xref: /illumos-gate/usr/src/cmd/sgs/rtld/common/dlfcns.c (revision da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1988 AT&T
24  *	  All Rights Reserved
25  *
26  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
27  * Use is subject to license terms.
28  */
29 
30 #pragma ident	"%Z%%M%	%I%	%E% SMI"
31 
32 /*
33  * Programmatic interface to the run_time linker.
34  */
35 #include	"_synonyms.h"
36 
37 #include	<sys/debug.h>
38 #include	<string.h>
39 #include	<dlfcn.h>
40 #include	<synch.h>
41 #include	<limits.h>
42 #include	<debug.h>
43 #include	"_rtld.h"
44 #include	"_audit.h"
45 #include	"_elf.h"
46 #include	"msg.h"
47 
48 /*
49  * Determine who called us - given a pc determine in which object it resides.
50  *
51  * For dlopen() the link map of the caller must be passed to load_so() so that
52  * the appropriate search rules (4.x or 5.0) are used to locate any
53  * dependencies.  Also, if we've been called from a 4.x module it may be
54  * necessary to fix the specified pathname so that it conforms with the 5.0 elf
55  * rules.
56  *
57  * For dlsym() the link map of the caller is used to determine RTLD_NEXT
58  * requests, together with requests based off of a dlopen(0).
59  * For dladdr() this routines provides a generic means of scanning all loaded
60  * segments.
61  */
62 Rt_map *
63 _caller(caddr_t cpc, int flags)
64 {
65 	Lm_list *	lml;
66 	Listnode *	lnp;
67 
68 	for (LIST_TRAVERSE(&dynlm_list, lnp, lml)) {
69 		Aliste	off;
70 		Lm_cntl	*lmc;
71 
72 		for (ALIST_TRAVERSE(lml->lm_lists, off, lmc)) {
73 			Rt_map	*lmp;
74 
75 			for (lmp = lmc->lc_head; lmp;
76 			    lmp = (Rt_map *)NEXT(lmp)) {
77 				Mmap	*mmap;
78 
79 				/*
80 				 * Traverse this objects mappings testing
81 				 * whether the pc falls within its range.
82 				 */
83 				for (mmap = MMAPS(lmp); mmap->m_vaddr; mmap++) {
84 					if ((cpc >= mmap->m_vaddr) && (cpc <
85 					    (mmap->m_vaddr + mmap->m_msize)))
86 						return (lmp);
87 				}
88 			}
89 		}
90 	}
91 
92 	/*
93 	 * No mapping can be determined.  If asked for a default, assume this
94 	 * is from the executable.
95 	 */
96 	if (flags & CL_EXECDEF)
97 		return ((Rt_map *)lml_main.lm_head);
98 
99 	return (0);
100 }
101 
102 #pragma weak dlerror = _dlerror
103 
104 /*
105  * External entry for dlerror(3dl).  Returns a pointer to the string describing
106  * the last occurring error.  The last occurring error is cleared.
107  */
108 char *
109 _dlerror()
110 {
111 	char	*error;
112 	Rt_map	*clmp;
113 	int	entry;
114 
115 	entry = enter();
116 
117 	clmp = _caller(caller(), CL_EXECDEF);
118 
119 	error = lasterr;
120 	lasterr = (char *)0;
121 
122 	if (entry)
123 		leave(LIST(clmp));
124 	return (error);
125 }
126 
127 /*
128  * Add a dependency as a group descriptor to a group handle.  Returns 0 on
129  * failure, ALE_EXISTS if the dependency already exists, or ALE_CREATE if it
130  * is newly created.
131  */
132 int
133 hdl_add(Grp_hdl *ghp, Rt_map *lmp, uint_t flags)
134 {
135 	Grp_desc	*gdp;
136 	Aliste		off;
137 	int		found = ALE_CREATE;
138 	uint_t		oflags;
139 
140 	/*
141 	 * Make sure this dependency hasn't already been recorded.
142 	 */
143 	for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
144 		if (gdp->gd_depend == lmp) {
145 			found = ALE_EXISTS;
146 			break;
147 		}
148 	}
149 
150 	if (found == ALE_CREATE) {
151 		Grp_desc	gd;
152 
153 		/*
154 		 * Create a new handle descriptor.
155 		 */
156 		gd.gd_depend = lmp;
157 		gd.gd_flags = 0;
158 
159 		/*
160 		 * Indicate this object is a part of this handles group.
161 		 */
162 		if (alist_append(&GROUPS(lmp), &ghp,
163 		    sizeof (Grp_hdl *), AL_CNT_GROUPS) == 0)
164 			return (0);
165 
166 		/*
167 		 * Append the new dependency to this handle.
168 		 */
169 		if ((gdp = alist_append(&(ghp->gh_depends), &gd,
170 		    sizeof (Grp_desc), AL_CNT_DEPENDS)) == 0)
171 			return (0);
172 	}
173 
174 	oflags = gdp->gd_flags;
175 	gdp->gd_flags |= flags;
176 
177 	if (DBG_ENABLED) {
178 		if (found == ALE_CREATE)
179 			DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_ADD,
180 			    gdp->gd_flags));
181 		else if (gdp->gd_flags != oflags)
182 			DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_UPDATE,
183 			    gdp->gd_flags));
184 	}
185 	return (found);
186 }
187 
188 /*
189  * Allocate a handle and record its existence on the handle list for future
190  * verification.
191  */
192 Grp_hdl *
193 hdl_alloc()
194 {
195 	Grp_hdl	*ghp;
196 	uint_t	ndx;
197 
198 	if ((ghp = calloc(sizeof (Grp_hdl), 1)) == 0)
199 		return (0);
200 
201 	/* LINTED */
202 	ndx = (uintptr_t)ghp % HDLIST_SZ;
203 
204 	if (list_append(&hdl_list[ndx], ghp) == 0) {
205 		free(ghp);
206 		return (0);
207 	}
208 	return (ghp);
209 }
210 
211 /*
212  * Create a handle.
213  */
214 Grp_hdl *
215 hdl_create(Lm_list *lml, Rt_map *nlmp, Rt_map *clmp, uint_t hflags,
216     uint_t ndflags, uint_t cdflags)
217 {
218 	Grp_hdl	*ghp = 0, **ghpp;
219 	Alist	**alpp;
220 	Aliste	off;
221 
222 	/*
223 	 * For dlopen(0) the handle is maintained as part of the link-map list,
224 	 * otherwise it is associated with the referenced link-map.
225 	 */
226 	if (hflags & GPH_ZERO)
227 		alpp = &(lml->lm_handle);
228 	else
229 		alpp = &(HANDLES(nlmp));
230 
231 	/*
232 	 * Objects can contain multiple handles depending on the handle flags
233 	 * supplied.  Most RTLD flags pertain to the object itself and the
234 	 * bindings that it can achieve.  Multiple handles for these flags
235 	 * don't make sense.  But if the flag determines how the handle might
236 	 * be used, then multiple handles may exist.  Presently this only makes
237 	 * sense for RTLD_FIRST.  Determine if an appropriate handle already
238 	 * exists.
239 	 */
240 	for (ALIST_TRAVERSE(*alpp, off, ghpp)) {
241 		if (((*ghpp)->gh_flags & GPH_FIRST) == (hflags & GPH_FIRST)) {
242 			ghp = *ghpp;
243 			break;
244 		}
245 	}
246 
247 	if (ghp == 0) {
248 		DBG_CALL(Dbg_file_hdl_title(DBG_HDL_CREATE));
249 
250 		/*
251 		 * If this is the first dlopen() request for this handle
252 		 * allocate and initialize a new handle.
253 		 */
254 		if ((ghp = hdl_alloc()) == 0)
255 			return (0);
256 
257 		if (alist_append(alpp, &ghp, sizeof (Grp_hdl *),
258 		    AL_CNT_GROUPS) == 0)
259 			return (0);
260 
261 		/*
262 		 * Indicate that this object has been referenced.  In truth a
263 		 * reference hasn't yet occurred, it's a dlsym() that makes the
264 		 * reference.  However, we assume that anyone performing a
265 		 * dlopen() will eventually call dlsym(), plus this makes for a
266 		 * better diagnostic location rather than having to call
267 		 * unused() after every dlsym() operation.
268 		 */
269 		if (nlmp)
270 			FLAGS1(nlmp) |= FL1_RT_USED;
271 
272 		ghp->gh_refcnt = 1;
273 		ghp->gh_flags = hflags;
274 
275 		/*
276 		 * A dlopen(0) handle is identified by the GPH_ZERO flag, the
277 		 * head of the link-map list is defined as the owner.  There is
278 		 * no need to maintain a list of dependencies, for when this
279 		 * handle is used (for dlsym()) a dynamic search through the
280 		 * entire link-map list provides for searching all objects with
281 		 * GLOBAL visibility.
282 		 */
283 		if (hflags & GPH_ZERO) {
284 			ghp->gh_ownlmp = lml->lm_head;
285 			ghp->gh_ownlml = lml;
286 		} else {
287 			ghp->gh_ownlmp = nlmp;
288 			ghp->gh_ownlml = LIST(nlmp);
289 
290 			if (hdl_add(ghp, nlmp, ndflags) == 0)
291 				return (0);
292 
293 			/*
294 			 * Indicate that a local group now exists.  This state
295 			 * allows singleton searches to be optimized.
296 			 */
297 			if ((hflags & GPH_LDSO) == 0)
298 				LIST(nlmp)->lm_flags |= LML_FLG_GROUPSEXIST;
299 		}
300 	} else {
301 		/*
302 		 * If a handle already exists, bump its reference count.
303 		 *
304 		 * If the previous reference count was 0, then this is a handle
305 		 * that an earlier call to dlclose() was unable to remove.  Such
306 		 * handles are put on the orphan list.  As this handle is back
307 		 * in use, it must be removed from the orphan list.
308 		 *
309 		 * Note, handles associated with a link-map list itself (i.e.
310 		 * dlopen(0)) can have a reference count of 0.  However, these
311 		 * handles are never deleted, and therefore are never moved to
312 		 * the orphan list.
313 		 */
314 		if ((ghp->gh_refcnt++ == 0) &&
315 		    ((ghp->gh_flags & GPH_ZERO) == 0)) {
316 			uint_t	ndx;
317 
318 			/* LINTED */
319 			ndx = (uintptr_t)ghp % HDLIST_SZ;
320 
321 			list_delete(&hdl_list[HDLIST_ORP], ghp);
322 			(void) list_append(&hdl_list[ndx], ghp);
323 
324 			if (DBG_ENABLED) {
325 				Aliste		off;
326 				Grp_desc	*gdp;
327 
328 				DBG_CALL(Dbg_file_hdl_title(DBG_HDL_REINST));
329 				for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp))
330 					DBG_CALL(Dbg_file_hdl_action(ghp,
331 					    gdp->gd_depend, DBG_DEP_REINST, 0));
332 			}
333 		}
334 	}
335 
336 	/*
337 	 * Keep track of the parent (caller).  As this object could be opened
338 	 * by different parents, this processing is carried out every time a
339 	 * handle is requested.
340 	 */
341 	if (clmp && (hdl_add(ghp, clmp, cdflags) == 0))
342 		return (0);
343 
344 	return (ghp);
345 }
346 
347 /*
348  * Initialize a handle that has been created for an object that is already
349  * loaded.  The handle is initialized with the present dependencies of that
350  * object.  Once this initialization has occurred, any new objects that might
351  * be loaded as dependencies (lazy-loading) are added to the handle as each new
352  * object is loaded.
353  */
354 int
355 hdl_initialize(Grp_hdl *ghp, Rt_map *nlmp, int mode, int promote)
356 {
357 	Aliste		off;
358 	Grp_desc	*gdp;
359 
360 	/*
361 	 * If the handle has already been initialized, and the initial object's
362 	 * mode hasn't been promoted, there's no need to recompute the modes of
363 	 * any dependencies.  If the object we've added has just been opened,
364 	 * the objects dependencies will not yet have been processed.  These
365 	 * dependencies will be added on later calls to load_one().  Otherwise,
366 	 * this object already exists, so add all of its dependencies to the
367 	 * handle were operating on.
368 	 */
369 	if (((ghp->gh_flags & GPH_INITIAL) && (promote == 0)) ||
370 	    ((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0)) {
371 		ghp->gh_flags |= GPH_INITIAL;
372 		return (1);
373 	}
374 
375 	DBG_CALL(Dbg_file_hdl_title(DBG_HDL_ADD));
376 	for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
377 		Rt_map *	lmp = gdp->gd_depend;
378 		Aliste		off1;
379 		Bnd_desc **	bdpp;
380 
381 		/*
382 		 * If this dependency doesn't indicate that its dependencies
383 		 * should be added to a handle, ignore it.  This case identifies
384 		 * a parent of a dlopen(RTLD_PARENT) request.
385 		 */
386 		if ((gdp->gd_flags & GPD_ADDEPS) == 0)
387 			continue;
388 
389 		for (ALIST_TRAVERSE(DEPENDS(lmp), off1, bdpp)) {
390 			Bnd_desc	*bdp = *bdpp;
391 			Rt_map		*dlmp = bdp->b_depend;
392 
393 			if ((bdp->b_flags & BND_NEEDED) == 0)
394 				continue;
395 
396 			if (hdl_add(ghp, dlmp,
397 			    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS)) == 0)
398 				return (0);
399 
400 			(void) update_mode(dlmp, MODE(dlmp), mode);
401 		}
402 	}
403 	ghp->gh_flags |= GPH_INITIAL;
404 	return (1);
405 }
406 
407 /*
408  * Sanity check a program-provided handle.
409  */
410 static int
411 hdl_validate(Grp_hdl *ghp)
412 {
413 	Listnode	*lnp;
414 	Grp_hdl		*lghp;
415 	uint_t		ndx;
416 
417 	/* LINTED */
418 	ndx = (uintptr_t)ghp % HDLIST_SZ;
419 
420 	for (LIST_TRAVERSE(&hdl_list[ndx], lnp, lghp)) {
421 		if ((lghp == ghp) && (ghp->gh_refcnt != 0))
422 			return (1);
423 	}
424 	return (0);
425 }
426 
427 /*
428  * Core dlclose activity.
429  */
430 int
431 dlclose_core(Grp_hdl *ghp, Rt_map *clmp, Lm_list *lml)
432 {
433 	int	error;
434 
435 	/*
436 	 * If we're already at atexit() there's no point processing further,
437 	 * all objects have already been tsorted for fini processing.
438 	 */
439 	if ((rtld_flags & RT_FL_ATEXIT) != 0)
440 		return (0);
441 
442 	/*
443 	 * Diagnose what we're up to.
444 	 */
445 	if (ghp->gh_flags & GPH_ZERO) {
446 		DBG_CALL(Dbg_file_dlclose(LIST(clmp), MSG_ORIG(MSG_STR_ZERO),
447 		    DBG_DLCLOSE_IGNORE));
448 	} else {
449 		DBG_CALL(Dbg_file_dlclose(LIST(clmp), NAME(ghp->gh_ownlmp),
450 		    DBG_DLCLOSE_NULL));
451 	}
452 
453 
454 	/*
455 	 * Decrement reference count of this object.
456 	 */
457 	if (--(ghp->gh_refcnt))
458 		return (0);
459 
460 	/*
461 	 * If this handle is special (dlopen(0)), then leave it around - it
462 	 * has little overhead.
463 	 */
464 	if (ghp->gh_flags & GPH_ZERO)
465 		return (0);
466 
467 	/*
468 	 * This handle is no longer being referenced, remove it.  If this handle
469 	 * is part of an alternative link-map list, determine if the whole list
470 	 * can be removed also.
471 	 */
472 	error = remove_hdl(ghp, clmp, 0);
473 
474 	if ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)
475 		remove_lml(lml);
476 
477 	return (error);
478 }
479 
480 /*
481  * Internal dlclose activity.  Called from user level or directly for internal
482  * error cleanup.
483  */
484 int
485 dlclose_intn(Grp_hdl *ghp, Rt_map *clmp)
486 {
487 	Rt_map	*nlmp = 0;
488 	Lm_list	*olml = 0;
489 	int	error;
490 
491 	/*
492 	 * Although we're deleting object(s) it's quite possible that additional
493 	 * objects get loaded from running the .fini section(s) of the objects
494 	 * being deleted.  These objects will have been added to the same
495 	 * link-map list as those objects being deleted.  Remember this list
496 	 * for later investigation.
497 	 */
498 	olml = ghp->gh_ownlml;
499 
500 	error = dlclose_core(ghp, clmp, olml);
501 
502 	/*
503 	 * Determine whether the original link-map list still exists.  In the
504 	 * case of a dlclose of an alternative (dlmopen) link-map the whole
505 	 * list may have been removed.
506 	 */
507 	if (olml) {
508 		Listnode	*lnp;
509 		Lm_list		*lml;
510 
511 		for (LIST_TRAVERSE(&dynlm_list, lnp, lml)) {
512 			if (olml == lml) {
513 				nlmp = olml->lm_head;
514 				break;
515 			}
516 		}
517 	}
518 	load_completion(nlmp);
519 	return (error);
520 }
521 
522 /*
523  * Argument checking for dlclose.  Only called via external entry.
524  */
525 static int
526 dlclose_check(void *handle, Rt_map *clmp)
527 {
528 	Grp_hdl	*ghp = (Grp_hdl *)handle;
529 
530 	if (hdl_validate(ghp) == 0) {
531 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL));
532 		return (1);
533 	}
534 	return (dlclose_intn(ghp, clmp));
535 }
536 
537 #pragma weak dlclose = _dlclose
538 
539 /*
540  * External entry for dlclose(3dl).  Returns 0 for success, non-zero otherwise.
541  */
542 int
543 _dlclose(void *handle)
544 {
545 	int		error, entry;
546 	Rt_map		*clmp;
547 
548 	entry = enter();
549 
550 	clmp = _caller(caller(), CL_EXECDEF);
551 
552 	error = dlclose_check(handle, clmp);
553 
554 	if (entry)
555 		leave(LIST(clmp));
556 	return (error);
557 }
558 
559 static uint_t	lmid = 0;
560 
561 /*
562  * The addition of new link-map lists is assumed to be in small quantities.
563  * Here, we assign a unique link-map id for diagnostic use.  Simply update the
564  * running link-map count until we max out.
565  */
566 int
567 newlmid(Lm_list *lml)
568 {
569 	char	buffer[MSG_LMID_ALT_SIZE + 12];
570 
571 	if (lmid == UINT_MAX) {
572 		lml->lm_lmid = UINT_MAX;
573 		(void) strncpy(buffer, MSG_ORIG(MSG_LMID_MAXED),
574 		    MSG_LMID_ALT_SIZE + 12);
575 	} else {
576 		lml->lm_lmid = lmid++;
577 		(void) snprintf(buffer, MSG_LMID_ALT_SIZE + 12,
578 		    MSG_ORIG(MSG_LMID_FMT), MSG_ORIG(MSG_LMID_ALT),
579 		    lml->lm_lmid);
580 	}
581 	if ((lml->lm_lmidstr = strdup(buffer)) == 0)
582 		return (0);
583 
584 	return (1);
585 }
586 
587 /*
588  * Core dlopen activity.
589  */
590 static Grp_hdl *
591 dlmopen_core(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
592     uint_t flags, uint_t orig)
593 {
594 	Rt_map	*nlmp;
595 	Grp_hdl	*ghp;
596 	Pnode	*pnp;
597 	Aliste	olmco, nlmco;
598 	Lm_cntl	*lmc;
599 
600 	DBG_CALL(Dbg_file_dlopen(clmp,
601 	    (path ? path : MSG_ORIG(MSG_STR_ZERO)), mode));
602 
603 	/*
604 	 * If the path specified is null then we're operating on global
605 	 * objects.  Associate a dummy handle with the link-map list.
606 	 */
607 	if (path == 0) {
608 		Grp_hdl *ghp;
609 		uint_t	hflags = GPH_ZERO, cdflags = GPD_PARENT;
610 		int	promote = 0;
611 
612 		/*
613 		 * Establish any flags for the handle (Grp_hdl).
614 		 *
615 		 *  .	This is a dummy handle (0) that provides for a dynamic
616 		 *	search of all global objects within the process.
617 		 *
618 		 *  .   Use of the RTLD_FIRST flag indicates that only the first
619 		 *	dependency on the handle (the new object) can be used
620 		 *	to satisfy dlsym() requests.
621 		 */
622 		if (mode & RTLD_FIRST)
623 			hflags |= GPH_FIRST;
624 
625 		/*
626 		 * Establish the flags for this callers dependency descriptor
627 		 * (Grp_desc).
628 		 *
629 		 *  .	The explicit creation of a handle creates a descriptor
630 		 *	for the new object and the parent (caller),
631 		 *
632 		 *  .	Use of the RTLD_PARENT flag indicates that the parent
633 		 *	can be relocated against.
634 		 */
635 		if (mode & RTLD_PARENT)
636 			cdflags |= GPD_RELOC;
637 
638 		if ((ghp = hdl_create(lml, 0, clmp, hflags,
639 		    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS), cdflags)) == 0)
640 			return (0);
641 
642 		/*
643 		 * Traverse the main link-map control list, updating the mode
644 		 * of any objects as necessary.  Call the relocation engine if
645 		 * this mode promotes the existing state of any relocations.
646 		 * crle()'s first pass loads all objects necessary for building
647 		 * a configuration file, however none of them are relocated.
648 		 * crle()'s second pass relocates objects in preparation for
649 		 * dldump()'ing using dlopen(0, RTLD_NOW).
650 		 */
651 		if ((mode & (RTLD_NOW | RTLD_CONFGEN)) == RTLD_CONFGEN)
652 			return (ghp);
653 
654 		for (nlmp = lml->lm_head; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
655 			if (((MODE(nlmp) & RTLD_GLOBAL) == 0) ||
656 			    (FLAGS(nlmp) & FLG_RT_DELETE))
657 				continue;
658 
659 			if (update_mode(nlmp, MODE(nlmp), mode))
660 				promote = 1;
661 		}
662 		if (promote)
663 			(void) relocate_lmc(lml, ALO_DATA, clmp, lml->lm_head);
664 
665 		return (ghp);
666 	}
667 
668 	/*
669 	 * Fix the pathname.  If this object expands to multiple paths (ie.
670 	 * $ISALIST or $HWCAP have been used), then make sure the user has also
671 	 * furnished the RTLD_FIRST flag.  As yet, we don't support opening
672 	 * more than one object at a time, so enforcing the RTLD_FIRST flag
673 	 * provides flexibility should we be able to support dlopening more
674 	 * than one object in the future.
675 	 */
676 	if ((pnp = LM_FIX_NAME(clmp)(path, clmp, orig)) == 0)
677 		return (0);
678 
679 	if (((pnp->p_orig & (PN_TKN_ISALIST | PN_TKN_HWCAP)) || pnp->p_next) &&
680 	    ((mode & RTLD_FIRST) == 0)) {
681 		remove_pnode(pnp);
682 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_5));
683 		return (0);
684 	}
685 
686 	/*
687 	 * Create a new link-map control list for this request, and load the
688 	 * associated object.
689 	 */
690 	if ((lmc = alist_append(&(lml->lm_lists), 0, sizeof (Lm_cntl),
691 	    AL_CNT_LMLISTS)) == 0) {
692 		remove_pnode(pnp);
693 		return (0);
694 	}
695 	olmco = nlmco = (Aliste)((char *)lmc - (char *)lml->lm_lists);
696 
697 	nlmp = load_one(lml, nlmco, pnp, clmp, mode,
698 	    (flags | FLG_RT_HANDLE), &ghp);
699 
700 	/*
701 	 * Remove any expanded pathname infrastructure, and if the dependency
702 	 * couldn't be loaded, cleanup.
703 	 */
704 	remove_pnode(pnp);
705 	if (nlmp == 0) {
706 		remove_cntl(lml, olmco);
707 		return (0);
708 	}
709 
710 	/*
711 	 * If loading an auditor was requested, and the auditor already existed,
712 	 * then the link-map returned will be to the original auditor.  The new
713 	 * link-map list that was initially created, and the associated link-map
714 	 * control list are no longer needed.  As the auditor is already loaded,
715 	 * we're probably done, but fall through in case additional relocations
716 	 * would be triggered by the mode of the caller.
717 	 */
718 	if ((flags & FLG_RT_AUDIT) && (LIST(nlmp) != lml)) {
719 		remove_cntl(lml, olmco);
720 		lml = LIST(nlmp);
721 		olmco = 0;
722 		nlmco = ALO_DATA;
723 	}
724 
725 	/*
726 	 * Finish processing the objects associated with this request.
727 	 */
728 	if ((analyze_lmc(lml, nlmco, nlmp) == 0) ||
729 	    (relocate_lmc(lml, nlmco, clmp, nlmp) == 0)) {
730 		ghp = 0;
731 		nlmp = 0;
732 	}
733 
734 	/*
735 	 * If this lazyload has failed, and we've created a new link-map
736 	 * control list to which this request has added objects, then remove
737 	 * all the objects that have been associated to this request.
738 	 */
739 	if ((nlmp == 0) && olmco && lmc->lc_head)
740 		remove_lmc(lml, clmp, lmc, olmco, path);
741 
742 	/*
743 	 * Finally, remove any link-map control list that was created.
744 	 */
745 	if (olmco)
746 		remove_cntl(lml, olmco);
747 
748 	return (ghp);
749 }
750 
751 /*
752  * Internal dlopen() activity.  Called from user level or directly for internal
753  * opens that require a handle.
754  */
755 Grp_hdl *
756 dlmopen_intn(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
757     uint_t flags, uint_t orig, int *loaded)
758 {
759 	Rt_map	*dlmp = 0;
760 	Grp_hdl	*ghp;
761 	int	objcnt;
762 
763 	/*
764 	 * Check for magic link-map list values:
765 	 *
766 	 *  LM_ID_BASE:		Operate on the PRIMARY (executables) link map
767 	 *  LM_ID_LDSO:		Operation on ld.so.1's link map
768 	 *  LM_ID_NEWLM: 	Create a new link-map.
769 	 */
770 	if (lml == (Lm_list *)LM_ID_NEWLM) {
771 		if ((lml = calloc(sizeof (Lm_list), 1)) == 0)
772 			return (0);
773 
774 		/*
775 		 * Establish the new link-map flags from the callers and those
776 		 * explicitly provided.
777 		 */
778 		lml->lm_tflags = LIST(clmp)->lm_tflags;
779 		if (flags & FLG_RT_AUDIT) {
780 			/*
781 			 * Unset any auditing flags - an auditor shouldn't be
782 			 * audited.  Insure all audit dependencies are loaded.
783 			 */
784 			lml->lm_tflags &= ~LML_TFLG_AUD_MASK;
785 			lml->lm_tflags |=
786 			    (LML_TFLG_NOLAZYLD | LML_TFLG_LOADFLTR);
787 			lml->lm_flags |= LML_FLG_NOAUDIT;
788 		}
789 
790 		if (list_append(&dynlm_list, lml) == 0) {
791 			free(lml);
792 			return (0);
793 		}
794 		if (newlmid(lml) == 0) {
795 			list_delete(&dynlm_list, lml);
796 			free(lml);
797 			return (0);
798 		}
799 	} else if ((uintptr_t)lml < LM_ID_NUM) {
800 		if ((uintptr_t)lml == LM_ID_BASE)
801 			lml = &lml_main;
802 		else if ((uintptr_t)lml == LM_ID_LDSO)
803 			lml = &lml_rtld;
804 	}
805 
806 	objcnt = lml->lm_obj;
807 
808 	/*
809 	 * Open the required object on the associated link-map list.
810 	 */
811 	if ((ghp = dlmopen_core(lml, path, mode, clmp, flags,
812 	    (orig | PN_SER_DLOPEN))) != 0) {
813 		/*
814 		 * Establish the new link-map from which .init processing will
815 		 * begin.  Ignore .init firing when constructing a configuration
816 		 * file (crle(1)).
817 		 */
818 		if ((mode & RTLD_CONFGEN) == 0)
819 			dlmp = ghp->gh_ownlmp;
820 	}
821 
822 	/*
823 	 * If loading an auditor was requested, and the auditor already existed,
824 	 * then the link-map returned will be to the original auditor.  Remove
825 	 * the link-map control list that was created for this request.
826 	 */
827 	if (dlmp && (flags & FLG_RT_AUDIT) && (LIST(dlmp) != lml)) {
828 		remove_lml(lml);
829 		lml = LIST(dlmp);
830 	}
831 
832 	/*
833 	 * Return the number of objects loaded if required.  This is used to
834 	 * trigger used() processing on return from a dlopen().
835 	 */
836 	if (loaded)
837 		*loaded = lml->lm_obj - objcnt;
838 
839 	/*
840 	 * If this load failed, remove any alternative link-map list.
841 	 */
842 	if ((ghp == 0) &&
843 	    ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)) {
844 		remove_lml(lml);
845 		lml = 0;
846 	}
847 
848 	/*
849 	 * Finish this load request.  If objects were loaded, .init processing
850 	 * is computed.  Finally, the debuggers are informed of the link-map
851 	 * lists being stable.
852 	 */
853 	load_completion(dlmp);
854 
855 	return (ghp);
856 }
857 
858 /*
859  * Argument checking for dlopen.  Only called via external entry.
860  */
861 static Grp_hdl *
862 dlmopen_check(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
863     int *loaded)
864 {
865 	/*
866 	 * Verify that a valid pathname has been supplied.
867 	 */
868 	if (path && (*path == '\0')) {
869 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
870 		return (0);
871 	}
872 
873 	/*
874 	 * Historically we've always verified the mode is either RTLD_NOW or
875 	 * RTLD_LAZY.  RTLD_NOLOAD is valid by itself.  Use of LM_ID_NEWLM
876 	 * requires a specific pathname, and use of RTLD_PARENT is meaningless.
877 	 */
878 	if ((mode & (RTLD_NOW | RTLD_LAZY | RTLD_NOLOAD)) == 0) {
879 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_1));
880 		return (0);
881 	}
882 	if ((mode & (RTLD_NOW | RTLD_LAZY)) == (RTLD_NOW | RTLD_LAZY)) {
883 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_2));
884 		return (0);
885 	}
886 	if ((lml == (Lm_list *)LM_ID_NEWLM) && (path == 0)) {
887 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_3));
888 		return (0);
889 	}
890 	if ((lml == (Lm_list *)LM_ID_NEWLM) && (mode & RTLD_PARENT)) {
891 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_4));
892 		return (0);
893 	}
894 	if (((mode & (RTLD_GROUP | RTLD_WORLD)) == 0) &&
895 	    ((mode & RTLD_NOLOAD) == 0))
896 		mode |= (RTLD_GROUP | RTLD_WORLD);
897 	if ((mode & RTLD_NOW) && (rtld_flags2 & RT_FL2_BINDLAZY)) {
898 		mode &= ~RTLD_NOW;
899 		mode |= RTLD_LAZY;
900 	}
901 
902 	return (dlmopen_intn(lml, path, mode, clmp, 0, 0, loaded));
903 }
904 
905 #pragma weak dlopen = _dlopen
906 
907 /*
908  * External entry for dlopen(3dl).  On success, returns a pointer (handle) to
909  * the structure containing information about the newly added object, ie. can
910  * be used by dlsym(). On failure, returns a null pointer.
911  */
912 void *
913 _dlopen(const char *path, int mode)
914 {
915 	int	entry, loaded = 0;
916 	Rt_map	*clmp;
917 	Grp_hdl	*ghp;
918 	Lm_list	*lml;
919 
920 	entry = enter();
921 
922 	clmp = _caller(caller(), CL_EXECDEF);
923 	lml = LIST(clmp);
924 
925 	ghp = dlmopen_check(lml, path, mode, clmp, &loaded);
926 
927 	if (entry && ghp && loaded)
928 		unused(lml);
929 
930 	if (entry)
931 		leave(lml);
932 	return ((void *)ghp);
933 }
934 
935 /*
936  * External entry for dlmopen(3dl).
937  */
938 #pragma weak dlmopen = _dlmopen
939 
940 void *
941 _dlmopen(Lmid_t lmid, const char *path, int mode)
942 {
943 	int	entry, loaded = 0;
944 	Rt_map	*clmp;
945 	Grp_hdl	*ghp;
946 
947 	entry = enter();
948 
949 	clmp = _caller(caller(), CL_EXECDEF);
950 
951 	ghp = dlmopen_check((Lm_list *)lmid, path, mode, clmp, &loaded);
952 
953 	if (entry && ghp && ghp->gh_ownlmp && loaded)
954 		unused(LIST(ghp->gh_ownlmp));
955 
956 	if (entry)
957 		leave(LIST(clmp));
958 	return ((void *)ghp);
959 }
960 
961 /*
962  * Handle processing for dlsym.
963  */
964 Sym *
965 dlsym_handle(Grp_hdl *ghp, Slookup *slp, Rt_map **_lmp, uint_t *binfo)
966 {
967 	Rt_map		*nlmp, * lmp = ghp->gh_ownlmp;
968 	Rt_map		*clmp = slp->sl_cmap;
969 	const char	*name = slp->sl_name;
970 	Sym		*sym = 0;
971 	Slookup		sl = *slp;
972 
973 	sl.sl_flags = (LKUP_FIRST | LKUP_SPEC);
974 
975 	/*
976 	 * Continue processing a dlsym request.  Lookup the required symbol in
977 	 * each link-map specified by the handle.
978 	 *
979 	 * To leverage off of lazy loading, dlsym() requests can result in two
980 	 * passes.  The first descends the link-maps of any objects already in
981 	 * the address space.  If the symbol isn't located, and lazy
982 	 * dependencies still exist, then a second pass is made to load these
983 	 * dependencies if applicable.  This model means that in the case where
984 	 * a symbols exists in more than one object, the one located may not be
985 	 * constant - this is the standard issue with lazy loading. In addition,
986 	 * attempting to locate a symbol that doesn't exist will result in the
987 	 * loading of all lazy dependencies on the given handle, which can
988 	 * defeat some of the advantages of lazy loading (look out JVM).
989 	 */
990 	if (ghp->gh_flags & GPH_ZERO) {
991 		Lm_list	*lml;
992 
993 		/*
994 		 * If this symbol lookup is triggered from a dlopen(0) handle,
995 		 * traverse the present link-map list looking for promiscuous
996 		 * entries.
997 		 */
998 		for (nlmp = lmp; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
999 
1000 			/*
1001 			 * If this handle indicates we're only to look in the
1002 			 * first object check whether we're done.
1003 			 */
1004 			if ((nlmp != lmp) && (ghp->gh_flags & GPH_FIRST))
1005 				return ((Sym *)0);
1006 
1007 			if (!(MODE(nlmp) & RTLD_GLOBAL))
1008 				continue;
1009 			if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1010 			    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1011 				continue;
1012 
1013 			sl.sl_imap = nlmp;
1014 			if (sym = LM_LOOKUP_SYM(clmp)(&sl, _lmp, binfo))
1015 				return (sym);
1016 		}
1017 
1018 		/*
1019 		 * If we're unable to locate the symbol and this link-map still
1020 		 * has pending lazy dependencies, start loading them in an
1021 		 * attempt to exhaust the search.  Note that as we're already
1022 		 * traversing a dynamic linked list of link-maps there's no
1023 		 * need for elf_lazy_find_sym() to descend the link-maps itself.
1024 		 */
1025 		lml = LIST(lmp);
1026 		if ((lml->lm_lazy) &&
1027 		    ((lml->lm_flags & LML_FLG_NOPENDGLBLAZY) == 0)) {
1028 			int	lazy = 0;
1029 
1030 			DBG_CALL(Dbg_syms_lazy_rescan(lml, name));
1031 
1032 			sl.sl_flags |= LKUP_NODESCENT;
1033 
1034 			for (nlmp = lmp; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
1035 
1036 				if (!(MODE(nlmp) & RTLD_GLOBAL) || !LAZY(nlmp))
1037 					continue;
1038 				if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1039 				    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1040 					continue;
1041 
1042 				lazy = 1;
1043 				sl.sl_imap = nlmp;
1044 				if (sym = elf_lazy_find_sym(&sl, _lmp, binfo))
1045 					return (sym);
1046 			}
1047 
1048 			/*
1049 			 * If no global, lazy loadable dependencies are found,
1050 			 * then none exist for this link-map list.  Pending lazy
1051 			 * loadable objects may still exist for non-local
1052 			 * objects that are associated with this link-map list,
1053 			 * which is why we entered this fallback.  Tag this
1054 			 * link-map list to prevent further searching for lazy
1055 			 * dependencies.
1056 			 */
1057 			if (lazy == 0)
1058 				lml->lm_flags |= LML_FLG_NOPENDGLBLAZY;
1059 		}
1060 	} else {
1061 		/*
1062 		 * Traverse the dlopen() handle for the presently loaded
1063 		 * link-maps.
1064 		 */
1065 		Grp_desc	*gdp;
1066 		Aliste		off;
1067 
1068 		for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
1069 			if ((gdp->gd_flags & GPD_DLSYM) == 0)
1070 				continue;
1071 
1072 			sl.sl_imap = gdp->gd_depend;
1073 			if (sym = LM_LOOKUP_SYM(clmp)(&sl, _lmp, binfo))
1074 				return (sym);
1075 
1076 			if (ghp->gh_flags & GPH_FIRST)
1077 				return ((Sym *)0);
1078 		}
1079 
1080 		/*
1081 		 * If we're unable to locate the symbol and this link-map still
1082 		 * has pending lazy dependencies, start loading them in an
1083 		 * attempt to exhaust the search.
1084 		 */
1085 		if ((LIST(lmp)->lm_lazy) &&
1086 		    ((ghp->gh_flags & GPH_NOPENDLAZY) == 0)) {
1087 			int	lazy = 0;
1088 
1089 			DBG_CALL(Dbg_syms_lazy_rescan(LIST(lmp), name));
1090 
1091 			for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
1092 				nlmp = gdp->gd_depend;
1093 
1094 				if (((gdp->gd_flags & GPD_DLSYM) == 0) ||
1095 				    (LAZY(nlmp) == 0))
1096 					continue;
1097 
1098 				lazy = 1;
1099 				sl.sl_imap = nlmp;
1100 				if (sym = elf_lazy_find_sym(&sl, _lmp, binfo))
1101 					return (sym);
1102 			}
1103 
1104 			/*
1105 			 * If no lazy loadable dependencies are found, then
1106 			 * none exist for this handle.  Pending lazy loadable
1107 			 * objects may still exist for the associated link-map
1108 			 * list, which is why we entered this fallback.  Tag
1109 			 * this handle to prevent further searching for lazy
1110 			 * dependencies.
1111 			 */
1112 			if (lazy == 0)
1113 				ghp->gh_flags |= GPH_NOPENDLAZY;
1114 		}
1115 	}
1116 	return ((Sym *)0);
1117 }
1118 
1119 /*
1120  * Core dlsym activity.  Selects symbol lookup method from handle.
1121  */
1122 void *
1123 dlsym_core(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1124 {
1125 	Sym		*sym = NULL;
1126 	Syminfo		*sip;
1127 	Slookup		sl;
1128 	uint_t		binfo;
1129 
1130 	sl.sl_name = name;
1131 	sl.sl_cmap = clmp;
1132 	sl.sl_rsymndx = 0;
1133 	sl.sl_rsym = 0;
1134 
1135 	/*
1136 	 * Standard relocations are evaluated using the symbol index of the
1137 	 * associated relocation symbol.  This index provides for loading
1138 	 * any lazy dependency and establishing a direct binding if necessary.
1139 	 * If a dlsym() operation originates from an object that contains a
1140 	 * symbol table entry for the same name, then establish the symbol
1141 	 * index so that any dependency requirements can be triggered.
1142 	 */
1143 	sl.sl_imap = clmp;
1144 	sl.sl_flags = LKUP_SYMNDX;
1145 	sl.sl_hash = elf_hash(name);
1146 
1147 	if ((FCT(clmp) == &elf_fct) &&
1148 	    ((sym = SYMINTP(clmp)(&sl, 0, 0)) != NULL)) {
1149 		sl.sl_rsymndx = (((ulong_t)sym -
1150 		    (ulong_t)SYMTAB(clmp)) / SYMENT(clmp));
1151 		sl.sl_rsym = sym;
1152 	}
1153 
1154 	if (sym && (ELF_ST_VISIBILITY(sym->st_other) == STV_SINGLETON)) {
1155 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1156 
1157 		/*
1158 		 * If a symbol reference is known, and that reference indicates
1159 		 * that the symbol is a singleton, then the search for the
1160 		 * symbol must follow the default search path.
1161 		 */
1162 		DBG_CALL(Dbg_syms_dlsym(clmp, name, 0, DBG_DLSYM_SINGLETON));
1163 
1164 		sl.sl_imap = hlmp;
1165 		sl.sl_flags = LKUP_SPEC;
1166 		if (handle == RTLD_PROBE)
1167 			sl.sl_flags |= LKUP_NOFALBACK;
1168 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1169 
1170 	} else if (handle == RTLD_NEXT) {
1171 		Rt_map	*nlmp;
1172 
1173 		/*
1174 		 * If this handle is RTLD_NEXT determine whether a lazy load
1175 		 * from the caller might provide the next object.  This mimics
1176 		 * the lazy loading initialization normally carried out by
1177 		 * lookup_sym(), however here, we must do this up-front, as
1178 		 * lookup_sym() will be used to inspect the next object.
1179 		 */
1180 		if ((sl.sl_rsymndx) && ((sip = SYMINFO(clmp)) != 0)) {
1181 			/* LINTED */
1182 			sip = (Syminfo *)((char *)sip +
1183 			    (sl.sl_rsymndx * SYMINENT(clmp)));
1184 
1185 			if ((sip->si_flags & SYMINFO_FLG_DIRECT) &&
1186 			    (sip->si_boundto < SYMINFO_BT_LOWRESERVE))
1187 				(void) elf_lazy_load(clmp,
1188 				    sip->si_boundto, name);
1189 
1190 			/*
1191 			 * Clear the symbol index, so as not to confuse
1192 			 * lookup_sym() of the next object.
1193 			 */
1194 			sl.sl_rsymndx = 0;
1195 			sl.sl_rsym = 0;
1196 		}
1197 
1198 		/*
1199 		 * If the handle is RTLD_NEXT start searching in the next link
1200 		 * map from the callers.  Determine permissions from the
1201 		 * present link map.  Indicate to lookup_sym() that we're on an
1202 		 * RTLD_NEXT request so that it will use the callers link map to
1203 		 * start any possible lazy dependency loading.
1204 		 */
1205 		sl.sl_imap = nlmp = (Rt_map *)NEXT(clmp);
1206 
1207 		DBG_CALL(Dbg_syms_dlsym(clmp, name, (nlmp ? NAME(nlmp) :
1208 		    MSG_INTL(MSG_STR_NULL)), DBG_DLSYM_NEXT));
1209 
1210 		if (nlmp == 0)
1211 			return (0);
1212 
1213 		sl.sl_flags = LKUP_NEXT;
1214 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1215 
1216 	} else if (handle == RTLD_SELF) {
1217 		/*
1218 		 * If the handle is RTLD_SELF start searching from the caller.
1219 		 */
1220 		DBG_CALL(Dbg_syms_dlsym(clmp, name, NAME(clmp),
1221 		    DBG_DLSYM_SELF));
1222 
1223 		sl.sl_imap = clmp;
1224 		sl.sl_flags = (LKUP_SPEC | LKUP_SELF);
1225 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1226 
1227 	} else if (handle == RTLD_DEFAULT) {
1228 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1229 
1230 		/*
1231 		 * If the handle is RTLD_DEFAULT mimic the standard symbol
1232 		 * lookup as would be triggered by a relocation.
1233 		 */
1234 		DBG_CALL(Dbg_syms_dlsym(clmp, name, 0, DBG_DLSYM_DEFAULT));
1235 
1236 		sl.sl_imap = hlmp;
1237 		sl.sl_flags = LKUP_SPEC;
1238 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1239 
1240 	} else if (handle == RTLD_PROBE) {
1241 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1242 
1243 		/*
1244 		 * If the handle is RTLD_PROBE, mimic the standard symbol
1245 		 * lookup as would be triggered by a relocation, however do
1246 		 * not fall back to a lazy loading rescan if the symbol can't be
1247 		 * found within the currently loaded objects.  Note, a lazy
1248 		 * loaded dependency required by the caller might still get
1249 		 * loaded to satisfy this request, but no exhaustive lazy load
1250 		 * rescan is carried out.
1251 		 */
1252 		DBG_CALL(Dbg_syms_dlsym(clmp, name, 0, DBG_DLSYM_PROBE));
1253 
1254 		sl.sl_imap = hlmp;
1255 		sl.sl_flags = (LKUP_SPEC | LKUP_NOFALBACK);
1256 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1257 
1258 	} else {
1259 		Grp_hdl *ghp = (Grp_hdl *)handle;
1260 
1261 		/*
1262 		 * Look in the shared object specified by the handle and in all
1263 		 * of its dependencies.
1264 		 */
1265 		DBG_CALL(Dbg_syms_dlsym(clmp, name, NAME(ghp->gh_ownlmp),
1266 		    DBG_DLSYM_DEF));
1267 
1268 		sym = LM_DLSYM(clmp)(ghp, &sl, dlmp, &binfo);
1269 	}
1270 
1271 	if (sym) {
1272 		Lm_list	*lml = LIST(clmp);
1273 		Addr	addr = sym->st_value;
1274 
1275 		if (!(FLAGS(*dlmp) & FLG_RT_FIXED))
1276 			addr += ADDR(*dlmp);
1277 
1278 		DBG_CALL(Dbg_bind_global(clmp, 0, 0, (Xword)-1, PLT_T_NONE,
1279 		    *dlmp, addr, sym->st_value, name, binfo));
1280 
1281 		if ((lml->lm_tflags | FLAGS1(clmp)) & LML_TFLG_AUD_SYMBIND) {
1282 			uint_t	sb_flags = LA_SYMB_DLSYM;
1283 			/* LINTED */
1284 			uint_t	symndx = (uint_t)(((Xword)sym -
1285 			    (Xword)SYMTAB(*dlmp)) / SYMENT(*dlmp));
1286 			addr = audit_symbind(clmp, *dlmp, sym, symndx, addr,
1287 			    &sb_flags);
1288 		}
1289 		return ((void *)addr);
1290 	} else
1291 		return (0);
1292 }
1293 
1294 /*
1295  * Internal dlsym activity.  Called from user level or directly for internal
1296  * symbol lookup.
1297  */
1298 void *
1299 dlsym_intn(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1300 {
1301 	Rt_map		*llmp = 0;
1302 	void		*error;
1303 	Aliste		off;
1304 	Grp_desc	*gdp;
1305 
1306 	/*
1307 	 * While looking for symbols it's quite possible that additional objects
1308 	 * get loaded from lazy loading.  These objects will have been added to
1309 	 * the same link-map list as those objects on the handle.  Remember this
1310 	 * list for later investigation.
1311 	 */
1312 	if ((handle == RTLD_NEXT) || (handle == RTLD_DEFAULT) ||
1313 	    (handle == RTLD_SELF) || (handle == RTLD_PROBE))
1314 		llmp = LIST(clmp)->lm_tail;
1315 	else {
1316 		Grp_hdl	*ghp = (Grp_hdl *)handle;
1317 
1318 		if (ghp->gh_ownlmp)
1319 			llmp = LIST(ghp->gh_ownlmp)->lm_tail;
1320 		else {
1321 			for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
1322 				if ((llmp = LIST(gdp->gd_depend)->lm_tail) != 0)
1323 					break;
1324 			}
1325 		}
1326 	}
1327 
1328 	if ((error = dlsym_core(handle, name, clmp, dlmp)) == 0) {
1329 		/*
1330 		 * Cache the error message, as Java tends to fall through this
1331 		 * code many times.
1332 		 */
1333 		if (nosym_str == 0)
1334 			nosym_str = MSG_INTL(MSG_GEN_NOSYM);
1335 		eprintf(LIST(clmp), ERR_FATAL, nosym_str, name);
1336 	}
1337 
1338 	load_completion(llmp);
1339 	return (error);
1340 }
1341 
1342 /*
1343  * Argument checking for dlsym.  Only called via external entry.
1344  */
1345 static void *
1346 dlsym_check(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1347 {
1348 	/*
1349 	 * Verify the arguments.
1350 	 */
1351 	if (name == 0) {
1352 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_ILLSYM));
1353 		return (0);
1354 	}
1355 	if ((handle != RTLD_NEXT) && (handle != RTLD_DEFAULT) &&
1356 	    (handle != RTLD_SELF) && (handle != RTLD_PROBE) &&
1357 	    (hdl_validate((Grp_hdl *)handle) == 0)) {
1358 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL));
1359 		return (0);
1360 	}
1361 	return (dlsym_intn(handle, name, clmp, dlmp));
1362 }
1363 
1364 
1365 #pragma weak dlsym = _dlsym
1366 
1367 /*
1368  * External entry for dlsym().  On success, returns the address of the specified
1369  * symbol.  On error returns a null.
1370  */
1371 void *
1372 _dlsym(void *handle, const char *name)
1373 {
1374 	int	entry;
1375 	Rt_map	*clmp, *dlmp = 0;
1376 	void	*addr;
1377 
1378 	entry = enter();
1379 
1380 	clmp = _caller(caller(), CL_EXECDEF);
1381 
1382 	addr = dlsym_check(handle, name, clmp, &dlmp);
1383 
1384 	if (dlmp)
1385 		is_dep_ready(dlmp, clmp, DBG_WAIT_SYMBOL);
1386 
1387 	if (entry && dlmp)
1388 		is_dep_init(dlmp, clmp);
1389 
1390 	if (entry)
1391 		leave(LIST(clmp));
1392 	return (addr);
1393 }
1394 
1395 /*
1396  * Core dladdr activity.
1397  */
1398 static void
1399 dladdr_core(Rt_map *clmp, void *addr, Dl_info *dlip, void **info, int flags)
1400 {
1401 	/*
1402 	 * Set up generic information and any defaults.
1403 	 */
1404 	dlip->dli_fname = PATHNAME(clmp);
1405 
1406 	dlip->dli_fbase = (void *)ADDR(clmp);
1407 	dlip->dli_sname = 0;
1408 	dlip->dli_saddr = 0;
1409 
1410 	/*
1411 	 * Determine the nearest symbol to this address.
1412 	 */
1413 	LM_DLADDR(clmp)((ulong_t)addr, clmp, dlip, info, flags);
1414 }
1415 
1416 #pragma weak dladdr = _dladdr
1417 
1418 /*
1419  * External entry for dladdr(3dl) and dladdr1(3dl).  Returns an information
1420  * structure that reflects the symbol closest to the address specified.
1421  */
1422 int
1423 _dladdr(void *addr, Dl_info *dlip)
1424 {
1425 	int	entry, error;
1426 	Rt_map	*clmp;
1427 
1428 	entry = enter();
1429 
1430 	/*
1431 	 * Use our calling technique to determine what object is associated
1432 	 * with the supplied address.  If a caller can't be determined,
1433 	 * indicate the failure.
1434 	 */
1435 	if ((clmp = _caller((caddr_t)addr, CL_NONE)) == 0) {
1436 		eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1437 		    EC_NATPTR(addr));
1438 		error = 0;
1439 	} else {
1440 		dladdr_core(clmp, addr, dlip, 0, 0);
1441 		error = 1;
1442 	}
1443 
1444 	if (entry)
1445 		leave(0);
1446 	return (error);
1447 }
1448 
1449 #pragma weak dladdr1 = _dladdr1
1450 
1451 int
1452 _dladdr1(void *addr, Dl_info *dlip, void **info, int flags)
1453 {
1454 	int	entry, error = 0;
1455 	Rt_map	*clmp;
1456 
1457 	/*
1458 	 * Validate any flags.
1459 	 */
1460 	if (flags) {
1461 		int	request;
1462 
1463 		if (((request = (flags & RTLD_DL_MASK)) != RTLD_DL_SYMENT) &&
1464 		    (request != RTLD_DL_LINKMAP)) {
1465 			eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_ILLFLAGS),
1466 			    flags);
1467 			return (0);
1468 		}
1469 		if (info == 0) {
1470 			eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_ILLINFO), flags);
1471 			return (0);
1472 		}
1473 	}
1474 
1475 	entry = enter();
1476 
1477 	/*
1478 	 * Use our calling technique to determine what object is associated
1479 	 * with the supplied address.  If a caller can't be determined,
1480 	 * indicate the failure.
1481 	 */
1482 	if ((clmp = _caller((caddr_t)addr, CL_NONE)) == 0) {
1483 		eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1484 		    EC_NATPTR(addr));
1485 		error = 0;
1486 	} else {
1487 		dladdr_core(clmp, addr, dlip, info, flags);
1488 		error = 1;
1489 	}
1490 
1491 	if (entry)
1492 		leave(0);
1493 	return (error);
1494 }
1495 
1496 /*
1497  * Core dldump activity.
1498  */
1499 static int
1500 dldump_core(Lm_list *lml, const char *ipath, const char *opath, int flags)
1501 {
1502 	Addr	addr = 0;
1503 	Rt_map	*lmp;
1504 
1505 	/*
1506 	 * Verify any arguments first.
1507 	 */
1508 	if ((!opath || (*opath == '\0')) || (ipath && (*ipath == '\0'))) {
1509 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
1510 		return (1);
1511 	}
1512 
1513 	/*
1514 	 * If an input file is specified make sure its one of our dependencies
1515 	 * on the main link-map list.  Note, this has really all evolved for
1516 	 * crle(), which uses libcrle.so on an alternative link-map to trigger
1517 	 * dumping objects from the main link-map list.   If we ever want to
1518 	 * dump objects from alternative link-maps, this model is going to
1519 	 * have to be revisited.
1520 	 */
1521 	if (ipath) {
1522 		if ((lmp = is_so_loaded(&lml_main, ipath)) == 0) {
1523 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NOFILE),
1524 			    ipath);
1525 			return (1);
1526 		}
1527 		if (FLAGS(lmp) & FLG_RT_ALTER) {
1528 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_ALTER), ipath);
1529 			return (1);
1530 		}
1531 		if (FLAGS(lmp) & FLG_RT_NODUMP) {
1532 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NODUMP),
1533 			    ipath);
1534 			return (1);
1535 		}
1536 	} else
1537 		lmp = lml_main.lm_head;
1538 
1539 
1540 	DBG_CALL(Dbg_file_dldump(lmp, opath, flags));
1541 
1542 	/*
1543 	 * If the object being dump'ed isn't fixed identify its mapping.
1544 	 */
1545 	if (!(FLAGS(lmp) & FLG_RT_FIXED))
1546 		addr = ADDR(lmp);
1547 
1548 	/*
1549 	 * As rt_dldump() will effectively lazy load the necessary support
1550 	 * libraries, make sure ld.so.1 is initialized for plt relocations.
1551 	 */
1552 	if (elf_rtld_load() == 0)
1553 		return (0);
1554 
1555 	/*
1556 	 * Dump the required image.
1557 	 */
1558 	return (rt_dldump(lmp, opath, flags, addr));
1559 }
1560 
1561 #pragma weak dldump = _dldump
1562 
1563 /*
1564  * External entry for dldump(3c).  Returns 0 on success, non-zero otherwise.
1565  */
1566 int
1567 _dldump(const char *ipath, const char *opath, int flags)
1568 {
1569 	int	error, entry;
1570 	Rt_map	*clmp;
1571 
1572 	entry = enter();
1573 
1574 	clmp = _caller(caller(), CL_EXECDEF);
1575 
1576 	error = dldump_core(LIST(clmp), ipath, opath, flags);
1577 
1578 	if (entry)
1579 		leave(LIST(clmp));
1580 	return (error);
1581 }
1582 
1583 /*
1584  * get_linkmap_id() translates Lm_list * pointers to the Link_map id as used by
1585  * the rtld_db and dlmopen() interfaces.  It checks to see if the Link_map is
1586  * one of the primary ones and if so returns it's special token:
1587  *		LM_ID_BASE
1588  *		LM_ID_LDSO
1589  *
1590  * If it's not one of the primary link_map id's it will instead returns a
1591  * pointer to the Lm_list structure which uniquely identifies the Link_map.
1592  */
1593 Lmid_t
1594 get_linkmap_id(Lm_list *lml)
1595 {
1596 	if (lml->lm_flags & LML_FLG_BASELM)
1597 		return (LM_ID_BASE);
1598 	if (lml->lm_flags & LML_FLG_RTLDLM)
1599 		return (LM_ID_LDSO);
1600 
1601 	return ((Lmid_t)lml);
1602 }
1603 
1604 /*
1605  * Extract information for a dlopen() handle.
1606  */
1607 static int
1608 dlinfo_core(void *handle, int request, void *p, Rt_map *clmp)
1609 {
1610 	Lm_list	*lml = LIST(clmp);
1611 	Rt_map	*lmp;
1612 
1613 	if ((request > RTLD_DI_MAX) || (p == 0)) {
1614 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLVAL));
1615 		return (-1);
1616 	}
1617 
1618 	/*
1619 	 * Return configuration cache name and address.
1620 	 */
1621 	if (request == RTLD_DI_CONFIGADDR) {
1622 		Dl_info	*dlip = (Dl_info *)p;
1623 
1624 		if ((config->c_name == 0) || (config->c_bgn == 0) ||
1625 		    (config->c_end == 0)) {
1626 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOCONFIG));
1627 			return (-1);
1628 		}
1629 		dlip->dli_fname = config->c_name;
1630 		dlip->dli_fbase = (void *)config->c_bgn;
1631 		return (0);
1632 	}
1633 
1634 	/*
1635 	 * Return profiled object name (used by ldprof audit library).
1636 	 */
1637 	if (request == RTLD_DI_PROFILENAME) {
1638 		if (profile_name == 0) {
1639 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOPROFNAME));
1640 			return (-1);
1641 		}
1642 
1643 		*(const char **)p = profile_name;
1644 		return (0);
1645 	}
1646 	if (request == RTLD_DI_PROFILEOUT) {
1647 		/*
1648 		 * If a profile destination directory hasn't been specified
1649 		 * provide a default.
1650 		 */
1651 		if (profile_out == 0)
1652 			profile_out = MSG_ORIG(MSG_PTH_VARTMP);
1653 
1654 		*(const char **)p = profile_out;
1655 		return (0);
1656 	}
1657 
1658 	/*
1659 	 * Obtain or establish a termination signal.
1660 	 */
1661 	if (request == RTLD_DI_GETSIGNAL) {
1662 		*(int *)p = killsig;
1663 		return (0);
1664 	}
1665 
1666 	if (request == RTLD_DI_SETSIGNAL) {
1667 		sigset_t	set;
1668 		int		sig = *(int *)p;
1669 
1670 		/*
1671 		 * Determine whether the signal is in range.
1672 		 */
1673 		(void) sigfillset(&set);
1674 		if (sigismember(&set, sig) != 1) {
1675 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVSIG), sig);
1676 			return (-1);
1677 		}
1678 
1679 		killsig = sig;
1680 		return (0);
1681 	}
1682 
1683 	/*
1684 	 * For any other request a link-map is required.  Verify the handle.
1685 	 */
1686 	if (handle == RTLD_SELF)
1687 		lmp = clmp;
1688 	else {
1689 		Grp_hdl	*ghp = (Grp_hdl *)handle;
1690 
1691 		if (!hdl_validate(ghp)) {
1692 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL));
1693 			return (-1);
1694 		}
1695 		lmp = ghp->gh_ownlmp;
1696 	}
1697 
1698 	/*
1699 	 * Obtain the process arguments, environment and auxv.  Note, as the
1700 	 * environment can be modified by the user (putenv(3c)), reinitialize
1701 	 * the environment pointer on each request.
1702 	 */
1703 	if (request == RTLD_DI_ARGSINFO) {
1704 		Dl_argsinfo	*aip = (Dl_argsinfo *)p;
1705 		Lm_list		*lml = LIST(lmp);
1706 
1707 		*aip = argsinfo;
1708 		if (lml->lm_flags & LML_FLG_ENVIRON)
1709 			aip->dla_envp = *(lml->lm_environ);
1710 
1711 		return (0);
1712 	}
1713 
1714 	/*
1715 	 * Return Lmid_t of the Link-Map list that the specified object is
1716 	 * loaded on.
1717 	 */
1718 	if (request == RTLD_DI_LMID) {
1719 		*(Lmid_t *)p = get_linkmap_id(LIST(lmp));
1720 		return (0);
1721 	}
1722 
1723 	/*
1724 	 * Return a pointer to the Link-Map structure associated with the
1725 	 * specified object.
1726 	 */
1727 	if (request == RTLD_DI_LINKMAP) {
1728 		*(Link_map **)p = (Link_map *)lmp;
1729 		return (0);
1730 	}
1731 
1732 	/*
1733 	 * Return search path information, or the size of the buffer required
1734 	 * to store the information.
1735 	 */
1736 	if ((request == RTLD_DI_SERINFO) || (request == RTLD_DI_SERINFOSIZE)) {
1737 		Pnode		*dir, *dirlist = (Pnode *)0;
1738 		Dl_serinfo	*info;
1739 		Dl_serpath	*path;
1740 		char		*strs;
1741 		size_t		size = sizeof (Dl_serinfo);
1742 		uint_t		cnt = 0;
1743 
1744 		info = (Dl_serinfo *)p;
1745 		path = &info->dls_serpath[0];
1746 		strs = (char *)&info->dls_serpath[info->dls_cnt];
1747 
1748 		/*
1749 		 * Traverse search path entries for this object.
1750 		 */
1751 		while ((dir = get_next_dir(&dirlist, lmp, 0)) != 0) {
1752 			size_t	_size;
1753 
1754 			if (dir->p_name == 0)
1755 				continue;
1756 
1757 			/*
1758 			 * If configuration information exists, it's possible
1759 			 * this path has been identified as non-existent, if so
1760 			 * ignore it.
1761 			 */
1762 			if (dir->p_info) {
1763 				Rtc_obj	*dobj = (Rtc_obj *)dir->p_info;
1764 				if (dobj->co_flags & RTC_OBJ_NOEXIST)
1765 					continue;
1766 			}
1767 
1768 			/*
1769 			 * Keep track of search path count and total info size.
1770 			 */
1771 			if (cnt++)
1772 				size += sizeof (Dl_serpath);
1773 			_size = strlen(dir->p_name) + 1;
1774 			size += _size;
1775 
1776 			if (request == RTLD_DI_SERINFOSIZE)
1777 				continue;
1778 
1779 			/*
1780 			 * If we're filling in search path information, confirm
1781 			 * there's sufficient space.
1782 			 */
1783 			if (size > info->dls_size) {
1784 				eprintf(lml, ERR_FATAL,
1785 				    MSG_INTL(MSG_ARG_SERSIZE),
1786 				    EC_OFF(info->dls_size));
1787 				return (-1);
1788 			}
1789 			if (cnt > info->dls_cnt) {
1790 				eprintf(lml, ERR_FATAL,
1791 				    MSG_INTL(MSG_ARG_SERCNT), info->dls_cnt);
1792 				return (-1);
1793 			}
1794 
1795 			/*
1796 			 * Append the path to the information buffer.
1797 			 */
1798 			(void) strcpy(strs, dir->p_name);
1799 			path->dls_name = strs;
1800 			path->dls_flags = dir->p_orig;
1801 
1802 			strs = strs + _size;
1803 			path++;
1804 		}
1805 
1806 		/*
1807 		 * If we're here to size the search buffer fill it in.
1808 		 */
1809 		if (request == RTLD_DI_SERINFOSIZE) {
1810 			info->dls_size = size;
1811 			info->dls_cnt = cnt;
1812 		}
1813 	}
1814 
1815 	/*
1816 	 * Return the origin of the object associated with this link-map.
1817 	 * Basically return the dirname(1) of the objects fullpath.
1818 	 */
1819 	if (request == RTLD_DI_ORIGIN) {
1820 		char	*str = (char *)p;
1821 
1822 		if (DIRSZ(lmp) == 0)
1823 			(void) fullpath(lmp, 0);
1824 
1825 		(void) strncpy(str, ORIGNAME(lmp), DIRSZ(lmp));
1826 		str += DIRSZ(lmp);
1827 		*str = '\0';
1828 
1829 		return (0);
1830 	}
1831 
1832 	return (0);
1833 }
1834 
1835 #pragma weak dlinfo = _dlinfo
1836 
1837 /*
1838  * External entry for dlinfo(3dl).
1839  */
1840 int
1841 _dlinfo(void *handle, int request, void *p)
1842 {
1843 	int	error, entry;
1844 	Rt_map	*clmp;
1845 
1846 	entry = enter();
1847 
1848 	clmp = _caller(caller(), CL_EXECDEF);
1849 
1850 	error = dlinfo_core(handle, request, p, clmp);
1851 
1852 	if (entry)
1853 		leave(LIST(clmp));
1854 	return (error);
1855 }
1856