smatch clean rtld

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  *      Copyright (c) 1988 AT&T
  24  *        All Rights Reserved
  25  *
  26  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
  27  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  28  */
  29 
  30 /*
  31  * Programmatic interface to the run_time linker.
  32  */
  33 
  34 #include        <sys/debug.h>
  35 #include        <stdio.h>
  36 #include        <string.h>
  37 #include        <dlfcn.h>
  38 #include        <synch.h>
  39 #include        <limits.h>
  40 #include        <debug.h>
  41 #include        <conv.h>
  42 #include        "_rtld.h"
  43 #include        "_audit.h"
  44 #include        "_elf.h"
  45 #include        "_inline_gen.h"
  46 #include        "msg.h"
  47 
  48 /*
  49  * Determine who called us - given a pc determine in which object it resides.
  50  *
  51  * For dlopen() the link map of the caller must be passed to load_so() so that
  52  * the appropriate search rules (4.x or 5.0) are used to locate any
  53  * dependencies.  Also, if we've been called from a 4.x module it may be
  54  * necessary to fix the specified pathname so that it conforms with the 5.0 elf
  55  * rules.
  56  *
  57  * For dlsym() the link map of the caller is used to determine RTLD_NEXT
  58  * requests, together with requests based off of a dlopen(0).
  59  * For dladdr() this routines provides a generic means of scanning all loaded
  60  * segments.
  61  */
  62 Rt_map *
  63 _caller(caddr_t cpc, int flags)
  64 {
  65         Lm_list *lml;
  66         Aliste  idx1;
  67 
  68         for (APLIST_TRAVERSE(dynlm_list, idx1, lml)) {
  69                 Aliste  idx2;
  70                 Lm_cntl *lmc;
  71 
  72                 for (ALIST_TRAVERSE(lml->lm_lists, idx2, lmc)) {
  73                         Rt_map  *lmp;
  74 
  75                         for (lmp = lmc->lc_head; lmp;
  76                             lmp = NEXT_RT_MAP(lmp)) {
  77 
  78                                 if (find_segment(cpc, lmp))
  79                                         return (lmp);
  80                         }
  81                 }
  82         }
  83 
  84         /*
  85          * No mapping can be determined.  If asked for a default, assume this
  86          * is from the executable.
  87          */
  88         if (flags & CL_EXECDEF)
  89                 return ((Rt_map *)lml_main.lm_head);
  90 
  91         return (0);
  92 }
  93 
  94 #pragma weak _dlerror = dlerror
  95 
  96 /*
  97  * External entry for dlerror(3dl).  Returns a pointer to the string describing
  98  * the last occurring error.  The last occurring error is cleared.
  99  */
 100 char *
 101 dlerror()
 102 {
 103         char    *error;
 104         Rt_map  *clmp;
 105         int     entry;
 106 
 107         entry = enter(0);
 108 
 109         clmp = _caller(caller(), CL_EXECDEF);
 110 
 111         DBG_CALL(Dbg_dl_dlerror(clmp, lasterr));
 112 
 113         error = lasterr;
 114         lasterr = NULL;
 115 
 116         if (entry)
 117                 leave(LIST(clmp), 0);
 118         return (error);
 119 }
 120 
 121 /*
 122  * Add a dependency as a group descriptor to a group handle.  Returns 0 on
 123  * failure.  On success, returns the group descriptor, and if alep is non-NULL
 124  * the *alep is set to ALE_EXISTS if the dependency already exists, or to
 125  * ALE_CREATE if the dependency is newly created.
 126  */
 127 Grp_desc *
 128 hdl_add(Grp_hdl *ghp, Rt_map *lmp, uint_t dflags, int *alep)
 129 {
 130         Grp_desc        *gdp;
 131         Aliste          idx;
 132         int             ale = ALE_CREATE;
 133         uint_t          oflags;
 134 
 135         /*
 136          * Make sure this dependency hasn't already been recorded.
 137          */
 138         for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
 139                 if (gdp->gd_depend == lmp) {
 140                         ale = ALE_EXISTS;
 141                         break;
 142                 }
 143         }
 144 
 145         if (ale == ALE_CREATE) {
 146                 Grp_desc        gd;
 147 
 148                 /*
 149                  * Create a new handle descriptor.
 150                  */
 151                 gd.gd_depend = lmp;
 152                 gd.gd_flags = 0;
 153 
 154                 /*
 155                  * Indicate this object is a part of this handles group.
 156                  */
 157                 if (aplist_append(&GROUPS(lmp), ghp, AL_CNT_GROUPS) == NULL)
 158                         return (NULL);
 159 
 160                 /*
 161                  * Append the new dependency to this handle.
 162                  */
 163                 if ((gdp = alist_append(&ghp->gh_depends, &gd,
 164                     sizeof (Grp_desc), AL_CNT_DEPENDS)) == NULL)
 165                         return (NULL);
 166         }
 167 
 168         oflags = gdp->gd_flags;
 169         gdp->gd_flags |= dflags;
 170 
 171         if (DBG_ENABLED) {
 172                 if (ale == ALE_CREATE)
 173                         DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_ADD,
 174                             gdp->gd_flags));
 175                 else if (gdp->gd_flags != oflags)
 176                         DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_UPDATE,
 177                             gdp->gd_flags));
 178         }
 179 
 180         if (alep)
 181                 *alep = ale;
 182         return (gdp);
 183 }
 184 
 185 /*
 186  * Create a handle.
 187  *
 188  *   rlmp -     represents the reference link-map for which the handle is being
 189  *              created.
 190  *   clmp -     represents the caller who is requesting the handle.
 191  *   hflags -   provide group handle flags (GPH_*) that affect the use of the
 192  *              handle, such as dlopen(0), or use or use of RTLD_FIRST.
 193  *   rdflags -  provide group dependency flags for the reference link-map rlmp,
 194  *              such as whether the dependency can be used for dlsym(), can be
 195  *              relocated against, or whether this objects dependencies should
 196  *              be processed.
 197  *   cdflags -  provide group dependency flags for the caller.
 198  */
 199 Grp_hdl *
 200 hdl_create(Lm_list *lml, Rt_map *rlmp, Rt_map *clmp, uint_t hflags,
 201     uint_t rdflags, uint_t cdflags)
 202 {
 203         Grp_hdl *ghp = NULL, *aghp;
 204         APlist  **alpp;
 205         Aliste  idx;
 206 
 207         /*
 208          * For dlopen(0) the handle is maintained as part of the link-map list,
 209          * otherwise the handle is associated with the reference link-map.
 210          */
 211         if (hflags & GPH_ZERO)
 212                 alpp = &(lml->lm_handle);
 213         else
 214                 alpp = &(HANDLES(rlmp));
 215 
 216         /*
 217          * Objects can contain multiple handles depending on the handle flags
 218          * supplied.  Most RTLD flags pertain to the object itself and the
 219          * bindings that it can achieve.  Multiple handles for these flags
 220          * don't make sense.  But if the flag determines how the handle might
 221          * be used, then multiple handles may exist.  Presently this only makes
 222          * sense for RTLD_FIRST.  Determine if an appropriate handle already
 223          * exists.
 224          */
 225         for (APLIST_TRAVERSE(*alpp, idx, aghp)) {
 226                 if ((aghp->gh_flags & GPH_FIRST) == (hflags & GPH_FIRST)) {
 227                         ghp = aghp;
 228                         break;
 229                 }
 230         }
 231 
 232         if (ghp == NULL) {
 233                 uint_t  ndx;
 234 
 235                 /*
 236                  * If this is the first request for this handle, allocate and
 237                  * initialize a new handle.
 238                  */
 239                 DBG_CALL(Dbg_file_hdl_title(DBG_HDL_CREATE));
 240 
 241                 if ((ghp = malloc(sizeof (Grp_hdl))) == NULL)
 242                         return (NULL);
 243 
 244                 /*
 245                  * Associate the handle with the link-map list or the reference
 246                  * link-map as appropriate.
 247                  */
 248                 if (aplist_append(alpp, ghp, AL_CNT_GROUPS) == NULL) {
 249                         free(ghp);
 250                         return (NULL);
 251                 }
 252 
 253                 /*
 254                  * Record the existence of this handle for future verification.
 255                  */
 256                 /* LINTED */
 257                 ndx = (uintptr_t)ghp % HDLIST_SZ;
 258 
 259                 if (aplist_append(&hdl_alp[ndx], ghp, AL_CNT_HANDLES) == NULL) {
 260                         (void) aplist_delete_value(*alpp, ghp);
 261                         free(ghp);
 262                         return (NULL);
 263                 }
 264 
 265                 ghp->gh_depends = NULL;
 266                 ghp->gh_refcnt = 1;
 267                 ghp->gh_flags = hflags;
 268 
 269                 /*
 270                  * A dlopen(0) handle is identified by the GPH_ZERO flag, the
 271                  * head of the link-map list is defined as the owner.  There is
 272                  * no need to maintain a list of dependencies, for when this
 273                  * handle is used (for dlsym()) a dynamic search through the
 274                  * entire link-map list provides for searching all objects with
 275                  * GLOBAL visibility.
 276                  */
 277                 if (hflags & GPH_ZERO) {
 278                         ghp->gh_ownlmp = lml->lm_head;
 279                         ghp->gh_ownlml = lml;
 280                 } else {
 281                         ghp->gh_ownlmp = rlmp;
 282                         ghp->gh_ownlml = LIST(rlmp);
 283 
 284                         if (hdl_add(ghp, rlmp, rdflags, NULL) == NULL)
 285                                 return (NULL);
 286 
 287                         /*
 288                          * If this new handle is a private handle, there's no
 289                          * need to track the caller, so we're done.
 290                          */
 291                         if (hflags & GPH_PRIVATE)
 292                                 return (ghp);
 293 
 294                         /*
 295                          * If this new handle is public, and isn't a special
 296                          * handle representing ld.so.1, indicate that a local
 297                          * group now exists.  This state allows singleton
 298                          * searches to be optimized.
 299                          */
 300                         if ((hflags & GPH_LDSO) == 0)
 301                                 LIST(rlmp)->lm_flags |= LML_FLG_GROUPSEXIST;
 302                 }
 303         } else {
 304                 /*
 305                  * If a handle already exists, bump its reference count.
 306                  *
 307                  * If the previous reference count was 0, then this is a handle
 308                  * that an earlier call to dlclose() was unable to remove.  Such
 309                  * handles are put on the orphan list.  As this handle is back
 310                  * in use, it must be removed from the orphan list.
 311                  *
 312                  * Note, handles associated with a link-map list itself (i.e.
 313                  * dlopen(0)) can have a reference count of 0.  However, these
 314                  * handles are never deleted, and therefore are never moved to
 315                  * the orphan list.
 316                  */
 317                 if ((ghp->gh_refcnt++ == 0) &&
 318                     ((ghp->gh_flags & GPH_ZERO) == 0)) {
 319                         uint_t  ndx;
 320 
 321                         /* LINTED */
 322                         ndx = (uintptr_t)ghp % HDLIST_SZ;
 323 
 324                         (void) aplist_delete_value(hdl_alp[HDLIST_ORP], ghp);
 325                         (void) aplist_append(&hdl_alp[ndx], ghp,
 326                             AL_CNT_HANDLES);
 327 
 328                         if (DBG_ENABLED) {
 329                                 Aliste          idx;
 330                                 Grp_desc        *gdp;
 331 
 332                                 DBG_CALL(Dbg_file_hdl_title(DBG_HDL_REINST));
 333                                 for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp))
 334                                         DBG_CALL(Dbg_file_hdl_action(ghp,
 335                                             gdp->gd_depend, DBG_DEP_REINST, 0));
 336                         }
 337                 }
 338 
 339                 /*
 340                  * If we've been asked to create a private handle, there's no
 341                  * need to track the caller.
 342                  */
 343                 if (hflags & GPH_PRIVATE) {
 344                         /*
 345                          * Negate the reference count increment.
 346                          */
 347                         ghp->gh_refcnt--;
 348                         return (ghp);
 349                 } else {
 350                         /*
 351                          * If a private handle already exists, promote this
 352                          * handle to public by initializing both the reference
 353                          * count and the handle flags.
 354                          */
 355                         if (ghp->gh_flags & GPH_PRIVATE) {
 356                                 ghp->gh_refcnt = 1;
 357                                 ghp->gh_flags &= ~GPH_PRIVATE;
 358                                 ghp->gh_flags |= hflags;
 359                         }
 360                 }
 361         }
 362 
 363         /*
 364          * Keep track of the parent (caller).  As this object can be referenced
 365          * by different parents, this processing is carried out every time a
 366          * handle is requested.
 367          */
 368         if (clmp && (hdl_add(ghp, clmp, cdflags, NULL) == NULL))
 369                 return (NULL);
 370 
 371         return (ghp);
 372 }
 373 
 374 /*
 375  * Initialize a handle that has been created for an object that is already
 376  * loaded.  The handle is initialized with the present dependencies of that
 377  * object.  Once this initialization has occurred, any new objects that might
 378  * be loaded as dependencies (lazy-loading) are added to the handle as each new
 379  * object is loaded.
 380  */
 381 int
 382 hdl_initialize(Grp_hdl *ghp, Rt_map *nlmp, int mode, int promote)
 383 {
 384         Aliste          idx;
 385         Grp_desc        *gdp;
 386 
 387         /*
 388          * If the handle has already been initialized, and the initial object's
 389          * mode hasn't been promoted, there's no need to recompute the modes of
 390          * any dependencies.  If the object we've added has just been opened,
 391          * the objects dependencies will not yet have been processed.  These
 392          * dependencies will be added on later calls to load_one().  Otherwise,
 393          * this object already exists, so add all of its dependencies to the
 394          * handle were operating on.
 395          */
 396         if (((ghp->gh_flags & GPH_INITIAL) && (promote == 0)) ||
 397             ((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0)) {
 398                 ghp->gh_flags |= GPH_INITIAL;
 399                 return (1);
 400         }
 401 
 402         DBG_CALL(Dbg_file_hdl_title(DBG_HDL_ADD));
 403         for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
 404                 Rt_map          *lmp = gdp->gd_depend;
 405                 Aliste          idx1;
 406                 Bnd_desc        *bdp;
 407 
 408                 /*
 409                  * If this dependency doesn't indicate that its dependencies
 410                  * should be added to a handle, ignore it.  This case identifies
 411                  * a parent of a dlopen(RTLD_PARENT) request.
 412                  */
 413                 if ((gdp->gd_flags & GPD_ADDEPS) == 0)
 414                         continue;
 415 
 416                 for (APLIST_TRAVERSE(DEPENDS(lmp), idx1, bdp)) {
 417                         Rt_map  *dlmp = bdp->b_depend;
 418 
 419                         if ((bdp->b_flags & BND_NEEDED) == 0)
 420                                 continue;
 421 
 422                         if (hdl_add(ghp, dlmp,
 423                             (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS), NULL) == NULL)
 424                                 return (0);
 425 
 426                         (void) update_mode(dlmp, MODE(dlmp), mode);
 427                 }
 428         }
 429         ghp->gh_flags |= GPH_INITIAL;
 430         return (1);
 431 }
 432 
 433 /*
 434  * Sanity check a program-provided handle.
 435  */
 436 static int
 437 hdl_validate(Grp_hdl *ghp)
 438 {
 439         Aliste          idx;
 440         Grp_hdl         *lghp;
 441         uint_t          ndx;
 442 
 443         /* LINTED */
 444         ndx = (uintptr_t)ghp % HDLIST_SZ;
 445 
 446         for (APLIST_TRAVERSE(hdl_alp[ndx], idx, lghp)) {
 447                 if ((lghp == ghp) && (ghp->gh_refcnt != 0))
 448                         return (1);
 449         }
 450         return (0);
 451 }
 452 
 453 /*
 454  * Core dlclose activity.
 455  */
 456 int
 457 dlclose_core(Grp_hdl *ghp, Rt_map *clmp, Lm_list *lml)
 458 {
 459         int     error;
 460         Rt_map  *lmp;
 461 
 462         /*
 463          * If we're already at atexit() there's no point processing further,
 464          * all objects have already been tsorted for fini processing.
 465          */
 466         if (rtld_flags & RT_FL_ATEXIT)
 467                 return (0);
 468 
 469         /*
 470          * Diagnose what we're up to.
 471          */
 472         if (ghp->gh_flags & GPH_ZERO) {
 473                 DBG_CALL(Dbg_dl_dlclose(clmp, MSG_ORIG(MSG_STR_ZERO),
 474                     DBG_DLCLOSE_IGNORE));
 475         } else {
 476                 DBG_CALL(Dbg_dl_dlclose(clmp, NAME(ghp->gh_ownlmp),
 477                     DBG_DLCLOSE_NULL));
 478         }
 479 
 480         /*
 481          * Decrement reference count of this object.
 482          */
 483         if (--(ghp->gh_refcnt))
 484                 return (0);
 485 
 486         /*
 487          * If this handle is special (dlopen(0)), then leave it around - it
 488          * has little overhead.
 489          */
 490         if (ghp->gh_flags & GPH_ZERO)
 491                 return (0);
 492 
 493         /*
 494          * If this handle is associated with an object that is not on the base
 495          * link-map control list, or it has not yet been relocated, then this
 496          * handle must have originated from an auditors interaction, or some
 497          * permutation of RTLD_CONFGEN use (crle(1), moe(1), etc.).  User code
 498          * can only execute and bind to relocated objects on the base link-map
 499          * control list.  Outside of RTLD_CONFGEN use, a non-relocated object,
 500          * or an object on a non-base link-map control list, is in the process
 501          * of being loaded, and therefore we do not attempt to remove the
 502          * handle.
 503          */
 504         if (((lmp = ghp->gh_ownlmp) != NULL) &&
 505             ((MODE(lmp) & RTLD_CONFGEN) == 0) &&
 506             ((CNTL(lmp) != ALIST_OFF_DATA) ||
 507             ((FLAGS(lmp) & FLG_RT_RELOCED) == 0)))
 508                 return (0);
 509 
 510         /*
 511          * This handle is no longer being referenced, remove it.  If this handle
 512          * is part of an alternative link-map list, determine if the whole list
 513          * can be removed also.
 514          */
 515         error = remove_hdl(ghp, clmp, NULL);
 516 
 517         if ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)
 518                 remove_lml(lml);
 519 
 520         return (error);
 521 }
 522 
 523 /*
 524  * Internal dlclose activity.  Called from user level or directly for internal
 525  * error cleanup.
 526  */
 527 int
 528 dlclose_intn(Grp_hdl *ghp, Rt_map *clmp)
 529 {
 530         Rt_map  *nlmp = NULL;
 531         Lm_list *olml = NULL;
 532         int     error;
 533 
 534         /*
 535          * Although we're deleting object(s) it's quite possible that additional
 536          * objects get loaded from running the .fini section(s) of the objects
 537          * being deleted.  These objects will have been added to the same
 538          * link-map list as those objects being deleted.  Remember this list
 539          * for later investigation.
 540          */
 541         olml = ghp->gh_ownlml;
 542 
 543         error = dlclose_core(ghp, clmp, olml);
 544 
 545         /*
 546          * Determine whether the original link-map list still exists.  In the
 547          * case of a dlclose of an alternative (dlmopen) link-map the whole
 548          * list may have been removed.
 549          */
 550         if (olml) {
 551                 Aliste  idx;
 552                 Lm_list *lml;
 553 
 554                 for (APLIST_TRAVERSE(dynlm_list, idx, lml)) {
 555                         if (olml == lml) {
 556                                 nlmp = olml->lm_head;
 557                                 break;
 558                         }
 559                 }
 560         }
 561         load_completion(nlmp);
 562         return (error);
 563 }
 564 
 565 /*
 566  * Argument checking for dlclose.  Only called via external entry.
 567  */
 568 static int
 569 dlclose_check(void *handle, Rt_map *clmp)
 570 {
 571         Grp_hdl *ghp = (Grp_hdl *)handle;
 572 
 573         if (hdl_validate(ghp) == 0) {
 574                 Conv_inv_buf_t  inv_buf;
 575 
 576                 (void) conv_invalid_val(&inv_buf, EC_NATPTR(ghp), 0);
 577                 DBG_CALL(Dbg_dl_dlclose(clmp, inv_buf.buf, DBG_DLCLOSE_NULL));
 578 
 579                 eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL),
 580                     EC_NATPTR(handle));
 581                 return (1);
 582         }
 583         return (dlclose_intn(ghp, clmp));
 584 }
 585 
 586 #pragma weak _dlclose = dlclose
 587 
 588 /*
 589  * External entry for dlclose(3dl).  Returns 0 for success, non-zero otherwise.
 590  */
 591 int
 592 dlclose(void *handle)
 593 {
 594         int             error, entry;
 595         Rt_map          *clmp;
 596 
 597         entry = enter(0);
 598 
 599         clmp = _caller(caller(), CL_EXECDEF);
 600 
 601         error = dlclose_check(handle, clmp);
 602 
 603         if (entry)
 604                 leave(LIST(clmp), 0);
 605         return (error);
 606 }
 607 
 608 static uint_t   lmid = 0;
 609 
 610 /*
 611  * The addition of new link-map lists is assumed to be in small quantities.
 612  * Here, we assign a unique link-map id for diagnostic use.  Simply update the
 613  * running link-map count until we max out.
 614  */
 615 int
 616 newlmid(Lm_list *lml)
 617 {
 618         char    buffer[MSG_LMID_ALT_SIZE + 12];
 619 
 620         if (lmid == UINT_MAX) {
 621                 lml->lm_lmid = UINT_MAX;
 622                 (void) strncpy(buffer, MSG_ORIG(MSG_LMID_MAXED),
 623                     MSG_LMID_ALT_SIZE + 12);
 624         } else {
 625                 lml->lm_lmid = lmid++;
 626                 (void) snprintf(buffer, MSG_LMID_ALT_SIZE + 12,
 627                     MSG_ORIG(MSG_LMID_FMT), MSG_ORIG(MSG_LMID_ALT),
 628                     lml->lm_lmid);
 629         }
 630         if ((lml->lm_lmidstr = strdup(buffer)) == NULL)
 631                 return (0);
 632 
 633         return (1);
 634 }
 635 
 636 /*
 637  * Core dlopen activity.
 638  */
 639 static Grp_hdl *
 640 dlmopen_core(Lm_list *lml, Lm_list *olml, const char *path, int mode,
 641     Rt_map *clmp, uint_t flags, uint_t orig, int *in_nfavl)
 642 {
 643         Alist           *palp = NULL;
 644         Rt_map          *nlmp;
 645         Grp_hdl         *ghp;
 646         Aliste          olmco, nlmco;
 647 
 648         DBG_CALL(Dbg_dl_dlopen(clmp,
 649             (path ? path : MSG_ORIG(MSG_STR_ZERO)), in_nfavl, mode));
 650 
 651         /*
 652          * Having diagnosed the originally defined modes, assign any defaults
 653          * or corrections.
 654          */
 655         if (((mode & (RTLD_GROUP | RTLD_WORLD)) == 0) &&
 656             ((mode & RTLD_NOLOAD) == 0))
 657                 mode |= (RTLD_GROUP | RTLD_WORLD);
 658         if ((mode & RTLD_NOW) && (rtld_flags2 & RT_FL2_BINDLAZY)) {
 659                 mode &= ~RTLD_NOW;
 660                 mode |= RTLD_LAZY;
 661         }
 662 
 663         /*
 664          * If the path specified is null then we're operating on global
 665          * objects.  Associate a dummy handle with the link-map list.
 666          */
 667         if (path == NULL) {
 668                 Grp_hdl *ghp;
 669                 uint_t  hflags, rdflags, cdflags;
 670                 int     promote = 0;
 671 
 672                 /*
 673                  * Establish any flags for the handle (Grp_hdl).
 674                  *
 675                  *  -   This is a dummy, public, handle (0) that provides for a
 676                  *      dynamic search of all global objects within the process.
 677                  *  -   Use of the RTLD_FIRST mode indicates that only the first
 678                  *      dependency on the handle (the referenced object) can be
 679                  *      used to satisfy dlsym() requests.
 680                  */
 681                 hflags = (GPH_PUBLIC | GPH_ZERO);
 682                 if (mode & RTLD_FIRST)
 683                         hflags |= GPH_FIRST;
 684 
 685                 /*
 686                  * Establish the flags for the referenced dependency descriptor
 687                  * (Grp_desc).
 688                  *
 689                  *  -   The referenced object is available for dlsym().
 690                  *  -   The referenced object is available to relocate against.
 691                  *  -   The referenced object should have it's dependencies
 692                  *      added to this handle.
 693                  */
 694                 rdflags = (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS);
 695 
 696                 /*
 697                  * Establish the flags for this callers dependency descriptor
 698                  * (Grp_desc).
 699                  *
 700                  *  -   The explicit creation of a handle creates a descriptor
 701                  *      for the referenced object and the parent (caller).
 702                  *  -   Use of the RTLD_PARENT flag indicates that the parent
 703                  *      can be relocated against.
 704                  */
 705                 cdflags = GPD_PARENT;
 706                 if (mode & RTLD_PARENT)
 707                         cdflags |= GPD_RELOC;
 708 
 709                 if ((ghp = hdl_create(lml, 0, clmp, hflags, rdflags,
 710                     cdflags)) == NULL)
 711                         return (NULL);
 712 
 713                 /*
 714                  * Traverse the main link-map control list, updating the mode
 715                  * of any objects as necessary.  Call the relocation engine if
 716                  * this mode promotes the existing state of any relocations.
 717                  * crle()'s first pass loads all objects necessary for building
 718                  * a configuration file, however none of them are relocated.
 719                  * crle()'s second pass relocates objects in preparation for
 720                  * dldump()'ing using dlopen(0, RTLD_NOW).
 721                  */
 722                 if ((mode & (RTLD_NOW | RTLD_CONFGEN)) == RTLD_CONFGEN)
 723                         return (ghp);
 724 
 725                 for (nlmp = lml->lm_head; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
 726                         if (((MODE(nlmp) & RTLD_GLOBAL) == 0) ||
 727                             (FLAGS(nlmp) & FLG_RT_DELETE))
 728                                 continue;
 729 
 730                         if (update_mode(nlmp, MODE(nlmp), mode))
 731                                 promote = 1;
 732                 }
 733                 if (promote)
 734                         (void) relocate_lmc(lml, ALIST_OFF_DATA, clmp,
 735                             lml->lm_head, in_nfavl);
 736 
 737                 return (ghp);
 738         }
 739 
 740         /*
 741          * Fix the pathname.  If this object expands to multiple paths (ie.
 742          * $ISALIST or $HWCAP have been used), then make sure the user has also
 743          * furnished the RTLD_FIRST flag.  As yet, we don't support opening
 744          * more than one object at a time, so enforcing the RTLD_FIRST flag
 745          * provides flexibility should we be able to support dlopening more
 746          * than one object in the future.
 747          */
 748         if (LM_FIX_NAME(clmp)(path, clmp, &palp, AL_CNT_NEEDED, orig) == NULL)
 749                 return (NULL);
 750 
 751         if ((palp->al_arritems > 1) && ((mode & RTLD_FIRST) == 0)) {
 752                 remove_alist(&palp, 1);
 753                 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_5));
 754                 return (NULL);
 755         }
 756 
 757         /*
 758          * Establish a link-map control list for this request, and load the
 759          * associated object.
 760          */
 761         if ((nlmco = create_cntl(lml, 1)) == NULL) {
 762                 remove_alist(&palp, 1);
 763                 return (NULL);
 764         }
 765         olmco = nlmco;
 766 
 767         nlmp = load_one(lml, nlmco, palp, clmp, mode, (flags | FLG_RT_PUBHDL),
 768             &ghp, in_nfavl);
 769 
 770         /*
 771          * Remove any expanded pathname infrastructure, and if the dependency
 772          * couldn't be loaded, cleanup.
 773          */
 774         remove_alist(&palp, 1);
 775         if (nlmp == NULL) {
 776                 remove_cntl(lml, olmco);
 777                 return (NULL);
 778         }
 779 
 780         /*
 781          * If loading an auditor was requested, and the auditor already existed,
 782          * then the link-map returned will be to the original auditor.  The new
 783          * link-map list that was initially created, and the associated link-map
 784          * control list are no longer needed.  As the auditor is already loaded,
 785          * we're probably done, but fall through in case additional relocations
 786          * would be triggered by the mode of the caller.
 787          */
 788         if ((flags & FLG_RT_AUDIT) && (LIST(nlmp) != lml)) {
 789                 remove_cntl(lml, olmco);
 790                 lml = LIST(nlmp);
 791                 olmco = 0;
 792                 nlmco = ALIST_OFF_DATA;
 793         }
 794 
 795         /*
 796          * Finish processing the objects associated with this request.
 797          */
 798         if (((nlmp = analyze_lmc(lml, nlmco, nlmp, clmp, in_nfavl)) == NULL) ||
 799             (relocate_lmc(lml, nlmco, clmp, nlmp, in_nfavl) == 0)) {
 800                 ghp = NULL;
 801                 nlmp = NULL;
 802         }
 803 
 804         /*
 805          * If the dlopen has failed, clean up any objects that might have been
 806          * loaded successfully on this new link-map control list.
 807          */
 808         if (olmco && (nlmp == NULL))
 809                 remove_lmc(lml, clmp, olmco, path);
 810 
 811         /*
 812          * Finally, remove any temporary link-map control list.  Note, if this
 813          * operation successfully established a new link-map list, then a base
 814          * link-map control list will have been created, which must remain.
 815          */
 816         if (olmco && ((nlmp == NULL) || (olml != (Lm_list *)LM_ID_NEWLM)))
 817                 remove_cntl(lml, olmco);
 818 
 819         return (ghp);
 820 }
 821 
 822 /*
 823  * dlopen() and dlsym() operations are the means by which a process can
 824  * test for the existence of required dependencies.  If the necessary
 825  * dependencies don't exist, then associated functionality can't be used.
 826  * However, the lack of dependencies can be fixed, and the dlopen() and
 827  * dlsym() requests can be repeated.  As we use a "not-found" AVL tree to
 828  * cache any failed full path loads, secondary dlopen() and dlsym() requests
 829  * will fail, even if the dependencies have been installed.
 830  *
 831  * dlopen() and dlsym() retry any failures by removing the "not-found" AVL
 832  * tree.  Should any dependencies be found, their names are added to the
 833  * FullPath AVL tree.  This routine removes any new "not-found" AVL tree,
 834  * so that the dlopen() or dlsym() can replace the original "not-found" tree.
 835  */
 836 inline static void
 837 nfavl_remove(avl_tree_t *avlt)
 838 {
 839         PathNode        *pnp;
 840         void            *cookie = NULL;
 841 
 842         if (avlt) {
 843                 while ((pnp = avl_destroy_nodes(avlt, &cookie)) != NULL)
 844                         free(pnp);
 845 
 846                 avl_destroy(avlt);
 847                 free(avlt);
 848         }
 849 }
 850 
 851 /*
 852  * Internal dlopen() activity.  Called from user level or directly for internal
 853  * opens that require a handle.
 854  */
 855 Grp_hdl *
 856 dlmopen_intn(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
 857     uint_t flags, uint_t orig)
 858 {
 859         Lm_list *olml = lml;
 860         Rt_map  *dlmp = NULL;
 861         Grp_hdl *ghp;
 862         int     in_nfavl = 0;
 863 
 864         /*
 865          * Check for magic link-map list values:
 866          *
 867          *  LM_ID_BASE:         Operate on the PRIMARY (executables) link map
 868          *  LM_ID_LDSO:         Operation on ld.so.1's link map
 869          *  LM_ID_NEWLM:        Create a new link-map.
 870          */
 871         if (lml == (Lm_list *)LM_ID_NEWLM) {
 872                 if ((lml = calloc(sizeof (Lm_list), 1)) == NULL)
 873                         return (NULL);
 874 
 875                 /*
 876                  * Establish the new link-map flags from the callers and those
 877                  * explicitly provided.
 878                  */
 879                 lml->lm_tflags = LIST(clmp)->lm_tflags;
 880                 if (flags & FLG_RT_AUDIT) {
 881                         /*
 882                          * Unset any auditing flags - an auditor shouldn't be
 883                          * audited.  Insure all audit dependencies are loaded.
 884                          */
 885                         lml->lm_tflags &= ~LML_TFLG_AUD_MASK;
 886                         lml->lm_tflags |= (LML_TFLG_NOLAZYLD |
 887                             LML_TFLG_LOADFLTR | LML_TFLG_NOAUDIT);
 888                 }
 889 
 890                 if (aplist_append(&dynlm_list, lml, AL_CNT_DYNLIST) == NULL) {
 891                         free(lml);
 892                         return (NULL);
 893                 }
 894                 if (newlmid(lml) == 0) {
 895                         (void) aplist_delete_value(dynlm_list, lml);
 896                         free(lml);
 897                         return (NULL);
 898                 }
 899         } else if ((uintptr_t)lml < LM_ID_NUM) {
 900                 if ((uintptr_t)lml == LM_ID_BASE)
 901                         lml = &lml_main;
 902                 else if ((uintptr_t)lml == LM_ID_LDSO)
 903                         lml = &lml_rtld;
 904         }
 905 
 906         /*
 907          * Open the required object on the associated link-map list.
 908          */
 909         ghp = dlmopen_core(lml, olml, path, mode, clmp, flags, orig, &in_nfavl);
 910 
 911         /*
 912          * If the object could not be found it is possible that the "not-found"
 913          * AVL tree had indicated that the file does not exist.  In case the
 914          * file system has changed since this "not-found" recording was made,
 915          * retry the dlopen() with a clean "not-found" AVL tree.
 916          */
 917         if ((ghp == NULL) && in_nfavl) {
 918                 avl_tree_t      *oavlt = nfavl;
 919 
 920                 nfavl = NULL;
 921                 ghp = dlmopen_core(lml, olml, path, mode, clmp, flags, orig,
 922                     NULL);
 923 
 924                 /*
 925                  * If the file is found, then its full path name will have been
 926                  * registered in the FullPath AVL tree.  Remove any new
 927                  * "not-found" AVL information, and restore the former AVL tree.
 928                  */
 929                 nfavl_remove(nfavl);
 930                 nfavl = oavlt;
 931         }
 932 
 933         /*
 934          * Establish the new link-map from which .init processing will begin.
 935          * Ignore .init firing when constructing a configuration file (crle(1)).
 936          */
 937         if (ghp && ((mode & RTLD_CONFGEN) == 0))
 938                 dlmp = ghp->gh_ownlmp;
 939 
 940         /*
 941          * If loading an auditor was requested, and the auditor already existed,
 942          * then the link-map returned will be to the original auditor.  Remove
 943          * the link-map control list that was created for this request.
 944          */
 945         if (dlmp && (flags & FLG_RT_AUDIT) && (LIST(dlmp) != lml)) {
 946                 remove_lml(lml);
 947                 lml = LIST(dlmp);
 948         }
 949 
 950         /*
 951          * If this load failed, remove any alternative link-map list.
 952          */
 953         if ((ghp == NULL) &&
 954             ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)) {
 955                 remove_lml(lml);
 956                 lml = NULL;
 957         }
 958 
 959         /*
 960          * Finish this load request.  If objects were loaded, .init processing
 961          * is computed.  Finally, the debuggers are informed of the link-map
 962          * lists being stable.
 963          */
 964         load_completion(dlmp);
 965 
 966         return (ghp);
 967 }
 968 
 969 /*
 970  * Argument checking for dlopen.  Only called via external entry.
 971  */
 972 static Grp_hdl *
 973 dlmopen_check(Lm_list *lml, const char *path, int mode, Rt_map *clmp)
 974 {
 975         /*
 976          * Verify that a valid pathname has been supplied.
 977          */
 978         if (path && (*path == '\0')) {
 979                 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
 980                 return (0);
 981         }
 982 
 983         /*
 984          * Historically we've always verified the mode is either RTLD_NOW or
 985          * RTLD_LAZY.  RTLD_NOLOAD is valid by itself.  Use of LM_ID_NEWLM
 986          * requires a specific pathname, and use of RTLD_PARENT is meaningless.
 987          */
 988         if ((mode & (RTLD_NOW | RTLD_LAZY | RTLD_NOLOAD)) == 0) {
 989                 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_1));
 990                 return (0);
 991         }
 992         if ((mode & (RTLD_NOW | RTLD_LAZY)) == (RTLD_NOW | RTLD_LAZY)) {
 993                 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_2));
 994                 return (0);
 995         }
 996         if ((lml == (Lm_list *)LM_ID_NEWLM) && (path == NULL)) {
 997                 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_3));
 998                 return (0);
 999         }
1000         if ((lml == (Lm_list *)LM_ID_NEWLM) && (mode & RTLD_PARENT)) {
1001                 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_4));
1002                 return (0);
1003         }
1004 
1005         return (dlmopen_intn(lml, path, mode, clmp, 0, 0));
1006 }
1007 
1008 #pragma weak _dlopen = dlopen
1009 
1010 /*
1011  * External entry for dlopen(3dl).  On success, returns a pointer (handle) to
1012  * the structure containing information about the newly added object, ie. can
1013  * be used by dlsym(). On failure, returns a null pointer.
1014  */
1015 void *
1016 dlopen(const char *path, int mode)
1017 {
1018         int     entry;
1019         Rt_map  *clmp;
1020         Grp_hdl *ghp;
1021         Lm_list *lml;
1022 
1023         entry = enter(0);
1024 
1025         clmp = _caller(caller(), CL_EXECDEF);
1026         lml = LIST(clmp);
1027 
1028         ghp = dlmopen_check(lml, path, mode, clmp);
1029 
1030         if (entry)
1031                 leave(lml, 0);
1032         return ((void *)ghp);
1033 }
1034 
1035 #pragma weak _dlmopen = dlmopen
1036 
1037 /*
1038  * External entry for dlmopen(3dl).
1039  */
1040 void *
1041 dlmopen(Lmid_t lmid, const char *path, int mode)
1042 {
1043         int     entry;
1044         Rt_map  *clmp;
1045         Grp_hdl *ghp;
1046 
1047         entry = enter(0);
1048 
1049         clmp = _caller(caller(), CL_EXECDEF);
1050 
1051         ghp = dlmopen_check((Lm_list *)lmid, path, mode, clmp);
1052 
1053         if (entry)
1054                 leave(LIST(clmp), 0);
1055         return ((void *)ghp);
1056 }
1057 
1058 /*
1059  * Handle processing for dlsym.
1060  */
1061 int
1062 dlsym_handle(Grp_hdl *ghp, Slookup *slp, Sresult *srp, uint_t *binfo,
1063     int *in_nfavl)
1064 {
1065         Rt_map          *nlmp, * lmp = ghp->gh_ownlmp;
1066         Rt_map          *clmp = slp->sl_cmap;
1067         const char      *name = slp->sl_name;
1068         Slookup         sl = *slp;
1069 
1070         sl.sl_flags = (LKUP_FIRST | LKUP_DLSYM | LKUP_SPEC);
1071 
1072         /*
1073          * Continue processing a dlsym request.  Lookup the required symbol in
1074          * each link-map specified by the handle.
1075          *
1076          * To leverage off of lazy loading, dlsym() requests can result in two
1077          * passes.  The first descends the link-maps of any objects already in
1078          * the address space.  If the symbol isn't located, and lazy
1079          * dependencies still exist, then a second pass is made to load these
1080          * dependencies if applicable.  This model means that in the case where
1081          * a symbol exists in more than one object, the one located may not be
1082          * constant - this is the standard issue with lazy loading. In addition,
1083          * attempting to locate a symbol that doesn't exist will result in the
1084          * loading of all lazy dependencies on the given handle, which can
1085          * defeat some of the advantages of lazy loading (look out JVM).
1086          */
1087         if (ghp->gh_flags & GPH_ZERO) {
1088                 Lm_list *lml;
1089                 uint_t  lazy = 0;
1090 
1091                 /*
1092                  * If this symbol lookup is triggered from a dlopen(0) handle,
1093                  * traverse the present link-map list looking for promiscuous
1094                  * entries.
1095                  */
1096                 for (nlmp = lmp; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
1097                         /*
1098                          * If this handle indicates we're only to look in the
1099                          * first object check whether we're done.
1100                          */
1101                         if ((nlmp != lmp) && (ghp->gh_flags & GPH_FIRST))
1102                                 return (0);
1103 
1104                         if (!(MODE(nlmp) & RTLD_GLOBAL))
1105                                 continue;
1106                         if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1107                             ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1108                                 continue;
1109 
1110                         sl.sl_imap = nlmp;
1111                         if (LM_LOOKUP_SYM(clmp)(&sl, srp, binfo, in_nfavl))
1112                                 return (1);
1113 
1114                         /*
1115                          * Keep track of any global pending lazy loads.
1116                          */
1117                         lazy += LAZY(nlmp);
1118                 }
1119 
1120                 /*
1121                  * If we're unable to locate the symbol and this link-map list
1122                  * still has pending lazy dependencies, start loading them in an
1123                  * attempt to exhaust the search.  Note that as we're already
1124                  * traversing a dynamic linked list of link-maps there's no
1125                  * need for elf_lazy_find_sym() to descend the link-maps itself.
1126                  */
1127                 lml = LIST(lmp);
1128                 if (lazy) {
1129                         DBG_CALL(Dbg_syms_lazy_rescan(lml, name));
1130 
1131                         sl.sl_flags |= LKUP_NODESCENT;
1132 
1133                         for (nlmp = lmp; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
1134 
1135                                 if (!(MODE(nlmp) & RTLD_GLOBAL) || !LAZY(nlmp))
1136                                         continue;
1137                                 if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1138                                     ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1139                                         continue;
1140 
1141                                 sl.sl_imap = nlmp;
1142                                 if (elf_lazy_find_sym(&sl, srp, binfo,
1143                                     in_nfavl))
1144                                         return (1);
1145                         }
1146                 }
1147         } else {
1148                 /*
1149                  * Traverse the dlopen() handle searching all presently loaded
1150                  * link-maps.
1151                  */
1152                 Grp_desc        *gdp;
1153                 Aliste          idx;
1154                 uint_t          lazy = 0;
1155 
1156                 for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1157                         nlmp = gdp->gd_depend;
1158 
1159                         if ((gdp->gd_flags & GPD_DLSYM) == 0)
1160                                 continue;
1161 
1162                         sl.sl_imap = nlmp;
1163                         if (LM_LOOKUP_SYM(clmp)(&sl, srp, binfo, in_nfavl))
1164                                 return (1);
1165 
1166                         if (ghp->gh_flags & GPH_FIRST)
1167                                 return (0);
1168 
1169                         /*
1170                          * Keep track of any pending lazy loads associated
1171                          * with this handle.
1172                          */
1173                         lazy += LAZY(nlmp);
1174                 }
1175 
1176                 /*
1177                  * If we're unable to locate the symbol and this handle still
1178                  * has pending lazy dependencies, start loading the lazy
1179                  * dependencies, in an attempt to exhaust the search.
1180                  */
1181                 if (lazy) {
1182                         DBG_CALL(Dbg_syms_lazy_rescan(LIST(lmp), name));
1183 
1184                         for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1185                                 nlmp = gdp->gd_depend;
1186 
1187                                 if (((gdp->gd_flags & GPD_DLSYM) == 0) ||
1188                                     (LAZY(nlmp) == 0))
1189                                         continue;
1190 
1191                                 sl.sl_imap = nlmp;
1192                                 if (elf_lazy_find_sym(&sl, srp, binfo,
1193                                     in_nfavl))
1194                                         return (1);
1195                         }
1196                 }
1197         }
1198         return (0);
1199 }
1200 
1201 /*
1202  * Determine whether a symbol resides in a caller.  This may be a reference,
1203  * which is associated with a specific dependency.
1204  */
1205 inline static Sym *
1206 sym_lookup_in_caller(Rt_map *clmp, Slookup *slp, Sresult *srp, uint_t *binfo)
1207 {
1208         if (THIS_IS_ELF(clmp) && SYMINTP(clmp)(slp, srp, binfo, NULL)) {
1209                 Sym     *sym = srp->sr_sym;
1210 
1211                 slp->sl_rsymndx = (((ulong_t)sym -
1212                     (ulong_t)SYMTAB(clmp)) / SYMENT(clmp));
1213                 slp->sl_rsym = sym;
1214                 return (sym);
1215         }
1216         return (NULL);
1217 }
1218 
1219 /*
1220  * Core dlsym activity.  Selects symbol lookup method from handle.
1221  */
1222 static void *
1223 dlsym_core(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp,
1224     int *in_nfavl)
1225 {
1226         Sym             *sym;
1227         int             ret = 0;
1228         Syminfo         *sip;
1229         Slookup         sl;
1230         Sresult         sr;
1231         uint_t          binfo;
1232 
1233         /*
1234          * Initialize the symbol lookup data structure.
1235          *
1236          * Standard relocations are evaluated using the symbol index of the
1237          * associated relocation symbol.  This index provides for loading
1238          * any lazy dependency and establishing a direct binding if necessary.
1239          * If a dlsym() operation originates from an object that contains a
1240          * symbol table entry for the same name, then we need to establish the
1241          * symbol index so that any dependency requirements can be triggered.
1242          *
1243          * Therefore, the first symbol lookup that is carried out is for the
1244          * symbol name within the calling object.  If this symbol exists, the
1245          * symbols index is computed, added to the Slookup data, and thus used
1246          * to seed the real symbol lookup.
1247          */
1248         SLOOKUP_INIT(sl, name, clmp, clmp, ld_entry_cnt, elf_hash(name),
1249             0, 0, 0, LKUP_SYMNDX);
1250         SRESULT_INIT(sr, name);
1251         sym = sym_lookup_in_caller(clmp, &sl, &sr, &binfo);
1252 
1253         SRESULT_INIT(sr, name);
1254 
1255         if (sym && (ELF_ST_VISIBILITY(sym->st_other) == STV_SINGLETON)) {
1256                 Rt_map  *hlmp = LIST(clmp)->lm_head;
1257 
1258                 /*
1259                  * If a symbol reference is known, and that reference indicates
1260                  * that the symbol is a singleton, then the search for the
1261                  * symbol must follow the default search path.
1262                  */
1263                 DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, 0,
1264                     DBG_DLSYM_SINGLETON));
1265 
1266                 sl.sl_imap = hlmp;
1267                 if (handle == RTLD_PROBE)
1268                         sl.sl_flags = LKUP_NOFALLBACK;
1269                 else
1270                         sl.sl_flags = LKUP_SPEC;
1271                 ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1272 
1273         } else if (handle == RTLD_NEXT) {
1274                 Rt_map  *nlmp;
1275 
1276                 /*
1277                  * If this handle is RTLD_NEXT determine whether a lazy load
1278                  * from the caller might provide the next object.  This mimics
1279                  * the lazy loading initialization normally carried out by
1280                  * lookup_sym(), however here, we must do this up-front, as
1281                  * lookup_sym() will be used to inspect the next object.
1282                  */
1283                 if ((sl.sl_rsymndx) && ((sip = SYMINFO(clmp)) != NULL)) {
1284                         /* LINTED */
1285                         sip = (Syminfo *)((char *)sip +
1286                             (sl.sl_rsymndx * SYMINENT(clmp)));
1287 
1288                         if ((sip->si_flags & SYMINFO_FLG_DIRECT) &&
1289                             (sip->si_boundto < SYMINFO_BT_LOWRESERVE))
1290                                 (void) elf_lazy_load(clmp, &sl,
1291                                     sip->si_boundto, name, 0, NULL, in_nfavl);
1292 
1293                         /*
1294                          * Clear the symbol index, so as not to confuse
1295                          * lookup_sym() of the next object.
1296                          */
1297                         sl.sl_rsymndx = 0;
1298                         sl.sl_rsym = NULL;
1299                 }
1300 
1301                 /*
1302                  * If the handle is RTLD_NEXT, start searching in the next link
1303                  * map from the callers.  Determine permissions from the
1304                  * present link map.  Indicate to lookup_sym() that we're on an
1305                  * RTLD_NEXT request so that it will use the callers link map to
1306                  * start any possible lazy dependency loading.
1307                  */
1308                 sl.sl_imap = nlmp = NEXT_RT_MAP(clmp);
1309 
1310                 DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl,
1311                     (nlmp ? NAME(nlmp) : MSG_INTL(MSG_STR_NULL)),
1312                     DBG_DLSYM_NEXT));
1313 
1314                 if (nlmp == NULL)
1315                         return (0);
1316 
1317                 sl.sl_flags = LKUP_NEXT;
1318                 ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1319 
1320         } else if (handle == RTLD_SELF) {
1321                 /*
1322                  * If the handle is RTLD_SELF start searching from the caller.
1323                  */
1324                 DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, NAME(clmp),
1325                     DBG_DLSYM_SELF));
1326 
1327                 sl.sl_imap = clmp;
1328                 sl.sl_flags = (LKUP_SPEC | LKUP_SELF);
1329                 ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1330 
1331         } else if (handle == RTLD_DEFAULT) {
1332                 Rt_map  *hlmp = LIST(clmp)->lm_head;
1333 
1334                 /*
1335                  * If the handle is RTLD_DEFAULT mimic the standard symbol
1336                  * lookup as would be triggered by a relocation.
1337                  */
1338                 DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, 0,
1339                     DBG_DLSYM_DEFAULT));
1340 
1341                 sl.sl_imap = hlmp;
1342                 sl.sl_flags = LKUP_SPEC;
1343                 ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1344 
1345         } else if (handle == RTLD_PROBE) {
1346                 Rt_map  *hlmp = LIST(clmp)->lm_head;
1347 
1348                 /*
1349                  * If the handle is RTLD_PROBE, mimic the standard symbol
1350                  * lookup as would be triggered by a relocation, however do
1351                  * not fall back to a lazy loading rescan if the symbol can't be
1352                  * found within the currently loaded objects.  Note, a lazy
1353                  * loaded dependency required by the caller might still get
1354                  * loaded to satisfy this request, but no exhaustive lazy load
1355                  * rescan is carried out.
1356                  */
1357                 DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, 0,
1358                     DBG_DLSYM_PROBE));
1359 
1360                 sl.sl_imap = hlmp;
1361                 sl.sl_flags = LKUP_NOFALLBACK;
1362                 ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1363 
1364         } else {
1365                 Grp_hdl *ghp = (Grp_hdl *)handle;
1366 
1367                 /*
1368                  * Look in the shared object specified by the handle and in all
1369                  * of its dependencies.
1370                  */
1371                 DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl,
1372                     NAME(ghp->gh_ownlmp), DBG_DLSYM_DEF));
1373 
1374                 ret = LM_DLSYM(clmp)(ghp, &sl, &sr, &binfo, in_nfavl);
1375         }
1376 
1377         if (ret && ((sym = sr.sr_sym) != NULL)) {
1378                 Lm_list *lml = LIST(clmp);
1379                 Addr    addr = sym->st_value;
1380 
1381                 *dlmp = sr.sr_dmap;
1382                 if (!(FLAGS(*dlmp) & FLG_RT_FIXED))
1383                         addr += ADDR(*dlmp);
1384 
1385                 /*
1386                  * Indicate that the defining object is now used.
1387                  */
1388                 if (*dlmp != clmp)
1389                         FLAGS1(*dlmp) |= FL1_RT_USED;
1390 
1391                 DBG_CALL(Dbg_bind_global(clmp, 0, 0, (Xword)-1, PLT_T_NONE,
1392                     *dlmp, addr, sym->st_value, sr.sr_name, binfo));
1393 
1394                 if ((lml->lm_tflags | AFLAGS(clmp) | AFLAGS(*dlmp)) &
1395                     LML_TFLG_AUD_SYMBIND) {
1396                         uint_t  sb_flags = LA_SYMB_DLSYM;
1397                         /* LINTED */
1398                         uint_t  symndx = (uint_t)(((Xword)sym -
1399                             (Xword)SYMTAB(*dlmp)) / SYMENT(*dlmp));
1400                         addr = audit_symbind(clmp, *dlmp, sym, symndx, addr,
1401                             &sb_flags);
1402                 }
1403                 return ((void *)addr);
1404         }
1405 
1406         return (NULL);
1407 }
1408 
1409 /*
1410  * Internal dlsym activity.  Called from user level or directly for internal
1411  * symbol lookup.
1412  */
1413 void *
1414 dlsym_intn(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1415 {
1416         Rt_map          *llmp = NULL;
1417         void            *error;
1418         Aliste          idx;
1419         Grp_desc        *gdp;
1420         int             in_nfavl = 0;
1421 
1422         /*
1423          * While looking for symbols it's quite possible that additional objects
1424          * get loaded from lazy loading.  These objects will have been added to
1425          * the same link-map list as those objects on the handle.  Remember this
1426          * list for later investigation.
1427          */
1428         if ((handle == RTLD_NEXT) || (handle == RTLD_DEFAULT) ||
1429             (handle == RTLD_SELF) || (handle == RTLD_PROBE))
1430                 llmp = LIST(clmp)->lm_tail;
1431         else {
1432                 Grp_hdl *ghp = (Grp_hdl *)handle;
1433 
1434                 if (ghp->gh_ownlmp)
1435                         llmp = LIST(ghp->gh_ownlmp)->lm_tail;
1436                 else {
1437                         for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1438                                 if ((llmp =
1439                                     LIST(gdp->gd_depend)->lm_tail) != NULL)
1440                                         break;
1441                         }
1442                 }
1443         }
1444 
1445         error = dlsym_core(handle, name, clmp, dlmp, &in_nfavl);
1446 
1447         /*
1448          * If the symbol could not be found it is possible that the "not-found"
1449          * AVL tree had indicated that a required file does not exist.  In case
1450          * the file system has changed since this "not-found" recording was
1451          * made, retry the dlsym() with a clean "not-found" AVL tree.
1452          */
1453         if ((error == NULL) && in_nfavl) {
1454                 avl_tree_t      *oavlt = nfavl;
1455 
1456                 nfavl = NULL;
1457                 error = dlsym_core(handle, name, clmp, dlmp, NULL);
1458 
1459                 /*
1460                  * If the symbol is found, then any file that was loaded will
1461                  * have had its full path name registered in the FullPath AVL
1462                  * tree.  Remove any new "not-found" AVL information, and
1463                  * restore the former AVL tree.
1464                  */
1465                 nfavl_remove(nfavl);
1466                 nfavl = oavlt;
1467         }
1468 
1469         if (error == NULL) {
1470                 /*
1471                  * Cache the error message, as Java tends to fall through this
1472                  * code many times.
1473                  */
1474                 if (nosym_str == NULL)
1475                         nosym_str = MSG_INTL(MSG_GEN_NOSYM);
1476                 eprintf(LIST(clmp), ERR_FATAL, nosym_str, name);
1477         }
1478 
1479         load_completion(llmp);
1480         return (error);
1481 }
1482 
1483 /*
1484  * Argument checking for dlsym.  Only called via external entry.
1485  */
1486 static void *
1487 dlsym_check(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1488 {
1489         /*
1490          * Verify the arguments.
1491          */
1492         if (name == NULL) {
1493                 eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_ILLSYM));
1494                 return (NULL);
1495         }
1496         if ((handle != RTLD_NEXT) && (handle != RTLD_DEFAULT) &&
1497             (handle != RTLD_SELF) && (handle != RTLD_PROBE) &&
1498             (hdl_validate((Grp_hdl *)handle) == 0)) {
1499                 eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL),
1500                     EC_NATPTR(handle));
1501                 return (NULL);
1502         }
1503         return (dlsym_intn(handle, name, clmp, dlmp));
1504 }
1505 
1506 
1507 #pragma weak _dlsym = dlsym
1508 
1509 /*
1510  * External entry for dlsym().  On success, returns the address of the specified
1511  * symbol.  On error returns a null.
1512  */
1513 void *
1514 dlsym(void *handle, const char *name)
1515 {
1516         int     entry;
1517         Rt_map  *clmp, *dlmp = NULL;
1518         void    *addr;
1519 
1520         entry = enter(0);
1521 
1522         clmp = _caller(caller(), CL_EXECDEF);
1523 
1524         addr = dlsym_check(handle, name, clmp, &dlmp);
1525 
1526         if (entry) {
1527                 if (dlmp)
1528                         is_dep_init(dlmp, clmp);
1529                 leave(LIST(clmp), 0);
1530         }
1531         return (addr);
1532 }
1533 
1534 /*
1535  * Core dladdr activity.
1536  */
1537 static void
1538 dladdr_core(Rt_map *almp, void *addr, Dl_info_t *dlip, void **info, int flags)
1539 {
1540         /*
1541          * Set up generic information and any defaults.
1542          */
1543         dlip->dli_fname = PATHNAME(almp);
1544 
1545         dlip->dli_fbase = (void *)ADDR(almp);
1546         dlip->dli_sname = NULL;
1547         dlip->dli_saddr = NULL;
1548 
1549         /*
1550          * Determine the nearest symbol to this address.
1551          */
1552         LM_DLADDR(almp)((ulong_t)addr, almp, dlip, info, flags);
1553 }
1554 
1555 #pragma weak _dladdr = dladdr
1556 
1557 /*
1558  * External entry for dladdr(3dl) and dladdr1(3dl).  Returns an information
1559  * structure that reflects the symbol closest to the address specified.
1560  */
1561 int
1562 dladdr(void *addr, Dl_info_t *dlip)
1563 {
1564         int     entry, ret;
1565         Rt_map  *clmp, *almp;
1566         Lm_list *clml;
1567 
1568         entry = enter(0);
1569 
1570         clmp = _caller(caller(), CL_EXECDEF);
1571         clml = LIST(clmp);
1572 
1573         DBG_CALL(Dbg_dl_dladdr(clmp, addr));
1574 
1575         /*
1576          * Use our calling technique to determine what object is associated
1577          * with the supplied address.  If a caller can't be determined,
1578          * indicate the failure.
1579          */
1580         if ((almp = _caller(addr, CL_NONE)) == NULL) {
1581                 eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1582                     EC_NATPTR(addr));
1583                 ret = 0;
1584         } else {
1585                 dladdr_core(almp, addr, dlip, 0, 0);
1586                 ret = 1;
1587         }
1588 
1589         if (entry)
1590                 leave(clml, 0);
1591         return (ret);
1592 }
1593 
1594 #pragma weak _dladdr1 = dladdr1
1595 
1596 int
1597 dladdr1(void *addr, Dl_info_t *dlip, void **info, int flags)
1598 {
1599         int     entry, ret = 1;
1600         Rt_map  *clmp, *almp;
1601         Lm_list *clml;
1602 
1603         entry = enter(0);
1604 
1605         clmp = _caller(caller(), CL_EXECDEF);
1606         clml = LIST(clmp);
1607 
1608         DBG_CALL(Dbg_dl_dladdr(clmp, addr));
1609 
1610         /*
1611          * Validate any flags.
1612          */
1613         if (flags) {
1614                 int     request;
1615 
1616                 if (((request = (flags & RTLD_DL_MASK)) != RTLD_DL_SYMENT) &&
1617                     (request != RTLD_DL_LINKMAP)) {
1618                         eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLFLAGS),
1619                             flags);
1620                         ret = 0;
1621 
1622                 } else if (info == NULL) {
1623                         eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLINFO),
1624                             flags);
1625                         ret = 0;
1626                 }
1627         }
1628 
1629         /*
1630          * Use our calling technique to determine what object is associated
1631          * with the supplied address.  If a caller can't be determined,
1632          * indicate the failure.
1633          */
1634         if (ret) {
1635                 if ((almp = _caller(addr, CL_NONE)) == NULL) {
1636                         eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1637                             EC_NATPTR(addr));
1638                         ret = 0;
1639                 } else
1640                         dladdr_core(almp, addr, dlip, info, flags);
1641         }
1642 
1643         if (entry)
1644                 leave(clml, 0);
1645         return (ret);
1646 }
1647 
1648 /*
1649  * Core dldump activity.
1650  */
1651 static int
1652 dldump_core(Rt_map *clmp, Rt_map *lmp, const char *ipath, const char *opath,
1653     int flags)
1654 {
1655         Lm_list *lml = LIST(clmp);
1656         Addr    addr = 0;
1657 
1658         /*
1659          * Verify any arguments first.
1660          */
1661         if ((opath == NULL) || (opath[0] == '\0') ||
1662             ((lmp == NULL) && (ipath[0] == '\0'))) {
1663                 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
1664                 return (1);
1665         }
1666 
1667         /*
1668          * If an input file is specified make sure its one of our dependencies
1669          * on the main link-map list.  Note, this has really all evolved for
1670          * crle(), which uses libcrle.so on an alternative link-map to trigger
1671          * dumping objects from the main link-map list.   If we ever want to
1672          * dump objects from alternative link-maps, this model is going to
1673          * have to be revisited.
1674          */
1675         if (lmp == NULL) {
1676                 if ((lmp = is_so_loaded(&lml_main, ipath, NULL)) == NULL) {
1677                         eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NOFILE),
1678                             ipath);
1679                         return (1);
1680                 }
1681                 if (FLAGS(lmp) & FLG_RT_ALTER) {
1682                         eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_ALTER), ipath);
1683                         return (1);
1684                 }
1685                 if (FLAGS(lmp) & FLG_RT_NODUMP) {
1686                         eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NODUMP),
1687                             ipath);
1688                         return (1);
1689                 }
1690         }
1691 
1692         /*
1693          * If the object being dump'ed isn't fixed identify its mapping.
1694          */
1695         if (!(FLAGS(lmp) & FLG_RT_FIXED))
1696                 addr = ADDR(lmp);
1697 
1698         /*
1699          * As rt_dldump() will effectively lazy load the necessary support
1700          * libraries, make sure ld.so.1 is initialized for plt relocations.
1701          */
1702         if (elf_rtld_load() == 0)
1703                 return (0);
1704 
1705         /*
1706          * Dump the required image.
1707          */
1708         return (rt_dldump(lmp, opath, flags, addr));
1709 }
1710 
1711 #pragma weak _dldump = dldump
1712 
1713 /*
1714  * External entry for dldump(3c).  Returns 0 on success, non-zero otherwise.
1715  */
1716 int
1717 dldump(const char *ipath, const char *opath, int flags)
1718 {
1719         int     error, entry;
1720         Rt_map  *clmp, *lmp;
1721 
1722         entry = enter(0);
1723 
1724         clmp = _caller(caller(), CL_EXECDEF);
1725 
1726         if (ipath) {
1727                 lmp = NULL;
1728         } else {
1729                 lmp = lml_main.lm_head;
1730                 ipath = NAME(lmp);
1731         }
1732 
1733         DBG_CALL(Dbg_dl_dldump(clmp, ipath, opath, flags));
1734 
1735         error = dldump_core(clmp, lmp, ipath, opath, flags);
1736 
1737         if (entry)
1738                 leave(LIST(clmp), 0);
1739         return (error);
1740 }
1741 
1742 /*
1743  * get_linkmap_id() translates Lm_list * pointers to the Link_map id as used by
1744  * the rtld_db and dlmopen() interfaces.  It checks to see if the Link_map is
1745  * one of the primary ones and if so returns it's special token:
1746  *              LM_ID_BASE
1747  *              LM_ID_LDSO
1748  *
1749  * If it's not one of the primary link_map id's it will instead returns a
1750  * pointer to the Lm_list structure which uniquely identifies the Link_map.
1751  */
1752 Lmid_t
1753 get_linkmap_id(Lm_list *lml)
1754 {
1755         if (lml->lm_flags & LML_FLG_BASELM)
1756                 return (LM_ID_BASE);
1757         if (lml->lm_flags & LML_FLG_RTLDLM)
1758                 return (LM_ID_LDSO);
1759 
1760         return ((Lmid_t)lml);
1761 }
1762 
1763 /*
1764  * Set a new deferred dependency name.
1765  */
1766 static int
1767 set_def_need(Lm_list *lml, Dyninfo *dyip, const char *name)
1768 {
1769         /*
1770          * If this dependency has already been established, then this dlinfo()
1771          * call is too late.
1772          */
1773         if (dyip->di_info) {
1774                 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_DEF_DEPLOADED),
1775                     dyip->di_name);
1776                 return (-1);
1777         }
1778 
1779         /*
1780          * Assign the new dependency name.
1781          */
1782         DBG_CALL(Dbg_file_deferred(lml, dyip->di_name, name));
1783         dyip->di_flags |= FLG_DI_DEF_DONE;
1784         dyip->di_name = name;
1785         return (0);
1786 }
1787 
1788 /*
1789  * Extract information for a dlopen() handle.
1790  */
1791 static int
1792 dlinfo_core(void *handle, int request, void *p, Rt_map *clmp)
1793 {
1794         Conv_inv_buf_t  inv_buf;
1795         char            *handlename;
1796         Lm_list         *lml = LIST(clmp);
1797         Rt_map          *lmp = NULL;
1798 
1799         /*
1800          * Determine whether a handle is provided.  A handle isn't needed for
1801          * all operations, but it is validated here for the initial diagnostic.
1802          */
1803         if (handle == RTLD_SELF) {
1804                 lmp = clmp;
1805         } else {
1806                 Grp_hdl *ghp = (Grp_hdl *)handle;
1807 
1808                 if (hdl_validate(ghp))
1809                         lmp = ghp->gh_ownlmp;
1810         }
1811         if (lmp) {
1812                 handlename = NAME(lmp);
1813         } else {
1814                 (void) conv_invalid_val(&inv_buf, EC_NATPTR(handle), 0);
1815                 handlename = inv_buf.buf;
1816         }
1817 
1818         DBG_CALL(Dbg_dl_dlinfo(clmp, handlename, request, p));
1819 
1820         /*
1821          * Validate the request and return buffer.
1822          */
1823         if ((request > RTLD_DI_MAX) || (p == NULL)) {
1824                 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLVAL));
1825                 return (-1);
1826         }
1827 
1828         /*
1829          * Return configuration cache name and address.
1830          */
1831         if (request == RTLD_DI_CONFIGADDR) {
1832                 Dl_info_t       *dlip = (Dl_info_t *)p;
1833 
1834                 if ((config->c_name == NULL) || (config->c_bgn == 0) ||
1835                     (config->c_end == 0)) {
1836                         eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOCONFIG));
1837                         return (-1);
1838                 }
1839                 dlip->dli_fname = config->c_name;
1840                 dlip->dli_fbase = (void *)config->c_bgn;
1841                 return (0);
1842         }
1843 
1844         /*
1845          * Return profiled object name (used by ldprof audit library).
1846          */
1847         if (request == RTLD_DI_PROFILENAME) {
1848                 if (profile_name == NULL) {
1849                         eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOPROFNAME));
1850                         return (-1);
1851                 }
1852 
1853                 *(const char **)p = profile_name;
1854                 return (0);
1855         }
1856         if (request == RTLD_DI_PROFILEOUT) {
1857                 /*
1858                  * If a profile destination directory hasn't been specified
1859                  * provide a default.
1860                  */
1861                 if (profile_out == NULL)
1862                         profile_out = MSG_ORIG(MSG_PTH_VARTMP);
1863 
1864                 *(const char **)p = profile_out;
1865                 return (0);
1866         }
1867 
1868         /*
1869          * Obtain or establish a termination signal.
1870          */
1871         if (request == RTLD_DI_GETSIGNAL) {
1872                 *(int *)p = killsig;
1873                 return (0);
1874         }
1875 
1876         if (request == RTLD_DI_SETSIGNAL) {
1877                 sigset_t        set;
1878                 int             sig = *(int *)p;
1879 
1880                 /*
1881                  * Determine whether the signal is in range.
1882                  */
1883                 (void) sigfillset(&set);
1884                 if (sigismember(&set, sig) != 1) {
1885                         eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVSIG), sig);
1886                         return (-1);
1887                 }
1888 
1889                 killsig = sig;
1890                 return (0);
1891         }
1892 
1893         /*
1894          * For any other request a link-map is required.  Verify the handle.
1895          */
1896         if (lmp == NULL) {
1897                 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL),
1898                     EC_NATPTR(handle));
1899                 return (-1);
1900         }
1901 
1902         /*
1903          * Obtain the process arguments, environment and auxv.  Note, as the
1904          * environment can be modified by the user (putenv(3c)), reinitialize
1905          * the environment pointer on each request.
1906          */
1907         if (request == RTLD_DI_ARGSINFO) {
1908                 Dl_argsinfo_t   *aip = (Dl_argsinfo_t *)p;
1909                 Lm_list         *lml = LIST(lmp);
1910 
1911                 *aip = argsinfo;
1912                 if (lml->lm_flags & LML_FLG_ENVIRON)
1913                         aip->dla_envp = *(lml->lm_environ);
1914 
1915                 return (0);
1916         }
1917 
1918         /*
1919          * Return Lmid_t of the Link-Map list that the specified object is
1920          * loaded on.
1921          */
1922         if (request == RTLD_DI_LMID) {
1923                 *(Lmid_t *)p = get_linkmap_id(LIST(lmp));
1924                 return (0);
1925         }
1926 
1927         /*
1928          * Return a pointer to the Link-Map structure associated with the
1929          * specified object.
1930          */
1931         if (request == RTLD_DI_LINKMAP) {
1932                 *(Link_map **)p = (Link_map *)lmp;
1933                 return (0);
1934         }
1935 
1936         /*
1937          * Return search path information, or the size of the buffer required
1938          * to store the information.
1939          */
1940         if ((request == RTLD_DI_SERINFO) || (request == RTLD_DI_SERINFOSIZE)) {
1941                 Spath_desc      sd = { search_rules, NULL, 0 };
1942                 Pdesc           *pdp;
1943                 Dl_serinfo_t    *info;
1944                 Dl_serpath_t    *path;
1945                 char            *strs;
1946                 size_t          size = sizeof (Dl_serinfo_t);
1947                 uint_t          cnt = 0;
1948 
1949                 info = (Dl_serinfo_t *)p;
1950                 path = &info->dls_serpath[0];
1951                 strs = (char *)&info->dls_serpath[info->dls_cnt];
1952 
1953                 /*
1954                  * Traverse search path entries for this object.
1955                  */
1956                 while ((pdp = get_next_dir(&sd, lmp, 0)) != NULL) {
1957                         size_t  _size;
1958 
1959                         if (pdp->pd_pname == NULL)
1960                                 continue;
1961 
1962                         /*
1963                          * If configuration information exists, it's possible
1964                          * this path has been identified as non-existent, if so
1965                          * ignore it.
1966                          */
1967                         if (pdp->pd_info) {
1968                                 Rtc_obj *dobj = (Rtc_obj *)pdp->pd_info;
1969                                 if (dobj->co_flags & RTC_OBJ_NOEXIST)
1970                                         continue;
1971                         }
1972 
1973                         /*
1974                          * Keep track of search path count and total info size.
1975                          */
1976                         if (cnt++)
1977                                 size += sizeof (Dl_serpath_t);
1978                         _size = pdp->pd_plen + 1;
1979                         size += _size;
1980 
1981                         if (request == RTLD_DI_SERINFOSIZE)
1982                                 continue;
1983 
1984                         /*
1985                          * If we're filling in search path information, confirm
1986                          * there's sufficient space.
1987                          */
1988                         if (size > info->dls_size) {
1989                                 eprintf(lml, ERR_FATAL,
1990                                     MSG_INTL(MSG_ARG_SERSIZE),
1991                                     EC_OFF(info->dls_size));
1992                                 return (-1);
1993                         }
1994                         if (cnt > info->dls_cnt) {
1995                                 eprintf(lml, ERR_FATAL,
1996                                     MSG_INTL(MSG_ARG_SERCNT), info->dls_cnt);
1997                                 return (-1);
1998                         }
1999 
2000                         /*
2001                          * Append the path to the information buffer.
2002                          */
2003                         (void) strcpy(strs, pdp->pd_pname);
2004                         path->dls_name = strs;
2005                         path->dls_flags = (pdp->pd_flags & LA_SER_MASK);
2006 
2007                         strs = strs + _size;
2008                         path++;
2009                 }
2010 
2011                 /*
2012                  * If we're here to size the search buffer fill it in.
2013                  */
2014                 if (request == RTLD_DI_SERINFOSIZE) {
2015                         info->dls_size = size;
2016                         info->dls_cnt = cnt;
2017                 }
2018 
2019                 return (0);
2020         }
2021 
2022         /*
2023          * Return the origin of the object associated with this link-map.
2024          * Basically return the dirname(1) of the objects fullpath.
2025          */
2026         if (request == RTLD_DI_ORIGIN) {
2027                 char    *str = (char *)p;
2028 
2029                 (void) strncpy(str, ORIGNAME(lmp), DIRSZ(lmp));
2030                 str += DIRSZ(lmp);
2031                 *str = '\0';
2032 
2033                 return (0);
2034         }
2035 
2036         /*
2037          * Return the number of object mappings, or the mapping information for
2038          * this object.
2039          */
2040         if (request == RTLD_DI_MMAPCNT) {
2041                 uint_t  *cnt = (uint_t *)p;
2042 
2043                 *cnt = MMAPCNT(lmp);
2044                 return (0);
2045         }
2046         if (request == RTLD_DI_MMAPS) {
2047                 Dl_mapinfo_t    *mip = (Dl_mapinfo_t *)p;
2048 
2049                 if (mip->dlm_acnt && mip->dlm_maps) {
2050                         uint_t  cnt = 0;
2051 
2052                         while ((cnt < mip->dlm_acnt) && (cnt < MMAPCNT(lmp))) {
2053                                 mip->dlm_maps[cnt] = MMAPS(lmp)[cnt];
2054                                 cnt++;
2055                         }
2056                         mip->dlm_rcnt = cnt;
2057                 }
2058                 return (0);
2059         }
2060 
2061         /*
2062          * Assign a new dependency name to a deferred dependency.
2063          */
2064         if ((request == RTLD_DI_DEFERRED) ||
2065             (request == RTLD_DI_DEFERRED_SYM)) {
2066                 Dl_definfo_t    *dfip = (Dl_definfo_t *)p;
2067                 Dyninfo         *dyip;
2068                 const char      *dname, *rname;
2069 
2070                 /*
2071                  * Verify the names.
2072                  */
2073                 if ((dfip->dld_refname == NULL) ||
2074                     (dfip->dld_depname == NULL)) {
2075                         eprintf(LIST(clmp), ERR_FATAL,
2076                             MSG_INTL(MSG_ARG_ILLNAME));
2077                         return (-1);
2078                 }
2079 
2080                 dname = dfip->dld_depname;
2081                 rname = dfip->dld_refname;
2082 
2083                 /*
2084                  * A deferred dependency can be determined by referencing a
2085                  * symbol family member that is associated to the dependency,
2086                  * or by looking for the dependency by its name.
2087                  */
2088                 if (request == RTLD_DI_DEFERRED_SYM) {
2089                         Slookup         sl;
2090                         Sresult         sr;
2091                         uint_t          binfo;
2092                         Syminfo         *sip;
2093 
2094                         /*
2095                          * Lookup the symbol in the associated object.
2096                          */
2097                         SLOOKUP_INIT(sl, rname, lmp, lmp, ld_entry_cnt,
2098                             elf_hash(rname), 0, 0, 0, LKUP_SYMNDX);
2099                         SRESULT_INIT(sr, rname);
2100                         if (sym_lookup_in_caller(clmp, &sl, &sr,
2101                             &binfo) == NULL) {
2102                                 eprintf(LIST(clmp), ERR_FATAL,
2103                                     MSG_INTL(MSG_DEF_NOSYMFOUND), rname);
2104                                 return (-1);
2105                         }
2106 
2107                         /*
2108                          * Use the symbols index to reference the Syminfo entry
2109                          * and thus find the associated dependency.
2110                          */
2111                         if (sl.sl_rsymndx && ((sip = SYMINFO(clmp)) != NULL)) {
2112                                 /* LINTED */
2113                                 sip = (Syminfo *)((char *)sip +
2114                                     (sl.sl_rsymndx * SYMINENT(lmp)));
2115 
2116                                 if ((sip->si_flags & SYMINFO_FLG_DEFERRED) &&
2117                                     (sip->si_boundto < SYMINFO_BT_LOWRESERVE) &&
2118                                     ((dyip = DYNINFO(lmp)) != NULL)) {
2119                                         dyip += sip->si_boundto;
2120 
2121                                         if (!(dyip->di_flags & FLG_DI_IGNORE))
2122                                                 return (set_def_need(lml,
2123                                                     dyip, dname));
2124                                 }
2125                         }
2126 
2127                         /*
2128                          * No deferred symbol found.
2129                          */
2130                         eprintf(LIST(clmp), ERR_FATAL,
2131                             MSG_INTL(MSG_DEF_NOSYMFOUND), rname);
2132                         return (-1);
2133 
2134                 } else {
2135                         Dyn     *dyn;
2136 
2137                         /*
2138                          * Using the target objects dependency information, find
2139                          * the associated deferred dependency.
2140                          */
2141                         for (dyn = DYN(lmp), dyip = DYNINFO(lmp);
2142                             !(dyip->di_flags & FLG_DI_IGNORE); dyn++, dyip++) {
2143                                 const char      *oname;
2144 
2145                                 if ((dyip->di_flags & FLG_DI_DEFERRED) == 0)
2146                                         continue;
2147 
2148                                 if (strcmp(rname, dyip->di_name) == 0)
2149                                         return (set_def_need(lml, dyip, dname));
2150 
2151                                 /*
2152                                  * If this dependency name has been changed by
2153                                  * a previous dlinfo(), check the original
2154                                  * dynamic entry string.  The user might be
2155                                  * attempting to re-change an entry using the
2156                                  * original name as the reference.
2157                                  */
2158                                 if ((dyip->di_flags & FLG_DI_DEF_DONE) == 0)
2159                                         continue;
2160 
2161                                 oname = STRTAB(lmp) + dyn->d_un.d_val;
2162                                 if (strcmp(rname, oname) == 0)
2163                                         return (set_def_need(lml, dyip, dname));
2164                         }
2165 
2166                         /*
2167                          * No deferred dependency found.
2168                          */
2169                         eprintf(lml, ERR_FATAL, MSG_INTL(MSG_DEF_NODEPFOUND),
2170                             rname);
2171                         return (-1);
2172                 }
2173         }
2174         return (0);
2175 }
2176 
2177 #pragma weak _dlinfo = dlinfo
2178 
2179 /*
2180  * External entry for dlinfo(3dl).
2181  */
2182 int
2183 dlinfo(void *handle, int request, void *p)
2184 {
2185         int     error, entry;
2186         Rt_map  *clmp;
2187 
2188         entry = enter(0);
2189 
2190         clmp = _caller(caller(), CL_EXECDEF);
2191 
2192         error = dlinfo_core(handle, request, p, clmp);
2193 
2194         if (entry)
2195                 leave(LIST(clmp), 0);
2196         return (error);
2197 }
2198 
2199 /*
2200  * GNU defined function to iterate through the program headers for all
2201  * currently loaded dynamic objects. The caller supplies a callback function
2202  * which is called for each object.
2203  *
2204  * entry:
2205  *      callback - Callback function to call. The arguments to the callback
2206  *              function are:
2207  *              info - Address of dl_phdr_info structure
2208  *              size - sizeof (struct dl_phdr_info)
2209  *              data - Caller supplied value.
2210  *      data - Value supplied by caller, which is passed to callback without
2211  *              examination.
2212  *
2213  * exit:
2214  *      callback is called for each dynamic ELF object in the process address
2215  *      space, halting when a non-zero value is returned, or when the last
2216  *      object has been processed. The return value from the last call
2217  *      to callback is returned.
2218  *
2219  * note:
2220  *      The Linux implementation has added additional fields to the
2221  *      dl_phdr_info structure over time. The callback function is
2222  *      supposed to use the size field to determine which fields are
2223  *      present, and to avoid attempts to access non-existent fields.
2224  *      We have added those fields that are compatible with Solaris, and
2225  *      which are used by GNU C++ (g++) runtime exception handling support.
2226  *
2227  * note:
2228  *      We issue a callback for every ELF object mapped into the process
2229  *      address space at the time this routine is entered. These callbacks
2230  *      are arbitrary functions that can do anything, including possibly
2231  *      causing new objects to be mapped into the process, or unmapped.
2232  *      This complicates matters:
2233  *
2234  *      -       Adding new objects can cause the alists to be reallocated
2235  *              or for contents to move. This can happen explicitly via
2236  *              dlopen(), or implicitly via lazy loading. One might consider
2237  *              simply banning dlopen from a callback, but lazy loading must
2238  *              be allowed, in which case there's no reason to ban dlopen().
2239  *
2240  *      -       Removing objects can leave us holding references to freed
2241  *              memory that must not be accessed, and can cause the list
2242  *              items to move in a way that would cause us to miss reporting
2243  *              one, or double report others.
2244  *
2245  *      -       We cannot allocate memory to build a separate data structure,
2246  *              because the interface to dl_iterate_phdr() does not have a
2247  *              way to communicate allocation errors back to the caller.
2248  *              Even if we could, it would be difficult to do so efficiently.
2249  *
2250  *      -       It is possible for dl_iterate_phdr() to be called recursively
2251  *              from a callback, and there is no way for us to detect or manage
2252  *              this effectively, particularly as the user might use longjmp()
2253  *              to skip past us on return. Hence, we must be reentrant
2254  *              (stateless), further precluding the option of building a
2255  *              separate data structure.
2256  *
2257  *      Despite these constraints, we are able to traverse the link-map
2258  *      lists safely:
2259  *
2260  *      -       Once interposer (preload) objects have been processed at
2261  *              startup, we know that new objects are always placed at the
2262  *              end of the list. Hence, if we are reading a list when that
2263  *              happens, the new object will not alter the part of the list
2264  *              that we've already processed.
2265  *
2266  *      -       The alist _TRAVERSE macros recalculate the address of the
2267  *              current item from scratch on each iteration, rather than
2268  *              incrementing a pointer. Hence, alist additions that occur
2269  *              in mid-traverse will not cause confusion.
2270  *
2271  *      There is one limitation: We cannot continue operation if an object
2272  *      is removed from the process from within a callback. We detect when
2273  *      this happens and return immediately with a -1 return value.
2274  *
2275  * note:
2276  *      As currently implemented, if a callback causes an object to be loaded,
2277  *      that object may or may not be reported by the current invocation of
2278  *      dl_iterate_phdr(), based on whether or not we have already processed
2279  *      the link-map list that receives it. If we want to prevent this, it
2280  *      can be done efficiently by associating the current value of cnt_map
2281  *      with each new Rt_map entered into the system. Then this function can
2282  *      use that to detect and skip new objects that enter the system in
2283  *      mid-iteration. However, the Linux documentation is ambiguous on whether
2284  *      this is necessary, and it does not appear to matter in practice.
2285  *      We have therefore chosen not to do so at this time.
2286  */
2287 int
2288 dl_iterate_phdr(int (*callback)(struct dl_phdr_info *, size_t, void *),
2289     void *data)
2290 {
2291         struct dl_phdr_info     info;
2292         u_longlong_t            l_cnt_map = cnt_map;
2293         u_longlong_t            l_cnt_unmap = cnt_unmap;
2294         Lm_list                 *lml, *clml;
2295         Lm_cntl                 *lmc;
2296         Rt_map                  *lmp, *clmp;
2297         Aliste                  idx1, idx2;
2298         Ehdr                    *ehdr;
2299         int                     ret = 0;
2300         int                     entry;
2301 
2302         entry = enter(0);
2303         clmp = _caller(caller(), CL_EXECDEF);
2304         clml = LIST(clmp);
2305 
2306         DBG_CALL(Dbg_dl_iphdr_enter(clmp, cnt_map, cnt_unmap));
2307 
2308         /* Issue a callback for each ELF object in the process */
2309         for (APLIST_TRAVERSE(dynlm_list, idx1, lml)) {
2310                 for (ALIST_TRAVERSE(lml->lm_lists, idx2, lmc)) {
2311                         for (lmp = lmc->lc_head; lmp; lmp = NEXT_RT_MAP(lmp)) {
2312 #if defined(_sparc) && !defined(_LP64)
2313                                 /*
2314                                  * On 32-bit sparc, the possibility exists that
2315                                  * this object is not ELF.
2316                                  */
2317                                 if (THIS_IS_NOT_ELF(lmp))
2318                                         continue;
2319 #endif
2320                                 /* Prepare the object information structure */
2321                                 ehdr = (Ehdr *) ADDR(lmp);
2322                                 info.dlpi_addr = (ehdr->e_type == ET_EXEC) ?
2323                                     0 : ADDR(lmp);
2324                                 info.dlpi_name = lmp->rt_pathname;
2325                                 info.dlpi_phdr = (Phdr *)
2326                                     (ADDR(lmp) + ehdr->e_phoff);
2327                                 info.dlpi_phnum = ehdr->e_phnum;
2328                                 info.dlpi_adds = cnt_map;
2329                                 info.dlpi_subs = cnt_unmap;
2330 
2331                                 /* Issue the callback */
2332                                 DBG_CALL(Dbg_dl_iphdr_callback(clml, &info));
2333                                 leave(clml, thr_flg_reenter);
2334                                 ret = (* callback)(&info, sizeof (info), data);
2335                                 (void) enter(thr_flg_reenter);
2336 
2337                                 /* Return immediately on non-zero result */
2338                                 if (ret != 0)
2339                                         goto done;
2340 
2341                                 /* Adapt to object mapping changes */
2342                                 if ((cnt_map == l_cnt_map) &&
2343                                     (cnt_unmap == l_cnt_unmap))
2344                                         continue;
2345 
2346                                 DBG_CALL(Dbg_dl_iphdr_mapchange(clml, cnt_map,
2347                                     cnt_unmap));
2348 
2349                                 /* Stop if an object was unmapped */
2350                                 if (cnt_unmap == l_cnt_unmap) {
2351                                         l_cnt_map = cnt_map;
2352                                         continue;
2353                                 }
2354 
2355                                 ret = -1;
2356                                 DBG_CALL(Dbg_dl_iphdr_unmap_ret(clml));
2357                                 goto done;
2358                         }
2359                 }
2360         }
2361 
2362 done:
2363         if (entry)
2364                 leave(LIST(clmp), 0);
2365         return (ret);
2366 }
--- EOF ---