1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22/*
23 *	Copyright (c) 1988 AT&T
24 *	  All Rights Reserved
25 *
26 * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
27 */
28
29/*
30 * Programmatic interface to the run_time linker.
31 */
32
33#include	<sys/debug.h>
34#include	<stdio.h>
35#include	<string.h>
36#include	<dlfcn.h>
37#include	<synch.h>
38#include	<limits.h>
39#include	<debug.h>
40#include	<conv.h>
41#include	"_rtld.h"
42#include	"_audit.h"
43#include	"_elf.h"
44#include	"_inline_gen.h"
45#include	"msg.h"
46
47/*
48 * Determine who called us - given a pc determine in which object it resides.
49 *
50 * For dlopen() the link map of the caller must be passed to load_so() so that
51 * the appropriate search rules (4.x or 5.0) are used to locate any
52 * dependencies.  Also, if we've been called from a 4.x module it may be
53 * necessary to fix the specified pathname so that it conforms with the 5.0 elf
54 * rules.
55 *
56 * For dlsym() the link map of the caller is used to determine RTLD_NEXT
57 * requests, together with requests based off of a dlopen(0).
58 * For dladdr() this routines provides a generic means of scanning all loaded
59 * segments.
60 */
61Rt_map *
62_caller(caddr_t cpc, int flags)
63{
64	Lm_list	*lml;
65	Aliste	idx1;
66
67	for (APLIST_TRAVERSE(dynlm_list, idx1, lml)) {
68		Aliste	idx2;
69		Lm_cntl	*lmc;
70
71		for (ALIST_TRAVERSE(lml->lm_lists, idx2, lmc)) {
72			Rt_map	*lmp;
73
74			for (lmp = lmc->lc_head; lmp;
75			    lmp = NEXT_RT_MAP(lmp)) {
76
77				if (find_segment(cpc, lmp))
78					return (lmp);
79			}
80		}
81	}
82
83	/*
84	 * No mapping can be determined.  If asked for a default, assume this
85	 * is from the executable.
86	 */
87	if (flags & CL_EXECDEF)
88		return ((Rt_map *)lml_main.lm_head);
89
90	return (0);
91}
92
93#pragma weak _dlerror = dlerror
94
95/*
96 * External entry for dlerror(3dl).  Returns a pointer to the string describing
97 * the last occurring error.  The last occurring error is cleared.
98 */
99char *
100dlerror()
101{
102	char	*error;
103	Rt_map	*clmp;
104	int	entry;
105
106	entry = enter(0);
107
108	clmp = _caller(caller(), CL_EXECDEF);
109
110	DBG_CALL(Dbg_dl_dlerror(clmp, lasterr));
111
112	error = lasterr;
113	lasterr = NULL;
114
115	if (entry)
116		leave(LIST(clmp), 0);
117	return (error);
118}
119
120/*
121 * Add a dependency as a group descriptor to a group handle.  Returns 0 on
122 * failure.  On success, returns the group descriptor, and if alep is non-NULL
123 * the *alep is set to ALE_EXISTS if the dependency already exists, or to
124 * ALE_CREATE if the dependency is newly created.
125 */
126Grp_desc *
127hdl_add(Grp_hdl *ghp, Rt_map *lmp, uint_t dflags, int *alep)
128{
129	Grp_desc	*gdp;
130	Aliste		idx;
131	int		ale = ALE_CREATE;
132	uint_t		oflags;
133
134	/*
135	 * Make sure this dependency hasn't already been recorded.
136	 */
137	for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
138		if (gdp->gd_depend == lmp) {
139			ale = ALE_EXISTS;
140			break;
141		}
142	}
143
144	if (ale == ALE_CREATE) {
145		Grp_desc	gd;
146
147		/*
148		 * Create a new handle descriptor.
149		 */
150		gd.gd_depend = lmp;
151		gd.gd_flags = 0;
152
153		/*
154		 * Indicate this object is a part of this handles group.
155		 */
156		if (aplist_append(&GROUPS(lmp), ghp, AL_CNT_GROUPS) == NULL)
157			return (NULL);
158
159		/*
160		 * Append the new dependency to this handle.
161		 */
162		if ((gdp = alist_append(&ghp->gh_depends, &gd,
163		    sizeof (Grp_desc), AL_CNT_DEPENDS)) == NULL)
164			return (NULL);
165	}
166
167	oflags = gdp->gd_flags;
168	gdp->gd_flags |= dflags;
169
170	if (DBG_ENABLED) {
171		if (ale == ALE_CREATE)
172			DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_ADD,
173			    gdp->gd_flags));
174		else if (gdp->gd_flags != oflags)
175			DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_UPDATE,
176			    gdp->gd_flags));
177	}
178
179	if (alep)
180		*alep = ale;
181	return (gdp);
182}
183
184/*
185 * Create a handle.
186 *
187 *   rlmp -	represents the reference link-map for which the handle is being
188 *		created.
189 *   clmp -	represents the caller who is requesting the handle.
190 *   hflags -	provide group handle flags (GPH_*) that affect the use of the
191 *		handle, such as dlopen(0), or use or use of RTLD_FIRST.
192 *   rdflags -	provide group dependency flags for the reference link-map rlmp,
193 *		such as whether the dependency can be used for dlsym(), can be
194 *		relocated against, or whether this objects dependencies should
195 *		be processed.
196 *   cdflags -	provide group dependency flags for the caller.
197 */
198Grp_hdl *
199hdl_create(Lm_list *lml, Rt_map *rlmp, Rt_map *clmp, uint_t hflags,
200    uint_t rdflags, uint_t cdflags)
201{
202	Grp_hdl	*ghp = NULL, *aghp;
203	APlist	**alpp;
204	Aliste	idx;
205
206	/*
207	 * For dlopen(0) the handle is maintained as part of the link-map list,
208	 * otherwise the handle is associated with the reference link-map.
209	 */
210	if (hflags & GPH_ZERO)
211		alpp = &(lml->lm_handle);
212	else
213		alpp = &(HANDLES(rlmp));
214
215	/*
216	 * Objects can contain multiple handles depending on the handle flags
217	 * supplied.  Most RTLD flags pertain to the object itself and the
218	 * bindings that it can achieve.  Multiple handles for these flags
219	 * don't make sense.  But if the flag determines how the handle might
220	 * be used, then multiple handles may exist.  Presently this only makes
221	 * sense for RTLD_FIRST.  Determine if an appropriate handle already
222	 * exists.
223	 */
224	for (APLIST_TRAVERSE(*alpp, idx, aghp)) {
225		if ((aghp->gh_flags & GPH_FIRST) == (hflags & GPH_FIRST)) {
226			ghp = aghp;
227			break;
228		}
229	}
230
231	if (ghp == NULL) {
232		uint_t	ndx;
233
234		/*
235		 * If this is the first request for this handle, allocate and
236		 * initialize a new handle.
237		 */
238		DBG_CALL(Dbg_file_hdl_title(DBG_HDL_CREATE));
239
240		if ((ghp = malloc(sizeof (Grp_hdl))) == NULL)
241			return (NULL);
242
243		/*
244		 * Associate the handle with the link-map list or the reference
245		 * link-map as appropriate.
246		 */
247		if (aplist_append(alpp, ghp, AL_CNT_GROUPS) == NULL) {
248			free(ghp);
249			return (NULL);
250		}
251
252		/*
253		 * Record the existence of this handle for future verification.
254		 */
255		/* LINTED */
256		ndx = (uintptr_t)ghp % HDLIST_SZ;
257
258		if (aplist_append(&hdl_alp[ndx], ghp, AL_CNT_HANDLES) == NULL) {
259			(void) aplist_delete_value(*alpp, ghp);
260			free(ghp);
261			return (NULL);
262		}
263
264		ghp->gh_depends = NULL;
265		ghp->gh_refcnt = 1;
266		ghp->gh_flags = hflags;
267
268		/*
269		 * A dlopen(0) handle is identified by the GPH_ZERO flag, the
270		 * head of the link-map list is defined as the owner.  There is
271		 * no need to maintain a list of dependencies, for when this
272		 * handle is used (for dlsym()) a dynamic search through the
273		 * entire link-map list provides for searching all objects with
274		 * GLOBAL visibility.
275		 */
276		if (hflags & GPH_ZERO) {
277			ghp->gh_ownlmp = lml->lm_head;
278			ghp->gh_ownlml = lml;
279		} else {
280			ghp->gh_ownlmp = rlmp;
281			ghp->gh_ownlml = LIST(rlmp);
282
283			if (hdl_add(ghp, rlmp, rdflags, NULL) == NULL)
284				return (NULL);
285
286			/*
287			 * If this new handle is a private handle, there's no
288			 * need to track the caller, so we're done.
289			 */
290			if (hflags & GPH_PRIVATE)
291				return (ghp);
292
293			/*
294			 * If this new handle is public, and isn't a special
295			 * handle representing ld.so.1, indicate that a local
296			 * group now exists.  This state allows singleton
297			 * searches to be optimized.
298			 */
299			if ((hflags & GPH_LDSO) == 0)
300				LIST(rlmp)->lm_flags |= LML_FLG_GROUPSEXIST;
301		}
302	} else {
303		/*
304		 * If a handle already exists, bump its reference count.
305		 *
306		 * If the previous reference count was 0, then this is a handle
307		 * that an earlier call to dlclose() was unable to remove.  Such
308		 * handles are put on the orphan list.  As this handle is back
309		 * in use, it must be removed from the orphan list.
310		 *
311		 * Note, handles associated with a link-map list itself (i.e.
312		 * dlopen(0)) can have a reference count of 0.  However, these
313		 * handles are never deleted, and therefore are never moved to
314		 * the orphan list.
315		 */
316		if ((ghp->gh_refcnt++ == 0) &&
317		    ((ghp->gh_flags & GPH_ZERO) == 0)) {
318			uint_t	ndx;
319
320			/* LINTED */
321			ndx = (uintptr_t)ghp % HDLIST_SZ;
322
323			(void) aplist_delete_value(hdl_alp[HDLIST_ORP], ghp);
324			(void) aplist_append(&hdl_alp[ndx], ghp,
325			    AL_CNT_HANDLES);
326
327			if (DBG_ENABLED) {
328				Aliste		idx;
329				Grp_desc	*gdp;
330
331				DBG_CALL(Dbg_file_hdl_title(DBG_HDL_REINST));
332				for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp))
333					DBG_CALL(Dbg_file_hdl_action(ghp,
334					    gdp->gd_depend, DBG_DEP_REINST, 0));
335			}
336		}
337
338		/*
339		 * If we've been asked to create a private handle, there's no
340		 * need to track the caller.
341		 */
342		if (hflags & GPH_PRIVATE) {
343			/*
344			 * Negate the reference count increment.
345			 */
346			ghp->gh_refcnt--;
347			return (ghp);
348		} else {
349			/*
350			 * If a private handle already exists, promote this
351			 * handle to public by initializing both the reference
352			 * count and the handle flags.
353			 */
354			if (ghp->gh_flags & GPH_PRIVATE) {
355				ghp->gh_refcnt = 1;
356				ghp->gh_flags &= ~GPH_PRIVATE;
357				ghp->gh_flags |= hflags;
358			}
359		}
360	}
361
362	/*
363	 * Keep track of the parent (caller).  As this object can be referenced
364	 * by different parents, this processing is carried out every time a
365	 * handle is requested.
366	 */
367	if (clmp && (hdl_add(ghp, clmp, cdflags, NULL) == NULL))
368		return (NULL);
369
370	return (ghp);
371}
372
373/*
374 * Initialize a handle that has been created for an object that is already
375 * loaded.  The handle is initialized with the present dependencies of that
376 * object.  Once this initialization has occurred, any new objects that might
377 * be loaded as dependencies (lazy-loading) are added to the handle as each new
378 * object is loaded.
379 */
380int
381hdl_initialize(Grp_hdl *ghp, Rt_map *nlmp, int mode, int promote)
382{
383	Aliste		idx;
384	Grp_desc	*gdp;
385
386	/*
387	 * If the handle has already been initialized, and the initial object's
388	 * mode hasn't been promoted, there's no need to recompute the modes of
389	 * any dependencies.  If the object we've added has just been opened,
390	 * the objects dependencies will not yet have been processed.  These
391	 * dependencies will be added on later calls to load_one().  Otherwise,
392	 * this object already exists, so add all of its dependencies to the
393	 * handle were operating on.
394	 */
395	if (((ghp->gh_flags & GPH_INITIAL) && (promote == 0)) ||
396	    ((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0)) {
397		ghp->gh_flags |= GPH_INITIAL;
398		return (1);
399	}
400
401	DBG_CALL(Dbg_file_hdl_title(DBG_HDL_ADD));
402	for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
403		Rt_map		*lmp = gdp->gd_depend;
404		Aliste		idx1;
405		Bnd_desc	*bdp;
406
407		/*
408		 * If this dependency doesn't indicate that its dependencies
409		 * should be added to a handle, ignore it.  This case identifies
410		 * a parent of a dlopen(RTLD_PARENT) request.
411		 */
412		if ((gdp->gd_flags & GPD_ADDEPS) == 0)
413			continue;
414
415		for (APLIST_TRAVERSE(DEPENDS(lmp), idx1, bdp)) {
416			Rt_map	*dlmp = bdp->b_depend;
417
418			if ((bdp->b_flags & BND_NEEDED) == 0)
419				continue;
420
421			if (hdl_add(ghp, dlmp,
422			    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS), NULL) == NULL)
423				return (0);
424
425			(void) update_mode(dlmp, MODE(dlmp), mode);
426		}
427	}
428	ghp->gh_flags |= GPH_INITIAL;
429	return (1);
430}
431
432/*
433 * Sanity check a program-provided handle.
434 */
435static int
436hdl_validate(Grp_hdl *ghp)
437{
438	Aliste		idx;
439	Grp_hdl		*lghp;
440	uint_t		ndx;
441
442	/* LINTED */
443	ndx = (uintptr_t)ghp % HDLIST_SZ;
444
445	for (APLIST_TRAVERSE(hdl_alp[ndx], idx, lghp)) {
446		if ((lghp == ghp) && (ghp->gh_refcnt != 0))
447			return (1);
448	}
449	return (0);
450}
451
452/*
453 * Core dlclose activity.
454 */
455int
456dlclose_core(Grp_hdl *ghp, Rt_map *clmp, Lm_list *lml)
457{
458	int	error;
459	Rt_map	*lmp;
460
461	/*
462	 * If we're already at atexit() there's no point processing further,
463	 * all objects have already been tsorted for fini processing.
464	 */
465	if (rtld_flags & RT_FL_ATEXIT)
466		return (0);
467
468	/*
469	 * Diagnose what we're up to.
470	 */
471	if (ghp->gh_flags & GPH_ZERO) {
472		DBG_CALL(Dbg_dl_dlclose(clmp, MSG_ORIG(MSG_STR_ZERO),
473		    DBG_DLCLOSE_IGNORE));
474	} else {
475		DBG_CALL(Dbg_dl_dlclose(clmp, NAME(ghp->gh_ownlmp),
476		    DBG_DLCLOSE_NULL));
477	}
478
479	/*
480	 * Decrement reference count of this object.
481	 */
482	if (--(ghp->gh_refcnt))
483		return (0);
484
485	/*
486	 * If this handle is special (dlopen(0)), then leave it around - it
487	 * has little overhead.
488	 */
489	if (ghp->gh_flags & GPH_ZERO)
490		return (0);
491
492	/*
493	 * If this handle is associated with an object that is not on the base
494	 * link-map control list, or it has not yet been relocated, then this
495	 * handle must have originated from an auditors interaction, or some
496	 * permutation of RTLD_CONFGEN use (crle(1), moe(1), etc.).  User code
497	 * can only execute and bind to relocated objects on the base link-map
498	 * control list.  Outside of RTLD_CONFGEN use, a non-relocated object,
499	 * or an object on a non-base link-map control list, is in the process
500	 * of being loaded, and therefore we do not attempt to remove the
501	 * handle.
502	 */
503	if (((lmp = ghp->gh_ownlmp) != NULL) &&
504	    ((MODE(lmp) & RTLD_CONFGEN) == 0) &&
505	    ((CNTL(lmp) != ALIST_OFF_DATA) ||
506	    ((FLAGS(lmp) & FLG_RT_RELOCED) == 0)))
507		return (0);
508
509	/*
510	 * This handle is no longer being referenced, remove it.  If this handle
511	 * is part of an alternative link-map list, determine if the whole list
512	 * can be removed also.
513	 */
514	error = remove_hdl(ghp, clmp, NULL);
515
516	if ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)
517		remove_lml(lml);
518
519	return (error);
520}
521
522/*
523 * Internal dlclose activity.  Called from user level or directly for internal
524 * error cleanup.
525 */
526int
527dlclose_intn(Grp_hdl *ghp, Rt_map *clmp)
528{
529	Rt_map	*nlmp = NULL;
530	Lm_list	*olml = NULL;
531	int	error;
532
533	/*
534	 * Although we're deleting object(s) it's quite possible that additional
535	 * objects get loaded from running the .fini section(s) of the objects
536	 * being deleted.  These objects will have been added to the same
537	 * link-map list as those objects being deleted.  Remember this list
538	 * for later investigation.
539	 */
540	olml = ghp->gh_ownlml;
541
542	error = dlclose_core(ghp, clmp, olml);
543
544	/*
545	 * Determine whether the original link-map list still exists.  In the
546	 * case of a dlclose of an alternative (dlmopen) link-map the whole
547	 * list may have been removed.
548	 */
549	if (olml) {
550		Aliste	idx;
551		Lm_list	*lml;
552
553		for (APLIST_TRAVERSE(dynlm_list, idx, lml)) {
554			if (olml == lml) {
555				nlmp = olml->lm_head;
556				break;
557			}
558		}
559	}
560	load_completion(nlmp);
561	return (error);
562}
563
564/*
565 * Argument checking for dlclose.  Only called via external entry.
566 */
567static int
568dlclose_check(void *handle, Rt_map *clmp)
569{
570	Grp_hdl	*ghp = (Grp_hdl *)handle;
571
572	if (hdl_validate(ghp) == 0) {
573		Conv_inv_buf_t	inv_buf;
574
575		(void) conv_invalid_val(&inv_buf, EC_NATPTR(ghp), 0);
576		DBG_CALL(Dbg_dl_dlclose(clmp, inv_buf.buf, DBG_DLCLOSE_NULL));
577
578		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL),
579		    EC_NATPTR(handle));
580		return (1);
581	}
582	return (dlclose_intn(ghp, clmp));
583}
584
585#pragma weak _dlclose = dlclose
586
587/*
588 * External entry for dlclose(3dl).  Returns 0 for success, non-zero otherwise.
589 */
590int
591dlclose(void *handle)
592{
593	int		error, entry;
594	Rt_map		*clmp;
595
596	entry = enter(0);
597
598	clmp = _caller(caller(), CL_EXECDEF);
599
600	error = dlclose_check(handle, clmp);
601
602	if (entry)
603		leave(LIST(clmp), 0);
604	return (error);
605}
606
607static uint_t	lmid = 0;
608
609/*
610 * The addition of new link-map lists is assumed to be in small quantities.
611 * Here, we assign a unique link-map id for diagnostic use.  Simply update the
612 * running link-map count until we max out.
613 */
614int
615newlmid(Lm_list *lml)
616{
617	char	buffer[MSG_LMID_ALT_SIZE + 12];
618
619	if (lmid == UINT_MAX) {
620		lml->lm_lmid = UINT_MAX;
621		(void) strncpy(buffer, MSG_ORIG(MSG_LMID_MAXED),
622		    MSG_LMID_ALT_SIZE + 12);
623	} else {
624		lml->lm_lmid = lmid++;
625		(void) snprintf(buffer, MSG_LMID_ALT_SIZE + 12,
626		    MSG_ORIG(MSG_LMID_FMT), MSG_ORIG(MSG_LMID_ALT),
627		    lml->lm_lmid);
628	}
629	if ((lml->lm_lmidstr = strdup(buffer)) == NULL)
630		return (0);
631
632	return (1);
633}
634
635/*
636 * Core dlopen activity.
637 */
638static Grp_hdl *
639dlmopen_core(Lm_list *lml, Lm_list *olml, const char *path, int mode,
640    Rt_map *clmp, uint_t flags, uint_t orig, int *in_nfavl)
641{
642	Alist		*palp = NULL;
643	Rt_map		*nlmp;
644	Grp_hdl		*ghp;
645	Aliste		olmco, nlmco;
646
647	DBG_CALL(Dbg_dl_dlopen(clmp,
648	    (path ? path : MSG_ORIG(MSG_STR_ZERO)), in_nfavl, mode));
649
650	/*
651	 * Having diagnosed the originally defined modes, assign any defaults
652	 * or corrections.
653	 */
654	if (((mode & (RTLD_GROUP | RTLD_WORLD)) == 0) &&
655	    ((mode & RTLD_NOLOAD) == 0))
656		mode |= (RTLD_GROUP | RTLD_WORLD);
657	if ((mode & RTLD_NOW) && (rtld_flags2 & RT_FL2_BINDLAZY)) {
658		mode &= ~RTLD_NOW;
659		mode |= RTLD_LAZY;
660	}
661
662	/*
663	 * If the path specified is null then we're operating on global
664	 * objects.  Associate a dummy handle with the link-map list.
665	 */
666	if (path == NULL) {
667		Grp_hdl *ghp;
668		uint_t	hflags, rdflags, cdflags;
669		int	promote = 0;
670
671		/*
672		 * Establish any flags for the handle (Grp_hdl).
673		 *
674		 *  -	This is a dummy, public, handle (0) that provides for a
675		 *	dynamic	search of all global objects within the process.
676		 *  -   Use of the RTLD_FIRST mode indicates that only the first
677		 *	dependency on the handle (the referenced object) can be
678		 *	used to satisfy dlsym() requests.
679		 */
680		hflags = (GPH_PUBLIC | GPH_ZERO);
681		if (mode & RTLD_FIRST)
682			hflags |= GPH_FIRST;
683
684		/*
685		 * Establish the flags for the referenced dependency descriptor
686		 * (Grp_desc).
687		 *
688		 *  -	The referenced object is available for dlsym().
689		 *  -	The referenced object is available to relocate against.
690		 *  -	The referenced object should have it's dependencies
691		 *	added to this handle.
692		 */
693		rdflags = (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS);
694
695		/*
696		 * Establish the flags for this callers dependency descriptor
697		 * (Grp_desc).
698		 *
699		 *  -	The explicit creation of a handle creates a descriptor
700		 *	for the referenced object and the parent (caller).
701		 *  -	Use of the RTLD_PARENT flag indicates that the parent
702		 *	can be relocated against.
703		 */
704		cdflags = GPD_PARENT;
705		if (mode & RTLD_PARENT)
706			cdflags |= GPD_RELOC;
707
708		if ((ghp = hdl_create(lml, 0, clmp, hflags, rdflags,
709		    cdflags)) == NULL)
710			return (NULL);
711
712		/*
713		 * Traverse the main link-map control list, updating the mode
714		 * of any objects as necessary.  Call the relocation engine if
715		 * this mode promotes the existing state of any relocations.
716		 * crle()'s first pass loads all objects necessary for building
717		 * a configuration file, however none of them are relocated.
718		 * crle()'s second pass relocates objects in preparation for
719		 * dldump()'ing using dlopen(0, RTLD_NOW).
720		 */
721		if ((mode & (RTLD_NOW | RTLD_CONFGEN)) == RTLD_CONFGEN)
722			return (ghp);
723
724		for (nlmp = lml->lm_head; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
725			if (((MODE(nlmp) & RTLD_GLOBAL) == 0) ||
726			    (FLAGS(nlmp) & FLG_RT_DELETE))
727				continue;
728
729			if (update_mode(nlmp, MODE(nlmp), mode))
730				promote = 1;
731		}
732		if (promote)
733			(void) relocate_lmc(lml, ALIST_OFF_DATA, clmp,
734			    lml->lm_head, in_nfavl);
735
736		return (ghp);
737	}
738
739	/*
740	 * Fix the pathname.  If this object expands to multiple paths (ie.
741	 * $ISALIST or $HWCAP have been used), then make sure the user has also
742	 * furnished the RTLD_FIRST flag.  As yet, we don't support opening
743	 * more than one object at a time, so enforcing the RTLD_FIRST flag
744	 * provides flexibility should we be able to support dlopening more
745	 * than one object in the future.
746	 */
747	if (LM_FIX_NAME(clmp)(path, clmp, &palp, AL_CNT_NEEDED, orig) == NULL)
748		return (NULL);
749
750	if ((palp->al_arritems > 1) && ((mode & RTLD_FIRST) == 0)) {
751		remove_alist(&palp, 1);
752		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_5));
753		return (NULL);
754	}
755
756	/*
757	 * Establish a link-map control list for this request, and load the
758	 * associated object.
759	 */
760	if ((nlmco = create_cntl(lml, 1)) == NULL) {
761		remove_alist(&palp, 1);
762		return (NULL);
763	}
764	olmco = nlmco;
765
766	nlmp = load_one(lml, nlmco, palp, clmp, mode, (flags | FLG_RT_PUBHDL),
767	    &ghp, in_nfavl);
768
769	/*
770	 * Remove any expanded pathname infrastructure, and if the dependency
771	 * couldn't be loaded, cleanup.
772	 */
773	remove_alist(&palp, 1);
774	if (nlmp == NULL) {
775		remove_cntl(lml, olmco);
776		return (NULL);
777	}
778
779	/*
780	 * If loading an auditor was requested, and the auditor already existed,
781	 * then the link-map returned will be to the original auditor.  The new
782	 * link-map list that was initially created, and the associated link-map
783	 * control list are no longer needed.  As the auditor is already loaded,
784	 * we're probably done, but fall through in case additional relocations
785	 * would be triggered by the mode of the caller.
786	 */
787	if ((flags & FLG_RT_AUDIT) && (LIST(nlmp) != lml)) {
788		remove_cntl(lml, olmco);
789		lml = LIST(nlmp);
790		olmco = 0;
791		nlmco = ALIST_OFF_DATA;
792	}
793
794	/*
795	 * Finish processing the objects associated with this request.
796	 */
797	if (((nlmp = analyze_lmc(lml, nlmco, nlmp, clmp, in_nfavl)) == NULL) ||
798	    (relocate_lmc(lml, nlmco, clmp, nlmp, in_nfavl) == 0)) {
799		ghp = NULL;
800		nlmp = NULL;
801	}
802
803	/*
804	 * If the dlopen has failed, clean up any objects that might have been
805	 * loaded successfully on this new link-map control list.
806	 */
807	if (olmco && (nlmp == NULL))
808		remove_lmc(lml, clmp, olmco, path);
809
810	/*
811	 * Finally, remove any temporary link-map control list.  Note, if this
812	 * operation successfully established a new link-map list, then a base
813	 * link-map control list will have been created, which must remain.
814	 */
815	if (olmco && ((nlmp == NULL) || (olml != (Lm_list *)LM_ID_NEWLM)))
816		remove_cntl(lml, olmco);
817
818	return (ghp);
819}
820
821/*
822 * dlopen() and dlsym() operations are the means by which a process can
823 * test for the existence of required dependencies.  If the necessary
824 * dependencies don't exist, then associated functionality can't be used.
825 * However, the lack of dependencies can be fixed, and the dlopen() and
826 * dlsym() requests can be repeated.  As we use a "not-found" AVL tree to
827 * cache any failed full path loads, secondary dlopen() and dlsym() requests
828 * will fail, even if the dependencies have been installed.
829 *
830 * dlopen() and dlsym() retry any failures by removing the "not-found" AVL
831 * tree.  Should any dependencies be found, their names are added to the
832 * FullPath AVL tree.  This routine removes any new "not-found" AVL tree,
833 * so that the dlopen() or dlsym() can replace the original "not-found" tree.
834 */
835inline static void
836nfavl_remove(avl_tree_t *avlt)
837{
838	PathNode	*pnp;
839	void		*cookie = NULL;
840
841	if (avlt) {
842		while ((pnp = avl_destroy_nodes(avlt, &cookie)) != NULL)
843			free(pnp);
844
845		avl_destroy(avlt);
846		free(avlt);
847	}
848}
849
850/*
851 * Internal dlopen() activity.  Called from user level or directly for internal
852 * opens that require a handle.
853 */
854Grp_hdl *
855dlmopen_intn(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
856    uint_t flags, uint_t orig)
857{
858	Lm_list	*olml = lml;
859	Rt_map	*dlmp = NULL;
860	Grp_hdl	*ghp;
861	int	in_nfavl = 0;
862
863	/*
864	 * Check for magic link-map list values:
865	 *
866	 *  LM_ID_BASE:		Operate on the PRIMARY (executables) link map
867	 *  LM_ID_LDSO:		Operation on ld.so.1's link map
868	 *  LM_ID_NEWLM: 	Create a new link-map.
869	 */
870	if (lml == (Lm_list *)LM_ID_NEWLM) {
871		if ((lml = calloc(sizeof (Lm_list), 1)) == NULL)
872			return (NULL);
873
874		/*
875		 * Establish the new link-map flags from the callers and those
876		 * explicitly provided.
877		 */
878		lml->lm_tflags = LIST(clmp)->lm_tflags;
879		if (flags & FLG_RT_AUDIT) {
880			/*
881			 * Unset any auditing flags - an auditor shouldn't be
882			 * audited.  Insure all audit dependencies are loaded.
883			 */
884			lml->lm_tflags &= ~LML_TFLG_AUD_MASK;
885			lml->lm_tflags |= (LML_TFLG_NOLAZYLD |
886			    LML_TFLG_LOADFLTR | LML_TFLG_NOAUDIT);
887		}
888
889		if (aplist_append(&dynlm_list, lml, AL_CNT_DYNLIST) == NULL) {
890			free(lml);
891			return (NULL);
892		}
893		if (newlmid(lml) == 0) {
894			(void) aplist_delete_value(dynlm_list, lml);
895			free(lml);
896			return (NULL);
897		}
898	} else if ((uintptr_t)lml < LM_ID_NUM) {
899		if ((uintptr_t)lml == LM_ID_BASE)
900			lml = &lml_main;
901		else if ((uintptr_t)lml == LM_ID_LDSO)
902			lml = &lml_rtld;
903	}
904
905	/*
906	 * Open the required object on the associated link-map list.
907	 */
908	ghp = dlmopen_core(lml, olml, path, mode, clmp, flags, orig, &in_nfavl);
909
910	/*
911	 * If the object could not be found it is possible that the "not-found"
912	 * AVL tree had indicated that the file does not exist.  In case the
913	 * file system has changed since this "not-found" recording was made,
914	 * retry the dlopen() with a clean "not-found" AVL tree.
915	 */
916	if ((ghp == NULL) && in_nfavl) {
917		avl_tree_t	*oavlt = nfavl;
918
919		nfavl = NULL;
920		ghp = dlmopen_core(lml, olml, path, mode, clmp, flags, orig,
921		    NULL);
922
923		/*
924		 * If the file is found, then its full path name will have been
925		 * registered in the FullPath AVL tree.  Remove any new
926		 * "not-found" AVL information, and restore the former AVL tree.
927		 */
928		nfavl_remove(nfavl);
929		nfavl = oavlt;
930	}
931
932	/*
933	 * Establish the new link-map from which .init processing will begin.
934	 * Ignore .init firing when constructing a configuration file (crle(1)).
935	 */
936	if (ghp && ((mode & RTLD_CONFGEN) == 0))
937		dlmp = ghp->gh_ownlmp;
938
939	/*
940	 * If loading an auditor was requested, and the auditor already existed,
941	 * then the link-map returned will be to the original auditor.  Remove
942	 * the link-map control list that was created for this request.
943	 */
944	if (dlmp && (flags & FLG_RT_AUDIT) && (LIST(dlmp) != lml)) {
945		remove_lml(lml);
946		lml = LIST(dlmp);
947	}
948
949	/*
950	 * If this load failed, remove any alternative link-map list.
951	 */
952	if ((ghp == NULL) &&
953	    ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)) {
954		remove_lml(lml);
955		lml = NULL;
956	}
957
958	/*
959	 * Finish this load request.  If objects were loaded, .init processing
960	 * is computed.  Finally, the debuggers are informed of the link-map
961	 * lists being stable.
962	 */
963	load_completion(dlmp);
964
965	return (ghp);
966}
967
968/*
969 * Argument checking for dlopen.  Only called via external entry.
970 */
971static Grp_hdl *
972dlmopen_check(Lm_list *lml, const char *path, int mode, Rt_map *clmp)
973{
974	/*
975	 * Verify that a valid pathname has been supplied.
976	 */
977	if (path && (*path == '\0')) {
978		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
979		return (0);
980	}
981
982	/*
983	 * Historically we've always verified the mode is either RTLD_NOW or
984	 * RTLD_LAZY.  RTLD_NOLOAD is valid by itself.  Use of LM_ID_NEWLM
985	 * requires a specific pathname, and use of RTLD_PARENT is meaningless.
986	 */
987	if ((mode & (RTLD_NOW | RTLD_LAZY | RTLD_NOLOAD)) == 0) {
988		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_1));
989		return (0);
990	}
991	if ((mode & (RTLD_NOW | RTLD_LAZY)) == (RTLD_NOW | RTLD_LAZY)) {
992		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_2));
993		return (0);
994	}
995	if ((lml == (Lm_list *)LM_ID_NEWLM) && (path == NULL)) {
996		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_3));
997		return (0);
998	}
999	if ((lml == (Lm_list *)LM_ID_NEWLM) && (mode & RTLD_PARENT)) {
1000		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_4));
1001		return (0);
1002	}
1003
1004	return (dlmopen_intn(lml, path, mode, clmp, 0, 0));
1005}
1006
1007#pragma weak _dlopen = dlopen
1008
1009/*
1010 * External entry for dlopen(3dl).  On success, returns a pointer (handle) to
1011 * the structure containing information about the newly added object, ie. can
1012 * be used by dlsym(). On failure, returns a null pointer.
1013 */
1014void *
1015dlopen(const char *path, int mode)
1016{
1017	int	entry;
1018	Rt_map	*clmp;
1019	Grp_hdl	*ghp;
1020	Lm_list	*lml;
1021
1022	entry = enter(0);
1023
1024	clmp = _caller(caller(), CL_EXECDEF);
1025	lml = LIST(clmp);
1026
1027	ghp = dlmopen_check(lml, path, mode, clmp);
1028
1029	if (entry)
1030		leave(lml, 0);
1031	return ((void *)ghp);
1032}
1033
1034#pragma weak _dlmopen = dlmopen
1035
1036/*
1037 * External entry for dlmopen(3dl).
1038 */
1039void *
1040dlmopen(Lmid_t lmid, const char *path, int mode)
1041{
1042	int	entry;
1043	Rt_map	*clmp;
1044	Grp_hdl	*ghp;
1045
1046	entry = enter(0);
1047
1048	clmp = _caller(caller(), CL_EXECDEF);
1049
1050	ghp = dlmopen_check((Lm_list *)lmid, path, mode, clmp);
1051
1052	if (entry)
1053		leave(LIST(clmp), 0);
1054	return ((void *)ghp);
1055}
1056
1057/*
1058 * Handle processing for dlsym.
1059 */
1060int
1061dlsym_handle(Grp_hdl *ghp, Slookup *slp, Sresult *srp, uint_t *binfo,
1062    int *in_nfavl)
1063{
1064	Rt_map		*nlmp, * lmp = ghp->gh_ownlmp;
1065	Rt_map		*clmp = slp->sl_cmap;
1066	const char	*name = slp->sl_name;
1067	Slookup		sl = *slp;
1068
1069	sl.sl_flags = (LKUP_FIRST | LKUP_DLSYM | LKUP_SPEC);
1070
1071	/*
1072	 * Continue processing a dlsym request.  Lookup the required symbol in
1073	 * each link-map specified by the handle.
1074	 *
1075	 * To leverage off of lazy loading, dlsym() requests can result in two
1076	 * passes.  The first descends the link-maps of any objects already in
1077	 * the address space.  If the symbol isn't located, and lazy
1078	 * dependencies still exist, then a second pass is made to load these
1079	 * dependencies if applicable.  This model means that in the case where
1080	 * a symbol exists in more than one object, the one located may not be
1081	 * constant - this is the standard issue with lazy loading. In addition,
1082	 * attempting to locate a symbol that doesn't exist will result in the
1083	 * loading of all lazy dependencies on the given handle, which can
1084	 * defeat some of the advantages of lazy loading (look out JVM).
1085	 */
1086	if (ghp->gh_flags & GPH_ZERO) {
1087		Lm_list	*lml;
1088		uint_t	lazy = 0;
1089
1090		/*
1091		 * If this symbol lookup is triggered from a dlopen(0) handle,
1092		 * traverse the present link-map list looking for promiscuous
1093		 * entries.
1094		 */
1095		for (nlmp = lmp; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
1096			/*
1097			 * If this handle indicates we're only to look in the
1098			 * first object check whether we're done.
1099			 */
1100			if ((nlmp != lmp) && (ghp->gh_flags & GPH_FIRST))
1101				return (0);
1102
1103			if (!(MODE(nlmp) & RTLD_GLOBAL))
1104				continue;
1105			if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1106			    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1107				continue;
1108
1109			sl.sl_imap = nlmp;
1110			if (LM_LOOKUP_SYM(clmp)(&sl, srp, binfo, in_nfavl))
1111				return (1);
1112
1113			/*
1114			 * Keep track of any global pending lazy loads.
1115			 */
1116			lazy += LAZY(nlmp);
1117		}
1118
1119		/*
1120		 * If we're unable to locate the symbol and this link-map list
1121		 * still has pending lazy dependencies, start loading them in an
1122		 * attempt to exhaust the search.  Note that as we're already
1123		 * traversing a dynamic linked list of link-maps there's no
1124		 * need for elf_lazy_find_sym() to descend the link-maps itself.
1125		 */
1126		lml = LIST(lmp);
1127		if (lazy) {
1128			DBG_CALL(Dbg_syms_lazy_rescan(lml, name));
1129
1130			sl.sl_flags |= LKUP_NODESCENT;
1131
1132			for (nlmp = lmp; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
1133
1134				if (!(MODE(nlmp) & RTLD_GLOBAL) || !LAZY(nlmp))
1135					continue;
1136				if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1137				    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1138					continue;
1139
1140				sl.sl_imap = nlmp;
1141				if (elf_lazy_find_sym(&sl, srp, binfo,
1142				    in_nfavl))
1143					return (1);
1144			}
1145		}
1146	} else {
1147		/*
1148		 * Traverse the dlopen() handle searching all presently loaded
1149		 * link-maps.
1150		 */
1151		Grp_desc	*gdp;
1152		Aliste		idx;
1153		uint_t		lazy = 0;
1154
1155		for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1156			nlmp = gdp->gd_depend;
1157
1158			if ((gdp->gd_flags & GPD_DLSYM) == 0)
1159				continue;
1160
1161			sl.sl_imap = nlmp;
1162			if (LM_LOOKUP_SYM(clmp)(&sl, srp, binfo, in_nfavl))
1163				return (1);
1164
1165			if (ghp->gh_flags & GPH_FIRST)
1166				return (0);
1167
1168			/*
1169			 * Keep track of any pending lazy loads associated
1170			 * with this handle.
1171			 */
1172			lazy += LAZY(nlmp);
1173		}
1174
1175		/*
1176		 * If we're unable to locate the symbol and this handle still
1177		 * has pending lazy dependencies, start loading the lazy
1178		 * dependencies, in an attempt to exhaust the search.
1179		 */
1180		if (lazy) {
1181			DBG_CALL(Dbg_syms_lazy_rescan(LIST(lmp), name));
1182
1183			for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1184				nlmp = gdp->gd_depend;
1185
1186				if (((gdp->gd_flags & GPD_DLSYM) == 0) ||
1187				    (LAZY(nlmp) == 0))
1188					continue;
1189
1190				sl.sl_imap = nlmp;
1191				if (elf_lazy_find_sym(&sl, srp, binfo,
1192				    in_nfavl))
1193					return (1);
1194			}
1195		}
1196	}
1197	return (0);
1198}
1199
1200/*
1201 * Determine whether a symbol resides in a caller.  This may be a reference,
1202 * which is associated with a specific dependency.
1203 */
1204inline static Sym *
1205sym_lookup_in_caller(Rt_map *clmp, Slookup *slp, Sresult *srp, uint_t *binfo)
1206{
1207	if (THIS_IS_ELF(clmp) && SYMINTP(clmp)(slp, srp, binfo, NULL)) {
1208		Sym	*sym = srp->sr_sym;
1209
1210		slp->sl_rsymndx = (((ulong_t)sym -
1211		    (ulong_t)SYMTAB(clmp)) / SYMENT(clmp));
1212		slp->sl_rsym = sym;
1213		return (sym);
1214	}
1215	return (NULL);
1216}
1217
1218/*
1219 * Core dlsym activity.  Selects symbol lookup method from handle.
1220 */
1221static void *
1222dlsym_core(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp,
1223    int *in_nfavl)
1224{
1225	Sym		*sym;
1226	int		ret = 0;
1227	Syminfo		*sip;
1228	Slookup		sl;
1229	Sresult		sr;
1230	uint_t		binfo;
1231
1232	/*
1233	 * Initialize the symbol lookup data structure.
1234	 *
1235	 * Standard relocations are evaluated using the symbol index of the
1236	 * associated relocation symbol.  This index provides for loading
1237	 * any lazy dependency and establishing a direct binding if necessary.
1238	 * If a dlsym() operation originates from an object that contains a
1239	 * symbol table entry for the same name, then we need to establish the
1240	 * symbol index so that any dependency requirements can be triggered.
1241	 *
1242	 * Therefore, the first symbol lookup that is carried out is for the
1243	 * symbol name within the calling object.  If this symbol exists, the
1244	 * symbols index is computed, added to the Slookup data, and thus used
1245	 * to seed the real symbol lookup.
1246	 */
1247	SLOOKUP_INIT(sl, name, clmp, clmp, ld_entry_cnt, elf_hash(name),
1248	    0, 0, 0, LKUP_SYMNDX);
1249	SRESULT_INIT(sr, name);
1250	sym = sym_lookup_in_caller(clmp, &sl, &sr, &binfo);
1251
1252	SRESULT_INIT(sr, name);
1253
1254	if (sym && (ELF_ST_VISIBILITY(sym->st_other) == STV_SINGLETON)) {
1255		Rt_map	*hlmp = LIST(clmp)->lm_head;
1256
1257		/*
1258		 * If a symbol reference is known, and that reference indicates
1259		 * that the symbol is a singleton, then the search for the
1260		 * symbol must follow the default search path.
1261		 */
1262		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, 0,
1263		    DBG_DLSYM_SINGLETON));
1264
1265		sl.sl_imap = hlmp;
1266		if (handle == RTLD_PROBE)
1267			sl.sl_flags = LKUP_NOFALLBACK;
1268		else
1269			sl.sl_flags = LKUP_SPEC;
1270		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1271
1272	} else if (handle == RTLD_NEXT) {
1273		Rt_map	*nlmp;
1274
1275		/*
1276		 * If this handle is RTLD_NEXT determine whether a lazy load
1277		 * from the caller might provide the next object.  This mimics
1278		 * the lazy loading initialization normally carried out by
1279		 * lookup_sym(), however here, we must do this up-front, as
1280		 * lookup_sym() will be used to inspect the next object.
1281		 */
1282		if ((sl.sl_rsymndx) && ((sip = SYMINFO(clmp)) != NULL)) {
1283			/* LINTED */
1284			sip = (Syminfo *)((char *)sip +
1285			    (sl.sl_rsymndx * SYMINENT(clmp)));
1286
1287			if ((sip->si_flags & SYMINFO_FLG_DIRECT) &&
1288			    (sip->si_boundto < SYMINFO_BT_LOWRESERVE))
1289				(void) elf_lazy_load(clmp, &sl,
1290				    sip->si_boundto, name, 0, NULL, in_nfavl);
1291
1292			/*
1293			 * Clear the symbol index, so as not to confuse
1294			 * lookup_sym() of the next object.
1295			 */
1296			sl.sl_rsymndx = 0;
1297			sl.sl_rsym = NULL;
1298		}
1299
1300		/*
1301		 * If the handle is RTLD_NEXT, start searching in the next link
1302		 * map from the callers.  Determine permissions from the
1303		 * present link map.  Indicate to lookup_sym() that we're on an
1304		 * RTLD_NEXT request so that it will use the callers link map to
1305		 * start any possible lazy dependency loading.
1306		 */
1307		sl.sl_imap = nlmp = NEXT_RT_MAP(clmp);
1308
1309		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl,
1310		    (nlmp ? NAME(nlmp) : MSG_INTL(MSG_STR_NULL)),
1311		    DBG_DLSYM_NEXT));
1312
1313		if (nlmp == NULL)
1314			return (0);
1315
1316		sl.sl_flags = LKUP_NEXT;
1317		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1318
1319	} else if (handle == RTLD_SELF) {
1320		/*
1321		 * If the handle is RTLD_SELF start searching from the caller.
1322		 */
1323		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, NAME(clmp),
1324		    DBG_DLSYM_SELF));
1325
1326		sl.sl_imap = clmp;
1327		sl.sl_flags = (LKUP_SPEC | LKUP_SELF);
1328		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1329
1330	} else if (handle == RTLD_DEFAULT) {
1331		Rt_map	*hlmp = LIST(clmp)->lm_head;
1332
1333		/*
1334		 * If the handle is RTLD_DEFAULT mimic the standard symbol
1335		 * lookup as would be triggered by a relocation.
1336		 */
1337		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, 0,
1338		    DBG_DLSYM_DEFAULT));
1339
1340		sl.sl_imap = hlmp;
1341		sl.sl_flags = LKUP_SPEC;
1342		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1343
1344	} else if (handle == RTLD_PROBE) {
1345		Rt_map	*hlmp = LIST(clmp)->lm_head;
1346
1347		/*
1348		 * If the handle is RTLD_PROBE, mimic the standard symbol
1349		 * lookup as would be triggered by a relocation, however do
1350		 * not fall back to a lazy loading rescan if the symbol can't be
1351		 * found within the currently loaded objects.  Note, a lazy
1352		 * loaded dependency required by the caller might still get
1353		 * loaded to satisfy this request, but no exhaustive lazy load
1354		 * rescan is carried out.
1355		 */
1356		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, 0,
1357		    DBG_DLSYM_PROBE));
1358
1359		sl.sl_imap = hlmp;
1360		sl.sl_flags = LKUP_NOFALLBACK;
1361		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1362
1363	} else {
1364		Grp_hdl *ghp = (Grp_hdl *)handle;
1365
1366		/*
1367		 * Look in the shared object specified by the handle and in all
1368		 * of its dependencies.
1369		 */
1370		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl,
1371		    NAME(ghp->gh_ownlmp), DBG_DLSYM_DEF));
1372
1373		ret = LM_DLSYM(clmp)(ghp, &sl, &sr, &binfo, in_nfavl);
1374	}
1375
1376	if (ret && ((sym = sr.sr_sym) != NULL)) {
1377		Lm_list	*lml = LIST(clmp);
1378		Addr	addr = sym->st_value;
1379
1380		*dlmp = sr.sr_dmap;
1381		if (!(FLAGS(*dlmp) & FLG_RT_FIXED))
1382			addr += ADDR(*dlmp);
1383
1384		/*
1385		 * Indicate that the defining object is now used.
1386		 */
1387		if (*dlmp != clmp)
1388			FLAGS1(*dlmp) |= FL1_RT_USED;
1389
1390		DBG_CALL(Dbg_bind_global(clmp, 0, 0, (Xword)-1, PLT_T_NONE,
1391		    *dlmp, addr, sym->st_value, sr.sr_name, binfo));
1392
1393		if ((lml->lm_tflags | AFLAGS(clmp)) & LML_TFLG_AUD_SYMBIND) {
1394			uint_t	sb_flags = LA_SYMB_DLSYM;
1395			/* LINTED */
1396			uint_t	symndx = (uint_t)(((Xword)sym -
1397			    (Xword)SYMTAB(*dlmp)) / SYMENT(*dlmp));
1398			addr = audit_symbind(clmp, *dlmp, sym, symndx, addr,
1399			    &sb_flags);
1400		}
1401		return ((void *)addr);
1402	}
1403
1404	return (NULL);
1405}
1406
1407/*
1408 * Internal dlsym activity.  Called from user level or directly for internal
1409 * symbol lookup.
1410 */
1411void *
1412dlsym_intn(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1413{
1414	Rt_map		*llmp = NULL;
1415	void		*error;
1416	Aliste		idx;
1417	Grp_desc	*gdp;
1418	int		in_nfavl = 0;
1419
1420	/*
1421	 * While looking for symbols it's quite possible that additional objects
1422	 * get loaded from lazy loading.  These objects will have been added to
1423	 * the same link-map list as those objects on the handle.  Remember this
1424	 * list for later investigation.
1425	 */
1426	if ((handle == RTLD_NEXT) || (handle == RTLD_DEFAULT) ||
1427	    (handle == RTLD_SELF) || (handle == RTLD_PROBE))
1428		llmp = LIST(clmp)->lm_tail;
1429	else {
1430		Grp_hdl	*ghp = (Grp_hdl *)handle;
1431
1432		if (ghp->gh_ownlmp)
1433			llmp = LIST(ghp->gh_ownlmp)->lm_tail;
1434		else {
1435			for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1436				if ((llmp =
1437				    LIST(gdp->gd_depend)->lm_tail) != NULL)
1438					break;
1439			}
1440		}
1441	}
1442
1443	error = dlsym_core(handle, name, clmp, dlmp, &in_nfavl);
1444
1445	/*
1446	 * If the symbol could not be found it is possible that the "not-found"
1447	 * AVL tree had indicated that a required file does not exist.  In case
1448	 * the file system has changed since this "not-found" recording was
1449	 * made, retry the dlsym() with a clean "not-found" AVL tree.
1450	 */
1451	if ((error == NULL) && in_nfavl) {
1452		avl_tree_t	*oavlt = nfavl;
1453
1454		nfavl = NULL;
1455		error = dlsym_core(handle, name, clmp, dlmp, NULL);
1456
1457		/*
1458		 * If the symbol is found, then any file that was loaded will
1459		 * have had its full path name registered in the FullPath AVL
1460		 * tree.  Remove any new "not-found" AVL information, and
1461		 * restore the former AVL tree.
1462		 */
1463		nfavl_remove(nfavl);
1464		nfavl = oavlt;
1465	}
1466
1467	if (error == NULL) {
1468		/*
1469		 * Cache the error message, as Java tends to fall through this
1470		 * code many times.
1471		 */
1472		if (nosym_str == NULL)
1473			nosym_str = MSG_INTL(MSG_GEN_NOSYM);
1474		eprintf(LIST(clmp), ERR_FATAL, nosym_str, name);
1475	}
1476
1477	load_completion(llmp);
1478	return (error);
1479}
1480
1481/*
1482 * Argument checking for dlsym.  Only called via external entry.
1483 */
1484static void *
1485dlsym_check(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1486{
1487	/*
1488	 * Verify the arguments.
1489	 */
1490	if (name == NULL) {
1491		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_ILLSYM));
1492		return (NULL);
1493	}
1494	if ((handle != RTLD_NEXT) && (handle != RTLD_DEFAULT) &&
1495	    (handle != RTLD_SELF) && (handle != RTLD_PROBE) &&
1496	    (hdl_validate((Grp_hdl *)handle) == 0)) {
1497		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL),
1498		    EC_NATPTR(handle));
1499		return (NULL);
1500	}
1501	return (dlsym_intn(handle, name, clmp, dlmp));
1502}
1503
1504
1505#pragma weak _dlsym = dlsym
1506
1507/*
1508 * External entry for dlsym().  On success, returns the address of the specified
1509 * symbol.  On error returns a null.
1510 */
1511void *
1512dlsym(void *handle, const char *name)
1513{
1514	int	entry;
1515	Rt_map	*clmp, *dlmp = NULL;
1516	void	*addr;
1517
1518	entry = enter(0);
1519
1520	clmp = _caller(caller(), CL_EXECDEF);
1521
1522	addr = dlsym_check(handle, name, clmp, &dlmp);
1523
1524	if (entry) {
1525		if (dlmp)
1526			is_dep_init(dlmp, clmp);
1527		leave(LIST(clmp), 0);
1528	}
1529	return (addr);
1530}
1531
1532/*
1533 * Core dladdr activity.
1534 */
1535static void
1536dladdr_core(Rt_map *almp, void *addr, Dl_info_t *dlip, void **info, int flags)
1537{
1538	/*
1539	 * Set up generic information and any defaults.
1540	 */
1541	dlip->dli_fname = PATHNAME(almp);
1542
1543	dlip->dli_fbase = (void *)ADDR(almp);
1544	dlip->dli_sname = NULL;
1545	dlip->dli_saddr = NULL;
1546
1547	/*
1548	 * Determine the nearest symbol to this address.
1549	 */
1550	LM_DLADDR(almp)((ulong_t)addr, almp, dlip, info, flags);
1551}
1552
1553#pragma weak _dladdr = dladdr
1554
1555/*
1556 * External entry for dladdr(3dl) and dladdr1(3dl).  Returns an information
1557 * structure that reflects the symbol closest to the address specified.
1558 */
1559int
1560dladdr(void *addr, Dl_info_t *dlip)
1561{
1562	int	entry, ret;
1563	Rt_map	*clmp, *almp;
1564	Lm_list	*clml;
1565
1566	entry = enter(0);
1567
1568	clmp = _caller(caller(), CL_EXECDEF);
1569	clml = LIST(clmp);
1570
1571	DBG_CALL(Dbg_dl_dladdr(clmp, addr));
1572
1573	/*
1574	 * Use our calling technique to determine what object is associated
1575	 * with the supplied address.  If a caller can't be determined,
1576	 * indicate the failure.
1577	 */
1578	if ((almp = _caller(addr, CL_NONE)) == NULL) {
1579		eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1580		    EC_NATPTR(addr));
1581		ret = 0;
1582	} else {
1583		dladdr_core(almp, addr, dlip, 0, 0);
1584		ret = 1;
1585	}
1586
1587	if (entry)
1588		leave(clml, 0);
1589	return (ret);
1590}
1591
1592#pragma weak _dladdr1 = dladdr1
1593
1594int
1595dladdr1(void *addr, Dl_info_t *dlip, void **info, int flags)
1596{
1597	int	entry, ret = 1;
1598	Rt_map	*clmp, *almp;
1599	Lm_list	*clml;
1600
1601	entry = enter(0);
1602
1603	clmp = _caller(caller(), CL_EXECDEF);
1604	clml = LIST(clmp);
1605
1606	DBG_CALL(Dbg_dl_dladdr(clmp, addr));
1607
1608	/*
1609	 * Validate any flags.
1610	 */
1611	if (flags) {
1612		int	request;
1613
1614		if (((request = (flags & RTLD_DL_MASK)) != RTLD_DL_SYMENT) &&
1615		    (request != RTLD_DL_LINKMAP)) {
1616			eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLFLAGS),
1617			    flags);
1618			ret = 0;
1619
1620		} else if (info == NULL) {
1621			eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLINFO),
1622			    flags);
1623			ret = 0;
1624		}
1625	}
1626
1627	/*
1628	 * Use our calling technique to determine what object is associated
1629	 * with the supplied address.  If a caller can't be determined,
1630	 * indicate the failure.
1631	 */
1632	if (ret) {
1633		if ((almp = _caller(addr, CL_NONE)) == NULL) {
1634			eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1635			    EC_NATPTR(addr));
1636			ret = 0;
1637		} else
1638			dladdr_core(almp, addr, dlip, info, flags);
1639	}
1640
1641	if (entry)
1642		leave(clml, 0);
1643	return (ret);
1644}
1645
1646/*
1647 * Core dldump activity.
1648 */
1649static int
1650dldump_core(Rt_map *clmp, Rt_map *lmp, const char *ipath, const char *opath,
1651    int flags)
1652{
1653	Lm_list	*lml = LIST(clmp);
1654	Addr	addr = 0;
1655
1656	/*
1657	 * Verify any arguments first.
1658	 */
1659	if ((opath == NULL) || (opath[0] == '\0') ||
1660	    ((lmp == NULL) && (ipath[0] == '\0'))) {
1661		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
1662		return (1);
1663	}
1664
1665	/*
1666	 * If an input file is specified make sure its one of our dependencies
1667	 * on the main link-map list.  Note, this has really all evolved for
1668	 * crle(), which uses libcrle.so on an alternative link-map to trigger
1669	 * dumping objects from the main link-map list.   If we ever want to
1670	 * dump objects from alternative link-maps, this model is going to
1671	 * have to be revisited.
1672	 */
1673	if (lmp == NULL) {
1674		if ((lmp = is_so_loaded(&lml_main, ipath, NULL)) == NULL) {
1675			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NOFILE),
1676			    ipath);
1677			return (1);
1678		}
1679		if (FLAGS(lmp) & FLG_RT_ALTER) {
1680			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_ALTER), ipath);
1681			return (1);
1682		}
1683		if (FLAGS(lmp) & FLG_RT_NODUMP) {
1684			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NODUMP),
1685			    ipath);
1686			return (1);
1687		}
1688	}
1689
1690	/*
1691	 * If the object being dump'ed isn't fixed identify its mapping.
1692	 */
1693	if (!(FLAGS(lmp) & FLG_RT_FIXED))
1694		addr = ADDR(lmp);
1695
1696	/*
1697	 * As rt_dldump() will effectively lazy load the necessary support
1698	 * libraries, make sure ld.so.1 is initialized for plt relocations.
1699	 */
1700	if (elf_rtld_load() == 0)
1701		return (0);
1702
1703	/*
1704	 * Dump the required image.
1705	 */
1706	return (rt_dldump(lmp, opath, flags, addr));
1707}
1708
1709#pragma weak _dldump = dldump
1710
1711/*
1712 * External entry for dldump(3c).  Returns 0 on success, non-zero otherwise.
1713 */
1714int
1715dldump(const char *ipath, const char *opath, int flags)
1716{
1717	int	error, entry;
1718	Rt_map	*clmp, *lmp;
1719
1720	entry = enter(0);
1721
1722	clmp = _caller(caller(), CL_EXECDEF);
1723
1724	if (ipath) {
1725		lmp = NULL;
1726	} else {
1727		lmp = lml_main.lm_head;
1728		ipath = NAME(lmp);
1729	}
1730
1731	DBG_CALL(Dbg_dl_dldump(clmp, ipath, opath, flags));
1732
1733	error = dldump_core(clmp, lmp, ipath, opath, flags);
1734
1735	if (entry)
1736		leave(LIST(clmp), 0);
1737	return (error);
1738}
1739
1740/*
1741 * get_linkmap_id() translates Lm_list * pointers to the Link_map id as used by
1742 * the rtld_db and dlmopen() interfaces.  It checks to see if the Link_map is
1743 * one of the primary ones and if so returns it's special token:
1744 *		LM_ID_BASE
1745 *		LM_ID_LDSO
1746 *
1747 * If it's not one of the primary link_map id's it will instead returns a
1748 * pointer to the Lm_list structure which uniquely identifies the Link_map.
1749 */
1750Lmid_t
1751get_linkmap_id(Lm_list *lml)
1752{
1753	if (lml->lm_flags & LML_FLG_BASELM)
1754		return (LM_ID_BASE);
1755	if (lml->lm_flags & LML_FLG_RTLDLM)
1756		return (LM_ID_LDSO);
1757
1758	return ((Lmid_t)lml);
1759}
1760
1761/*
1762 * Set a new deferred dependency name.
1763 */
1764static int
1765set_def_need(Lm_list *lml, Dyninfo *dyip, const char *name)
1766{
1767	/*
1768	 * If this dependency has already been established, then this dlinfo()
1769	 * call is too late.
1770	 */
1771	if (dyip->di_info) {
1772		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_DEF_DEPLOADED),
1773		    dyip->di_name);
1774		return (-1);
1775	}
1776
1777	/*
1778	 * Assign the new dependency name.
1779	 */
1780	DBG_CALL(Dbg_file_deferred(lml, dyip->di_name, name));
1781	dyip->di_flags |= FLG_DI_DEF_DONE;
1782	dyip->di_name = name;
1783	return (0);
1784}
1785
1786/*
1787 * Extract information for a dlopen() handle.
1788 */
1789static int
1790dlinfo_core(void *handle, int request, void *p, Rt_map *clmp)
1791{
1792	Conv_inv_buf_t	inv_buf;
1793	char		*handlename;
1794	Lm_list		*lml = LIST(clmp);
1795	Rt_map		*lmp = NULL;
1796
1797	/*
1798	 * Determine whether a handle is provided.  A handle isn't needed for
1799	 * all operations, but it is validated here for the initial diagnostic.
1800	 */
1801	if (handle == RTLD_SELF) {
1802		lmp = clmp;
1803	} else {
1804		Grp_hdl	*ghp = (Grp_hdl *)handle;
1805
1806		if (hdl_validate(ghp))
1807			lmp = ghp->gh_ownlmp;
1808	}
1809	if (lmp) {
1810		handlename = NAME(lmp);
1811	} else {
1812		(void) conv_invalid_val(&inv_buf, EC_NATPTR(handle), 0);
1813		handlename = inv_buf.buf;
1814	}
1815
1816	DBG_CALL(Dbg_dl_dlinfo(clmp, handlename, request, p));
1817
1818	/*
1819	 * Validate the request and return buffer.
1820	 */
1821	if ((request > RTLD_DI_MAX) || (p == NULL)) {
1822		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLVAL));
1823		return (-1);
1824	}
1825
1826	/*
1827	 * Return configuration cache name and address.
1828	 */
1829	if (request == RTLD_DI_CONFIGADDR) {
1830		Dl_info_t	*dlip = (Dl_info_t *)p;
1831
1832		if ((config->c_name == NULL) || (config->c_bgn == 0) ||
1833		    (config->c_end == 0)) {
1834			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOCONFIG));
1835			return (-1);
1836		}
1837		dlip->dli_fname = config->c_name;
1838		dlip->dli_fbase = (void *)config->c_bgn;
1839		return (0);
1840	}
1841
1842	/*
1843	 * Return profiled object name (used by ldprof audit library).
1844	 */
1845	if (request == RTLD_DI_PROFILENAME) {
1846		if (profile_name == NULL) {
1847			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOPROFNAME));
1848			return (-1);
1849		}
1850
1851		*(const char **)p = profile_name;
1852		return (0);
1853	}
1854	if (request == RTLD_DI_PROFILEOUT) {
1855		/*
1856		 * If a profile destination directory hasn't been specified
1857		 * provide a default.
1858		 */
1859		if (profile_out == NULL)
1860			profile_out = MSG_ORIG(MSG_PTH_VARTMP);
1861
1862		*(const char **)p = profile_out;
1863		return (0);
1864	}
1865
1866	/*
1867	 * Obtain or establish a termination signal.
1868	 */
1869	if (request == RTLD_DI_GETSIGNAL) {
1870		*(int *)p = killsig;
1871		return (0);
1872	}
1873
1874	if (request == RTLD_DI_SETSIGNAL) {
1875		sigset_t	set;
1876		int		sig = *(int *)p;
1877
1878		/*
1879		 * Determine whether the signal is in range.
1880		 */
1881		(void) sigfillset(&set);
1882		if (sigismember(&set, sig) != 1) {
1883			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVSIG), sig);
1884			return (-1);
1885		}
1886
1887		killsig = sig;
1888		return (0);
1889	}
1890
1891	/*
1892	 * For any other request a link-map is required.  Verify the handle.
1893	 */
1894	if (lmp == NULL) {
1895		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL),
1896		    EC_NATPTR(handle));
1897		return (-1);
1898	}
1899
1900	/*
1901	 * Obtain the process arguments, environment and auxv.  Note, as the
1902	 * environment can be modified by the user (putenv(3c)), reinitialize
1903	 * the environment pointer on each request.
1904	 */
1905	if (request == RTLD_DI_ARGSINFO) {
1906		Dl_argsinfo_t	*aip = (Dl_argsinfo_t *)p;
1907		Lm_list		*lml = LIST(lmp);
1908
1909		*aip = argsinfo;
1910		if (lml->lm_flags & LML_FLG_ENVIRON)
1911			aip->dla_envp = *(lml->lm_environ);
1912
1913		return (0);
1914	}
1915
1916	/*
1917	 * Return Lmid_t of the Link-Map list that the specified object is
1918	 * loaded on.
1919	 */
1920	if (request == RTLD_DI_LMID) {
1921		*(Lmid_t *)p = get_linkmap_id(LIST(lmp));
1922		return (0);
1923	}
1924
1925	/*
1926	 * Return a pointer to the Link-Map structure associated with the
1927	 * specified object.
1928	 */
1929	if (request == RTLD_DI_LINKMAP) {
1930		*(Link_map **)p = (Link_map *)lmp;
1931		return (0);
1932	}
1933
1934	/*
1935	 * Return search path information, or the size of the buffer required
1936	 * to store the information.
1937	 */
1938	if ((request == RTLD_DI_SERINFO) || (request == RTLD_DI_SERINFOSIZE)) {
1939		Spath_desc	sd = { search_rules, NULL, 0 };
1940		Pdesc		*pdp;
1941		Dl_serinfo_t	*info;
1942		Dl_serpath_t	*path;
1943		char		*strs;
1944		size_t		size = sizeof (Dl_serinfo_t);
1945		uint_t		cnt = 0;
1946
1947		info = (Dl_serinfo_t *)p;
1948		path = &info->dls_serpath[0];
1949		strs = (char *)&info->dls_serpath[info->dls_cnt];
1950
1951		/*
1952		 * Traverse search path entries for this object.
1953		 */
1954		while ((pdp = get_next_dir(&sd, lmp, 0)) != NULL) {
1955			size_t	_size;
1956
1957			if (pdp->pd_pname == NULL)
1958				continue;
1959
1960			/*
1961			 * If configuration information exists, it's possible
1962			 * this path has been identified as non-existent, if so
1963			 * ignore it.
1964			 */
1965			if (pdp->pd_info) {
1966				Rtc_obj	*dobj = (Rtc_obj *)pdp->pd_info;
1967				if (dobj->co_flags & RTC_OBJ_NOEXIST)
1968					continue;
1969			}
1970
1971			/*
1972			 * Keep track of search path count and total info size.
1973			 */
1974			if (cnt++)
1975				size += sizeof (Dl_serpath_t);
1976			_size = pdp->pd_plen + 1;
1977			size += _size;
1978
1979			if (request == RTLD_DI_SERINFOSIZE)
1980				continue;
1981
1982			/*
1983			 * If we're filling in search path information, confirm
1984			 * there's sufficient space.
1985			 */
1986			if (size > info->dls_size) {
1987				eprintf(lml, ERR_FATAL,
1988				    MSG_INTL(MSG_ARG_SERSIZE),
1989				    EC_OFF(info->dls_size));
1990				return (-1);
1991			}
1992			if (cnt > info->dls_cnt) {
1993				eprintf(lml, ERR_FATAL,
1994				    MSG_INTL(MSG_ARG_SERCNT), info->dls_cnt);
1995				return (-1);
1996			}
1997
1998			/*
1999			 * Append the path to the information buffer.
2000			 */
2001			(void) strcpy(strs, pdp->pd_pname);
2002			path->dls_name = strs;
2003			path->dls_flags = (pdp->pd_flags & LA_SER_MASK);
2004
2005			strs = strs + _size;
2006			path++;
2007		}
2008
2009		/*
2010		 * If we're here to size the search buffer fill it in.
2011		 */
2012		if (request == RTLD_DI_SERINFOSIZE) {
2013			info->dls_size = size;
2014			info->dls_cnt = cnt;
2015		}
2016
2017		return (0);
2018	}
2019
2020	/*
2021	 * Return the origin of the object associated with this link-map.
2022	 * Basically return the dirname(1) of the objects fullpath.
2023	 */
2024	if (request == RTLD_DI_ORIGIN) {
2025		char	*str = (char *)p;
2026
2027		(void) strncpy(str, ORIGNAME(lmp), DIRSZ(lmp));
2028		str += DIRSZ(lmp);
2029		*str = '\0';
2030
2031		return (0);
2032	}
2033
2034	/*
2035	 * Return the number of object mappings, or the mapping information for
2036	 * this object.
2037	 */
2038	if (request == RTLD_DI_MMAPCNT) {
2039		uint_t	*cnt = (uint_t *)p;
2040
2041		*cnt = MMAPCNT(lmp);
2042		return (0);
2043	}
2044	if (request == RTLD_DI_MMAPS) {
2045		Dl_mapinfo_t	*mip = (Dl_mapinfo_t *)p;
2046
2047		if (mip->dlm_acnt && mip->dlm_maps) {
2048			uint_t	cnt = 0;
2049
2050			while ((cnt < mip->dlm_acnt) && (cnt < MMAPCNT(lmp))) {
2051				mip->dlm_maps[cnt] = MMAPS(lmp)[cnt];
2052				cnt++;
2053			}
2054			mip->dlm_rcnt = cnt;
2055		}
2056		return (0);
2057	}
2058
2059	/*
2060	 * Assign a new dependency name to a deferred dependency.
2061	 */
2062	if ((request == RTLD_DI_DEFERRED) ||
2063	    (request == RTLD_DI_DEFERRED_SYM)) {
2064		Dl_definfo_t	*dfip = (Dl_definfo_t *)p;
2065		Dyninfo		*dyip;
2066		const char	*dname, *rname;
2067
2068		/*
2069		 * Verify the names.
2070		 */
2071		if ((dfip->dld_refname == NULL) ||
2072		    (dfip->dld_depname == NULL)) {
2073			eprintf(LIST(clmp), ERR_FATAL,
2074			    MSG_INTL(MSG_ARG_ILLNAME));
2075			return (-1);
2076		}
2077
2078		dname = dfip->dld_depname;
2079		rname = dfip->dld_refname;
2080
2081		/*
2082		 * A deferred dependency can be determined by referencing a
2083		 * symbol family member that is associated to the dependency,
2084		 * or by looking for the dependency by its name.
2085		 */
2086		if (request == RTLD_DI_DEFERRED_SYM) {
2087			Slookup		sl;
2088			Sresult		sr;
2089			uint_t		binfo;
2090			Syminfo		*sip;
2091
2092			/*
2093			 * Lookup the symbol in the associated object.
2094			 */
2095			SLOOKUP_INIT(sl, rname, lmp, lmp, ld_entry_cnt,
2096			    elf_hash(rname), 0, 0, 0, LKUP_SYMNDX);
2097			SRESULT_INIT(sr, rname);
2098			if (sym_lookup_in_caller(clmp, &sl, &sr,
2099			    &binfo) == NULL) {
2100				eprintf(LIST(clmp), ERR_FATAL,
2101				    MSG_INTL(MSG_DEF_NOSYMFOUND), rname);
2102				return (-1);
2103			}
2104
2105			/*
2106			 * Use the symbols index to reference the Syminfo entry
2107			 * and thus find the associated dependency.
2108			 */
2109			if (sl.sl_rsymndx && ((sip = SYMINFO(clmp)) != NULL)) {
2110				/* LINTED */
2111				sip = (Syminfo *)((char *)sip +
2112				    (sl.sl_rsymndx * SYMINENT(lmp)));
2113
2114				if ((sip->si_flags & SYMINFO_FLG_DEFERRED) &&
2115				    (sip->si_boundto < SYMINFO_BT_LOWRESERVE) &&
2116				    ((dyip = DYNINFO(lmp)) != NULL)) {
2117					dyip += sip->si_boundto;
2118
2119					if (!(dyip->di_flags & FLG_DI_IGNORE))
2120						return (set_def_need(lml,
2121						    dyip, dname));
2122				}
2123			}
2124
2125			/*
2126			 * No deferred symbol found.
2127			 */
2128			eprintf(LIST(clmp), ERR_FATAL,
2129			    MSG_INTL(MSG_DEF_NOSYMFOUND), rname);
2130			return (-1);
2131
2132		} else {
2133			Dyn	*dyn;
2134
2135			/*
2136			 * Using the target objects dependency information, find
2137			 * the associated deferred dependency.
2138			 */
2139			for (dyn = DYN(lmp), dyip = DYNINFO(lmp);
2140			    !(dyip->di_flags & FLG_DI_IGNORE); dyn++, dyip++) {
2141				const char	*oname;
2142
2143				if ((dyip->di_flags & FLG_DI_DEFERRED) == 0)
2144					continue;
2145
2146				if (strcmp(rname, dyip->di_name) == 0)
2147					return (set_def_need(lml, dyip, dname));
2148
2149				/*
2150				 * If this dependency name has been changed by
2151				 * a previous dlinfo(), check the original
2152				 * dynamic entry string.  The user might be
2153				 * attempting to re-change an entry using the
2154				 * original name as the reference.
2155				 */
2156				if ((dyip->di_flags & FLG_DI_DEF_DONE) == 0)
2157					continue;
2158
2159				oname = STRTAB(lmp) + dyn->d_un.d_val;
2160				if (strcmp(rname, oname) == 0)
2161					return (set_def_need(lml, dyip, dname));
2162			}
2163
2164			/*
2165			 * No deferred dependency found.
2166			 */
2167			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_DEF_NODEPFOUND),
2168			    rname);
2169			return (-1);
2170		}
2171	}
2172	return (0);
2173}
2174
2175#pragma weak _dlinfo = dlinfo
2176
2177/*
2178 * External entry for dlinfo(3dl).
2179 */
2180int
2181dlinfo(void *handle, int request, void *p)
2182{
2183	int	error, entry;
2184	Rt_map	*clmp;
2185
2186	entry = enter(0);
2187
2188	clmp = _caller(caller(), CL_EXECDEF);
2189
2190	error = dlinfo_core(handle, request, p, clmp);
2191
2192	if (entry)
2193		leave(LIST(clmp), 0);
2194	return (error);
2195}
2196
2197/*
2198 * GNU defined function to iterate through the program headers for all
2199 * currently loaded dynamic objects. The caller supplies a callback function
2200 * which is called for each object.
2201 *
2202 * entry:
2203 *	callback - Callback function to call. The arguments to the callback
2204 *		function are:
2205 *		info - Address of dl_phdr_info structure
2206 *		size - sizeof (struct dl_phdr_info)
2207 *		data - Caller supplied value.
2208 *	data - Value supplied by caller, which is passed to callback without
2209 *		examination.
2210 *
2211 * exit:
2212 *	callback is called for each dynamic ELF object in the process address
2213 *	space, halting when a non-zero value is returned, or when the last
2214 *	object has been processed. The return value from the last call
2215 *	to callback is returned.
2216 *
2217 * note:
2218 *	The Linux implementation has added additional fields to the
2219 *	dl_phdr_info structure over time. The callback function is
2220 *	supposed to use the size field to determine which fields are
2221 *	present, and to avoid attempts to access non-existent fields.
2222 *	We have added those fields that are compatible with Solaris, and
2223 *	which are used by GNU C++ (g++) runtime exception handling support.
2224 *
2225 * note:
2226 *	We issue a callback for every ELF object mapped into the process
2227 *	address space at the time this routine is entered. These callbacks
2228 *	are arbitrary functions that can do anything, including possibly
2229 *	causing new objects to be mapped into the process, or unmapped.
2230 *	This complicates matters:
2231 *
2232 *	-	Adding new objects can cause the alists to be reallocated
2233 *		or for contents to move. This can happen explicitly via
2234 *		dlopen(), or implicitly via lazy loading. One might consider
2235 *		simply banning dlopen from a callback, but lazy loading must
2236 *		be allowed, in which case there's no reason to ban dlopen().
2237 *
2238 *	-	Removing objects can leave us holding references to freed
2239 *		memory that must not be accessed, and can cause the list
2240 *		items to move in a way that would cause us to miss reporting
2241 *		one, or double report others.
2242 *
2243 *	-	We cannot allocate memory to build a separate data structure,
2244 *		because the interface to dl_iterate_phdr() does not have a
2245 *		way to communicate allocation errors back to the caller.
2246 *		Even if we could, it would be difficult to do so efficiently.
2247 *
2248 *	-	It is possible for dl_iterate_phdr() to be called recursively
2249 *		from a callback, and there is no way for us to detect or manage
2250 *		this effectively, particularly as the user might use longjmp()
2251 *		to skip past us on return. Hence, we must be reentrant
2252 *		(stateless), further precluding the option of building a
2253 *		separate data structure.
2254 *
2255 *	Despite these constraints, we are able to traverse the link-map
2256 *	lists safely:
2257 *
2258 *	-	Once interposer (preload) objects have been processed at
2259 *		startup, we know that new objects are always placed at the
2260 *		end of the list. Hence, if we are reading a list when that
2261 *		happens, the new object will not alter the part of the list
2262 *		that we've already processed.
2263 *
2264 *	-	The alist _TRAVERSE macros recalculate the address of the
2265 *		current item from scratch on each iteration, rather than
2266 *		incrementing a pointer. Hence, alist additions that occur
2267 *		in mid-traverse will not cause confusion.
2268 *
2269 * 	There is one limitation: We cannot continue operation if an object
2270 *	is removed from the process from within a callback. We detect when
2271 *	this happens and return immediately with a -1 return value.
2272 *
2273 * note:
2274 *	As currently implemented, if a callback causes an object to be loaded,
2275 *	that object may or may not be reported by the current invocation of
2276 *	dl_iterate_phdr(), based on whether or not we have already processed
2277 *	the link-map list that receives it. If we want to prevent this, it
2278 *	can be done efficiently by associating the current value of cnt_map
2279 *	with each new Rt_map entered into the system. Then this function can
2280 *	use that to detect and skip new objects that enter the system in
2281 *	mid-iteration. However, the Linux documentation is ambiguous on whether
2282 *	this is necessary, and it does not appear to matter in practice.
2283 *	We have therefore chosen not to do so at this time.
2284 */
2285int
2286dl_iterate_phdr(int (*callback)(struct dl_phdr_info *, size_t, void *),
2287    void *data)
2288{
2289	struct dl_phdr_info	info;
2290	u_longlong_t		l_cnt_map = cnt_map;
2291	u_longlong_t		l_cnt_unmap = cnt_unmap;
2292	Lm_list			*lml, *clml;
2293	Lm_cntl			*lmc;
2294	Rt_map			*lmp, *clmp;
2295	Aliste			idx1, idx2;
2296	Ehdr			*ehdr;
2297	int			ret = 0;
2298	int			entry;
2299
2300	entry = enter(0);
2301	clmp = _caller(caller(), CL_EXECDEF);
2302	clml = LIST(clmp);
2303
2304	DBG_CALL(Dbg_dl_iphdr_enter(clmp, cnt_map, cnt_unmap));
2305
2306	/* Issue a callback for each ELF object in the process */
2307	for (APLIST_TRAVERSE(dynlm_list, idx1, lml)) {
2308		for (ALIST_TRAVERSE(lml->lm_lists, idx2, lmc)) {
2309			for (lmp = lmc->lc_head; lmp; lmp = NEXT_RT_MAP(lmp)) {
2310#if defined(_sparc) && !defined(_LP64)
2311				/*
2312				 * On 32-bit sparc, the possibility exists that
2313				 * this object is not ELF.
2314				 */
2315				if (THIS_IS_NOT_ELF(lmp))
2316					continue;
2317#endif
2318				/* Prepare the object information structure */
2319				ehdr = (Ehdr *) ADDR(lmp);
2320				info.dlpi_addr = (ehdr->e_type == ET_EXEC) ?
2321				    0 : ADDR(lmp);
2322				info.dlpi_name = lmp->rt_pathname;
2323				info.dlpi_phdr = (Phdr *)
2324				    (ADDR(lmp) + ehdr->e_phoff);
2325				info.dlpi_phnum = ehdr->e_phnum;
2326				info.dlpi_adds = cnt_map;
2327				info.dlpi_subs = cnt_unmap;
2328
2329				/* Issue the callback */
2330				DBG_CALL(Dbg_dl_iphdr_callback(clml, &info));
2331				leave(clml, thr_flg_reenter);
2332				ret = (* callback)(&info, sizeof (info), data);
2333				(void) enter(thr_flg_reenter);
2334
2335				/* Return immediately on non-zero result */
2336				if (ret != 0)
2337					goto done;
2338
2339				/* Adapt to object mapping changes */
2340				if ((cnt_map == l_cnt_map) &&
2341				    (cnt_unmap == l_cnt_unmap))
2342					continue;
2343
2344				DBG_CALL(Dbg_dl_iphdr_mapchange(clml, cnt_map,
2345				    cnt_unmap));
2346
2347				/* Stop if an object was unmapped */
2348				if (cnt_unmap == l_cnt_unmap) {
2349					l_cnt_map = cnt_map;
2350					continue;
2351				}
2352
2353				ret = -1;
2354				DBG_CALL(Dbg_dl_iphdr_unmap_ret(clml));
2355				goto done;
2356			}
2357		}
2358	}
2359
2360done:
2361	if (entry)
2362		leave(LIST(clmp), 0);
2363	return (ret);
2364}
2365