xref: /titanic_50/usr/src/cmd/sgs/rtld/common/dlfcns.c (revision 8ef10d209f1443865a8ce5b1eb59838b64a64e67)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1988 AT&T
24  *	  All Rights Reserved
25  *
26  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
27  * Use is subject to license terms.
28  */
29 
30 #pragma ident	"%Z%%M%	%I%	%E% SMI"
31 
32 /*
33  * Programmatic interface to the run_time linker.
34  */
35 #include	"_synonyms.h"
36 
37 #include	<sys/debug.h>
38 #include	<stdio.h>
39 #include	<string.h>
40 #include	<dlfcn.h>
41 #include	<synch.h>
42 #include	<limits.h>
43 #include	<debug.h>
44 #include	"_rtld.h"
45 #include	"_audit.h"
46 #include	"_elf.h"
47 #include	"msg.h"
48 
49 /*
50  * Determine who called us - given a pc determine in which object it resides.
51  *
52  * For dlopen() the link map of the caller must be passed to load_so() so that
53  * the appropriate search rules (4.x or 5.0) are used to locate any
54  * dependencies.  Also, if we've been called from a 4.x module it may be
55  * necessary to fix the specified pathname so that it conforms with the 5.0 elf
56  * rules.
57  *
58  * For dlsym() the link map of the caller is used to determine RTLD_NEXT
59  * requests, together with requests based off of a dlopen(0).
60  * For dladdr() this routines provides a generic means of scanning all loaded
61  * segments.
62  */
63 Rt_map *
64 _caller(caddr_t cpc, int flags)
65 {
66 	Lm_list *	lml;
67 	Listnode *	lnp;
68 
69 	for (LIST_TRAVERSE(&dynlm_list, lnp, lml)) {
70 		Aliste	off;
71 		Lm_cntl	*lmc;
72 
73 		for (ALIST_TRAVERSE(lml->lm_lists, off, lmc)) {
74 			Rt_map	*lmp;
75 
76 			for (lmp = lmc->lc_head; lmp;
77 			    lmp = (Rt_map *)NEXT(lmp)) {
78 				Mmap	*mmap;
79 
80 				/*
81 				 * Traverse this objects mappings testing
82 				 * whether the pc falls within its range.
83 				 */
84 				for (mmap = MMAPS(lmp); mmap->m_vaddr; mmap++) {
85 					if ((cpc >= mmap->m_vaddr) && (cpc <
86 					    (mmap->m_vaddr + mmap->m_msize)))
87 						return (lmp);
88 				}
89 			}
90 		}
91 	}
92 
93 	/*
94 	 * No mapping can be determined.  If asked for a default, assume this
95 	 * is from the executable.
96 	 */
97 	if (flags & CL_EXECDEF)
98 		return ((Rt_map *)lml_main.lm_head);
99 
100 	return (0);
101 }
102 
103 #pragma weak dlerror = _dlerror
104 
105 /*
106  * External entry for dlerror(3dl).  Returns a pointer to the string describing
107  * the last occurring error.  The last occurring error is cleared.
108  */
109 char *
110 _dlerror()
111 {
112 	char	*error;
113 	Rt_map	*clmp;
114 	int	entry;
115 
116 	entry = enter();
117 
118 	clmp = _caller(caller(), CL_EXECDEF);
119 
120 	error = lasterr;
121 	lasterr = (char *)0;
122 
123 	if (entry)
124 		leave(LIST(clmp));
125 	return (error);
126 }
127 
128 /*
129  * Add a dependency as a group descriptor to a group handle.  Returns 0 on
130  * failure, ALE_EXISTS if the dependency already exists, or ALE_CREATE if it
131  * is newly created.
132  */
133 int
134 hdl_add(Grp_hdl *ghp, Rt_map *lmp, uint_t flags)
135 {
136 	Grp_desc	*gdp;
137 	Aliste		off;
138 	int		found = ALE_CREATE;
139 	uint_t		oflags;
140 
141 	/*
142 	 * Make sure this dependency hasn't already been recorded.
143 	 */
144 	for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
145 		if (gdp->gd_depend == lmp) {
146 			found = ALE_EXISTS;
147 			break;
148 		}
149 	}
150 
151 	if (found == ALE_CREATE) {
152 		Grp_desc	gd;
153 
154 		/*
155 		 * Create a new handle descriptor.
156 		 */
157 		gd.gd_depend = lmp;
158 		gd.gd_flags = 0;
159 
160 		/*
161 		 * Indicate this object is a part of this handles group.
162 		 */
163 		if (alist_append(&GROUPS(lmp), &ghp,
164 		    sizeof (Grp_hdl *), AL_CNT_GROUPS) == 0)
165 			return (0);
166 
167 		/*
168 		 * Append the new dependency to this handle.
169 		 */
170 		if ((gdp = alist_append(&(ghp->gh_depends), &gd,
171 		    sizeof (Grp_desc), AL_CNT_DEPENDS)) == 0)
172 			return (0);
173 	}
174 
175 	oflags = gdp->gd_flags;
176 	gdp->gd_flags |= flags;
177 
178 	if (DBG_ENABLED) {
179 		if (found == ALE_CREATE)
180 			DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_ADD,
181 			    gdp->gd_flags));
182 		else if (gdp->gd_flags != oflags)
183 			DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_UPDATE,
184 			    gdp->gd_flags));
185 	}
186 	return (found);
187 }
188 
189 /*
190  * Allocate a handle and record its existence on the handle list for future
191  * verification.
192  */
193 Grp_hdl *
194 hdl_alloc()
195 {
196 	Grp_hdl	*ghp;
197 	uint_t	ndx;
198 
199 	if ((ghp = calloc(sizeof (Grp_hdl), 1)) == 0)
200 		return (0);
201 
202 	/* LINTED */
203 	ndx = (uintptr_t)ghp % HDLIST_SZ;
204 
205 	if (list_append(&hdl_list[ndx], ghp) == 0) {
206 		free(ghp);
207 		return (0);
208 	}
209 	return (ghp);
210 }
211 
212 /*
213  * Create a handle.
214  */
215 Grp_hdl *
216 hdl_create(Lm_list *lml, Rt_map *nlmp, Rt_map *clmp, uint_t hflags,
217     uint_t ndflags, uint_t cdflags)
218 {
219 	Grp_hdl	*ghp = 0, **ghpp;
220 	Alist	**alpp;
221 	Aliste	off;
222 
223 	/*
224 	 * For dlopen(0) the handle is maintained as part of the link-map list,
225 	 * otherwise it is associated with the referenced link-map.
226 	 */
227 	if (hflags & GPH_ZERO)
228 		alpp = &(lml->lm_handle);
229 	else
230 		alpp = &(HANDLES(nlmp));
231 
232 	/*
233 	 * Objects can contain multiple handles depending on the handle flags
234 	 * supplied.  Most RTLD flags pertain to the object itself and the
235 	 * bindings that it can achieve.  Multiple handles for these flags
236 	 * don't make sense.  But if the flag determines how the handle might
237 	 * be used, then multiple handles may exist.  Presently this only makes
238 	 * sense for RTLD_FIRST.  Determine if an appropriate handle already
239 	 * exists.
240 	 */
241 	for (ALIST_TRAVERSE(*alpp, off, ghpp)) {
242 		if (((*ghpp)->gh_flags & GPH_FIRST) == (hflags & GPH_FIRST)) {
243 			ghp = *ghpp;
244 			break;
245 		}
246 	}
247 
248 	if (ghp == 0) {
249 		DBG_CALL(Dbg_file_hdl_title(DBG_HDL_CREATE));
250 
251 		/*
252 		 * If this is the first dlopen() request for this handle
253 		 * allocate and initialize a new handle.
254 		 */
255 		if ((ghp = hdl_alloc()) == 0)
256 			return (0);
257 
258 		if (alist_append(alpp, &ghp, sizeof (Grp_hdl *),
259 		    AL_CNT_GROUPS) == 0)
260 			return (0);
261 
262 		/*
263 		 * Indicate that this object has been referenced.  In truth a
264 		 * reference hasn't yet occurred, it's a dlsym() that makes the
265 		 * reference.  However, we assume that anyone performing a
266 		 * dlopen() will eventually call dlsym(), plus this makes for a
267 		 * better diagnostic location rather than having to call
268 		 * unused() after every dlsym() operation.
269 		 */
270 		if (nlmp)
271 			FLAGS1(nlmp) |= FL1_RT_USED;
272 
273 		ghp->gh_refcnt = 1;
274 		ghp->gh_flags = hflags;
275 
276 		/*
277 		 * A dlopen(0) handle is identified by the GPH_ZERO flag, the
278 		 * head of the link-map list is defined as the owner.  There is
279 		 * no need to maintain a list of dependencies, for when this
280 		 * handle is used (for dlsym()) a dynamic search through the
281 		 * entire link-map list provides for searching all objects with
282 		 * GLOBAL visibility.
283 		 */
284 		if (hflags & GPH_ZERO) {
285 			ghp->gh_ownlmp = lml->lm_head;
286 			ghp->gh_ownlml = lml;
287 		} else {
288 			ghp->gh_ownlmp = nlmp;
289 			ghp->gh_ownlml = LIST(nlmp);
290 
291 			if (hdl_add(ghp, nlmp, ndflags) == 0)
292 				return (0);
293 
294 			/*
295 			 * Indicate that a local group now exists.  This state
296 			 * allows singleton searches to be optimized.
297 			 */
298 			if ((hflags & GPH_LDSO) == 0)
299 				LIST(nlmp)->lm_flags |= LML_FLG_GROUPSEXIST;
300 		}
301 	} else {
302 		/*
303 		 * If a handle already exists, bump its reference count.
304 		 *
305 		 * If the previous reference count was 0, then this is a handle
306 		 * that an earlier call to dlclose() was unable to remove.  Such
307 		 * handles are put on the orphan list.  As this handle is back
308 		 * in use, it must be removed from the orphan list.
309 		 *
310 		 * Note, handles associated with a link-map list itself (i.e.
311 		 * dlopen(0)) can have a reference count of 0.  However, these
312 		 * handles are never deleted, and therefore are never moved to
313 		 * the orphan list.
314 		 */
315 		if ((ghp->gh_refcnt++ == 0) &&
316 		    ((ghp->gh_flags & GPH_ZERO) == 0)) {
317 			uint_t	ndx;
318 
319 			/* LINTED */
320 			ndx = (uintptr_t)ghp % HDLIST_SZ;
321 
322 			list_delete(&hdl_list[HDLIST_ORP], ghp);
323 			(void) list_append(&hdl_list[ndx], ghp);
324 
325 			if (DBG_ENABLED) {
326 				Aliste		off;
327 				Grp_desc	*gdp;
328 
329 				DBG_CALL(Dbg_file_hdl_title(DBG_HDL_REINST));
330 				for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp))
331 					DBG_CALL(Dbg_file_hdl_action(ghp,
332 					    gdp->gd_depend, DBG_DEP_REINST, 0));
333 			}
334 		}
335 	}
336 
337 	/*
338 	 * Keep track of the parent (caller).  As this object could be opened
339 	 * by different parents, this processing is carried out every time a
340 	 * handle is requested.
341 	 */
342 	if (clmp && (hdl_add(ghp, clmp, cdflags) == 0))
343 		return (0);
344 
345 	return (ghp);
346 }
347 
348 /*
349  * Initialize a handle that has been created for an object that is already
350  * loaded.  The handle is initialized with the present dependencies of that
351  * object.  Once this initialization has occurred, any new objects that might
352  * be loaded as dependencies (lazy-loading) are added to the handle as each new
353  * object is loaded.
354  */
355 int
356 hdl_initialize(Grp_hdl *ghp, Rt_map *nlmp, int mode, int promote)
357 {
358 	Aliste		off;
359 	Grp_desc	*gdp;
360 
361 	/*
362 	 * If the handle has already been initialized, and the initial object's
363 	 * mode hasn't been promoted, there's no need to recompute the modes of
364 	 * any dependencies.  If the object we've added has just been opened,
365 	 * the objects dependencies will not yet have been processed.  These
366 	 * dependencies will be added on later calls to load_one().  Otherwise,
367 	 * this object already exists, so add all of its dependencies to the
368 	 * handle were operating on.
369 	 */
370 	if (((ghp->gh_flags & GPH_INITIAL) && (promote == 0)) ||
371 	    ((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0)) {
372 		ghp->gh_flags |= GPH_INITIAL;
373 		return (1);
374 	}
375 
376 	DBG_CALL(Dbg_file_hdl_title(DBG_HDL_ADD));
377 	for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
378 		Rt_map *	lmp = gdp->gd_depend;
379 		Aliste		off1;
380 		Bnd_desc **	bdpp;
381 
382 		/*
383 		 * If this dependency doesn't indicate that its dependencies
384 		 * should be added to a handle, ignore it.  This case identifies
385 		 * a parent of a dlopen(RTLD_PARENT) request.
386 		 */
387 		if ((gdp->gd_flags & GPD_ADDEPS) == 0)
388 			continue;
389 
390 		for (ALIST_TRAVERSE(DEPENDS(lmp), off1, bdpp)) {
391 			Bnd_desc	*bdp = *bdpp;
392 			Rt_map		*dlmp = bdp->b_depend;
393 
394 			if ((bdp->b_flags & BND_NEEDED) == 0)
395 				continue;
396 
397 			if (hdl_add(ghp, dlmp,
398 			    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS)) == 0)
399 				return (0);
400 
401 			(void) update_mode(dlmp, MODE(dlmp), mode);
402 		}
403 	}
404 	ghp->gh_flags |= GPH_INITIAL;
405 	return (1);
406 }
407 
408 /*
409  * Sanity check a program-provided handle.
410  */
411 static int
412 hdl_validate(Grp_hdl *ghp)
413 {
414 	Listnode	*lnp;
415 	Grp_hdl		*lghp;
416 	uint_t		ndx;
417 
418 	/* LINTED */
419 	ndx = (uintptr_t)ghp % HDLIST_SZ;
420 
421 	for (LIST_TRAVERSE(&hdl_list[ndx], lnp, lghp)) {
422 		if ((lghp == ghp) && (ghp->gh_refcnt != 0))
423 			return (1);
424 	}
425 	return (0);
426 }
427 
428 /*
429  * Core dlclose activity.
430  */
431 int
432 dlclose_core(Grp_hdl *ghp, Rt_map *clmp, Lm_list *lml)
433 {
434 	int	error;
435 
436 	/*
437 	 * If we're already at atexit() there's no point processing further,
438 	 * all objects have already been tsorted for fini processing.
439 	 */
440 	if ((rtld_flags & RT_FL_ATEXIT) != 0)
441 		return (0);
442 
443 	/*
444 	 * Diagnose what we're up to.
445 	 */
446 	if (ghp->gh_flags & GPH_ZERO) {
447 		DBG_CALL(Dbg_file_dlclose(LIST(clmp), MSG_ORIG(MSG_STR_ZERO),
448 		    DBG_DLCLOSE_IGNORE));
449 	} else {
450 		DBG_CALL(Dbg_file_dlclose(LIST(clmp), NAME(ghp->gh_ownlmp),
451 		    DBG_DLCLOSE_NULL));
452 	}
453 
454 
455 	/*
456 	 * Decrement reference count of this object.
457 	 */
458 	if (--(ghp->gh_refcnt))
459 		return (0);
460 
461 	/*
462 	 * If this handle is special (dlopen(0)), then leave it around - it
463 	 * has little overhead.
464 	 */
465 	if (ghp->gh_flags & GPH_ZERO)
466 		return (0);
467 
468 	/*
469 	 * This handle is no longer being referenced, remove it.  If this handle
470 	 * is part of an alternative link-map list, determine if the whole list
471 	 * can be removed also.
472 	 */
473 	error = remove_hdl(ghp, clmp, 0);
474 
475 	if ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)
476 		remove_lml(lml);
477 
478 	return (error);
479 }
480 
481 /*
482  * Internal dlclose activity.  Called from user level or directly for internal
483  * error cleanup.
484  */
485 int
486 dlclose_intn(Grp_hdl *ghp, Rt_map *clmp)
487 {
488 	Rt_map	*nlmp = 0;
489 	Lm_list	*olml = 0;
490 	int	error;
491 
492 	/*
493 	 * Although we're deleting object(s) it's quite possible that additional
494 	 * objects get loaded from running the .fini section(s) of the objects
495 	 * being deleted.  These objects will have been added to the same
496 	 * link-map list as those objects being deleted.  Remember this list
497 	 * for later investigation.
498 	 */
499 	olml = ghp->gh_ownlml;
500 
501 	error = dlclose_core(ghp, clmp, olml);
502 
503 	/*
504 	 * Determine whether the original link-map list still exists.  In the
505 	 * case of a dlclose of an alternative (dlmopen) link-map the whole
506 	 * list may have been removed.
507 	 */
508 	if (olml) {
509 		Listnode	*lnp;
510 		Lm_list		*lml;
511 
512 		for (LIST_TRAVERSE(&dynlm_list, lnp, lml)) {
513 			if (olml == lml) {
514 				nlmp = olml->lm_head;
515 				break;
516 			}
517 		}
518 	}
519 	load_completion(nlmp);
520 	return (error);
521 }
522 
523 /*
524  * Argument checking for dlclose.  Only called via external entry.
525  */
526 static int
527 dlclose_check(void *handle, Rt_map *clmp)
528 {
529 	Grp_hdl	*ghp = (Grp_hdl *)handle;
530 
531 	if (hdl_validate(ghp) == 0) {
532 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL));
533 		return (1);
534 	}
535 	return (dlclose_intn(ghp, clmp));
536 }
537 
538 #pragma weak dlclose = _dlclose
539 
540 /*
541  * External entry for dlclose(3dl).  Returns 0 for success, non-zero otherwise.
542  */
543 int
544 _dlclose(void *handle)
545 {
546 	int		error, entry;
547 	Rt_map		*clmp;
548 
549 	entry = enter();
550 
551 	clmp = _caller(caller(), CL_EXECDEF);
552 
553 	error = dlclose_check(handle, clmp);
554 
555 	if (entry)
556 		leave(LIST(clmp));
557 	return (error);
558 }
559 
560 static uint_t	lmid = 0;
561 
562 /*
563  * The addition of new link-map lists is assumed to be in small quantities.
564  * Here, we assign a unique link-map id for diagnostic use.  Simply update the
565  * running link-map count until we max out.
566  */
567 int
568 newlmid(Lm_list *lml)
569 {
570 	char	buffer[MSG_LMID_ALT_SIZE + 12];
571 
572 	if (lmid == UINT_MAX) {
573 		lml->lm_lmid = UINT_MAX;
574 		(void) strncpy(buffer, MSG_ORIG(MSG_LMID_MAXED),
575 		    MSG_LMID_ALT_SIZE + 12);
576 	} else {
577 		lml->lm_lmid = lmid++;
578 		(void) snprintf(buffer, MSG_LMID_ALT_SIZE + 12,
579 		    MSG_ORIG(MSG_LMID_FMT), MSG_ORIG(MSG_LMID_ALT),
580 		    lml->lm_lmid);
581 	}
582 	if ((lml->lm_lmidstr = strdup(buffer)) == 0)
583 		return (0);
584 
585 	return (1);
586 }
587 
588 /*
589  * Core dlopen activity.
590  */
591 static Grp_hdl *
592 dlmopen_core(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
593     uint_t flags, uint_t orig)
594 {
595 	Rt_map	*nlmp;
596 	Grp_hdl	*ghp;
597 	Pnode	*pnp;
598 	Aliste	olmco, nlmco;
599 	Lm_cntl	*lmc;
600 
601 	DBG_CALL(Dbg_file_dlopen(clmp,
602 	    (path ? path : MSG_ORIG(MSG_STR_ZERO)), mode));
603 
604 	/*
605 	 * If the path specified is null then we're operating on global
606 	 * objects.  Associate a dummy handle with the link-map list.
607 	 */
608 	if (path == 0) {
609 		Grp_hdl *ghp;
610 		uint_t	hflags = GPH_ZERO, cdflags = GPD_PARENT;
611 		int	promote = 0;
612 
613 		/*
614 		 * Establish any flags for the handle (Grp_hdl).
615 		 *
616 		 *  .	This is a dummy handle (0) that provides for a dynamic
617 		 *	search of all global objects within the process.
618 		 *
619 		 *  .   Use of the RTLD_FIRST flag indicates that only the first
620 		 *	dependency on the handle (the new object) can be used
621 		 *	to satisfy dlsym() requests.
622 		 */
623 		if (mode & RTLD_FIRST)
624 			hflags |= GPH_FIRST;
625 
626 		/*
627 		 * Establish the flags for this callers dependency descriptor
628 		 * (Grp_desc).
629 		 *
630 		 *  .	The explicit creation of a handle creates a descriptor
631 		 *	for the new object and the parent (caller),
632 		 *
633 		 *  .	Use of the RTLD_PARENT flag indicates that the parent
634 		 *	can be relocated against.
635 		 */
636 		if (mode & RTLD_PARENT)
637 			cdflags |= GPD_RELOC;
638 
639 		if ((ghp = hdl_create(lml, 0, clmp, hflags,
640 		    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS), cdflags)) == 0)
641 			return (0);
642 
643 		/*
644 		 * Traverse the main link-map control list, updating the mode
645 		 * of any objects as necessary.  Call the relocation engine if
646 		 * this mode promotes the existing state of any relocations.
647 		 * crle()'s first pass loads all objects necessary for building
648 		 * a configuration file, however none of them are relocated.
649 		 * crle()'s second pass relocates objects in preparation for
650 		 * dldump()'ing using dlopen(0, RTLD_NOW).
651 		 */
652 		if ((mode & (RTLD_NOW | RTLD_CONFGEN)) == RTLD_CONFGEN)
653 			return (ghp);
654 
655 		for (nlmp = lml->lm_head; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
656 			if (((MODE(nlmp) & RTLD_GLOBAL) == 0) ||
657 			    (FLAGS(nlmp) & FLG_RT_DELETE))
658 				continue;
659 
660 			if (update_mode(nlmp, MODE(nlmp), mode))
661 				promote = 1;
662 		}
663 		if (promote)
664 			(void) relocate_lmc(lml, ALO_DATA, clmp, lml->lm_head);
665 
666 		return (ghp);
667 	}
668 
669 	/*
670 	 * Fix the pathname.  If this object expands to multiple paths (ie.
671 	 * $ISALIST or $HWCAP have been used), then make sure the user has also
672 	 * furnished the RTLD_FIRST flag.  As yet, we don't support opening
673 	 * more than one object at a time, so enforcing the RTLD_FIRST flag
674 	 * provides flexibility should we be able to support dlopening more
675 	 * than one object in the future.
676 	 */
677 	if ((pnp = LM_FIX_NAME(clmp)(path, clmp, orig)) == 0)
678 		return (0);
679 
680 	if (((pnp->p_orig & (PN_TKN_ISALIST | PN_TKN_HWCAP)) || pnp->p_next) &&
681 	    ((mode & RTLD_FIRST) == 0)) {
682 		remove_pnode(pnp);
683 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_5));
684 		return (0);
685 	}
686 
687 	/*
688 	 * Create a new link-map control list for this request, and load the
689 	 * associated object.
690 	 */
691 	if ((lmc = alist_append(&(lml->lm_lists), 0, sizeof (Lm_cntl),
692 	    AL_CNT_LMLISTS)) == 0) {
693 		remove_pnode(pnp);
694 		return (0);
695 	}
696 	olmco = nlmco = (Aliste)((char *)lmc - (char *)lml->lm_lists);
697 
698 	nlmp = load_one(lml, nlmco, pnp, clmp, mode,
699 	    (flags | FLG_RT_HANDLE), &ghp);
700 
701 	/*
702 	 * Remove any expanded pathname infrastructure, and if the dependency
703 	 * couldn't be loaded, cleanup.
704 	 */
705 	remove_pnode(pnp);
706 	if (nlmp == 0) {
707 		remove_cntl(lml, olmco);
708 		return (0);
709 	}
710 
711 	/*
712 	 * If loading an auditor was requested, and the auditor already existed,
713 	 * then the link-map returned will be to the original auditor.  The new
714 	 * link-map list that was initially created, and the associated link-map
715 	 * control list are no longer needed.  As the auditor is already loaded,
716 	 * we're probably done, but fall through in case additional relocations
717 	 * would be triggered by the mode of the caller.
718 	 */
719 	if ((flags & FLG_RT_AUDIT) && (LIST(nlmp) != lml)) {
720 		remove_cntl(lml, olmco);
721 		lml = LIST(nlmp);
722 		olmco = 0;
723 		nlmco = ALO_DATA;
724 	}
725 
726 	/*
727 	 * Finish processing the objects associated with this request.
728 	 */
729 	if ((analyze_lmc(lml, nlmco, nlmp) == 0) ||
730 	    (relocate_lmc(lml, nlmco, clmp, nlmp) == 0)) {
731 		ghp = 0;
732 		nlmp = 0;
733 	}
734 
735 	/*
736 	 * If this lazyload has failed, and we've created a new link-map
737 	 * control list to which this request has added objects, then remove
738 	 * all the objects that have been associated to this request.
739 	 */
740 	if ((nlmp == 0) && olmco && lmc->lc_head)
741 		remove_lmc(lml, clmp, lmc, olmco, path);
742 
743 	/*
744 	 * Finally, remove any link-map control list that was created.
745 	 */
746 	if (olmco)
747 		remove_cntl(lml, olmco);
748 
749 	return (ghp);
750 }
751 
752 /*
753  * Internal dlopen() activity.  Called from user level or directly for internal
754  * opens that require a handle.
755  */
756 Grp_hdl *
757 dlmopen_intn(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
758     uint_t flags, uint_t orig, int *loaded)
759 {
760 	Rt_map	*dlmp = 0;
761 	Grp_hdl	*ghp;
762 	int	objcnt;
763 
764 	/*
765 	 * Check for magic link-map list values:
766 	 *
767 	 *  LM_ID_BASE:		Operate on the PRIMARY (executables) link map
768 	 *  LM_ID_LDSO:		Operation on ld.so.1's link map
769 	 *  LM_ID_NEWLM: 	Create a new link-map.
770 	 */
771 	if (lml == (Lm_list *)LM_ID_NEWLM) {
772 		if ((lml = calloc(sizeof (Lm_list), 1)) == 0)
773 			return (0);
774 
775 		/*
776 		 * Establish the new link-map flags from the callers and those
777 		 * explicitly provided.
778 		 */
779 		lml->lm_tflags = LIST(clmp)->lm_tflags;
780 		if (flags & FLG_RT_AUDIT) {
781 			/*
782 			 * Unset any auditing flags - an auditor shouldn't be
783 			 * audited.  Insure all audit dependencies are loaded.
784 			 */
785 			lml->lm_tflags &= ~LML_TFLG_AUD_MASK;
786 			lml->lm_tflags |=
787 			    (LML_TFLG_NOLAZYLD | LML_TFLG_LOADFLTR);
788 			lml->lm_flags |= LML_FLG_NOAUDIT;
789 		}
790 
791 		if (list_append(&dynlm_list, lml) == 0) {
792 			free(lml);
793 			return (0);
794 		}
795 		if (newlmid(lml) == 0) {
796 			list_delete(&dynlm_list, lml);
797 			free(lml);
798 			return (0);
799 		}
800 	} else if ((uintptr_t)lml < LM_ID_NUM) {
801 		if ((uintptr_t)lml == LM_ID_BASE)
802 			lml = &lml_main;
803 		else if ((uintptr_t)lml == LM_ID_LDSO)
804 			lml = &lml_rtld;
805 	}
806 
807 	objcnt = lml->lm_obj;
808 
809 	/*
810 	 * Open the required object on the associated link-map list.
811 	 */
812 	if ((ghp = dlmopen_core(lml, path, mode, clmp, flags,
813 	    (orig | PN_SER_DLOPEN))) != 0) {
814 		/*
815 		 * Establish the new link-map from which .init processing will
816 		 * begin.  Ignore .init firing when constructing a configuration
817 		 * file (crle(1)).
818 		 */
819 		if ((mode & RTLD_CONFGEN) == 0)
820 			dlmp = ghp->gh_ownlmp;
821 	}
822 
823 	/*
824 	 * If loading an auditor was requested, and the auditor already existed,
825 	 * then the link-map returned will be to the original auditor.  Remove
826 	 * the link-map control list that was created for this request.
827 	 */
828 	if (dlmp && (flags & FLG_RT_AUDIT) && (LIST(dlmp) != lml)) {
829 		remove_lml(lml);
830 		lml = LIST(dlmp);
831 	}
832 
833 	/*
834 	 * Return the number of objects loaded if required.  This is used to
835 	 * trigger used() processing on return from a dlopen().
836 	 */
837 	if (loaded)
838 		*loaded = lml->lm_obj - objcnt;
839 
840 	/*
841 	 * If this load failed, remove any alternative link-map list.
842 	 */
843 	if ((ghp == 0) &&
844 	    ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)) {
845 		remove_lml(lml);
846 		lml = 0;
847 	}
848 
849 	/*
850 	 * Finish this load request.  If objects were loaded, .init processing
851 	 * is computed.  Finally, the debuggers are informed of the link-map
852 	 * lists being stable.
853 	 */
854 	load_completion(dlmp);
855 
856 	return (ghp);
857 }
858 
859 /*
860  * Argument checking for dlopen.  Only called via external entry.
861  */
862 static Grp_hdl *
863 dlmopen_check(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
864     int *loaded)
865 {
866 	/*
867 	 * Verify that a valid pathname has been supplied.
868 	 */
869 	if (path && (*path == '\0')) {
870 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
871 		return (0);
872 	}
873 
874 	/*
875 	 * Historically we've always verified the mode is either RTLD_NOW or
876 	 * RTLD_LAZY.  RTLD_NOLOAD is valid by itself.  Use of LM_ID_NEWLM
877 	 * requires a specific pathname, and use of RTLD_PARENT is meaningless.
878 	 */
879 	if ((mode & (RTLD_NOW | RTLD_LAZY | RTLD_NOLOAD)) == 0) {
880 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_1));
881 		return (0);
882 	}
883 	if ((mode & (RTLD_NOW | RTLD_LAZY)) == (RTLD_NOW | RTLD_LAZY)) {
884 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_2));
885 		return (0);
886 	}
887 	if ((lml == (Lm_list *)LM_ID_NEWLM) && (path == 0)) {
888 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_3));
889 		return (0);
890 	}
891 	if ((lml == (Lm_list *)LM_ID_NEWLM) && (mode & RTLD_PARENT)) {
892 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_4));
893 		return (0);
894 	}
895 	if (((mode & (RTLD_GROUP | RTLD_WORLD)) == 0) &&
896 	    ((mode & RTLD_NOLOAD) == 0))
897 		mode |= (RTLD_GROUP | RTLD_WORLD);
898 	if ((mode & RTLD_NOW) && (rtld_flags2 & RT_FL2_BINDLAZY)) {
899 		mode &= ~RTLD_NOW;
900 		mode |= RTLD_LAZY;
901 	}
902 
903 	return (dlmopen_intn(lml, path, mode, clmp, 0, 0, loaded));
904 }
905 
906 #pragma weak dlopen = _dlopen
907 
908 /*
909  * External entry for dlopen(3dl).  On success, returns a pointer (handle) to
910  * the structure containing information about the newly added object, ie. can
911  * be used by dlsym(). On failure, returns a null pointer.
912  */
913 void *
914 _dlopen(const char *path, int mode)
915 {
916 	int	entry, loaded = 0;
917 	Rt_map	*clmp;
918 	Grp_hdl	*ghp;
919 	Lm_list	*lml;
920 
921 	entry = enter();
922 
923 	clmp = _caller(caller(), CL_EXECDEF);
924 	lml = LIST(clmp);
925 
926 	ghp = dlmopen_check(lml, path, mode, clmp, &loaded);
927 
928 	if (entry && ghp && loaded)
929 		unused(lml);
930 
931 	if (entry)
932 		leave(lml);
933 	return ((void *)ghp);
934 }
935 
936 /*
937  * External entry for dlmopen(3dl).
938  */
939 #pragma weak dlmopen = _dlmopen
940 
941 void *
942 _dlmopen(Lmid_t lmid, const char *path, int mode)
943 {
944 	int	entry, loaded = 0;
945 	Rt_map	*clmp;
946 	Grp_hdl	*ghp;
947 
948 	entry = enter();
949 
950 	clmp = _caller(caller(), CL_EXECDEF);
951 
952 	ghp = dlmopen_check((Lm_list *)lmid, path, mode, clmp, &loaded);
953 
954 	if (entry && ghp && ghp->gh_ownlmp && loaded)
955 		unused(LIST(ghp->gh_ownlmp));
956 
957 	if (entry)
958 		leave(LIST(clmp));
959 	return ((void *)ghp);
960 }
961 
962 /*
963  * Handle processing for dlsym.
964  */
965 Sym *
966 dlsym_handle(Grp_hdl *ghp, Slookup *slp, Rt_map **_lmp, uint_t *binfo)
967 {
968 	Rt_map		*nlmp, * lmp = ghp->gh_ownlmp;
969 	Rt_map		*clmp = slp->sl_cmap;
970 	const char	*name = slp->sl_name;
971 	Sym		*sym = 0;
972 	Slookup		sl = *slp;
973 
974 	sl.sl_flags = (LKUP_FIRST | LKUP_SPEC);
975 
976 	/*
977 	 * Continue processing a dlsym request.  Lookup the required symbol in
978 	 * each link-map specified by the handle.
979 	 *
980 	 * To leverage off of lazy loading, dlsym() requests can result in two
981 	 * passes.  The first descends the link-maps of any objects already in
982 	 * the address space.  If the symbol isn't located, and lazy
983 	 * dependencies still exist, then a second pass is made to load these
984 	 * dependencies if applicable.  This model means that in the case where
985 	 * a symbols exists in more than one object, the one located may not be
986 	 * constant - this is the standard issue with lazy loading. In addition,
987 	 * attempting to locate a symbol that doesn't exist will result in the
988 	 * loading of all lazy dependencies on the given handle, which can
989 	 * defeat some of the advantages of lazy loading (look out JVM).
990 	 */
991 	if (ghp->gh_flags & GPH_ZERO) {
992 		Lm_list	*lml;
993 
994 		/*
995 		 * If this symbol lookup is triggered from a dlopen(0) handle,
996 		 * traverse the present link-map list looking for promiscuous
997 		 * entries.
998 		 */
999 		for (nlmp = lmp; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
1000 
1001 			/*
1002 			 * If this handle indicates we're only to look in the
1003 			 * first object check whether we're done.
1004 			 */
1005 			if ((nlmp != lmp) && (ghp->gh_flags & GPH_FIRST))
1006 				return ((Sym *)0);
1007 
1008 			if (!(MODE(nlmp) & RTLD_GLOBAL))
1009 				continue;
1010 			if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1011 			    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1012 				continue;
1013 
1014 			sl.sl_imap = nlmp;
1015 			if (sym = LM_LOOKUP_SYM(clmp)(&sl, _lmp, binfo))
1016 				return (sym);
1017 		}
1018 
1019 		/*
1020 		 * If we're unable to locate the symbol and this link-map still
1021 		 * has pending lazy dependencies, start loading them in an
1022 		 * attempt to exhaust the search.  Note that as we're already
1023 		 * traversing a dynamic linked list of link-maps there's no
1024 		 * need for elf_lazy_find_sym() to descend the link-maps itself.
1025 		 */
1026 		lml = LIST(lmp);
1027 		if ((lml->lm_lazy) &&
1028 		    ((lml->lm_flags & LML_FLG_NOPENDGLBLAZY) == 0)) {
1029 			int	lazy = 0;
1030 
1031 			DBG_CALL(Dbg_syms_lazy_rescan(lml, name));
1032 
1033 			sl.sl_flags |= LKUP_NODESCENT;
1034 
1035 			for (nlmp = lmp; nlmp; nlmp = (Rt_map *)NEXT(nlmp)) {
1036 
1037 				if (!(MODE(nlmp) & RTLD_GLOBAL) || !LAZY(nlmp))
1038 					continue;
1039 				if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1040 				    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1041 					continue;
1042 
1043 				lazy = 1;
1044 				sl.sl_imap = nlmp;
1045 				if (sym = elf_lazy_find_sym(&sl, _lmp, binfo))
1046 					return (sym);
1047 			}
1048 
1049 			/*
1050 			 * If no global, lazy loadable dependencies are found,
1051 			 * then none exist for this link-map list.  Pending lazy
1052 			 * loadable objects may still exist for non-local
1053 			 * objects that are associated with this link-map list,
1054 			 * which is why we entered this fallback.  Tag this
1055 			 * link-map list to prevent further searching for lazy
1056 			 * dependencies.
1057 			 */
1058 			if (lazy == 0)
1059 				lml->lm_flags |= LML_FLG_NOPENDGLBLAZY;
1060 		}
1061 	} else {
1062 		/*
1063 		 * Traverse the dlopen() handle for the presently loaded
1064 		 * link-maps.
1065 		 */
1066 		Grp_desc	*gdp;
1067 		Aliste		off;
1068 
1069 		for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
1070 			if ((gdp->gd_flags & GPD_DLSYM) == 0)
1071 				continue;
1072 
1073 			sl.sl_imap = gdp->gd_depend;
1074 			if (sym = LM_LOOKUP_SYM(clmp)(&sl, _lmp, binfo))
1075 				return (sym);
1076 
1077 			if (ghp->gh_flags & GPH_FIRST)
1078 				return ((Sym *)0);
1079 		}
1080 
1081 		/*
1082 		 * If we're unable to locate the symbol and this link-map still
1083 		 * has pending lazy dependencies, start loading them in an
1084 		 * attempt to exhaust the search.
1085 		 */
1086 		if ((LIST(lmp)->lm_lazy) &&
1087 		    ((ghp->gh_flags & GPH_NOPENDLAZY) == 0)) {
1088 			int	lazy = 0;
1089 
1090 			DBG_CALL(Dbg_syms_lazy_rescan(LIST(lmp), name));
1091 
1092 			for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
1093 				nlmp = gdp->gd_depend;
1094 
1095 				if (((gdp->gd_flags & GPD_DLSYM) == 0) ||
1096 				    (LAZY(nlmp) == 0))
1097 					continue;
1098 
1099 				lazy = 1;
1100 				sl.sl_imap = nlmp;
1101 				if (sym = elf_lazy_find_sym(&sl, _lmp, binfo))
1102 					return (sym);
1103 			}
1104 
1105 			/*
1106 			 * If no lazy loadable dependencies are found, then
1107 			 * none exist for this handle.  Pending lazy loadable
1108 			 * objects may still exist for the associated link-map
1109 			 * list, which is why we entered this fallback.  Tag
1110 			 * this handle to prevent further searching for lazy
1111 			 * dependencies.
1112 			 */
1113 			if (lazy == 0)
1114 				ghp->gh_flags |= GPH_NOPENDLAZY;
1115 		}
1116 	}
1117 	return ((Sym *)0);
1118 }
1119 
1120 /*
1121  * Core dlsym activity.  Selects symbol lookup method from handle.
1122  */
1123 void *
1124 dlsym_core(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1125 {
1126 	Sym		*sym = NULL;
1127 	Syminfo		*sip;
1128 	Slookup		sl;
1129 	uint_t		binfo;
1130 
1131 	sl.sl_name = name;
1132 	sl.sl_cmap = clmp;
1133 	sl.sl_rsymndx = 0;
1134 	sl.sl_rsym = 0;
1135 
1136 	/*
1137 	 * Standard relocations are evaluated using the symbol index of the
1138 	 * associated relocation symbol.  This index provides for loading
1139 	 * any lazy dependency and establishing a direct binding if necessary.
1140 	 * If a dlsym() operation originates from an object that contains a
1141 	 * symbol table entry for the same name, then establish the symbol
1142 	 * index so that any dependency requirements can be triggered.
1143 	 */
1144 	sl.sl_imap = clmp;
1145 	sl.sl_flags = LKUP_SYMNDX;
1146 	sl.sl_hash = elf_hash(name);
1147 
1148 	if ((FCT(clmp) == &elf_fct) &&
1149 	    ((sym = SYMINTP(clmp)(&sl, 0, 0)) != NULL)) {
1150 		sl.sl_rsymndx = (((ulong_t)sym -
1151 		    (ulong_t)SYMTAB(clmp)) / SYMENT(clmp));
1152 		sl.sl_rsym = sym;
1153 	}
1154 
1155 	if (sym && (ELF_ST_VISIBILITY(sym->st_other) == STV_SINGLETON)) {
1156 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1157 
1158 		/*
1159 		 * If a symbol reference is known, and that reference indicates
1160 		 * that the symbol is a singleton, then the search for the
1161 		 * symbol must follow the default search path.
1162 		 */
1163 		DBG_CALL(Dbg_syms_dlsym(clmp, name, 0, DBG_DLSYM_SINGLETON));
1164 
1165 		sl.sl_imap = hlmp;
1166 		sl.sl_flags = LKUP_SPEC;
1167 		if (handle == RTLD_PROBE)
1168 			sl.sl_flags |= LKUP_NOFALBACK;
1169 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1170 
1171 	} else if (handle == RTLD_NEXT) {
1172 		Rt_map	*nlmp;
1173 
1174 		/*
1175 		 * If this handle is RTLD_NEXT determine whether a lazy load
1176 		 * from the caller might provide the next object.  This mimics
1177 		 * the lazy loading initialization normally carried out by
1178 		 * lookup_sym(), however here, we must do this up-front, as
1179 		 * lookup_sym() will be used to inspect the next object.
1180 		 */
1181 		if ((sl.sl_rsymndx) && ((sip = SYMINFO(clmp)) != 0)) {
1182 			/* LINTED */
1183 			sip = (Syminfo *)((char *)sip +
1184 			    (sl.sl_rsymndx * SYMINENT(clmp)));
1185 
1186 			if ((sip->si_flags & SYMINFO_FLG_DIRECT) &&
1187 			    (sip->si_boundto < SYMINFO_BT_LOWRESERVE))
1188 				(void) elf_lazy_load(clmp,
1189 				    sip->si_boundto, name);
1190 
1191 			/*
1192 			 * Clear the symbol index, so as not to confuse
1193 			 * lookup_sym() of the next object.
1194 			 */
1195 			sl.sl_rsymndx = 0;
1196 			sl.sl_rsym = 0;
1197 		}
1198 
1199 		/*
1200 		 * If the handle is RTLD_NEXT start searching in the next link
1201 		 * map from the callers.  Determine permissions from the
1202 		 * present link map.  Indicate to lookup_sym() that we're on an
1203 		 * RTLD_NEXT request so that it will use the callers link map to
1204 		 * start any possible lazy dependency loading.
1205 		 */
1206 		sl.sl_imap = nlmp = (Rt_map *)NEXT(clmp);
1207 
1208 		DBG_CALL(Dbg_syms_dlsym(clmp, name, (nlmp ? NAME(nlmp) :
1209 		    MSG_INTL(MSG_STR_NULL)), DBG_DLSYM_NEXT));
1210 
1211 		if (nlmp == 0)
1212 			return (0);
1213 
1214 		sl.sl_flags = LKUP_NEXT;
1215 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1216 
1217 	} else if (handle == RTLD_SELF) {
1218 		/*
1219 		 * If the handle is RTLD_SELF start searching from the caller.
1220 		 */
1221 		DBG_CALL(Dbg_syms_dlsym(clmp, name, NAME(clmp),
1222 		    DBG_DLSYM_SELF));
1223 
1224 		sl.sl_imap = clmp;
1225 		sl.sl_flags = (LKUP_SPEC | LKUP_SELF);
1226 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1227 
1228 	} else if (handle == RTLD_DEFAULT) {
1229 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1230 
1231 		/*
1232 		 * If the handle is RTLD_DEFAULT mimic the standard symbol
1233 		 * lookup as would be triggered by a relocation.
1234 		 */
1235 		DBG_CALL(Dbg_syms_dlsym(clmp, name, 0, DBG_DLSYM_DEFAULT));
1236 
1237 		sl.sl_imap = hlmp;
1238 		sl.sl_flags = LKUP_SPEC;
1239 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1240 
1241 	} else if (handle == RTLD_PROBE) {
1242 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1243 
1244 		/*
1245 		 * If the handle is RTLD_PROBE, mimic the standard symbol
1246 		 * lookup as would be triggered by a relocation, however do
1247 		 * not fall back to a lazy loading rescan if the symbol can't be
1248 		 * found within the currently loaded objects.  Note, a lazy
1249 		 * loaded dependency required by the caller might still get
1250 		 * loaded to satisfy this request, but no exhaustive lazy load
1251 		 * rescan is carried out.
1252 		 */
1253 		DBG_CALL(Dbg_syms_dlsym(clmp, name, 0, DBG_DLSYM_PROBE));
1254 
1255 		sl.sl_imap = hlmp;
1256 		sl.sl_flags = (LKUP_SPEC | LKUP_NOFALBACK);
1257 		sym = LM_LOOKUP_SYM(clmp)(&sl, dlmp, &binfo);
1258 
1259 	} else {
1260 		Grp_hdl *ghp = (Grp_hdl *)handle;
1261 
1262 		/*
1263 		 * Look in the shared object specified by the handle and in all
1264 		 * of its dependencies.
1265 		 */
1266 		DBG_CALL(Dbg_syms_dlsym(clmp, name, NAME(ghp->gh_ownlmp),
1267 		    DBG_DLSYM_DEF));
1268 
1269 		sym = LM_DLSYM(clmp)(ghp, &sl, dlmp, &binfo);
1270 	}
1271 
1272 	if (sym) {
1273 		Lm_list	*lml = LIST(clmp);
1274 		Addr	addr = sym->st_value;
1275 
1276 		if (!(FLAGS(*dlmp) & FLG_RT_FIXED))
1277 			addr += ADDR(*dlmp);
1278 
1279 		DBG_CALL(Dbg_bind_global(clmp, 0, 0, (Xword)-1, PLT_T_NONE,
1280 		    *dlmp, addr, sym->st_value, name, binfo));
1281 
1282 		if ((lml->lm_tflags | FLAGS1(clmp)) & LML_TFLG_AUD_SYMBIND) {
1283 			uint_t	sb_flags = LA_SYMB_DLSYM;
1284 			/* LINTED */
1285 			uint_t	symndx = (uint_t)(((Xword)sym -
1286 			    (Xword)SYMTAB(*dlmp)) / SYMENT(*dlmp));
1287 			addr = audit_symbind(clmp, *dlmp, sym, symndx, addr,
1288 			    &sb_flags);
1289 		}
1290 		return ((void *)addr);
1291 	} else
1292 		return (0);
1293 }
1294 
1295 /*
1296  * Internal dlsym activity.  Called from user level or directly for internal
1297  * symbol lookup.
1298  */
1299 void *
1300 dlsym_intn(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1301 {
1302 	Rt_map		*llmp = 0;
1303 	void		*error;
1304 	Aliste		off;
1305 	Grp_desc	*gdp;
1306 
1307 	/*
1308 	 * While looking for symbols it's quite possible that additional objects
1309 	 * get loaded from lazy loading.  These objects will have been added to
1310 	 * the same link-map list as those objects on the handle.  Remember this
1311 	 * list for later investigation.
1312 	 */
1313 	if ((handle == RTLD_NEXT) || (handle == RTLD_DEFAULT) ||
1314 	    (handle == RTLD_SELF) || (handle == RTLD_PROBE))
1315 		llmp = LIST(clmp)->lm_tail;
1316 	else {
1317 		Grp_hdl	*ghp = (Grp_hdl *)handle;
1318 
1319 		if (ghp->gh_ownlmp)
1320 			llmp = LIST(ghp->gh_ownlmp)->lm_tail;
1321 		else {
1322 			for (ALIST_TRAVERSE(ghp->gh_depends, off, gdp)) {
1323 				if ((llmp = LIST(gdp->gd_depend)->lm_tail) != 0)
1324 					break;
1325 			}
1326 		}
1327 	}
1328 
1329 	if ((error = dlsym_core(handle, name, clmp, dlmp)) == 0) {
1330 		/*
1331 		 * Cache the error message, as Java tends to fall through this
1332 		 * code many times.
1333 		 */
1334 		if (nosym_str == 0)
1335 			nosym_str = MSG_INTL(MSG_GEN_NOSYM);
1336 		eprintf(LIST(clmp), ERR_FATAL, nosym_str, name);
1337 	}
1338 
1339 	load_completion(llmp);
1340 	return (error);
1341 }
1342 
1343 /*
1344  * Argument checking for dlsym.  Only called via external entry.
1345  */
1346 static void *
1347 dlsym_check(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1348 {
1349 	/*
1350 	 * Verify the arguments.
1351 	 */
1352 	if (name == 0) {
1353 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_ILLSYM));
1354 		return (0);
1355 	}
1356 	if ((handle != RTLD_NEXT) && (handle != RTLD_DEFAULT) &&
1357 	    (handle != RTLD_SELF) && (handle != RTLD_PROBE) &&
1358 	    (hdl_validate((Grp_hdl *)handle) == 0)) {
1359 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL));
1360 		return (0);
1361 	}
1362 	return (dlsym_intn(handle, name, clmp, dlmp));
1363 }
1364 
1365 
1366 #pragma weak dlsym = _dlsym
1367 
1368 /*
1369  * External entry for dlsym().  On success, returns the address of the specified
1370  * symbol.  On error returns a null.
1371  */
1372 void *
1373 _dlsym(void *handle, const char *name)
1374 {
1375 	int	entry;
1376 	Rt_map	*clmp, *dlmp = 0;
1377 	void	*addr;
1378 
1379 	entry = enter();
1380 
1381 	clmp = _caller(caller(), CL_EXECDEF);
1382 
1383 	addr = dlsym_check(handle, name, clmp, &dlmp);
1384 
1385 	if (dlmp)
1386 		is_dep_ready(dlmp, clmp, DBG_WAIT_SYMBOL);
1387 
1388 	if (entry && dlmp)
1389 		is_dep_init(dlmp, clmp);
1390 
1391 	if (entry)
1392 		leave(LIST(clmp));
1393 	return (addr);
1394 }
1395 
1396 /*
1397  * Core dladdr activity.
1398  */
1399 static void
1400 dladdr_core(Rt_map *clmp, void *addr, Dl_info *dlip, void **info, int flags)
1401 {
1402 	/*
1403 	 * Set up generic information and any defaults.
1404 	 */
1405 	dlip->dli_fname = PATHNAME(clmp);
1406 
1407 	dlip->dli_fbase = (void *)ADDR(clmp);
1408 	dlip->dli_sname = 0;
1409 	dlip->dli_saddr = 0;
1410 
1411 	/*
1412 	 * Determine the nearest symbol to this address.
1413 	 */
1414 	LM_DLADDR(clmp)((ulong_t)addr, clmp, dlip, info, flags);
1415 }
1416 
1417 #pragma weak dladdr = _dladdr
1418 
1419 /*
1420  * External entry for dladdr(3dl) and dladdr1(3dl).  Returns an information
1421  * structure that reflects the symbol closest to the address specified.
1422  */
1423 int
1424 _dladdr(void *addr, Dl_info *dlip)
1425 {
1426 	int	entry, error;
1427 	Rt_map	*clmp;
1428 
1429 	entry = enter();
1430 
1431 	/*
1432 	 * Use our calling technique to determine what object is associated
1433 	 * with the supplied address.  If a caller can't be determined,
1434 	 * indicate the failure.
1435 	 */
1436 	if ((clmp = _caller((caddr_t)addr, CL_NONE)) == 0) {
1437 		eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1438 		    EC_NATPTR(addr));
1439 		error = 0;
1440 	} else {
1441 		dladdr_core(clmp, addr, dlip, 0, 0);
1442 		error = 1;
1443 	}
1444 
1445 	if (entry)
1446 		leave(0);
1447 	return (error);
1448 }
1449 
1450 #pragma weak dladdr1 = _dladdr1
1451 
1452 int
1453 _dladdr1(void *addr, Dl_info *dlip, void **info, int flags)
1454 {
1455 	int	entry, error = 0;
1456 	Rt_map	*clmp;
1457 
1458 	/*
1459 	 * Validate any flags.
1460 	 */
1461 	if (flags) {
1462 		int	request;
1463 
1464 		if (((request = (flags & RTLD_DL_MASK)) != RTLD_DL_SYMENT) &&
1465 		    (request != RTLD_DL_LINKMAP)) {
1466 			eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_ILLFLAGS),
1467 			    flags);
1468 			return (0);
1469 		}
1470 		if (info == 0) {
1471 			eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_ILLINFO), flags);
1472 			return (0);
1473 		}
1474 	}
1475 
1476 	entry = enter();
1477 
1478 	/*
1479 	 * Use our calling technique to determine what object is associated
1480 	 * with the supplied address.  If a caller can't be determined,
1481 	 * indicate the failure.
1482 	 */
1483 	if ((clmp = _caller((caddr_t)addr, CL_NONE)) == 0) {
1484 		eprintf(0, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1485 		    EC_NATPTR(addr));
1486 		error = 0;
1487 	} else {
1488 		dladdr_core(clmp, addr, dlip, info, flags);
1489 		error = 1;
1490 	}
1491 
1492 	if (entry)
1493 		leave(0);
1494 	return (error);
1495 }
1496 
1497 /*
1498  * Core dldump activity.
1499  */
1500 static int
1501 dldump_core(Lm_list *lml, const char *ipath, const char *opath, int flags)
1502 {
1503 	Addr	addr = 0;
1504 	Rt_map	*lmp;
1505 
1506 	/*
1507 	 * Verify any arguments first.
1508 	 */
1509 	if ((!opath || (*opath == '\0')) || (ipath && (*ipath == '\0'))) {
1510 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
1511 		return (1);
1512 	}
1513 
1514 	/*
1515 	 * If an input file is specified make sure its one of our dependencies
1516 	 * on the main link-map list.  Note, this has really all evolved for
1517 	 * crle(), which uses libcrle.so on an alternative link-map to trigger
1518 	 * dumping objects from the main link-map list.   If we ever want to
1519 	 * dump objects from alternative link-maps, this model is going to
1520 	 * have to be revisited.
1521 	 */
1522 	if (ipath) {
1523 		if ((lmp = is_so_loaded(&lml_main, ipath)) == 0) {
1524 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NOFILE),
1525 			    ipath);
1526 			return (1);
1527 		}
1528 		if (FLAGS(lmp) & FLG_RT_ALTER) {
1529 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_ALTER), ipath);
1530 			return (1);
1531 		}
1532 		if (FLAGS(lmp) & FLG_RT_NODUMP) {
1533 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NODUMP),
1534 			    ipath);
1535 			return (1);
1536 		}
1537 	} else
1538 		lmp = lml_main.lm_head;
1539 
1540 
1541 	DBG_CALL(Dbg_file_dldump(lmp, opath, flags));
1542 
1543 	/*
1544 	 * If the object being dump'ed isn't fixed identify its mapping.
1545 	 */
1546 	if (!(FLAGS(lmp) & FLG_RT_FIXED))
1547 		addr = ADDR(lmp);
1548 
1549 	/*
1550 	 * As rt_dldump() will effectively lazy load the necessary support
1551 	 * libraries, make sure ld.so.1 is initialized for plt relocations.
1552 	 */
1553 	if (elf_rtld_load() == 0)
1554 		return (0);
1555 
1556 	/*
1557 	 * Dump the required image.
1558 	 */
1559 	return (rt_dldump(lmp, opath, flags, addr));
1560 }
1561 
1562 #pragma weak dldump = _dldump
1563 
1564 /*
1565  * External entry for dldump(3c).  Returns 0 on success, non-zero otherwise.
1566  */
1567 int
1568 _dldump(const char *ipath, const char *opath, int flags)
1569 {
1570 	int	error, entry;
1571 	Rt_map	*clmp;
1572 
1573 	entry = enter();
1574 
1575 	clmp = _caller(caller(), CL_EXECDEF);
1576 
1577 	error = dldump_core(LIST(clmp), ipath, opath, flags);
1578 
1579 	if (entry)
1580 		leave(LIST(clmp));
1581 	return (error);
1582 }
1583 
1584 /*
1585  * get_linkmap_id() translates Lm_list * pointers to the Link_map id as used by
1586  * the rtld_db and dlmopen() interfaces.  It checks to see if the Link_map is
1587  * one of the primary ones and if so returns it's special token:
1588  *		LM_ID_BASE
1589  *		LM_ID_LDSO
1590  *
1591  * If it's not one of the primary link_map id's it will instead returns a
1592  * pointer to the Lm_list structure which uniquely identifies the Link_map.
1593  */
1594 Lmid_t
1595 get_linkmap_id(Lm_list *lml)
1596 {
1597 	if (lml->lm_flags & LML_FLG_BASELM)
1598 		return (LM_ID_BASE);
1599 	if (lml->lm_flags & LML_FLG_RTLDLM)
1600 		return (LM_ID_LDSO);
1601 
1602 	return ((Lmid_t)lml);
1603 }
1604 
1605 /*
1606  * Extract information for a dlopen() handle.
1607  */
1608 static int
1609 dlinfo_core(void *handle, int request, void *p, Rt_map *clmp)
1610 {
1611 	Lm_list	*lml = LIST(clmp);
1612 	Rt_map	*lmp;
1613 
1614 	if ((request > RTLD_DI_MAX) || (p == 0)) {
1615 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLVAL));
1616 		return (-1);
1617 	}
1618 
1619 	/*
1620 	 * Return configuration cache name and address.
1621 	 */
1622 	if (request == RTLD_DI_CONFIGADDR) {
1623 		Dl_info	*dlip = (Dl_info *)p;
1624 
1625 		if ((config->c_name == 0) || (config->c_bgn == 0) ||
1626 		    (config->c_end == 0)) {
1627 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOCONFIG));
1628 			return (-1);
1629 		}
1630 		dlip->dli_fname = config->c_name;
1631 		dlip->dli_fbase = (void *)config->c_bgn;
1632 		return (0);
1633 	}
1634 
1635 	/*
1636 	 * Return profiled object name (used by ldprof audit library).
1637 	 */
1638 	if (request == RTLD_DI_PROFILENAME) {
1639 		if (profile_name == 0) {
1640 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOPROFNAME));
1641 			return (-1);
1642 		}
1643 
1644 		*(const char **)p = profile_name;
1645 		return (0);
1646 	}
1647 	if (request == RTLD_DI_PROFILEOUT) {
1648 		/*
1649 		 * If a profile destination directory hasn't been specified
1650 		 * provide a default.
1651 		 */
1652 		if (profile_out == 0)
1653 			profile_out = MSG_ORIG(MSG_PTH_VARTMP);
1654 
1655 		*(const char **)p = profile_out;
1656 		return (0);
1657 	}
1658 
1659 	/*
1660 	 * Obtain or establish a termination signal.
1661 	 */
1662 	if (request == RTLD_DI_GETSIGNAL) {
1663 		*(int *)p = killsig;
1664 		return (0);
1665 	}
1666 
1667 	if (request == RTLD_DI_SETSIGNAL) {
1668 		sigset_t	set;
1669 		int		sig = *(int *)p;
1670 
1671 		/*
1672 		 * Determine whether the signal is in range.
1673 		 */
1674 		(void) sigfillset(&set);
1675 		if (sigismember(&set, sig) != 1) {
1676 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVSIG), sig);
1677 			return (-1);
1678 		}
1679 
1680 		killsig = sig;
1681 		return (0);
1682 	}
1683 
1684 	/*
1685 	 * For any other request a link-map is required.  Verify the handle.
1686 	 */
1687 	if (handle == RTLD_SELF)
1688 		lmp = clmp;
1689 	else {
1690 		Grp_hdl	*ghp = (Grp_hdl *)handle;
1691 
1692 		if (!hdl_validate(ghp)) {
1693 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL));
1694 			return (-1);
1695 		}
1696 		lmp = ghp->gh_ownlmp;
1697 	}
1698 
1699 	/*
1700 	 * Obtain the process arguments, environment and auxv.  Note, as the
1701 	 * environment can be modified by the user (putenv(3c)), reinitialize
1702 	 * the environment pointer on each request.
1703 	 */
1704 	if (request == RTLD_DI_ARGSINFO) {
1705 		Dl_argsinfo	*aip = (Dl_argsinfo *)p;
1706 		Lm_list		*lml = LIST(lmp);
1707 
1708 		*aip = argsinfo;
1709 		if (lml->lm_flags & LML_FLG_ENVIRON)
1710 			aip->dla_envp = *(lml->lm_environ);
1711 
1712 		return (0);
1713 	}
1714 
1715 	/*
1716 	 * Return Lmid_t of the Link-Map list that the specified object is
1717 	 * loaded on.
1718 	 */
1719 	if (request == RTLD_DI_LMID) {
1720 		*(Lmid_t *)p = get_linkmap_id(LIST(lmp));
1721 		return (0);
1722 	}
1723 
1724 	/*
1725 	 * Return a pointer to the Link-Map structure associated with the
1726 	 * specified object.
1727 	 */
1728 	if (request == RTLD_DI_LINKMAP) {
1729 		*(Link_map **)p = (Link_map *)lmp;
1730 		return (0);
1731 	}
1732 
1733 	/*
1734 	 * Return search path information, or the size of the buffer required
1735 	 * to store the information.
1736 	 */
1737 	if ((request == RTLD_DI_SERINFO) || (request == RTLD_DI_SERINFOSIZE)) {
1738 		Pnode		*dir, *dirlist = (Pnode *)0;
1739 		Dl_serinfo	*info;
1740 		Dl_serpath	*path;
1741 		char		*strs;
1742 		size_t		size = sizeof (Dl_serinfo);
1743 		uint_t		cnt = 0;
1744 
1745 		info = (Dl_serinfo *)p;
1746 		path = &info->dls_serpath[0];
1747 		strs = (char *)&info->dls_serpath[info->dls_cnt];
1748 
1749 		/*
1750 		 * Traverse search path entries for this object.
1751 		 */
1752 		while ((dir = get_next_dir(&dirlist, lmp, 0)) != 0) {
1753 			size_t	_size;
1754 
1755 			if (dir->p_name == 0)
1756 				continue;
1757 
1758 			/*
1759 			 * If configuration information exists, it's possible
1760 			 * this path has been identified as non-existent, if so
1761 			 * ignore it.
1762 			 */
1763 			if (dir->p_info) {
1764 				Rtc_obj	*dobj = (Rtc_obj *)dir->p_info;
1765 				if (dobj->co_flags & RTC_OBJ_NOEXIST)
1766 					continue;
1767 			}
1768 
1769 			/*
1770 			 * Keep track of search path count and total info size.
1771 			 */
1772 			if (cnt++)
1773 				size += sizeof (Dl_serpath);
1774 			_size = strlen(dir->p_name) + 1;
1775 			size += _size;
1776 
1777 			if (request == RTLD_DI_SERINFOSIZE)
1778 				continue;
1779 
1780 			/*
1781 			 * If we're filling in search path information, confirm
1782 			 * there's sufficient space.
1783 			 */
1784 			if (size > info->dls_size) {
1785 				eprintf(lml, ERR_FATAL,
1786 				    MSG_INTL(MSG_ARG_SERSIZE),
1787 				    EC_OFF(info->dls_size));
1788 				return (-1);
1789 			}
1790 			if (cnt > info->dls_cnt) {
1791 				eprintf(lml, ERR_FATAL,
1792 				    MSG_INTL(MSG_ARG_SERCNT), info->dls_cnt);
1793 				return (-1);
1794 			}
1795 
1796 			/*
1797 			 * Append the path to the information buffer.
1798 			 */
1799 			(void) strcpy(strs, dir->p_name);
1800 			path->dls_name = strs;
1801 			path->dls_flags = dir->p_orig;
1802 
1803 			strs = strs + _size;
1804 			path++;
1805 		}
1806 
1807 		/*
1808 		 * If we're here to size the search buffer fill it in.
1809 		 */
1810 		if (request == RTLD_DI_SERINFOSIZE) {
1811 			info->dls_size = size;
1812 			info->dls_cnt = cnt;
1813 		}
1814 	}
1815 
1816 	/*
1817 	 * Return the origin of the object associated with this link-map.
1818 	 * Basically return the dirname(1) of the objects fullpath.
1819 	 */
1820 	if (request == RTLD_DI_ORIGIN) {
1821 		char	*str = (char *)p;
1822 
1823 		if (DIRSZ(lmp) == 0)
1824 			(void) fullpath(lmp, 0);
1825 
1826 		(void) strncpy(str, ORIGNAME(lmp), DIRSZ(lmp));
1827 		str += DIRSZ(lmp);
1828 		*str = '\0';
1829 
1830 		return (0);
1831 	}
1832 
1833 	return (0);
1834 }
1835 
1836 #pragma weak dlinfo = _dlinfo
1837 
1838 /*
1839  * External entry for dlinfo(3dl).
1840  */
1841 int
1842 _dlinfo(void *handle, int request, void *p)
1843 {
1844 	int	error, entry;
1845 	Rt_map	*clmp;
1846 
1847 	entry = enter();
1848 
1849 	clmp = _caller(caller(), CL_EXECDEF);
1850 
1851 	error = dlinfo_core(handle, request, p, clmp);
1852 
1853 	if (entry)
1854 		leave(LIST(clmp));
1855 	return (error);
1856 }
1857