xref: /illumos-gate/usr/src/cmd/sgs/librtld_db/common/rd_elf.c (revision 22ca2f96)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include	<stdlib.h>
#include	<stdio.h>
#include	<proc_service.h>
#include	<link.h>
#include	<rtld_db.h>
#include	<rtld.h>
#include	<alist.h>
#include	<list.h>
#include	<_rtld_db.h>
#include	<msg.h>
#include	<limits.h>
#include	<string.h>
#include	<sys/param.h>

/*
 * 64-bit builds are going to compile this module twice, the
 * second time with _ELF64 defined.  These defines should make
 * all the necessary adjustments to the code.
 */
#ifdef _LP64
#ifdef _ELF64
#define	_rd_event_enable32	_rd_event_enable64
#define	_rd_event_getmsg32	_rd_event_getmsg64
#define	_rd_get_dyns32		_rd_get_dyns64
#define	_rd_get_ehdr32		_rd_get_ehdr64
#define	_rd_objpad_enable32	_rd_objpad_enable64
#define	_rd_loadobj_iter32	_rd_loadobj_iter64
#define	_rd_reset32		_rd_reset64
#define	find_dynamic_ent32	find_dynamic_ent64
#define	validate_rdebug32	validate_rdebug64
#define	TAPlist			APlist
#define	TLm_list		Lm_list
#define	TList			List
#define	TListnode		Listnode
#define	MSG_SYM_BRANDOPS	MSG_SYM_BRANDOPS_64
#else	/* ELF32 */
#define	Rt_map			Rt_map32
#define	Rtld_db_priv		Rtld_db_priv32
#define	TAPlist			APlist32
#define	TLm_list		Lm_list32
#define	TList			List32
#define	TListnode		Listnode32
#define	Lm_list			Lm_list32
#define	MSG_SYM_BRANDOPS	MSG_SYM_BRANDOPS_32
#endif	/* _ELF64 */
#else	/* _LP64 */
#define	TAPlist			APlist
#define	TLm_list		Lm_list
#define	TList			List
#define	TListnode		Listnode
#define	MSG_SYM_BRANDOPS	MSG_SYM_BRANDOPS_32
#endif	/* _LP64 */

/*
 * BrandZ added ps_pbrandname().  Many debuggers that link directly
 * against librtld_db.so may not implement this interface.  Hence
 * we won't call the function directly, instead we'll try to look it
 * up using the linker first and only invoke it if we find it.
 */
typedef ps_err_e (*ps_pbrandname_fp_t)(struct ps_prochandle *,
    char *, size_t);

rd_err_e
validate_rdebug32(struct rd_agent *rap)
{
	struct ps_prochandle	*php = rap->rd_psp;
	psaddr_t		db_privp;
	Rtld_db_priv		db_priv;

	if (rap->rd_rdebug == 0)
		return (RD_ERR);

	/*
	 * The rtld_db_priv structure contains both the traditional (exposed)
	 * r_debug structure as well as private data only available to
	 * this library.
	 */
	db_privp = rap->rd_rdebug;

	/*
	 * Verify that librtld_db & rtld are at the proper revision
	 * levels.
	 */
	if (ps_pread(php, db_privp, (char *)&db_priv,
	    sizeof (Rtld_db_priv)) != PS_OK) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_READPRIVFAIL_1),
		    EC_ADDR(db_privp)));
		return (RD_DBERR);
	}

	if ((db_priv.rtd_version < R_RTLDDB_VERSION1) ||
	    (db_priv.rtd_version > R_RTLDDB_VERSION)) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_BADPVERS),
		    db_priv.rtd_version, R_RTLDDB_VERSION));
		return (RD_NOCAPAB);
	}

	/*
	 * Is the image being examined from a core file or not.
	 * If it is a core file then the following write will fail.
	 */
	if (ps_pwrite(php, db_privp, (char *)&db_priv,
	    sizeof (Rtld_db_priv)) != PS_OK)
		rap->rd_flags |= RDF_FL_COREFILE;

	rap->rd_rdebugvers = db_priv.rtd_version;
	rap->rd_rtlddbpriv = db_privp;

	LOG(ps_plog(MSG_ORIG(MSG_DB_VALIDRDEBUG), EC_ADDR(rap->rd_rdebug),
	    R_RTLDDB_VERSION, rap->rd_rdebugvers,
	    rap->rd_flags & RDF_FL_COREFILE));
	return (RD_OK);
}


rd_err_e
find_dynamic_ent32(struct rd_agent *rap, psaddr_t dynaddr,
    Xword dyntag, Dyn *dyn)
{
	struct ps_prochandle	*php = rap->rd_psp;
	Dyn			d;

	d.d_tag = DT_NULL;
	do {
		if (ps_pread(php, dynaddr, (void *)(&d), sizeof (d)) !=
		    PS_OK) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_READFAIL_4),
			    EC_ADDR(dynaddr)));
			return (RD_DBERR);
		}
		dynaddr += sizeof (d);
		if (d.d_tag == dyntag)
			break;
	} while (d.d_tag != DT_NULL);
	if (d.d_tag == dyntag) {
		*dyn = d;
		LOG(ps_plog(MSG_ORIG(MSG_DB_FINDDYNAMIC), EC_ADDR(dyntag),
		    EC_ADDR(d.d_un.d_val)));
		return (RD_OK);
	}
	LOG(ps_plog(MSG_ORIG(MSG_DB_NODYNDEBUG), EC_ADDR(dyntag)));
	return (RD_DBERR);
}

extern char rtld_db_helper_path[MAXPATHLEN];

rd_err_e
_rd_reset32(struct rd_agent *rap)
{
	psaddr_t		symaddr;
	struct ps_prochandle	*php = rap->rd_psp;
	const auxv_t		*auxvp = NULL;
	rd_err_e		rc = RD_OK;
	char			brandname[MAXPATHLEN];
	char			brandlib[MAXPATHLEN];
	ps_pbrandname_fp_t	ps_pbrandname;

	/*
	 * librtld_db attempts three different methods to find
	 * the r_debug structure which is required to
	 * initialize itself.  The methods are:
	 *	method1:
	 *		entirely independent of any text segment
	 *		and relies on the AT_SUN_LDDATA auxvector
	 *		to find the ld.so.1::rdebug structure.
	 *	method2:
	 *		lookup symbols in ld.so.1's symbol table
	 *		to find the r_debug symbol.
	 *	method3:
	 *		(old dbx method) dependent upon the
	 *		text segment/symbol table of the
	 *		executable and not ld.so.1.  We lookup the
	 *		_DYNAMIC symbol in the executable and look for
	 *		the DT_DEBUG entry in the .dynamic table.  This
	 *		points to rdebug.
	 *
	 * If none of that works - we fail.
	 */
	LOG(ps_plog(MSG_ORIG(MSG_DB_RDRESET), rap->rd_dmodel));
	/*
	 * Method1
	 *
	 * Scan the aux vector looking for AT_BASE & AT_SUN_LDDATA
	 */

	if (ps_pauxv(php, &auxvp) != PS_OK) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_NOAUXV)));
		rc = RD_ERR;
	}

	rap->rd_rdebug = 0;

	if (auxvp != NULL) {
		rc = RD_ERR;
		while (auxvp->a_type != AT_NULL) {
			if (auxvp->a_type == AT_SUN_LDDATA) {
				/* LINTED */
				rap->rd_rdebug = (uintptr_t)auxvp->a_un.a_ptr;
				LOG(ps_plog(MSG_ORIG(MSG_DB_FLDDATA),
				    rap->rd_rdebug));
				rc = validate_rdebug32(rap);
				break;
			}
			auxvp++;
		}
	}

	/*
	 * method2 - look for r_rdebug symbol in ld.so.1
	 */
	if (rc != RD_OK) {
		/*
		 * If the AT_SUN_LDDATA auxv vector is not present
		 * fall back on doing a symlookup of
		 * the r_debug symbol.  This is for backward
		 * compatiblity with older OS's
		 */
		LOG(ps_plog(MSG_ORIG(MSG_DB_NOLDDATA)));
		if (ps_pglobal_lookup(php, PS_OBJ_LDSO, MSG_ORIG(MSG_SYM_DEBUG),
		    &symaddr) != PS_OK) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_LOOKFAIL),
			    MSG_ORIG(MSG_SYM_DEBUG)));
			rc = RD_DBERR;
		} else {
			rap->rd_rdebug = symaddr;
			LOG(ps_plog(MSG_ORIG(MSG_DB_SYMRDEBUG),
			    EC_ADDR(symaddr)));
			rc = validate_rdebug32(rap);
		}
	}


	/*
	 * method3 - find DT_DEBUG in the executables .dynamic section.
	 */
	if (rc != RD_OK) {
		Dyn	dyn;
		if (ps_pglobal_lookup(php, PS_OBJ_EXEC,
		    MSG_ORIG(MSG_SYM_DYNAMIC), &symaddr) != PS_OK) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_NODYNAMIC)));
			LOG(ps_plog(MSG_ORIG(MSG_DB_INITFAILED)));
			return (rc);
		}
		rc = find_dynamic_ent32(rap, symaddr, DT_DEBUG, &dyn);
		if (rc != RD_OK) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_INITFAILED)));
			return (rc);
		}
		rap->rd_rdebug = dyn.d_un.d_ptr;
		rc = validate_rdebug32(rap);
		if (rc != RD_OK) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_INITFAILED)));
			return (rc);
		}
	}

	/*
	 * If we are debugging a branded executable, load the appropriate
	 * helper library, and call its initialization routine.  Being unable
	 * to load the helper library is not a critical error.  (Hopefully
	 * we'll still be able to access some objects in the target.)
	 */
	ps_pbrandname = (ps_pbrandname_fp_t)dlsym(RTLD_PROBE, "ps_pbrandname");
	while ((ps_pbrandname != NULL) &&
	    (ps_pbrandname(php, brandname, MAXPATHLEN) == PS_OK)) {
		const char *isa = "";

#ifdef _LP64
		isa = MSG_ORIG(MSG_DB_64BIT_PREFIX);
#endif /* _LP64 */

		if (rtld_db_helper_path[0] != '\0')
			(void) snprintf(brandlib, MAXPATHLEN,
			    MSG_ORIG(MSG_DB_BRAND_HELPERPATH_PREFIX),
			    rtld_db_helper_path,
			    MSG_ORIG(MSG_DB_HELPER_PREFIX), brandname, isa,
			    brandname);
		else
			(void) snprintf(brandlib, MAXPATHLEN,
			    MSG_ORIG(MSG_DB_BRAND_HELPERPATH),
			    MSG_ORIG(MSG_DB_HELPER_PREFIX), brandname, isa,
			    brandname);

		rap->rd_helper.rh_dlhandle = dlopen(brandlib,
		    RTLD_LAZY | RTLD_LOCAL);
		if (rap->rd_helper.rh_dlhandle == NULL) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_HELPERLOADFAILED),
			    brandlib));
			break;
		}

		rap->rd_helper.rh_ops = dlsym(rap->rd_helper.rh_dlhandle,
		    MSG_ORIG(MSG_SYM_BRANDOPS));
		if (rap->rd_helper.rh_ops == NULL) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_HELPERNOOPS),
			    brandlib));
			(void) dlclose(rap->rd_helper.rh_dlhandle);
			rap->rd_helper.rh_dlhandle = NULL;
			break;
		}

		rap->rd_helper.rh_data = rap->rd_helper.rh_ops->rho_init(rap,
		    php);
		if (rap->rd_helper.rh_data == NULL) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_HELPERINITFAILED)));
			(void) dlclose(rap->rd_helper.rh_dlhandle);
			rap->rd_helper.rh_dlhandle = NULL;
			rap->rd_helper.rh_ops = NULL;
			break;
		}

		LOG(ps_plog(MSG_ORIG(MSG_DB_HELPERLOADED), brandname));
		break;

		/* NOTREACHED */
	}

	if ((rap->rd_flags & RDF_FL_COREFILE) == 0) {
		if (ps_pglobal_lookup(php, PS_OBJ_LDSO,
		    MSG_ORIG(MSG_SYM_PREINIT), &symaddr) != PS_OK) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_LOOKFAIL),
			    MSG_ORIG(MSG_SYM_PREINIT)));
			return (RD_DBERR);
		}
		rap->rd_preinit = symaddr;

		if (ps_pglobal_lookup(php, PS_OBJ_LDSO,
		    MSG_ORIG(MSG_SYM_POSTINIT), &symaddr) != PS_OK) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_LOOKFAIL),
			    MSG_ORIG(MSG_SYM_POSTINIT)));
			return (RD_DBERR);
		}
		rap->rd_postinit = symaddr;

		if (ps_pglobal_lookup(php, PS_OBJ_LDSO,
		    MSG_ORIG(MSG_SYM_DLACT), &symaddr) != PS_OK) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_LOOKFAIL),
			    MSG_ORIG(MSG_SYM_DLACT)));
			return (RD_DBERR);
		}
		rap->rd_dlact = symaddr;
		rap->rd_tbinder = 0;
	}

	return (RD_OK);
}

rd_err_e
_rd_get_ehdr32(struct rd_agent *rap,
    psaddr_t addr, Ehdr *ehdr, uint_t *phnum)
{
	struct ps_prochandle	*php = rap->rd_psp;
	Shdr			shdr;

	if (ps_pread(php, addr, ehdr, sizeof (*ehdr)) != PS_OK) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_READFAIL_5), EC_ADDR(addr)));
		return (RD_ERR);
	}
	if (phnum == NULL)
		return (RD_OK);

	if (ehdr->e_phnum != PN_XNUM) {
		*phnum = ehdr->e_phnum;
		return (RD_OK);
	}

	/* deal with elf extended program headers */
	if ((ehdr->e_shoff == 0) || (ehdr->e_shentsize < sizeof (shdr)))
		return (RD_ERR);

	addr += ehdr->e_shoff;
	if (ps_pread(php, addr, &shdr, sizeof (shdr)) != PS_OK) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_READFAIL_5), EC_ADDR(addr)));
		return (RD_ERR);
	}

	if (shdr.sh_info == 0)
		return (RD_ERR);

	*phnum = shdr.sh_info;
	return (RD_OK);
}

rd_err_e
_rd_get_dyns32(rd_agent_t *rap, psaddr_t addr, Dyn **dynpp, size_t *dynpp_sz)
{
	struct ps_prochandle	*php = rap->rd_psp;
	rd_err_e		err;
	uint_t			phnum;
	Ehdr			ehdr;
	Phdr			phdr;
	Dyn			*dynp;
	int			i;

	/* We only need to muck with dyn elements for ET_DYN objects */
	if ((err = _rd_get_ehdr32(rap, addr, &ehdr, &phnum)) != RD_OK)
		return (err);

	for (i = 0; i < phnum; i++) {
		psaddr_t a = addr + ehdr.e_phoff + (i * ehdr.e_phentsize);
		if (ps_pread(php, a, &phdr, sizeof (phdr)) != PS_OK) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_READFAIL_6), EC_ADDR(a)));
			return (RD_ERR);
		}
		if (phdr.p_type == PT_DYNAMIC)
			break;
	}
	if (i == phnum)
		return (RD_ERR);

	if ((dynp = malloc(phdr.p_filesz)) == NULL)
		return (RD_ERR);
	if (ehdr.e_type == ET_DYN)
		phdr.p_vaddr += addr;
	if (ps_pread(php, phdr.p_vaddr, dynp, phdr.p_filesz) != PS_OK) {
		free(dynp);
		LOG(ps_plog(MSG_ORIG(MSG_DB_READFAIL_6),
		    EC_ADDR(phdr.p_vaddr)));
		return (RD_ERR);
	}

	*dynpp = dynp;
	if (dynpp_sz != NULL)
		*dynpp_sz = phdr.p_filesz;
	return (RD_OK);
}

rd_err_e
_rd_event_enable32(rd_agent_t *rap, int onoff)
{
	struct ps_prochandle	*php = rap->rd_psp;
	Rtld_db_priv		rdb;

	LOG(ps_plog(MSG_ORIG(MSG_DB_RDEVENTENABLE), rap->rd_dmodel, onoff));
	/*
	 * Tell the debugged process that debugging is occuring
	 * This will enable the storing of event messages so that
	 * the can be gathered by the debugger.
	 */
	if (ps_pread(php, rap->rd_rdebug, (char *)&rdb,
	    sizeof (Rtld_db_priv)) != PS_OK) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_READFAIL_1),
		    EC_ADDR((uintptr_t)&rdb)));
		return (RD_DBERR);
	}

	if (onoff)
		rdb.rtd_rdebug.r_flags |= RD_FL_DBG;
	else
		rdb.rtd_rdebug.r_flags &= ~RD_FL_DBG;

	if (ps_pwrite(php, rap->rd_rdebug, (char *)&rdb,
	    sizeof (Rtld_db_priv)) != PS_OK) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_WRITEFAIL_1),
		    EC_ADDR((uintptr_t)&rdb)));
		return (RD_DBERR);
	}

	return (RD_OK);
}


rd_err_e
_rd_event_getmsg32(rd_agent_t *rap, rd_event_msg_t *emsg)
{
	Rtld_db_priv	rdb;

	if (ps_pread(rap->rd_psp, rap->rd_rdebug, (char *)&rdb,
	    sizeof (Rtld_db_priv)) != PS_OK) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_READDBGFAIL_2),
		    EC_ADDR(rap->rd_rdebug)));
		return (RD_DBERR);
	}
	emsg->type = rdb.rtd_rdebug.r_rdevent;
	if (emsg->type == RD_DLACTIVITY) {
		switch (rdb.rtd_rdebug.r_state) {
			case RT_CONSISTENT:
				emsg->u.state = RD_CONSISTENT;
				break;
			case RT_ADD:
				emsg->u.state = RD_ADD;
				break;
			case RT_DELETE:
				emsg->u.state = RD_DELETE;
				break;
		}
	} else
		emsg->u.state = RD_NOSTATE;

	LOG(ps_plog(MSG_ORIG(MSG_DB_RDEVENTGETMSG), rap->rd_dmodel,
	    emsg->type, emsg->u.state));

	return (RD_OK);
}


rd_err_e
_rd_objpad_enable32(struct rd_agent *rap, size_t padsize)
{
	Rtld_db_priv		db_priv;
	struct ps_prochandle	*php = rap->rd_psp;

	LOG(ps_plog(MSG_ORIG(MSG_DB_RDOBJPADE), EC_ADDR(padsize)));

	if (ps_pread(php, rap->rd_rtlddbpriv, (char *)&db_priv,
	    sizeof (Rtld_db_priv)) != PS_OK) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_READFAIL_3),
		    EC_ADDR(rap->rd_rtlddbpriv)));
		return (RD_DBERR);
	}
#if	defined(_LP64) && !defined(_ELF64)
	/*LINTED*/
	db_priv.rtd_objpad = (uint32_t)padsize;
#else
	db_priv.rtd_objpad = padsize;
#endif
	if (ps_pwrite(php, rap->rd_rtlddbpriv, (char *)&db_priv,
	    sizeof (Rtld_db_priv)) != PS_OK) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_WRITEFAIL_2),
		    EC_ADDR(rap->rd_rtlddbpriv)));
		return (RD_DBERR);
	}
	return (RD_OK);
}

static rd_err_e
iter_map(rd_agent_t *rap, unsigned long ident, psaddr_t lmaddr,
    rl_iter_f *cb, void *client_data, uint_t *abort_iterp)
{
	while (lmaddr) {
		Rt_map		rmap;
		rd_loadobj_t	lobj;
		int		i;
		ulong_t		off;
		Ehdr		ehdr;
		Phdr		phdr;

		if (ps_pread(rap->rd_psp, lmaddr, (char *)&rmap,
		    sizeof (Rt_map)) != PS_OK) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_LKMAPFAIL)));
			return (RD_DBERR);
		}

		/*
		 * As of 'VERSION5' we only report objects
		 * which have been fully relocated.  While the maps
		 * might be in a consistent state - if a object hasn't
		 * been relocated - it's not really ready for the debuggers
		 * to examine.  This is mostly due to the fact that we
		 * might still be mucking with the text-segment, if
		 * we are - we could conflict with any break-points
		 * the debuggers might have set.
		 */
		if (rap->rd_rdebugvers >= R_RTLDDB_VERSION5) {
			if ((FLAGS(&rmap) & FLG_RT_RELOCED) == 0) {
				lmaddr = (psaddr_t)NEXT(&rmap);
				continue;
			}
		}

		lobj.rl_base = (psaddr_t)ADDR(&rmap);
		lobj.rl_flags = 0;
		lobj.rl_refnameaddr = (psaddr_t)REFNAME(&rmap);
		if ((rap->rd_helper.rh_ops != NULL) &&
		    (rap->rd_helper.rh_ops->rho_lmid != LM_ID_NONE))
			lobj.rl_lmident =
			    rap->rd_helper.rh_ops->rho_lmid;
		else
			lobj.rl_lmident = ident;

		/*
		 * refnameaddr is only valid from a core file
		 * which is VERSION3 or greater.
		 */
		if (rap->rd_rdebugvers < R_RTLDDB_VERSION3) {
			lobj.rl_nameaddr = (psaddr_t)NAME(&rmap);
			lobj.rl_bend = 0;
			lobj.rl_padstart = 0;
			lobj.rl_padend = 0;
		} else {
			lobj.rl_nameaddr = (psaddr_t)PATHNAME(&rmap);
			lobj.rl_bend = ADDR(&rmap) + MSIZE(&rmap);
			lobj.rl_padstart = PADSTART(&rmap);
			lobj.rl_padend = PADSTART(&rmap) + PADIMLEN(&rmap);

		}

		if (rtld_db_version >= RD_VERSION2)
			if (FLAGS(&rmap) & FLG_RT_IMGALLOC)
				lobj.rl_flags |= RD_FLG_MEM_OBJECT;
		if (rtld_db_version >= RD_VERSION2) {
			lobj.rl_dynamic = (psaddr_t)DYN(&rmap);
		}

		if (rtld_db_version >= RD_VERSION4)
			lobj.rl_tlsmodid = TLSMODID(&rmap);

		/*
		 * Look for beginning of data segment.
		 *
		 * NOTE: the data segment can only be found for full
		 *	processes and not from core images.
		 */
		lobj.rl_data_base = 0;
		if (rap->rd_flags & RDF_FL_COREFILE)
			lobj.rl_data_base = 0;
		else {
			off = ADDR(&rmap);
			if (ps_pread(rap->rd_psp, off, (char *)&ehdr,
			    sizeof (Ehdr)) != PS_OK) {
				LOG(ps_plog(MSG_ORIG(MSG_DB_LKMAPFAIL)));
				return (RD_DBERR);
			}
			off += sizeof (Ehdr);
			for (i = 0; i < ehdr.e_phnum; i++) {
				if (ps_pread(rap->rd_psp, off, (char *)&phdr,
				    sizeof (Phdr)) != PS_OK) {
					LOG(ps_plog(MSG_ORIG(
					    MSG_DB_LKMAPFAIL)));
					return (RD_DBERR);
				}
				if ((phdr.p_type == PT_LOAD) &&
				    (phdr.p_flags & PF_W)) {
					lobj.rl_data_base = phdr.p_vaddr;
					if (ehdr.e_type == ET_DYN)
						lobj.rl_data_base +=
						    ADDR(&rmap);
					break;
				}
				off += ehdr.e_phentsize;
			}
		}

		/*
		 * When we transfer control to the client we free the
		 * lock and re-atain it after we've returned from the
		 * client.  This is to avoid any deadlock situations.
		 */
		LOG(ps_plog(MSG_ORIG(MSG_DB_ITERMAP), cb, client_data,
		    EC_ADDR(lobj.rl_base), EC_ADDR(lobj.rl_lmident)));
		RDAGUNLOCK(rap);
		if ((*cb)(&lobj, client_data) == 0) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_CALLBACKR0)));
			RDAGLOCK(rap);
			*abort_iterp = 1;
			break;
		}
		RDAGLOCK(rap);
		lmaddr = (psaddr_t)NEXT(&rmap);
	}
	return (RD_OK);
}


static rd_err_e
_rd_loadobj_iter32_native(rd_agent_t *rap, rl_iter_f *cb, void *client_data,
    uint_t *abort_iterp)
{
	Rtld_db_priv	db_priv;
	TAPlist		apl;
	uintptr_t	datap, nitems;
	Addr		addr;
	rd_err_e	rc;

	LOG(ps_plog(MSG_ORIG(MSG_DB_LOADOBJITER), rap->rd_dmodel, cb,
	    client_data));

	/*
	 * First, determine whether the link-map information has been
	 * established.  Some debuggers have made an initial call to this
	 * function with a null call back function (cb), but expect a
	 * RD_NOMAPS error return rather than a RD_ERR return when the
	 * link-maps aren't available.
	 */
	if (ps_pread(rap->rd_psp, rap->rd_rtlddbpriv, (char *)&db_priv,
	    sizeof (Rtld_db_priv)) != PS_OK) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_READDBGFAIL_1),
		    EC_ADDR(rap->rd_rtlddbpriv)));
		return (RD_DBERR);
	}

	if (db_priv.rtd_dynlmlst == 0) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_LKMAPNOINIT),
		    EC_ADDR((uintptr_t)db_priv.rtd_dynlmlst)));
		return (RD_NOMAPS);
	}

	if (ps_pread(rap->rd_psp, (psaddr_t)db_priv.rtd_dynlmlst, (char *)&addr,
	    sizeof (Addr)) != PS_OK) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_READDBGFAIL_3),
		    EC_ADDR((uintptr_t)db_priv.rtd_dynlmlst)));
		return (RD_DBERR);
	}

	if (addr == 0) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_LKMAPNOINIT_1),
		    EC_ADDR((uintptr_t)db_priv.rtd_dynlmlst)));
		return (RD_NOMAPS);
	}

	/*
	 * Having determined we have link-maps, ensure we have an iterator
	 * call back function.
	 */
	if (cb == NULL) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_NULLITER)));
		return (RD_ERR);
	}

	/*
	 * As of VERSION6, rtd_dynlmlst points to an APlist.  Prior to VERSION6
	 * rtd_dynlmlst pointed to a List.  But, there was a window where the
	 * version was not incremented, and this must be worked around by
	 * interpreting the APlist data.  Read the initial APlist information.
	 */
	if (ps_pread(rap->rd_psp, (psaddr_t)addr, (char *)&apl,
	    sizeof (TAPlist)) != PS_OK) {
		LOG(ps_plog(MSG_ORIG(MSG_DB_READDBGFAIL_4),
		    EC_ADDR((uintptr_t)addr)));
		return (RD_DBERR);
	}

	/*
	 * The rtd_dynlmlst change from a List to an APlist occurred under
	 * 6801536 in snv_112.  However, this change neglected to preserve
	 * backward compatibility by maintaining List processing and using a
	 * version increment to detect the change.  6862967, intergrated in
	 * snv_121 corrects the version detection.  However, to catch objects
	 * built between these releases, we look at the first element of the
	 * APlist.  apl_arritems indicates the number of APlist items that are
	 * available.  This was originally initialized with a AL_CNT_DYNLIST
	 * value of 2 (one entry for LM_ID_BASE and one entry for LM_ID_LDSO).
	 * It is possible that the use of an auditor results in an additional
	 * link-map list, in which case the original apl_arritems would have
	 * been doubled.
	 *
	 * Therefore, if the debugging verion is VERSION6, or the apl_arritems
	 * entry has a value less than or equal to 4 and the debugging version
	 * is VERSION5, then we process APlists.  Otherwise, fall back to List
	 * processing.
	 */
	if ((rap->rd_rdebugvers >= R_RTLDDB_VERSION6) ||
	    ((rap->rd_rdebugvers == R_RTLDDB_VERSION5) &&
	    (apl.apl_arritems <= 4))) {
		/*
		 * Iterate through each apl.ap_data[] entry.
		 */
		for (datap = (uintptr_t)((char *)(uintptr_t)addr +
		    ((size_t)(((TAPlist *)0)->apl_data))), nitems = 0;
		    nitems < apl.apl_nitems; nitems++, datap += sizeof (Addr)) {
			TLm_list	lm;
			ulong_t		ident;

			/*
			 * Obtain the Lm_list address for this apl.ap_data[]
			 * entry.
			 */
			if (ps_pread(rap->rd_psp, (psaddr_t)datap,
			    (char *)&addr, sizeof (Addr)) != PS_OK) {
				LOG(ps_plog(MSG_ORIG(MSG_DB_READDBGFAIL_5),
				    EC_ADDR(datap)));
				return (RD_DBERR);
			}

			/*
			 * Obtain the Lm_list data for this Lm_list address.
			 */
			if (ps_pread(rap->rd_psp, (psaddr_t)addr, (char *)&lm,
			    sizeof (TLm_list)) != PS_OK) {
				LOG(ps_plog(MSG_ORIG(MSG_DB_READDBGFAIL_6),
				    EC_ADDR((uintptr_t)addr)));
				return (RD_DBERR);
			}

			/*
			 * Determine IDENT of current LM_LIST
			 */
			if (lm.lm_flags & LML_FLG_BASELM)
				ident = LM_ID_BASE;
			else if (lm.lm_flags & LML_FLG_RTLDLM)
				ident = LM_ID_LDSO;
			else
				ident = (ulong_t)addr;

			if ((rc = iter_map(rap, ident, (psaddr_t)lm.lm_head,
			    cb, client_data, abort_iterp)) != RD_OK)
				return (rc);

			if (*abort_iterp != 0)
				break;
		}
	} else {
		TList		list;
		TListnode	lnode;
		Addr		lnp;

		/*
		 * Re-read the dynlmlst address to obtain a List structure.
		 */
		if (ps_pread(rap->rd_psp, (psaddr_t)db_priv.rtd_dynlmlst,
		    (char *)&list, sizeof (TList)) != PS_OK) {
			LOG(ps_plog(MSG_ORIG(MSG_DB_READDBGFAIL_3),
			    EC_ADDR((uintptr_t)db_priv.rtd_dynlmlst)));
			return (RD_DBERR);
		}

		/*
		 * Iterate through the link-map list.
		 */
		for (lnp = (Addr)list.head; lnp; lnp = (Addr)lnode.next) {
			Lm_list	lml;
			ulong_t	ident;

			/*
			 * Iterate through the List of Lm_list's.
			 */
			if (ps_pread(rap->rd_psp, (psaddr_t)lnp, (char *)&lnode,
			    sizeof (TListnode)) != PS_OK) {
				LOG(ps_plog(MSG_ORIG(MSG_DB_READDBGFAIL_4),
				    EC_ADDR(lnp)));
					return (RD_DBERR);
			}

			if (ps_pread(rap->rd_psp, (psaddr_t)lnode.data,
			    (char *)&lml, sizeof (Lm_list)) != PS_OK) {
				LOG(ps_plog(MSG_ORIG(MSG_DB_READDBGFAIL_5),
				    EC_ADDR((uintptr_t)lnode.data)));
					return (RD_DBERR);
			}

			/*
			 * Determine IDENT of current LM_LIST
			 */
			if (lml.lm_flags & LML_FLG_BASELM)
				ident = LM_ID_BASE;
			else if (lml.lm_flags & LML_FLG_RTLDLM)
				ident = LM_ID_LDSO;
			else
				ident = (unsigned long)lnode.data;

			if ((rc = iter_map(rap, ident, (psaddr_t)lml.lm_head,
			    cb, client_data, abort_iterp)) != RD_OK)
				return (rc);

			if (*abort_iterp != 0)
				break;
		}
	}

	return (rc);
}

rd_err_e
_rd_loadobj_iter32(rd_agent_t *rap, rl_iter_f *cb, void *client_data)
{
	rd_err_e	rc, rc_brand = RD_OK;
	uint_t		abort_iter = 0;

	/* First iterate over the native target objects */
	rc = _rd_loadobj_iter32_native(rap, cb, client_data, &abort_iter);
	if (abort_iter != 0)
		return (rc);

	/* Then iterate over any branded objects. */
	if ((rap->rd_helper.rh_ops != NULL) &&
	    (rap->rd_helper.rh_ops->rho_loadobj_iter != NULL))
		rc_brand = rap->rd_helper.rh_ops->rho_loadobj_iter(
		    rap->rd_helper.rh_data, cb, client_data);

	rc = (rc != RD_OK) ? rc : rc_brand;
	return (rc);
}