xref: /titanic_44/usr/src/cmd/sgs/rtld/common/dlfcns.c (revision fe598cdcd847f8359013532d5c691bb6190378c0)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1988 AT&T
24  *	  All Rights Reserved
25  *
26  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
27  * Use is subject to license terms.
28  */
29 
30 #pragma ident	"%Z%%M%	%I%	%E% SMI"
31 
32 /*
33  * Programmatic interface to the run_time linker.
34  */
35 #include	"_synonyms.h"
36 
37 #include	<sys/debug.h>
38 #include	<string.h>
39 #include	<dlfcn.h>
40 #include	<synch.h>
41 #include	<limits.h>
42 #include	<debug.h>
43 #include	"_rtld.h"
44 #include	"_audit.h"
45 #include	"_elf.h"
46 #include	"msg.h"
47 
48 /*
49  * Determine who called us - given a pc determine in which object it resides.
50  *
51  * For dlopen() the link map of the caller must be passed to load_so() so that
52  * the appropriate search rules (4.x or 5.0) are used to locate any
53  * dependencies.  Also, if we've been called from a 4.x module it may be
54  * necessary to fix the specified pathname so that it conforms with the 5.0 elf
55  * rules.
56  *
57  * For dlsym() the link map of the caller is used to determine RTLD_NEXT
58  * requests, together with requests based off of a dlopen(0).
59  * For dladdr() this routines provides a generic means of scanning all loaded
60  * segments.
61  */
62 Rt_map *
63 _caller(caddr_t cpc, int flags)
64 {
65 	Lm_list *	lml;
66 	Listnode *	lnp;
67 
68 	for (LIST_TRAVERSE(&dynlm_list, lnp, lml)) {
69 		Aliste	off;
70 		Lm_cntl	*lmc;
71 
72 		for (ALIST_TRAVERSE(lml->lm_lists, off, lmc)) {
73 			Rt_map	*lmp;
74 
75 			for (lmp = lmc->lc_head; lmp;
76 			    lmp = (Rt_map *)NEXT(lmp)) {
77 				Mmap	*mmap;
78 
79 				/*
80 				 * Traverse this objects mappings testing
81 				 * whether the pc falls within its range.
82 				 */
83 				for (mmap = MMAPS(lmp); mmap->m_vaddr; mmap++) {
84 					if ((cpc >= mmap->m_vaddr) && (cpc <
85 					    (mmap->m_vaddr + mmap->m_msize)))
86 						return (lmp);
87 				}
88 			}
89 		}
90 	}
91 
92 	/*
93 	 * No mapping can be determined.  If asked for a default, assume this
94 	 * is from the executable.
95 	 */
96 	if (flags & CL_EXECDEF)
97 		return ((Rt_map *)lml_main.lm_head);
98 
99 	return (0);
100 }
101 
102 #pragma weak dlerror = _dlerror
103 
104 /*
105  * External entry for dlerror(3dl).  Returns a pointer to the string describing
106  * the last occurring error.  The last occurring error is cleared.
107  */
108 char *
109 _dlerror()
110 {
111 	char	*error;
112 	Rt_map	*clmp;
113 	int	entry;
114 
115 	entry = enter();
116 
117 	clmp = _caller(caller(), CL_EXECDEF);
118 
119 	error = lasterr;
120 	lasterr = (char *)0;
121 
122 	if (entry)
123 		leave(LIST(clmp));
124 	return (error);
125 }
126 
127 /*
128  * Add a dependency as a group descriptor to a group handle.  Returns 0 on
129  * failure, ALE_EXISTS if the dependency already exists, or ALE_CREATE if it
130  * is newly created.
131  */
132 int
133 hdl_add(Grp_hdl *ghp, Rt_map *lmp, uint_t flags)
134 {
135 	Grp_desc	*gdp;
136 	Aliste		off;
137 	int		found = ALE_CREATE;
138 
139 	/*
140 	 * Make sure this dependency hasn't already been recorded.
141 	 */
142 	for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
143 		if (gdp->gd_depend == lmp) {
144 			found = ALE_EXISTS;
145 			break;
146 		}
147 	}
148 
149 	if (found == ALE_CREATE) {
150 		Grp_desc	gd;
151 
152 		/*
153 		 * Create a new handle descriptor.
154 		 */
155 		gd.gd_depend = lmp;
156 		gd.gd_flags = 0;
157 
158 		/*
159 		 * Indicate this object is a part of this handles group.
160 		 */
161 		if (alist_append(&GROUPS(lmp), &ghp,
162 		    sizeof (Grp_hdl *), AL_CNT_GROUPS) == 0)
163 			return (0);
164 
165 		/*
166 		 * Append the new dependency to this handle.
167 		 */
168 		if ((gdp = alist_append(&(ghp->gh_depends), &gd,
169 		    sizeof (Grp_desc), AL_CNT_DEPENDS)) == 0)
170 			return (0);
171 	}
172 
173 	gdp->gd_flags |= flags;
174 
175 	if (found == ALE_CREATE)
176 		DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_ADD, flags));
177 
178 	return (found);
179 }
180 
181 /*
182  * Allocate a handle and record its existence on the handle list for future
183  * verification.
184  */
185 Grp_hdl *
186 hdl_alloc()
187 {
188 	Grp_hdl	*ghp;
189 	uint_t	ndx;
190 
191 	if ((ghp = calloc(sizeof (Grp_hdl), 1)) == 0)
192 		return (0);
193 
194 	/* LINTED */
195 	ndx = (uintptr_t)ghp % HDLIST_SZ;
196 
197 	if (list_append(&hdl_list[ndx], ghp) == 0) {
198 		free(ghp);
199 		return (0);
200 	}
201 	return (ghp);
202 }
203 
204 /*
205  * Create a handle.
206  */
207 Grp_hdl *
208 hdl_create(Lm_list *lml, Rt_map *nlmp, Rt_map *clmp, uint_t flags)
209 {
210 	Grp_hdl	*ghp = 0, **ghpp;
211 	uint_t	hflags;
212 	Alist	**alpp;
213 	Aliste	off;
214 
215 	/*
216 	 * For dlopen(0) the handle is maintained as part of the link-map list,
217 	 * otherwise it is associated with the referenced link-map.
218 	 */
219 	if (flags & GPH_ZERO)
220 		alpp = &(lml->lm_handle);
221 	else
222 		alpp = &(HANDLES(nlmp));
223 
224 	/*
225 	 * Objects can contain multiple handles depending on the flags supplied.
226 	 * Most RTLD flags pertain to the object itself and the bindings that it
227 	 * can achieve.  Multiple handles for these flags don't make sense.  But
228 	 * if the flag determines how the handle might be used, then multiple
229 	 * handles may exist.  Presently this only makes sense for RTLD_FIRST.
230 	 * Determine if an appropriate handle already exists.
231 	 */
232 	hflags = flags & GPH_FIRST;
233 	for (ALIST_TRAVERSE(*alpp, off, ghpp)) {
234 		if (((*ghpp)->gh_flags & GPH_FIRST) == hflags) {
235 			ghp = *ghpp;
236 			break;
237 		}
238 	}
239 
240 	if (ghp == 0) {
241 		DBG_CALL(Dbg_file_hdl_title(DBG_DEP_CREATE));
242 
243 		/*
244 		 * If this is the first dlopen() request for this handle
245 		 * allocate and initialize a new handle.
246 		 */
247 		if ((ghp = hdl_alloc()) == 0)
248 			return (0);
249 
250 		if (alist_append(alpp, &ghp, sizeof (Grp_hdl *),
251 		    AL_CNT_GROUPS) == 0)
252 			return (0);
253 
254 		/*
255 		 * Indicate that this object has been referenced.  In truth a
256 		 * reference hasn't yet occurred, it's a dlsym() that makes the
257 		 * reference.  However, we assume that anyone performing a
258 		 * dlopen() will eventually call dlsym(), plus this makes for a
259 		 * better diagnostic location rather than having to call
260 		 * unused() after every dlsym() operation.
261 		 */
262 		if (nlmp)
263 			FLAGS1(nlmp) |= FL1_RT_USED;
264 
265 		ghp->gh_refcnt = 1;
266 		ghp->gh_flags = flags;
267 
268 		/*
269 		 * A dlopen(0) handle is identified by the GPH_ZERO flag, the
270 		 * head of the link-map list is defined as the owner.  There is
271 		 * no need to maintain a list of dependencies, for when this
272 		 * handle is used (for dlsym()) a dynamic search through the
273 		 * entire link-map list provides for searching all objects with
274 		 * GLOBAL visibility.
275 		 */
276 		if (flags & GPH_ZERO) {
277 			ghp->gh_ownlmp = lml->lm_head;
278 			ghp->gh_ownlml = lml;
279 		} else {
280 			uint_t	hflags = (GPD_DLSYM | GPD_RELOC);
281 
282 			ghp->gh_ownlmp = nlmp;
283 			ghp->gh_ownlml = LIST(nlmp);
284 
285 			/*
286 			 * As an optimization, a handle for ld.so.1 itself
287 			 * (required for libdl's filtering mechanism) shouldn't
288 			 * search any dependencies of ld.so.1.  Omitting
289 			 * GPD_ADDEPS prevents the addition of any ld.so.1
290 			 * dependencies to this handle.
291 			 */
292 			if ((flags & GPH_LDSO) == 0)
293 				hflags |= GPD_ADDEPS;
294 			if (hdl_add(ghp, nlmp, hflags) == 0)
295 				return (0);
296 		}
297 	} else {
298 		/*
299 		 * If a handle already exists, bump its reference count.
300 		 *
301 		 * If the previous reference count was 0, then this is a handle
302 		 * that an earlier call to dlclose() was unable to remove.  Such
303 		 * handles are put on the orphan list.  As this handle is back
304 		 * in use, it must be removed from the orphan list.
305 		 *
306 		 * Note, handles associated with a link-map list itself (i.e.
307 		 * dlopen(0)) can have a reference count of 0.  However, these
308 		 * handles are never deleted, and therefore are never moved to
309 		 * the orphan list.
310 		 */
311 		if ((ghp->gh_refcnt++ == 0) &&
312 		    ((ghp->gh_flags & GPH_ZERO) == 0)) {
313 			uint_t	ndx;
314 
315 			/* LINTED */
316 			ndx = (uintptr_t)ghp % HDLIST_SZ;
317 
318 			list_delete(&hdl_list[HDLIST_ORP], ghp);
319 			(void) list_append(&hdl_list[ndx], ghp);
320 
321 			if (DBG_ENABLED) {
322 				Aliste		off;
323 				Grp_desc	*gdp;
324 
325 				DBG_CALL(Dbg_file_hdl_title(DBG_DEP_REINST));
326 				for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp))
327 					DBG_CALL(Dbg_file_hdl_action(ghp,
328 					    gdp->gd_depend, DBG_DEP_REINST, 0));
329 			}
330 		}
331 	}
332 
333 	/*
334 	 * Keep track of the parent (caller).  If this request stems from a
335 	 * dlopen(..., RTLD_PARENT) call, then the parent is made available to
336 	 * satisfy relocation bindings.  Note, that individual, explicit,
337 	 * direct bindings can also be made to the parent should this object
338 	 * have been built defining PARENT symbol references.  Also note that a
339 	 * parent doesn't provide symbols to dlsym() requests, so it isn't
340 	 * necessary to add the parents dependencies to the handle.
341 	 *
342 	 * As this object could be opened by different parents, this test is
343 	 * carried out every time a handle is requested.
344 	 */
345 	if (clmp) {
346 		if (flags & GPH_PARENT)
347 			flags = (GPD_PARENT | GPD_RELOC);
348 		else
349 			flags = GPD_PARENT;
350 
351 		if (hdl_add(ghp, clmp, flags) == 0)
352 			return (0);
353 	}
354 	return (ghp);
355 }
356 
357 /*
358  * Initialize a handle that has been created for an object that is already
359  * loaded.  The handle is initialized with the present dependencies of that
360  * object.  Once this initialization has occurred, any new objects that might
361  * be loaded as dependencies (lazy-loading) are added to the handle as each new
362  * object is loaded.
363  */
364 int
365 hdl_initialize(Grp_hdl *ghp, Rt_map *nlmp, int mode, int promote)
366 {
367 	Aliste		off;
368 	Grp_desc	*gdp;
369 
370 	/*
371 	 * If the handle has already been initialized, and the initial object's
372 	 * mode hasn't been promoted, there's no need to recompute the modes of
373 	 * any dependencies.  If the object we've added has just been opened,
374 	 * the objects dependencies will not yet have been processed.  These
375 	 * dependencies will be added on later calls to load_one().  Otherwise,
376 	 * this object already exists, so add all of its dependencies to the
377 	 * handle were operating on.
378 	 */
379 	if (((ghp->gh_flags & GPH_INITIAL) && (promote == 0)) ||
380 	    ((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0)) {
381 		ghp->gh_flags |= GPH_INITIAL;
382 		return (1);
383 	}
384 
385 	DBG_CALL(Dbg_file_hdl_title(DBG_DEP_ADD));
386 	for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
387 		Rt_map *	lmp = gdp->gd_depend;
388 		Aliste		off1;
389 		Bnd_desc **	bdpp;
390 
391 		/*
392 		 * If this dependency doesn't indicate that its dependencies
393 		 * should be added to a handle, ignore it.  This case identifies
394 		 * a parent of a dlopen(RTLD_PARENT) request.
395 		 */
396 		if ((gdp->gd_flags & GPD_ADDEPS) == 0)
397 			continue;
398 
399 		for (ALIST_TRAVERSE(DEPENDS(lmp), off1, bdpp)) {
400 			Bnd_desc	*bdp = *bdpp;
401 			Rt_map		*dlmp = bdp->b_depend;
402 
403 			if ((bdp->b_flags & BND_NEEDED) == 0)
404 				continue;
405 
406 			if (hdl_add(ghp, dlmp,
407 			    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS)) == 0)
408 				return (0);
409 
410 			(void) update_mode(dlmp, MODE(dlmp), mode);
411 		}
412 	}
413 	ghp->gh_flags |= GPH_INITIAL;
414 	return (1);
415 }
416 
417 /*
418  * Sanity check a program-provided handle.
419  */
420 static int
421 hdl_validate(Grp_hdl *ghp)
422 {
423 	Listnode	*lnp;
424 	Grp_hdl		*lghp;
425 	uint_t		ndx;
426 
427 	/* LINTED */
428 	ndx = (uintptr_t)ghp % HDLIST_SZ;
429 
430 	for (LIST_TRAVERSE(&hdl_list[ndx], lnp, lghp)) {
431 		if ((lghp == ghp) && (ghp->gh_refcnt != 0))
432 			return (1);
433 	}
434 	return (0);
435 }
436 
437 /*
438  * Core dlclose activity.
439  */
440 int
441 dlclose_core(Grp_hdl *ghp, Rt_map *clmp, Lm_list *lml)
442 {
443 	int	error;
444 
445 	/*
446 	 * If we're already at atexit() there's no point processing further,
447 	 * all objects have already been tsorted for fini processing.
448 	 */
449 	if ((rtld_flags & RT_FL_ATEXIT) != 0)
450 		return (0);
451 
452 	/*
453 	 * Diagnose what we're up to.
454 	 */
455 	if (ghp->gh_flags & GPH_ZERO) {
456 		DBG_CALL(Dbg_file_dlclose(LIST(clmp), MSG_ORIG(MSG_STR_ZERO),
457 		    DBG_DLCLOSE_IGNORE));
458 	} else {
459 		DBG_CALL(Dbg_file_dlclose(LIST(clmp), NAME(ghp->gh_ownlmp),
460 		    DBG_DLCLOSE_NULL));
461 	}
462 
463 
464 	/*
465 	 * Decrement reference count of this object.
466 	 */
467 	if (--(ghp->gh_refcnt))
468 		return (0);
469 
470 	/*
471 	 * If this handle is special (dlopen(0)), then leave it around - it
472 	 * has little overhead.
473 	 */
474 	if (ghp->gh_flags & GPH_ZERO)
475 		return (0);
476 
477 	/*
478 	 * This handle is no longer being referenced, remove it.  If this handle
479 	 * is part of an alternative link-map list, determine if the whole list
480 	 * can be removed also.
481 	 */
482 	error = remove_hdl(ghp, clmp, 0);
483 
484 	if ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)
485 		remove_lml(lml);
486 
487 	return (error);
488 }
489 
490 /*
491  * Internal dlclose activity.  Called from user level or directly for internal
492  * error cleanup.
493  */
494 int
495 dlclose_intn(Grp_hdl *ghp, Rt_map *clmp)
496 {
497 	Rt_map	*nlmp = 0;
498 	Lm_list	*olml = 0;
499 	int	error;
500 
501 	/*
502 	 * Although we're deleting object(s) it's quite possible that additional
503 	 * objects get loaded from running the .fini section(s) of the objects
504 	 * being deleted.  These objects will have been added to the same
505 	 * link-map list as those objects being deleted.  Remember this list
506 	 * for later investigation.
507 	 */
508 	olml = ghp->gh_ownlml;
509 
510 	error = dlclose_core(ghp, clmp, olml);
511 
512 	/*
513 	 * Determine whether the original link-map list still exists.  In the
514 	 * case of a dlclose of an alternative (dlmopen) link-map the whole
515 	 * list may have been removed.
516 	 */
517 	if (olml) {
518 		Listnode	*lnp;
519 		Lm_list		*lml;
520 
521 		for (LIST_TRAVERSE(&dynlm_list, lnp, lml)) {
522 			if (olml == lml) {
523 				nlmp = olml->lm_head;
524 				break;
525 			}
526 		}
527 	}
528 	load_completion(nlmp);
529 	return (error);
530 }
531 
532 /*
533  * Argument checking for dlclose.  Only called via external entry.
534  */
535 static int
536 dlclose_check(void *handle, Rt_map *clmp)
537 {
538 	Grp_hdl	*ghp = (Grp_hdl *)handle;
539 
540 	if (hdl_validate(ghp) == 0) {
541 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL));
542 		return (1);
543 	}
544 	return (dlclose_intn(ghp, clmp));
545 }
546 
547 #pragma weak dlclose = _dlclose
548 
549 /*
550  * External entry for dlclose(3dl).  Returns 0 for success, non-zero otherwise.
551  */
552 int
553 _dlclose(void *handle)
554 {
555 	int		error, entry;
556 	Rt_map		*clmp;
557 
558 	entry = enter();
559 
560 	clmp = _caller(caller(), CL_EXECDEF);
561 
562 	error = dlclose_check(handle, clmp);
563 
564 	if (entry)
565 		leave(LIST(clmp));
566 	return (error);
567 }
568 
569 static uint_t	lmid = 0;
570 
571 /*
572  * The addition of new link-map lists is assumed to be in small quantities.
573  * Here, we assign a unique link-map id for diagnostic use.  Simply update the
574  * running link-map count until we max out.
575  */
576 int
577 newlmid(Lm_list *lml)
578 {
579 	char	buffer[MSG_LMID_ALT_SIZE + 12];
580 
581 	if (lmid == UINT_MAX) {
582 		lml->lm_lmid = UINT_MAX;
583 		(void) strncpy(buffer, MSG_ORIG(MSG_LMID_MAXED),
584 		    MSG_LMID_ALT_SIZE + 12);
585 	} else {
586 		lml->lm_lmid = lmid++;
587 		(void) snprintf(buffer, MSG_LMID_ALT_SIZE + 12,
588 		    MSG_ORIG(MSG_LMID_FMT), MSG_ORIG(MSG_LMID_ALT),
589 		    lml->lm_lmid);
590 	}
591 	if ((lml->lm_lmidstr = strdup(buffer)) == 0)
592 		return (0);
593 
594 	return (1);
595 }
596 
597 /*
598  * Core dlopen activity.
599  */
600 static Grp_hdl *
601 dlmopen_core(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
602     uint_t flags, uint_t orig)
603 {
604 	Rt_map	*nlmp;
605 	Grp_hdl	*ghp;
606 	Pnode	*pnp;
607 	Aliste	olmco, nlmco;
608 	Lm_cntl	*lmc;
609 
610 	DBG_CALL(Dbg_file_dlopen(clmp,
611 	    (path ? path : MSG_ORIG(MSG_STR_ZERO)), mode));
612 
613 	/*
614 	 * If the path specified is null then we're operating on global
615 	 * objects.  Associate a dummy handle with the link-map list.
616 	 */
617 	if (path == 0) {
618 		Grp_hdl *ghp;
619 		uint_t	hflags = GPH_ZERO;
620 		int	promote = 0;
621 
622 		if (mode & RTLD_PARENT)
623 			hflags |=  GPH_PARENT;
624 		if (mode & RTLD_FIRST)
625 			hflags |=  GPH_FIRST;
626 
627 		if ((ghp = hdl_create(lml, 0, clmp, hflags)) == 0)
628 			return (0);
629 
630 		/*
631 		 * Traverse the main link-map control list, updating the mode
632 		 * of any objects as necessary.  Call the relocation engine if
633 		 * this mode promotes the existing state of any relocations.
634 		 * crle()'s first pass loads all objects necessary for building
635 		 * a configuration file, however none of them are relocated.
636 		 * crle()'s second pass relocates objects in preparation for
637 		 * dldump()'ing using dlopen(0, RTLD_NOW).
638 		 */
639 		if ((mode & (RTLD_NOW | RTLD_CONFGEN)) == RTLD_CONFGEN)
640 			return (ghp);
641 
642 		for (nlmp = lml->lm_head; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
643 			if (((MODE(nlmp) & RTLD_GLOBAL) == 0) ||
644 			    (FLAGS(nlmp) & FLG_RT_DELETE))
645 				continue;
646 
647 			if (update_mode(nlmp, MODE(nlmp), mode))
648 				promote = 1;
649 		}
650 		if (promote)
651 			(void) relocate_lmc(lml, ALO_DATA, clmp, lml->lm_head);
652 
653 		return (ghp);
654 	}
655 
656 	/*
657 	 * Fix the pathname.  If this object expands to multiple paths (ie.
658 	 * $ISALIST or $HWCAP have been used), then make sure the user has also
659 	 * furnished the RTLD_FIRST flag.  As yet, we don't support opening
660 	 * more than one object at a time, so enforcing the RTLD_FIRST flag
661 	 * provides flexibility should we be able to support dlopening more
662 	 * than one object in the future.
663 	 */
664 	if ((pnp = LM_FIX_NAME(clmp)(path, clmp, orig)) == 0)
665 		return (0);
666 
667 	if (((pnp->p_orig & (PN_TKN_ISALIST | PN_TKN_HWCAP)) || pnp->p_next) &&
668 	    ((mode & RTLD_FIRST) == 0)) {
669 		remove_pnode(pnp);
670 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_5));
671 		return (0);
672 	}
673 
674 	/*
675 	 * Create a new link-map control list for this request, and load the
676 	 * associated object.
677 	 */
678 	if ((lmc = alist_append(&(lml->lm_lists), 0, sizeof (Lm_cntl),
679 	    AL_CNT_LMLISTS)) == 0) {
680 		remove_pnode(pnp);
681 		return (0);
682 	}
683 	olmco = nlmco = (Aliste)((char *)lmc - (char *)lml->lm_lists);
684 
685 	nlmp = load_one(lml, nlmco, pnp, clmp, mode,
686 	    (flags | FLG_RT_HANDLE), &ghp);
687 
688 	/*
689 	 * Remove any expanded pathname infrastructure, and if the dependency
690 	 * couldn't be loaded, cleanup.
691 	 */
692 	remove_pnode(pnp);
693 	if (nlmp == 0) {
694 		remove_cntl(lml, olmco);
695 		return (0);
696 	}
697 
698 	/*
699 	 * If loading an auditor was requested, and the auditor already existed,
700 	 * then the link-map returned will be to the original auditor.  The new
701 	 * link-map list that was initially created, and the associated link-map
702 	 * control list are no longer needed.  As the auditor is already loaded,
703 	 * we're probably done, but fall through in case additional relocations
704 	 * would be triggered by the mode of the caller.
705 	 */
706 	if ((flags & FLG_RT_AUDIT) && (LIST(nlmp) != lml)) {
707 		remove_cntl(lml, olmco);
708 		lml = LIST(nlmp);
709 		olmco = 0;
710 		nlmco = ALO_DATA;
711 	}
712 
713 	/*
714 	 * Finish processing the objects associated with this request.
715 	 */
716 	if ((analyze_lmc(lml, nlmco, nlmp) == 0) ||
717 	    (relocate_lmc(lml, nlmco, clmp, nlmp) == 0)) {
718 		ghp = 0;
719 		nlmp = 0;
720 	}
721 
722 	/*
723 	 * If this lazyload has failed, and we've created a new link-map
724 	 * control list to which this request has added objects, then remove
725 	 * all the objects that have been associated to this request.
726 	 */
727 	if ((nlmp == 0) && olmco && lmc->lc_head)
728 		remove_lmc(lml, clmp, lmc, olmco, path);
729 
730 	/*
731 	 * Finally, remove any link-map control list that was created.
732 	 */
733 	if (olmco)
734 		remove_cntl(lml, olmco);
735 
736 	return (ghp);
737 }
738 
739 /*
740  * Internal dlopen() activity.  Called from user level or directly for internal
741  * opens that require a handle.
742  */
743 Grp_hdl *
744 dlmopen_intn(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
745     uint_t flags, uint_t orig, int *loaded)
746 {
747 	Rt_map	*dlmp = 0;
748 	Grp_hdl	*ghp;
749 	int	objcnt;
750 
751 	/*
752 	 * Check for magic link-map list values:
753 	 *
754 	 *  LM_ID_BASE:		Operate on the PRIMARY (executables) link map
755 	 *  LM_ID_LDSO:		Operation on ld.so.1's link map
756 	 *  LM_ID_NEWLM: 	Create a new link-map.
757 	 */
758 	if (lml == (Lm_list *)LM_ID_NEWLM) {
759 		if ((lml = calloc(sizeof (Lm_list), 1)) == 0)
760 			return (0);
761 
762 		/*
763 		 * Establish the new link-map flags from the callers and those
764 		 * explicitly provided.
765 		 */
766 		lml->lm_tflags = LIST(clmp)->lm_tflags;
767 		if (flags & FLG_RT_AUDIT) {
768 			/*
769 			 * Unset any auditing flags - an auditor shouldn't be
770 			 * audited.  Insure all audit dependencies are loaded.
771 			 */
772 			lml->lm_tflags &= ~LML_TFLG_AUD_MASK;
773 			lml->lm_tflags |=
774 			    (LML_TFLG_NOLAZYLD | LML_TFLG_LOADFLTR);
775 			lml->lm_flags |= LML_FLG_NOAUDIT;
776 		}
777 
778 		if (list_append(&dynlm_list, lml) == 0) {
779 			free(lml);
780 			return (0);
781 		}
782 		if (newlmid(lml) == 0) {
783 			list_delete(&dynlm_list, lml);
784 			free(lml);
785 			return (0);
786 		}
787 	} else if ((uintptr_t)lml < LM_ID_NUM) {
788 		if ((uintptr_t)lml == LM_ID_BASE)
789 			lml = &lml_main;
790 		else if ((uintptr_t)lml == LM_ID_LDSO)
791 			lml = &lml_rtld;
792 	}
793 
794 	objcnt = lml->lm_obj;
795 
796 	/*
797 	 * Open the required object on the associated link-map list.
798 	 */
799 	if ((ghp = dlmopen_core(lml, path, mode, clmp, flags,
800 	    (orig | PN_SER_DLOPEN))) != 0) {
801 		/*
802 		 * Establish the new link-map from which .init processing will
803 		 * begin.  Ignore .init firing when constructing a configuration
804 		 * file (crle(1)).
805 		 */
806 		if ((mode & RTLD_CONFGEN) == 0)
807 			dlmp = ghp->gh_ownlmp;
808 	}
809 
810 	/*
811 	 * If loading an auditor was requested, and the auditor already existed,
812 	 * then the link-map returned will be to the original auditor.  Remove
813 	 * the link-map control list that was created for this request.
814 	 */
815 	if (dlmp && (flags & FLG_RT_AUDIT) && (LIST(dlmp) != lml)) {
816 		remove_lml(lml);
817 		lml = LIST(dlmp);
818 	}
819 
820 	/*
821 	 * Return the number of objects loaded if required.  This is used to
822 	 * trigger used() processing on return from a dlopen().
823 	 */
824 	if (loaded)
825 		*loaded = lml->lm_obj - objcnt;
826 
827 	/*
828 	 * If this load failed, remove any alternative link-map list.
829 	 */
830 	if ((ghp == 0) &&
831 	    ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)) {
832 		remove_lml(lml);
833 		lml = 0;
834 	}
835 
836 	/*
837 	 * Finish this load request.  If objects were loaded, .init processing
838 	 * is computed.  Finally, the debuggers are informed of the link-map
839 	 * lists being stable.
840 	 */
841 	load_completion(dlmp);
842 
843 	return (ghp);
844 }
845 
846 /*
847  * Argument checking for dlopen.  Only called via external entry.
848  */
849 static Grp_hdl *
850 dlmopen_check(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
851     int *loaded)
852 {
853 	/*
854 	 * Verify that a valid pathname has been supplied.
855 	 */
856 	if (path && (*path == '\0')) {
857 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
858 		return (0);
859 	}
860 
861 	/*
862 	 * Historically we've always verified the mode is either RTLD_NOW or
863 	 * RTLD_LAZY.  RTLD_NOLOAD is valid by itself.  Use of LM_ID_NEWLM
864 	 * requires a specific pathname, and use of RTLD_PARENT is meaningless.
865 	 */
866 	if ((mode & (RTLD_NOW | RTLD_LAZY | RTLD_NOLOAD)) == 0) {
867 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_1));
868 		return (0);
869 	}
870 	if ((mode & (RTLD_NOW | RTLD_LAZY)) == (RTLD_NOW | RTLD_LAZY)) {
871 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_2));
872 		return (0);
873 	}
874 	if ((lml == (Lm_list *)LM_ID_NEWLM) && (path == 0)) {
875 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_3));
876 		return (0);
877 	}
878 	if ((lml == (Lm_list *)LM_ID_NEWLM) && (mode & RTLD_PARENT)) {
879 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_4));
880 		return (0);
881 	}
882 	if (((mode & (RTLD_GROUP | RTLD_WORLD)) == 0) &&
883 	    ((mode & RTLD_NOLOAD) == 0))
884 		mode |= (RTLD_GROUP | RTLD_WORLD);
885 	if ((mode & RTLD_NOW) && (rtld_flags2 & RT_FL2_BINDLAZY)) {
886 		mode &= ~RTLD_NOW;
887 		mode |= RTLD_LAZY;
888 	}
889 
890 	return (dlmopen_intn(lml, path, mode, clmp, 0, 0, loaded));
891 }
892 
893 #pragma weak dlopen = _dlopen
894 
895 /*
896  * External entry for dlopen(3dl).  On success, returns a pointer (handle) to
897  * the structure containing information about the newly added object, ie. can
898  * be used by dlsym(). On failure, returns a null pointer.
899  */
900 void *
901 _dlopen(const char *path, int mode)
902 {
903 	int	entry, loaded = 0;
904 	Rt_map	*clmp;
905 	Grp_hdl	*ghp;
906 	Lm_list	*lml;
907 
908 	entry = enter();
909 
910 	clmp = _caller(caller(), CL_EXECDEF);
911 	lml = LIST(clmp);
912 
913 	ghp = dlmopen_check(lml, path, mode, clmp, &loaded);
914 
915 	if (entry && ghp && loaded)
916 		unused(lml);
917 
918 	if (entry)
919 		leave(lml);
920 	return ((void *)ghp);
921 }
922 
923 /*
924  * External entry for dlmopen(3dl).
925  */
926 #pragma weak dlmopen = _dlmopen
927 
928 void *
929 _dlmopen(Lmid_t lmid, const char *path, int mode)
930 {
931 	int	entry, loaded = 0;
932 	Rt_map	*clmp;
933 	Grp_hdl	*ghp;
934 
935 	entry = enter();
936 
937 	clmp = _caller(caller(), CL_EXECDEF);
938 
939 	ghp = dlmopen_check((Lm_list *)lmid, path, mode, clmp, &loaded);
940 
941 	if (entry && ghp && ghp->gh_ownlmp && loaded)
942 		unused(LIST(ghp->gh_ownlmp));
943 
944 	if (entry)
945 		leave(LIST(clmp));
946 	return ((void *)ghp);
947 }
948 
949 /*
950  * Handle processing for dlsym.
951  */
952 Sym *
953 dlsym_handle(Grp_hdl * ghp, Slookup * slp, Rt_map ** _lmp, uint_t *binfo)
954 {
955 	Rt_map		*nlmp, * lmp = ghp->gh_ownlmp;
956 	Rt_map		*clmp = slp->sl_cmap;
957 	const char	*name = slp->sl_name;
958 	Sym		*sym = 0;
959 	Slookup		sl = *slp;
960 
961 	sl.sl_flags = (LKUP_FIRST | LKUP_SPEC);
962 
963 	/*
964 	 * Continue processing a dlsym request.  Lookup the required symbol in
965 	 * each link-map specified by the handle.
966 	 *
967 	 * To leverage off of lazy loading, dlsym() requests can result in two
968 	 * passes.  The first descends the link-maps of any objects already in
969 	 * the address space.  If the symbol isn't located, and lazy
970 	 * dependencies still exist, then a second pass is made to load these
971 	 * dependencies if applicable.  This model means that in the case where
972 	 * a symbols exists in more than one object, the one located may not be
973 	 * constant - this is the standard issue with lazy loading. In addition,
974 	 * attempting to locate a symbol that doesn't exist will result in the
975 	 * loading of all lazy dependencies on the given handle, which can
976 	 * defeat some of the advantages of lazy loading (look out JVM).
977 	 */
978 	if (ghp->gh_flags & GPH_ZERO) {
979 		Lm_list	*lml;
980 
981 		/*
982 		 * If this symbol lookup is triggered from a dlopen(0) handle,
983 		 * traverse the present link-map list looking for promiscuous
984 		 * entries.
985 		 */
986 		for (nlmp = lmp; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
987 
988 			/*
989 			 * If this handle indicates we're only to look in the
990 			 * first object check whether we're done.
991 			 */
992 			if ((nlmp != lmp) && (ghp->gh_flags & GPH_FIRST))
993 				return ((Sym *)0);
994 
995 			if (!(MODE(nlmp) & RTLD_GLOBAL))
996 				continue;
997 			if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
998 			    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
999 				continue;
1000 
1001 			sl.sl_imap = nlmp;
1002 			if (sym = LM_LOOKUP_SYM(clmp)(&sl, _lmp, binfo))
1003 				return (sym);
1004 		}
1005 
1006 		/*
1007 		 * If we're unable to locate the symbol and this link-map still
1008 		 * has pending lazy dependencies, start loading them in an
1009 		 * attempt to exhaust the search.  Note that as we're already
1010 		 * traversing a dynamic linked list of link-maps there's no
1011 		 * need for elf_lazy_find_sym() to descend the link-maps itself.
1012 		 */
1013 		lml = LIST(lmp);
1014 		if ((lml->lm_lazy) &&
1015 		    ((lml->lm_flags & LML_FLG_NOPENDGLBLAZY) == 0)) {
1016 			int	lazy = 0;
1017 
1018 			DBG_CALL(Dbg_syms_lazy_rescan(lml, name));
1019 
1020 			sl.sl_flags |= LKUP_NODESCENT;
1021 
1022 			for (nlmp = lmp; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
1023 
1024 				if (!(MODE(nlmp) & RTLD_GLOBAL) || !LAZY(nlmp))
1025 					continue;
1026 				if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1027 				    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1028 					continue;
1029 
1030 				lazy = 1;
1031 				sl.sl_imap = nlmp;
1032 				if (sym = elf_lazy_find_sym(&sl, _lmp, binfo))
1033 					return (sym);
1034 			}
1035 
1036 			/*
1037 			 * If no global, lazy loadable dependencies are found,
1038 			 * then none exist for this link-map list.  Pending lazy
1039 			 * loadable objects may still exist for non-local
1040 			 * objects that are associated with this link-map list,
1041 			 * which is why we entered this fallback.  Tag this
1042 			 * link-map list to prevent further searching for lazy
1043 			 * dependencies.
1044 			 */
1045 			if (lazy == 0)
1046 				lml->lm_flags |= LML_FLG_NOPENDGLBLAZY;
1047 		}
1048 	} else {
1049 		/*
1050 		 * Traverse the dlopen() handle for the presently loaded
1051 		 * link-maps.
1052 		 */
1053 		Grp_desc	*gdp;
1054 		Aliste		off;
1055 
1056 		for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
1057 			if ((gdp->gd_flags & GPD_DLSYM) == 0)
1058 				continue;
1059 
1060 			sl.sl_imap = gdp->gd_depend;
1061 			if (sym = LM_LOOKUP_SYM(clmp)(&sl, _lmp, binfo))
1062 				return (sym);
1063 
1064 			if (ghp->gh_flags & GPH_FIRST)
1065 				return ((Sym *)0);
1066 		}
1067 
1068 		/*
1069 		 * If we're unable to locate the symbol and this link-map still
1070 		 * has pending lazy dependencies, start loading them in an
1071 		 * attempt to exhaust the search.
1072 		 */
1073 		if ((LIST(lmp)->lm_lazy) &&
1074 		    ((ghp->gh_flags & GPH_NOPENDLAZY) == 0)) {
1075 			int	lazy = 0;
1076 
1077 			DBG_CALL(Dbg_syms_lazy_rescan(LIST(lmp), name));
1078 
1079 			for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
1080 				nlmp = gdp->gd_depend;
1081 
1082 				if (((gdp->gd_flags & GPD_DLSYM) == 0) ||
1083 				    (LAZY(nlmp) == 0))
1084 					continue;
1085 
1086 				lazy = 1;
1087 				sl.sl_imap = nlmp;
1088 				if (sym = elf_lazy_find_sym(&sl, _lmp, binfo))
1089 					return (sym);
1090 			}
1091 
1092 			/*
1093 			 * If no lazy loadable dependencies are found, then
1094 			 * none exist for this handle.  Pending lazy loadable
1095 			 * objects may still exist for the associated link-map
1096 			 * list, which is why we entered this fallback.  Tag
1097 			 * this handle to prevent further searching for lazy
1098 			 * dependencies.
1099 			 */
1100 			if (lazy == 0)
1101 				ghp->gh_flags |= GPH_NOPENDLAZY;
1102 		}
1103 	}
1104 	return ((Sym *)0);
1105 }
1106 
1107 /*
1108  * Core dlsym activity.  Selects symbol lookup method from handle.
1109  */
1110 void *
1111 dlsym_core(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1112 {
1113 	Sym		*sym;
1114 	Syminfo		*sip;
1115 	Slookup		sl;
1116 	uint_t		binfo;
1117 
1118 	sl.sl_name = name;
1119 	sl.sl_cmap = clmp;
1120 	sl.sl_hash = 0;
1121 	sl.sl_rsymndx = 0;
1122 
1123 	/*
1124 	 * Standard relocations are evaluated using the symbol index of the
1125 	 * associated relocation symbol.  This index provides for loading
1126 	 * any lazy dependency and establishing a direct binding if necessary.
1127 	 * If a dlsym() operation originates from an object that contains a
1128 	 * symbol table entry for the same name, then establish the symbol
1129 	 * index so that any dependency requirements can be triggered.
1130 	 */
1131 	if (((intptr_t)handle < 0) && (sip = SYMINFO(clmp)) != 0) {
1132 		sl.sl_imap = clmp;
1133 		sl.sl_flags = LKUP_SYMNDX;
1134 		sl.sl_hash = elf_hash(name);
1135 
1136 		if ((sym = SYMINTP(clmp)(&sl, 0, 0)) != NULL) {
1137 			sl.sl_rsymndx = (((ulong_t)sym -
1138 			    (ulong_t)SYMTAB(clmp)) / SYMENT(clmp));
1139 		}
1140 	}
1141 
1142 	if (handle == RTLD_NEXT) {
1143 		Rt_map	*nlmp;
1144 
1145 		/*
1146 		 * If this handle is RTLD_NEXT determine whether a lazy load
1147 		 * from the caller might provide the next object.  This mimics
1148 		 * the lazy loading initialization normally carried out by
1149 		 * lookup_sym(), however here, we must do this up-front, as
1150 		 * lookup_sym() will be used to inspect the next object.
1151 		 */
1152 		if (sl.sl_rsymndx) {
1153 			/* LINTED */
1154 			sip = (Syminfo *)((char *)sip +
1155 			    (sl.sl_rsymndx * SYMINENT(clmp)));
1156 
1157 			if ((sip->si_flags & SYMINFO_FLG_DIRECT) &&
1158 			    (sip->si_boundto < SYMINFO_BT_LOWRESERVE))
1159 				(void) elf_lazy_load(clmp,
1160 				    sip->si_boundto, name);
1161 
1162 			/*
1163 			 * Clear the symbol index, so as not to confuse
1164 			 * lookup_sym() of the next object.
1165 			 */
1166 			sl.sl_rsymndx = 0;
1167 		}
1168 
1169 		/*
1170 		 * If the handle is RTLD_NEXT start searching in the next link
1171 		 * map from the callers.  Determine permissions from the
1172 		 * present link map.  Indicate to lookup_sym() that we're on an
1173 		 * RTLD_NEXT request so that it will use the callers link map to
1174 		 * start any possible lazy dependency loading.
1175 		 */
1176 		sl.sl_imap = nlmp = (Rt_map *)NEXT(clmp);
1177 
1178 		DBG_CALL(Dbg_syms_dlsym(clmp, name, (nlmp ? NAME(nlmp) :
1179 		    MSG_INTL(MSG_STR_NULL)), DBG_DLSYM_NEXT));
1180 
1181 		if (nlmp == 0)
1182 			return (0);
1183 
1184 		sl.sl_flags = LKUP_NEXT;
1185 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1186 
1187 	} else if (handle == RTLD_SELF) {
1188 		/*
1189 		 * If the handle is RTLD_SELF start searching from the caller.
1190 		 */
1191 		DBG_CALL(Dbg_syms_dlsym(clmp, name, NAME(clmp),
1192 		    DBG_DLSYM_SELF));
1193 
1194 		sl.sl_imap = clmp;
1195 		sl.sl_flags = LKUP_SPEC;
1196 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1197 
1198 	} else if (handle == RTLD_DEFAULT) {
1199 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1200 
1201 		/*
1202 		 * If the handle is RTLD_DEFAULT mimic the standard symbol
1203 		 * lookup as would be triggered by a relocation.
1204 		 */
1205 		DBG_CALL(Dbg_syms_dlsym(clmp, name, 0, DBG_DLSYM_DEFAULT));
1206 
1207 		sl.sl_imap = hlmp;
1208 		sl.sl_flags = LKUP_SPEC;
1209 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1210 
1211 	} else if (handle == RTLD_PROBE) {
1212 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1213 
1214 		/*
1215 		 * If the handle is RTLD_PROBE, mimic the standard symbol
1216 		 * lookup as would be triggered by a relocation, however do
1217 		 * not fall back to a lazy loading rescan if the symbol can't be
1218 		 * found within the currently loaded objects.  Note, a lazy
1219 		 * loaded dependency required by the caller might still get
1220 		 * loaded to satisfy this request, but no exhaustive lazy load
1221 		 * rescan is carried out.
1222 		 */
1223 		DBG_CALL(Dbg_syms_dlsym(clmp, name, 0, DBG_DLSYM_PROBE));
1224 
1225 		sl.sl_imap = hlmp;
1226 		sl.sl_flags = (LKUP_SPEC | LKUP_NOFALBACK);
1227 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1228 
1229 	} else {
1230 		Grp_hdl *ghp = (Grp_hdl *)handle;
1231 
1232 		/*
1233 		 * Look in the shared object specified by the handle and in all
1234 		 * of its dependencies.
1235 		 */
1236 		DBG_CALL(Dbg_syms_dlsym(clmp, name, NAME(ghp->gh_ownlmp),
1237 		    DBG_DLSYM_DEF));
1238 
1239 		sym = LM_DLSYM(clmp)(ghp, &sl, dlmp, &binfo);
1240 	}
1241 
1242 	if (sym) {
1243 		Lm_list	*lml = LIST(clmp);
1244 		Addr	addr = sym->st_value;
1245 
1246 		if (!(FLAGS(*dlmp) & FLG_RT_FIXED))
1247 			addr += ADDR(*dlmp);
1248 
1249 		DBG_CALL(Dbg_bind_global(clmp, 0, 0, (Xword)-1, PLT_T_NONE,
1250 		    *dlmp, addr, sym->st_value, name, binfo));
1251 
1252 		if ((lml->lm_tflags | FLAGS1(clmp)) & LML_TFLG_AUD_SYMBIND) {
1253 			uint_t	sb_flags = LA_SYMB_DLSYM;
1254 			/* LINTED */
1255 			uint_t	symndx = (uint_t)(((Xword)sym -
1256 			    (Xword)SYMTAB(*dlmp)) / SYMENT(*dlmp));
1257 			addr = audit_symbind(clmp, *dlmp, sym, symndx, addr,
1258 			    &sb_flags);
1259 		}
1260 		return ((void *)addr);
1261 	} else
1262 		return (0);
1263 }
1264 
1265 /*
1266  * Internal dlsym activity.  Called from user level or directly for internal
1267  * symbol lookup.
1268  */
1269 void *
1270 dlsym_intn(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1271 {
1272 	Rt_map		*llmp = 0;
1273 	void		*error;
1274 	Aliste		off;
1275 	Grp_desc	*gdp;
1276 
1277 	/*
1278 	 * While looking for symbols it's quite possible that additional objects
1279 	 * get loaded from lazy loading.  These objects will have been added to
1280 	 * the same link-map list as those objects on the handle.  Remember this
1281 	 * list for later investigation.
1282 	 */
1283 	if ((handle == RTLD_NEXT) || (handle == RTLD_DEFAULT) ||
1284 	    (handle == RTLD_SELF) || (handle == RTLD_PROBE))
1285 		llmp = LIST(clmp)->lm_tail;
1286 	else {
1287 		Grp_hdl	*ghp = (Grp_hdl *)handle;
1288 
1289 		if (ghp->gh_ownlmp)
1290 			llmp = LIST(ghp->gh_ownlmp)->lm_tail;
1291 		else {
1292 			for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
1293 				if ((llmp = LIST(gdp->gd_depend)->lm_tail) != 0)
1294 					break;
1295 			}
1296 		}
1297 	}
1298 
1299 	if ((error = dlsym_core(handle, name, clmp, dlmp)) == 0) {
1300 		/*
1301 		 * Cache the error message, as Java tends to fall through this
1302 		 * code many times.
1303 		 */
1304 		if (nosym_str == 0)
1305 			nosym_str = MSG_INTL(MSG_GEN_NOSYM);
1306 		eprintf(LIST(clmp), ERR_FATAL, nosym_str, name);
1307 	}
1308 
1309 	load_completion(llmp);
1310 	return (error);
1311 }
1312 
1313 /*
1314  * Argument checking for dlsym.  Only called via external entry.
1315  */
1316 static void *
1317 dlsym_check(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1318 {
1319 	/*
1320 	 * Verify the arguments.
1321 	 */
1322 	if (name == 0) {
1323 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_ILLSYM));
1324 		return (0);
1325 	}
1326 	if ((handle != RTLD_NEXT) && (handle != RTLD_DEFAULT) &&
1327 	    (handle != RTLD_SELF) && (handle != RTLD_PROBE) &&
1328 	    (hdl_validate((Grp_hdl *)handle) == 0)) {
1329 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL));
1330 		return (0);
1331 	}
1332 	return (dlsym_intn(handle, name, clmp, dlmp));
1333 }
1334 
1335 
1336 #pragma weak dlsym = _dlsym
1337 
1338 /*
1339  * External entry for dlsym().  On success, returns the address of the specified
1340  * symbol.  On error returns a null.
1341  */
1342 void *
1343 _dlsym(void *handle, const char *name)
1344 {
1345 	int	entry;
1346 	Rt_map	*clmp, *dlmp = 0;
1347 	void	*addr;
1348 
1349 	entry = enter();
1350 
1351 	clmp = _caller(caller(), CL_EXECDEF);
1352 
1353 	addr = dlsym_check(handle, name, clmp, &dlmp);
1354 
1355 	if (dlmp)
1356 		is_dep_ready(dlmp, clmp, DBG_WAIT_SYMBOL);
1357 
1358 	if (entry && dlmp)
1359 		is_dep_init(dlmp, clmp);
1360 
1361 	if (entry)
1362 		leave(LIST(clmp));
1363 	return (addr);
1364 }
1365 
1366 /*
1367  * Core dladdr activity.
1368  */
1369 static void
1370 dladdr_core(Rt_map *clmp, void *addr, Dl_info *dlip, void **info, int flags)
1371 {
1372 	/*
1373 	 * Set up generic information and any defaults.
1374 	 */
1375 	dlip->dli_fname = PATHNAME(clmp);
1376 
1377 	dlip->dli_fbase = (void *)ADDR(clmp);
1378 	dlip->dli_sname = 0;
1379 	dlip->dli_saddr = 0;
1380 
1381 	/*
1382 	 * Determine the nearest symbol to this address.
1383 	 */
1384 	LM_DLADDR(clmp)((ulong_t)addr, clmp, dlip, info, flags);
1385 }
1386 
1387 #pragma weak dladdr = _dladdr
1388 
1389 /*
1390  * External entry for dladdr(3dl) and dladdr1(3dl).  Returns an information
1391  * structure that reflects the symbol closest to the address specified.
1392  */
1393 int
1394 _dladdr(void *addr, Dl_info *dlip)
1395 {
1396 	int	entry, error;
1397 	Rt_map	*clmp;
1398 
1399 	entry = enter();
1400 
1401 	/*
1402 	 * Use our calling technique to determine what object is associated
1403 	 * with the supplied address.  If a caller can't be determined,
1404 	 * indicate the failure.
1405 	 */
1406 	if ((clmp = _caller((caddr_t)addr, CL_NONE)) == 0) {
1407 		eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1408 		    EC_NATPTR(addr));
1409 		error = 0;
1410 	} else {
1411 		dladdr_core(clmp, addr, dlip, 0, 0);
1412 		error = 1;
1413 	}
1414 
1415 	if (entry)
1416 		leave(0);
1417 	return (error);
1418 }
1419 
1420 #pragma weak dladdr1 = _dladdr1
1421 
1422 int
1423 _dladdr1(void *addr, Dl_info *dlip, void **info, int flags)
1424 {
1425 	int	entry, error = 0;
1426 	Rt_map	*clmp;
1427 
1428 	/*
1429 	 * Validate any flags.
1430 	 */
1431 	if (flags) {
1432 		int	request;
1433 
1434 		if (((request = (flags & RTLD_DL_MASK)) != RTLD_DL_SYMENT) &&
1435 		    (request != RTLD_DL_LINKMAP)) {
1436 			eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_ILLFLAGS),
1437 			    flags);
1438 			return (0);
1439 		}
1440 		if (info == 0) {
1441 			eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_ILLINFO), flags);
1442 			return (0);
1443 		}
1444 	}
1445 
1446 	entry = enter();
1447 
1448 	/*
1449 	 * Use our calling technique to determine what object is associated
1450 	 * with the supplied address.  If a caller can't be determined,
1451 	 * indicate the failure.
1452 	 */
1453 	if ((clmp = _caller((caddr_t)addr, CL_NONE)) == 0) {
1454 		eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1455 		    EC_NATPTR(addr));
1456 		error = 0;
1457 	} else {
1458 		dladdr_core(clmp, addr, dlip, info, flags);
1459 		error = 1;
1460 	}
1461 
1462 	if (entry)
1463 		leave(0);
1464 	return (error);
1465 }
1466 
1467 /*
1468  * Core dldump activity.
1469  */
1470 static int
1471 dldump_core(Lm_list *lml, const char *ipath, const char *opath, int flags)
1472 {
1473 	Addr	addr = 0;
1474 	Rt_map	*lmp;
1475 
1476 	/*
1477 	 * Verify any arguments first.
1478 	 */
1479 	if ((!opath || (*opath == '\0')) || (ipath && (*ipath == '\0'))) {
1480 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
1481 		return (1);
1482 	}
1483 
1484 	/*
1485 	 * If an input file is specified make sure its one of our dependencies
1486 	 * on the main link-map list.  Note, this has really all evolved for
1487 	 * crle(), which uses libcrle.so on an alternative link-map to trigger
1488 	 * dumping objects from the main link-map list.   If we ever want to
1489 	 * dump objects from alternative link-maps, this model is going to
1490 	 * have to be revisited.
1491 	 */
1492 	if (ipath) {
1493 		if ((lmp = is_so_loaded(&lml_main, ipath)) == 0) {
1494 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NOFILE),
1495 			    ipath);
1496 			return (1);
1497 		}
1498 		if (FLAGS(lmp) & FLG_RT_ALTER) {
1499 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_ALTER), ipath);
1500 			return (1);
1501 		}
1502 		if (FLAGS(lmp) & FLG_RT_NODUMP) {
1503 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NODUMP),
1504 			    ipath);
1505 			return (1);
1506 		}
1507 	} else
1508 		lmp = lml_main.lm_head;
1509 
1510 
1511 	DBG_CALL(Dbg_file_dldump(lmp, opath, flags));
1512 
1513 	/*
1514 	 * If the object being dump'ed isn't fixed identify its mapping.
1515 	 */
1516 	if (!(FLAGS(lmp) & FLG_RT_FIXED))
1517 		addr = ADDR(lmp);
1518 
1519 	/*
1520 	 * As rt_dldump() will effectively lazy load the necessary support
1521 	 * libraries, make sure ld.so.1 is initialized for plt relocations.
1522 	 */
1523 	if (elf_rtld_load() == 0)
1524 		return (0);
1525 
1526 	/*
1527 	 * Dump the required image.
1528 	 */
1529 	return (rt_dldump(lmp, opath, flags, addr));
1530 }
1531 
1532 #pragma weak dldump = _dldump
1533 
1534 /*
1535  * External entry for dldump(3c).  Returns 0 on success, non-zero otherwise.
1536  */
1537 int
1538 _dldump(const char *ipath, const char *opath, int flags)
1539 {
1540 	int	error, entry;
1541 	Rt_map	*clmp;
1542 
1543 	entry = enter();
1544 
1545 	clmp = _caller(caller(), CL_EXECDEF);
1546 
1547 	error = dldump_core(LIST(clmp), ipath, opath, flags);
1548 
1549 	if (entry)
1550 		leave(LIST(clmp));
1551 	return (error);
1552 }
1553 
1554 /*
1555  * get_linkmap_id() translates Lm_list * pointers to the Link_map id as used by
1556  * the rtld_db and dlmopen() interfaces.  It checks to see if the Link_map is
1557  * one of the primary ones and if so returns it's special token:
1558  *		LM_ID_BASE
1559  *		LM_ID_LDSO
1560  *
1561  * If it's not one of the primary link_map id's it will instead returns a
1562  * pointer to the Lm_list structure which uniquely identifies the Link_map.
1563  */
1564 Lmid_t
1565 get_linkmap_id(Lm_list *lml)
1566 {
1567 	if (lml->lm_flags & LML_FLG_BASELM)
1568 		return (LM_ID_BASE);
1569 	if (lml->lm_flags & LML_FLG_RTLDLM)
1570 		return (LM_ID_LDSO);
1571 
1572 	return ((Lmid_t)lml);
1573 }
1574 
1575 /*
1576  * Extract information for a dlopen() handle.
1577  */
1578 static int
1579 dlinfo_core(void *handle, int request, void *p, Rt_map *clmp)
1580 {
1581 	Lm_list	*lml = LIST(clmp);
1582 	Rt_map	*lmp;
1583 
1584 	if ((request > RTLD_DI_MAX) || (p == 0)) {
1585 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLVAL));
1586 		return (-1);
1587 	}
1588 
1589 	/*
1590 	 * Return configuration cache name and address.
1591 	 */
1592 	if (request == RTLD_DI_CONFIGADDR) {
1593 		Dl_info	*dlip = (Dl_info *)p;
1594 
1595 		if ((config->c_name == 0) || (config->c_bgn == 0) ||
1596 		    (config->c_end == 0)) {
1597 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOCONFIG));
1598 			return (-1);
1599 		}
1600 		dlip->dli_fname = config->c_name;
1601 		dlip->dli_fbase = (void *)config->c_bgn;
1602 		return (0);
1603 	}
1604 
1605 	/*
1606 	 * Return profiled object name (used by ldprof audit library).
1607 	 */
1608 	if (request == RTLD_DI_PROFILENAME) {
1609 		if (profile_name == 0) {
1610 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOPROFNAME));
1611 			return (-1);
1612 		}
1613 
1614 		*(const char **)p = profile_name;
1615 		return (0);
1616 	}
1617 	if (request == RTLD_DI_PROFILEOUT) {
1618 		/*
1619 		 * If a profile destination directory hasn't been specified
1620 		 * provide a default.
1621 		 */
1622 		if (profile_out == 0)
1623 			profile_out = MSG_ORIG(MSG_PTH_VARTMP);
1624 
1625 		*(const char **)p = profile_out;
1626 		return (0);
1627 	}
1628 
1629 	/*
1630 	 * Obtain or establish a termination signal.
1631 	 */
1632 	if (request == RTLD_DI_GETSIGNAL) {
1633 		*(int *)p = killsig;
1634 		return (0);
1635 	}
1636 
1637 	if (request == RTLD_DI_SETSIGNAL) {
1638 		sigset_t	set;
1639 		int		sig = *(int *)p;
1640 
1641 		/*
1642 		 * Determine whether the signal is in range.
1643 		 */
1644 		(void) sigfillset(&set);
1645 		if (sigismember(&set, sig) != 1) {
1646 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVSIG), sig);
1647 			return (-1);
1648 		}
1649 
1650 		killsig = sig;
1651 		return (0);
1652 	}
1653 
1654 	/*
1655 	 * For any other request a link-map is required.  Verify the handle.
1656 	 */
1657 	if (handle == RTLD_SELF)
1658 		lmp = clmp;
1659 	else {
1660 		Grp_hdl	*ghp = (Grp_hdl *)handle;
1661 
1662 		if (!hdl_validate(ghp)) {
1663 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL));
1664 			return (-1);
1665 		}
1666 		lmp = ghp->gh_ownlmp;
1667 	}
1668 
1669 	/*
1670 	 * Obtain the process arguments, environment and auxv.  Note, as the
1671 	 * environment can be modified by the user (putenv(3c)), reinitialize
1672 	 * the environment pointer on each request.
1673 	 */
1674 	if (request == RTLD_DI_ARGSINFO) {
1675 		Dl_argsinfo	*aip = (Dl_argsinfo *)p;
1676 		Lm_list		*lml = LIST(lmp);
1677 
1678 		*aip = argsinfo;
1679 		if (lml->lm_flags & LML_FLG_ENVIRON)
1680 			aip->dla_envp = *(lml->lm_environ);
1681 
1682 		return (0);
1683 	}
1684 
1685 	/*
1686 	 * Return Lmid_t of the Link-Map list that the specified object is
1687 	 * loaded on.
1688 	 */
1689 	if (request == RTLD_DI_LMID) {
1690 		*(Lmid_t *)p = get_linkmap_id(LIST(lmp));
1691 		return (0);
1692 	}
1693 
1694 	/*
1695 	 * Return a pointer to the Link-Map structure associated with the
1696 	 * specified object.
1697 	 */
1698 	if (request == RTLD_DI_LINKMAP) {
1699 		*(Link_map **)p = (Link_map *)lmp;
1700 		return (0);
1701 	}
1702 
1703 	/*
1704 	 * Return search path information, or the size of the buffer required
1705 	 * to store the information.
1706 	 */
1707 	if ((request == RTLD_DI_SERINFO) || (request == RTLD_DI_SERINFOSIZE)) {
1708 		Pnode		*dir, *dirlist = (Pnode *)0;
1709 		Dl_serinfo	*info;
1710 		Dl_serpath	*path;
1711 		char		*strs;
1712 		size_t		size = sizeof (Dl_serinfo);
1713 		uint_t		cnt = 0;
1714 
1715 		info = (Dl_serinfo *)p;
1716 		path = &info->dls_serpath[0];
1717 		strs = (char *)&info->dls_serpath[info->dls_cnt];
1718 
1719 		/*
1720 		 * Traverse search path entries for this object.
1721 		 */
1722 		while ((dir = get_next_dir(&dirlist, lmp, 0)) != 0) {
1723 			size_t	_size;
1724 
1725 			if (dir->p_name == 0)
1726 				continue;
1727 
1728 			/*
1729 			 * If configuration information exists, it's possible
1730 			 * this path has been identified as non-existent, if so
1731 			 * ignore it.
1732 			 */
1733 			if (dir->p_info) {
1734 				Rtc_obj	*dobj = (Rtc_obj *)dir->p_info;
1735 				if (dobj->co_flags & RTC_OBJ_NOEXIST)
1736 					continue;
1737 			}
1738 
1739 			/*
1740 			 * Keep track of search path count and total info size.
1741 			 */
1742 			if (cnt++)
1743 				size += sizeof (Dl_serpath);
1744 			_size = strlen(dir->p_name) + 1;
1745 			size += _size;
1746 
1747 			if (request == RTLD_DI_SERINFOSIZE)
1748 				continue;
1749 
1750 			/*
1751 			 * If we're filling in search path information, confirm
1752 			 * there's sufficient space.
1753 			 */
1754 			if (size > info->dls_size) {
1755 				eprintf(lml, ERR_FATAL,
1756 				    MSG_INTL(MSG_ARG_SERSIZE),
1757 				    EC_OFF(info->dls_size));
1758 				return (-1);
1759 			}
1760 			if (cnt > info->dls_cnt) {
1761 				eprintf(lml, ERR_FATAL,
1762 				    MSG_INTL(MSG_ARG_SERCNT), info->dls_cnt);
1763 				return (-1);
1764 			}
1765 
1766 			/*
1767 			 * Append the path to the information buffer.
1768 			 */
1769 			(void) strcpy(strs, dir->p_name);
1770 			path->dls_name = strs;
1771 			path->dls_flags = dir->p_orig;
1772 
1773 			strs = strs + _size;
1774 			path++;
1775 		}
1776 
1777 		/*
1778 		 * If we're here to size the search buffer fill it in.
1779 		 */
1780 		if (request == RTLD_DI_SERINFOSIZE) {
1781 			info->dls_size = size;
1782 			info->dls_cnt = cnt;
1783 		}
1784 	}
1785 
1786 	/*
1787 	 * Return the origin of the object associated with this link-map.
1788 	 * Basically return the dirname(1) of the objects fullpath.
1789 	 */
1790 	if (request == RTLD_DI_ORIGIN) {
1791 		char	*str = (char *)p;
1792 
1793 		if (DIRSZ(lmp) == 0)
1794 			(void) fullpath(lmp, 0);
1795 
1796 		(void) strncpy(str, ORIGNAME(lmp), DIRSZ(lmp));
1797 		str += DIRSZ(lmp);
1798 		*str = '\0';
1799 
1800 		return (0);
1801 	}
1802 
1803 	return (0);
1804 }
1805 
1806 #pragma weak dlinfo = _dlinfo
1807 
1808 /*
1809  * External entry for dlinfo(3dl).
1810  */
1811 int
1812 _dlinfo(void *handle, int request, void *p)
1813 {
1814 	int	error, entry;
1815 	Rt_map	*clmp;
1816 
1817 	entry = enter();
1818 
1819 	clmp = _caller(caller(), CL_EXECDEF);
1820 
1821 	error = dlinfo_core(handle, request, p, clmp);
1822 
1823 	if (entry)
1824 		leave(LIST(clmp));
1825 	return (error);
1826 }
1827