xref: /titanic_44/usr/src/cmd/sgs/rtld/common/dlfcns.c (revision f5488aa822e08905cde61d596e965030a1dfffcd)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  *	Copyright (c) 1988 AT&T
29  *	  All Rights Reserved
30  */
31 
32 #pragma ident	"%Z%%M%	%I%	%E% SMI"
33 
34 /*
35  * Programmatic interface to the run_time linker.
36  */
37 
38 #include	<sys/debug.h>
39 #include	<stdio.h>
40 #include	<string.h>
41 #include	<dlfcn.h>
42 #include	<synch.h>
43 #include	<limits.h>
44 #include	<debug.h>
45 #include	"_rtld.h"
46 #include	"_audit.h"
47 #include	"_elf.h"
48 #include	"msg.h"
49 
50 /*
51  * Determine who called us - given a pc determine in which object it resides.
52  *
53  * For dlopen() the link map of the caller must be passed to load_so() so that
54  * the appropriate search rules (4.x or 5.0) are used to locate any
55  * dependencies.  Also, if we've been called from a 4.x module it may be
56  * necessary to fix the specified pathname so that it conforms with the 5.0 elf
57  * rules.
58  *
59  * For dlsym() the link map of the caller is used to determine RTLD_NEXT
60  * requests, together with requests based off of a dlopen(0).
61  * For dladdr() this routines provides a generic means of scanning all loaded
62  * segments.
63  */
64 Rt_map *
65 _caller(caddr_t cpc, int flags)
66 {
67 	Lm_list *	lml;
68 	Listnode *	lnp;
69 
70 	for (LIST_TRAVERSE(&dynlm_list, lnp, lml)) {
71 		Aliste	idx;
72 		Lm_cntl	*lmc;
73 
74 		for (ALIST_TRAVERSE(lml->lm_lists, idx, lmc)) {
75 			Rt_map	*lmp;
76 
77 			for (lmp = lmc->lc_head; lmp;
78 			    lmp = (Rt_map *)NEXT(lmp)) {
79 				Mmap	*mmap;
80 
81 				/*
82 				 * Traverse this objects mappings testing
83 				 * whether the pc falls within its range.
84 				 */
85 				for (mmap = MMAPS(lmp); mmap->m_vaddr; mmap++) {
86 					if ((cpc >= mmap->m_vaddr) && (cpc <
87 					    (mmap->m_vaddr + mmap->m_msize)))
88 						return (lmp);
89 				}
90 			}
91 		}
92 	}
93 
94 	/*
95 	 * No mapping can be determined.  If asked for a default, assume this
96 	 * is from the executable.
97 	 */
98 	if (flags & CL_EXECDEF)
99 		return ((Rt_map *)lml_main.lm_head);
100 
101 	return (0);
102 }
103 
104 #pragma weak _dlerror = dlerror
105 
106 /*
107  * External entry for dlerror(3dl).  Returns a pointer to the string describing
108  * the last occurring error.  The last occurring error is cleared.
109  */
110 char *
111 dlerror()
112 {
113 	char	*error;
114 	Rt_map	*clmp;
115 	int	entry;
116 
117 	entry = enter(0);
118 
119 	clmp = _caller(caller(), CL_EXECDEF);
120 
121 	error = lasterr;
122 	lasterr = (char *)0;
123 
124 	if (entry)
125 		leave(LIST(clmp), 0);
126 	return (error);
127 }
128 
129 /*
130  * Add a dependency as a group descriptor to a group handle.  Returns 0 on
131  * failure, ALE_EXISTS if the dependency already exists, or ALE_CREATE if it
132  * is newly created.
133  */
134 int
135 hdl_add(Grp_hdl *ghp, Rt_map *lmp, uint_t flags)
136 {
137 	Grp_desc	*gdp;
138 	Aliste		idx;
139 	int		found = ALE_CREATE;
140 	uint_t		oflags;
141 
142 	/*
143 	 * Make sure this dependency hasn't already been recorded.
144 	 */
145 	for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
146 		if (gdp->gd_depend == lmp) {
147 			found = ALE_EXISTS;
148 			break;
149 		}
150 	}
151 
152 	if (found == ALE_CREATE) {
153 		Grp_desc	gd;
154 
155 		/*
156 		 * Create a new handle descriptor.
157 		 */
158 		gd.gd_depend = lmp;
159 		gd.gd_flags = 0;
160 
161 		/*
162 		 * Indicate this object is a part of this handles group.
163 		 */
164 		if (aplist_append(&GROUPS(lmp), ghp,
165 		    AL_CNT_GROUPS) == 0)
166 			return (0);
167 
168 		/*
169 		 * Append the new dependency to this handle.
170 		 */
171 		if ((gdp = alist_append(&ghp->gh_depends, &gd,
172 		    sizeof (Grp_desc), AL_CNT_DEPENDS)) == 0)
173 			return (0);
174 	}
175 
176 	oflags = gdp->gd_flags;
177 	gdp->gd_flags |= flags;
178 
179 	if (DBG_ENABLED) {
180 		if (found == ALE_CREATE)
181 			DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_ADD,
182 			    gdp->gd_flags));
183 		else if (gdp->gd_flags != oflags)
184 			DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_UPDATE,
185 			    gdp->gd_flags));
186 	}
187 	return (found);
188 }
189 
190 /*
191  * Allocate a handle and record its existence on the handle list for future
192  * verification.
193  */
194 Grp_hdl *
195 hdl_alloc()
196 {
197 	Grp_hdl	*ghp;
198 	uint_t	ndx;
199 
200 	if ((ghp = calloc(sizeof (Grp_hdl), 1)) == 0)
201 		return (0);
202 
203 	/* LINTED */
204 	ndx = (uintptr_t)ghp % HDLIST_SZ;
205 
206 	if (list_append(&hdl_list[ndx], ghp) == 0) {
207 		free(ghp);
208 		return (0);
209 	}
210 	return (ghp);
211 }
212 
213 /*
214  * Create a handle.
215  */
216 Grp_hdl *
217 hdl_create(Lm_list *lml, Rt_map *nlmp, Rt_map *clmp, uint_t hflags,
218     uint_t ndflags, uint_t cdflags)
219 {
220 	Grp_hdl	*ghp = 0, *_ghp;
221 	APlist	**alpp;
222 	Aliste	idx;
223 
224 	/*
225 	 * For dlopen(0) the handle is maintained as part of the link-map list,
226 	 * otherwise it is associated with the referenced link-map.
227 	 */
228 	if (hflags & GPH_ZERO)
229 		alpp = &(lml->lm_handle);
230 	else
231 		alpp = &(HANDLES(nlmp));
232 
233 	/*
234 	 * Objects can contain multiple handles depending on the handle flags
235 	 * supplied.  Most RTLD flags pertain to the object itself and the
236 	 * bindings that it can achieve.  Multiple handles for these flags
237 	 * don't make sense.  But if the flag determines how the handle might
238 	 * be used, then multiple handles may exist.  Presently this only makes
239 	 * sense for RTLD_FIRST.  Determine if an appropriate handle already
240 	 * exists.
241 	 */
242 	for (APLIST_TRAVERSE(*alpp, idx, _ghp)) {
243 		if ((_ghp->gh_flags & GPH_FIRST) == (hflags & GPH_FIRST)) {
244 			ghp = _ghp;
245 			break;
246 		}
247 	}
248 
249 	if (ghp == 0) {
250 		DBG_CALL(Dbg_file_hdl_title(DBG_HDL_CREATE));
251 
252 		/*
253 		 * If this is the first dlopen() request for this handle
254 		 * allocate and initialize a new handle.
255 		 */
256 		if ((ghp = hdl_alloc()) == 0)
257 			return (0);
258 
259 		if (aplist_append(alpp, ghp, AL_CNT_GROUPS) == 0)
260 			return (0);
261 
262 		ghp->gh_refcnt = 1;
263 		ghp->gh_flags = hflags;
264 
265 		/*
266 		 * A dlopen(0) handle is identified by the GPH_ZERO flag, the
267 		 * head of the link-map list is defined as the owner.  There is
268 		 * no need to maintain a list of dependencies, for when this
269 		 * handle is used (for dlsym()) a dynamic search through the
270 		 * entire link-map list provides for searching all objects with
271 		 * GLOBAL visibility.
272 		 */
273 		if (hflags & GPH_ZERO) {
274 			ghp->gh_ownlmp = lml->lm_head;
275 			ghp->gh_ownlml = lml;
276 		} else {
277 			ghp->gh_ownlmp = nlmp;
278 			ghp->gh_ownlml = LIST(nlmp);
279 
280 			if (hdl_add(ghp, nlmp, ndflags) == 0)
281 				return (0);
282 
283 			/*
284 			 * Indicate that a local group now exists.  This state
285 			 * allows singleton searches to be optimized.
286 			 */
287 			if ((hflags & GPH_LDSO) == 0)
288 				LIST(nlmp)->lm_flags |= LML_FLG_GROUPSEXIST;
289 		}
290 	} else {
291 		/*
292 		 * If a handle already exists, bump its reference count.
293 		 *
294 		 * If the previous reference count was 0, then this is a handle
295 		 * that an earlier call to dlclose() was unable to remove.  Such
296 		 * handles are put on the orphan list.  As this handle is back
297 		 * in use, it must be removed from the orphan list.
298 		 *
299 		 * Note, handles associated with a link-map list itself (i.e.
300 		 * dlopen(0)) can have a reference count of 0.  However, these
301 		 * handles are never deleted, and therefore are never moved to
302 		 * the orphan list.
303 		 */
304 		if ((ghp->gh_refcnt++ == 0) &&
305 		    ((ghp->gh_flags & GPH_ZERO) == 0)) {
306 			uint_t	ndx;
307 
308 			/* LINTED */
309 			ndx = (uintptr_t)ghp % HDLIST_SZ;
310 
311 			list_delete(&hdl_list[HDLIST_ORP], ghp);
312 			(void) list_append(&hdl_list[ndx], ghp);
313 
314 			if (DBG_ENABLED) {
315 				Aliste		idx;
316 				Grp_desc	*gdp;
317 
318 				DBG_CALL(Dbg_file_hdl_title(DBG_HDL_REINST));
319 				for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp))
320 					DBG_CALL(Dbg_file_hdl_action(ghp,
321 					    gdp->gd_depend, DBG_DEP_REINST, 0));
322 			}
323 		}
324 	}
325 
326 	/*
327 	 * Keep track of the parent (caller).  As this object could be opened
328 	 * by different parents, this processing is carried out every time a
329 	 * handle is requested.
330 	 */
331 	if (clmp && (hdl_add(ghp, clmp, cdflags) == 0))
332 		return (0);
333 
334 	return (ghp);
335 }
336 
337 /*
338  * Initialize a handle that has been created for an object that is already
339  * loaded.  The handle is initialized with the present dependencies of that
340  * object.  Once this initialization has occurred, any new objects that might
341  * be loaded as dependencies (lazy-loading) are added to the handle as each new
342  * object is loaded.
343  */
344 int
345 hdl_initialize(Grp_hdl *ghp, Rt_map *nlmp, int mode, int promote)
346 {
347 	Aliste		idx;
348 	Grp_desc	*gdp;
349 
350 	/*
351 	 * If the handle has already been initialized, and the initial object's
352 	 * mode hasn't been promoted, there's no need to recompute the modes of
353 	 * any dependencies.  If the object we've added has just been opened,
354 	 * the objects dependencies will not yet have been processed.  These
355 	 * dependencies will be added on later calls to load_one().  Otherwise,
356 	 * this object already exists, so add all of its dependencies to the
357 	 * handle were operating on.
358 	 */
359 	if (((ghp->gh_flags & GPH_INITIAL) && (promote == 0)) ||
360 	    ((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0)) {
361 		ghp->gh_flags |= GPH_INITIAL;
362 		return (1);
363 	}
364 
365 	DBG_CALL(Dbg_file_hdl_title(DBG_HDL_ADD));
366 	for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
367 		Rt_map *	lmp = gdp->gd_depend;
368 		Aliste		idx1;
369 		Bnd_desc	*bdp;
370 
371 		/*
372 		 * If this dependency doesn't indicate that its dependencies
373 		 * should be added to a handle, ignore it.  This case identifies
374 		 * a parent of a dlopen(RTLD_PARENT) request.
375 		 */
376 		if ((gdp->gd_flags & GPD_ADDEPS) == 0)
377 			continue;
378 
379 		for (APLIST_TRAVERSE(DEPENDS(lmp), idx1, bdp)) {
380 			Rt_map		*dlmp = bdp->b_depend;
381 
382 			if ((bdp->b_flags & BND_NEEDED) == 0)
383 				continue;
384 
385 			if (hdl_add(ghp, dlmp,
386 			    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS)) == 0)
387 				return (0);
388 
389 			(void) update_mode(dlmp, MODE(dlmp), mode);
390 		}
391 	}
392 	ghp->gh_flags |= GPH_INITIAL;
393 	return (1);
394 }
395 
396 /*
397  * Sanity check a program-provided handle.
398  */
399 static int
400 hdl_validate(Grp_hdl *ghp)
401 {
402 	Listnode	*lnp;
403 	Grp_hdl		*lghp;
404 	uint_t		ndx;
405 
406 	/* LINTED */
407 	ndx = (uintptr_t)ghp % HDLIST_SZ;
408 
409 	for (LIST_TRAVERSE(&hdl_list[ndx], lnp, lghp)) {
410 		if ((lghp == ghp) && (ghp->gh_refcnt != 0))
411 			return (1);
412 	}
413 	return (0);
414 }
415 
416 /*
417  * Core dlclose activity.
418  */
419 int
420 dlclose_core(Grp_hdl *ghp, Rt_map *clmp, Lm_list *lml)
421 {
422 	int	error;
423 
424 	/*
425 	 * If we're already at atexit() there's no point processing further,
426 	 * all objects have already been tsorted for fini processing.
427 	 */
428 	if ((rtld_flags & RT_FL_ATEXIT) != 0)
429 		return (0);
430 
431 	/*
432 	 * Diagnose what we're up to.
433 	 */
434 	if (ghp->gh_flags & GPH_ZERO) {
435 		DBG_CALL(Dbg_file_dlclose(LIST(clmp), MSG_ORIG(MSG_STR_ZERO),
436 		    DBG_DLCLOSE_IGNORE));
437 	} else {
438 		DBG_CALL(Dbg_file_dlclose(LIST(clmp), NAME(ghp->gh_ownlmp),
439 		    DBG_DLCLOSE_NULL));
440 	}
441 
442 
443 	/*
444 	 * Decrement reference count of this object.
445 	 */
446 	if (--(ghp->gh_refcnt))
447 		return (0);
448 
449 	/*
450 	 * If this handle is special (dlopen(0)), then leave it around - it
451 	 * has little overhead.
452 	 */
453 	if (ghp->gh_flags & GPH_ZERO)
454 		return (0);
455 
456 	/*
457 	 * This handle is no longer being referenced, remove it.  If this handle
458 	 * is part of an alternative link-map list, determine if the whole list
459 	 * can be removed also.
460 	 */
461 	error = remove_hdl(ghp, clmp, 0);
462 
463 	if ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)
464 		remove_lml(lml);
465 
466 	return (error);
467 }
468 
469 /*
470  * Internal dlclose activity.  Called from user level or directly for internal
471  * error cleanup.
472  */
473 int
474 dlclose_intn(Grp_hdl *ghp, Rt_map *clmp)
475 {
476 	Rt_map	*nlmp = 0;
477 	Lm_list	*olml = 0;
478 	int	error;
479 
480 	/*
481 	 * Although we're deleting object(s) it's quite possible that additional
482 	 * objects get loaded from running the .fini section(s) of the objects
483 	 * being deleted.  These objects will have been added to the same
484 	 * link-map list as those objects being deleted.  Remember this list
485 	 * for later investigation.
486 	 */
487 	olml = ghp->gh_ownlml;
488 
489 	error = dlclose_core(ghp, clmp, olml);
490 
491 	/*
492 	 * Determine whether the original link-map list still exists.  In the
493 	 * case of a dlclose of an alternative (dlmopen) link-map the whole
494 	 * list may have been removed.
495 	 */
496 	if (olml) {
497 		Listnode	*lnp;
498 		Lm_list		*lml;
499 
500 		for (LIST_TRAVERSE(&dynlm_list, lnp, lml)) {
501 			if (olml == lml) {
502 				nlmp = olml->lm_head;
503 				break;
504 			}
505 		}
506 	}
507 	load_completion(nlmp);
508 	return (error);
509 }
510 
511 /*
512  * Argument checking for dlclose.  Only called via external entry.
513  */
514 static int
515 dlclose_check(void *handle, Rt_map *clmp)
516 {
517 	Grp_hdl	*ghp = (Grp_hdl *)handle;
518 
519 	if (hdl_validate(ghp) == 0) {
520 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL));
521 		return (1);
522 	}
523 	return (dlclose_intn(ghp, clmp));
524 }
525 
526 #pragma weak _dlclose = dlclose
527 
528 /*
529  * External entry for dlclose(3dl).  Returns 0 for success, non-zero otherwise.
530  */
531 int
532 dlclose(void *handle)
533 {
534 	int		error, entry;
535 	Rt_map		*clmp;
536 
537 	entry = enter(0);
538 
539 	clmp = _caller(caller(), CL_EXECDEF);
540 
541 	error = dlclose_check(handle, clmp);
542 
543 	if (entry)
544 		leave(LIST(clmp), 0);
545 	return (error);
546 }
547 
548 static uint_t	lmid = 0;
549 
550 /*
551  * The addition of new link-map lists is assumed to be in small quantities.
552  * Here, we assign a unique link-map id for diagnostic use.  Simply update the
553  * running link-map count until we max out.
554  */
555 int
556 newlmid(Lm_list *lml)
557 {
558 	char	buffer[MSG_LMID_ALT_SIZE + 12];
559 
560 	if (lmid == UINT_MAX) {
561 		lml->lm_lmid = UINT_MAX;
562 		(void) strncpy(buffer, MSG_ORIG(MSG_LMID_MAXED),
563 		    MSG_LMID_ALT_SIZE + 12);
564 	} else {
565 		lml->lm_lmid = lmid++;
566 		(void) snprintf(buffer, MSG_LMID_ALT_SIZE + 12,
567 		    MSG_ORIG(MSG_LMID_FMT), MSG_ORIG(MSG_LMID_ALT),
568 		    lml->lm_lmid);
569 	}
570 	if ((lml->lm_lmidstr = strdup(buffer)) == 0)
571 		return (0);
572 
573 	return (1);
574 }
575 
576 /*
577  * Core dlopen activity.
578  */
579 static Grp_hdl *
580 dlmopen_core(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
581     uint_t flags, uint_t orig, int *in_nfavl)
582 {
583 	Rt_map	*nlmp;
584 	Grp_hdl	*ghp;
585 	Pnode	*pnp;
586 	Aliste	olmco, nlmco;
587 	Lm_cntl	*lmc;
588 
589 	DBG_CALL(Dbg_file_dlopen(clmp,
590 	    (path ? path : MSG_ORIG(MSG_STR_ZERO)), in_nfavl, mode));
591 
592 	/*
593 	 * If the path specified is null then we're operating on global
594 	 * objects.  Associate a dummy handle with the link-map list.
595 	 */
596 	if (path == 0) {
597 		Grp_hdl *ghp;
598 		uint_t	hflags = GPH_ZERO, cdflags = GPD_PARENT;
599 		int	promote = 0;
600 
601 		/*
602 		 * Establish any flags for the handle (Grp_hdl).
603 		 *
604 		 *  .	This is a dummy handle (0) that provides for a dynamic
605 		 *	search of all global objects within the process.
606 		 *
607 		 *  .   Use of the RTLD_FIRST flag indicates that only the first
608 		 *	dependency on the handle (the new object) can be used
609 		 *	to satisfy dlsym() requests.
610 		 */
611 		if (mode & RTLD_FIRST)
612 			hflags |= GPH_FIRST;
613 
614 		/*
615 		 * Establish the flags for this callers dependency descriptor
616 		 * (Grp_desc).
617 		 *
618 		 *  .	The explicit creation of a handle creates a descriptor
619 		 *	for the new object and the parent (caller),
620 		 *
621 		 *  .	Use of the RTLD_PARENT flag indicates that the parent
622 		 *	can be relocated against.
623 		 */
624 		if (mode & RTLD_PARENT)
625 			cdflags |= GPD_RELOC;
626 
627 		if ((ghp = hdl_create(lml, 0, clmp, hflags,
628 		    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS), cdflags)) == 0)
629 			return (0);
630 
631 		/*
632 		 * Traverse the main link-map control list, updating the mode
633 		 * of any objects as necessary.  Call the relocation engine if
634 		 * this mode promotes the existing state of any relocations.
635 		 * crle()'s first pass loads all objects necessary for building
636 		 * a configuration file, however none of them are relocated.
637 		 * crle()'s second pass relocates objects in preparation for
638 		 * dldump()'ing using dlopen(0, RTLD_NOW).
639 		 */
640 		if ((mode & (RTLD_NOW | RTLD_CONFGEN)) == RTLD_CONFGEN)
641 			return (ghp);
642 
643 		for (nlmp = lml->lm_head; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
644 			if (((MODE(nlmp) & RTLD_GLOBAL) == 0) ||
645 			    (FLAGS(nlmp) & FLG_RT_DELETE))
646 				continue;
647 
648 			if (update_mode(nlmp, MODE(nlmp), mode))
649 				promote = 1;
650 		}
651 		if (promote)
652 			(void) relocate_lmc(lml, ALIST_OFF_DATA, clmp,
653 			    lml->lm_head, in_nfavl);
654 
655 		return (ghp);
656 	}
657 
658 	/*
659 	 * Fix the pathname.  If this object expands to multiple paths (ie.
660 	 * $ISALIST or $HWCAP have been used), then make sure the user has also
661 	 * furnished the RTLD_FIRST flag.  As yet, we don't support opening
662 	 * more than one object at a time, so enforcing the RTLD_FIRST flag
663 	 * provides flexibility should we be able to support dlopening more
664 	 * than one object in the future.
665 	 */
666 	if ((pnp = LM_FIX_NAME(clmp)(path, clmp, orig)) == 0)
667 		return (0);
668 
669 	if (((pnp->p_orig & (PN_TKN_ISALIST | PN_TKN_HWCAP)) || pnp->p_next) &&
670 	    ((mode & RTLD_FIRST) == 0)) {
671 		remove_pnode(pnp);
672 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_5));
673 		return (0);
674 	}
675 
676 	/*
677 	 * Create a new link-map control list for this request, and load the
678 	 * associated object.
679 	 */
680 	if ((lmc = alist_append(&lml->lm_lists, 0, sizeof (Lm_cntl),
681 	    AL_CNT_LMLISTS)) == 0) {
682 		remove_pnode(pnp);
683 		return (0);
684 	}
685 	olmco = nlmco = (Aliste)((char *)lmc - (char *)lml->lm_lists);
686 
687 	nlmp = load_one(lml, nlmco, pnp, clmp, mode,
688 	    (flags | FLG_RT_HANDLE), &ghp, in_nfavl);
689 
690 	/*
691 	 * Remove any expanded pathname infrastructure, and if the dependency
692 	 * couldn't be loaded, cleanup.
693 	 */
694 	remove_pnode(pnp);
695 	if (nlmp == 0) {
696 		remove_cntl(lml, olmco);
697 		return (0);
698 	}
699 
700 	/*
701 	 * If loading an auditor was requested, and the auditor already existed,
702 	 * then the link-map returned will be to the original auditor.  The new
703 	 * link-map list that was initially created, and the associated link-map
704 	 * control list are no longer needed.  As the auditor is already loaded,
705 	 * we're probably done, but fall through in case additional relocations
706 	 * would be triggered by the mode of the caller.
707 	 */
708 	if ((flags & FLG_RT_AUDIT) && (LIST(nlmp) != lml)) {
709 		remove_cntl(lml, olmco);
710 		lml = LIST(nlmp);
711 		olmco = 0;
712 		nlmco = ALIST_OFF_DATA;
713 	}
714 
715 	/*
716 	 * Finish processing the objects associated with this request.
717 	 */
718 	if ((analyze_lmc(lml, nlmco, nlmp, in_nfavl) == 0) ||
719 	    (relocate_lmc(lml, nlmco, clmp, nlmp, in_nfavl) == 0)) {
720 		ghp = 0;
721 		nlmp = 0;
722 	}
723 
724 	/*
725 	 * If this lazyload has failed, and we've created a new link-map
726 	 * control list to which this request has added objects, then remove
727 	 * all the objects that have been associated to this request.
728 	 */
729 	if ((nlmp == 0) && olmco && lmc->lc_head)
730 		remove_lmc(lml, clmp, lmc, olmco, path);
731 
732 	/*
733 	 * Finally, remove any link-map control list that was created.
734 	 */
735 	if (olmco)
736 		remove_cntl(lml, olmco);
737 
738 	return (ghp);
739 }
740 
741 /*
742  * dlopen() and dlsym() operations are the means by which a process can
743  * test for the existence of required dependencies.  If the necessary
744  * dependencies don't exist, then associated functionality can't be used.
745  * However, the lack of dependencies can be fixed, and the dlopen() and
746  * dlsym() requests can be repeated.  As we use a "not-found" AVL tree to
747  * cache any failed full path loads, secondary dlopen() and dlsym() requests
748  * will fail, even if the dependencies have been installed.
749  *
750  * dlopen() and dlsym() retry any failures by removing the "not-found" AVL
751  * tree.  Should any dependencies be found, their names are added to the
752  * FullPath AVL tree.  This routine removes any new "not-found" AVL tree,
753  * so that the dlopen() or dlsym() can replace the original "not-found" tree.
754  */
755 inline static void
756 nfavl_remove(avl_tree_t *avlt)
757 {
758 	PathNode	*pnp;
759 	void		*cookie = NULL;
760 
761 	if (avlt) {
762 		while ((pnp = avl_destroy_nodes(avlt, &cookie)) != NULL) {
763 			free((void *)pnp->pn_name);
764 			free(pnp);
765 		}
766 		avl_destroy(avlt);
767 		free(avlt);
768 	}
769 }
770 
771 /*
772  * Internal dlopen() activity.  Called from user level or directly for internal
773  * opens that require a handle.
774  */
775 Grp_hdl *
776 dlmopen_intn(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
777     uint_t flags, uint_t orig)
778 {
779 	Rt_map	*dlmp = 0;
780 	Grp_hdl	*ghp;
781 	int	in_nfavl = 0;
782 
783 	/*
784 	 * Check for magic link-map list values:
785 	 *
786 	 *  LM_ID_BASE:		Operate on the PRIMARY (executables) link map
787 	 *  LM_ID_LDSO:		Operation on ld.so.1's link map
788 	 *  LM_ID_NEWLM: 	Create a new link-map.
789 	 */
790 	if (lml == (Lm_list *)LM_ID_NEWLM) {
791 		if ((lml = calloc(sizeof (Lm_list), 1)) == 0)
792 			return (0);
793 
794 		/*
795 		 * Establish the new link-map flags from the callers and those
796 		 * explicitly provided.
797 		 */
798 		lml->lm_tflags = LIST(clmp)->lm_tflags;
799 		if (flags & FLG_RT_AUDIT) {
800 			/*
801 			 * Unset any auditing flags - an auditor shouldn't be
802 			 * audited.  Insure all audit dependencies are loaded.
803 			 */
804 			lml->lm_tflags &= ~LML_TFLG_AUD_MASK;
805 			lml->lm_tflags |=
806 			    (LML_TFLG_NOLAZYLD | LML_TFLG_LOADFLTR);
807 			lml->lm_flags |= LML_FLG_NOAUDIT;
808 		}
809 
810 		if (list_append(&dynlm_list, lml) == 0) {
811 			free(lml);
812 			return (0);
813 		}
814 		if (newlmid(lml) == 0) {
815 			list_delete(&dynlm_list, lml);
816 			free(lml);
817 			return (0);
818 		}
819 	} else if ((uintptr_t)lml < LM_ID_NUM) {
820 		if ((uintptr_t)lml == LM_ID_BASE)
821 			lml = &lml_main;
822 		else if ((uintptr_t)lml == LM_ID_LDSO)
823 			lml = &lml_rtld;
824 	}
825 
826 	/*
827 	 * Open the required object on the associated link-map list.
828 	 */
829 	ghp = dlmopen_core(lml, path, mode, clmp, flags, orig, &in_nfavl);
830 
831 	/*
832 	 * If the object could not be found it is possible that the "not-found"
833 	 * AVL tree had indicated that the file does not exist.  In case the
834 	 * file system has changes since this "not-found" recording was made,
835 	 * retry the dlopen() with a clean "not-found" AVL tree.
836 	 */
837 	if ((ghp == 0) && in_nfavl) {
838 		avl_tree_t	*oavlt = nfavl;
839 
840 		nfavl = NULL;
841 		ghp = dlmopen_core(lml, path, mode, clmp, flags, orig, NULL);
842 
843 		/*
844 		 * If the file is found, then its full path name will have been
845 		 * registered in the FullPath AVL tree.  Remove any new
846 		 * "not-found" AVL information, and restore the former AVL tree.
847 		 */
848 		nfavl_remove(nfavl);
849 		nfavl = oavlt;
850 	}
851 
852 	/*
853 	 * Establish the new link-map from which .init processing will begin.
854 	 * Ignore .init firing when constructing a configuration file (crle(1)).
855 	 */
856 	if (ghp && ((mode & RTLD_CONFGEN) == 0))
857 		dlmp = ghp->gh_ownlmp;
858 
859 	/*
860 	 * If loading an auditor was requested, and the auditor already existed,
861 	 * then the link-map returned will be to the original auditor.  Remove
862 	 * the link-map control list that was created for this request.
863 	 */
864 	if (dlmp && (flags & FLG_RT_AUDIT) && (LIST(dlmp) != lml)) {
865 		remove_lml(lml);
866 		lml = LIST(dlmp);
867 	}
868 
869 	/*
870 	 * If this load failed, remove any alternative link-map list.
871 	 */
872 	if ((ghp == 0) &&
873 	    ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)) {
874 		remove_lml(lml);
875 		lml = 0;
876 	}
877 
878 	/*
879 	 * Finish this load request.  If objects were loaded, .init processing
880 	 * is computed.  Finally, the debuggers are informed of the link-map
881 	 * lists being stable.
882 	 */
883 	load_completion(dlmp);
884 
885 	return (ghp);
886 }
887 
888 /*
889  * Argument checking for dlopen.  Only called via external entry.
890  */
891 static Grp_hdl *
892 dlmopen_check(Lm_list *lml, const char *path, int mode, Rt_map *clmp)
893 {
894 	/*
895 	 * Verify that a valid pathname has been supplied.
896 	 */
897 	if (path && (*path == '\0')) {
898 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
899 		return (0);
900 	}
901 
902 	/*
903 	 * Historically we've always verified the mode is either RTLD_NOW or
904 	 * RTLD_LAZY.  RTLD_NOLOAD is valid by itself.  Use of LM_ID_NEWLM
905 	 * requires a specific pathname, and use of RTLD_PARENT is meaningless.
906 	 */
907 	if ((mode & (RTLD_NOW | RTLD_LAZY | RTLD_NOLOAD)) == 0) {
908 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_1));
909 		return (0);
910 	}
911 	if ((mode & (RTLD_NOW | RTLD_LAZY)) == (RTLD_NOW | RTLD_LAZY)) {
912 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_2));
913 		return (0);
914 	}
915 	if ((lml == (Lm_list *)LM_ID_NEWLM) && (path == 0)) {
916 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_3));
917 		return (0);
918 	}
919 	if ((lml == (Lm_list *)LM_ID_NEWLM) && (mode & RTLD_PARENT)) {
920 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_4));
921 		return (0);
922 	}
923 	if (((mode & (RTLD_GROUP | RTLD_WORLD)) == 0) &&
924 	    ((mode & RTLD_NOLOAD) == 0))
925 		mode |= (RTLD_GROUP | RTLD_WORLD);
926 	if ((mode & RTLD_NOW) && (rtld_flags2 & RT_FL2_BINDLAZY)) {
927 		mode &= ~RTLD_NOW;
928 		mode |= RTLD_LAZY;
929 	}
930 
931 	return (dlmopen_intn(lml, path, mode, clmp, 0, 0));
932 }
933 
934 #pragma weak _dlopen = dlopen
935 
936 /*
937  * External entry for dlopen(3dl).  On success, returns a pointer (handle) to
938  * the structure containing information about the newly added object, ie. can
939  * be used by dlsym(). On failure, returns a null pointer.
940  */
941 void *
942 dlopen(const char *path, int mode)
943 {
944 	int	entry;
945 	Rt_map	*clmp;
946 	Grp_hdl	*ghp;
947 	Lm_list	*lml;
948 
949 	entry = enter(0);
950 
951 	clmp = _caller(caller(), CL_EXECDEF);
952 	lml = LIST(clmp);
953 
954 	ghp = dlmopen_check(lml, path, mode, clmp);
955 
956 	if (entry)
957 		leave(lml, 0);
958 	return ((void *)ghp);
959 }
960 
961 #pragma weak _dlmopen = dlmopen
962 
963 /*
964  * External entry for dlmopen(3dl).
965  */
966 void *
967 dlmopen(Lmid_t lmid, const char *path, int mode)
968 {
969 	int	entry;
970 	Rt_map	*clmp;
971 	Grp_hdl	*ghp;
972 
973 	entry = enter(0);
974 
975 	clmp = _caller(caller(), CL_EXECDEF);
976 
977 	ghp = dlmopen_check((Lm_list *)lmid, path, mode, clmp);
978 
979 	if (entry)
980 		leave(LIST(clmp), 0);
981 	return ((void *)ghp);
982 }
983 
984 /*
985  * Handle processing for dlsym.
986  */
987 Sym *
988 dlsym_handle(Grp_hdl *ghp, Slookup *slp, Rt_map **_lmp, uint_t *binfo,
989     int *in_nfavl)
990 {
991 	Rt_map		*nlmp, * lmp = ghp->gh_ownlmp;
992 	Rt_map		*clmp = slp->sl_cmap;
993 	const char	*name = slp->sl_name;
994 	Sym		*sym = 0;
995 	Slookup		sl = *slp;
996 
997 	sl.sl_flags = (LKUP_FIRST | LKUP_SPEC);
998 
999 	/*
1000 	 * Continue processing a dlsym request.  Lookup the required symbol in
1001 	 * each link-map specified by the handle.
1002 	 *
1003 	 * To leverage off of lazy loading, dlsym() requests can result in two
1004 	 * passes.  The first descends the link-maps of any objects already in
1005 	 * the address space.  If the symbol isn't located, and lazy
1006 	 * dependencies still exist, then a second pass is made to load these
1007 	 * dependencies if applicable.  This model means that in the case where
1008 	 * a symbols exists in more than one object, the one located may not be
1009 	 * constant - this is the standard issue with lazy loading. In addition,
1010 	 * attempting to locate a symbol that doesn't exist will result in the
1011 	 * loading of all lazy dependencies on the given handle, which can
1012 	 * defeat some of the advantages of lazy loading (look out JVM).
1013 	 */
1014 	if (ghp->gh_flags & GPH_ZERO) {
1015 		Lm_list	*lml;
1016 
1017 		/*
1018 		 * If this symbol lookup is triggered from a dlopen(0) handle,
1019 		 * traverse the present link-map list looking for promiscuous
1020 		 * entries.
1021 		 */
1022 		for (nlmp = lmp; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
1023 
1024 			/*
1025 			 * If this handle indicates we're only to look in the
1026 			 * first object check whether we're done.
1027 			 */
1028 			if ((nlmp != lmp) && (ghp->gh_flags & GPH_FIRST))
1029 				return ((Sym *)0);
1030 
1031 			if (!(MODE(nlmp) & RTLD_GLOBAL))
1032 				continue;
1033 			if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1034 			    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1035 				continue;
1036 
1037 			sl.sl_imap = nlmp;
1038 			if (sym = LM_LOOKUP_SYM(clmp)(&sl, _lmp, binfo,
1039 			    in_nfavl))
1040 				return (sym);
1041 		}
1042 
1043 		/*
1044 		 * If we're unable to locate the symbol and this link-map still
1045 		 * has pending lazy dependencies, start loading them in an
1046 		 * attempt to exhaust the search.  Note that as we're already
1047 		 * traversing a dynamic linked list of link-maps there's no
1048 		 * need for elf_lazy_find_sym() to descend the link-maps itself.
1049 		 */
1050 		lml = LIST(lmp);
1051 		if ((lml->lm_lazy) &&
1052 		    ((lml->lm_flags & LML_FLG_NOPENDGLBLAZY) == 0)) {
1053 			int	lazy = 0;
1054 
1055 			DBG_CALL(Dbg_syms_lazy_rescan(lml, name));
1056 
1057 			sl.sl_flags |= LKUP_NODESCENT;
1058 
1059 			for (nlmp = lmp; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
1060 
1061 				if (!(MODE(nlmp) & RTLD_GLOBAL) || !LAZY(nlmp))
1062 					continue;
1063 				if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1064 				    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1065 					continue;
1066 
1067 				lazy = 1;
1068 				sl.sl_imap = nlmp;
1069 				if (sym = elf_lazy_find_sym(&sl, _lmp, binfo,
1070 				    in_nfavl))
1071 					return (sym);
1072 			}
1073 
1074 			/*
1075 			 * If no global, lazy loadable dependencies are found,
1076 			 * then none exist for this link-map list.  Pending lazy
1077 			 * loadable objects may still exist for non-local
1078 			 * objects that are associated with this link-map list,
1079 			 * which is why we entered this fallback.  Tag this
1080 			 * link-map list to prevent further searching for lazy
1081 			 * dependencies.
1082 			 */
1083 			if (lazy == 0)
1084 				lml->lm_flags |= LML_FLG_NOPENDGLBLAZY;
1085 		}
1086 	} else {
1087 		/*
1088 		 * Traverse the dlopen() handle for the presently loaded
1089 		 * link-maps.
1090 		 */
1091 		Grp_desc	*gdp;
1092 		Aliste		idx;
1093 
1094 		for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1095 			if ((gdp->gd_flags & GPD_DLSYM) == 0)
1096 				continue;
1097 
1098 			sl.sl_imap = gdp->gd_depend;
1099 			if (sym = LM_LOOKUP_SYM(clmp)(&sl, _lmp, binfo,
1100 			    in_nfavl))
1101 				return (sym);
1102 
1103 			if (ghp->gh_flags & GPH_FIRST)
1104 				return ((Sym *)0);
1105 		}
1106 
1107 		/*
1108 		 * If we're unable to locate the symbol and this link-map still
1109 		 * has pending lazy dependencies, start loading them in an
1110 		 * attempt to exhaust the search.
1111 		 */
1112 		if ((LIST(lmp)->lm_lazy) &&
1113 		    ((ghp->gh_flags & GPH_NOPENDLAZY) == 0)) {
1114 			int	lazy = 0;
1115 
1116 			DBG_CALL(Dbg_syms_lazy_rescan(LIST(lmp), name));
1117 
1118 			for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1119 				nlmp = gdp->gd_depend;
1120 
1121 				if (((gdp->gd_flags & GPD_DLSYM) == 0) ||
1122 				    (LAZY(nlmp) == 0))
1123 					continue;
1124 
1125 				lazy = 1;
1126 				sl.sl_imap = nlmp;
1127 				if (sym = elf_lazy_find_sym(&sl, _lmp,
1128 				    binfo, in_nfavl))
1129 					return (sym);
1130 			}
1131 
1132 			/*
1133 			 * If no lazy loadable dependencies are found, then
1134 			 * none exist for this handle.  Pending lazy loadable
1135 			 * objects may still exist for the associated link-map
1136 			 * list, which is why we entered this fallback.  Tag
1137 			 * this handle to prevent further searching for lazy
1138 			 * dependencies.
1139 			 */
1140 			if (lazy == 0)
1141 				ghp->gh_flags |= GPH_NOPENDLAZY;
1142 		}
1143 	}
1144 	return ((Sym *)0);
1145 }
1146 
1147 /*
1148  * Core dlsym activity.  Selects symbol lookup method from handle.
1149  */
1150 void *
1151 dlsym_core(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp,
1152     int *in_nfavl)
1153 {
1154 	Sym		*sym = NULL;
1155 	Syminfo		*sip;
1156 	Slookup		sl;
1157 	uint_t		binfo;
1158 
1159 	/*
1160 	 * Initialize the symbol lookup data structure.
1161 	 *
1162 	 * Standard relocations are evaluated using the symbol index of the
1163 	 * associated relocation symbol.  This index provides for loading
1164 	 * any lazy dependency and establishing a direct binding if necessary.
1165 	 * If a dlsym() operation originates from an object that contains a
1166 	 * symbol table entry for the same name, then we need to establish the
1167 	 * symbol index so that any dependency requirements can be triggered.
1168 	 *
1169 	 * Therefore, the first symbol lookup that is carried out is for the
1170 	 * symbol name within the calling object.  If this symbol exists, the
1171 	 * symbols index is computed, added to the Slookup data, and thus used
1172 	 * to seed the real symbol lookup.
1173 	 */
1174 	SLOOKUP_INIT(sl, name, clmp, clmp, ld_entry_cnt, elf_hash(name),
1175 	    0, 0, 0, LKUP_SYMNDX);
1176 
1177 	if ((FCT(clmp) == &elf_fct) &&
1178 	    ((sym = SYMINTP(clmp)(&sl, 0, 0, NULL)) != NULL)) {
1179 		sl.sl_rsymndx = (((ulong_t)sym -
1180 		    (ulong_t)SYMTAB(clmp)) / SYMENT(clmp));
1181 		sl.sl_rsym = sym;
1182 	}
1183 
1184 	if (sym && (ELF_ST_VISIBILITY(sym->st_other) == STV_SINGLETON)) {
1185 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1186 
1187 		/*
1188 		 * If a symbol reference is known, and that reference indicates
1189 		 * that the symbol is a singleton, then the search for the
1190 		 * symbol must follow the default search path.
1191 		 */
1192 		DBG_CALL(Dbg_syms_dlsym(clmp, name, in_nfavl, 0,
1193 		    DBG_DLSYM_SINGLETON));
1194 
1195 		sl.sl_imap = hlmp;
1196 		sl.sl_flags = LKUP_SPEC;
1197 		if (handle == RTLD_PROBE)
1198 			sl.sl_flags |= LKUP_NOFALLBACK;
1199 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo, in_nfavl);
1200 
1201 	} else if (handle == RTLD_NEXT) {
1202 		Rt_map	*nlmp;
1203 
1204 		/*
1205 		 * If this handle is RTLD_NEXT determine whether a lazy load
1206 		 * from the caller might provide the next object.  This mimics
1207 		 * the lazy loading initialization normally carried out by
1208 		 * lookup_sym(), however here, we must do this up-front, as
1209 		 * lookup_sym() will be used to inspect the next object.
1210 		 */
1211 		if ((sl.sl_rsymndx) && ((sip = SYMINFO(clmp)) != 0)) {
1212 			/* LINTED */
1213 			sip = (Syminfo *)((char *)sip +
1214 			    (sl.sl_rsymndx * SYMINENT(clmp)));
1215 
1216 			if ((sip->si_flags & SYMINFO_FLG_DIRECT) &&
1217 			    (sip->si_boundto < SYMINFO_BT_LOWRESERVE))
1218 				(void) elf_lazy_load(clmp, &sl,
1219 				    sip->si_boundto, name, in_nfavl);
1220 
1221 			/*
1222 			 * Clear the symbol index, so as not to confuse
1223 			 * lookup_sym() of the next object.
1224 			 */
1225 			sl.sl_rsymndx = 0;
1226 			sl.sl_rsym = 0;
1227 		}
1228 
1229 		/*
1230 		 * If the handle is RTLD_NEXT start searching in the next link
1231 		 * map from the callers.  Determine permissions from the
1232 		 * present link map.  Indicate to lookup_sym() that we're on an
1233 		 * RTLD_NEXT request so that it will use the callers link map to
1234 		 * start any possible lazy dependency loading.
1235 		 */
1236 		sl.sl_imap = nlmp = (Rt_map *)NEXT(clmp);
1237 
1238 		DBG_CALL(Dbg_syms_dlsym(clmp, name, in_nfavl,
1239 		    (nlmp ? NAME(nlmp) : MSG_INTL(MSG_STR_NULL)),
1240 		    DBG_DLSYM_NEXT));
1241 
1242 		if (nlmp == 0)
1243 			return (0);
1244 
1245 		sl.sl_flags = LKUP_NEXT;
1246 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo, in_nfavl);
1247 
1248 	} else if (handle == RTLD_SELF) {
1249 		/*
1250 		 * If the handle is RTLD_SELF start searching from the caller.
1251 		 */
1252 		DBG_CALL(Dbg_syms_dlsym(clmp, name, in_nfavl, NAME(clmp),
1253 		    DBG_DLSYM_SELF));
1254 
1255 		sl.sl_imap = clmp;
1256 		sl.sl_flags = (LKUP_SPEC | LKUP_SELF);
1257 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo, in_nfavl);
1258 
1259 	} else if (handle == RTLD_DEFAULT) {
1260 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1261 
1262 		/*
1263 		 * If the handle is RTLD_DEFAULT mimic the standard symbol
1264 		 * lookup as would be triggered by a relocation.
1265 		 */
1266 		DBG_CALL(Dbg_syms_dlsym(clmp, name, in_nfavl, 0,
1267 		    DBG_DLSYM_DEFAULT));
1268 
1269 		sl.sl_imap = hlmp;
1270 		sl.sl_flags = LKUP_SPEC;
1271 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo, in_nfavl);
1272 
1273 	} else if (handle == RTLD_PROBE) {
1274 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1275 
1276 		/*
1277 		 * If the handle is RTLD_PROBE, mimic the standard symbol
1278 		 * lookup as would be triggered by a relocation, however do
1279 		 * not fall back to a lazy loading rescan if the symbol can't be
1280 		 * found within the currently loaded objects.  Note, a lazy
1281 		 * loaded dependency required by the caller might still get
1282 		 * loaded to satisfy this request, but no exhaustive lazy load
1283 		 * rescan is carried out.
1284 		 */
1285 		DBG_CALL(Dbg_syms_dlsym(clmp, name, in_nfavl, 0,
1286 		    DBG_DLSYM_PROBE));
1287 
1288 		sl.sl_imap = hlmp;
1289 		sl.sl_flags = (LKUP_SPEC | LKUP_NOFALLBACK);
1290 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo, in_nfavl);
1291 
1292 	} else {
1293 		Grp_hdl *ghp = (Grp_hdl *)handle;
1294 
1295 		/*
1296 		 * Look in the shared object specified by the handle and in all
1297 		 * of its dependencies.
1298 		 */
1299 		DBG_CALL(Dbg_syms_dlsym(clmp, name, in_nfavl,
1300 		    NAME(ghp->gh_ownlmp), DBG_DLSYM_DEF));
1301 
1302 		sym = LM_DLSYM(clmp)(ghp, &sl, dlmp, &binfo, in_nfavl);
1303 	}
1304 
1305 	if (sym) {
1306 		Lm_list	*lml = LIST(clmp);
1307 		Addr	addr = sym->st_value;
1308 
1309 		if (!(FLAGS(*dlmp) & FLG_RT_FIXED))
1310 			addr += ADDR(*dlmp);
1311 
1312 		/*
1313 		 * Indicate that the defining object is now used.
1314 		 */
1315 		if (*dlmp != clmp)
1316 			FLAGS1(*dlmp) |= FL1_RT_USED;
1317 
1318 		DBG_CALL(Dbg_bind_global(clmp, 0, 0, (Xword)-1, PLT_T_NONE,
1319 		    *dlmp, addr, sym->st_value, name, binfo));
1320 
1321 		if ((lml->lm_tflags | FLAGS1(clmp)) & LML_TFLG_AUD_SYMBIND) {
1322 			uint_t	sb_flags = LA_SYMB_DLSYM;
1323 			/* LINTED */
1324 			uint_t	symndx = (uint_t)(((Xword)sym -
1325 			    (Xword)SYMTAB(*dlmp)) / SYMENT(*dlmp));
1326 			addr = audit_symbind(clmp, *dlmp, sym, symndx, addr,
1327 			    &sb_flags);
1328 		}
1329 		return ((void *)addr);
1330 	} else
1331 		return (0);
1332 }
1333 
1334 /*
1335  * Internal dlsym activity.  Called from user level or directly for internal
1336  * symbol lookup.
1337  */
1338 void *
1339 dlsym_intn(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1340 {
1341 	Rt_map		*llmp = 0;
1342 	void		*error;
1343 	Aliste		idx;
1344 	Grp_desc	*gdp;
1345 	int		in_nfavl = 0;
1346 
1347 	/*
1348 	 * While looking for symbols it's quite possible that additional objects
1349 	 * get loaded from lazy loading.  These objects will have been added to
1350 	 * the same link-map list as those objects on the handle.  Remember this
1351 	 * list for later investigation.
1352 	 */
1353 	if ((handle == RTLD_NEXT) || (handle == RTLD_DEFAULT) ||
1354 	    (handle == RTLD_SELF) || (handle == RTLD_PROBE))
1355 		llmp = LIST(clmp)->lm_tail;
1356 	else {
1357 		Grp_hdl	*ghp = (Grp_hdl *)handle;
1358 
1359 		if (ghp->gh_ownlmp)
1360 			llmp = LIST(ghp->gh_ownlmp)->lm_tail;
1361 		else {
1362 			for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1363 				if ((llmp = LIST(gdp->gd_depend)->lm_tail) != 0)
1364 					break;
1365 			}
1366 		}
1367 	}
1368 
1369 	error = dlsym_core(handle, name, clmp, dlmp, &in_nfavl);
1370 
1371 	/*
1372 	 * If the symbol could not be found it is possible that the "not-found"
1373 	 * AVL tree had indicated that a required file does not exist.  In case
1374 	 * the file system has changed since this "not-found" recording was
1375 	 * made, retry the dlsym() with a clean "not-found" AVL tree.
1376 	 */
1377 	if ((error == 0) && in_nfavl) {
1378 		avl_tree_t	*oavlt = nfavl;
1379 
1380 		nfavl = NULL;
1381 		error = dlsym_core(handle, name, clmp, dlmp, NULL);
1382 
1383 		/*
1384 		 * If the symbol is found, then any file that was loaded will
1385 		 * have had its full path name registered in the FullPath AVL
1386 		 * tree.  Remove any new "not-found" AVL information, and
1387 		 * restore the former AVL tree.
1388 		 */
1389 		nfavl_remove(nfavl);
1390 		nfavl = oavlt;
1391 	}
1392 
1393 	if (error == 0) {
1394 		/*
1395 		 * Cache the error message, as Java tends to fall through this
1396 		 * code many times.
1397 		 */
1398 		if (nosym_str == 0)
1399 			nosym_str = MSG_INTL(MSG_GEN_NOSYM);
1400 		eprintf(LIST(clmp), ERR_FATAL, nosym_str, name);
1401 	}
1402 
1403 	load_completion(llmp);
1404 	return (error);
1405 }
1406 
1407 /*
1408  * Argument checking for dlsym.  Only called via external entry.
1409  */
1410 static void *
1411 dlsym_check(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1412 {
1413 	/*
1414 	 * Verify the arguments.
1415 	 */
1416 	if (name == 0) {
1417 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_ILLSYM));
1418 		return (0);
1419 	}
1420 	if ((handle != RTLD_NEXT) && (handle != RTLD_DEFAULT) &&
1421 	    (handle != RTLD_SELF) && (handle != RTLD_PROBE) &&
1422 	    (hdl_validate((Grp_hdl *)handle) == 0)) {
1423 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL));
1424 		return (0);
1425 	}
1426 	return (dlsym_intn(handle, name, clmp, dlmp));
1427 }
1428 
1429 
1430 #pragma weak _dlsym = dlsym
1431 
1432 /*
1433  * External entry for dlsym().  On success, returns the address of the specified
1434  * symbol.  On error returns a null.
1435  */
1436 void *
1437 dlsym(void *handle, const char *name)
1438 {
1439 	int	entry;
1440 	Rt_map	*clmp, *dlmp = 0;
1441 	void	*addr;
1442 
1443 	entry = enter(0);
1444 
1445 	clmp = _caller(caller(), CL_EXECDEF);
1446 
1447 	addr = dlsym_check(handle, name, clmp, &dlmp);
1448 
1449 	if (dlmp)
1450 		is_dep_ready(dlmp, clmp, DBG_WAIT_SYMBOL);
1451 
1452 	if (entry && dlmp)
1453 		is_dep_init(dlmp, clmp);
1454 
1455 	if (entry)
1456 		leave(LIST(clmp), 0);
1457 	return (addr);
1458 }
1459 
1460 /*
1461  * Core dladdr activity.
1462  */
1463 static void
1464 dladdr_core(Rt_map *clmp, void *addr, Dl_info *dlip, void **info, int flags)
1465 {
1466 	/*
1467 	 * Set up generic information and any defaults.
1468 	 */
1469 	dlip->dli_fname = PATHNAME(clmp);
1470 
1471 	dlip->dli_fbase = (void *)ADDR(clmp);
1472 	dlip->dli_sname = 0;
1473 	dlip->dli_saddr = 0;
1474 
1475 	/*
1476 	 * Determine the nearest symbol to this address.
1477 	 */
1478 	LM_DLADDR(clmp)((ulong_t)addr, clmp, dlip, info, flags);
1479 }
1480 
1481 #pragma weak _dladdr = dladdr
1482 
1483 /*
1484  * External entry for dladdr(3dl) and dladdr1(3dl).  Returns an information
1485  * structure that reflects the symbol closest to the address specified.
1486  */
1487 int
1488 dladdr(void *addr, Dl_info *dlip)
1489 {
1490 	int	entry, error;
1491 	Rt_map	*clmp;
1492 
1493 	entry = enter(0);
1494 
1495 	/*
1496 	 * Use our calling technique to determine what object is associated
1497 	 * with the supplied address.  If a caller can't be determined,
1498 	 * indicate the failure.
1499 	 */
1500 	if ((clmp = _caller((caddr_t)addr, CL_NONE)) == 0) {
1501 		eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1502 		    EC_NATPTR(addr));
1503 		error = 0;
1504 	} else {
1505 		dladdr_core(clmp, addr, dlip, 0, 0);
1506 		error = 1;
1507 	}
1508 
1509 	if (entry)
1510 		leave(0, 0);
1511 	return (error);
1512 }
1513 
1514 #pragma weak _dladdr1 = dladdr1
1515 
1516 int
1517 dladdr1(void *addr, Dl_info *dlip, void **info, int flags)
1518 {
1519 	int	entry, error = 0;
1520 	Rt_map	*clmp;
1521 
1522 	/*
1523 	 * Validate any flags.
1524 	 */
1525 	if (flags) {
1526 		int	request;
1527 
1528 		if (((request = (flags & RTLD_DL_MASK)) != RTLD_DL_SYMENT) &&
1529 		    (request != RTLD_DL_LINKMAP)) {
1530 			eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_ILLFLAGS),
1531 			    flags);
1532 			return (0);
1533 		}
1534 		if (info == 0) {
1535 			eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_ILLINFO), flags);
1536 			return (0);
1537 		}
1538 	}
1539 
1540 	entry = enter(0);
1541 
1542 	/*
1543 	 * Use our calling technique to determine what object is associated
1544 	 * with the supplied address.  If a caller can't be determined,
1545 	 * indicate the failure.
1546 	 */
1547 	if ((clmp = _caller((caddr_t)addr, CL_NONE)) == 0) {
1548 		eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1549 		    EC_NATPTR(addr));
1550 		error = 0;
1551 	} else {
1552 		dladdr_core(clmp, addr, dlip, info, flags);
1553 		error = 1;
1554 	}
1555 
1556 	if (entry)
1557 		leave(0, 0);
1558 	return (error);
1559 }
1560 
1561 /*
1562  * Core dldump activity.
1563  */
1564 static int
1565 dldump_core(Lm_list *lml, const char *ipath, const char *opath, int flags)
1566 {
1567 	Addr	addr = 0;
1568 	Rt_map	*lmp;
1569 
1570 	/*
1571 	 * Verify any arguments first.
1572 	 */
1573 	if ((!opath || (*opath == '\0')) || (ipath && (*ipath == '\0'))) {
1574 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
1575 		return (1);
1576 	}
1577 
1578 	/*
1579 	 * If an input file is specified make sure its one of our dependencies
1580 	 * on the main link-map list.  Note, this has really all evolved for
1581 	 * crle(), which uses libcrle.so on an alternative link-map to trigger
1582 	 * dumping objects from the main link-map list.   If we ever want to
1583 	 * dump objects from alternative link-maps, this model is going to
1584 	 * have to be revisited.
1585 	 */
1586 	if (ipath) {
1587 		if ((lmp = is_so_loaded(&lml_main, ipath, NULL)) == 0) {
1588 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NOFILE),
1589 			    ipath);
1590 			return (1);
1591 		}
1592 		if (FLAGS(lmp) & FLG_RT_ALTER) {
1593 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_ALTER), ipath);
1594 			return (1);
1595 		}
1596 		if (FLAGS(lmp) & FLG_RT_NODUMP) {
1597 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NODUMP),
1598 			    ipath);
1599 			return (1);
1600 		}
1601 	} else
1602 		lmp = lml_main.lm_head;
1603 
1604 
1605 	DBG_CALL(Dbg_file_dldump(lmp, opath, flags));
1606 
1607 	/*
1608 	 * If the object being dump'ed isn't fixed identify its mapping.
1609 	 */
1610 	if (!(FLAGS(lmp) & FLG_RT_FIXED))
1611 		addr = ADDR(lmp);
1612 
1613 	/*
1614 	 * As rt_dldump() will effectively lazy load the necessary support
1615 	 * libraries, make sure ld.so.1 is initialized for plt relocations.
1616 	 */
1617 	if (elf_rtld_load() == 0)
1618 		return (0);
1619 
1620 	/*
1621 	 * Dump the required image.
1622 	 */
1623 	return (rt_dldump(lmp, opath, flags, addr));
1624 }
1625 
1626 #pragma weak _dldump = dldump
1627 
1628 /*
1629  * External entry for dldump(3c).  Returns 0 on success, non-zero otherwise.
1630  */
1631 int
1632 dldump(const char *ipath, const char *opath, int flags)
1633 {
1634 	int	error, entry;
1635 	Rt_map	*clmp;
1636 
1637 	entry = enter(0);
1638 
1639 	clmp = _caller(caller(), CL_EXECDEF);
1640 
1641 	error = dldump_core(LIST(clmp), ipath, opath, flags);
1642 
1643 	if (entry)
1644 		leave(LIST(clmp), 0);
1645 	return (error);
1646 }
1647 
1648 /*
1649  * get_linkmap_id() translates Lm_list * pointers to the Link_map id as used by
1650  * the rtld_db and dlmopen() interfaces.  It checks to see if the Link_map is
1651  * one of the primary ones and if so returns it's special token:
1652  *		LM_ID_BASE
1653  *		LM_ID_LDSO
1654  *
1655  * If it's not one of the primary link_map id's it will instead returns a
1656  * pointer to the Lm_list structure which uniquely identifies the Link_map.
1657  */
1658 Lmid_t
1659 get_linkmap_id(Lm_list *lml)
1660 {
1661 	if (lml->lm_flags & LML_FLG_BASELM)
1662 		return (LM_ID_BASE);
1663 	if (lml->lm_flags & LML_FLG_RTLDLM)
1664 		return (LM_ID_LDSO);
1665 
1666 	return ((Lmid_t)lml);
1667 }
1668 
1669 /*
1670  * Extract information for a dlopen() handle.
1671  */
1672 static int
1673 dlinfo_core(void *handle, int request, void *p, Rt_map *clmp)
1674 {
1675 	Lm_list	*lml = LIST(clmp);
1676 	Rt_map	*lmp;
1677 
1678 	if ((request > RTLD_DI_MAX) || (p == 0)) {
1679 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLVAL));
1680 		return (-1);
1681 	}
1682 
1683 	/*
1684 	 * Return configuration cache name and address.
1685 	 */
1686 	if (request == RTLD_DI_CONFIGADDR) {
1687 		Dl_info	*dlip = (Dl_info *)p;
1688 
1689 		if ((config->c_name == 0) || (config->c_bgn == 0) ||
1690 		    (config->c_end == 0)) {
1691 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOCONFIG));
1692 			return (-1);
1693 		}
1694 		dlip->dli_fname = config->c_name;
1695 		dlip->dli_fbase = (void *)config->c_bgn;
1696 		return (0);
1697 	}
1698 
1699 	/*
1700 	 * Return profiled object name (used by ldprof audit library).
1701 	 */
1702 	if (request == RTLD_DI_PROFILENAME) {
1703 		if (profile_name == 0) {
1704 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOPROFNAME));
1705 			return (-1);
1706 		}
1707 
1708 		*(const char **)p = profile_name;
1709 		return (0);
1710 	}
1711 	if (request == RTLD_DI_PROFILEOUT) {
1712 		/*
1713 		 * If a profile destination directory hasn't been specified
1714 		 * provide a default.
1715 		 */
1716 		if (profile_out == 0)
1717 			profile_out = MSG_ORIG(MSG_PTH_VARTMP);
1718 
1719 		*(const char **)p = profile_out;
1720 		return (0);
1721 	}
1722 
1723 	/*
1724 	 * Obtain or establish a termination signal.
1725 	 */
1726 	if (request == RTLD_DI_GETSIGNAL) {
1727 		*(int *)p = killsig;
1728 		return (0);
1729 	}
1730 
1731 	if (request == RTLD_DI_SETSIGNAL) {
1732 		sigset_t	set;
1733 		int		sig = *(int *)p;
1734 
1735 		/*
1736 		 * Determine whether the signal is in range.
1737 		 */
1738 		(void) sigfillset(&set);
1739 		if (sigismember(&set, sig) != 1) {
1740 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVSIG), sig);
1741 			return (-1);
1742 		}
1743 
1744 		killsig = sig;
1745 		return (0);
1746 	}
1747 
1748 	/*
1749 	 * For any other request a link-map is required.  Verify the handle.
1750 	 */
1751 	if (handle == RTLD_SELF)
1752 		lmp = clmp;
1753 	else {
1754 		Grp_hdl	*ghp = (Grp_hdl *)handle;
1755 
1756 		if (!hdl_validate(ghp)) {
1757 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL));
1758 			return (-1);
1759 		}
1760 		lmp = ghp->gh_ownlmp;
1761 	}
1762 
1763 	/*
1764 	 * Obtain the process arguments, environment and auxv.  Note, as the
1765 	 * environment can be modified by the user (putenv(3c)), reinitialize
1766 	 * the environment pointer on each request.
1767 	 */
1768 	if (request == RTLD_DI_ARGSINFO) {
1769 		Dl_argsinfo	*aip = (Dl_argsinfo *)p;
1770 		Lm_list		*lml = LIST(lmp);
1771 
1772 		*aip = argsinfo;
1773 		if (lml->lm_flags & LML_FLG_ENVIRON)
1774 			aip->dla_envp = *(lml->lm_environ);
1775 
1776 		return (0);
1777 	}
1778 
1779 	/*
1780 	 * Return Lmid_t of the Link-Map list that the specified object is
1781 	 * loaded on.
1782 	 */
1783 	if (request == RTLD_DI_LMID) {
1784 		*(Lmid_t *)p = get_linkmap_id(LIST(lmp));
1785 		return (0);
1786 	}
1787 
1788 	/*
1789 	 * Return a pointer to the Link-Map structure associated with the
1790 	 * specified object.
1791 	 */
1792 	if (request == RTLD_DI_LINKMAP) {
1793 		*(Link_map **)p = (Link_map *)lmp;
1794 		return (0);
1795 	}
1796 
1797 	/*
1798 	 * Return search path information, or the size of the buffer required
1799 	 * to store the information.
1800 	 */
1801 	if ((request == RTLD_DI_SERINFO) || (request == RTLD_DI_SERINFOSIZE)) {
1802 		Pnode		*dir, *dirlist = (Pnode *)0;
1803 		Dl_serinfo	*info;
1804 		Dl_serpath	*path;
1805 		char		*strs;
1806 		size_t		size = sizeof (Dl_serinfo);
1807 		uint_t		cnt = 0;
1808 
1809 		info = (Dl_serinfo *)p;
1810 		path = &info->dls_serpath[0];
1811 		strs = (char *)&info->dls_serpath[info->dls_cnt];
1812 
1813 		/*
1814 		 * Traverse search path entries for this object.
1815 		 */
1816 		while ((dir = get_next_dir(&dirlist, lmp, 0)) != 0) {
1817 			size_t	_size;
1818 
1819 			if (dir->p_name == 0)
1820 				continue;
1821 
1822 			/*
1823 			 * If configuration information exists, it's possible
1824 			 * this path has been identified as non-existent, if so
1825 			 * ignore it.
1826 			 */
1827 			if (dir->p_info) {
1828 				Rtc_obj	*dobj = (Rtc_obj *)dir->p_info;
1829 				if (dobj->co_flags & RTC_OBJ_NOEXIST)
1830 					continue;
1831 			}
1832 
1833 			/*
1834 			 * Keep track of search path count and total info size.
1835 			 */
1836 			if (cnt++)
1837 				size += sizeof (Dl_serpath);
1838 			_size = strlen(dir->p_name) + 1;
1839 			size += _size;
1840 
1841 			if (request == RTLD_DI_SERINFOSIZE)
1842 				continue;
1843 
1844 			/*
1845 			 * If we're filling in search path information, confirm
1846 			 * there's sufficient space.
1847 			 */
1848 			if (size > info->dls_size) {
1849 				eprintf(lml, ERR_FATAL,
1850 				    MSG_INTL(MSG_ARG_SERSIZE),
1851 				    EC_OFF(info->dls_size));
1852 				return (-1);
1853 			}
1854 			if (cnt > info->dls_cnt) {
1855 				eprintf(lml, ERR_FATAL,
1856 				    MSG_INTL(MSG_ARG_SERCNT), info->dls_cnt);
1857 				return (-1);
1858 			}
1859 
1860 			/*
1861 			 * Append the path to the information buffer.
1862 			 */
1863 			(void) strcpy(strs, dir->p_name);
1864 			path->dls_name = strs;
1865 			path->dls_flags = dir->p_orig;
1866 
1867 			strs = strs + _size;
1868 			path++;
1869 		}
1870 
1871 		/*
1872 		 * If we're here to size the search buffer fill it in.
1873 		 */
1874 		if (request == RTLD_DI_SERINFOSIZE) {
1875 			info->dls_size = size;
1876 			info->dls_cnt = cnt;
1877 		}
1878 	}
1879 
1880 	/*
1881 	 * Return the origin of the object associated with this link-map.
1882 	 * Basically return the dirname(1) of the objects fullpath.
1883 	 */
1884 	if (request == RTLD_DI_ORIGIN) {
1885 		char	*str = (char *)p;
1886 
1887 		if (DIRSZ(lmp) == 0)
1888 			(void) fullpath(lmp, 0);
1889 
1890 		(void) strncpy(str, ORIGNAME(lmp), DIRSZ(lmp));
1891 		str += DIRSZ(lmp);
1892 		*str = '\0';
1893 
1894 		return (0);
1895 	}
1896 
1897 	return (0);
1898 }
1899 
1900 #pragma weak _dlinfo = dlinfo
1901 
1902 /*
1903  * External entry for dlinfo(3dl).
1904  */
1905 int
1906 dlinfo(void *handle, int request, void *p)
1907 {
1908 	int	error, entry;
1909 	Rt_map	*clmp;
1910 
1911 	entry = enter(0);
1912 
1913 	clmp = _caller(caller(), CL_EXECDEF);
1914 
1915 	error = dlinfo_core(handle, request, p, clmp);
1916 
1917 	if (entry)
1918 		leave(LIST(clmp), 0);
1919 	return (error);
1920 }
1921