xref: /illumos-gate/usr/src/cmd/sgs/rtld/common/dlfcns.c (revision 6148443adeb5d3f493cee0d19110b32a0189bd41)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1988 AT&T
24  *	  All Rights Reserved
25  *
26  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
27  */
28 
29 /*
30  * Programmatic interface to the run_time linker.
31  */
32 
33 #include	<sys/debug.h>
34 #include	<stdio.h>
35 #include	<string.h>
36 #include	<dlfcn.h>
37 #include	<synch.h>
38 #include	<limits.h>
39 #include	<debug.h>
40 #include	<conv.h>
41 #include	"_rtld.h"
42 #include	"_audit.h"
43 #include	"_elf.h"
44 #include	"_inline_gen.h"
45 #include	"msg.h"
46 
47 /*
48  * Determine who called us - given a pc determine in which object it resides.
49  *
50  * For dlopen() the link map of the caller must be passed to load_so() so that
51  * the appropriate search rules (4.x or 5.0) are used to locate any
52  * dependencies.  Also, if we've been called from a 4.x module it may be
53  * necessary to fix the specified pathname so that it conforms with the 5.0 elf
54  * rules.
55  *
56  * For dlsym() the link map of the caller is used to determine RTLD_NEXT
57  * requests, together with requests based off of a dlopen(0).
58  * For dladdr() this routines provides a generic means of scanning all loaded
59  * segments.
60  */
61 Rt_map *
62 _caller(caddr_t cpc, int flags)
63 {
64 	Lm_list	*lml;
65 	Aliste	idx1;
66 
67 	for (APLIST_TRAVERSE(dynlm_list, idx1, lml)) {
68 		Aliste	idx2;
69 		Lm_cntl	*lmc;
70 
71 		for (ALIST_TRAVERSE(lml->lm_lists, idx2, lmc)) {
72 			Rt_map	*lmp;
73 
74 			for (lmp = lmc->lc_head; lmp;
75 			    lmp = NEXT_RT_MAP(lmp)) {
76 
77 				if (find_segment(cpc, lmp))
78 					return (lmp);
79 			}
80 		}
81 	}
82 
83 	/*
84 	 * No mapping can be determined.  If asked for a default, assume this
85 	 * is from the executable.
86 	 */
87 	if (flags & CL_EXECDEF)
88 		return ((Rt_map *)lml_main.lm_head);
89 
90 	return (0);
91 }
92 
93 #pragma weak _dlerror = dlerror
94 
95 /*
96  * External entry for dlerror(3dl).  Returns a pointer to the string describing
97  * the last occurring error.  The last occurring error is cleared.
98  */
99 char *
100 dlerror()
101 {
102 	char	*error;
103 	Rt_map	*clmp;
104 	int	entry;
105 
106 	entry = enter(0);
107 
108 	clmp = _caller(caller(), CL_EXECDEF);
109 
110 	DBG_CALL(Dbg_dl_dlerror(clmp, lasterr));
111 
112 	error = lasterr;
113 	lasterr = NULL;
114 
115 	if (entry)
116 		leave(LIST(clmp), 0);
117 	return (error);
118 }
119 
120 /*
121  * Add a dependency as a group descriptor to a group handle.  Returns 0 on
122  * failure.  On success, returns the group descriptor, and if alep is non-NULL
123  * the *alep is set to ALE_EXISTS if the dependency already exists, or to
124  * ALE_CREATE if the dependency is newly created.
125  */
126 Grp_desc *
127 hdl_add(Grp_hdl *ghp, Rt_map *lmp, uint_t dflags, int *alep)
128 {
129 	Grp_desc	*gdp;
130 	Aliste		idx;
131 	int		ale = ALE_CREATE;
132 	uint_t		oflags;
133 
134 	/*
135 	 * Make sure this dependency hasn't already been recorded.
136 	 */
137 	for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
138 		if (gdp->gd_depend == lmp) {
139 			ale = ALE_EXISTS;
140 			break;
141 		}
142 	}
143 
144 	if (ale == ALE_CREATE) {
145 		Grp_desc	gd;
146 
147 		/*
148 		 * Create a new handle descriptor.
149 		 */
150 		gd.gd_depend = lmp;
151 		gd.gd_flags = 0;
152 
153 		/*
154 		 * Indicate this object is a part of this handles group.
155 		 */
156 		if (aplist_append(&GROUPS(lmp), ghp, AL_CNT_GROUPS) == NULL)
157 			return (NULL);
158 
159 		/*
160 		 * Append the new dependency to this handle.
161 		 */
162 		if ((gdp = alist_append(&ghp->gh_depends, &gd,
163 		    sizeof (Grp_desc), AL_CNT_DEPENDS)) == NULL)
164 			return (NULL);
165 	}
166 
167 	oflags = gdp->gd_flags;
168 	gdp->gd_flags |= dflags;
169 
170 	if (DBG_ENABLED) {
171 		if (ale == ALE_CREATE)
172 			DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_ADD,
173 			    gdp->gd_flags));
174 		else if (gdp->gd_flags != oflags)
175 			DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_UPDATE,
176 			    gdp->gd_flags));
177 	}
178 
179 	if (alep)
180 		*alep = ale;
181 	return (gdp);
182 }
183 
184 /*
185  * Create a handle.
186  *
187  *   rlmp -	represents the reference link-map for which the handle is being
188  *		created.
189  *   clmp -	represents the caller who is requesting the handle.
190  *   hflags -	provide group handle flags (GPH_*) that affect the use of the
191  *		handle, such as dlopen(0), or use or use of RTLD_FIRST.
192  *   rdflags -	provide group dependency flags for the reference link-map rlmp,
193  *		such as whether the dependency can be used for dlsym(), can be
194  *		relocated against, or whether this objects dependencies should
195  *		be processed.
196  *   cdflags -	provide group dependency flags for the caller.
197  */
198 Grp_hdl *
199 hdl_create(Lm_list *lml, Rt_map *rlmp, Rt_map *clmp, uint_t hflags,
200     uint_t rdflags, uint_t cdflags)
201 {
202 	Grp_hdl	*ghp = NULL, *aghp;
203 	APlist	**alpp;
204 	Aliste	idx;
205 
206 	/*
207 	 * For dlopen(0) the handle is maintained as part of the link-map list,
208 	 * otherwise the handle is associated with the reference link-map.
209 	 */
210 	if (hflags & GPH_ZERO)
211 		alpp = &(lml->lm_handle);
212 	else
213 		alpp = &(HANDLES(rlmp));
214 
215 	/*
216 	 * Objects can contain multiple handles depending on the handle flags
217 	 * supplied.  Most RTLD flags pertain to the object itself and the
218 	 * bindings that it can achieve.  Multiple handles for these flags
219 	 * don't make sense.  But if the flag determines how the handle might
220 	 * be used, then multiple handles may exist.  Presently this only makes
221 	 * sense for RTLD_FIRST.  Determine if an appropriate handle already
222 	 * exists.
223 	 */
224 	for (APLIST_TRAVERSE(*alpp, idx, aghp)) {
225 		if ((aghp->gh_flags & GPH_FIRST) == (hflags & GPH_FIRST)) {
226 			ghp = aghp;
227 			break;
228 		}
229 	}
230 
231 	if (ghp == NULL) {
232 		uint_t	ndx;
233 
234 		/*
235 		 * If this is the first request for this handle, allocate and
236 		 * initialize a new handle.
237 		 */
238 		DBG_CALL(Dbg_file_hdl_title(DBG_HDL_CREATE));
239 
240 		if ((ghp = malloc(sizeof (Grp_hdl))) == NULL)
241 			return (NULL);
242 
243 		/*
244 		 * Associate the handle with the link-map list or the reference
245 		 * link-map as appropriate.
246 		 */
247 		if (aplist_append(alpp, ghp, AL_CNT_GROUPS) == NULL) {
248 			free(ghp);
249 			return (NULL);
250 		}
251 
252 		/*
253 		 * Record the existence of this handle for future verification.
254 		 */
255 		/* LINTED */
256 		ndx = (uintptr_t)ghp % HDLIST_SZ;
257 
258 		if (aplist_append(&hdl_alp[ndx], ghp, AL_CNT_HANDLES) == NULL) {
259 			(void) aplist_delete_value(*alpp, ghp);
260 			free(ghp);
261 			return (NULL);
262 		}
263 
264 		ghp->gh_depends = NULL;
265 		ghp->gh_refcnt = 1;
266 		ghp->gh_flags = hflags;
267 
268 		/*
269 		 * A dlopen(0) handle is identified by the GPH_ZERO flag, the
270 		 * head of the link-map list is defined as the owner.  There is
271 		 * no need to maintain a list of dependencies, for when this
272 		 * handle is used (for dlsym()) a dynamic search through the
273 		 * entire link-map list provides for searching all objects with
274 		 * GLOBAL visibility.
275 		 */
276 		if (hflags & GPH_ZERO) {
277 			ghp->gh_ownlmp = lml->lm_head;
278 			ghp->gh_ownlml = lml;
279 		} else {
280 			ghp->gh_ownlmp = rlmp;
281 			ghp->gh_ownlml = LIST(rlmp);
282 
283 			if (hdl_add(ghp, rlmp, rdflags, NULL) == NULL)
284 				return (NULL);
285 
286 			/*
287 			 * If this new handle is a private handle, there's no
288 			 * need to track the caller, so we're done.
289 			 */
290 			if (hflags & GPH_PRIVATE)
291 				return (ghp);
292 
293 			/*
294 			 * If this new handle is public, and isn't a special
295 			 * handle representing ld.so.1, indicate that a local
296 			 * group now exists.  This state allows singleton
297 			 * searches to be optimized.
298 			 */
299 			if ((hflags & GPH_LDSO) == 0)
300 				LIST(rlmp)->lm_flags |= LML_FLG_GROUPSEXIST;
301 		}
302 	} else {
303 		/*
304 		 * If a handle already exists, bump its reference count.
305 		 *
306 		 * If the previous reference count was 0, then this is a handle
307 		 * that an earlier call to dlclose() was unable to remove.  Such
308 		 * handles are put on the orphan list.  As this handle is back
309 		 * in use, it must be removed from the orphan list.
310 		 *
311 		 * Note, handles associated with a link-map list itself (i.e.
312 		 * dlopen(0)) can have a reference count of 0.  However, these
313 		 * handles are never deleted, and therefore are never moved to
314 		 * the orphan list.
315 		 */
316 		if ((ghp->gh_refcnt++ == 0) &&
317 		    ((ghp->gh_flags & GPH_ZERO) == 0)) {
318 			uint_t	ndx;
319 
320 			/* LINTED */
321 			ndx = (uintptr_t)ghp % HDLIST_SZ;
322 
323 			(void) aplist_delete_value(hdl_alp[HDLIST_ORP], ghp);
324 			(void) aplist_append(&hdl_alp[ndx], ghp,
325 			    AL_CNT_HANDLES);
326 
327 			if (DBG_ENABLED) {
328 				Aliste		idx;
329 				Grp_desc	*gdp;
330 
331 				DBG_CALL(Dbg_file_hdl_title(DBG_HDL_REINST));
332 				for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp))
333 					DBG_CALL(Dbg_file_hdl_action(ghp,
334 					    gdp->gd_depend, DBG_DEP_REINST, 0));
335 			}
336 		}
337 
338 		/*
339 		 * If we've been asked to create a private handle, there's no
340 		 * need to track the caller.
341 		 */
342 		if (hflags & GPH_PRIVATE) {
343 			/*
344 			 * Negate the reference count increment.
345 			 */
346 			ghp->gh_refcnt--;
347 			return (ghp);
348 		} else {
349 			/*
350 			 * If a private handle already exists, promote this
351 			 * handle to public by initializing both the reference
352 			 * count and the handle flags.
353 			 */
354 			if (ghp->gh_flags & GPH_PRIVATE) {
355 				ghp->gh_refcnt = 1;
356 				ghp->gh_flags &= ~GPH_PRIVATE;
357 				ghp->gh_flags |= hflags;
358 			}
359 		}
360 	}
361 
362 	/*
363 	 * Keep track of the parent (caller).  As this object can be referenced
364 	 * by different parents, this processing is carried out every time a
365 	 * handle is requested.
366 	 */
367 	if (clmp && (hdl_add(ghp, clmp, cdflags, NULL) == NULL))
368 		return (NULL);
369 
370 	return (ghp);
371 }
372 
373 /*
374  * Initialize a handle that has been created for an object that is already
375  * loaded.  The handle is initialized with the present dependencies of that
376  * object.  Once this initialization has occurred, any new objects that might
377  * be loaded as dependencies (lazy-loading) are added to the handle as each new
378  * object is loaded.
379  */
380 int
381 hdl_initialize(Grp_hdl *ghp, Rt_map *nlmp, int mode, int promote)
382 {
383 	Aliste		idx;
384 	Grp_desc	*gdp;
385 
386 	/*
387 	 * If the handle has already been initialized, and the initial object's
388 	 * mode hasn't been promoted, there's no need to recompute the modes of
389 	 * any dependencies.  If the object we've added has just been opened,
390 	 * the objects dependencies will not yet have been processed.  These
391 	 * dependencies will be added on later calls to load_one().  Otherwise,
392 	 * this object already exists, so add all of its dependencies to the
393 	 * handle were operating on.
394 	 */
395 	if (((ghp->gh_flags & GPH_INITIAL) && (promote == 0)) ||
396 	    ((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0)) {
397 		ghp->gh_flags |= GPH_INITIAL;
398 		return (1);
399 	}
400 
401 	DBG_CALL(Dbg_file_hdl_title(DBG_HDL_ADD));
402 	for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
403 		Rt_map		*lmp = gdp->gd_depend;
404 		Aliste		idx1;
405 		Bnd_desc	*bdp;
406 
407 		/*
408 		 * If this dependency doesn't indicate that its dependencies
409 		 * should be added to a handle, ignore it.  This case identifies
410 		 * a parent of a dlopen(RTLD_PARENT) request.
411 		 */
412 		if ((gdp->gd_flags & GPD_ADDEPS) == 0)
413 			continue;
414 
415 		for (APLIST_TRAVERSE(DEPENDS(lmp), idx1, bdp)) {
416 			Rt_map	*dlmp = bdp->b_depend;
417 
418 			if ((bdp->b_flags & BND_NEEDED) == 0)
419 				continue;
420 
421 			if (hdl_add(ghp, dlmp,
422 			    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS), NULL) == NULL)
423 				return (0);
424 
425 			(void) update_mode(dlmp, MODE(dlmp), mode);
426 		}
427 	}
428 	ghp->gh_flags |= GPH_INITIAL;
429 	return (1);
430 }
431 
432 /*
433  * Sanity check a program-provided handle.
434  */
435 static int
436 hdl_validate(Grp_hdl *ghp)
437 {
438 	Aliste		idx;
439 	Grp_hdl		*lghp;
440 	uint_t		ndx;
441 
442 	/* LINTED */
443 	ndx = (uintptr_t)ghp % HDLIST_SZ;
444 
445 	for (APLIST_TRAVERSE(hdl_alp[ndx], idx, lghp)) {
446 		if ((lghp == ghp) && (ghp->gh_refcnt != 0))
447 			return (1);
448 	}
449 	return (0);
450 }
451 
452 /*
453  * Core dlclose activity.
454  */
455 int
456 dlclose_core(Grp_hdl *ghp, Rt_map *clmp, Lm_list *lml)
457 {
458 	int	error;
459 	Rt_map	*lmp;
460 
461 	/*
462 	 * If we're already at atexit() there's no point processing further,
463 	 * all objects have already been tsorted for fini processing.
464 	 */
465 	if (rtld_flags & RT_FL_ATEXIT)
466 		return (0);
467 
468 	/*
469 	 * Diagnose what we're up to.
470 	 */
471 	if (ghp->gh_flags & GPH_ZERO) {
472 		DBG_CALL(Dbg_dl_dlclose(clmp, MSG_ORIG(MSG_STR_ZERO),
473 		    DBG_DLCLOSE_IGNORE));
474 	} else {
475 		DBG_CALL(Dbg_dl_dlclose(clmp, NAME(ghp->gh_ownlmp),
476 		    DBG_DLCLOSE_NULL));
477 	}
478 
479 	/*
480 	 * Decrement reference count of this object.
481 	 */
482 	if (--(ghp->gh_refcnt))
483 		return (0);
484 
485 	/*
486 	 * If this handle is special (dlopen(0)), then leave it around - it
487 	 * has little overhead.
488 	 */
489 	if (ghp->gh_flags & GPH_ZERO)
490 		return (0);
491 
492 	/*
493 	 * If this handle is associated with an object that is not on the base
494 	 * link-map control list, or it has not yet been relocated, then this
495 	 * handle must have originated from an auditors interaction.  User code
496 	 * can only execute and bind to relocated objects on the base link-map
497 	 * control list.  A non-relocated object, or an object on a non-base
498 	 * link-map control list, is in the process of being loaded, and
499 	 * therefore we do not attempt to remove the handle, as we might
500 	 * mistakenly delete the object thinking that its loading has failed.
501 	 */
502 	if (((lmp = ghp->gh_ownlmp) != NULL) &&
503 	    ((CNTL(lmp) != ALIST_OFF_DATA) ||
504 	    ((FLAGS(lmp) & FLG_RT_RELOCED) == 0)))
505 		return (0);
506 
507 	/*
508 	 * This handle is no longer being referenced, remove it.  If this handle
509 	 * is part of an alternative link-map list, determine if the whole list
510 	 * can be removed also.
511 	 */
512 	error = remove_hdl(ghp, clmp, NULL);
513 
514 	if ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)
515 		remove_lml(lml);
516 
517 	return (error);
518 }
519 
520 /*
521  * Internal dlclose activity.  Called from user level or directly for internal
522  * error cleanup.
523  */
524 int
525 dlclose_intn(Grp_hdl *ghp, Rt_map *clmp)
526 {
527 	Rt_map	*nlmp = NULL;
528 	Lm_list	*olml = NULL;
529 	int	error;
530 
531 	/*
532 	 * Although we're deleting object(s) it's quite possible that additional
533 	 * objects get loaded from running the .fini section(s) of the objects
534 	 * being deleted.  These objects will have been added to the same
535 	 * link-map list as those objects being deleted.  Remember this list
536 	 * for later investigation.
537 	 */
538 	olml = ghp->gh_ownlml;
539 
540 	error = dlclose_core(ghp, clmp, olml);
541 
542 	/*
543 	 * Determine whether the original link-map list still exists.  In the
544 	 * case of a dlclose of an alternative (dlmopen) link-map the whole
545 	 * list may have been removed.
546 	 */
547 	if (olml) {
548 		Aliste	idx;
549 		Lm_list	*lml;
550 
551 		for (APLIST_TRAVERSE(dynlm_list, idx, lml)) {
552 			if (olml == lml) {
553 				nlmp = olml->lm_head;
554 				break;
555 			}
556 		}
557 	}
558 	load_completion(nlmp);
559 	return (error);
560 }
561 
562 /*
563  * Argument checking for dlclose.  Only called via external entry.
564  */
565 static int
566 dlclose_check(void *handle, Rt_map *clmp)
567 {
568 	Grp_hdl	*ghp = (Grp_hdl *)handle;
569 
570 	if (hdl_validate(ghp) == 0) {
571 		Conv_inv_buf_t	inv_buf;
572 
573 		(void) conv_invalid_val(&inv_buf, EC_NATPTR(ghp), 0);
574 		DBG_CALL(Dbg_dl_dlclose(clmp, inv_buf.buf, DBG_DLCLOSE_NULL));
575 
576 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL),
577 		    EC_NATPTR(handle));
578 		return (1);
579 	}
580 	return (dlclose_intn(ghp, clmp));
581 }
582 
583 #pragma weak _dlclose = dlclose
584 
585 /*
586  * External entry for dlclose(3dl).  Returns 0 for success, non-zero otherwise.
587  */
588 int
589 dlclose(void *handle)
590 {
591 	int		error, entry;
592 	Rt_map		*clmp;
593 
594 	entry = enter(0);
595 
596 	clmp = _caller(caller(), CL_EXECDEF);
597 
598 	error = dlclose_check(handle, clmp);
599 
600 	if (entry)
601 		leave(LIST(clmp), 0);
602 	return (error);
603 }
604 
605 static uint_t	lmid = 0;
606 
607 /*
608  * The addition of new link-map lists is assumed to be in small quantities.
609  * Here, we assign a unique link-map id for diagnostic use.  Simply update the
610  * running link-map count until we max out.
611  */
612 int
613 newlmid(Lm_list *lml)
614 {
615 	char	buffer[MSG_LMID_ALT_SIZE + 12];
616 
617 	if (lmid == UINT_MAX) {
618 		lml->lm_lmid = UINT_MAX;
619 		(void) strncpy(buffer, MSG_ORIG(MSG_LMID_MAXED),
620 		    MSG_LMID_ALT_SIZE + 12);
621 	} else {
622 		lml->lm_lmid = lmid++;
623 		(void) snprintf(buffer, MSG_LMID_ALT_SIZE + 12,
624 		    MSG_ORIG(MSG_LMID_FMT), MSG_ORIG(MSG_LMID_ALT),
625 		    lml->lm_lmid);
626 	}
627 	if ((lml->lm_lmidstr = strdup(buffer)) == NULL)
628 		return (0);
629 
630 	return (1);
631 }
632 
633 /*
634  * Core dlopen activity.
635  */
636 static Grp_hdl *
637 dlmopen_core(Lm_list *lml, Lm_list *olml, const char *path, int mode,
638     Rt_map *clmp, uint_t flags, uint_t orig, int *in_nfavl)
639 {
640 	Alist		*palp = NULL;
641 	Rt_map		*nlmp;
642 	Grp_hdl		*ghp;
643 	Aliste		olmco, nlmco;
644 
645 	DBG_CALL(Dbg_dl_dlopen(clmp,
646 	    (path ? path : MSG_ORIG(MSG_STR_ZERO)), in_nfavl, mode));
647 
648 	/*
649 	 * Having diagnosed the originally defined modes, assign any defaults
650 	 * or corrections.
651 	 */
652 	if (((mode & (RTLD_GROUP | RTLD_WORLD)) == 0) &&
653 	    ((mode & RTLD_NOLOAD) == 0))
654 		mode |= (RTLD_GROUP | RTLD_WORLD);
655 	if ((mode & RTLD_NOW) && (rtld_flags2 & RT_FL2_BINDLAZY)) {
656 		mode &= ~RTLD_NOW;
657 		mode |= RTLD_LAZY;
658 	}
659 
660 	/*
661 	 * If the path specified is null then we're operating on global
662 	 * objects.  Associate a dummy handle with the link-map list.
663 	 */
664 	if (path == NULL) {
665 		Grp_hdl *ghp;
666 		uint_t	hflags, rdflags, cdflags;
667 		int	promote = 0;
668 
669 		/*
670 		 * Establish any flags for the handle (Grp_hdl).
671 		 *
672 		 *  -	This is a dummy, public, handle (0) that provides for a
673 		 *	dynamic	search of all global objects within the process.
674 		 *  -   Use of the RTLD_FIRST mode indicates that only the first
675 		 *	dependency on the handle (the referenced object) can be
676 		 *	used to satisfy dlsym() requests.
677 		 */
678 		hflags = (GPH_PUBLIC | GPH_ZERO);
679 		if (mode & RTLD_FIRST)
680 			hflags |= GPH_FIRST;
681 
682 		/*
683 		 * Establish the flags for the referenced dependency descriptor
684 		 * (Grp_desc).
685 		 *
686 		 *  -	The referenced object is available for dlsym().
687 		 *  -	The referenced object is available to relocate against.
688 		 *  -	The referenced object should have it's dependencies
689 		 *	added to this handle.
690 		 */
691 		rdflags = (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS);
692 
693 		/*
694 		 * Establish the flags for this callers dependency descriptor
695 		 * (Grp_desc).
696 		 *
697 		 *  -	The explicit creation of a handle creates a descriptor
698 		 *	for the referenced object and the parent (caller).
699 		 *  -	Use of the RTLD_PARENT flag indicates that the parent
700 		 *	can be relocated against.
701 		 */
702 		cdflags = GPD_PARENT;
703 		if (mode & RTLD_PARENT)
704 			cdflags |= GPD_RELOC;
705 
706 		if ((ghp = hdl_create(lml, 0, clmp, hflags, rdflags,
707 		    cdflags)) == NULL)
708 			return (NULL);
709 
710 		/*
711 		 * Traverse the main link-map control list, updating the mode
712 		 * of any objects as necessary.  Call the relocation engine if
713 		 * this mode promotes the existing state of any relocations.
714 		 * crle()'s first pass loads all objects necessary for building
715 		 * a configuration file, however none of them are relocated.
716 		 * crle()'s second pass relocates objects in preparation for
717 		 * dldump()'ing using dlopen(0, RTLD_NOW).
718 		 */
719 		if ((mode & (RTLD_NOW | RTLD_CONFGEN)) == RTLD_CONFGEN)
720 			return (ghp);
721 
722 		for (nlmp = lml->lm_head; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
723 			if (((MODE(nlmp) & RTLD_GLOBAL) == 0) ||
724 			    (FLAGS(nlmp) & FLG_RT_DELETE))
725 				continue;
726 
727 			if (update_mode(nlmp, MODE(nlmp), mode))
728 				promote = 1;
729 		}
730 		if (promote)
731 			(void) relocate_lmc(lml, ALIST_OFF_DATA, clmp,
732 			    lml->lm_head, in_nfavl);
733 
734 		return (ghp);
735 	}
736 
737 	/*
738 	 * Fix the pathname.  If this object expands to multiple paths (ie.
739 	 * $ISALIST or $HWCAP have been used), then make sure the user has also
740 	 * furnished the RTLD_FIRST flag.  As yet, we don't support opening
741 	 * more than one object at a time, so enforcing the RTLD_FIRST flag
742 	 * provides flexibility should we be able to support dlopening more
743 	 * than one object in the future.
744 	 */
745 	if (LM_FIX_NAME(clmp)(path, clmp, &palp, AL_CNT_NEEDED, orig) == NULL)
746 		return (NULL);
747 
748 	if ((palp->al_arritems > 1) && ((mode & RTLD_FIRST) == 0)) {
749 		remove_alist(&palp, 1);
750 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_5));
751 		return (NULL);
752 	}
753 
754 	/*
755 	 * Establish a link-map control list for this request, and load the
756 	 * associated object.
757 	 */
758 	if ((nlmco = create_cntl(lml, 1)) == NULL) {
759 		remove_alist(&palp, 1);
760 		return (NULL);
761 	}
762 	olmco = nlmco;
763 
764 	nlmp = load_one(lml, nlmco, palp, clmp, mode, (flags | FLG_RT_PUBHDL),
765 	    &ghp, in_nfavl);
766 
767 	/*
768 	 * Remove any expanded pathname infrastructure, and if the dependency
769 	 * couldn't be loaded, cleanup.
770 	 */
771 	remove_alist(&palp, 1);
772 	if (nlmp == NULL) {
773 		remove_cntl(lml, olmco);
774 		return (NULL);
775 	}
776 
777 	/*
778 	 * If loading an auditor was requested, and the auditor already existed,
779 	 * then the link-map returned will be to the original auditor.  The new
780 	 * link-map list that was initially created, and the associated link-map
781 	 * control list are no longer needed.  As the auditor is already loaded,
782 	 * we're probably done, but fall through in case additional relocations
783 	 * would be triggered by the mode of the caller.
784 	 */
785 	if ((flags & FLG_RT_AUDIT) && (LIST(nlmp) != lml)) {
786 		remove_cntl(lml, olmco);
787 		lml = LIST(nlmp);
788 		olmco = 0;
789 		nlmco = ALIST_OFF_DATA;
790 	}
791 
792 	/*
793 	 * Finish processing the objects associated with this request.
794 	 */
795 	if (((nlmp = analyze_lmc(lml, nlmco, nlmp, clmp, in_nfavl)) == NULL) ||
796 	    (relocate_lmc(lml, nlmco, clmp, nlmp, in_nfavl) == 0)) {
797 		ghp = NULL;
798 		nlmp = NULL;
799 	}
800 
801 	/*
802 	 * If the dlopen has failed, clean up any objects that might have been
803 	 * loaded successfully on this new link-map control list.
804 	 */
805 	if (olmco && (nlmp == NULL))
806 		remove_lmc(lml, clmp, olmco, path);
807 
808 	/*
809 	 * Finally, remove any temporary link-map control list.  Note, if this
810 	 * operation successfully established a new link-map list, then a base
811 	 * link-map control list will have been created, which must remain.
812 	 */
813 	if (olmco && ((nlmp == NULL) || (olml != (Lm_list *)LM_ID_NEWLM)))
814 		remove_cntl(lml, olmco);
815 
816 	return (ghp);
817 }
818 
819 /*
820  * dlopen() and dlsym() operations are the means by which a process can
821  * test for the existence of required dependencies.  If the necessary
822  * dependencies don't exist, then associated functionality can't be used.
823  * However, the lack of dependencies can be fixed, and the dlopen() and
824  * dlsym() requests can be repeated.  As we use a "not-found" AVL tree to
825  * cache any failed full path loads, secondary dlopen() and dlsym() requests
826  * will fail, even if the dependencies have been installed.
827  *
828  * dlopen() and dlsym() retry any failures by removing the "not-found" AVL
829  * tree.  Should any dependencies be found, their names are added to the
830  * FullPath AVL tree.  This routine removes any new "not-found" AVL tree,
831  * so that the dlopen() or dlsym() can replace the original "not-found" tree.
832  */
833 inline static void
834 nfavl_remove(avl_tree_t *avlt)
835 {
836 	PathNode	*pnp;
837 	void		*cookie = NULL;
838 
839 	if (avlt) {
840 		while ((pnp = avl_destroy_nodes(avlt, &cookie)) != NULL)
841 			free(pnp);
842 
843 		avl_destroy(avlt);
844 		free(avlt);
845 	}
846 }
847 
848 /*
849  * Internal dlopen() activity.  Called from user level or directly for internal
850  * opens that require a handle.
851  */
852 Grp_hdl *
853 dlmopen_intn(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
854     uint_t flags, uint_t orig)
855 {
856 	Lm_list	*olml = lml;
857 	Rt_map	*dlmp = NULL;
858 	Grp_hdl	*ghp;
859 	int	in_nfavl = 0;
860 
861 	/*
862 	 * Check for magic link-map list values:
863 	 *
864 	 *  LM_ID_BASE:		Operate on the PRIMARY (executables) link map
865 	 *  LM_ID_LDSO:		Operation on ld.so.1's link map
866 	 *  LM_ID_NEWLM: 	Create a new link-map.
867 	 */
868 	if (lml == (Lm_list *)LM_ID_NEWLM) {
869 		if ((lml = calloc(sizeof (Lm_list), 1)) == NULL)
870 			return (NULL);
871 
872 		/*
873 		 * Establish the new link-map flags from the callers and those
874 		 * explicitly provided.
875 		 */
876 		lml->lm_tflags = LIST(clmp)->lm_tflags;
877 		if (flags & FLG_RT_AUDIT) {
878 			/*
879 			 * Unset any auditing flags - an auditor shouldn't be
880 			 * audited.  Insure all audit dependencies are loaded.
881 			 */
882 			lml->lm_tflags &= ~LML_TFLG_AUD_MASK;
883 			lml->lm_tflags |= (LML_TFLG_NOLAZYLD |
884 			    LML_TFLG_LOADFLTR | LML_TFLG_NOAUDIT);
885 		}
886 
887 		if (aplist_append(&dynlm_list, lml, AL_CNT_DYNLIST) == NULL) {
888 			free(lml);
889 			return (NULL);
890 		}
891 		if (newlmid(lml) == 0) {
892 			(void) aplist_delete_value(dynlm_list, lml);
893 			free(lml);
894 			return (NULL);
895 		}
896 	} else if ((uintptr_t)lml < LM_ID_NUM) {
897 		if ((uintptr_t)lml == LM_ID_BASE)
898 			lml = &lml_main;
899 		else if ((uintptr_t)lml == LM_ID_LDSO)
900 			lml = &lml_rtld;
901 	}
902 
903 	/*
904 	 * Open the required object on the associated link-map list.
905 	 */
906 	ghp = dlmopen_core(lml, olml, path, mode, clmp, flags, orig, &in_nfavl);
907 
908 	/*
909 	 * If the object could not be found it is possible that the "not-found"
910 	 * AVL tree had indicated that the file does not exist.  In case the
911 	 * file system has changed since this "not-found" recording was made,
912 	 * retry the dlopen() with a clean "not-found" AVL tree.
913 	 */
914 	if ((ghp == NULL) && in_nfavl) {
915 		avl_tree_t	*oavlt = nfavl;
916 
917 		nfavl = NULL;
918 		ghp = dlmopen_core(lml, olml, path, mode, clmp, flags, orig,
919 		    NULL);
920 
921 		/*
922 		 * If the file is found, then its full path name will have been
923 		 * registered in the FullPath AVL tree.  Remove any new
924 		 * "not-found" AVL information, and restore the former AVL tree.
925 		 */
926 		nfavl_remove(nfavl);
927 		nfavl = oavlt;
928 	}
929 
930 	/*
931 	 * Establish the new link-map from which .init processing will begin.
932 	 * Ignore .init firing when constructing a configuration file (crle(1)).
933 	 */
934 	if (ghp && ((mode & RTLD_CONFGEN) == 0))
935 		dlmp = ghp->gh_ownlmp;
936 
937 	/*
938 	 * If loading an auditor was requested, and the auditor already existed,
939 	 * then the link-map returned will be to the original auditor.  Remove
940 	 * the link-map control list that was created for this request.
941 	 */
942 	if (dlmp && (flags & FLG_RT_AUDIT) && (LIST(dlmp) != lml)) {
943 		remove_lml(lml);
944 		lml = LIST(dlmp);
945 	}
946 
947 	/*
948 	 * If this load failed, remove any alternative link-map list.
949 	 */
950 	if ((ghp == NULL) &&
951 	    ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)) {
952 		remove_lml(lml);
953 		lml = NULL;
954 	}
955 
956 	/*
957 	 * Finish this load request.  If objects were loaded, .init processing
958 	 * is computed.  Finally, the debuggers are informed of the link-map
959 	 * lists being stable.
960 	 */
961 	load_completion(dlmp);
962 
963 	return (ghp);
964 }
965 
966 /*
967  * Argument checking for dlopen.  Only called via external entry.
968  */
969 static Grp_hdl *
970 dlmopen_check(Lm_list *lml, const char *path, int mode, Rt_map *clmp)
971 {
972 	/*
973 	 * Verify that a valid pathname has been supplied.
974 	 */
975 	if (path && (*path == '\0')) {
976 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
977 		return (0);
978 	}
979 
980 	/*
981 	 * Historically we've always verified the mode is either RTLD_NOW or
982 	 * RTLD_LAZY.  RTLD_NOLOAD is valid by itself.  Use of LM_ID_NEWLM
983 	 * requires a specific pathname, and use of RTLD_PARENT is meaningless.
984 	 */
985 	if ((mode & (RTLD_NOW | RTLD_LAZY | RTLD_NOLOAD)) == 0) {
986 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_1));
987 		return (0);
988 	}
989 	if ((mode & (RTLD_NOW | RTLD_LAZY)) == (RTLD_NOW | RTLD_LAZY)) {
990 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_2));
991 		return (0);
992 	}
993 	if ((lml == (Lm_list *)LM_ID_NEWLM) && (path == NULL)) {
994 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_3));
995 		return (0);
996 	}
997 	if ((lml == (Lm_list *)LM_ID_NEWLM) && (mode & RTLD_PARENT)) {
998 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_4));
999 		return (0);
1000 	}
1001 
1002 	return (dlmopen_intn(lml, path, mode, clmp, 0, 0));
1003 }
1004 
1005 #pragma weak _dlopen = dlopen
1006 
1007 /*
1008  * External entry for dlopen(3dl).  On success, returns a pointer (handle) to
1009  * the structure containing information about the newly added object, ie. can
1010  * be used by dlsym(). On failure, returns a null pointer.
1011  */
1012 void *
1013 dlopen(const char *path, int mode)
1014 {
1015 	int	entry;
1016 	Rt_map	*clmp;
1017 	Grp_hdl	*ghp;
1018 	Lm_list	*lml;
1019 
1020 	entry = enter(0);
1021 
1022 	clmp = _caller(caller(), CL_EXECDEF);
1023 	lml = LIST(clmp);
1024 
1025 	ghp = dlmopen_check(lml, path, mode, clmp);
1026 
1027 	if (entry)
1028 		leave(lml, 0);
1029 	return ((void *)ghp);
1030 }
1031 
1032 #pragma weak _dlmopen = dlmopen
1033 
1034 /*
1035  * External entry for dlmopen(3dl).
1036  */
1037 void *
1038 dlmopen(Lmid_t lmid, const char *path, int mode)
1039 {
1040 	int	entry;
1041 	Rt_map	*clmp;
1042 	Grp_hdl	*ghp;
1043 
1044 	entry = enter(0);
1045 
1046 	clmp = _caller(caller(), CL_EXECDEF);
1047 
1048 	ghp = dlmopen_check((Lm_list *)lmid, path, mode, clmp);
1049 
1050 	if (entry)
1051 		leave(LIST(clmp), 0);
1052 	return ((void *)ghp);
1053 }
1054 
1055 /*
1056  * Handle processing for dlsym.
1057  */
1058 int
1059 dlsym_handle(Grp_hdl *ghp, Slookup *slp, Sresult *srp, uint_t *binfo,
1060     int *in_nfavl)
1061 {
1062 	Rt_map		*nlmp, * lmp = ghp->gh_ownlmp;
1063 	Rt_map		*clmp = slp->sl_cmap;
1064 	const char	*name = slp->sl_name;
1065 	Slookup		sl = *slp;
1066 
1067 	sl.sl_flags = (LKUP_FIRST | LKUP_DLSYM | LKUP_SPEC);
1068 
1069 	/*
1070 	 * Continue processing a dlsym request.  Lookup the required symbol in
1071 	 * each link-map specified by the handle.
1072 	 *
1073 	 * To leverage off of lazy loading, dlsym() requests can result in two
1074 	 * passes.  The first descends the link-maps of any objects already in
1075 	 * the address space.  If the symbol isn't located, and lazy
1076 	 * dependencies still exist, then a second pass is made to load these
1077 	 * dependencies if applicable.  This model means that in the case where
1078 	 * a symbol exists in more than one object, the one located may not be
1079 	 * constant - this is the standard issue with lazy loading. In addition,
1080 	 * attempting to locate a symbol that doesn't exist will result in the
1081 	 * loading of all lazy dependencies on the given handle, which can
1082 	 * defeat some of the advantages of lazy loading (look out JVM).
1083 	 */
1084 	if (ghp->gh_flags & GPH_ZERO) {
1085 		Lm_list	*lml;
1086 		uint_t	lazy = 0;
1087 
1088 		/*
1089 		 * If this symbol lookup is triggered from a dlopen(0) handle,
1090 		 * traverse the present link-map list looking for promiscuous
1091 		 * entries.
1092 		 */
1093 		for (nlmp = lmp; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
1094 			/*
1095 			 * If this handle indicates we're only to look in the
1096 			 * first object check whether we're done.
1097 			 */
1098 			if ((nlmp != lmp) && (ghp->gh_flags & GPH_FIRST))
1099 				return (0);
1100 
1101 			if (!(MODE(nlmp) & RTLD_GLOBAL))
1102 				continue;
1103 			if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1104 			    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1105 				continue;
1106 
1107 			sl.sl_imap = nlmp;
1108 			if (LM_LOOKUP_SYM(clmp)(&sl, srp, binfo, in_nfavl))
1109 				return (1);
1110 
1111 			/*
1112 			 * Keep track of any global pending lazy loads.
1113 			 */
1114 			lazy += LAZY(nlmp);
1115 		}
1116 
1117 		/*
1118 		 * If we're unable to locate the symbol and this link-map list
1119 		 * still has pending lazy dependencies, start loading them in an
1120 		 * attempt to exhaust the search.  Note that as we're already
1121 		 * traversing a dynamic linked list of link-maps there's no
1122 		 * need for elf_lazy_find_sym() to descend the link-maps itself.
1123 		 */
1124 		lml = LIST(lmp);
1125 		if (lazy) {
1126 			DBG_CALL(Dbg_syms_lazy_rescan(lml, name));
1127 
1128 			sl.sl_flags |= LKUP_NODESCENT;
1129 
1130 			for (nlmp = lmp; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
1131 
1132 				if (!(MODE(nlmp) & RTLD_GLOBAL) || !LAZY(nlmp))
1133 					continue;
1134 				if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1135 				    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1136 					continue;
1137 
1138 				sl.sl_imap = nlmp;
1139 				if (elf_lazy_find_sym(&sl, srp, binfo,
1140 				    in_nfavl))
1141 					return (1);
1142 			}
1143 		}
1144 	} else {
1145 		/*
1146 		 * Traverse the dlopen() handle searching all presently loaded
1147 		 * link-maps.
1148 		 */
1149 		Grp_desc	*gdp;
1150 		Aliste		idx;
1151 		uint_t		lazy = 0;
1152 
1153 		for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1154 			nlmp = gdp->gd_depend;
1155 
1156 			if ((gdp->gd_flags & GPD_DLSYM) == 0)
1157 				continue;
1158 
1159 			sl.sl_imap = nlmp;
1160 			if (LM_LOOKUP_SYM(clmp)(&sl, srp, binfo, in_nfavl))
1161 				return (1);
1162 
1163 			if (ghp->gh_flags & GPH_FIRST)
1164 				return (0);
1165 
1166 			/*
1167 			 * Keep track of any pending lazy loads associated
1168 			 * with this handle.
1169 			 */
1170 			lazy += LAZY(nlmp);
1171 		}
1172 
1173 		/*
1174 		 * If we're unable to locate the symbol and this handle still
1175 		 * has pending lazy dependencies, start loading the lazy
1176 		 * dependencies, in an attempt to exhaust the search.
1177 		 */
1178 		if (lazy) {
1179 			DBG_CALL(Dbg_syms_lazy_rescan(LIST(lmp), name));
1180 
1181 			for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1182 				nlmp = gdp->gd_depend;
1183 
1184 				if (((gdp->gd_flags & GPD_DLSYM) == 0) ||
1185 				    (LAZY(nlmp) == 0))
1186 					continue;
1187 
1188 				sl.sl_imap = nlmp;
1189 				if (elf_lazy_find_sym(&sl, srp, binfo,
1190 				    in_nfavl))
1191 					return (1);
1192 			}
1193 		}
1194 	}
1195 	return (0);
1196 }
1197 
1198 /*
1199  * Determine whether a symbol resides in a caller.  This may be a reference,
1200  * which is associated with a specific dependency.
1201  */
1202 inline static Sym *
1203 sym_lookup_in_caller(Rt_map *clmp, Slookup *slp, Sresult *srp, uint_t *binfo)
1204 {
1205 	if (THIS_IS_ELF(clmp) && SYMINTP(clmp)(slp, srp, binfo, NULL)) {
1206 		Sym	*sym = srp->sr_sym;
1207 
1208 		slp->sl_rsymndx = (((ulong_t)sym -
1209 		    (ulong_t)SYMTAB(clmp)) / SYMENT(clmp));
1210 		slp->sl_rsym = sym;
1211 		return (sym);
1212 	}
1213 	return (NULL);
1214 }
1215 
1216 /*
1217  * Core dlsym activity.  Selects symbol lookup method from handle.
1218  */
1219 static void *
1220 dlsym_core(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp,
1221     int *in_nfavl)
1222 {
1223 	Sym		*sym;
1224 	int		ret = 0;
1225 	Syminfo		*sip;
1226 	Slookup		sl;
1227 	Sresult		sr;
1228 	uint_t		binfo;
1229 
1230 	/*
1231 	 * Initialize the symbol lookup data structure.
1232 	 *
1233 	 * Standard relocations are evaluated using the symbol index of the
1234 	 * associated relocation symbol.  This index provides for loading
1235 	 * any lazy dependency and establishing a direct binding if necessary.
1236 	 * If a dlsym() operation originates from an object that contains a
1237 	 * symbol table entry for the same name, then we need to establish the
1238 	 * symbol index so that any dependency requirements can be triggered.
1239 	 *
1240 	 * Therefore, the first symbol lookup that is carried out is for the
1241 	 * symbol name within the calling object.  If this symbol exists, the
1242 	 * symbols index is computed, added to the Slookup data, and thus used
1243 	 * to seed the real symbol lookup.
1244 	 */
1245 	SLOOKUP_INIT(sl, name, clmp, clmp, ld_entry_cnt, elf_hash(name),
1246 	    0, 0, 0, LKUP_SYMNDX);
1247 	SRESULT_INIT(sr, name);
1248 	sym = sym_lookup_in_caller(clmp, &sl, &sr, &binfo);
1249 
1250 	SRESULT_INIT(sr, name);
1251 
1252 	if (sym && (ELF_ST_VISIBILITY(sym->st_other) == STV_SINGLETON)) {
1253 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1254 
1255 		/*
1256 		 * If a symbol reference is known, and that reference indicates
1257 		 * that the symbol is a singleton, then the search for the
1258 		 * symbol must follow the default search path.
1259 		 */
1260 		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, 0,
1261 		    DBG_DLSYM_SINGLETON));
1262 
1263 		sl.sl_imap = hlmp;
1264 		if (handle == RTLD_PROBE)
1265 			sl.sl_flags = LKUP_NOFALLBACK;
1266 		else
1267 			sl.sl_flags = LKUP_SPEC;
1268 		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1269 
1270 	} else if (handle == RTLD_NEXT) {
1271 		Rt_map	*nlmp;
1272 
1273 		/*
1274 		 * If this handle is RTLD_NEXT determine whether a lazy load
1275 		 * from the caller might provide the next object.  This mimics
1276 		 * the lazy loading initialization normally carried out by
1277 		 * lookup_sym(), however here, we must do this up-front, as
1278 		 * lookup_sym() will be used to inspect the next object.
1279 		 */
1280 		if ((sl.sl_rsymndx) && ((sip = SYMINFO(clmp)) != NULL)) {
1281 			/* LINTED */
1282 			sip = (Syminfo *)((char *)sip +
1283 			    (sl.sl_rsymndx * SYMINENT(clmp)));
1284 
1285 			if ((sip->si_flags & SYMINFO_FLG_DIRECT) &&
1286 			    (sip->si_boundto < SYMINFO_BT_LOWRESERVE))
1287 				(void) elf_lazy_load(clmp, &sl,
1288 				    sip->si_boundto, name, 0, NULL, in_nfavl);
1289 
1290 			/*
1291 			 * Clear the symbol index, so as not to confuse
1292 			 * lookup_sym() of the next object.
1293 			 */
1294 			sl.sl_rsymndx = 0;
1295 			sl.sl_rsym = NULL;
1296 		}
1297 
1298 		/*
1299 		 * If the handle is RTLD_NEXT, start searching in the next link
1300 		 * map from the callers.  Determine permissions from the
1301 		 * present link map.  Indicate to lookup_sym() that we're on an
1302 		 * RTLD_NEXT request so that it will use the callers link map to
1303 		 * start any possible lazy dependency loading.
1304 		 */
1305 		sl.sl_imap = nlmp = NEXT_RT_MAP(clmp);
1306 
1307 		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl,
1308 		    (nlmp ? NAME(nlmp) : MSG_INTL(MSG_STR_NULL)),
1309 		    DBG_DLSYM_NEXT));
1310 
1311 		if (nlmp == NULL)
1312 			return (0);
1313 
1314 		sl.sl_flags = LKUP_NEXT;
1315 		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1316 
1317 	} else if (handle == RTLD_SELF) {
1318 		/*
1319 		 * If the handle is RTLD_SELF start searching from the caller.
1320 		 */
1321 		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, NAME(clmp),
1322 		    DBG_DLSYM_SELF));
1323 
1324 		sl.sl_imap = clmp;
1325 		sl.sl_flags = (LKUP_SPEC | LKUP_SELF);
1326 		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1327 
1328 	} else if (handle == RTLD_DEFAULT) {
1329 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1330 
1331 		/*
1332 		 * If the handle is RTLD_DEFAULT mimic the standard symbol
1333 		 * lookup as would be triggered by a relocation.
1334 		 */
1335 		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, 0,
1336 		    DBG_DLSYM_DEFAULT));
1337 
1338 		sl.sl_imap = hlmp;
1339 		sl.sl_flags = LKUP_SPEC;
1340 		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1341 
1342 	} else if (handle == RTLD_PROBE) {
1343 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1344 
1345 		/*
1346 		 * If the handle is RTLD_PROBE, mimic the standard symbol
1347 		 * lookup as would be triggered by a relocation, however do
1348 		 * not fall back to a lazy loading rescan if the symbol can't be
1349 		 * found within the currently loaded objects.  Note, a lazy
1350 		 * loaded dependency required by the caller might still get
1351 		 * loaded to satisfy this request, but no exhaustive lazy load
1352 		 * rescan is carried out.
1353 		 */
1354 		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, 0,
1355 		    DBG_DLSYM_PROBE));
1356 
1357 		sl.sl_imap = hlmp;
1358 		sl.sl_flags = LKUP_NOFALLBACK;
1359 		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1360 
1361 	} else {
1362 		Grp_hdl *ghp = (Grp_hdl *)handle;
1363 
1364 		/*
1365 		 * Look in the shared object specified by the handle and in all
1366 		 * of its dependencies.
1367 		 */
1368 		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl,
1369 		    NAME(ghp->gh_ownlmp), DBG_DLSYM_DEF));
1370 
1371 		ret = LM_DLSYM(clmp)(ghp, &sl, &sr, &binfo, in_nfavl);
1372 	}
1373 
1374 	if (ret && ((sym = sr.sr_sym) != NULL)) {
1375 		Lm_list	*lml = LIST(clmp);
1376 		Addr	addr = sym->st_value;
1377 
1378 		*dlmp = sr.sr_dmap;
1379 		if (!(FLAGS(*dlmp) & FLG_RT_FIXED))
1380 			addr += ADDR(*dlmp);
1381 
1382 		/*
1383 		 * Indicate that the defining object is now used.
1384 		 */
1385 		if (*dlmp != clmp)
1386 			FLAGS1(*dlmp) |= FL1_RT_USED;
1387 
1388 		DBG_CALL(Dbg_bind_global(clmp, 0, 0, (Xword)-1, PLT_T_NONE,
1389 		    *dlmp, addr, sym->st_value, sr.sr_name, binfo));
1390 
1391 		if ((lml->lm_tflags | AFLAGS(clmp)) & LML_TFLG_AUD_SYMBIND) {
1392 			uint_t	sb_flags = LA_SYMB_DLSYM;
1393 			/* LINTED */
1394 			uint_t	symndx = (uint_t)(((Xword)sym -
1395 			    (Xword)SYMTAB(*dlmp)) / SYMENT(*dlmp));
1396 			addr = audit_symbind(clmp, *dlmp, sym, symndx, addr,
1397 			    &sb_flags);
1398 		}
1399 		return ((void *)addr);
1400 	}
1401 
1402 	return (NULL);
1403 }
1404 
1405 /*
1406  * Internal dlsym activity.  Called from user level or directly for internal
1407  * symbol lookup.
1408  */
1409 void *
1410 dlsym_intn(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1411 {
1412 	Rt_map		*llmp = NULL;
1413 	void		*error;
1414 	Aliste		idx;
1415 	Grp_desc	*gdp;
1416 	int		in_nfavl = 0;
1417 
1418 	/*
1419 	 * While looking for symbols it's quite possible that additional objects
1420 	 * get loaded from lazy loading.  These objects will have been added to
1421 	 * the same link-map list as those objects on the handle.  Remember this
1422 	 * list for later investigation.
1423 	 */
1424 	if ((handle == RTLD_NEXT) || (handle == RTLD_DEFAULT) ||
1425 	    (handle == RTLD_SELF) || (handle == RTLD_PROBE))
1426 		llmp = LIST(clmp)->lm_tail;
1427 	else {
1428 		Grp_hdl	*ghp = (Grp_hdl *)handle;
1429 
1430 		if (ghp->gh_ownlmp)
1431 			llmp = LIST(ghp->gh_ownlmp)->lm_tail;
1432 		else {
1433 			for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1434 				if ((llmp =
1435 				    LIST(gdp->gd_depend)->lm_tail) != NULL)
1436 					break;
1437 			}
1438 		}
1439 	}
1440 
1441 	error = dlsym_core(handle, name, clmp, dlmp, &in_nfavl);
1442 
1443 	/*
1444 	 * If the symbol could not be found it is possible that the "not-found"
1445 	 * AVL tree had indicated that a required file does not exist.  In case
1446 	 * the file system has changed since this "not-found" recording was
1447 	 * made, retry the dlsym() with a clean "not-found" AVL tree.
1448 	 */
1449 	if ((error == NULL) && in_nfavl) {
1450 		avl_tree_t	*oavlt = nfavl;
1451 
1452 		nfavl = NULL;
1453 		error = dlsym_core(handle, name, clmp, dlmp, NULL);
1454 
1455 		/*
1456 		 * If the symbol is found, then any file that was loaded will
1457 		 * have had its full path name registered in the FullPath AVL
1458 		 * tree.  Remove any new "not-found" AVL information, and
1459 		 * restore the former AVL tree.
1460 		 */
1461 		nfavl_remove(nfavl);
1462 		nfavl = oavlt;
1463 	}
1464 
1465 	if (error == NULL) {
1466 		/*
1467 		 * Cache the error message, as Java tends to fall through this
1468 		 * code many times.
1469 		 */
1470 		if (nosym_str == NULL)
1471 			nosym_str = MSG_INTL(MSG_GEN_NOSYM);
1472 		eprintf(LIST(clmp), ERR_FATAL, nosym_str, name);
1473 	}
1474 
1475 	load_completion(llmp);
1476 	return (error);
1477 }
1478 
1479 /*
1480  * Argument checking for dlsym.  Only called via external entry.
1481  */
1482 static void *
1483 dlsym_check(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1484 {
1485 	/*
1486 	 * Verify the arguments.
1487 	 */
1488 	if (name == NULL) {
1489 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_ILLSYM));
1490 		return (NULL);
1491 	}
1492 	if ((handle != RTLD_NEXT) && (handle != RTLD_DEFAULT) &&
1493 	    (handle != RTLD_SELF) && (handle != RTLD_PROBE) &&
1494 	    (hdl_validate((Grp_hdl *)handle) == 0)) {
1495 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL),
1496 		    EC_NATPTR(handle));
1497 		return (NULL);
1498 	}
1499 	return (dlsym_intn(handle, name, clmp, dlmp));
1500 }
1501 
1502 
1503 #pragma weak _dlsym = dlsym
1504 
1505 /*
1506  * External entry for dlsym().  On success, returns the address of the specified
1507  * symbol.  On error returns a null.
1508  */
1509 void *
1510 dlsym(void *handle, const char *name)
1511 {
1512 	int	entry;
1513 	Rt_map	*clmp, *dlmp = NULL;
1514 	void	*addr;
1515 
1516 	entry = enter(0);
1517 
1518 	clmp = _caller(caller(), CL_EXECDEF);
1519 
1520 	addr = dlsym_check(handle, name, clmp, &dlmp);
1521 
1522 	if (entry) {
1523 		if (dlmp)
1524 			is_dep_init(dlmp, clmp);
1525 		leave(LIST(clmp), 0);
1526 	}
1527 	return (addr);
1528 }
1529 
1530 /*
1531  * Core dladdr activity.
1532  */
1533 static void
1534 dladdr_core(Rt_map *almp, void *addr, Dl_info_t *dlip, void **info, int flags)
1535 {
1536 	/*
1537 	 * Set up generic information and any defaults.
1538 	 */
1539 	dlip->dli_fname = PATHNAME(almp);
1540 
1541 	dlip->dli_fbase = (void *)ADDR(almp);
1542 	dlip->dli_sname = NULL;
1543 	dlip->dli_saddr = NULL;
1544 
1545 	/*
1546 	 * Determine the nearest symbol to this address.
1547 	 */
1548 	LM_DLADDR(almp)((ulong_t)addr, almp, dlip, info, flags);
1549 }
1550 
1551 #pragma weak _dladdr = dladdr
1552 
1553 /*
1554  * External entry for dladdr(3dl) and dladdr1(3dl).  Returns an information
1555  * structure that reflects the symbol closest to the address specified.
1556  */
1557 int
1558 dladdr(void *addr, Dl_info_t *dlip)
1559 {
1560 	int	entry, ret;
1561 	Rt_map	*clmp, *almp;
1562 	Lm_list	*clml;
1563 
1564 	entry = enter(0);
1565 
1566 	clmp = _caller(caller(), CL_EXECDEF);
1567 	clml = LIST(clmp);
1568 
1569 	DBG_CALL(Dbg_dl_dladdr(clmp, addr));
1570 
1571 	/*
1572 	 * Use our calling technique to determine what object is associated
1573 	 * with the supplied address.  If a caller can't be determined,
1574 	 * indicate the failure.
1575 	 */
1576 	if ((almp = _caller(addr, CL_NONE)) == NULL) {
1577 		eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1578 		    EC_NATPTR(addr));
1579 		ret = 0;
1580 	} else {
1581 		dladdr_core(almp, addr, dlip, 0, 0);
1582 		ret = 1;
1583 	}
1584 
1585 	if (entry)
1586 		leave(clml, 0);
1587 	return (ret);
1588 }
1589 
1590 #pragma weak _dladdr1 = dladdr1
1591 
1592 int
1593 dladdr1(void *addr, Dl_info_t *dlip, void **info, int flags)
1594 {
1595 	int	entry, ret = 1;
1596 	Rt_map	*clmp, *almp;
1597 	Lm_list	*clml;
1598 
1599 	entry = enter(0);
1600 
1601 	clmp = _caller(caller(), CL_EXECDEF);
1602 	clml = LIST(clmp);
1603 
1604 	DBG_CALL(Dbg_dl_dladdr(clmp, addr));
1605 
1606 	/*
1607 	 * Validate any flags.
1608 	 */
1609 	if (flags) {
1610 		int	request;
1611 
1612 		if (((request = (flags & RTLD_DL_MASK)) != RTLD_DL_SYMENT) &&
1613 		    (request != RTLD_DL_LINKMAP)) {
1614 			eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLFLAGS),
1615 			    flags);
1616 			ret = 0;
1617 
1618 		} else if (info == NULL) {
1619 			eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLINFO),
1620 			    flags);
1621 			ret = 0;
1622 		}
1623 	}
1624 
1625 	/*
1626 	 * Use our calling technique to determine what object is associated
1627 	 * with the supplied address.  If a caller can't be determined,
1628 	 * indicate the failure.
1629 	 */
1630 	if (ret) {
1631 		if ((almp = _caller(addr, CL_NONE)) == NULL) {
1632 			eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1633 			    EC_NATPTR(addr));
1634 			ret = 0;
1635 		} else
1636 			dladdr_core(almp, addr, dlip, info, flags);
1637 	}
1638 
1639 	if (entry)
1640 		leave(clml, 0);
1641 	return (ret);
1642 }
1643 
1644 /*
1645  * Core dldump activity.
1646  */
1647 static int
1648 dldump_core(Rt_map *clmp, Rt_map *lmp, const char *ipath, const char *opath,
1649     int flags)
1650 {
1651 	Lm_list	*lml = LIST(clmp);
1652 	Addr	addr = 0;
1653 
1654 	/*
1655 	 * Verify any arguments first.
1656 	 */
1657 	if ((opath == NULL) || (opath[0] == '\0') ||
1658 	    ((lmp == NULL) && (ipath[0] == '\0'))) {
1659 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
1660 		return (1);
1661 	}
1662 
1663 	/*
1664 	 * If an input file is specified make sure its one of our dependencies
1665 	 * on the main link-map list.  Note, this has really all evolved for
1666 	 * crle(), which uses libcrle.so on an alternative link-map to trigger
1667 	 * dumping objects from the main link-map list.   If we ever want to
1668 	 * dump objects from alternative link-maps, this model is going to
1669 	 * have to be revisited.
1670 	 */
1671 	if (lmp == NULL) {
1672 		if ((lmp = is_so_loaded(&lml_main, ipath, NULL)) == NULL) {
1673 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NOFILE),
1674 			    ipath);
1675 			return (1);
1676 		}
1677 		if (FLAGS(lmp) & FLG_RT_ALTER) {
1678 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_ALTER), ipath);
1679 			return (1);
1680 		}
1681 		if (FLAGS(lmp) & FLG_RT_NODUMP) {
1682 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NODUMP),
1683 			    ipath);
1684 			return (1);
1685 		}
1686 	}
1687 
1688 	/*
1689 	 * If the object being dump'ed isn't fixed identify its mapping.
1690 	 */
1691 	if (!(FLAGS(lmp) & FLG_RT_FIXED))
1692 		addr = ADDR(lmp);
1693 
1694 	/*
1695 	 * As rt_dldump() will effectively lazy load the necessary support
1696 	 * libraries, make sure ld.so.1 is initialized for plt relocations.
1697 	 */
1698 	if (elf_rtld_load() == 0)
1699 		return (0);
1700 
1701 	/*
1702 	 * Dump the required image.
1703 	 */
1704 	return (rt_dldump(lmp, opath, flags, addr));
1705 }
1706 
1707 #pragma weak _dldump = dldump
1708 
1709 /*
1710  * External entry for dldump(3c).  Returns 0 on success, non-zero otherwise.
1711  */
1712 int
1713 dldump(const char *ipath, const char *opath, int flags)
1714 {
1715 	int	error, entry;
1716 	Rt_map	*clmp, *lmp;
1717 
1718 	entry = enter(0);
1719 
1720 	clmp = _caller(caller(), CL_EXECDEF);
1721 
1722 	if (ipath) {
1723 		lmp = NULL;
1724 	} else {
1725 		lmp = lml_main.lm_head;
1726 		ipath = NAME(lmp);
1727 	}
1728 
1729 	DBG_CALL(Dbg_dl_dldump(clmp, ipath, opath, flags));
1730 
1731 	error = dldump_core(clmp, lmp, ipath, opath, flags);
1732 
1733 	if (entry)
1734 		leave(LIST(clmp), 0);
1735 	return (error);
1736 }
1737 
1738 /*
1739  * get_linkmap_id() translates Lm_list * pointers to the Link_map id as used by
1740  * the rtld_db and dlmopen() interfaces.  It checks to see if the Link_map is
1741  * one of the primary ones and if so returns it's special token:
1742  *		LM_ID_BASE
1743  *		LM_ID_LDSO
1744  *
1745  * If it's not one of the primary link_map id's it will instead returns a
1746  * pointer to the Lm_list structure which uniquely identifies the Link_map.
1747  */
1748 Lmid_t
1749 get_linkmap_id(Lm_list *lml)
1750 {
1751 	if (lml->lm_flags & LML_FLG_BASELM)
1752 		return (LM_ID_BASE);
1753 	if (lml->lm_flags & LML_FLG_RTLDLM)
1754 		return (LM_ID_LDSO);
1755 
1756 	return ((Lmid_t)lml);
1757 }
1758 
1759 /*
1760  * Set a new deferred dependency name.
1761  */
1762 static int
1763 set_def_need(Lm_list *lml, Dyninfo *dyip, const char *name)
1764 {
1765 	/*
1766 	 * If this dependency has already been established, then this dlinfo()
1767 	 * call is too late.
1768 	 */
1769 	if (dyip->di_info) {
1770 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_DEF_DEPLOADED),
1771 		    dyip->di_name);
1772 		return (-1);
1773 	}
1774 
1775 	/*
1776 	 * Assign the new dependency name.
1777 	 */
1778 	DBG_CALL(Dbg_file_deferred(lml, dyip->di_name, name));
1779 	dyip->di_flags |= FLG_DI_DEF_DONE;
1780 	dyip->di_name = name;
1781 	return (0);
1782 }
1783 
1784 /*
1785  * Extract information for a dlopen() handle.
1786  */
1787 static int
1788 dlinfo_core(void *handle, int request, void *p, Rt_map *clmp)
1789 {
1790 	Conv_inv_buf_t	inv_buf;
1791 	char		*handlename;
1792 	Lm_list		*lml = LIST(clmp);
1793 	Rt_map		*lmp = NULL;
1794 
1795 	/*
1796 	 * Determine whether a handle is provided.  A handle isn't needed for
1797 	 * all operations, but it is validated here for the initial diagnostic.
1798 	 */
1799 	if (handle == RTLD_SELF) {
1800 		lmp = clmp;
1801 	} else {
1802 		Grp_hdl	*ghp = (Grp_hdl *)handle;
1803 
1804 		if (hdl_validate(ghp))
1805 			lmp = ghp->gh_ownlmp;
1806 	}
1807 	if (lmp) {
1808 		handlename = NAME(lmp);
1809 	} else {
1810 		(void) conv_invalid_val(&inv_buf, EC_NATPTR(handle), 0);
1811 		handlename = inv_buf.buf;
1812 	}
1813 
1814 	DBG_CALL(Dbg_dl_dlinfo(clmp, handlename, request, p));
1815 
1816 	/*
1817 	 * Validate the request and return buffer.
1818 	 */
1819 	if ((request > RTLD_DI_MAX) || (p == NULL)) {
1820 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLVAL));
1821 		return (-1);
1822 	}
1823 
1824 	/*
1825 	 * Return configuration cache name and address.
1826 	 */
1827 	if (request == RTLD_DI_CONFIGADDR) {
1828 		Dl_info_t	*dlip = (Dl_info_t *)p;
1829 
1830 		if ((config->c_name == NULL) || (config->c_bgn == 0) ||
1831 		    (config->c_end == 0)) {
1832 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOCONFIG));
1833 			return (-1);
1834 		}
1835 		dlip->dli_fname = config->c_name;
1836 		dlip->dli_fbase = (void *)config->c_bgn;
1837 		return (0);
1838 	}
1839 
1840 	/*
1841 	 * Return profiled object name (used by ldprof audit library).
1842 	 */
1843 	if (request == RTLD_DI_PROFILENAME) {
1844 		if (profile_name == NULL) {
1845 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOPROFNAME));
1846 			return (-1);
1847 		}
1848 
1849 		*(const char **)p = profile_name;
1850 		return (0);
1851 	}
1852 	if (request == RTLD_DI_PROFILEOUT) {
1853 		/*
1854 		 * If a profile destination directory hasn't been specified
1855 		 * provide a default.
1856 		 */
1857 		if (profile_out == NULL)
1858 			profile_out = MSG_ORIG(MSG_PTH_VARTMP);
1859 
1860 		*(const char **)p = profile_out;
1861 		return (0);
1862 	}
1863 
1864 	/*
1865 	 * Obtain or establish a termination signal.
1866 	 */
1867 	if (request == RTLD_DI_GETSIGNAL) {
1868 		*(int *)p = killsig;
1869 		return (0);
1870 	}
1871 
1872 	if (request == RTLD_DI_SETSIGNAL) {
1873 		sigset_t	set;
1874 		int		sig = *(int *)p;
1875 
1876 		/*
1877 		 * Determine whether the signal is in range.
1878 		 */
1879 		(void) sigfillset(&set);
1880 		if (sigismember(&set, sig) != 1) {
1881 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVSIG), sig);
1882 			return (-1);
1883 		}
1884 
1885 		killsig = sig;
1886 		return (0);
1887 	}
1888 
1889 	/*
1890 	 * For any other request a link-map is required.  Verify the handle.
1891 	 */
1892 	if (lmp == NULL) {
1893 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL),
1894 		    EC_NATPTR(handle));
1895 		return (-1);
1896 	}
1897 
1898 	/*
1899 	 * Obtain the process arguments, environment and auxv.  Note, as the
1900 	 * environment can be modified by the user (putenv(3c)), reinitialize
1901 	 * the environment pointer on each request.
1902 	 */
1903 	if (request == RTLD_DI_ARGSINFO) {
1904 		Dl_argsinfo_t	*aip = (Dl_argsinfo_t *)p;
1905 		Lm_list		*lml = LIST(lmp);
1906 
1907 		*aip = argsinfo;
1908 		if (lml->lm_flags & LML_FLG_ENVIRON)
1909 			aip->dla_envp = *(lml->lm_environ);
1910 
1911 		return (0);
1912 	}
1913 
1914 	/*
1915 	 * Return Lmid_t of the Link-Map list that the specified object is
1916 	 * loaded on.
1917 	 */
1918 	if (request == RTLD_DI_LMID) {
1919 		*(Lmid_t *)p = get_linkmap_id(LIST(lmp));
1920 		return (0);
1921 	}
1922 
1923 	/*
1924 	 * Return a pointer to the Link-Map structure associated with the
1925 	 * specified object.
1926 	 */
1927 	if (request == RTLD_DI_LINKMAP) {
1928 		*(Link_map **)p = (Link_map *)lmp;
1929 		return (0);
1930 	}
1931 
1932 	/*
1933 	 * Return search path information, or the size of the buffer required
1934 	 * to store the information.
1935 	 */
1936 	if ((request == RTLD_DI_SERINFO) || (request == RTLD_DI_SERINFOSIZE)) {
1937 		Spath_desc	sd = { search_rules, NULL, 0 };
1938 		Pdesc		*pdp;
1939 		Dl_serinfo_t	*info;
1940 		Dl_serpath_t	*path;
1941 		char		*strs;
1942 		size_t		size = sizeof (Dl_serinfo_t);
1943 		uint_t		cnt = 0;
1944 
1945 		info = (Dl_serinfo_t *)p;
1946 		path = &info->dls_serpath[0];
1947 		strs = (char *)&info->dls_serpath[info->dls_cnt];
1948 
1949 		/*
1950 		 * Traverse search path entries for this object.
1951 		 */
1952 		while ((pdp = get_next_dir(&sd, lmp, 0)) != NULL) {
1953 			size_t	_size;
1954 
1955 			if (pdp->pd_pname == NULL)
1956 				continue;
1957 
1958 			/*
1959 			 * If configuration information exists, it's possible
1960 			 * this path has been identified as non-existent, if so
1961 			 * ignore it.
1962 			 */
1963 			if (pdp->pd_info) {
1964 				Rtc_obj	*dobj = (Rtc_obj *)pdp->pd_info;
1965 				if (dobj->co_flags & RTC_OBJ_NOEXIST)
1966 					continue;
1967 			}
1968 
1969 			/*
1970 			 * Keep track of search path count and total info size.
1971 			 */
1972 			if (cnt++)
1973 				size += sizeof (Dl_serpath_t);
1974 			_size = pdp->pd_plen + 1;
1975 			size += _size;
1976 
1977 			if (request == RTLD_DI_SERINFOSIZE)
1978 				continue;
1979 
1980 			/*
1981 			 * If we're filling in search path information, confirm
1982 			 * there's sufficient space.
1983 			 */
1984 			if (size > info->dls_size) {
1985 				eprintf(lml, ERR_FATAL,
1986 				    MSG_INTL(MSG_ARG_SERSIZE),
1987 				    EC_OFF(info->dls_size));
1988 				return (-1);
1989 			}
1990 			if (cnt > info->dls_cnt) {
1991 				eprintf(lml, ERR_FATAL,
1992 				    MSG_INTL(MSG_ARG_SERCNT), info->dls_cnt);
1993 				return (-1);
1994 			}
1995 
1996 			/*
1997 			 * Append the path to the information buffer.
1998 			 */
1999 			(void) strcpy(strs, pdp->pd_pname);
2000 			path->dls_name = strs;
2001 			path->dls_flags = (pdp->pd_flags & LA_SER_MASK);
2002 
2003 			strs = strs + _size;
2004 			path++;
2005 		}
2006 
2007 		/*
2008 		 * If we're here to size the search buffer fill it in.
2009 		 */
2010 		if (request == RTLD_DI_SERINFOSIZE) {
2011 			info->dls_size = size;
2012 			info->dls_cnt = cnt;
2013 		}
2014 
2015 		return (0);
2016 	}
2017 
2018 	/*
2019 	 * Return the origin of the object associated with this link-map.
2020 	 * Basically return the dirname(1) of the objects fullpath.
2021 	 */
2022 	if (request == RTLD_DI_ORIGIN) {
2023 		char	*str = (char *)p;
2024 
2025 		(void) strncpy(str, ORIGNAME(lmp), DIRSZ(lmp));
2026 		str += DIRSZ(lmp);
2027 		*str = '\0';
2028 
2029 		return (0);
2030 	}
2031 
2032 	/*
2033 	 * Return the number of object mappings, or the mapping information for
2034 	 * this object.
2035 	 */
2036 	if (request == RTLD_DI_MMAPCNT) {
2037 		uint_t	*cnt = (uint_t *)p;
2038 
2039 		*cnt = MMAPCNT(lmp);
2040 		return (0);
2041 	}
2042 	if (request == RTLD_DI_MMAPS) {
2043 		Dl_mapinfo_t	*mip = (Dl_mapinfo_t *)p;
2044 
2045 		if (mip->dlm_acnt && mip->dlm_maps) {
2046 			uint_t	cnt = 0;
2047 
2048 			while ((cnt < mip->dlm_acnt) && (cnt < MMAPCNT(lmp))) {
2049 				mip->dlm_maps[cnt] = MMAPS(lmp)[cnt];
2050 				cnt++;
2051 			}
2052 			mip->dlm_rcnt = cnt;
2053 		}
2054 		return (0);
2055 	}
2056 
2057 	/*
2058 	 * Assign a new dependency name to a deferred dependency.
2059 	 */
2060 	if ((request == RTLD_DI_DEFERRED) ||
2061 	    (request == RTLD_DI_DEFERRED_SYM)) {
2062 		Dl_definfo_t	*dfip = (Dl_definfo_t *)p;
2063 		Dyninfo		*dyip;
2064 		const char	*dname, *rname;
2065 
2066 		/*
2067 		 * Verify the names.
2068 		 */
2069 		if ((dfip->dld_refname == NULL) ||
2070 		    (dfip->dld_depname == NULL)) {
2071 			eprintf(LIST(clmp), ERR_FATAL,
2072 			    MSG_INTL(MSG_ARG_ILLNAME));
2073 			return (-1);
2074 		}
2075 
2076 		dname = dfip->dld_depname;
2077 		rname = dfip->dld_refname;
2078 
2079 		/*
2080 		 * A deferred dependency can be determined by referencing a
2081 		 * symbol family member that is associated to the dependency,
2082 		 * or by looking for the dependency by its name.
2083 		 */
2084 		if (request == RTLD_DI_DEFERRED_SYM) {
2085 			Slookup		sl;
2086 			Sresult		sr;
2087 			uint_t		binfo;
2088 			Syminfo		*sip;
2089 
2090 			/*
2091 			 * Lookup the symbol in the associated object.
2092 			 */
2093 			SLOOKUP_INIT(sl, rname, lmp, lmp, ld_entry_cnt,
2094 			    elf_hash(rname), 0, 0, 0, LKUP_SYMNDX);
2095 			SRESULT_INIT(sr, rname);
2096 			if (sym_lookup_in_caller(clmp, &sl, &sr,
2097 			    &binfo) == NULL) {
2098 				eprintf(LIST(clmp), ERR_FATAL,
2099 				    MSG_INTL(MSG_DEF_NOSYMFOUND), rname);
2100 				return (-1);
2101 			}
2102 
2103 			/*
2104 			 * Use the symbols index to reference the Syminfo entry
2105 			 * and thus find the associated dependency.
2106 			 */
2107 			if (sl.sl_rsymndx && ((sip = SYMINFO(clmp)) != NULL)) {
2108 				/* LINTED */
2109 				sip = (Syminfo *)((char *)sip +
2110 				    (sl.sl_rsymndx * SYMINENT(lmp)));
2111 
2112 				if ((sip->si_flags & SYMINFO_FLG_DEFERRED) &&
2113 				    (sip->si_boundto < SYMINFO_BT_LOWRESERVE) &&
2114 				    ((dyip = DYNINFO(lmp)) != NULL)) {
2115 					dyip += sip->si_boundto;
2116 
2117 					if (!(dyip->di_flags & FLG_DI_IGNORE))
2118 						return (set_def_need(lml,
2119 						    dyip, dname));
2120 				}
2121 			}
2122 
2123 			/*
2124 			 * No deferred symbol found.
2125 			 */
2126 			eprintf(LIST(clmp), ERR_FATAL,
2127 			    MSG_INTL(MSG_DEF_NOSYMFOUND), rname);
2128 			return (-1);
2129 
2130 		} else {
2131 			Dyn	*dyn;
2132 
2133 			/*
2134 			 * Using the target objects dependency information, find
2135 			 * the associated deferred dependency.
2136 			 */
2137 			for (dyn = DYN(lmp), dyip = DYNINFO(lmp);
2138 			    !(dyip->di_flags & FLG_DI_IGNORE); dyn++, dyip++) {
2139 				const char	*oname;
2140 
2141 				if ((dyip->di_flags & FLG_DI_DEFERRED) == 0)
2142 					continue;
2143 
2144 				if (strcmp(rname, dyip->di_name) == 0)
2145 					return (set_def_need(lml, dyip, dname));
2146 
2147 				/*
2148 				 * If this dependency name has been changed by
2149 				 * a previous dlinfo(), check the original
2150 				 * dynamic entry string.  The user might be
2151 				 * attempting to re-change an entry using the
2152 				 * original name as the reference.
2153 				 */
2154 				if ((dyip->di_flags & FLG_DI_DEF_DONE) == 0)
2155 					continue;
2156 
2157 				oname = STRTAB(lmp) + dyn->d_un.d_val;
2158 				if (strcmp(rname, oname) == 0)
2159 					return (set_def_need(lml, dyip, dname));
2160 			}
2161 
2162 			/*
2163 			 * No deferred dependency found.
2164 			 */
2165 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_DEF_NODEPFOUND),
2166 			    rname);
2167 			return (-1);
2168 		}
2169 	}
2170 	return (0);
2171 }
2172 
2173 #pragma weak _dlinfo = dlinfo
2174 
2175 /*
2176  * External entry for dlinfo(3dl).
2177  */
2178 int
2179 dlinfo(void *handle, int request, void *p)
2180 {
2181 	int	error, entry;
2182 	Rt_map	*clmp;
2183 
2184 	entry = enter(0);
2185 
2186 	clmp = _caller(caller(), CL_EXECDEF);
2187 
2188 	error = dlinfo_core(handle, request, p, clmp);
2189 
2190 	if (entry)
2191 		leave(LIST(clmp), 0);
2192 	return (error);
2193 }
2194 
2195 /*
2196  * GNU defined function to iterate through the program headers for all
2197  * currently loaded dynamic objects. The caller supplies a callback function
2198  * which is called for each object.
2199  *
2200  * entry:
2201  *	callback - Callback function to call. The arguments to the callback
2202  *		function are:
2203  *		info - Address of dl_phdr_info structure
2204  *		size - sizeof (struct dl_phdr_info)
2205  *		data - Caller supplied value.
2206  *	data - Value supplied by caller, which is passed to callback without
2207  *		examination.
2208  *
2209  * exit:
2210  *	callback is called for each dynamic ELF object in the process address
2211  *	space, halting when a non-zero value is returned, or when the last
2212  *	object has been processed. The return value from the last call
2213  *	to callback is returned.
2214  *
2215  * note:
2216  *	The Linux implementation has added additional fields to the
2217  *	dl_phdr_info structure over time. The callback function is
2218  *	supposed to use the size field to determine which fields are
2219  *	present, and to avoid attempts to access non-existent fields.
2220  *	We have added those fields that are compatible with Solaris, and
2221  *	which are used by GNU C++ (g++) runtime exception handling support.
2222  *
2223  * note:
2224  *	We issue a callback for every ELF object mapped into the process
2225  *	address space at the time this routine is entered. These callbacks
2226  *	are arbitrary functions that can do anything, including possibly
2227  *	causing new objects to be mapped into the process, or unmapped.
2228  *	This complicates matters:
2229  *
2230  *	-	Adding new objects can cause the alists to be reallocated
2231  *		or for contents to move. This can happen explicitly via
2232  *		dlopen(), or implicitly via lazy loading. One might consider
2233  *		simply banning dlopen from a callback, but lazy loading must
2234  *		be allowed, in which case there's no reason to ban dlopen().
2235  *
2236  *	-	Removing objects can leave us holding references to freed
2237  *		memory that must not be accessed, and can cause the list
2238  *		items to move in a way that would cause us to miss reporting
2239  *		one, or double report others.
2240  *
2241  *	-	We cannot allocate memory to build a separate data structure,
2242  *		because the interface to dl_iterate_phdr() does not have a
2243  *		way to communicate allocation errors back to the caller.
2244  *		Even if we could, it would be difficult to do so efficiently.
2245  *
2246  *	-	It is possible for dl_iterate_phdr() to be called recursively
2247  *		from a callback, and there is no way for us to detect or manage
2248  *		this effectively, particularly as the user might use longjmp()
2249  *		to skip past us on return. Hence, we must be reentrant
2250  *		(stateless), further precluding the option of building a
2251  *		separate data structure.
2252  *
2253  *	Despite these constraints, we are able to traverse the link-map
2254  *	lists safely:
2255  *
2256  *	-	Once interposer (preload) objects have been processed at
2257  *		startup, we know that new objects are always placed at the
2258  *		end of the list. Hence, if we are reading a list when that
2259  *		happens, the new object will not alter the part of the list
2260  *		that we've already processed.
2261  *
2262  *	-	The alist _TRAVERSE macros recalculate the address of the
2263  *		current item from scratch on each iteration, rather than
2264  *		incrementing a pointer. Hence, alist additions that occur
2265  *		in mid-traverse will not cause confusion.
2266  *
2267  * 	There is one limitation: We cannot continue operation if an object
2268  *	is removed from the process from within a callback. We detect when
2269  *	this happens and return immediately with a -1 return value.
2270  *
2271  * note:
2272  *	As currently implemented, if a callback causes an object to be loaded,
2273  *	that object may or may not be reported by the current invocation of
2274  *	dl_iterate_phdr(), based on whether or not we have already processed
2275  *	the link-map list that receives it. If we want to prevent this, it
2276  *	can be done efficiently by associating the current value of cnt_map
2277  *	with each new Rt_map entered into the system. Then this function can
2278  *	use that to detect and skip new objects that enter the system in
2279  *	mid-iteration. However, the Linux documentation is ambiguous on whether
2280  *	this is necessary, and it does not appear to matter in practice.
2281  *	We have therefore chosen not to do so at this time.
2282  */
2283 int
2284 dl_iterate_phdr(int (*callback)(struct dl_phdr_info *, size_t, void *),
2285     void *data)
2286 {
2287 	struct dl_phdr_info	info;
2288 	u_longlong_t		l_cnt_map = cnt_map;
2289 	u_longlong_t		l_cnt_unmap = cnt_unmap;
2290 	Lm_list			*lml, *clml;
2291 	Lm_cntl			*lmc;
2292 	Rt_map			*lmp, *clmp;
2293 	Aliste			idx1, idx2;
2294 	Ehdr			*ehdr;
2295 	int			ret = 0;
2296 	int			entry;
2297 
2298 	entry = enter(0);
2299 	clmp = _caller(caller(), CL_EXECDEF);
2300 	clml = LIST(clmp);
2301 
2302 	DBG_CALL(Dbg_dl_iphdr_enter(clmp, cnt_map, cnt_unmap));
2303 
2304 	/* Issue a callback for each ELF object in the process */
2305 	for (APLIST_TRAVERSE(dynlm_list, idx1, lml)) {
2306 		for (ALIST_TRAVERSE(lml->lm_lists, idx2, lmc)) {
2307 			for (lmp = lmc->lc_head; lmp; lmp = NEXT_RT_MAP(lmp)) {
2308 #if defined(_sparc) && !defined(_LP64)
2309 				/*
2310 				 * On 32-bit sparc, the possibility exists that
2311 				 * this object is not ELF.
2312 				 */
2313 				if (THIS_IS_NOT_ELF(lmp))
2314 					continue;
2315 #endif
2316 				/* Prepare the object information structure */
2317 				ehdr = (Ehdr *) ADDR(lmp);
2318 				info.dlpi_addr = (ehdr->e_type == ET_EXEC) ?
2319 				    0 : ADDR(lmp);
2320 				info.dlpi_name = lmp->rt_pathname;
2321 				info.dlpi_phdr = (Phdr *)
2322 				    (ADDR(lmp) + ehdr->e_phoff);
2323 				info.dlpi_phnum = ehdr->e_phnum;
2324 				info.dlpi_adds = cnt_map;
2325 				info.dlpi_subs = cnt_unmap;
2326 
2327 				/* Issue the callback */
2328 				DBG_CALL(Dbg_dl_iphdr_callback(clml, &info));
2329 				leave(clml, thr_flg_reenter);
2330 				ret = (* callback)(&info, sizeof (info), data);
2331 				(void) enter(thr_flg_reenter);
2332 
2333 				/* Return immediately on non-zero result */
2334 				if (ret != 0)
2335 					goto done;
2336 
2337 				/* Adapt to object mapping changes */
2338 				if ((cnt_map == l_cnt_map) &&
2339 				    (cnt_unmap == l_cnt_unmap))
2340 					continue;
2341 
2342 				DBG_CALL(Dbg_dl_iphdr_mapchange(clml, cnt_map,
2343 				    cnt_unmap));
2344 
2345 				/* Stop if an object was unmapped */
2346 				if (cnt_unmap == l_cnt_unmap) {
2347 					l_cnt_map = cnt_map;
2348 					continue;
2349 				}
2350 
2351 				ret = -1;
2352 				DBG_CALL(Dbg_dl_iphdr_unmap_ret(clml));
2353 				goto done;
2354 			}
2355 		}
2356 	}
2357 
2358 done:
2359 	if (entry)
2360 		leave(LIST(clmp), 0);
2361 	return (ret);
2362 }
2363