1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22/*
23 * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2016 Joyent, Inc.
25 * Copyright (c) 2013 by Delphix. All rights reserved.
26 */
27
28#include <assert.h>
29#include <stdio.h>
30#include <stdlib.h>
31#include <stddef.h>
32#include <unistd.h>
33#include <ctype.h>
34#include <fcntl.h>
35#include <string.h>
36#include <strings.h>
37#include <memory.h>
38#include <errno.h>
39#include <dirent.h>
40#include <signal.h>
41#include <limits.h>
42#include <libgen.h>
43#include <sys/types.h>
44#include <sys/stat.h>
45#include <sys/sysmacros.h>
46#include <sys/crc32.h>
47
48#include "libproc.h"
49#include "Pcontrol.h"
50#include "Putil.h"
51#include "Psymtab_machelf.h"
52
53static file_info_t *build_map_symtab(struct ps_prochandle *, map_info_t *);
54static map_info_t *exec_map(struct ps_prochandle *);
55static map_info_t *object_to_map(struct ps_prochandle *, Lmid_t, const char *);
56static map_info_t *object_name_to_map(struct ps_prochandle *,
57	Lmid_t, const char *);
58static GElf_Sym *sym_by_name(sym_tbl_t *, const char *, GElf_Sym *, uint_t *);
59static int read_ehdr32(struct ps_prochandle *, Elf32_Ehdr *, uint_t *,
60    uintptr_t);
61#ifdef _LP64
62static int read_ehdr64(struct ps_prochandle *, Elf64_Ehdr *, uint_t *,
63    uintptr_t);
64#endif
65static uint32_t psym_crc32[] = { CRC32_TABLE };
66
67#define	DATA_TYPES	\
68	((1 << STT_OBJECT) | (1 << STT_FUNC) | \
69	(1 << STT_COMMON) | (1 << STT_TLS))
70#define	IS_DATA_TYPE(tp)	(((1 << (tp)) & DATA_TYPES) != 0)
71
72#define	MA_RWX	(MA_READ | MA_WRITE | MA_EXEC)
73
74/*
75 * Minimum and maximum length of a build-id that we'll accept. Generally it's a
76 * 20 byte SHA1 and it's expected that the first byte (which is two ascii
77 * characters) indicates a directory and the remaining bytes become the file
78 * name. Therefore, our minimum length is at least 2 bytes (one for the
79 * directory and one for the name) and the max is a bit over the minimum -- 64,
80 * just in case folks do something odd. The string length is three times the max
81 * length. This accounts for the fact that each byte is two characters, a null
82 * terminator, and the directory '/' character.
83 */
84#define	MINBUILDID	2
85#define	MAXBUILDID	64
86#define	BUILDID_STRLEN	(3*MAXBUILDID)
87#define	BUILDID_NAME	".note.gnu.build-id"
88#define	DBGLINK_NAME	".gnu_debuglink"
89
90typedef enum {
91	PRO_NATURAL,
92	PRO_BYADDR,
93	PRO_BYNAME
94} pr_order_t;
95
96static int
97addr_cmp(const void *aa, const void *bb)
98{
99	uintptr_t a = *((uintptr_t *)aa);
100	uintptr_t b = *((uintptr_t *)bb);
101
102	if (a > b)
103		return (1);
104	if (a < b)
105		return (-1);
106	return (0);
107}
108
109/*
110 * This function creates a list of addresses for a load object's sections.
111 * The list is in ascending address order and alternates start address
112 * then end address for each section we're interested in. The function
113 * returns a pointer to the list, which must be freed by the caller.
114 */
115static uintptr_t *
116get_saddrs(struct ps_prochandle *P, uintptr_t ehdr_start, uint_t *n)
117{
118	uintptr_t a, addr, *addrs, last = 0;
119	uint_t i, naddrs = 0, unordered = 0;
120
121	if (P->status.pr_dmodel == PR_MODEL_ILP32) {
122		Elf32_Ehdr ehdr;
123		Elf32_Phdr phdr;
124		uint_t phnum;
125
126		if (read_ehdr32(P, &ehdr, &phnum, ehdr_start) != 0)
127			return (NULL);
128
129		addrs = malloc(sizeof (uintptr_t) * phnum * 2);
130		a = ehdr_start + ehdr.e_phoff;
131		for (i = 0; i < phnum; i++, a += ehdr.e_phentsize) {
132			if (Pread(P, &phdr, sizeof (phdr), a) !=
133			    sizeof (phdr)) {
134				free(addrs);
135				return (NULL);
136			}
137			if (phdr.p_type != PT_LOAD || phdr.p_memsz == 0)
138				continue;
139
140			addr = phdr.p_vaddr;
141			if (ehdr.e_type == ET_DYN)
142				addr += ehdr_start;
143			if (last > addr)
144				unordered = 1;
145			addrs[naddrs++] = addr;
146			addrs[naddrs++] = last = addr + phdr.p_memsz - 1;
147		}
148#ifdef _LP64
149	} else {
150		Elf64_Ehdr ehdr;
151		Elf64_Phdr phdr;
152		uint_t phnum;
153
154		if (read_ehdr64(P, &ehdr, &phnum, ehdr_start) != 0)
155			return (NULL);
156
157		addrs = malloc(sizeof (uintptr_t) * phnum * 2);
158		a = ehdr_start + ehdr.e_phoff;
159		for (i = 0; i < phnum; i++, a += ehdr.e_phentsize) {
160			if (Pread(P, &phdr, sizeof (phdr), a) !=
161			    sizeof (phdr)) {
162				free(addrs);
163				return (NULL);
164			}
165			if (phdr.p_type != PT_LOAD || phdr.p_memsz == 0)
166				continue;
167
168			addr = phdr.p_vaddr;
169			if (ehdr.e_type == ET_DYN)
170				addr += ehdr_start;
171			if (last > addr)
172				unordered = 1;
173			addrs[naddrs++] = addr;
174			addrs[naddrs++] = last = addr + phdr.p_memsz - 1;
175		}
176#endif
177	}
178
179	if (unordered)
180		qsort(addrs, naddrs, sizeof (uintptr_t), addr_cmp);
181
182	*n = naddrs;
183	return (addrs);
184}
185
186/*
187 * Allocation function for a new file_info_t
188 */
189file_info_t *
190file_info_new(struct ps_prochandle *P, map_info_t *mptr)
191{
192	file_info_t *fptr;
193	map_info_t *mp;
194	uintptr_t mstart, mend, sstart, send;
195	uint_t i;
196
197	if ((fptr = calloc(1, sizeof (file_info_t))) == NULL)
198		return (NULL);
199
200	list_link(fptr, &P->file_head);
201	(void) strcpy(fptr->file_pname, mptr->map_pmap.pr_mapname);
202	mptr->map_file = fptr;
203	fptr->file_ref = 1;
204	fptr->file_fd = -1;
205	fptr->file_dbgfile = -1;
206	P->num_files++;
207
208	/*
209	 * To figure out which map_info_t instances correspond to the mappings
210	 * for this load object we try to obtain the start and end address
211	 * for each section of our in-memory ELF image. If successful, we
212	 * walk down the list of addresses and the list of map_info_t
213	 * instances in lock step to correctly find the mappings that
214	 * correspond to this load object.
215	 */
216	if ((fptr->file_saddrs = get_saddrs(P, mptr->map_pmap.pr_vaddr,
217	    &fptr->file_nsaddrs)) == NULL)
218		return (fptr);
219
220	mp = P->mappings;
221	i = 0;
222	while (mp < P->mappings + P->map_count && i < fptr->file_nsaddrs) {
223
224		/* Calculate the start and end of the mapping and section */
225		mstart = mp->map_pmap.pr_vaddr;
226		mend = mp->map_pmap.pr_vaddr + mp->map_pmap.pr_size;
227		sstart = fptr->file_saddrs[i];
228		send = fptr->file_saddrs[i + 1];
229
230		if (mend <= sstart) {
231			/* This mapping is below the current section */
232			mp++;
233		} else if (mstart >= send) {
234			/* This mapping is above the current section */
235			i += 2;
236		} else {
237			/* This mapping overlaps the current section */
238			if (mp->map_file == NULL) {
239				dprintf("file_info_new: associating "
240				    "segment at %p\n",
241				    (void *)mp->map_pmap.pr_vaddr);
242				mp->map_file = fptr;
243				fptr->file_ref++;
244			} else {
245				dprintf("file_info_new: segment at %p "
246				    "already associated with %s\n",
247				    (void *)mp->map_pmap.pr_vaddr,
248				    (mp == mptr ? "this file" :
249				    mp->map_file->file_pname));
250			}
251			mp++;
252		}
253	}
254
255	return (fptr);
256}
257
258/*
259 * Deallocation function for a file_info_t
260 */
261static void
262file_info_free(struct ps_prochandle *P, file_info_t *fptr)
263{
264	if (--fptr->file_ref == 0) {
265		list_unlink(fptr);
266		if (fptr->file_symtab.sym_elf) {
267			(void) elf_end(fptr->file_symtab.sym_elf);
268			free(fptr->file_symtab.sym_elfmem);
269		}
270		if (fptr->file_symtab.sym_byname)
271			free(fptr->file_symtab.sym_byname);
272		if (fptr->file_symtab.sym_byaddr)
273			free(fptr->file_symtab.sym_byaddr);
274
275		if (fptr->file_dynsym.sym_elf) {
276			(void) elf_end(fptr->file_dynsym.sym_elf);
277			free(fptr->file_dynsym.sym_elfmem);
278		}
279		if (fptr->file_dynsym.sym_byname)
280			free(fptr->file_dynsym.sym_byname);
281		if (fptr->file_dynsym.sym_byaddr)
282			free(fptr->file_dynsym.sym_byaddr);
283
284		if (fptr->file_lo)
285			free(fptr->file_lo);
286		if (fptr->file_lname)
287			free(fptr->file_lname);
288		if (fptr->file_rname)
289			free(fptr->file_rname);
290		if (fptr->file_elf)
291			(void) elf_end(fptr->file_elf);
292		if (fptr->file_elfmem != NULL)
293			free(fptr->file_elfmem);
294		if (fptr->file_fd >= 0)
295			(void) close(fptr->file_fd);
296		if (fptr->file_dbgelf)
297			(void) elf_end(fptr->file_dbgelf);
298		if (fptr->file_dbgfile >= 0)
299			(void) close(fptr->file_dbgfile);
300		if (fptr->file_ctfp) {
301			ctf_close(fptr->file_ctfp);
302			free(fptr->file_ctf_buf);
303		}
304		if (fptr->file_saddrs)
305			free(fptr->file_saddrs);
306		free(fptr);
307		P->num_files--;
308	}
309}
310
311/*
312 * Deallocation function for a map_info_t
313 */
314static void
315map_info_free(struct ps_prochandle *P, map_info_t *mptr)
316{
317	file_info_t *fptr;
318
319	if ((fptr = mptr->map_file) != NULL) {
320		if (fptr->file_map == mptr)
321			fptr->file_map = NULL;
322		file_info_free(P, fptr);
323	}
324	if (P->execname && mptr == P->map_exec) {
325		free(P->execname);
326		P->execname = NULL;
327	}
328	if (P->auxv && (mptr == P->map_exec || mptr == P->map_ldso)) {
329		free(P->auxv);
330		P->auxv = NULL;
331		P->nauxv = 0;
332	}
333	if (mptr == P->map_exec)
334		P->map_exec = NULL;
335	if (mptr == P->map_ldso)
336		P->map_ldso = NULL;
337}
338
339/*
340 * Call-back function for librtld_db to iterate through all of its shared
341 * libraries.  We use this to get the load object names for the mappings.
342 */
343static int
344map_iter(const rd_loadobj_t *lop, void *cd)
345{
346	char buf[PATH_MAX];
347	struct ps_prochandle *P = cd;
348	map_info_t *mptr;
349	file_info_t *fptr;
350
351	dprintf("encountered rd object at %p\n", (void *)lop->rl_base);
352
353	if ((mptr = Paddr2mptr(P, lop->rl_base)) == NULL) {
354		dprintf("map_iter: base address doesn't match any mapping\n");
355		return (1); /* Base address does not match any mapping */
356	}
357
358	if ((fptr = mptr->map_file) == NULL &&
359	    (fptr = file_info_new(P, mptr)) == NULL) {
360		dprintf("map_iter: failed to allocate a new file_info_t\n");
361		return (1); /* Failed to allocate a new file_info_t */
362	}
363
364	if ((fptr->file_lo == NULL) &&
365	    (fptr->file_lo = malloc(sizeof (rd_loadobj_t))) == NULL) {
366		dprintf("map_iter: failed to allocate rd_loadobj_t\n");
367		file_info_free(P, fptr);
368		return (1); /* Failed to allocate rd_loadobj_t */
369	}
370
371	fptr->file_map = mptr;
372	*fptr->file_lo = *lop;
373
374	fptr->file_lo->rl_plt_base = fptr->file_plt_base;
375	fptr->file_lo->rl_plt_size = fptr->file_plt_size;
376
377	if (fptr->file_lname) {
378		free(fptr->file_lname);
379		fptr->file_lname = NULL;
380		fptr->file_lbase = NULL;
381	}
382	if (fptr->file_rname) {
383		free(fptr->file_rname);
384		fptr->file_rname = NULL;
385		fptr->file_rbase = NULL;
386	}
387
388	if (Pread_string(P, buf, sizeof (buf), lop->rl_nameaddr) > 0) {
389		if ((fptr->file_lname = strdup(buf)) != NULL)
390			fptr->file_lbase = basename(fptr->file_lname);
391	} else {
392		dprintf("map_iter: failed to read string at %p\n",
393		    (void *)lop->rl_nameaddr);
394	}
395
396	if ((Pfindmap(P, mptr, buf, sizeof (buf)) != NULL) &&
397	    ((fptr->file_rname = strdup(buf)) != NULL))
398		fptr->file_rbase = basename(fptr->file_rname);
399
400	dprintf("loaded rd object %s lmid %lx\n",
401	    fptr->file_lname ? buf : "<NULL>", lop->rl_lmident);
402	return (1);
403}
404
405static void
406map_set(struct ps_prochandle *P, map_info_t *mptr, const char *lname)
407{
408	file_info_t *fptr;
409	char buf[PATH_MAX];
410
411	if ((fptr = mptr->map_file) == NULL &&
412	    (fptr = file_info_new(P, mptr)) == NULL)
413		return; /* Failed to allocate a new file_info_t */
414
415	fptr->file_map = mptr;
416
417	if ((fptr->file_lo == NULL) &&
418	    (fptr->file_lo = malloc(sizeof (rd_loadobj_t))) == NULL) {
419		file_info_free(P, fptr);
420		return; /* Failed to allocate rd_loadobj_t */
421	}
422
423	(void) memset(fptr->file_lo, 0, sizeof (rd_loadobj_t));
424	fptr->file_lo->rl_base = mptr->map_pmap.pr_vaddr;
425	fptr->file_lo->rl_bend =
426	    mptr->map_pmap.pr_vaddr + mptr->map_pmap.pr_size;
427
428	fptr->file_lo->rl_plt_base = fptr->file_plt_base;
429	fptr->file_lo->rl_plt_size = fptr->file_plt_size;
430
431	if ((fptr->file_lname == NULL) &&
432	    (fptr->file_lname = strdup(lname)) != NULL)
433		fptr->file_lbase = basename(fptr->file_lname);
434
435	if ((Pfindmap(P, mptr, buf, sizeof (buf)) != NULL) &&
436	    ((fptr->file_rname = strdup(buf)) != NULL))
437		fptr->file_rbase = basename(fptr->file_rname);
438}
439
440static void
441load_static_maps(struct ps_prochandle *P)
442{
443	map_info_t *mptr;
444
445	/*
446	 * Construct the map for the a.out.
447	 */
448	if ((mptr = object_name_to_map(P, PR_LMID_EVERY, PR_OBJ_EXEC)) != NULL)
449		map_set(P, mptr, "a.out");
450
451	/*
452	 * If the dynamic linker exists for this process,
453	 * construct the map for it.
454	 */
455	if (Pgetauxval(P, AT_BASE) != -1L &&
456	    (mptr = object_name_to_map(P, PR_LMID_EVERY, PR_OBJ_LDSO)) != NULL)
457		map_set(P, mptr, "ld.so.1");
458}
459
460int
461Preadmaps(struct ps_prochandle *P, prmap_t **Pmapp, ssize_t *nmapp)
462{
463	return (P->ops.pop_read_maps(P, Pmapp, nmapp, P->data));
464}
465
466/*
467 * Go through all the address space mappings, validating or updating
468 * the information already gathered, or gathering new information.
469 *
470 * This function is only called when we suspect that the mappings have changed
471 * because this is the first time we're calling it or because of rtld activity.
472 */
473void
474Pupdate_maps(struct ps_prochandle *P)
475{
476	prmap_t *Pmap = NULL;
477	prmap_t *pmap;
478	ssize_t nmap;
479	int i;
480	uint_t oldmapcount;
481	map_info_t *newmap, *newp;
482	map_info_t *mptr;
483
484	if (P->info_valid || P->state == PS_UNDEAD)
485		return;
486
487	Preadauxvec(P);
488
489	if (Preadmaps(P, &Pmap, &nmap) != 0)
490		return;
491
492	if ((newmap = calloc(1, nmap * sizeof (map_info_t))) == NULL)
493		return;
494
495	/*
496	 * We try to merge any file information we may have for existing
497	 * mappings, to avoid having to rebuild the file info.
498	 */
499	mptr = P->mappings;
500	pmap = Pmap;
501	newp = newmap;
502	oldmapcount = P->map_count;
503	for (i = 0; i < nmap; i++, pmap++, newp++) {
504
505		if (oldmapcount == 0) {
506			/*
507			 * We've exhausted all the old mappings.  Every new
508			 * mapping should be added.
509			 */
510			newp->map_pmap = *pmap;
511
512		} else if (pmap->pr_vaddr == mptr->map_pmap.pr_vaddr &&
513		    pmap->pr_size == mptr->map_pmap.pr_size &&
514		    pmap->pr_offset == mptr->map_pmap.pr_offset &&
515		    (pmap->pr_mflags & ~(MA_BREAK | MA_STACK)) ==
516		    (mptr->map_pmap.pr_mflags & ~(MA_BREAK | MA_STACK)) &&
517		    pmap->pr_pagesize == mptr->map_pmap.pr_pagesize &&
518		    pmap->pr_shmid == mptr->map_pmap.pr_shmid &&
519		    strcmp(pmap->pr_mapname, mptr->map_pmap.pr_mapname) == 0) {
520
521			/*
522			 * This mapping matches exactly.  Copy over the old
523			 * mapping, taking care to get the latest flags.
524			 * Make sure the associated file_info_t is updated
525			 * appropriately.
526			 */
527			*newp = *mptr;
528			if (P->map_exec == mptr)
529				P->map_exec = newp;
530			if (P->map_ldso == mptr)
531				P->map_ldso = newp;
532			newp->map_pmap.pr_mflags = pmap->pr_mflags;
533			if (mptr->map_file != NULL &&
534			    mptr->map_file->file_map == mptr)
535				mptr->map_file->file_map = newp;
536			oldmapcount--;
537			mptr++;
538
539		} else if (pmap->pr_vaddr + pmap->pr_size >
540		    mptr->map_pmap.pr_vaddr) {
541
542			/*
543			 * The old mapping doesn't exist any more, remove it
544			 * from the list.
545			 */
546			map_info_free(P, mptr);
547			oldmapcount--;
548			i--;
549			newp--;
550			pmap--;
551			mptr++;
552
553		} else {
554
555			/*
556			 * This is a new mapping, add it directly.
557			 */
558			newp->map_pmap = *pmap;
559		}
560	}
561
562	/*
563	 * Free any old maps
564	 */
565	while (oldmapcount) {
566		map_info_free(P, mptr);
567		oldmapcount--;
568		mptr++;
569	}
570
571	free(Pmap);
572	if (P->mappings != NULL)
573		free(P->mappings);
574	P->mappings = newmap;
575	P->map_count = P->map_alloc = nmap;
576	P->info_valid = 1;
577
578	/*
579	 * Consult librtld_db to get the load object
580	 * names for all of the shared libraries.
581	 */
582	if (P->rap != NULL)
583		(void) rd_loadobj_iter(P->rap, map_iter, P);
584}
585
586/*
587 * Update all of the mappings and rtld_db as if by Pupdate_maps(), and then
588 * forcibly cache all of the symbol tables associated with all object files.
589 */
590void
591Pupdate_syms(struct ps_prochandle *P)
592{
593	file_info_t *fptr;
594	int i;
595
596	Pupdate_maps(P);
597
598	for (i = 0, fptr = list_next(&P->file_head); i < P->num_files;
599	    i++, fptr = list_next(fptr)) {
600		Pbuild_file_symtab(P, fptr);
601		(void) Pbuild_file_ctf(P, fptr);
602	}
603}
604
605/*
606 * Return the librtld_db agent handle for the victim process.
607 * The handle will become invalid at the next successful exec() and the
608 * client (caller of proc_rd_agent()) must not use it beyond that point.
609 * If the process is already dead, we've already tried our best to
610 * create the agent during core file initialization.
611 */
612rd_agent_t *
613Prd_agent(struct ps_prochandle *P)
614{
615	if (P->rap == NULL && P->state != PS_DEAD && P->state != PS_IDLE) {
616		Pupdate_maps(P);
617		if (P->num_files == 0)
618			load_static_maps(P);
619		rd_log(_libproc_debug);
620		if ((P->rap = rd_new(P)) != NULL)
621			(void) rd_loadobj_iter(P->rap, map_iter, P);
622	}
623	return (P->rap);
624}
625
626/*
627 * Return the prmap_t structure containing 'addr', but only if it
628 * is in the dynamic linker's link map and is the text section.
629 */
630const prmap_t *
631Paddr_to_text_map(struct ps_prochandle *P, uintptr_t addr)
632{
633	map_info_t *mptr;
634
635	if (!P->info_valid)
636		Pupdate_maps(P);
637
638	if ((mptr = Paddr2mptr(P, addr)) != NULL) {
639		file_info_t *fptr = build_map_symtab(P, mptr);
640		const prmap_t *pmp = &mptr->map_pmap;
641
642		/*
643		 * Assume that if rl_data_base is NULL, it means that no
644		 * data section was found for this load object, and that
645		 * a section must be text. Otherwise, a section will be
646		 * text unless it ends above the start of the data
647		 * section.
648		 */
649		if (fptr != NULL && fptr->file_lo != NULL &&
650		    (fptr->file_lo->rl_data_base == (uintptr_t)NULL ||
651		    pmp->pr_vaddr + pmp->pr_size <=
652		    fptr->file_lo->rl_data_base))
653			return (pmp);
654	}
655
656	return (NULL);
657}
658
659/*
660 * Return the prmap_t structure containing 'addr' (no restrictions on
661 * the type of mapping).
662 */
663const prmap_t *
664Paddr_to_map(struct ps_prochandle *P, uintptr_t addr)
665{
666	map_info_t *mptr;
667
668	if (!P->info_valid)
669		Pupdate_maps(P);
670
671	if ((mptr = Paddr2mptr(P, addr)) != NULL)
672		return (&mptr->map_pmap);
673
674	return (NULL);
675}
676
677/*
678 * Convert a full or partial load object name to the prmap_t for its
679 * corresponding primary text mapping.
680 */
681const prmap_t *
682Plmid_to_map(struct ps_prochandle *P, Lmid_t lmid, const char *name)
683{
684	map_info_t *mptr;
685
686	if (name == PR_OBJ_EVERY)
687		return (NULL); /* A reasonable mistake */
688
689	if ((mptr = object_name_to_map(P, lmid, name)) != NULL)
690		return (&mptr->map_pmap);
691
692	return (NULL);
693}
694
695const prmap_t *
696Pname_to_map(struct ps_prochandle *P, const char *name)
697{
698	return (Plmid_to_map(P, PR_LMID_EVERY, name));
699}
700
701const rd_loadobj_t *
702Paddr_to_loadobj(struct ps_prochandle *P, uintptr_t addr)
703{
704	map_info_t *mptr;
705
706	if (!P->info_valid)
707		Pupdate_maps(P);
708
709	if ((mptr = Paddr2mptr(P, addr)) == NULL)
710		return (NULL);
711
712	/*
713	 * By building the symbol table, we implicitly bring the PLT
714	 * information up to date in the load object.
715	 */
716	(void) build_map_symtab(P, mptr);
717
718	return (mptr->map_file->file_lo);
719}
720
721const rd_loadobj_t *
722Plmid_to_loadobj(struct ps_prochandle *P, Lmid_t lmid, const char *name)
723{
724	map_info_t *mptr;
725
726	if (name == PR_OBJ_EVERY)
727		return (NULL);
728
729	if ((mptr = object_name_to_map(P, lmid, name)) == NULL)
730		return (NULL);
731
732	/*
733	 * By building the symbol table, we implicitly bring the PLT
734	 * information up to date in the load object.
735	 */
736	(void) build_map_symtab(P, mptr);
737
738	return (mptr->map_file->file_lo);
739}
740
741const rd_loadobj_t *
742Pname_to_loadobj(struct ps_prochandle *P, const char *name)
743{
744	return (Plmid_to_loadobj(P, PR_LMID_EVERY, name));
745}
746
747ctf_file_t *
748Pbuild_file_ctf(struct ps_prochandle *P, file_info_t *fptr)
749{
750	ctf_sect_t ctdata, symtab, strtab;
751	sym_tbl_t *symp;
752	int err;
753
754	if (fptr->file_ctfp != NULL)
755		return (fptr->file_ctfp);
756
757	Pbuild_file_symtab(P, fptr);
758
759	if (fptr->file_ctf_size == 0)
760		return (NULL);
761
762	symp = fptr->file_ctf_dyn ? &fptr->file_dynsym : &fptr->file_symtab;
763	if (symp->sym_data_pri == NULL)
764		return (NULL);
765
766	/*
767	 * The buffer may alread be allocated if this is a core file that
768	 * contained CTF data for this file.
769	 */
770	if (fptr->file_ctf_buf == NULL) {
771		fptr->file_ctf_buf = malloc(fptr->file_ctf_size);
772		if (fptr->file_ctf_buf == NULL) {
773			dprintf("failed to allocate ctf buffer\n");
774			return (NULL);
775		}
776
777		if (pread(fptr->file_fd, fptr->file_ctf_buf,
778		    fptr->file_ctf_size, fptr->file_ctf_off) !=
779		    fptr->file_ctf_size) {
780			free(fptr->file_ctf_buf);
781			fptr->file_ctf_buf = NULL;
782			dprintf("failed to read ctf data\n");
783			return (NULL);
784		}
785	}
786
787	ctdata.cts_name = ".SUNW_ctf";
788	ctdata.cts_type = SHT_PROGBITS;
789	ctdata.cts_flags = 0;
790	ctdata.cts_data = fptr->file_ctf_buf;
791	ctdata.cts_size = fptr->file_ctf_size;
792	ctdata.cts_entsize = 1;
793	ctdata.cts_offset = 0;
794
795	symtab.cts_name = fptr->file_ctf_dyn ? ".dynsym" : ".symtab";
796	symtab.cts_type = symp->sym_hdr_pri.sh_type;
797	symtab.cts_flags = symp->sym_hdr_pri.sh_flags;
798	symtab.cts_data = symp->sym_data_pri->d_buf;
799	symtab.cts_size = symp->sym_hdr_pri.sh_size;
800	symtab.cts_entsize = symp->sym_hdr_pri.sh_entsize;
801	symtab.cts_offset = symp->sym_hdr_pri.sh_offset;
802
803	strtab.cts_name = fptr->file_ctf_dyn ? ".dynstr" : ".strtab";
804	strtab.cts_type = symp->sym_strhdr.sh_type;
805	strtab.cts_flags = symp->sym_strhdr.sh_flags;
806	strtab.cts_data = symp->sym_strs;
807	strtab.cts_size = symp->sym_strhdr.sh_size;
808	strtab.cts_entsize = symp->sym_strhdr.sh_entsize;
809	strtab.cts_offset = symp->sym_strhdr.sh_offset;
810
811	fptr->file_ctfp = ctf_bufopen(&ctdata, &symtab, &strtab, &err);
812	if (fptr->file_ctfp == NULL) {
813		dprintf("ctf_bufopen() failed, error code %d\n", err);
814		free(fptr->file_ctf_buf);
815		fptr->file_ctf_buf = NULL;
816		return (NULL);
817	}
818
819	dprintf("loaded %lu bytes of CTF data for %s\n",
820	    (ulong_t)fptr->file_ctf_size, fptr->file_pname);
821
822	return (fptr->file_ctfp);
823}
824
825ctf_file_t *
826Paddr_to_ctf(struct ps_prochandle *P, uintptr_t addr)
827{
828	map_info_t *mptr;
829	file_info_t *fptr;
830
831	if (!P->info_valid)
832		Pupdate_maps(P);
833
834	if ((mptr = Paddr2mptr(P, addr)) == NULL ||
835	    (fptr = mptr->map_file) == NULL)
836		return (NULL);
837
838	return (Pbuild_file_ctf(P, fptr));
839}
840
841ctf_file_t *
842Plmid_to_ctf(struct ps_prochandle *P, Lmid_t lmid, const char *name)
843{
844	map_info_t *mptr;
845	file_info_t *fptr = NULL;
846
847	if (name == PR_OBJ_EVERY)
848		return (NULL);
849
850	/*
851	 * While most idle files are all ELF objects, not all of them have
852	 * mapping information available. There's nothing which would make
853	 * sense to fake up for ET_REL. Instead, if we're being asked for their
854	 * executable object and we know that the information is valid and they
855	 * only have a single file, we jump straight to that file pointer.
856	 */
857	if (P->state == PS_IDLE && name == PR_OBJ_EXEC && P->info_valid == 1 &&
858	    P->num_files == 1 && P->mappings == NULL) {
859		fptr = list_next(&P->file_head);
860	}
861
862	if (fptr == NULL) {
863		if ((mptr = object_name_to_map(P, lmid, name)) == NULL ||
864		    (fptr = mptr->map_file) == NULL)
865			return (NULL);
866	}
867
868	return (Pbuild_file_ctf(P, fptr));
869}
870
871ctf_file_t *
872Pname_to_ctf(struct ps_prochandle *P, const char *name)
873{
874	return (Plmid_to_ctf(P, PR_LMID_EVERY, name));
875}
876
877void
878Preadauxvec(struct ps_prochandle *P)
879{
880	if (P->auxv != NULL) {
881		free(P->auxv);
882		P->auxv = NULL;
883		P->nauxv = 0;
884	}
885
886	P->ops.pop_read_aux(P, &P->auxv, &P->nauxv, P->data);
887}
888
889/*
890 * Return a requested element from the process's aux vector.
891 * Return -1 on failure (this is adequate for our purposes).
892 */
893long
894Pgetauxval(struct ps_prochandle *P, int type)
895{
896	auxv_t *auxv;
897
898	if (P->auxv == NULL)
899		Preadauxvec(P);
900
901	if (P->auxv == NULL)
902		return (-1);
903
904	for (auxv = P->auxv; auxv->a_type != AT_NULL; auxv++) {
905		if (auxv->a_type == type)
906			return (auxv->a_un.a_val);
907	}
908
909	return (-1);
910}
911
912/*
913 * Return a pointer to our internal copy of the process's aux vector.
914 * The caller should not hold on to this pointer across any libproc calls.
915 */
916const auxv_t *
917Pgetauxvec(struct ps_prochandle *P)
918{
919	static const auxv_t empty = { AT_NULL, 0L };
920
921	if (P->auxv == NULL)
922		Preadauxvec(P);
923
924	if (P->auxv == NULL)
925		return (&empty);
926
927	return (P->auxv);
928}
929
930/*
931 * Return 1 if the given mapping corresponds to the given file_info_t's
932 * load object; return 0 otherwise.
933 */
934static int
935is_mapping_in_file(struct ps_prochandle *P, map_info_t *mptr, file_info_t *fptr)
936{
937	prmap_t *pmap = &mptr->map_pmap;
938	rd_loadobj_t *lop = fptr->file_lo;
939	uint_t i;
940	uintptr_t mstart, mend, sstart, send;
941
942	/*
943	 * We can get for free the start address of the text and data
944	 * sections of the load object. Start by seeing if the mapping
945	 * encloses either of these.
946	 */
947	if ((pmap->pr_vaddr <= lop->rl_base &&
948	    lop->rl_base < pmap->pr_vaddr + pmap->pr_size) ||
949	    (pmap->pr_vaddr <= lop->rl_data_base &&
950	    lop->rl_data_base < pmap->pr_vaddr + pmap->pr_size))
951		return (1);
952
953	/*
954	 * It's still possible that this mapping correponds to the load
955	 * object. Consider the example of a mapping whose start and end
956	 * addresses correspond to those of the load object's text section.
957	 * If the mapping splits, e.g. as a result of a segment demotion,
958	 * then although both mappings are still backed by the same section,
959	 * only one will be seen to enclose that section's start address.
960	 * Thus, to be rigorous, we ask not whether this mapping encloses
961	 * the start of a section, but whether there exists a section that
962	 * overlaps this mapping.
963	 *
964	 * If we don't already have the section addresses, and we successfully
965	 * get them, then we cache them in case we come here again.
966	 */
967	if (fptr->file_saddrs == NULL &&
968	    (fptr->file_saddrs = get_saddrs(P,
969	    fptr->file_map->map_pmap.pr_vaddr, &fptr->file_nsaddrs)) == NULL)
970		return (0);
971
972	mstart = mptr->map_pmap.pr_vaddr;
973	mend = mptr->map_pmap.pr_vaddr + mptr->map_pmap.pr_size;
974	for (i = 0; i < fptr->file_nsaddrs; i += 2) {
975		/* Does this section overlap the mapping? */
976		sstart = fptr->file_saddrs[i];
977		send = fptr->file_saddrs[i + 1];
978		if (!(mend <= sstart || mstart >= send))
979			return (1);
980	}
981
982	return (0);
983}
984
985/*
986 * Find or build the symbol table for the given mapping.
987 */
988static file_info_t *
989build_map_symtab(struct ps_prochandle *P, map_info_t *mptr)
990{
991	prmap_t *pmap = &mptr->map_pmap;
992	file_info_t *fptr;
993	uint_t i;
994
995	if ((fptr = mptr->map_file) != NULL) {
996		Pbuild_file_symtab(P, fptr);
997		return (fptr);
998	}
999
1000	if (pmap->pr_mapname[0] == '\0')
1001		return (NULL);
1002
1003	/*
1004	 * Attempt to find a matching file.
1005	 * (A file can be mapped at several different addresses.)
1006	 */
1007	for (i = 0, fptr = list_next(&P->file_head); i < P->num_files;
1008	    i++, fptr = list_next(fptr)) {
1009		if (strcmp(fptr->file_pname, pmap->pr_mapname) == 0 &&
1010		    fptr->file_lo && is_mapping_in_file(P, mptr, fptr)) {
1011			mptr->map_file = fptr;
1012			fptr->file_ref++;
1013			Pbuild_file_symtab(P, fptr);
1014			return (fptr);
1015		}
1016	}
1017
1018	/*
1019	 * If we need to create a new file_info structure, iterate
1020	 * through the load objects in order to attempt to connect
1021	 * this new file with its primary text mapping.  We again
1022	 * need to handle ld.so as a special case because we need
1023	 * to be able to bootstrap librtld_db.
1024	 */
1025	if ((fptr = file_info_new(P, mptr)) == NULL)
1026		return (NULL);
1027
1028	if (P->map_ldso != mptr) {
1029		if (P->rap != NULL)
1030			(void) rd_loadobj_iter(P->rap, map_iter, P);
1031		else
1032			(void) Prd_agent(P);
1033	} else {
1034		fptr->file_map = mptr;
1035	}
1036
1037	/*
1038	 * If librtld_db wasn't able to help us connect the file to a primary
1039	 * text mapping, set file_map to the current mapping because we require
1040	 * fptr->file_map to be set in Pbuild_file_symtab.  librtld_db may be
1041	 * unaware of what's going on in the rare case that a legitimate ELF
1042	 * file has been mmap(2)ed into the process address space *without*
1043	 * the use of dlopen(3x).
1044	 */
1045	if (fptr->file_map == NULL)
1046		fptr->file_map = mptr;
1047
1048	Pbuild_file_symtab(P, fptr);
1049
1050	return (fptr);
1051}
1052
1053static int
1054read_ehdr32(struct ps_prochandle *P, Elf32_Ehdr *ehdr, uint_t *phnum,
1055    uintptr_t addr)
1056{
1057	if (Pread(P, ehdr, sizeof (*ehdr), addr) != sizeof (*ehdr))
1058		return (-1);
1059
1060	if (ehdr->e_ident[EI_MAG0] != ELFMAG0 ||
1061	    ehdr->e_ident[EI_MAG1] != ELFMAG1 ||
1062	    ehdr->e_ident[EI_MAG2] != ELFMAG2 ||
1063	    ehdr->e_ident[EI_MAG3] != ELFMAG3 ||
1064	    ehdr->e_ident[EI_CLASS] != ELFCLASS32 ||
1065#ifdef _BIG_ENDIAN
1066	    ehdr->e_ident[EI_DATA] != ELFDATA2MSB ||
1067#else
1068	    ehdr->e_ident[EI_DATA] != ELFDATA2LSB ||
1069#endif
1070	    ehdr->e_ident[EI_VERSION] != EV_CURRENT)
1071		return (-1);
1072
1073	if ((*phnum = ehdr->e_phnum) == PN_XNUM) {
1074		Elf32_Shdr shdr0;
1075
1076		if (ehdr->e_shoff == 0 || ehdr->e_shentsize < sizeof (shdr0) ||
1077		    Pread(P, &shdr0, sizeof (shdr0), addr + ehdr->e_shoff) !=
1078		    sizeof (shdr0))
1079			return (-1);
1080
1081		if (shdr0.sh_info != 0)
1082			*phnum = shdr0.sh_info;
1083	}
1084
1085	return (0);
1086}
1087
1088static int
1089read_dynamic_phdr32(struct ps_prochandle *P, const Elf32_Ehdr *ehdr,
1090    uint_t phnum, Elf32_Phdr *phdr, uintptr_t addr)
1091{
1092	uint_t i;
1093
1094	for (i = 0; i < phnum; i++) {
1095		uintptr_t a = addr + ehdr->e_phoff + i * ehdr->e_phentsize;
1096		if (Pread(P, phdr, sizeof (*phdr), a) != sizeof (*phdr))
1097			return (-1);
1098
1099		if (phdr->p_type == PT_DYNAMIC)
1100			return (0);
1101	}
1102
1103	return (-1);
1104}
1105
1106#ifdef _LP64
1107static int
1108read_ehdr64(struct ps_prochandle *P, Elf64_Ehdr *ehdr, uint_t *phnum,
1109    uintptr_t addr)
1110{
1111	if (Pread(P, ehdr, sizeof (Elf64_Ehdr), addr) != sizeof (Elf64_Ehdr))
1112		return (-1);
1113
1114	if (ehdr->e_ident[EI_MAG0] != ELFMAG0 ||
1115	    ehdr->e_ident[EI_MAG1] != ELFMAG1 ||
1116	    ehdr->e_ident[EI_MAG2] != ELFMAG2 ||
1117	    ehdr->e_ident[EI_MAG3] != ELFMAG3 ||
1118	    ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
1119#ifdef _BIG_ENDIAN
1120	    ehdr->e_ident[EI_DATA] != ELFDATA2MSB ||
1121#else
1122	    ehdr->e_ident[EI_DATA] != ELFDATA2LSB ||
1123#endif
1124	    ehdr->e_ident[EI_VERSION] != EV_CURRENT)
1125		return (-1);
1126
1127	if ((*phnum = ehdr->e_phnum) == PN_XNUM) {
1128		Elf64_Shdr shdr0;
1129
1130		if (ehdr->e_shoff == 0 || ehdr->e_shentsize < sizeof (shdr0) ||
1131		    Pread(P, &shdr0, sizeof (shdr0), addr + ehdr->e_shoff) !=
1132		    sizeof (shdr0))
1133			return (-1);
1134
1135		if (shdr0.sh_info != 0)
1136			*phnum = shdr0.sh_info;
1137	}
1138
1139	return (0);
1140}
1141
1142static int
1143read_dynamic_phdr64(struct ps_prochandle *P, const Elf64_Ehdr *ehdr,
1144    uint_t phnum, Elf64_Phdr *phdr, uintptr_t addr)
1145{
1146	uint_t i;
1147
1148	for (i = 0; i < phnum; i++) {
1149		uintptr_t a = addr + ehdr->e_phoff + i * ehdr->e_phentsize;
1150		if (Pread(P, phdr, sizeof (*phdr), a) != sizeof (*phdr))
1151			return (-1);
1152
1153		if (phdr->p_type == PT_DYNAMIC)
1154			return (0);
1155	}
1156
1157	return (-1);
1158}
1159#endif	/* _LP64 */
1160
1161/*
1162 * The text segment for each load object contains the elf header and
1163 * program headers. We can use this information to determine if the
1164 * file that corresponds to the load object is the same file that
1165 * was loaded into the process's address space. There can be a discrepency
1166 * if a file is recompiled after the process is started or if the target
1167 * represents a core file from a differently configured system -- two
1168 * common examples. The DT_CHECKSUM entry in the dynamic section
1169 * provides an easy method of comparison. It is important to note that
1170 * the dynamic section usually lives in the data segment, but the meta
1171 * data we use to find the dynamic section lives in the text segment so
1172 * if either of those segments is absent we can't proceed.
1173 *
1174 * We're looking through the elf file for several items: the symbol tables
1175 * (both dynsym and symtab), the procedure linkage table (PLT) base,
1176 * size, and relocation base, and the CTF information. Most of this can
1177 * be recovered from the loaded image of the file itself, the exceptions
1178 * being the symtab and CTF data.
1179 *
1180 * First we try to open the file that we think corresponds to the load
1181 * object, if the DT_CHECKSUM values match, we're all set, and can simply
1182 * recover all the information we need from the file. If the values of
1183 * DT_CHECKSUM don't match, or if we can't access the file for whatever
1184 * reasaon, we fake up a elf file to use in its stead. If we can't read
1185 * the elf data in the process's address space, we fall back to using
1186 * the file even though it may give inaccurate information.
1187 *
1188 * The elf file that we fake up has to consist of sections for the
1189 * dynsym, the PLT and the dynamic section. Note that in the case of a
1190 * core file, we'll get the CTF data in the file_info_t later on from
1191 * a section embedded the core file (if it's present).
1192 *
1193 * file_differs() conservatively looks for mismatched files, identifying
1194 * a match when there is any ambiguity (since that's the legacy behavior).
1195 */
1196static int
1197file_differs(struct ps_prochandle *P, Elf *elf, file_info_t *fptr)
1198{
1199	Elf_Scn *scn;
1200	GElf_Shdr shdr;
1201	GElf_Dyn dyn;
1202	Elf_Data *data;
1203	uint_t i, ndyn;
1204	GElf_Xword cksum;
1205	uintptr_t addr;
1206
1207	if (fptr->file_map == NULL)
1208		return (0);
1209
1210	if ((Pcontent(P) & (CC_CONTENT_TEXT | CC_CONTENT_DATA)) !=
1211	    (CC_CONTENT_TEXT | CC_CONTENT_DATA))
1212		return (0);
1213
1214	/*
1215	 * First, we find the checksum value in the elf file.
1216	 */
1217	scn = NULL;
1218	while ((scn = elf_nextscn(elf, scn)) != NULL) {
1219		if (gelf_getshdr(scn, &shdr) != NULL &&
1220		    shdr.sh_type == SHT_DYNAMIC)
1221			goto found_shdr;
1222	}
1223	return (0);
1224
1225found_shdr:
1226	if ((data = elf_getdata(scn, NULL)) == NULL)
1227		return (0);
1228
1229	if (P->status.pr_dmodel == PR_MODEL_ILP32)
1230		ndyn = shdr.sh_size / sizeof (Elf32_Dyn);
1231#ifdef _LP64
1232	else if (P->status.pr_dmodel == PR_MODEL_LP64)
1233		ndyn = shdr.sh_size / sizeof (Elf64_Dyn);
1234#endif
1235	else
1236		return (0);
1237
1238	for (i = 0; i < ndyn; i++) {
1239		if (gelf_getdyn(data, i, &dyn) != NULL &&
1240		    dyn.d_tag == DT_CHECKSUM)
1241			goto found_cksum;
1242	}
1243
1244	/*
1245	 * The in-memory ELF has no DT_CHECKSUM section, but we will report it
1246	 * as matching the file anyhow.
1247	 */
1248	return (0);
1249
1250found_cksum:
1251	cksum = dyn.d_un.d_val;
1252	dprintf("elf cksum value is %llx\n", (u_longlong_t)cksum);
1253
1254	/*
1255	 * Get the base of the text mapping that corresponds to this file.
1256	 */
1257	addr = fptr->file_map->map_pmap.pr_vaddr;
1258
1259	if (P->status.pr_dmodel == PR_MODEL_ILP32) {
1260		Elf32_Ehdr ehdr;
1261		Elf32_Phdr phdr;
1262		Elf32_Dyn dync, *dynp;
1263		uint_t phnum, i;
1264
1265		if (read_ehdr32(P, &ehdr, &phnum, addr) != 0 ||
1266		    read_dynamic_phdr32(P, &ehdr, phnum, &phdr, addr) != 0)
1267			return (0);
1268
1269		if (ehdr.e_type == ET_DYN)
1270			phdr.p_vaddr += addr;
1271		if ((dynp = malloc(phdr.p_filesz)) == NULL)
1272			return (0);
1273		dync.d_tag = DT_NULL;
1274		if (Pread(P, dynp, phdr.p_filesz, phdr.p_vaddr) !=
1275		    phdr.p_filesz) {
1276			free(dynp);
1277			return (0);
1278		}
1279
1280		for (i = 0; i < phdr.p_filesz / sizeof (Elf32_Dyn); i++) {
1281			if (dynp[i].d_tag == DT_CHECKSUM)
1282				dync = dynp[i];
1283		}
1284
1285		free(dynp);
1286
1287		if (dync.d_tag != DT_CHECKSUM)
1288			return (0);
1289
1290		dprintf("image cksum value is %llx\n",
1291		    (u_longlong_t)dync.d_un.d_val);
1292		return (dync.d_un.d_val != cksum);
1293#ifdef _LP64
1294	} else if (P->status.pr_dmodel == PR_MODEL_LP64) {
1295		Elf64_Ehdr ehdr;
1296		Elf64_Phdr phdr;
1297		Elf64_Dyn dync, *dynp;
1298		uint_t phnum, i;
1299
1300		if (read_ehdr64(P, &ehdr, &phnum, addr) != 0 ||
1301		    read_dynamic_phdr64(P, &ehdr, phnum, &phdr, addr) != 0)
1302			return (0);
1303
1304		if (ehdr.e_type == ET_DYN)
1305			phdr.p_vaddr += addr;
1306		if ((dynp = malloc(phdr.p_filesz)) == NULL)
1307			return (0);
1308		dync.d_tag = DT_NULL;
1309		if (Pread(P, dynp, phdr.p_filesz, phdr.p_vaddr) !=
1310		    phdr.p_filesz) {
1311			free(dynp);
1312			return (0);
1313		}
1314
1315		for (i = 0; i < phdr.p_filesz / sizeof (Elf64_Dyn); i++) {
1316			if (dynp[i].d_tag == DT_CHECKSUM)
1317				dync = dynp[i];
1318		}
1319
1320		free(dynp);
1321
1322		if (dync.d_tag != DT_CHECKSUM)
1323			return (0);
1324
1325		dprintf("image cksum value is %llx\n",
1326		    (u_longlong_t)dync.d_un.d_val);
1327		return (dync.d_un.d_val != cksum);
1328#endif	/* _LP64 */
1329	}
1330
1331	return (0);
1332}
1333
1334/*
1335 * Read data from the specified process and construct an in memory
1336 * image of an ELF file that represents it well enough to let
1337 * us probe it for information.
1338 */
1339static Elf *
1340fake_elf(struct ps_prochandle *P, file_info_t *fptr)
1341{
1342	Elf *elf;
1343	uintptr_t addr;
1344	uint_t phnum;
1345
1346	if (fptr->file_map == NULL)
1347		return (NULL);
1348
1349	if ((Pcontent(P) & (CC_CONTENT_TEXT | CC_CONTENT_DATA)) !=
1350	    (CC_CONTENT_TEXT | CC_CONTENT_DATA))
1351		return (NULL);
1352
1353	addr = fptr->file_map->map_pmap.pr_vaddr;
1354
1355	if (P->status.pr_dmodel == PR_MODEL_ILP32) {
1356		Elf32_Ehdr ehdr;
1357		Elf32_Phdr phdr;
1358
1359		if ((read_ehdr32(P, &ehdr, &phnum, addr) != 0) ||
1360		    read_dynamic_phdr32(P, &ehdr, phnum, &phdr, addr) != 0)
1361			return (NULL);
1362
1363		elf = fake_elf32(P, fptr, addr, &ehdr, phnum, &phdr);
1364#ifdef _LP64
1365	} else {
1366		Elf64_Ehdr ehdr;
1367		Elf64_Phdr phdr;
1368
1369		if (read_ehdr64(P, &ehdr, &phnum, addr) != 0 ||
1370		    read_dynamic_phdr64(P, &ehdr, phnum, &phdr, addr) != 0)
1371			return (NULL);
1372
1373		elf = fake_elf64(P, fptr, addr, &ehdr, phnum, &phdr);
1374#endif
1375	}
1376
1377	return (elf);
1378}
1379
1380/*
1381 * We wouldn't need these if qsort(3C) took an argument for the callback...
1382 */
1383static mutex_t sort_mtx = DEFAULTMUTEX;
1384static char *sort_strs;
1385static GElf_Sym *sort_syms;
1386
1387int
1388byaddr_cmp_common(GElf_Sym *a, char *aname, GElf_Sym *b, char *bname)
1389{
1390	if (a->st_value < b->st_value)
1391		return (-1);
1392	if (a->st_value > b->st_value)
1393		return (1);
1394
1395	/*
1396	 * Prefer the function to the non-function.
1397	 */
1398	if (GELF_ST_TYPE(a->st_info) != GELF_ST_TYPE(b->st_info)) {
1399		if (GELF_ST_TYPE(a->st_info) == STT_FUNC)
1400			return (-1);
1401		if (GELF_ST_TYPE(b->st_info) == STT_FUNC)
1402			return (1);
1403	}
1404
1405	/*
1406	 * Prefer the weak or strong global symbol to the local symbol.
1407	 */
1408	if (GELF_ST_BIND(a->st_info) != GELF_ST_BIND(b->st_info)) {
1409		if (GELF_ST_BIND(b->st_info) == STB_LOCAL)
1410			return (-1);
1411		if (GELF_ST_BIND(a->st_info) == STB_LOCAL)
1412			return (1);
1413	}
1414
1415	/*
1416	 * Prefer the symbol that doesn't begin with a '$' since compilers and
1417	 * other symbol generators often use it as a prefix.
1418	 */
1419	if (*bname == '$')
1420		return (-1);
1421	if (*aname == '$')
1422		return (1);
1423
1424	/*
1425	 * Prefer the name with fewer leading underscores in the name.
1426	 */
1427	while (*aname == '_' && *bname == '_') {
1428		aname++;
1429		bname++;
1430	}
1431
1432	if (*bname == '_')
1433		return (-1);
1434	if (*aname == '_')
1435		return (1);
1436
1437	/*
1438	 * Prefer the symbol with the smaller size.
1439	 */
1440	if (a->st_size < b->st_size)
1441		return (-1);
1442	if (a->st_size > b->st_size)
1443		return (1);
1444
1445	/*
1446	 * All other factors being equal, fall back to lexicographic order.
1447	 */
1448	return (strcmp(aname, bname));
1449}
1450
1451static int
1452byaddr_cmp(const void *aa, const void *bb)
1453{
1454	GElf_Sym *a = &sort_syms[*(uint_t *)aa];
1455	GElf_Sym *b = &sort_syms[*(uint_t *)bb];
1456	char *aname = sort_strs + a->st_name;
1457	char *bname = sort_strs + b->st_name;
1458
1459	return (byaddr_cmp_common(a, aname, b, bname));
1460}
1461
1462static int
1463byname_cmp(const void *aa, const void *bb)
1464{
1465	GElf_Sym *a = &sort_syms[*(uint_t *)aa];
1466	GElf_Sym *b = &sort_syms[*(uint_t *)bb];
1467	char *aname = sort_strs + a->st_name;
1468	char *bname = sort_strs + b->st_name;
1469
1470	return (strcmp(aname, bname));
1471}
1472
1473/*
1474 * Given a symbol index, look up the corresponding symbol from the
1475 * given symbol table.
1476 *
1477 * This function allows the caller to treat the symbol table as a single
1478 * logical entity even though there may be 2 actual ELF symbol tables
1479 * involved. See the comments in Pcontrol.h for details.
1480 */
1481static GElf_Sym *
1482symtab_getsym(sym_tbl_t *symtab, int ndx, GElf_Sym *dst)
1483{
1484	/* If index is in range of primary symtab, look it up there */
1485	if (ndx >= symtab->sym_symn_aux) {
1486		return (gelf_getsym(symtab->sym_data_pri,
1487		    ndx - symtab->sym_symn_aux, dst));
1488	}
1489
1490	/* Not in primary: Look it up in the auxiliary symtab */
1491	return (gelf_getsym(symtab->sym_data_aux, ndx, dst));
1492}
1493
1494void
1495optimize_symtab(sym_tbl_t *symtab)
1496{
1497	GElf_Sym *symp, *syms;
1498	uint_t i, *indexa, *indexb;
1499	size_t symn, strsz, count;
1500
1501	if (symtab == NULL || symtab->sym_data_pri == NULL ||
1502	    symtab->sym_byaddr != NULL)
1503		return;
1504
1505	symn = symtab->sym_symn;
1506	strsz = symtab->sym_strsz;
1507
1508	symp = syms = malloc(sizeof (GElf_Sym) * symn);
1509	if (symp == NULL) {
1510		dprintf("optimize_symtab: failed to malloc symbol array");
1511		return;
1512	}
1513
1514	/*
1515	 * First record all the symbols into a table and count up the ones
1516	 * that we're interested in. We mark symbols as invalid by setting
1517	 * the st_name to an illegal value.
1518	 */
1519	for (i = 0, count = 0; i < symn; i++, symp++) {
1520		if (symtab_getsym(symtab, i, symp) != NULL &&
1521		    symp->st_name < strsz &&
1522		    IS_DATA_TYPE(GELF_ST_TYPE(symp->st_info)))
1523			count++;
1524		else
1525			symp->st_name = strsz;
1526	}
1527
1528	/*
1529	 * Allocate sufficient space for both tables and populate them
1530	 * with the same symbols we just counted.
1531	 */
1532	symtab->sym_count = count;
1533	indexa = symtab->sym_byaddr = calloc(sizeof (uint_t), count);
1534	indexb = symtab->sym_byname = calloc(sizeof (uint_t), count);
1535	if (indexa == NULL || indexb == NULL) {
1536		dprintf(
1537		    "optimize_symtab: failed to malloc symbol index arrays");
1538		symtab->sym_count = 0;
1539		if (indexa != NULL) {	/* First alloc succeeded. Free it */
1540			free(indexa);
1541			symtab->sym_byaddr = NULL;
1542		}
1543		free(syms);
1544		return;
1545	}
1546	for (i = 0, symp = syms; i < symn; i++, symp++) {
1547		if (symp->st_name < strsz)
1548			*indexa++ = *indexb++ = i;
1549	}
1550
1551	/*
1552	 * Sort the two tables according to the appropriate criteria,
1553	 * unless the user has overridden this behaviour.
1554	 *
1555	 * An example where we might not sort the tables is the relatively
1556	 * unusual case of a process with very large symbol tables in which
1557	 * we perform few lookups. In such a case the total time would be
1558	 * dominated by the sort. It is difficult to determine a priori
1559	 * how many lookups an arbitrary client will perform, and
1560	 * hence whether the symbol tables should be sorted. We therefore
1561	 * sort the tables by default, but provide the user with a
1562	 * "chicken switch" in the form of the LIBPROC_NO_QSORT
1563	 * environment variable.
1564	 */
1565	if (!_libproc_no_qsort) {
1566		(void) mutex_lock(&sort_mtx);
1567		sort_strs = symtab->sym_strs;
1568		sort_syms = syms;
1569
1570		qsort(symtab->sym_byaddr, count, sizeof (uint_t), byaddr_cmp);
1571		qsort(symtab->sym_byname, count, sizeof (uint_t), byname_cmp);
1572
1573		sort_strs = NULL;
1574		sort_syms = NULL;
1575		(void) mutex_unlock(&sort_mtx);
1576	}
1577
1578	free(syms);
1579}
1580
1581
1582static Elf *
1583build_fake_elf(struct ps_prochandle *P, file_info_t *fptr, GElf_Ehdr *ehdr,
1584    size_t *nshdrs, Elf_Data **shdata)
1585{
1586	size_t shstrndx;
1587	Elf_Scn *scn;
1588	Elf *elf;
1589
1590	if ((elf = fake_elf(P, fptr)) == NULL ||
1591	    elf_kind(elf) != ELF_K_ELF ||
1592	    gelf_getehdr(elf, ehdr) == NULL ||
1593	    elf_getshdrnum(elf, nshdrs) == -1 ||
1594	    elf_getshdrstrndx(elf, &shstrndx) == -1 ||
1595	    (scn = elf_getscn(elf, shstrndx)) == NULL ||
1596	    (*shdata = elf_getdata(scn, NULL)) == NULL) {
1597		if (elf != NULL)
1598			(void) elf_end(elf);
1599		dprintf("failed to fake up ELF file\n");
1600		return (NULL);
1601	}
1602
1603	return (elf);
1604}
1605
1606/*
1607 * Try and find the file described by path in the file system and validate that
1608 * it matches our CRC before we try and process it for symbol information. If we
1609 * instead have an ELF data section, then that means we're checking a build-id
1610 * section instead. In that case we just need to find and bcmp the corresponding
1611 * section.
1612 *
1613 * Before we validate if it's a valid CRC or data section, we check to ensure
1614 * that it's a normal file and not anything else.
1615 */
1616static boolean_t
1617build_alt_debug(file_info_t *fptr, const char *path, uint32_t crc,
1618    Elf_Data *data)
1619{
1620	int fd;
1621	struct stat st;
1622	Elf *elf;
1623	Elf_Scn *scn;
1624	GElf_Shdr symshdr, strshdr;
1625	Elf_Data *symdata, *strdata;
1626	boolean_t valid;
1627	uint32_t c = -1U;
1628
1629	if ((fd = open(path, O_RDONLY)) < 0)
1630		return (B_FALSE);
1631
1632	if (fstat(fd, &st) != 0) {
1633		(void) close(fd);
1634		return (B_FALSE);
1635	}
1636
1637	if (S_ISREG(st.st_mode) == 0) {
1638		(void) close(fd);
1639		return (B_FALSE);
1640	}
1641
1642	/*
1643	 * Only check the CRC if we've come here through a GNU debug link
1644	 * section as opposed to the build id. This is indicated by having the
1645	 * value of data be NULL.
1646	 */
1647	if (data == NULL) {
1648		for (;;) {
1649			char buf[4096];
1650			ssize_t ret = read(fd, buf, sizeof (buf));
1651			if (ret == -1) {
1652				if (ret == EINTR)
1653					continue;
1654				(void) close(fd);
1655				return (B_FALSE);
1656			}
1657			if (ret == 0) {
1658				c = ~c;
1659				if (c != crc) {
1660					dprintf("crc mismatch, found: 0x%x "
1661					    "expected 0x%x\n", c, crc);
1662					(void) close(fd);
1663					return (B_FALSE);
1664				}
1665				break;
1666			}
1667			CRC32(c, buf, ret, c, psym_crc32);
1668		}
1669	}
1670
1671	elf = elf_begin(fd, ELF_C_READ, NULL);
1672	if (elf == NULL) {
1673		(void) close(fd);
1674		return (B_FALSE);
1675	}
1676
1677	if (elf_kind(elf) != ELF_K_ELF) {
1678		goto fail;
1679	}
1680
1681	/*
1682	 * If we have a data section, that indicates we have a build-id which
1683	 * means we need to find the corresponding build-id section and compare
1684	 * it.
1685	 */
1686	scn = NULL;
1687	valid = B_FALSE;
1688	for (scn = elf_nextscn(elf, scn); data != NULL && scn != NULL;
1689	    scn = elf_nextscn(elf, scn)) {
1690		GElf_Shdr hdr;
1691		Elf_Data *ntdata;
1692
1693		if (gelf_getshdr(scn, &hdr) == NULL)
1694			goto fail;
1695
1696		if (hdr.sh_type != SHT_NOTE)
1697			continue;
1698
1699		if ((ntdata = elf_getdata(scn, NULL)) == NULL)
1700			goto fail;
1701
1702		/*
1703		 * First verify the data section sizes are equal, then the
1704		 * section name. If that's all true, then we can just do a bcmp.
1705		 */
1706		if (data->d_size != ntdata->d_size)
1707			continue;
1708
1709		dprintf("found corresponding section in alternate file\n");
1710		if (bcmp(ntdata->d_buf, data->d_buf, data->d_size) != 0)
1711			goto fail;
1712
1713		valid = B_TRUE;
1714		break;
1715	}
1716	if (data != NULL && valid == B_FALSE) {
1717		dprintf("failed to find a matching %s section in %s\n",
1718		    BUILDID_NAME, path);
1719		goto fail;
1720	}
1721
1722
1723	/*
1724	 * Do two passes, first see if we have a symbol header, then see if we
1725	 * can find the corresponding linked string table.
1726	 */
1727	scn = NULL;
1728	for (scn = elf_nextscn(elf, scn); scn != NULL;
1729	    scn = elf_nextscn(elf, scn)) {
1730
1731		if (gelf_getshdr(scn, &symshdr) == NULL)
1732			goto fail;
1733
1734		if (symshdr.sh_type != SHT_SYMTAB)
1735			continue;
1736
1737		if ((symdata = elf_getdata(scn, NULL)) == NULL)
1738			goto fail;
1739
1740		break;
1741	}
1742	if (scn == NULL)
1743		goto fail;
1744
1745	if ((scn = elf_getscn(elf, symshdr.sh_link)) == NULL)
1746		goto fail;
1747
1748	if (gelf_getshdr(scn, &strshdr) == NULL)
1749		goto fail;
1750
1751	if ((strdata = elf_getdata(scn, NULL)) == NULL)
1752		goto fail;
1753
1754	fptr->file_symtab.sym_data_pri = symdata;
1755	fptr->file_symtab.sym_symn += symshdr.sh_size / symshdr.sh_entsize;
1756	fptr->file_symtab.sym_strs = strdata->d_buf;
1757	fptr->file_symtab.sym_strsz = strdata->d_size;
1758	fptr->file_symtab.sym_hdr_pri = symshdr;
1759	fptr->file_symtab.sym_strhdr = strshdr;
1760
1761	dprintf("successfully loaded additional debug symbols for %s from %s\n",
1762	    fptr->file_rname, path);
1763
1764	fptr->file_dbgfile = fd;
1765	fptr->file_dbgelf = elf;
1766	return (B_TRUE);
1767fail:
1768	(void) elf_end(elf);
1769	(void) close(fd);
1770	return (B_FALSE);
1771}
1772
1773/*
1774 * We're here because the object in question has no symbol information, that's a
1775 * bit unfortunate. However, we've found that there's a .gnu_debuglink sitting
1776 * around. By convention that means that given the current location of the
1777 * object on disk, and the debug name that we found in the binary we need to
1778 * search the following locations for a matching file.
1779 *
1780 * <dirname>/.debug/<debug-name>
1781 * /usr/lib/debug/<dirname>/<debug-name>
1782 *
1783 * In the future, we should consider supporting looking in the prefix's
1784 * lib/debug directory for a matching object or supporting an arbitrary user
1785 * defined set of places to look.
1786 */
1787static void
1788find_alt_debuglink(file_info_t *fptr, const char *name, uint32_t crc)
1789{
1790	boolean_t r;
1791	char *dup = NULL, *path = NULL, *dname;
1792
1793	dprintf("find_alt_debug: looking for %s, crc 0x%x\n", name, crc);
1794	if (fptr->file_rname == NULL) {
1795		dprintf("find_alt_debug: encountered null file_rname\n");
1796		return;
1797	}
1798
1799	dup = strdup(fptr->file_rname);
1800	if (dup == NULL)
1801		return;
1802
1803	dname = dirname(dup);
1804	if (asprintf(&path, "%s/.debug/%s", dname, name) != -1) {
1805		dprintf("attempting to load alternate debug information "
1806		    "from %s\n", path);
1807		r = build_alt_debug(fptr, path, crc, NULL);
1808		free(path);
1809		if (r == B_TRUE)
1810			goto out;
1811	}
1812
1813	if (asprintf(&path, "/usr/lib/debug/%s/%s", dname, name) != -1) {
1814		dprintf("attempting to load alternate debug information "
1815		    "from %s\n", path);
1816		r = build_alt_debug(fptr, path, crc, NULL);
1817		free(path);
1818		if (r == B_TRUE)
1819			goto out;
1820	}
1821out:
1822	free(dup);
1823}
1824
1825/*
1826 * Build the symbol table for the given mapped file.
1827 */
1828void
1829Pbuild_file_symtab(struct ps_prochandle *P, file_info_t *fptr)
1830{
1831	char objectfile[PATH_MAX];
1832	uint_t i;
1833
1834	GElf_Ehdr ehdr;
1835	GElf_Sym s;
1836
1837	Elf_Data *shdata;
1838	Elf_Scn *scn;
1839	Elf *elf;
1840	size_t nshdrs, shstrndx;
1841
1842	struct {
1843		GElf_Shdr c_shdr;
1844		Elf_Data *c_data;
1845		const char *c_name;
1846	} *cp, *cache = NULL, *dyn = NULL, *plt = NULL, *ctf = NULL,
1847	*dbglink = NULL, *buildid = NULL;
1848
1849	if (fptr->file_init)
1850		return;	/* We've already processed this file */
1851
1852	/*
1853	 * Mark the file_info struct as having the symbol table initialized
1854	 * even if we fail below.  We tried once; we don't try again.
1855	 */
1856	fptr->file_init = 1;
1857
1858	if (elf_version(EV_CURRENT) == EV_NONE) {
1859		dprintf("libproc ELF version is more recent than libelf\n");
1860		return;
1861	}
1862
1863	if (P->state == PS_DEAD || P->state == PS_IDLE) {
1864		char *name;
1865		/*
1866		 * If we're a not live, we can't open files from the /proc
1867		 * object directory; we have only the mapping and file names
1868		 * to guide us.  We prefer the file_lname, but need to handle
1869		 * the case of it being NULL in order to bootstrap: we first
1870		 * come here during rd_new() when the only information we have
1871		 * is interpreter name associated with the AT_BASE mapping.
1872		 *
1873		 * Also, if the zone associated with the core file seems
1874		 * to exists on this machine we'll try to open the object
1875		 * file within the zone.
1876		 */
1877		if (fptr->file_rname != NULL)
1878			name = fptr->file_rname;
1879		else if (fptr->file_lname != NULL)
1880			name = fptr->file_lname;
1881		else
1882			name = fptr->file_pname;
1883		(void) strlcpy(objectfile, name, sizeof (objectfile));
1884	} else {
1885		(void) snprintf(objectfile, sizeof (objectfile),
1886		    "%s/%d/object/%s",
1887		    procfs_path, (int)P->pid, fptr->file_pname);
1888	}
1889
1890	/*
1891	 * Open the object file, create the elf file, and then get the elf
1892	 * header and .shstrtab data buffer so we can process sections by
1893	 * name. If anything goes wrong try to fake up an elf file from
1894	 * the in-core elf image.
1895	 */
1896
1897	if (_libproc_incore_elf || (P->flags & INCORE)) {
1898		dprintf("Pbuild_file_symtab: using in-core data for: %s\n",
1899		    fptr->file_pname);
1900
1901		if ((elf = build_fake_elf(P, fptr, &ehdr, &nshdrs, &shdata)) ==
1902		    NULL)
1903			return;
1904
1905	} else if ((fptr->file_fd = open(objectfile, O_RDONLY)) < 0) {
1906		dprintf("Pbuild_file_symtab: failed to open %s: %s\n",
1907		    objectfile, strerror(errno));
1908
1909		if ((elf = build_fake_elf(P, fptr, &ehdr, &nshdrs, &shdata)) ==
1910		    NULL)
1911			return;
1912
1913	} else if ((elf = elf_begin(fptr->file_fd, ELF_C_READ, NULL)) == NULL ||
1914	    elf_kind(elf) != ELF_K_ELF ||
1915	    gelf_getehdr(elf, &ehdr) == NULL ||
1916	    elf_getshdrnum(elf, &nshdrs) == -1 ||
1917	    elf_getshdrstrndx(elf, &shstrndx) == -1 ||
1918	    (scn = elf_getscn(elf, shstrndx)) == NULL ||
1919	    (shdata = elf_getdata(scn, NULL)) == NULL) {
1920		int err = elf_errno();
1921
1922		dprintf("failed to process ELF file %s: %s\n",
1923		    objectfile, (err == 0) ? "<null>" : elf_errmsg(err));
1924		(void) elf_end(elf);
1925
1926		if ((elf = build_fake_elf(P, fptr, &ehdr, &nshdrs, &shdata)) ==
1927		    NULL)
1928			return;
1929
1930	} else if (file_differs(P, elf, fptr)) {
1931		Elf *newelf;
1932
1933		/*
1934		 * Before we get too excited about this elf file, we'll check
1935		 * its checksum value against the value we have in memory. If
1936		 * they don't agree, we try to fake up a new elf file and
1937		 * proceed with that instead.
1938		 */
1939		dprintf("ELF file %s (%lx) doesn't match in-core image\n",
1940		    fptr->file_pname,
1941		    (ulong_t)fptr->file_map->map_pmap.pr_vaddr);
1942
1943		if ((newelf = build_fake_elf(P, fptr, &ehdr, &nshdrs, &shdata))
1944		    != NULL) {
1945			(void) elf_end(elf);
1946			elf = newelf;
1947			dprintf("switched to faked up ELF file\n");
1948
1949			/*
1950			 * Check to see if the file that we just discovered
1951			 * to be an imposter matches the execname that was
1952			 * determined by Pfindexec().  If it does, we (clearly)
1953			 * don't have the right binary, and we zero out
1954			 * execname before anyone gets hurt.
1955			 */
1956			if (fptr->file_rname != NULL && P->execname != NULL &&
1957			    strcmp(fptr->file_rname, P->execname) == 0) {
1958				dprintf("file/in-core image mismatch was "
1959				    "on P->execname; discarding\n");
1960				free(P->execname);
1961				P->execname = NULL;
1962			}
1963		}
1964	}
1965
1966	if ((cache = malloc(nshdrs * sizeof (*cache))) == NULL) {
1967		dprintf("failed to malloc section cache for %s\n", objectfile);
1968		goto bad;
1969	}
1970
1971	dprintf("processing ELF file %s\n", objectfile);
1972	fptr->file_class = ehdr.e_ident[EI_CLASS];
1973	fptr->file_etype = ehdr.e_type;
1974	fptr->file_elf = elf;
1975	fptr->file_shstrs = shdata->d_buf;
1976	fptr->file_shstrsz = shdata->d_size;
1977
1978	/*
1979	 * Iterate through each section, caching its section header, data
1980	 * pointer, and name.  We use this for handling sh_link values below.
1981	 */
1982	for (cp = cache + 1, scn = NULL; scn = elf_nextscn(elf, scn); cp++) {
1983		if (gelf_getshdr(scn, &cp->c_shdr) == NULL) {
1984			dprintf("Pbuild_file_symtab: Failed to get section "
1985			    "header\n");
1986			goto bad; /* Failed to get section header */
1987		}
1988
1989		if ((cp->c_data = elf_getdata(scn, NULL)) == NULL) {
1990			dprintf("Pbuild_file_symtab: Failed to get section "
1991			    "data\n");
1992			goto bad; /* Failed to get section data */
1993		}
1994
1995		if (cp->c_shdr.sh_name >= shdata->d_size) {
1996			dprintf("Pbuild_file_symtab: corrupt section name");
1997			goto bad; /* Corrupt section name */
1998		}
1999
2000		cp->c_name = (const char *)shdata->d_buf + cp->c_shdr.sh_name;
2001	}
2002
2003	/*
2004	 * Now iterate through the section cache in order to locate info
2005	 * for the .symtab, .dynsym, .SUNW_ldynsym, .dynamic, .plt,
2006	 * and .SUNW_ctf sections:
2007	 */
2008	for (i = 1, cp = cache + 1; i < nshdrs; i++, cp++) {
2009		GElf_Shdr *shp = &cp->c_shdr;
2010
2011		if (shp->sh_type == SHT_SYMTAB || shp->sh_type == SHT_DYNSYM) {
2012			sym_tbl_t *symp = shp->sh_type == SHT_SYMTAB ?
2013			    &fptr->file_symtab : &fptr->file_dynsym;
2014			/*
2015			 * It's possible that the we already got the symbol
2016			 * table from the core file itself. Either the file
2017			 * differs in which case our faked up elf file will
2018			 * only contain the dynsym (not the symtab) or the
2019			 * file matches in which case we'll just be replacing
2020			 * the symbol table we pulled out of the core file
2021			 * with an equivalent one. In either case, this
2022			 * check isn't essential, but it's a good idea.
2023			 */
2024			if (symp->sym_data_pri == NULL) {
2025				dprintf("Symbol table found for %s\n",
2026				    objectfile);
2027				symp->sym_data_pri = cp->c_data;
2028				symp->sym_symn +=
2029				    shp->sh_size / shp->sh_entsize;
2030				symp->sym_strs =
2031				    cache[shp->sh_link].c_data->d_buf;
2032				symp->sym_strsz =
2033				    cache[shp->sh_link].c_data->d_size;
2034				symp->sym_hdr_pri = cp->c_shdr;
2035				symp->sym_strhdr = cache[shp->sh_link].c_shdr;
2036			} else {
2037				dprintf("Symbol table already there for %s\n",
2038				    objectfile);
2039			}
2040		} else if (shp->sh_type == SHT_SUNW_LDYNSYM) {
2041			/* .SUNW_ldynsym section is auxiliary to .dynsym */
2042			if (fptr->file_dynsym.sym_data_aux == NULL) {
2043				dprintf(".SUNW_ldynsym symbol table"
2044				    " found for %s\n", objectfile);
2045				fptr->file_dynsym.sym_data_aux = cp->c_data;
2046				fptr->file_dynsym.sym_symn_aux =
2047				    shp->sh_size / shp->sh_entsize;
2048				fptr->file_dynsym.sym_symn +=
2049				    fptr->file_dynsym.sym_symn_aux;
2050				fptr->file_dynsym.sym_hdr_aux = cp->c_shdr;
2051			} else {
2052				dprintf(".SUNW_ldynsym symbol table already"
2053				    " there for %s\n", objectfile);
2054			}
2055		} else if (shp->sh_type == SHT_DYNAMIC) {
2056			dyn = cp;
2057		} else if (strcmp(cp->c_name, ".plt") == 0) {
2058			plt = cp;
2059		} else if (strcmp(cp->c_name, ".SUNW_ctf") == 0) {
2060			/*
2061			 * Skip over bogus CTF sections so they don't come back
2062			 * to haunt us later.
2063			 */
2064			if (shp->sh_link == 0 ||
2065			    shp->sh_link >= nshdrs ||
2066			    (cache[shp->sh_link].c_shdr.sh_type != SHT_DYNSYM &&
2067			    cache[shp->sh_link].c_shdr.sh_type != SHT_SYMTAB)) {
2068				dprintf("Bad sh_link %d for "
2069				    "CTF\n", shp->sh_link);
2070				continue;
2071			}
2072			ctf = cp;
2073		} else if (strcmp(cp->c_name, BUILDID_NAME) == 0) {
2074			dprintf("Found a %s section for %s\n", BUILDID_NAME,
2075			    fptr->file_rname);
2076			/* The ElfXX_Nhdr is 32/64-bit neutral */
2077			if (cp->c_shdr.sh_type == SHT_NOTE &&
2078			    cp->c_data->d_buf != NULL &&
2079			    cp->c_data->d_size >= sizeof (Elf32_Nhdr)) {
2080				Elf32_Nhdr *hdr = cp->c_data->d_buf;
2081				if (hdr->n_type != 3)
2082					continue;
2083				if (hdr->n_namesz != 4)
2084					continue;
2085				if (hdr->n_descsz < MINBUILDID)
2086					continue;
2087				/* Set a reasonable upper bound */
2088				if (hdr->n_descsz > MAXBUILDID) {
2089					dprintf("Skipped %s as too large "
2090					    "(%ld)\n", BUILDID_NAME,
2091					    (unsigned long)hdr->n_descsz);
2092					continue;
2093				}
2094
2095				if (cp->c_data->d_size < sizeof (hdr) +
2096				    hdr->n_namesz + hdr->n_descsz)
2097					continue;
2098				buildid = cp;
2099			}
2100		} else if (strcmp(cp->c_name, DBGLINK_NAME) == 0) {
2101			dprintf("found %s section for %s\n", DBGLINK_NAME,
2102			    fptr->file_rname);
2103			/*
2104			 * Let's make sure of a few things before we do this.
2105			 */
2106			if (cp->c_shdr.sh_type == SHT_PROGBITS &&
2107			    cp->c_data->d_buf != NULL &&
2108			    cp->c_data->d_size) {
2109				dbglink = cp;
2110			}
2111		}
2112	}
2113
2114	/*
2115	 * If we haven't found any symbol table information and we have found
2116	 * either a .note.gnu.build-id or a .gnu_debuglink, it's time to try and
2117	 * figure out where we might find this. Originally, GNU used the
2118	 * .gnu_debuglink solely, but then they added a .note.gnu.build-id. The
2119	 * build-id is some size, usually 16 or 20 bytes, often a SHA1 sum of
2120	 * parts of the original file. This is maintained across all versions of
2121	 * the subsequent file.
2122	 *
2123	 * For the .note.gnu.build-id, we're going to check a few things before
2124	 * using it, first that the name is 4 bytes, and is GNU and that the
2125	 * type is 3, which they say is the build-id identifier.
2126	 *
2127	 * To verify that the elf data for the .gnu_debuglink seems somewhat
2128	 * sane, eg. the elf data should be a string, so we want to verify we
2129	 * have a null-terminator.
2130	 */
2131	if (fptr->file_symtab.sym_data_pri == NULL && buildid != NULL) {
2132		int i, bo;
2133		uint8_t *dp;
2134		char buf[BUILDID_STRLEN], *path;
2135		Elf32_Nhdr *hdr = buildid->c_data->d_buf;
2136
2137		/*
2138		 * This was checked for validity when assigning the buildid
2139		 * variable.
2140		 */
2141		bzero(buf, sizeof (buf));
2142		dp = (uint8_t *)((uintptr_t)hdr + sizeof (*hdr) +
2143		    hdr->n_namesz);
2144		for (i = 0, bo = 0; i < hdr->n_descsz; i++, bo += 2, dp++) {
2145			assert(sizeof (buf) - bo > 0);
2146
2147			/*
2148			 * Recall that the build-id is structured as a series of
2149			 * bytes. However, the first two characters are supposed
2150			 * to represent a directory. Hence, once we reach offset
2151			 * two, we insert a '/' character.
2152			 */
2153			if (bo == 2) {
2154				buf[bo] = '/';
2155				bo++;
2156			}
2157			(void) snprintf(buf + bo, sizeof (buf) - bo, "%2x",
2158			    *dp);
2159		}
2160
2161		if (asprintf(&path, "/usr/lib/debug/.build-id/%s.debug",
2162		    buf) != -1) {
2163			boolean_t r;
2164			dprintf("attempting to find build id alternate debug "
2165			    "file at %s\n", path);
2166			r = build_alt_debug(fptr, path, 0, buildid->c_data);
2167			dprintf("attempt %s\n", r == B_TRUE ?
2168			    "succeeded" : "failed");
2169			free(path);
2170		} else {
2171			dprintf("failed to construct build id path: %s\n",
2172			    strerror(errno));
2173		}
2174	}
2175
2176	if (fptr->file_symtab.sym_data_pri == NULL && dbglink != NULL) {
2177		char *c = dbglink->c_data->d_buf;
2178		size_t i;
2179		boolean_t found = B_FALSE;
2180		Elf_Data *ed = dbglink->c_data;
2181		uint32_t crc;
2182
2183		for (i = 0; i < ed->d_size; i++) {
2184			if (c[i] == '\0') {
2185				uintptr_t off;
2186				dprintf("got .gnu_debuglink terminator at "
2187				    "offset %lu\n", (unsigned long)i);
2188				/*
2189				 * After the null terminator, there should be
2190				 * padding, followed by a 4 byte CRC of the
2191				 * file. If we don't see this, we're going to
2192				 * assume this is bogus.
2193				 */
2194				if ((i % sizeof (uint32_t)) == 0) {
2195					i += 4;
2196				} else {
2197					i += sizeof (uint32_t) -
2198					    (i % sizeof (uint32_t));
2199				}
2200				if (i + sizeof (uint32_t) ==
2201				    dbglink->c_data->d_size) {
2202					found = B_TRUE;
2203					off = (uintptr_t)ed->d_buf + i;
2204					crc = *(uint32_t *)off;
2205				} else {
2206					dprintf(".gnu_debuglink size mismatch, "
2207					    "expected: %lu, found: %lu\n",
2208					    (unsigned long)i,
2209					    (unsigned long)ed->d_size);
2210				}
2211				break;
2212			}
2213		}
2214
2215		if (found == B_TRUE)
2216			find_alt_debuglink(fptr, dbglink->c_data->d_buf, crc);
2217	}
2218
2219	/*
2220	 * At this point, we've found all the symbol tables we're ever going
2221	 * to find: the ones in the loop above and possibly the symtab that
2222	 * was included in the core file. Before we perform any lookups, we
2223	 * create sorted versions to optimize for lookups.
2224	 */
2225	optimize_symtab(&fptr->file_symtab);
2226	optimize_symtab(&fptr->file_dynsym);
2227
2228	/*
2229	 * Fill in the base address of the text mapping for shared libraries.
2230	 * This allows us to translate symbols before librtld_db is ready.
2231	 */
2232	if (fptr->file_etype == ET_DYN) {
2233		fptr->file_dyn_base = fptr->file_map->map_pmap.pr_vaddr -
2234		    fptr->file_map->map_pmap.pr_offset;
2235		dprintf("setting file_dyn_base for %s to %lx\n",
2236		    objectfile, (long)fptr->file_dyn_base);
2237	}
2238
2239	/*
2240	 * Record the CTF section information in the file info structure.
2241	 */
2242	if (ctf != NULL) {
2243		fptr->file_ctf_off = ctf->c_shdr.sh_offset;
2244		fptr->file_ctf_size = ctf->c_shdr.sh_size;
2245		if (ctf->c_shdr.sh_link != 0 &&
2246		    cache[ctf->c_shdr.sh_link].c_shdr.sh_type == SHT_DYNSYM)
2247			fptr->file_ctf_dyn = 1;
2248	}
2249
2250	if (fptr->file_lo == NULL)
2251		goto done; /* Nothing else to do if no load object info */
2252
2253	/*
2254	 * If the object is a shared library and we have a different rl_base
2255	 * value, reset file_dyn_base according to librtld_db's information.
2256	 */
2257	if (fptr->file_etype == ET_DYN &&
2258	    fptr->file_lo->rl_base != fptr->file_dyn_base) {
2259		dprintf("resetting file_dyn_base for %s to %lx\n",
2260		    objectfile, (long)fptr->file_lo->rl_base);
2261		fptr->file_dyn_base = fptr->file_lo->rl_base;
2262	}
2263
2264	/*
2265	 * Fill in the PLT information for this file if a PLT symbol is found.
2266	 */
2267	if (sym_by_name(&fptr->file_dynsym, "_PROCEDURE_LINKAGE_TABLE_", &s,
2268	    NULL) != NULL) {
2269		fptr->file_plt_base = s.st_value + fptr->file_dyn_base;
2270		fptr->file_plt_size = (plt != NULL) ? plt->c_shdr.sh_size : 0;
2271
2272		/*
2273		 * Bring the load object up to date; it is the only way the
2274		 * user has to access the PLT data. The PLT information in the
2275		 * rd_loadobj_t is not set in the call to map_iter() (the
2276		 * callback for rd_loadobj_iter) where we set file_lo.
2277		 */
2278		fptr->file_lo->rl_plt_base = fptr->file_plt_base;
2279		fptr->file_lo->rl_plt_size = fptr->file_plt_size;
2280
2281		dprintf("PLT found at %p, size = %lu\n",
2282		    (void *)fptr->file_plt_base, (ulong_t)fptr->file_plt_size);
2283	}
2284
2285	/*
2286	 * Fill in the PLT information.
2287	 */
2288	if (dyn != NULL) {
2289		uintptr_t dynaddr = dyn->c_shdr.sh_addr + fptr->file_dyn_base;
2290		size_t ndyn = dyn->c_shdr.sh_size / dyn->c_shdr.sh_entsize;
2291		GElf_Dyn d;
2292
2293		for (i = 0; i < ndyn; i++) {
2294			if (gelf_getdyn(dyn->c_data, i, &d) == NULL)
2295				continue;
2296
2297			switch (d.d_tag) {
2298			case DT_JMPREL:
2299				dprintf("DT_JMPREL is %p\n",
2300				    (void *)(uintptr_t)d.d_un.d_ptr);
2301				fptr->file_jmp_rel =
2302				    d.d_un.d_ptr + fptr->file_dyn_base;
2303				break;
2304			case DT_STRTAB:
2305				dprintf("DT_STRTAB is %p\n",
2306				    (void *)(uintptr_t)d.d_un.d_ptr);
2307				break;
2308			case DT_PLTGOT:
2309				dprintf("DT_PLTGOT is %p\n",
2310				    (void *)(uintptr_t)d.d_un.d_ptr);
2311				break;
2312			case DT_SUNW_SYMTAB:
2313				dprintf("DT_SUNW_SYMTAB is %p\n",
2314				    (void *)(uintptr_t)d.d_un.d_ptr);
2315				break;
2316			case DT_SYMTAB:
2317				dprintf("DT_SYMTAB is %p\n",
2318				    (void *)(uintptr_t)d.d_un.d_ptr);
2319				break;
2320			case DT_HASH:
2321				dprintf("DT_HASH is %p\n",
2322				    (void *)(uintptr_t)d.d_un.d_ptr);
2323				break;
2324			}
2325		}
2326
2327		dprintf("_DYNAMIC found at %p, %lu entries, DT_JMPREL = %p\n",
2328		    (void *)dynaddr, (ulong_t)ndyn, (void *)fptr->file_jmp_rel);
2329	}
2330
2331done:
2332	free(cache);
2333	return;
2334
2335bad:
2336	if (cache != NULL)
2337		free(cache);
2338
2339	(void) elf_end(elf);
2340	fptr->file_elf = NULL;
2341	if (fptr->file_elfmem != NULL) {
2342		free(fptr->file_elfmem);
2343		fptr->file_elfmem = NULL;
2344	}
2345	(void) close(fptr->file_fd);
2346	if (fptr->file_dbgelf != NULL)
2347		(void) elf_end(fptr->file_dbgelf);
2348	fptr->file_dbgelf = NULL;
2349	if (fptr->file_dbgfile >= 0)
2350		(void) close(fptr->file_dbgfile);
2351	fptr->file_fd = -1;
2352	fptr->file_dbgfile = -1;
2353}
2354
2355/*
2356 * Given a process virtual address, return the map_info_t containing it.
2357 * If none found, return NULL.
2358 */
2359map_info_t *
2360Paddr2mptr(struct ps_prochandle *P, uintptr_t addr)
2361{
2362	int lo = 0;
2363	int hi = P->map_count - 1;
2364	int mid;
2365	map_info_t *mp;
2366
2367	while (lo <= hi) {
2368
2369		mid = (lo + hi) / 2;
2370		mp = &P->mappings[mid];
2371
2372		/* check that addr is in [vaddr, vaddr + size) */
2373		if ((addr - mp->map_pmap.pr_vaddr) < mp->map_pmap.pr_size)
2374			return (mp);
2375
2376		if (addr < mp->map_pmap.pr_vaddr)
2377			hi = mid - 1;
2378		else
2379			lo = mid + 1;
2380	}
2381
2382	return (NULL);
2383}
2384
2385/*
2386 * Return the map_info_t for the executable file.
2387 * If not found, return NULL.
2388 */
2389static map_info_t *
2390exec_map(struct ps_prochandle *P)
2391{
2392	uint_t i;
2393	map_info_t *mptr;
2394	map_info_t *mold = NULL;
2395	file_info_t *fptr;
2396	uintptr_t base;
2397
2398	for (i = 0, mptr = P->mappings; i < P->map_count; i++, mptr++) {
2399		if (mptr->map_pmap.pr_mapname[0] == '\0')
2400			continue;
2401		if (strcmp(mptr->map_pmap.pr_mapname, "a.out") == 0) {
2402			if ((fptr = mptr->map_file) != NULL &&
2403			    fptr->file_lo != NULL) {
2404				base = fptr->file_lo->rl_base;
2405				if (base >= mptr->map_pmap.pr_vaddr &&
2406				    base < mptr->map_pmap.pr_vaddr +
2407				    mptr->map_pmap.pr_size)	/* text space */
2408					return (mptr);
2409				mold = mptr;	/* must be the data */
2410				continue;
2411			}
2412			/* This is a poor way to test for text space */
2413			if (!(mptr->map_pmap.pr_mflags & MA_EXEC) ||
2414			    (mptr->map_pmap.pr_mflags & MA_WRITE)) {
2415				mold = mptr;
2416				continue;
2417			}
2418			return (mptr);
2419		}
2420	}
2421
2422	return (mold);
2423}
2424
2425/*
2426 * Given a shared object name, return the map_info_t for it.  If no matching
2427 * object is found, return NULL.  Normally, the link maps contain the full
2428 * object pathname, e.g. /usr/lib/libc.so.1.  We allow the object name to
2429 * take one of the following forms:
2430 *
2431 * 1. An exact match (i.e. a full pathname): "/usr/lib/libc.so.1"
2432 * 2. An exact basename match: "libc.so.1"
2433 * 3. An initial basename match up to a '.' suffix: "libc.so" or "libc"
2434 * 4. The literal string "a.out" is an alias for the executable mapping
2435 *
2436 * The third case is a convenience for callers and may not be necessary.
2437 *
2438 * As the exact same object name may be loaded on different link maps (see
2439 * dlmopen(3DL)), we also allow the caller to resolve the object name by
2440 * specifying a particular link map id.  If lmid is PR_LMID_EVERY, the
2441 * first matching name will be returned, regardless of the link map id.
2442 */
2443static map_info_t *
2444object_to_map(struct ps_prochandle *P, Lmid_t lmid, const char *objname)
2445{
2446	map_info_t *mp;
2447	file_info_t *fp;
2448	size_t objlen;
2449	uint_t i;
2450
2451	/*
2452	 * If we have no rtld_db, then always treat a request as one for all
2453	 * link maps.
2454	 */
2455	if (P->rap == NULL)
2456		lmid = PR_LMID_EVERY;
2457
2458	/*
2459	 * First pass: look for exact matches of the entire pathname or
2460	 * basename (cases 1 and 2 above):
2461	 */
2462	for (i = 0, mp = P->mappings; i < P->map_count; i++, mp++) {
2463
2464		if (mp->map_pmap.pr_mapname[0] == '\0' ||
2465		    (fp = mp->map_file) == NULL ||
2466		    ((fp->file_lname == NULL) && (fp->file_rname == NULL)))
2467			continue;
2468
2469		if (lmid != PR_LMID_EVERY &&
2470		    (fp->file_lo == NULL || lmid != fp->file_lo->rl_lmident))
2471			continue;
2472
2473		/*
2474		 * If we match, return the primary text mapping; otherwise
2475		 * just return the mapping we matched.
2476		 */
2477		if ((fp->file_lbase && strcmp(fp->file_lbase, objname) == 0) ||
2478		    (fp->file_rbase && strcmp(fp->file_rbase, objname) == 0) ||
2479		    (fp->file_lname && strcmp(fp->file_lname, objname) == 0) ||
2480		    (fp->file_rname && strcmp(fp->file_rname, objname) == 0))
2481			return (fp->file_map ? fp->file_map : mp);
2482	}
2483
2484	objlen = strlen(objname);
2485
2486	/*
2487	 * Second pass: look for partial matches (case 3 above):
2488	 */
2489	for (i = 0, mp = P->mappings; i < P->map_count; i++, mp++) {
2490
2491		if (mp->map_pmap.pr_mapname[0] == '\0' ||
2492		    (fp = mp->map_file) == NULL ||
2493		    ((fp->file_lname == NULL) && (fp->file_rname == NULL)))
2494			continue;
2495
2496		if (lmid != PR_LMID_EVERY &&
2497		    (fp->file_lo == NULL || lmid != fp->file_lo->rl_lmident))
2498			continue;
2499
2500		/*
2501		 * If we match, return the primary text mapping; otherwise
2502		 * just return the mapping we matched.
2503		 */
2504		if ((fp->file_lbase != NULL) &&
2505		    (strncmp(fp->file_lbase, objname, objlen) == 0) &&
2506		    (fp->file_lbase[objlen] == '.'))
2507			return (fp->file_map ? fp->file_map : mp);
2508		if ((fp->file_rbase != NULL) &&
2509		    (strncmp(fp->file_rbase, objname, objlen) == 0) &&
2510		    (fp->file_rbase[objlen] == '.'))
2511			return (fp->file_map ? fp->file_map : mp);
2512	}
2513
2514	/*
2515	 * One last check: we allow "a.out" to always alias the executable,
2516	 * assuming this name was not in use for something else.
2517	 */
2518	if ((lmid == PR_LMID_EVERY || lmid == LM_ID_BASE) &&
2519	    (strcmp(objname, "a.out") == 0))
2520		return (P->map_exec);
2521
2522	return (NULL);
2523}
2524
2525static map_info_t *
2526object_name_to_map(struct ps_prochandle *P, Lmid_t lmid, const char *name)
2527{
2528	map_info_t *mptr;
2529
2530	if (!P->info_valid)
2531		Pupdate_maps(P);
2532
2533	if (P->map_exec == NULL && ((mptr = Paddr2mptr(P,
2534	    Pgetauxval(P, AT_ENTRY))) != NULL || (mptr = exec_map(P)) != NULL))
2535		P->map_exec = mptr;
2536
2537	if (P->map_ldso == NULL && (mptr = Paddr2mptr(P,
2538	    Pgetauxval(P, AT_BASE))) != NULL)
2539		P->map_ldso = mptr;
2540
2541	if (name == PR_OBJ_EXEC)
2542		mptr = P->map_exec;
2543	else if (name == PR_OBJ_LDSO)
2544		mptr = P->map_ldso;
2545	else if (Prd_agent(P) != NULL || P->state == PS_IDLE)
2546		mptr = object_to_map(P, lmid, name);
2547	else
2548		mptr = NULL;
2549
2550	return (mptr);
2551}
2552
2553/*
2554 * When two symbols are found by address, decide which one is to be preferred.
2555 */
2556static GElf_Sym *
2557sym_prefer(GElf_Sym *sym1, char *name1, GElf_Sym *sym2, char *name2)
2558{
2559	/*
2560	 * Prefer the non-NULL symbol.
2561	 */
2562	if (sym1 == NULL)
2563		return (sym2);
2564	if (sym2 == NULL)
2565		return (sym1);
2566
2567	/*
2568	 * Defer to the sort ordering...
2569	 */
2570	return (byaddr_cmp_common(sym1, name1, sym2, name2) <= 0 ? sym1 : sym2);
2571}
2572
2573/*
2574 * Use a binary search to do the work of sym_by_addr().
2575 */
2576static GElf_Sym *
2577sym_by_addr_binary(sym_tbl_t *symtab, GElf_Addr addr, GElf_Sym *symp,
2578    uint_t *idp)
2579{
2580	GElf_Sym sym, osym;
2581	uint_t i, oid, *byaddr = symtab->sym_byaddr;
2582	int min, max, mid, omid, found = 0;
2583
2584	if (symtab->sym_data_pri == NULL || symtab->sym_count == 0)
2585		return (NULL);
2586
2587	min = 0;
2588	max = symtab->sym_count - 1;
2589	osym.st_value = 0;
2590
2591	/*
2592	 * We can't return when we've found a match, we have to continue
2593	 * searching for the closest matching symbol.
2594	 */
2595	while (min <= max) {
2596		mid = (max + min) / 2;
2597
2598		i = byaddr[mid];
2599		(void) symtab_getsym(symtab, i, &sym);
2600
2601		if (addr >= sym.st_value &&
2602		    addr < sym.st_value + sym.st_size &&
2603		    (!found || sym.st_value > osym.st_value)) {
2604			osym = sym;
2605			omid = mid;
2606			oid = i;
2607			found = 1;
2608		}
2609
2610		if (addr < sym.st_value)
2611			max = mid - 1;
2612		else
2613			min = mid + 1;
2614	}
2615
2616	if (!found)
2617		return (NULL);
2618
2619	/*
2620	 * There may be many symbols with identical values so we walk
2621	 * backward in the byaddr table to find the best match.
2622	 */
2623	do {
2624		sym = osym;
2625		i = oid;
2626
2627		if (omid == 0)
2628			break;
2629
2630		oid = byaddr[--omid];
2631		(void) symtab_getsym(symtab, oid, &osym);
2632	} while (addr >= osym.st_value &&
2633	    addr < sym.st_value + osym.st_size &&
2634	    osym.st_value == sym.st_value);
2635
2636	*symp = sym;
2637	if (idp != NULL)
2638		*idp = i;
2639	return (symp);
2640}
2641
2642/*
2643 * Use a linear search to do the work of sym_by_addr().
2644 */
2645static GElf_Sym *
2646sym_by_addr_linear(sym_tbl_t *symtab, GElf_Addr addr, GElf_Sym *symbolp,
2647    uint_t *idp)
2648{
2649	size_t symn = symtab->sym_symn;
2650	char *strs = symtab->sym_strs;
2651	GElf_Sym sym, *symp = NULL;
2652	GElf_Sym osym, *osymp = NULL;
2653	int i, id;
2654
2655	if (symtab->sym_data_pri == NULL || symn == 0 || strs == NULL)
2656		return (NULL);
2657
2658	for (i = 0; i < symn; i++) {
2659		if ((symp = symtab_getsym(symtab, i, &sym)) != NULL) {
2660			if (addr >= sym.st_value &&
2661			    addr < sym.st_value + sym.st_size) {
2662				if (osymp)
2663					symp = sym_prefer(
2664					    symp, strs + symp->st_name,
2665					    osymp, strs + osymp->st_name);
2666				if (symp != osymp) {
2667					osym = sym;
2668					osymp = &osym;
2669					id = i;
2670				}
2671			}
2672		}
2673	}
2674	if (osymp) {
2675		*symbolp = osym;
2676		if (idp)
2677			*idp = id;
2678		return (symbolp);
2679	}
2680	return (NULL);
2681}
2682
2683/*
2684 * Look up a symbol by address in the specified symbol table.
2685 * Adjustment to 'addr' must already have been made for the
2686 * offset of the symbol if this is a dynamic library symbol table.
2687 *
2688 * Use a linear or a binary search depending on whether or not we
2689 * chose to sort the table in optimize_symtab().
2690 */
2691static GElf_Sym *
2692sym_by_addr(sym_tbl_t *symtab, GElf_Addr addr, GElf_Sym *symp, uint_t *idp)
2693{
2694	if (_libproc_no_qsort) {
2695		return (sym_by_addr_linear(symtab, addr, symp, idp));
2696	} else {
2697		return (sym_by_addr_binary(symtab, addr, symp, idp));
2698	}
2699}
2700
2701/*
2702 * Use a binary search to do the work of sym_by_name().
2703 */
2704static GElf_Sym *
2705sym_by_name_binary(sym_tbl_t *symtab, const char *name, GElf_Sym *symp,
2706    uint_t *idp)
2707{
2708	char *strs = symtab->sym_strs;
2709	uint_t i, *byname = symtab->sym_byname;
2710	int min, mid, max, cmp;
2711
2712	if (symtab->sym_data_pri == NULL || strs == NULL ||
2713	    symtab->sym_count == 0)
2714		return (NULL);
2715
2716	min = 0;
2717	max = symtab->sym_count - 1;
2718
2719	while (min <= max) {
2720		mid = (max + min) / 2;
2721
2722		i = byname[mid];
2723		(void) symtab_getsym(symtab, i, symp);
2724
2725		if ((cmp = strcmp(name, strs + symp->st_name)) == 0) {
2726			if (idp != NULL)
2727				*idp = i;
2728			return (symp);
2729		}
2730
2731		if (cmp < 0)
2732			max = mid - 1;
2733		else
2734			min = mid + 1;
2735	}
2736
2737	return (NULL);
2738}
2739
2740/*
2741 * Use a linear search to do the work of sym_by_name().
2742 */
2743static GElf_Sym *
2744sym_by_name_linear(sym_tbl_t *symtab, const char *name, GElf_Sym *symp,
2745    uint_t *idp)
2746{
2747	size_t symn = symtab->sym_symn;
2748	char *strs = symtab->sym_strs;
2749	int i;
2750
2751	if (symtab->sym_data_pri == NULL || symn == 0 || strs == NULL)
2752		return (NULL);
2753
2754	for (i = 0; i < symn; i++) {
2755		if (symtab_getsym(symtab, i, symp) &&
2756		    strcmp(name, strs + symp->st_name) == 0) {
2757			if (idp)
2758				*idp = i;
2759			return (symp);
2760		}
2761	}
2762
2763	return (NULL);
2764}
2765
2766/*
2767 * Look up a symbol by name in the specified symbol table.
2768 *
2769 * Use a linear or a binary search depending on whether or not we
2770 * chose to sort the table in optimize_symtab().
2771 */
2772static GElf_Sym *
2773sym_by_name(sym_tbl_t *symtab, const char *name, GElf_Sym *symp, uint_t *idp)
2774{
2775	if (_libproc_no_qsort) {
2776		return (sym_by_name_linear(symtab, name, symp, idp));
2777	} else {
2778		return (sym_by_name_binary(symtab, name, symp, idp));
2779	}
2780}
2781
2782/*
2783 * Search the process symbol tables looking for a symbol whose
2784 * value to value+size contain the address specified by addr.
2785 * Return values are:
2786 *	sym_name_buffer containing the symbol name
2787 *	GElf_Sym symbol table entry
2788 *	prsyminfo_t ancillary symbol information
2789 * Returns 0 on success, -1 on failure.
2790 */
2791static int
2792i_Pxlookup_by_addr(
2793	struct ps_prochandle *P,
2794	int lmresolve,			/* use resolve linker object names */
2795	uintptr_t addr,			/* process address being sought */
2796	char *sym_name_buffer,		/* buffer for the symbol name */
2797	size_t bufsize,			/* size of sym_name_buffer */
2798	GElf_Sym *symbolp,		/* returned symbol table entry */
2799	prsyminfo_t *sip)		/* returned symbol info */
2800{
2801	GElf_Sym	*symp;
2802	char		*name;
2803	GElf_Sym	sym1, *sym1p = NULL;
2804	GElf_Sym	sym2, *sym2p = NULL;
2805	char		*name1 = NULL;
2806	char		*name2 = NULL;
2807	uint_t		i1;
2808	uint_t		i2;
2809	map_info_t	*mptr;
2810	file_info_t	*fptr;
2811
2812	(void) Prd_agent(P);
2813
2814	if ((mptr = Paddr2mptr(P, addr)) == NULL ||	/* no such address */
2815	    (fptr = build_map_symtab(P, mptr)) == NULL || /* no mapped file */
2816	    fptr->file_elf == NULL)			/* not an ELF file */
2817		return (-1);
2818
2819	/*
2820	 * Adjust the address by the load object base address in
2821	 * case the address turns out to be in a shared library.
2822	 */
2823	addr -= fptr->file_dyn_base;
2824
2825	/*
2826	 * Search both symbol tables, symtab first, then dynsym.
2827	 */
2828	if ((sym1p = sym_by_addr(&fptr->file_symtab, addr, &sym1, &i1)) != NULL)
2829		name1 = fptr->file_symtab.sym_strs + sym1.st_name;
2830	if ((sym2p = sym_by_addr(&fptr->file_dynsym, addr, &sym2, &i2)) != NULL)
2831		name2 = fptr->file_dynsym.sym_strs + sym2.st_name;
2832
2833	if ((symp = sym_prefer(sym1p, name1, sym2p, name2)) == NULL)
2834		return (-1);
2835
2836	name = (symp == sym1p) ? name1 : name2;
2837	if (bufsize > 0) {
2838		(void) strncpy(sym_name_buffer, name, bufsize);
2839		sym_name_buffer[bufsize - 1] = '\0';
2840	}
2841
2842	*symbolp = *symp;
2843	if (sip != NULL) {
2844		sip->prs_name = bufsize == 0 ? NULL : sym_name_buffer;
2845		if (lmresolve && (fptr->file_rname != NULL))
2846			sip->prs_object = fptr->file_rbase;
2847		else
2848			sip->prs_object = fptr->file_lbase;
2849		sip->prs_id = (symp == sym1p) ? i1 : i2;
2850		sip->prs_table = (symp == sym1p) ? PR_SYMTAB : PR_DYNSYM;
2851		sip->prs_lmid = (fptr->file_lo == NULL) ? LM_ID_BASE :
2852		    fptr->file_lo->rl_lmident;
2853	}
2854
2855	if (GELF_ST_TYPE(symbolp->st_info) != STT_TLS)
2856		symbolp->st_value += fptr->file_dyn_base;
2857
2858	return (0);
2859}
2860
2861int
2862Pxlookup_by_addr(struct ps_prochandle *P, uintptr_t addr, char *buf,
2863    size_t bufsize, GElf_Sym *symp, prsyminfo_t *sip)
2864{
2865	return (i_Pxlookup_by_addr(P, B_FALSE, addr, buf, bufsize, symp, sip));
2866}
2867
2868int
2869Pxlookup_by_addr_resolved(struct ps_prochandle *P, uintptr_t addr, char *buf,
2870    size_t bufsize, GElf_Sym *symp, prsyminfo_t *sip)
2871{
2872	return (i_Pxlookup_by_addr(P, B_TRUE, addr, buf, bufsize, symp, sip));
2873}
2874
2875int
2876Plookup_by_addr(struct ps_prochandle *P, uintptr_t addr, char *buf,
2877    size_t size, GElf_Sym *symp)
2878{
2879	return (i_Pxlookup_by_addr(P, B_FALSE, addr, buf, size, symp, NULL));
2880}
2881
2882/*
2883 * Search the process symbol tables looking for a symbol whose name matches the
2884 * specified name and whose object and link map optionally match the specified
2885 * parameters.  On success, the function returns 0 and fills in the GElf_Sym
2886 * symbol table entry.  On failure, -1 is returned.
2887 */
2888int
2889Pxlookup_by_name(
2890	struct ps_prochandle *P,
2891	Lmid_t lmid,			/* link map to match, or -1 for any */
2892	const char *oname,		/* load object name */
2893	const char *sname,		/* symbol name */
2894	GElf_Sym *symp,			/* returned symbol table entry */
2895	prsyminfo_t *sip)		/* returned symbol info */
2896{
2897	map_info_t *mptr;
2898	file_info_t *fptr;
2899	int cnt;
2900
2901	GElf_Sym sym;
2902	prsyminfo_t si;
2903	int rv = -1;
2904	uint_t id;
2905
2906	if (oname == PR_OBJ_EVERY) {
2907		/* create all the file_info_t's for all the mappings */
2908		(void) Prd_agent(P);
2909		cnt = P->num_files;
2910		fptr = list_next(&P->file_head);
2911	} else {
2912		cnt = 1;
2913		if ((mptr = object_name_to_map(P, lmid, oname)) == NULL ||
2914		    (fptr = build_map_symtab(P, mptr)) == NULL)
2915			return (-1);
2916	}
2917
2918	/*
2919	 * Iterate through the loaded object files and look for the symbol
2920	 * name in the .symtab and .dynsym of each.  If we encounter a match
2921	 * with SHN_UNDEF, keep looking in hopes of finding a better match.
2922	 * This means that a name such as "puts" will match the puts function
2923	 * in libc instead of matching the puts PLT entry in the a.out file.
2924	 */
2925	for (; cnt > 0; cnt--, fptr = list_next(fptr)) {
2926		Pbuild_file_symtab(P, fptr);
2927
2928		if (fptr->file_elf == NULL)
2929			continue;
2930
2931		if (lmid != PR_LMID_EVERY && fptr->file_lo != NULL &&
2932		    lmid != fptr->file_lo->rl_lmident)
2933			continue;
2934
2935		if (fptr->file_symtab.sym_data_pri != NULL &&
2936		    sym_by_name(&fptr->file_symtab, sname, symp, &id)) {
2937			if (sip != NULL) {
2938				sip->prs_id = id;
2939				sip->prs_table = PR_SYMTAB;
2940				sip->prs_object = oname;
2941				sip->prs_name = sname;
2942				sip->prs_lmid = fptr->file_lo == NULL ?
2943				    LM_ID_BASE : fptr->file_lo->rl_lmident;
2944			}
2945		} else if (fptr->file_dynsym.sym_data_pri != NULL &&
2946		    sym_by_name(&fptr->file_dynsym, sname, symp, &id)) {
2947			if (sip != NULL) {
2948				sip->prs_id = id;
2949				sip->prs_table = PR_DYNSYM;
2950				sip->prs_object = oname;
2951				sip->prs_name = sname;
2952				sip->prs_lmid = fptr->file_lo == NULL ?
2953				    LM_ID_BASE : fptr->file_lo->rl_lmident;
2954			}
2955		} else {
2956			continue;
2957		}
2958
2959		if (GELF_ST_TYPE(symp->st_info) != STT_TLS)
2960			symp->st_value += fptr->file_dyn_base;
2961
2962		if (symp->st_shndx != SHN_UNDEF)
2963			return (0);
2964
2965		if (rv != 0) {
2966			if (sip != NULL)
2967				si = *sip;
2968			sym = *symp;
2969			rv = 0;
2970		}
2971	}
2972
2973	if (rv == 0) {
2974		if (sip != NULL)
2975			*sip = si;
2976		*symp = sym;
2977	}
2978
2979	return (rv);
2980}
2981
2982/*
2983 * Search the process symbol tables looking for a symbol whose name matches the
2984 * specified name, but without any restriction on the link map id.
2985 */
2986int
2987Plookup_by_name(struct ps_prochandle *P, const char *object,
2988    const char *symbol, GElf_Sym *symp)
2989{
2990	return (Pxlookup_by_name(P, PR_LMID_EVERY, object, symbol, symp, NULL));
2991}
2992
2993/*
2994 * Iterate over the process's address space mappings.
2995 */
2996static int
2997i_Pmapping_iter(struct ps_prochandle *P, boolean_t lmresolve,
2998    proc_map_f *func, void *cd)
2999{
3000	map_info_t *mptr;
3001	file_info_t *fptr;
3002	char *object_name;
3003	int rc = 0;
3004	int i;
3005
3006	/* create all the file_info_t's for all the mappings */
3007	(void) Prd_agent(P);
3008
3009	for (i = 0, mptr = P->mappings; i < P->map_count; i++, mptr++) {
3010		if ((fptr = mptr->map_file) == NULL)
3011			object_name = NULL;
3012		else if (lmresolve && (fptr->file_rname != NULL))
3013			object_name = fptr->file_rname;
3014		else
3015			object_name = fptr->file_lname;
3016		if ((rc = func(cd, &mptr->map_pmap, object_name)) != 0)
3017			return (rc);
3018	}
3019	return (0);
3020}
3021
3022int
3023Pmapping_iter(struct ps_prochandle *P, proc_map_f *func, void *cd)
3024{
3025	return (i_Pmapping_iter(P, B_FALSE, func, cd));
3026}
3027
3028int
3029Pmapping_iter_resolved(struct ps_prochandle *P, proc_map_f *func, void *cd)
3030{
3031	return (i_Pmapping_iter(P, B_TRUE, func, cd));
3032}
3033
3034/*
3035 * Iterate over the process's mapped objects.
3036 */
3037static int
3038i_Pobject_iter(struct ps_prochandle *P, boolean_t lmresolve,
3039    proc_map_f *func, void *cd)
3040{
3041	map_info_t *mptr;
3042	file_info_t *fptr;
3043	uint_t cnt;
3044	int rc = 0;
3045
3046	(void) Prd_agent(P); /* create file_info_t's for all the mappings */
3047	Pupdate_maps(P);
3048
3049	for (cnt = P->num_files, fptr = list_next(&P->file_head);
3050	    cnt; cnt--, fptr = list_next(fptr)) {
3051		const char *lname;
3052
3053		if (lmresolve && (fptr->file_rname != NULL))
3054			lname = fptr->file_rname;
3055		else if (fptr->file_lname != NULL)
3056			lname = fptr->file_lname;
3057		else
3058			lname = "";
3059
3060		if ((mptr = fptr->file_map) == NULL)
3061			continue;
3062
3063		if ((rc = func(cd, &mptr->map_pmap, lname)) != 0)
3064			return (rc);
3065
3066		if (!P->info_valid)
3067			Pupdate_maps(P);
3068	}
3069	return (0);
3070}
3071
3072int
3073Pobject_iter(struct ps_prochandle *P, proc_map_f *func, void *cd)
3074{
3075	return (i_Pobject_iter(P, B_FALSE, func, cd));
3076}
3077
3078int
3079Pobject_iter_resolved(struct ps_prochandle *P, proc_map_f *func, void *cd)
3080{
3081	return (i_Pobject_iter(P, B_TRUE, func, cd));
3082}
3083
3084static char *
3085i_Pobjname(struct ps_prochandle *P, boolean_t lmresolve, uintptr_t addr,
3086    char *buffer, size_t bufsize)
3087{
3088	map_info_t *mptr;
3089	file_info_t *fptr;
3090
3091	/* create all the file_info_t's for all the mappings */
3092	(void) Prd_agent(P);
3093
3094	if ((mptr = Paddr2mptr(P, addr)) == NULL)
3095		return (NULL);
3096
3097	if (!lmresolve) {
3098		if (((fptr = mptr->map_file) == NULL) ||
3099		    (fptr->file_lname == NULL))
3100			return (NULL);
3101		(void) strlcpy(buffer, fptr->file_lname, bufsize);
3102		return (buffer);
3103	}
3104
3105	/* Check for a cached copy of the resolved path */
3106	if (Pfindmap(P, mptr, buffer, bufsize) != NULL)
3107		return (buffer);
3108
3109	return (NULL);
3110}
3111
3112/*
3113 * Given a virtual address, return the name of the underlying
3114 * mapped object (file) as provided by the dynamic linker.
3115 * Return NULL if we can't find any name information for the object.
3116 */
3117char *
3118Pobjname(struct ps_prochandle *P, uintptr_t addr,
3119    char *buffer, size_t bufsize)
3120{
3121	return (i_Pobjname(P, B_FALSE, addr, buffer, bufsize));
3122}
3123
3124/*
3125 * Given a virtual address, try to return a filesystem path to the
3126 * underlying mapped object (file).  If we're in the global zone,
3127 * this path could resolve to an object in another zone.  If we're
3128 * unable return a valid filesystem path, we'll fall back to providing
3129 * the mapped object (file) name provided by the dynamic linker in
3130 * the target process (ie, the object reported by Pobjname()).
3131 */
3132char *
3133Pobjname_resolved(struct ps_prochandle *P, uintptr_t addr,
3134    char *buffer, size_t bufsize)
3135{
3136	return (i_Pobjname(P, B_TRUE, addr, buffer, bufsize));
3137}
3138
3139/*
3140 * Given a virtual address, return the link map id of the underlying mapped
3141 * object (file), as provided by the dynamic linker.  Return -1 on failure.
3142 */
3143int
3144Plmid(struct ps_prochandle *P, uintptr_t addr, Lmid_t *lmidp)
3145{
3146	map_info_t *mptr;
3147	file_info_t *fptr;
3148
3149	/* create all the file_info_t's for all the mappings */
3150	(void) Prd_agent(P);
3151
3152	if ((mptr = Paddr2mptr(P, addr)) != NULL &&
3153	    (fptr = mptr->map_file) != NULL && fptr->file_lo != NULL) {
3154		*lmidp = fptr->file_lo->rl_lmident;
3155		return (0);
3156	}
3157
3158	return (-1);
3159}
3160
3161/*
3162 * Given an object name and optional lmid, iterate over the object's symbols.
3163 * If which == PR_SYMTAB, search the normal symbol table.
3164 * If which == PR_DYNSYM, search the dynamic symbol table.
3165 */
3166static int
3167Psymbol_iter_com(struct ps_prochandle *P, Lmid_t lmid, const char *object_name,
3168    int which, int mask, pr_order_t order, proc_xsym_f *func, void *cd)
3169{
3170#if STT_NUM != (STT_TLS + 1)
3171#error "STT_NUM has grown. update Psymbol_iter_com()"
3172#endif
3173
3174	GElf_Sym sym;
3175	GElf_Shdr shdr;
3176	map_info_t *mptr;
3177	file_info_t *fptr;
3178	sym_tbl_t *symtab;
3179	size_t symn;
3180	const char *strs;
3181	size_t strsz;
3182	prsyminfo_t si;
3183	int rv;
3184	uint_t *map, i, count, ndx;
3185
3186	if ((mptr = object_name_to_map(P, lmid, object_name)) == NULL)
3187		return (-1);
3188
3189	if ((fptr = build_map_symtab(P, mptr)) == NULL || /* no mapped file */
3190	    fptr->file_elf == NULL)			/* not an ELF file */
3191		return (-1);
3192
3193	/*
3194	 * Search the specified symbol table.
3195	 */
3196	switch (which) {
3197	case PR_SYMTAB:
3198		symtab = &fptr->file_symtab;
3199		si.prs_table = PR_SYMTAB;
3200		break;
3201	case PR_DYNSYM:
3202		symtab = &fptr->file_dynsym;
3203		si.prs_table = PR_DYNSYM;
3204		break;
3205	default:
3206		return (-1);
3207	}
3208
3209	si.prs_object = object_name;
3210	si.prs_lmid = fptr->file_lo == NULL ?
3211	    LM_ID_BASE : fptr->file_lo->rl_lmident;
3212
3213	symn = symtab->sym_symn;
3214	strs = symtab->sym_strs;
3215	strsz = symtab->sym_strsz;
3216
3217	switch (order) {
3218	case PRO_NATURAL:
3219		map = NULL;
3220		count = symn;
3221		break;
3222	case PRO_BYNAME:
3223		map = symtab->sym_byname;
3224		count = symtab->sym_count;
3225		break;
3226	case PRO_BYADDR:
3227		map = symtab->sym_byaddr;
3228		count = symtab->sym_count;
3229		break;
3230	default:
3231		return (-1);
3232	}
3233
3234	if (symtab->sym_data_pri == NULL || strs == NULL || count == 0)
3235		return (-1);
3236
3237	rv = 0;
3238
3239	for (i = 0; i < count; i++) {
3240		ndx = map == NULL ? i : map[i];
3241		if (symtab_getsym(symtab, ndx, &sym) != NULL) {
3242			uint_t s_bind, s_type, type;
3243
3244			if (sym.st_name >= strsz)	/* invalid st_name */
3245				continue;
3246
3247			s_bind = GELF_ST_BIND(sym.st_info);
3248			s_type = GELF_ST_TYPE(sym.st_info);
3249
3250			/*
3251			 * In case you haven't already guessed, this relies on
3252			 * the bitmask used in <libproc.h> for encoding symbol
3253			 * type and binding matching the order of STB and STT
3254			 * constants in <sys/elf.h>.  Changes to ELF must
3255			 * maintain binary compatibility, so I think this is
3256			 * reasonably fair game.
3257			 */
3258			if (s_bind < STB_NUM && s_type < STT_NUM) {
3259				type = (1 << (s_type + 8)) | (1 << s_bind);
3260				if ((type & ~mask) != 0)
3261					continue;
3262			} else
3263				continue; /* Invalid type or binding */
3264
3265			if (GELF_ST_TYPE(sym.st_info) != STT_TLS)
3266				sym.st_value += fptr->file_dyn_base;
3267
3268			si.prs_name = strs + sym.st_name;
3269
3270			/*
3271			 * If symbol's type is STT_SECTION, then try to lookup
3272			 * the name of the corresponding section.
3273			 */
3274			if (GELF_ST_TYPE(sym.st_info) == STT_SECTION &&
3275			    fptr->file_shstrs != NULL &&
3276			    gelf_getshdr(elf_getscn(fptr->file_elf,
3277			    sym.st_shndx), &shdr) != NULL &&
3278			    shdr.sh_name != 0 &&
3279			    shdr.sh_name < fptr->file_shstrsz)
3280				si.prs_name = fptr->file_shstrs + shdr.sh_name;
3281
3282			si.prs_id = ndx;
3283			if ((rv = func(cd, &sym, si.prs_name, &si)) != 0)
3284				break;
3285		}
3286	}
3287
3288	return (rv);
3289}
3290
3291int
3292Pxsymbol_iter(struct ps_prochandle *P, Lmid_t lmid, const char *object_name,
3293    int which, int mask, proc_xsym_f *func, void *cd)
3294{
3295	return (Psymbol_iter_com(P, lmid, object_name, which, mask,
3296	    PRO_NATURAL, func, cd));
3297}
3298
3299int
3300Psymbol_iter_by_lmid(struct ps_prochandle *P, Lmid_t lmid,
3301    const char *object_name, int which, int mask, proc_sym_f *func, void *cd)
3302{
3303	return (Psymbol_iter_com(P, lmid, object_name, which, mask,
3304	    PRO_NATURAL, (proc_xsym_f *)(uintptr_t)func, cd));
3305}
3306
3307int
3308Psymbol_iter(struct ps_prochandle *P,
3309    const char *object_name, int which, int mask, proc_sym_f *func, void *cd)
3310{
3311	return (Psymbol_iter_com(P, PR_LMID_EVERY, object_name, which, mask,
3312	    PRO_NATURAL, (proc_xsym_f *)(uintptr_t)func, cd));
3313}
3314
3315int
3316Psymbol_iter_by_addr(struct ps_prochandle *P,
3317    const char *object_name, int which, int mask, proc_sym_f *func, void *cd)
3318{
3319	return (Psymbol_iter_com(P, PR_LMID_EVERY, object_name, which, mask,
3320	    PRO_BYADDR, (proc_xsym_f *)(uintptr_t)func, cd));
3321}
3322
3323int
3324Psymbol_iter_by_name(struct ps_prochandle *P,
3325    const char *object_name, int which, int mask, proc_sym_f *func, void *cd)
3326{
3327	return (Psymbol_iter_com(P, PR_LMID_EVERY, object_name, which, mask,
3328	    PRO_BYNAME, (proc_xsym_f *)(uintptr_t)func, cd));
3329}
3330
3331/*
3332 * Get the platform string.
3333 */
3334char *
3335Pplatform(struct ps_prochandle *P, char *s, size_t n)
3336{
3337	return (P->ops.pop_platform(P, s, n, P->data));
3338}
3339
3340/*
3341 * Get the uname(2) information.
3342 */
3343int
3344Puname(struct ps_prochandle *P, struct utsname *u)
3345{
3346	return (P->ops.pop_uname(P, u, P->data));
3347}
3348
3349/*
3350 * Called from Pcreate(), Pgrab(), and Pfgrab_core() to initialize
3351 * the symbol table heads in the new ps_prochandle.
3352 */
3353void
3354Pinitsym(struct ps_prochandle *P)
3355{
3356	P->num_files = 0;
3357	list_link(&P->file_head, NULL);
3358}
3359
3360/*
3361 * Called from Prelease() to destroy the symbol tables.
3362 * Must be called by the client after an exec() in the victim process.
3363 */
3364void
3365Preset_maps(struct ps_prochandle *P)
3366{
3367	int i;
3368
3369	if (P->rap != NULL) {
3370		rd_delete(P->rap);
3371		P->rap = NULL;
3372	}
3373
3374	if (P->execname != NULL) {
3375		free(P->execname);
3376		P->execname = NULL;
3377	}
3378
3379	if (P->auxv != NULL) {
3380		free(P->auxv);
3381		P->auxv = NULL;
3382		P->nauxv = 0;
3383	}
3384
3385	for (i = 0; i < P->map_count; i++)
3386		map_info_free(P, &P->mappings[i]);
3387
3388	if (P->mappings != NULL) {
3389		free(P->mappings);
3390		P->mappings = NULL;
3391	}
3392	P->map_count = P->map_alloc = 0;
3393
3394	P->info_valid = 0;
3395}
3396
3397typedef struct getenv_data {
3398	char *buf;
3399	size_t bufsize;
3400	const char *search;
3401	size_t searchlen;
3402} getenv_data_t;
3403
3404/*ARGSUSED*/
3405static int
3406getenv_func(void *data, struct ps_prochandle *P, uintptr_t addr,
3407    const char *nameval)
3408{
3409	getenv_data_t *d = data;
3410	size_t len;
3411
3412	if (nameval == NULL)
3413		return (0);
3414
3415	if (d->searchlen < strlen(nameval) &&
3416	    strncmp(nameval, d->search, d->searchlen) == 0 &&
3417	    nameval[d->searchlen] == '=') {
3418		len = MIN(strlen(nameval), d->bufsize - 1);
3419		(void) strncpy(d->buf, nameval, len);
3420		d->buf[len] = '\0';
3421		return (1);
3422	}
3423
3424	return (0);
3425}
3426
3427char *
3428Pgetenv(struct ps_prochandle *P, const char *name, char *buf, size_t buflen)
3429{
3430	getenv_data_t d;
3431
3432	d.buf = buf;
3433	d.bufsize = buflen;
3434	d.search = name;
3435	d.searchlen = strlen(name);
3436
3437	if (Penv_iter(P, getenv_func, &d) == 1) {
3438		char *equals = strchr(d.buf, '=');
3439
3440		if (equals != NULL) {
3441			(void) memmove(d.buf, equals + 1,
3442			    d.buf + buflen - equals - 1);
3443			d.buf[d.buf + buflen - equals] = '\0';
3444
3445			return (buf);
3446		}
3447	}
3448
3449	return (NULL);
3450}
3451
3452/* number of argument or environment pointers to read all at once */
3453#define	NARG	100
3454
3455int
3456Penv_iter(struct ps_prochandle *P, proc_env_f *func, void *data)
3457{
3458	const psinfo_t *psp;
3459	uintptr_t envpoff;
3460	GElf_Sym sym;
3461	int ret;
3462	char *buf, *nameval;
3463	size_t buflen;
3464
3465	int nenv = NARG;
3466	long envp[NARG];
3467
3468	/*
3469	 * Attempt to find the "_environ" variable in the process.
3470	 * Failing that, use the original value provided by Ppsinfo().
3471	 */
3472	if ((psp = Ppsinfo(P)) == NULL)
3473		return (-1);
3474
3475	envpoff = psp->pr_envp; /* Default if no _environ found */
3476
3477	if (Plookup_by_name(P, PR_OBJ_EXEC, "_environ", &sym) == 0) {
3478		if (P->status.pr_dmodel == PR_MODEL_NATIVE) {
3479			if (Pread(P, &envpoff, sizeof (envpoff),
3480			    sym.st_value) != sizeof (envpoff))
3481				envpoff = psp->pr_envp;
3482		} else if (P->status.pr_dmodel == PR_MODEL_ILP32) {
3483			uint32_t envpoff32;
3484
3485			if (Pread(P, &envpoff32, sizeof (envpoff32),
3486			    sym.st_value) != sizeof (envpoff32))
3487				envpoff = psp->pr_envp;
3488			else
3489				envpoff = envpoff32;
3490		}
3491	}
3492
3493	buflen = 128;
3494	buf = malloc(buflen);
3495
3496	ret = 0;
3497	for (;;) {
3498		uintptr_t envoff;
3499
3500		if (nenv == NARG) {
3501			(void) memset(envp, 0, sizeof (envp));
3502			if (P->status.pr_dmodel == PR_MODEL_NATIVE) {
3503				if (Pread(P, envp,
3504				    sizeof (envp), envpoff) <= 0) {
3505					ret = -1;
3506					break;
3507				}
3508			} else if (P->status.pr_dmodel == PR_MODEL_ILP32) {
3509				uint32_t e32[NARG];
3510				int i;
3511
3512				(void) memset(e32, 0, sizeof (e32));
3513				if (Pread(P, e32, sizeof (e32), envpoff) <= 0) {
3514					ret = -1;
3515					break;
3516				}
3517				for (i = 0; i < NARG; i++)
3518					envp[i] = e32[i];
3519			}
3520			nenv = 0;
3521		}
3522
3523		if ((envoff = envp[nenv++]) == (uintptr_t)NULL)
3524			break;
3525
3526		/*
3527		 * Attempt to read the string from the process.
3528		 */
3529again:
3530		ret = Pread_string(P, buf, buflen, envoff);
3531
3532		if (ret <= 0) {
3533			nameval = NULL;
3534		} else if (ret == buflen - 1) {
3535			free(buf);
3536			/*
3537			 * Bail if we have a corrupted environment
3538			 */
3539			if (buflen >= ARG_MAX)
3540				return (-1);
3541			buflen *= 2;
3542			buf = malloc(buflen);
3543			goto again;
3544		} else {
3545			nameval = buf;
3546		}
3547
3548		if ((ret = func(data, P, envoff, nameval)) != 0)
3549			break;
3550
3551		envpoff += (P->status.pr_dmodel == PR_MODEL_LP64)? 8 : 4;
3552	}
3553
3554	free(buf);
3555
3556	return (ret);
3557}
3558