622 	return (sym);
1623 }
1624 
1625 /*
1626  * Create a new Rt_map structure for an ELF object and initialize
1627  * all values.
1628  */
1629 Rt_map *
1630 elf_new_lmp(Lm_list *lml, Aliste lmco, Fdesc *fdp, Addr addr, size_t msize,
1631     void *odyn, int *in_nfavl)
1632 {
1633 	const char	*name = fdp->fd_nname;
1634 	Rt_map		*lmp;
1635 	Ehdr		*ehdr = (Ehdr *)addr;
1636 	Phdr		*phdr, *tphdr = NULL, *dphdr = NULL, *uphdr = NULL;
1637 	Dyn		*dyn = (Dyn *)odyn;
1638 	Cap		*cap = NULL;
1639 	int		ndx;
1640 	Addr		base, fltr = 0, audit = 0, cfile = 0, crle = 0;
1641 	Xword		rpath = 0;
1642 	size_t		lmsz, rtsz, epsz, dynsz = 0;
1643 	uint_t		dyncnt = 0;
1644 
1645 	DBG_CALL(Dbg_file_elf(lml, name, addr, msize, lml->lm_lmidstr, lmco));
1646 
1647 	/*
1648 	 * If this is a shared object, the base address of the shared object is
1649 	 * added to all address values defined within the object.  Otherwise, if
1650 	 * this is an executable, all object addresses are used as is.
1651 	 */
1652 	if (ehdr->e_type == ET_EXEC)
1653 		base = 0;
1654 	else
1655 		base = addr;
1656 
1657 	/*
1658 	 * Traverse the program header table, picking off required items.  This
1659 	 * traversal also provides for the sizing of the PT_DYNAMIC section.
1660 	 */
1661 	phdr = (Phdr *)((uintptr_t)ehdr + ehdr->e_phoff);
1662 	for (ndx = 0; ndx < (int)ehdr->e_phnum; ndx++,
1663 	    phdr = (Phdr *)((uintptr_t)phdr + ehdr->e_phentsize)) {
1664 		switch (phdr->p_type) {
1665 		case PT_DYNAMIC:
1666 			dphdr = phdr;
1667 			dyn = (Dyn *)((uintptr_t)phdr->p_vaddr + base);
1668 			break;
1669 		case PT_TLS:
1670 			tphdr = phdr;
1671 			break;
1672 		case PT_SUNWCAP:
1673 			cap = (Cap *)((uintptr_t)phdr->p_vaddr + base);
1674 			break;
1675 		case PT_SUNW_UNWIND:
1676 		case PT_SUNW_EH_FRAME:
1677 			uphdr = phdr;
1678 			break;
1679 		default:
1680 			break;
1681 		}
1682 	}
1683 
1684 	/*
1685 	 * Determine the number of PT_DYNAMIC entries for the DYNINFO()
1686 	 * allocation.  Sadly, this is a little larger than we really need,
1687 	 * as there are typically padding DT_NULL entries.  However, adding
1688 	 * this data to the initial link-map allocation is a win.
1689 	 */
1690 	if (dyn) {
1691 		dyncnt = dphdr->p_filesz / sizeof (Dyn);
1692 		dynsz = dyncnt * sizeof (Dyninfo);
1693 	}
1694 
1695 	/*
1696 	 * Allocate space for the link-map, private elf information, and
1697 	 * DYNINFO() data.  Once these are allocated and initialized,
1698 	 * remove_so(0, lmp) can be used to tear down the link-map allocation
1699 	 * should any failures occur.
1700 	 */
1701 	rtsz = S_DROUND(sizeof (Rt_map));
1702 	epsz = S_DROUND(sizeof (Rt_elfp));
1703 	lmsz = rtsz + epsz + dynsz;
1704 	if ((lmp = calloc(lmsz, 1)) == NULL)
1705 		return (NULL);
1706 	ELFPRV(lmp) = (void *)((uintptr_t)lmp + rtsz);
1707 	DYNINFO(lmp) = (Dyninfo *)((uintptr_t)lmp + rtsz + epsz);
1708 	LMSIZE(lmp) = lmsz;
1709 
1710 	/*
1711 	 * All fields not filled in were set to 0 by calloc.
1712 	 */
1713 	NAME(lmp) = (char *)name;
1714 	ADDR(lmp) = addr;
1715 	MSIZE(lmp) = msize;
1716 	SYMINTP(lmp) = elf_find_sym;
1717 	FCT(lmp) = &elf_fct;
1718 	LIST(lmp) = lml;
1719 	OBJFLTRNDX(lmp) = FLTR_DISABLED;
1720 	SORTVAL(lmp) = -1;
1721 	DYN(lmp) = dyn;
1722 	DYNINFOCNT(lmp) = dyncnt;
1723 	PTUNWIND(lmp) = uphdr;
1724 
1725 	if (ehdr->e_type == ET_EXEC)
1726 		FLAGS(lmp) |= FLG_RT_FIXED;
1727 
1728 	/*
1729 	 * Fill in rest of the link map entries with information from the file's
1730 	 * dynamic structure.
1731 	 */
1732 	if (dyn) {
1733 		uint_t		dynndx = 0;
1734 		Xword		pltpadsz = 0;
1735 		Rti_desc	*rti;
1736 
1737 		/* CSTYLED */
1738 		for ( ; dyn->d_tag != DT_NULL; ++dyn, dynndx++) {
1739 			switch ((Xword)dyn->d_tag) {
1740 			case DT_SYMTAB:
1741 				SYMTAB(lmp) = (void *)(dyn->d_un.d_ptr + base);
1742 				break;
1743 			case DT_SUNW_SYMTAB:
1744 				SUNWSYMTAB(lmp) =
1745 				    (void *)(dyn->d_un.d_ptr + base);
1746 				break;
1747 			case DT_SUNW_SYMSZ:
1748 				SUNWSYMSZ(lmp) = dyn->d_un.d_val;
1749 				break;
1750 			case DT_STRTAB:
1751 				STRTAB(lmp) = (void *)(dyn->d_un.d_ptr + base);
1752 				break;
1753 			case DT_SYMENT:
1754 				SYMENT(lmp) = dyn->d_un.d_val;
1755 				break;
1756 			case DT_FEATURE_1:
1757 				dyn->d_un.d_val |= DTF_1_PARINIT;
1758 				if (dyn->d_un.d_val & DTF_1_CONFEXP)
1759 					crle = 1;
1760 				break;
1761 			case DT_MOVESZ:
1762 				MOVESZ(lmp) = dyn->d_un.d_val;
1763 				FLAGS(lmp) |= FLG_RT_MOVE;
1764 				break;
1765 			case DT_MOVEENT:
1766 				MOVEENT(lmp) = dyn->d_un.d_val;
1767 				break;
1768 			case DT_MOVETAB:
1769 				MOVETAB(lmp) = (void *)(dyn->d_un.d_ptr + base);
1770 				break;
1771 			case DT_REL:
1772 			case DT_RELA:
1773 				/*
1774 				 * At this time, ld.so. can only handle one
1775 				 * type of relocation per object.
1776 				 */
1777 				REL(lmp) = (void *)(dyn->d_un.d_ptr + base);
1778 				break;
1779 			case DT_RELSZ:
1780 			case DT_RELASZ:
1781 				RELSZ(lmp) = dyn->d_un.d_val;
1782 				break;
1783 			case DT_RELENT:
1784 			case DT_RELAENT:
1785 				RELENT(lmp) = dyn->d_un.d_val;
1786 				break;
1787 			case DT_RELCOUNT:
1788 			case DT_RELACOUNT:
1789 				RELACOUNT(lmp) = (uint_t)dyn->d_un.d_val;
1790 				break;
1791 			case DT_HASH:
1792 				HASH(lmp) = (uint_t *)(dyn->d_un.d_ptr + base);
1793 				break;
1794 			case DT_PLTGOT:
1795 				PLTGOT(lmp) =
1796 				    (uint_t *)(dyn->d_un.d_ptr + base);
1797 				break;
1798 			case DT_PLTRELSZ:
1799 				PLTRELSZ(lmp) = dyn->d_un.d_val;
1800 				break;
1801 			case DT_JMPREL:
1802 				JMPREL(lmp) = (void *)(dyn->d_un.d_ptr + base);
1803 				break;
1804 			case DT_INIT:
1805 				if (dyn->d_un.d_ptr != NULL)
1806 					INIT(lmp) =
1807 					    (void (*)())(dyn->d_un.d_ptr +
1808 					    base);
1809 				break;
1810 			case DT_FINI:
1811 				if (dyn->d_un.d_ptr != NULL)
1812 					FINI(lmp) =
1813 					    (void (*)())(dyn->d_un.d_ptr +
1814 					    base);
1815 				break;
1816 			case DT_INIT_ARRAY:
1817 				INITARRAY(lmp) = (Addr *)(dyn->d_un.d_ptr +
1818 				    base);
1819 				break;
1820 			case DT_INIT_ARRAYSZ:
1821 				INITARRAYSZ(lmp) = (uint_t)dyn->d_un.d_val;
1822 				break;
1823 			case DT_FINI_ARRAY:
1824 				FINIARRAY(lmp) = (Addr *)(dyn->d_un.d_ptr +
1825 				    base);
1826 				break;
1827 			case DT_FINI_ARRAYSZ:
1828 				FINIARRAYSZ(lmp) = (uint_t)dyn->d_un.d_val;
1829 				break;
1830 			case DT_PREINIT_ARRAY:
1831 				PREINITARRAY(lmp) = (Addr *)(dyn->d_un.d_ptr +
1832 				    base);
1833 				break;
1834 			case DT_PREINIT_ARRAYSZ:
1835 				PREINITARRAYSZ(lmp) = (uint_t)dyn->d_un.d_val;
1836 				break;
1837 			case DT_RPATH:
1838 			case DT_RUNPATH:
1839 				rpath = dyn->d_un.d_val;
1840 				break;
1841 			case DT_FILTER:
1842 				fltr = dyn->d_un.d_val;
1843 				OBJFLTRNDX(lmp) = dynndx;
1844 				FLAGS1(lmp) |= FL1_RT_OBJSFLTR;
1845 				break;
1846 			case DT_AUXILIARY:
1847 				if (!(rtld_flags & RT_FL_NOAUXFLTR)) {
1848 					fltr = dyn->d_un.d_val;
1849 					OBJFLTRNDX(lmp) = dynndx;
1850 				}
1851 				FLAGS1(lmp) |= FL1_RT_OBJAFLTR;
1852 				break;
1853 			case DT_SUNW_FILTER:
1854 				SYMSFLTRCNT(lmp)++;
1855 				FLAGS1(lmp) |= FL1_RT_SYMSFLTR;
1856 				break;
1857 			case DT_SUNW_AUXILIARY:
1858 				if (!(rtld_flags & RT_FL_NOAUXFLTR)) {
1859 					SYMAFLTRCNT(lmp)++;
1860 				}
1861 				FLAGS1(lmp) |= FL1_RT_SYMAFLTR;
1862 				break;
1863 			case DT_DEPAUDIT:
1864 				if (!(rtld_flags & RT_FL_NOAUDIT))
1865 					audit = dyn->d_un.d_val;
1866 				break;
1867 			case DT_CONFIG:
1868 				cfile = dyn->d_un.d_val;
1869 				break;
1870 			case DT_DEBUG:
1871 				/*
1872 				 * DT_DEBUG entries are only created in
1873 				 * dynamic objects that require an interpretor
1874 				 * (ie. all dynamic executables and some shared
1875 				 * objects), and provide for a hand-shake with
1876 				 * debuggers.  This entry is initialized to
1877 				 * zero by the link-editor.  If a debugger has
1878 				 * us and updated this entry set the debugger
1879 				 * flag, and finish initializing the debugging
1880 				 * structure (see setup() also).  Switch off any
1881 				 * configuration object use as most debuggers
1882 				 * can't handle fixed dynamic executables as
1883 				 * dependencies, and we can't handle requests
1884 				 * like object padding for alternative objects.
1885 				 */
1886 				if (dyn->d_un.d_ptr)
1887 					rtld_flags |=
1888 					    (RT_FL_DEBUGGER | RT_FL_NOOBJALT);
1889 				dyn->d_un.d_ptr = (Addr)&r_debug;
1890 				break;
1891 			case DT_VERNEED:
1892 				VERNEED(lmp) = (Verneed *)(dyn->d_un.d_ptr +
1893 				    base);
1894 				break;
1895 			case DT_VERNEEDNUM:
1896 				/* LINTED */
1897 				VERNEEDNUM(lmp) = (int)dyn->d_un.d_val;
1898 				break;
1899 			case DT_VERDEF:
1900 				VERDEF(lmp) = (Verdef *)(dyn->d_un.d_ptr +
1901 				    base);
1902 				break;
1903 			case DT_VERDEFNUM:
1904 				/* LINTED */
1905 				VERDEFNUM(lmp) = (int)dyn->d_un.d_val;
1906 				break;
1907 			case DT_VERSYM:
1908 				/*
1909 				 * The Solaris ld does not produce DT_VERSYM,
1910 				 * but the GNU ld does, in order to support
1911 				 * their style of versioning, which differs
1912 				 * from ours in some ways, while using the
1913 				 * same data structures. The presence of
1914 				 * DT_VERSYM therefore means that GNU
1915 				 * versioning rules apply to the given file.
1916 				 * If DT_VERSYM is not present, then Solaris
1917 				 * versioning rules apply.
1918 				 */
1919 				VERSYM(lmp) = (Versym *)(dyn->d_un.d_ptr +
1920 				    base);
1921 				break;
1922 			case DT_BIND_NOW:
1923 				if ((dyn->d_un.d_val & DF_BIND_NOW) &&
1924 				    ((rtld_flags2 & RT_FL2_BINDLAZY) == 0)) {
1925 					MODE(lmp) |= RTLD_NOW;
1926 					MODE(lmp) &= ~RTLD_LAZY;
1927 				}
1928 				break;
1929 			case DT_FLAGS:
1930 				FLAGS1(lmp) |= FL1_RT_DTFLAGS;
1931 				if (dyn->d_un.d_val & DF_SYMBOLIC)
1932 					FLAGS1(lmp) |= FL1_RT_SYMBOLIC;
1933 				if ((dyn->d_un.d_val & DF_BIND_NOW) &&
1934 				    ((rtld_flags2 & RT_FL2_BINDLAZY) == 0)) {
1935 					MODE(lmp) |= RTLD_NOW;
1936 					MODE(lmp) &= ~RTLD_LAZY;
1937 				}
1938 				/*
1939 				 * Capture any static TLS use, and enforce that
1940 				 * this object be non-deletable.
1941 				 */
1942 				if (dyn->d_un.d_val & DF_STATIC_TLS) {
1943 					FLAGS1(lmp) |= FL1_RT_TLSSTAT;
1944 					MODE(lmp) |= RTLD_NODELETE;
1945 				}
1946 				break;
1947 			case DT_FLAGS_1:
1948 				if (dyn->d_un.d_val & DF_1_DISPRELPND)
1949 					FLAGS1(lmp) |= FL1_RT_DISPREL;
1950 				if (dyn->d_un.d_val & DF_1_GROUP)
1951 					FLAGS(lmp) |=
1952 					    (FLG_RT_SETGROUP | FLG_RT_HANDLE);
1953 				if ((dyn->d_un.d_val & DF_1_NOW) &&
1954 				    ((rtld_flags2 & RT_FL2_BINDLAZY) == 0)) {
1955 					MODE(lmp) |= RTLD_NOW;
1956 					MODE(lmp) &= ~RTLD_LAZY;
1957 				}
1958 				if (dyn->d_un.d_val & DF_1_NODELETE)
1959 					MODE(lmp) |= RTLD_NODELETE;
1960 				if (dyn->d_un.d_val & DF_1_INITFIRST)
1961 					FLAGS(lmp) |= FLG_RT_INITFRST;
1962 				if (dyn->d_un.d_val & DF_1_NOOPEN)
1963 					FLAGS(lmp) |= FLG_RT_NOOPEN;
1964 				if (dyn->d_un.d_val & DF_1_LOADFLTR)
1965 					FLAGS(lmp) |= FLG_RT_LOADFLTR;
1966 				if (dyn->d_un.d_val & DF_1_NODUMP)
1967 					FLAGS(lmp) |= FLG_RT_NODUMP;
1968 				if (dyn->d_un.d_val & DF_1_CONFALT)
1969 					crle = 1;
1970 				if (dyn->d_un.d_val & DF_1_DIRECT)
1971 					FLAGS1(lmp) |= FL1_RT_DIRECT;
1972 				if (dyn->d_un.d_val & DF_1_NODEFLIB)
1973 					FLAGS1(lmp) |= FL1_RT_NODEFLIB;
1974 				if (dyn->d_un.d_val & DF_1_ENDFILTEE)
1975 					FLAGS1(lmp) |= FL1_RT_ENDFILTE;
1976 				if (dyn->d_un.d_val & DF_1_TRANS)
1977 					FLAGS(lmp) |= FLG_RT_TRANS;
1978 
1979 				/*
1980 				 * Global auditing is only meaningful when
1981 				 * specified by the initiating object of the
1982 				 * process - typically the dynamic executable.
1983 				 * If this is the initiaiting object, its link-
1984 				 * map will not yet have been added to the
1985 				 * link-map list, and consequently the link-map
1986 				 * list is empty.  (see setup()).
1987 				 */
1988 				if (dyn->d_un.d_val & DF_1_GLOBAUDIT) {
1989 					if (lml_main.lm_head == NULL)
1990 						FLAGS1(lmp) |= FL1_RT_GLOBAUD;
1991 					else
1992 						DBG_CALL(Dbg_audit_ignore(lmp));
1993 				}
1994 
1995 				/*
1996 				 * If this object identifies itself as an
1997 				 * interposer, but relocation processing has
1998 				 * already started, then demote it.  It's too
1999 				 * late to guarantee complete interposition.
2000 				 */
2001 				/* BEGIN CSTYLED */
2002 				if (dyn->d_un.d_val &
2003 				    (DF_1_INTERPOSE | DF_1_SYMINTPOSE)) {
2004 				    if (lml->lm_flags & LML_FLG_STARTREL) {
2005 					DBG_CALL(Dbg_util_intoolate(lmp));
2006 					if (lml->lm_flags & LML_FLG_TRC_ENABLE)
2007 					    (void) printf(
2008 						MSG_INTL(MSG_LDD_REL_ERR2),
2009 						NAME(lmp));
2010 				    } else if (dyn->d_un.d_val & DF_1_INTERPOSE)
2011 					FLAGS(lmp) |= FLG_RT_OBJINTPO;
2012 				    else
2013 					FLAGS(lmp) |= FLG_RT_SYMINTPO;
2014 				}
2015 				/* END CSTYLED */
2016 				break;
2017 			case DT_SYMINFO:
2018 				SYMINFO(lmp) = (Syminfo *)(dyn->d_un.d_ptr +
2019 				    base);
2020 				break;
2021 			case DT_SYMINENT:
2022 				SYMINENT(lmp) = dyn->d_un.d_val;
2023 				break;
2024 			case DT_PLTPAD:
2025 				PLTPAD(lmp) = (void *)(dyn->d_un.d_ptr + base);
2026 				break;
2027 			case DT_PLTPADSZ:
2028 				pltpadsz = dyn->d_un.d_val;
2029 				break;
2030 			case DT_SUNW_RTLDINF:
2031 				/*
2032 				 * Maintain a list of RTLDINFO structures.
2033 				 * Typically, libc is the only supplier, and
2034 				 * only one structure is provided.  However,
2035 				 * multiple suppliers and multiple structures
2036 				 * are supported.  For example, one structure
2037 				 * may provide thread_init, and another
2038 				 * structure may provide atexit reservations.
2039 				 */
2040 				if ((rti = alist_append(&lml->lm_rti, 0,
2041 				    sizeof (Rti_desc),
2042 				    AL_CNT_RTLDINFO)) == NULL) {
2043 					remove_so(0, lmp);
2044 					return (NULL);
2045 				}
2046 				rti->rti_lmp = lmp;
2047 				rti->rti_info = (void *)(dyn->d_un.d_ptr +
2048 				    base);
2049 				break;
2050 			case DT_SUNW_SORTENT:
2051 				SUNWSORTENT(lmp) = dyn->d_un.d_val;
2052 				break;
2053 			case DT_SUNW_SYMSORT:
2054 				SUNWSYMSORT(lmp) =
2055 				    (void *)(dyn->d_un.d_ptr + base);
2056 				break;
2057 			case DT_SUNW_SYMSORTSZ:
2058 				SUNWSYMSORTSZ(lmp) = dyn->d_un.d_val;
2059 				break;
2060 			case DT_DEPRECATED_SPARC_REGISTER:
2061 			case M_DT_REGISTER:
2062 				FLAGS(lmp) |= FLG_RT_REGSYMS;
2063 				break;
2064 			}
2065 		}
2066 
2067 		if (PLTPAD(lmp)) {
2068 			if (pltpadsz == (Xword)0)
2069 				PLTPAD(lmp) = NULL;
2070 			else
2071 				PLTPADEND(lmp) = (void *)((Addr)PLTPAD(lmp) +
2072 				    pltpadsz);
2073 		}
2074 	}
2075 
2076 	/*
2077 	 * A dynsym contains only global functions. We want to have
2078 	 * a version of it that also includes local functions, so that
2079 	 * dladdr() will be able to report names for local functions
2080 	 * when used to generate a stack trace for a stripped file.
2081 	 * This version of the dynsym is provided via DT_SUNW_SYMTAB.
2082 	 *
2083 	 * In producing DT_SUNW_SYMTAB, ld uses a non-obvious trick
2084 	 * in order to avoid having to have two copies of the global
2085 	 * symbols held in DT_SYMTAB: The local symbols are placed in
2086 	 * a separate section than the globals in the dynsym, but the
2087 	 * linker conspires to put the data for these two sections adjacent
2088 	 * to each other. DT_SUNW_SYMTAB points at the top of the local
2089 	 * symbols, and DT_SUNW_SYMSZ is the combined length of both tables.
2090 	 *
2091 	 * If the two sections are not adjacent, then something went wrong
2092 	 * at link time. We use ASSERT to kill the process if this is
2093 	 * a debug build. In a production build, we will silently ignore
2094 	 * the presence of the .ldynsym and proceed. We can detect this
2095 	 * situation by checking to see that DT_SYMTAB lies in
2096 	 * the range given by DT_SUNW_SYMTAB/DT_SUNW_SYMSZ.
2097 	 */
2098 	if ((SUNWSYMTAB(lmp) != NULL) &&
2099 	    (((char *)SYMTAB(lmp) <= (char *)SUNWSYMTAB(lmp)) ||
2100 	    (((char *)SYMTAB(lmp) >=
2101 	    (SUNWSYMSZ(lmp) + (char *)SUNWSYMTAB(lmp)))))) {
2102 		ASSERT(0);
2103 		SUNWSYMTAB(lmp) = NULL;
2104 		SUNWSYMSZ(lmp) = 0;
2105 	}
2106 
2107 	/*
2108 	 * If configuration file use hasn't been disabled, and a configuration
2109 	 * file hasn't already been set via an environment variable, see if any
2110 	 * application specific configuration file is specified.  An LD_CONFIG
2111 	 * setting is used first, but if this image was generated via crle(1)
2112 	 * then a default configuration file is a fall-back.
2113 	 */
2114 	if ((!(rtld_flags & RT_FL_NOCFG)) && (config->c_name == NULL)) {
2115 		if (cfile)
2116 			config->c_name = (const char *)(cfile +
2117 			    (char *)STRTAB(lmp));
2118 		else if (crle)
2119 			rtld_flags |= RT_FL_CONFAPP;
2120 	}
2121 
2122 	if (rpath)
2123 		RPATH(lmp) = (char *)(rpath + (char *)STRTAB(lmp));
2124 	if (fltr)
2125 		REFNAME(lmp) = (char *)(fltr + (char *)STRTAB(lmp));
2126 
2127 	/*
2128 	 * For Intel ABI compatibility.  It's possible that a JMPREL can be
2129 	 * specified without any other relocations (e.g. a dynamic executable
2130 	 * normally only contains .plt relocations).  If this is the case then
2131 	 * no REL, RELSZ or RELENT will have been created.  For us to be able
2132 	 * to traverse the .plt relocations under LD_BIND_NOW we need to know
2133 	 * the RELENT for these relocations.  Refer to elf_reloc() for more
2134 	 * details.
2135 	 */
2136 	if (!RELENT(lmp) && JMPREL(lmp))
2137 		RELENT(lmp) = sizeof (M_RELOC);
2138 
2139 	/*
2140 	 * Establish any per-object auditing.  If we're establishing `main's
2141 	 * link-map its too early to go searching for audit objects so just
2142 	 * hold the object name for later (see setup()).
2143 	 */
2144 	if (audit) {
2145 		char	*cp = audit + (char *)STRTAB(lmp);
2146 
2147 		if (*cp) {
2148 			if (((AUDITORS(lmp) =
2149 			    calloc(1, sizeof (Audit_desc))) == NULL) ||
2150 			    ((AUDITORS(lmp)->ad_name = strdup(cp)) == NULL)) {
2151 				remove_so(0, lmp);
2152 				return (NULL);
2153 			}
2154 			if (lml_main.lm_head) {
2155 				if (audit_setup(lmp, AUDITORS(lmp), 0,
2156 				    in_nfavl) == 0) {
2157 					remove_so(0, lmp);
2158 					return (NULL);
2159 				}
2160 				AFLAGS(lmp) |= AUDITORS(lmp)->ad_flags;
2161 				lml->lm_flags |= LML_FLG_LOCAUDIT;
2162 			}
2163 		}
2164 	}
2165 
2166 	if (tphdr && (tls_assign(lml, lmp, tphdr) == 0)) {
2167 		remove_so(0, lmp);
2168 		return (NULL);
2169 	}
2170 
2171 	if (cap)
2172 		cap_assign(cap, lmp);
2173 
2174 	/*
2175 	 * Add the mapped object to the end of the link map list.
2176 	 */
2177 	lm_append(lml, lmco, lmp);
2178 
2179 	/*
2180 	 * Start the system loading in the ELF information we'll be processing.
2181 	 */
2182 	if (REL(lmp)) {
2183 		(void) madvise((void *)ADDR(lmp), (uintptr_t)REL(lmp) +
2184 		    (uintptr_t)RELSZ(lmp) - (uintptr_t)ADDR(lmp),
2185 		    MADV_WILLNEED);
2186 	}
2187 	return (lmp);
2188 }
2189 
2190 /*
2191  * Assign hardware/software capabilities.
2192  */
2193 void
2194 cap_assign(Cap *cap, Rt_map *lmp)
2195 {
2196 	while (cap->c_tag != CA_SUNW_NULL) {
2197 		switch (cap->c_tag) {
2198 		case CA_SUNW_HW_1:
2199 			HWCAP(lmp) = cap->c_un.c_val;
2200 			break;
2201 		case CA_SUNW_SF_1:
2202 			SFCAP(lmp) = cap->c_un.c_val;
2203 		}
2204 		cap++;
2205 	}
2206 }
2207 
2208 /*
2209  * Build full pathname of shared object from given directory name and filename.
2210  */
2211 static char *
2212 elf_get_so(const char *dir, const char *file, size_t dlen, size_t flen)
2213 {
2214 	static char	pname[PATH_MAX];
2215 
2216 	(void) strncpy(pname, dir, dlen);
2217 	pname[dlen++] = '/';
2218 	(void) strncpy(&pname[dlen], file, flen + 1);
2219 	return (pname);
2220 }
2221 
2222 /*
2223  * The copy relocation is recorded in a copy structure which will be applied
2224  * after all other relocations are carried out.  This provides for copying data
2225  * that must be relocated itself (ie. pointers in shared objects).  This
2226  * structure also provides a means of binding RTLD_GROUP dependencies to any
2227  * copy relocations that have been taken from any group members.
2228  *
2229  * If the size of the .bss area available for the copy information is not the
2230  * same as the source of the data inform the user if we're under ldd(1) control
2231  * (this checking was only established in 5.3, so by only issuing an error via
2232  * ldd(1) we maintain the standard set by previous releases).
2233  */
2234 int
2235 elf_copy_reloc(char *name, Sym *rsym, Rt_map *rlmp, void *radd, Sym *dsym,
2236     Rt_map *dlmp, const void *dadd)
2237 {
2238 	Rel_copy	rc;
2239 	Lm_list		*lml = LIST(rlmp);
2240 
2241 	rc.r_name = name;
2242 	rc.r_rsym = rsym;		/* the new reference symbol and its */
2243 	rc.r_rlmp = rlmp;		/*	associated link-map */
2244 	rc.r_dlmp = dlmp;		/* the defining link-map */
2245 	rc.r_dsym = dsym;		/* the original definition */
2246 	rc.r_radd = radd;
2247 	rc.r_dadd = dadd;
2248 
2249 	if (rsym->st_size > dsym->st_size)
2250 		rc.r_size = (size_t)dsym->st_size;
2251 	else
2252 		rc.r_size = (size_t)rsym->st_size;
2253 
2254 	if (alist_append(&COPY_R(dlmp), &rc, sizeof (Rel_copy),
2255 	    AL_CNT_COPYREL) == NULL) {
2256 		if (!(lml->lm_flags & LML_FLG_TRC_WARN))
2257 			return (0);
2258 		else
2259 			return (1);
2260 	}
2261 	if (!(FLAGS1(dlmp) & FL1_RT_COPYTOOK)) {
2262 		if (aplist_append(&COPY_S(rlmp), dlmp,
2263 		    AL_CNT_COPYREL) == NULL) {
2264 			if (!(lml->lm_flags & LML_FLG_TRC_WARN))
2265 				return (0);
2266 			else
2267 				return (1);
2268 		}
2269 		FLAGS1(dlmp) |= FL1_RT_COPYTOOK;
2270 	}
2271 
2272 	/*
2273 	 * If we are tracing (ldd), warn the user if
2274 	 *	1) the size from the reference symbol differs from the
2275 	 *	   copy definition. We can only copy as much data as the
2276 	 *	   reference (dynamic executables) entry allows.
2277 	 *	2) the copy definition has STV_PROTECTED visibility.
2278 	 */
2279 	if (lml->lm_flags & LML_FLG_TRC_WARN) {
2280 		if (rsym->st_size != dsym->st_size) {
2281 			(void) printf(MSG_INTL(MSG_LDD_CPY_SIZDIF),
2282 			    _conv_reloc_type(M_R_COPY), demangle(name),
2283 			    NAME(rlmp), EC_XWORD(rsym->st_size),
2284 			    NAME(dlmp), EC_XWORD(dsym->st_size));
2285 			if (rsym->st_size > dsym->st_size)
2286 				(void) printf(MSG_INTL(MSG_LDD_CPY_INSDATA),
2287 				    NAME(dlmp));
2288 			else
2289 				(void) printf(MSG_INTL(MSG_LDD_CPY_DATRUNC),
2290 				    NAME(rlmp));
2291 		}
2292 
2293 		if (ELF_ST_VISIBILITY(dsym->st_other) == STV_PROTECTED) {
2294 			(void) printf(MSG_INTL(MSG_LDD_CPY_PROT),
2295 			    _conv_reloc_type(M_R_COPY), demangle(name),
2296 			    NAME(dlmp));
2297 		}
2298 	}
2299 
2300 	DBG_CALL(Dbg_reloc_apply_val(lml, ELF_DBG_RTLD, (Xword)radd,
2301 	    (Xword)rc.r_size));
2302 	return (1);
2303 }
2304 
2305 /*
2306  * Determine the symbol location of an address within a link-map.  Look for
2307  * the nearest symbol (whose value is less than or equal to the required
2308  * address).  This is the object specific part of dladdr().
2309  */
2310 static void
2311 elf_dladdr(ulong_t addr, Rt_map *lmp, Dl_info *dlip, void **info, int flags)
2312 {
2313 	ulong_t		ndx, cnt, base, _value;
2314 	Sym		*sym, *_sym = NULL;
2315 	const char	*str;
2316 	int		_flags;
2317 	uint_t		*dynaddr_ndx;
2318 	uint_t		dynaddr_n = 0;
2319 	ulong_t		value;
2320 
2321 	/*
2322 	 * If SUNWSYMTAB() is non-NULL, then it sees a special version of
2323 	 * the dynsym that starts with any local function symbols that exist in
2324 	 * the library and then moves to the data held in SYMTAB(). In this
2325 	 * case, SUNWSYMSZ tells us how long the symbol table is. The
2326 	 * availability of local function symbols will enhance the results
2327 	 * we can provide.
2328 	 *
2329 	 * If SUNWSYMTAB() is non-NULL, then there might also be a
2330 	 * SUNWSYMSORT() vector associated with it. SUNWSYMSORT() contains
2331 	 * an array of indices into SUNWSYMTAB, sorted by increasing
2332 	 * address. We can use this to do an O(log N) search instead of a
2333 	 * brute force search.
2334 	 *
2335 	 * If SUNWSYMTAB() is NULL, then SYMTAB() references a dynsym that
2336 	 * contains only global symbols. In that case, the length of
2337 	 * the symbol table comes from the nchain field of the related
2338 	 * symbol lookup hash table.
2339 	 */
2340 	str = STRTAB(lmp);
2341 	if (SUNWSYMSZ(lmp) == NULL) {
2342 		sym = SYMTAB(lmp);
2343 		/*
2344 		 * If we don't have a .hash table there are no symbols
2345 		 * to look at.
2346 		 */
2347 		if (HASH(lmp) == NULL)
2348 			return;
2349 		cnt = HASH(lmp)[1];
2350 	} else {
2351 		sym = SUNWSYMTAB(lmp);
2352 		cnt = SUNWSYMSZ(lmp) / SYMENT(lmp);
2353 		dynaddr_ndx = SUNWSYMSORT(lmp);
2354 		if (dynaddr_ndx != NULL)
2355 			dynaddr_n = SUNWSYMSORTSZ(lmp) / SUNWSORTENT(lmp);
2356 	}
2357 
2358 	if (FLAGS(lmp) & FLG_RT_FIXED)
2359 		base = 0;
2360 	else
2361 		base = ADDR(lmp);
2362 
2363 	if (dynaddr_n > 0) {		/* Binary search */
2364 		long	low = 0, low_bnd;
2365 		long	high = dynaddr_n - 1, high_bnd;
2366 		long	mid;
2367 		Sym	*mid_sym;
2368 
2369 		/*
2370 		 * Note that SUNWSYMSORT only contains symbols types that
2371 		 * supply memory addresses, so there's no need to check and
2372 		 * filter out any other types.
2373 		 */
2374 		low_bnd = low;
2375 		high_bnd = high;
2376 		while (low <= high) {
2377 			mid = (low + high) / 2;
2378 			mid_sym = &sym[dynaddr_ndx[mid]];
2379 			value = mid_sym->st_value + base;
2380 			if (addr < value) {
2381 				if ((sym[dynaddr_ndx[high]].st_value + base) >=
2382 				    addr)
2383 					high_bnd = high;
2384 				high = mid - 1;
2385 			} else if (addr > value) {
2386 				if ((sym[dynaddr_ndx[low]].st_value + base) <=
2387 				    addr)
2388 					low_bnd = low;
2389 				low = mid + 1;
2390 			} else {
2391 				_sym = mid_sym;
2392 				_value = value;
2393 				break;
2394 			}
2395 		}
2396 		/*
2397 		 * If the above didn't find it exactly, then we must
2398 		 * return the closest symbol with a value that doesn't
2399 		 * exceed the one we are looking for. If that symbol exists,
2400 		 * it will lie in the range bounded by low_bnd and
2401 		 * high_bnd. This is a linear search, but a short one.
2402 		 */
2403 		if (_sym == NULL) {
2404 			for (mid = low_bnd; mid <= high_bnd; mid++) {
2405 				mid_sym = &sym[dynaddr_ndx[mid]];
2406 				value = mid_sym->st_value + base;
2407 				if (addr >= value) {
2408 					_sym = mid_sym;
2409 					_value = value;
2410 				} else {
2411 					break;
2412 				}
2413 			}
2414 		}
2415 	} else {			/* Linear search */
2416 		for (_value = 0, sym++, ndx = 1; ndx < cnt; ndx++, sym++) {
2417 			/*
2418 			 * Skip expected symbol types that are not functions
2419 			 * or data:
2420 			 *	- A symbol table starts with an undefined symbol
2421 			 *		in slot 0. If we are using SUNWSYMTAB(),
2422 			 *		there will be a second undefined symbol
2423 			 *		right before the globals.
2424 			 *	- The local part of SUNWSYMTAB() contains a
2425 			 *		series of function symbols. Each section
2426 			 *		starts with an initial STT_FILE symbol.
2427 			 */
2428 			if ((sym->st_shndx == SHN_UNDEF) ||
2429 			    (ELF_ST_TYPE(sym->st_info) == STT_FILE))
2430 				continue;
2431 
2432 			value = sym->st_value + base;
2433 			if (value > addr)
2434 				continue;
2435 			if (value < _value)
2436 				continue;
2437 
2438 			_sym = sym;
2439 			_value = value;
2440 
2441 			/*
2442 			 * Note, because we accept local and global symbols
2443 			 * we could find a section symbol that matches the
2444 			 * associated address, which means that the symbol
2445 			 * name will be null.  In this case continue the
2446 			 * search in case we can find a global symbol of
2447 			 * the same value.
2448 			 */
2449 			if ((value == addr) &&
2450 			    (ELF_ST_TYPE(sym->st_info) != STT_SECTION))
2451 				break;
2452 		}
2453 	}
2454 
2455 	_flags = flags & RTLD_DL_MASK;
2456 	if (_sym) {
2457 		if (_flags == RTLD_DL_SYMENT)
2458 			*info = (void *)_sym;
2459 		else if (_flags == RTLD_DL_LINKMAP)
2460 			*info = (void *)lmp;
2461 
2462 		dlip->dli_sname = str + _sym->st_name;
2463 		dlip->dli_saddr = (void *)_value;
2464 	} else {
2465 		/*
2466 		 * addr lies between the beginning of the mapped segment and
2467 		 * the first global symbol. We have no symbol to return
2468 		 * and the caller requires one. We use _START_, the base
2469 		 * address of the mapping.
2470 		 */
2471 
2472 		if (_flags == RTLD_DL_SYMENT) {
2473 			/*
2474 			 * An actual symbol struct is needed, so we
2475 			 * construct one for _START_. To do this in a
2476 			 * fully accurate way requires a different symbol
2477 			 * for each mapped segment. This requires the
2478 			 * use of dynamic memory and a mutex. That's too much
2479 			 * plumbing for a fringe case of limited importance.
2480 			 *
2481 			 * Fortunately, we can simplify:
2482 			 *    - Only the st_size and st_info fields are useful
2483 			 *	outside of the linker internals. The others
2484 			 *	reference things that outside code cannot see,
2485 			 *	and can be set to 0.
2486 			 *    - It's just a label and there is no size
2487 			 *	to report. So, the size should be 0.
2488 			 * This means that only st_info needs a non-zero
2489 			 * (constant) value. A static struct will suffice.
2490 			 * It must be const (readonly) so the caller can't
2491 			 * change its meaning for subsequent callers.
2492 			 */
2493 			static const Sym fsym = { 0, 0, 0,
2494 			    ELF_ST_INFO(STB_LOCAL, STT_OBJECT) };
2495 			*info = (void *) &fsym;
2496 		}
2497 
2498 		dlip->dli_sname = MSG_ORIG(MSG_SYM_START);
2499 		dlip->dli_saddr = (void *) ADDR(lmp);
2500 	}
2501 }
2502 
2503 static void
2504 elf_lazy_cleanup(APlist *alp)
2505 {
2506 	Rt_map	*lmp;
2507 	Aliste	idx;
2508 
2509 	/*
2510 	 * Cleanup any link-maps added to this dynamic list and free it.
2511 	 */
2512 	for (APLIST_TRAVERSE(alp, idx, lmp))
2513 		FLAGS(lmp) &= ~FLG_RT_TMPLIST;
2514 	free(alp);
2515 }
2516 
2517 /*
2518  * This routine is called as a last fall-back to search for a symbol from a
2519  * standard relocation.  To maintain lazy loadings goal of reducing the number
2520  * of objects mapped, any symbol search is first carried out using the objects
2521  * that already exist in the process (either on a link-map list or handle).
2522  * If a symbol can't be found, and lazy dependencies are still pending, this
2523  * routine loads the dependencies in an attempt to locate the symbol.
2524  *
2525  * Only new objects are inspected as we will have already inspected presently
2526  * loaded objects before calling this routine.  However, a new object may not
2527  * be new - although the di_lmp might be zero, the object may have been mapped
2528  * as someone elses dependency.  Thus there's a possibility of some symbol
2529  * search duplication.
2530  */
2531 Sym *
2532 elf_lazy_find_sym(Slookup *slp, Rt_map **_lmp, uint_t *binfo, int *in_nfavl)
2533 {
2534 	Sym		*sym = NULL;
2535 	APlist		*alist = NULL;
2536 	Aliste		idx;
2537 	Rt_map		*lmp1, *lmp = slp->sl_imap;
2538 	const char	*name = slp->sl_name;
2539 
2540 	/*
2541 	 * Generate a local list of new objects to process.  This list can grow
2542 	 * as each object supplies its own lazy dependencies.
2543 	 */
2544 	if (aplist_append(&alist, lmp, AL_CNT_LAZYFIND) == NULL)
2545 		return (NULL);
2546 	FLAGS(lmp) |= FLG_RT_TMPLIST;
2547 
2548 	for (APLIST_TRAVERSE(alist, idx, lmp1)) {
2549 		uint_t	cnt = 0;
2550 		Slookup	sl = *slp;
2551 		Dyninfo	*dip, *pdip;
2552 
2553 		/*
2554 		 * Discard any relocation index from further symbol searches.
2555 		 * This index will have already been used to trigger any
2556 		 * necessary lazy-loads, and it might be because one of these
2557 		 * lazy loads have failed that we're here performing this
2558 		 * fallback.  By removing the relocation index we don't try
2559 		 * and perform the same failed lazy loading activity again.
2560 		 */
2561 		sl.sl_rsymndx = 0;
2562 
2563 		/*
2564 		 * Loop through the lazy DT_NEEDED entries examining each object
2565 		 * for the required symbol.  If the symbol is not found, the
2566 		 * object is in turn added to the local alist, so that the
2567 		 * objects lazy DT_NEEDED entries can be examined.
2568 		 */
2569 		lmp = lmp1;
2570 		for (dip = DYNINFO(lmp), pdip = NULL; cnt < DYNINFOCNT(lmp);
2571 		    cnt++, pdip = dip++) {
2572 			Rt_map *nlmp;
2573 
2574 			if (((dip->di_flags & FLG_DI_LAZY) == 0) ||
2575 			    dip->di_info)
2576 				continue;
2577 
2578 			/*
2579 			 * If this object has already failed to lazy load, and
2580 			 * we're still processing the same runtime linker
2581 			 * operation that produced the failure, don't bother
2582 			 * to try and load the object again.
2583 			 */
2584 			if ((dip->di_flags & FLG_DI_LAZYFAIL) && pdip &&
2585 			    (pdip->di_flags & FLG_DI_POSFLAG1)) {
2586 				if (pdip->di_info == (void *)ld_entry_cnt)
2587 					continue;
2588 
2589 				dip->di_flags &= ~FLG_DI_LAZYFAIL;
2590 				pdip->di_info = NULL;
2591 			}
2592 
2593 			/*
2594 			 * Try loading this lazy dependency.  If the object
2595 			 * can't be loaded, consider this non-fatal and continue
2596 			 * the search.  Lazy loaded dependencies need not exist
2597 			 * and their loading should only turn out to be fatal
2598 			 * if they are required to satisfy a relocation.
2599 			 *
2600 			 * If the file is already loaded and relocated we must
2601 			 * still inspect it for symbols, even though it might
2602 			 * have already been searched.  This lazy load operation
2603 			 * might have promoted the permissions of the object,
2604 			 * and thus made the object applicable for this symbol
2605 			 * search, whereas before the object might have been
2606 			 * skipped.
2607 			 */
2608 			if ((nlmp = elf_lazy_load(lmp, &sl, cnt,
2609 			    name, in_nfavl)) == NULL)
2610 				continue;
2611 
2612 			/*
2613 			 * If this object isn't yet a part of the dynamic list
2614 			 * then inspect it for the symbol.  If the symbol isn't
2615 			 * found add the object to the dynamic list so that we
2616 			 * can inspect its dependencies.
2617 			 */
2618 			if (FLAGS(nlmp) & FLG_RT_TMPLIST)
2619 				continue;
2620 
2621 			sl.sl_imap = nlmp;
2622 			if (sym = LM_LOOKUP_SYM(sl.sl_cmap)(&sl, _lmp,
2623 			    binfo, in_nfavl))
2624 				break;
2625 
2626 			/*
2627 			 * Some dlsym() operations are already traversing a
2628 			 * link-map (dlopen(0)), and thus there's no need to
2629 			 * build our own dynamic dependency list.
2630 			 */
2631 			if ((sl.sl_flags & LKUP_NODESCENT) == 0) {
2632 				if (aplist_append(&alist, nlmp,
2633 				    AL_CNT_LAZYFIND) == NULL) {
2634 					elf_lazy_cleanup(alist);
2635 					return (NULL);
2636 				}
2637 				FLAGS(nlmp) |= FLG_RT_TMPLIST;
2638 			}
2639 		}
2640 		if (sym)
2641 			break;
2642 	}
2643 
2644 	elf_lazy_cleanup(alist);
2645 	return (sym);
2646 }
2647 
2648 /*
2649  * Warning message for bad r_offset.
2650  */
2651 void
2652 elf_reloc_bad(Rt_map *lmp, void *rel, uchar_t rtype, ulong_t roffset,
2653     ulong_t rsymndx)
2654 {
2655 	const char	*name = NULL;
2656 	Lm_list		*lml = LIST(lmp);
2657 	int		trace;
2658 
2659 	if ((lml->lm_flags & LML_FLG_TRC_ENABLE) &&
2660 	    (((rtld_flags & RT_FL_SILENCERR) == 0) ||
2661 	    (lml->lm_flags & LML_FLG_TRC_VERBOSE)))
2662 		trace = 1;
2663 	else
2664 		trace = 0;
2665 
2666 	if ((trace == 0) && (DBG_ENABLED == 0))
2667 		return;
2668 
2669 	if (rsymndx) {
2670 		Sym	*symref = (Sym *)((ulong_t)SYMTAB(lmp) +
2671 		    (rsymndx * SYMENT(lmp)));
2672 
2673 		if (ELF_ST_BIND(symref->st_info) != STB_LOCAL)
2674 			name = (char *)(STRTAB(lmp) + symref->st_name);
2675 	}
2676 
2677 	if (name == NULL)
2678 		name = MSG_INTL(MSG_STR_UNKNOWN);
2679 
2680 	if (trace) {
2681 		const char *rstr;
2682 
2683 		rstr = _conv_reloc_type((uint_t)rtype);
2684 		(void) printf(MSG_INTL(MSG_LDD_REL_ERR1), rstr, name,
2685 		    EC_ADDR(roffset));
2686 		return;
2687 	}
2688 
2689 	Dbg_reloc_error(lml, ELF_DBG_RTLD, M_MACH, M_REL_SHT_TYPE, rel, name);
2690 }
2691 
2692 /*
2693  * Resolve a static TLS relocation.
2694  */
2695 long
2696 elf_static_tls(Rt_map *lmp, Sym *sym, void *rel, uchar_t rtype, char *name,
2697     ulong_t roffset, long value)
2698 {
2699 	Lm_list	*lml = LIST(lmp);
2700 
2701 	/*
2702 	 * Relocations against a static TLS block have limited support once
2703 	 * process initialization has completed.  Any error condition should be
2704 	 * discovered by testing for DF_STATIC_TLS as part of loading an object,
2705 	 * however individual relocations are tested in case the dynamic flag
2706 	 * had not been set when this object was built.
2707 	 */
2708 	if (PTTLS(lmp) == NULL) {
2709 		DBG_CALL(Dbg_reloc_in(lml, ELF_DBG_RTLD, M_MACH,
2710 		    M_REL_SHT_TYPE, rel, NULL, name));
2711 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_BADTLS),
2712 		    _conv_reloc_type((uint_t)rtype), NAME(lmp),
2713 		    name ? demangle(name) : MSG_INTL(MSG_STR_UNKNOWN));
2714 		return (0);
2715 	}
2716 
2717 	/*
2718 	 * If no static TLS has been set aside for this object, determine if
2719 	 * any can be obtained.  Enforce that any object using static TLS is
2720 	 * non-deletable.
2721 	 */
2722 	if (TLSSTATOFF(lmp) == 0) {
2723 		FLAGS1(lmp) |= FL1_RT_TLSSTAT;
2724 		MODE(lmp) |= RTLD_NODELETE;
2725 
2726 		if (tls_assign(lml, lmp, PTTLS(lmp)) == 0) {
2727 			DBG_CALL(Dbg_reloc_in(lml, ELF_DBG_RTLD, M_MACH,
2728 			    M_REL_SHT_TYPE, rel, NULL, name));
2729 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_BADTLS),
2730 			    _conv_reloc_type((uint_t)rtype), NAME(lmp),
2731 			    name ? demangle(name) : MSG_INTL(MSG_STR_UNKNOWN));
2732 			return (0);
2733 		}
2734 	}
2735 
2736 	/*
2737 	 * Typically, a static TLS offset is maintained as a symbols value.
2738 	 * For local symbols that are not apart of the dynamic symbol table,
2739 	 * the TLS relocation points to a section symbol, and the static TLS
2740 	 * offset was deposited in the associated GOT table.  Make sure the GOT
2741 	 * is cleared, so that the value isn't reused in do_reloc().
2742 	 */
2743 	if (ELF_ST_BIND(sym->st_info) == STB_LOCAL) {
2744 		if ((ELF_ST_TYPE(sym->st_info) == STT_SECTION)) {
2745 			value = *(long *)roffset;
2746 			*(long *)roffset = 0;
2747 		} else {
2748 			value = sym->st_value;
2749 		}
2750 	}
2751 	return (-(TLSSTATOFF(lmp) - value));
2752 }
2753 
2754 /*
2755  * If the symbol is not found and the reference was not to a weak symbol, report
2756  * an error.  Weak references may be unresolved.
2757  */
2758 int
2759 elf_reloc_error(Rt_map *lmp, const char *name, void *rel, uint_t binfo)
2760 {
2761 	Lm_list	*lml = LIST(lmp);
2762 
2763 	/*
2764 	 * Under crle(1), relocation failures are ignored.
2765 	 */
2766 	if (lml->lm_flags & LML_FLG_IGNRELERR)
2767 		return (1);
2768 
2769 	/*
2770 	 * Under ldd(1), unresolved references are reported.  However, if the
2771 	 * original reference is EXTERN or PARENT these references are ignored
2772 	 * unless ldd's -p option is in effect.
2773 	 */
2774 	if (lml->lm_flags & LML_FLG_TRC_WARN) {
2775 		if (((binfo & DBG_BINFO_REF_MSK) == 0) ||
2776 		    ((lml->lm_flags & LML_FLG_TRC_NOPAREXT) != 0)) {
2777 			(void) printf(MSG_INTL(MSG_LDD_SYM_NFOUND),
2778 			    demangle(name), NAME(lmp));
2779 		}
2780 		return (1);
2781 	}
2782 
2783 	/*
2784 	 * Otherwise, the unresolved references is fatal.
2785 	 */
2786 	DBG_CALL(Dbg_reloc_in(lml, ELF_DBG_RTLD, M_MACH, M_REL_SHT_TYPE, rel,
2787 	    NULL, name));
2788 	eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_NOSYM), NAME(lmp),
2789 	    demangle(name));
2790 
2791 	return (0);
2792 }
2793 
2794 /*
2795  * Generic relative relocation function.
2796  */
2797 inline static ulong_t
2798 _elf_reloc_relative(ulong_t rbgn, ulong_t base, Rt_map *lmp, APlist **textrel)
2799 {
2800 	mmapobj_result_t	*mpp;
2801 	ulong_t			roffset;
2802 
2803 	roffset = ((M_RELOC *)rbgn)->r_offset;
2804 	roffset += base;
2805 
2806 	/*
2807 	 * If this relocation is against an address that is not associated with
2808 	 * a mapped segment, fall back to the generic relocation loop to
2809 	 * collect the associated error.
2810 	 */
2811 	if ((mpp = find_segment((caddr_t)roffset, lmp)) == NULL)
2812 		return (0);
2813 
2814 	/*
2815 	 * If this relocation is against a segment that does not provide write
2816 	 * access, set the write permission for all non-writable mappings.
2817 	 */
2818 	if (((mpp->mr_prot & PROT_WRITE) == 0) && textrel &&
2819 	    ((set_prot(lmp, mpp, 1) == 0) ||
2820 	    (aplist_append(textrel, mpp, AL_CNT_TEXTREL) == NULL)))
2821 		return (0);
2822 
2823 	/*
2824 	 * Perform the actual relocation.  Note, for backward compatibility,
2825 	 * SPARC relocations are added to the offset contents (there was a time
2826 	 * when the offset was used to contain the addend, rather than using
2827 	 * the addend itself).
2828 	 */
2829 #if	defined(__sparc)
2830 	*((ulong_t *)roffset) += base + ((M_RELOC *)rbgn)->r_addend;
2831 #elif	defined(__amd64)
2832 	*((ulong_t *)roffset) = base + ((M_RELOC *)rbgn)->r_addend;
2833 #else
2834 	*((ulong_t *)roffset) += base;
2835 #endif
2836 	return (1);
2837 }
2838 
2839 /*
2840  * When a generic relocation loop realizes that it's dealing with relative
2841  * relocations, but no DT_RELCOUNT .dynamic tag is present, this tighter loop
2842  * is entered as an optimization.
2843  */
2844 ulong_t
2845 elf_reloc_relative(ulong_t rbgn, ulong_t rend, ulong_t rsize, ulong_t base,
2846     Rt_map *lmp, APlist **textrel)
2847 {
2848 	char	rtype;
2849 
2850 	do {
2851 		if (_elf_reloc_relative(rbgn, base, lmp, textrel) == 0)
2852 			break;
2853 
2854 		rbgn += rsize;
2855 		if (rbgn >= rend)
2856 			break;
2857 
2858 		/*
2859 		 * Make sure the next type is a relative relocation.
2860 		 */
2861 		rtype = ELF_R_TYPE(((M_RELOC *)rbgn)->r_info, M_MACH);
2862 
2863 	} while (rtype == M_R_RELATIVE);
2864 
2865 	return (rbgn);
2866 }
2867 
2868 /*
2869  * This is the tightest loop for RELATIVE relocations for those objects built
2870  * with the DT_RELACOUNT .dynamic entry.
2871  */
2872 ulong_t
2873 elf_reloc_relative_count(ulong_t rbgn, ulong_t rcount, ulong_t rsize,
2874     ulong_t base, Rt_map *lmp, APlist **textrel)
2875 {
2876 	for (; rcount; rcount--) {
2877 		if (_elf_reloc_relative(rbgn, base, lmp, textrel) == 0)
2878 			break;
2879 
2880 		rbgn += rsize;
2881 	}
2882 	return (rbgn);
2883 }
2884