xref: /illumos-gate/usr/src/lib/libproc/common/Psymtab.c (revision e68846a8e404cfae64e1c4e685626bf6867ce513)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright 2016 Joyent, Inc.
25  * Copyright (c) 2013 by Delphix. All rights reserved.
26  */
27 
28 #include <assert.h>
29 #include <stdio.h>
30 #include <stdlib.h>
31 #include <stddef.h>
32 #include <unistd.h>
33 #include <ctype.h>
34 #include <fcntl.h>
35 #include <string.h>
36 #include <strings.h>
37 #include <memory.h>
38 #include <errno.h>
39 #include <dirent.h>
40 #include <signal.h>
41 #include <limits.h>
42 #include <libgen.h>
43 #include <sys/types.h>
44 #include <sys/stat.h>
45 #include <sys/sysmacros.h>
46 #include <sys/crc32.h>
47 
48 #include "libproc.h"
49 #include "Pcontrol.h"
50 #include "Putil.h"
51 #include "Psymtab_machelf.h"
52 
53 static file_info_t *build_map_symtab(struct ps_prochandle *, map_info_t *);
54 static map_info_t *exec_map(struct ps_prochandle *);
55 static map_info_t *object_to_map(struct ps_prochandle *, Lmid_t, const char *);
56 static map_info_t *object_name_to_map(struct ps_prochandle *,
57 	Lmid_t, const char *);
58 static GElf_Sym *sym_by_name(sym_tbl_t *, const char *, GElf_Sym *, uint_t *);
59 static int read_ehdr32(struct ps_prochandle *, Elf32_Ehdr *, uint_t *,
60     uintptr_t);
61 #ifdef _LP64
62 static int read_ehdr64(struct ps_prochandle *, Elf64_Ehdr *, uint_t *,
63     uintptr_t);
64 #endif
65 static uint32_t psym_crc32[] = { CRC32_TABLE };
66 
67 #define	DATA_TYPES	\
68 	((1 << STT_OBJECT) | (1 << STT_FUNC) | \
69 	(1 << STT_COMMON) | (1 << STT_TLS))
70 #define	IS_DATA_TYPE(tp)	(((1 << (tp)) & DATA_TYPES) != 0)
71 
72 #define	MA_RWX	(MA_READ | MA_WRITE | MA_EXEC)
73 
74 typedef enum {
75 	PRO_NATURAL,
76 	PRO_BYADDR,
77 	PRO_BYNAME
78 } pr_order_t;
79 
80 static int
81 addr_cmp(const void *aa, const void *bb)
82 {
83 	uintptr_t a = *((uintptr_t *)aa);
84 	uintptr_t b = *((uintptr_t *)bb);
85 
86 	if (a > b)
87 		return (1);
88 	if (a < b)
89 		return (-1);
90 	return (0);
91 }
92 
93 /*
94  * This function creates a list of addresses for a load object's sections.
95  * The list is in ascending address order and alternates start address
96  * then end address for each section we're interested in. The function
97  * returns a pointer to the list, which must be freed by the caller.
98  */
99 static uintptr_t *
100 get_saddrs(struct ps_prochandle *P, uintptr_t ehdr_start, uint_t *n)
101 {
102 	uintptr_t a, addr, *addrs, last = 0;
103 	uint_t i, naddrs = 0, unordered = 0;
104 
105 	if (P->status.pr_dmodel == PR_MODEL_ILP32) {
106 		Elf32_Ehdr ehdr;
107 		Elf32_Phdr phdr;
108 		uint_t phnum;
109 
110 		if (read_ehdr32(P, &ehdr, &phnum, ehdr_start) != 0)
111 			return (NULL);
112 
113 		addrs = malloc(sizeof (uintptr_t) * phnum * 2);
114 		a = ehdr_start + ehdr.e_phoff;
115 		for (i = 0; i < phnum; i++, a += ehdr.e_phentsize) {
116 			if (Pread(P, &phdr, sizeof (phdr), a) !=
117 			    sizeof (phdr)) {
118 				free(addrs);
119 				return (NULL);
120 			}
121 			if (phdr.p_type != PT_LOAD || phdr.p_memsz == 0)
122 				continue;
123 
124 			addr = phdr.p_vaddr;
125 			if (ehdr.e_type == ET_DYN)
126 				addr += ehdr_start;
127 			if (last > addr)
128 				unordered = 1;
129 			addrs[naddrs++] = addr;
130 			addrs[naddrs++] = last = addr + phdr.p_memsz - 1;
131 		}
132 #ifdef _LP64
133 	} else {
134 		Elf64_Ehdr ehdr;
135 		Elf64_Phdr phdr;
136 		uint_t phnum;
137 
138 		if (read_ehdr64(P, &ehdr, &phnum, ehdr_start) != 0)
139 			return (NULL);
140 
141 		addrs = malloc(sizeof (uintptr_t) * phnum * 2);
142 		a = ehdr_start + ehdr.e_phoff;
143 		for (i = 0; i < phnum; i++, a += ehdr.e_phentsize) {
144 			if (Pread(P, &phdr, sizeof (phdr), a) !=
145 			    sizeof (phdr)) {
146 				free(addrs);
147 				return (NULL);
148 			}
149 			if (phdr.p_type != PT_LOAD || phdr.p_memsz == 0)
150 				continue;
151 
152 			addr = phdr.p_vaddr;
153 			if (ehdr.e_type == ET_DYN)
154 				addr += ehdr_start;
155 			if (last > addr)
156 				unordered = 1;
157 			addrs[naddrs++] = addr;
158 			addrs[naddrs++] = last = addr + phdr.p_memsz - 1;
159 		}
160 #endif
161 	}
162 
163 	if (unordered)
164 		qsort(addrs, naddrs, sizeof (uintptr_t), addr_cmp);
165 
166 	*n = naddrs;
167 	return (addrs);
168 }
169 
170 /*
171  * Allocation function for a new file_info_t
172  */
173 file_info_t *
174 file_info_new(struct ps_prochandle *P, map_info_t *mptr)
175 {
176 	file_info_t *fptr;
177 	map_info_t *mp;
178 	uintptr_t mstart, mend, sstart, send;
179 	uint_t i;
180 
181 	if ((fptr = calloc(1, sizeof (file_info_t))) == NULL)
182 		return (NULL);
183 
184 	list_link(fptr, &P->file_head);
185 	(void) strcpy(fptr->file_pname, mptr->map_pmap.pr_mapname);
186 	mptr->map_file = fptr;
187 	fptr->file_ref = 1;
188 	fptr->file_fd = -1;
189 	fptr->file_dbgfile = -1;
190 	P->num_files++;
191 
192 	/*
193 	 * To figure out which map_info_t instances correspond to the mappings
194 	 * for this load object we try to obtain the start and end address
195 	 * for each section of our in-memory ELF image. If successful, we
196 	 * walk down the list of addresses and the list of map_info_t
197 	 * instances in lock step to correctly find the mappings that
198 	 * correspond to this load object.
199 	 */
200 	if ((fptr->file_saddrs = get_saddrs(P, mptr->map_pmap.pr_vaddr,
201 	    &fptr->file_nsaddrs)) == NULL)
202 		return (fptr);
203 
204 	mp = P->mappings;
205 	i = 0;
206 	while (mp < P->mappings + P->map_count && i < fptr->file_nsaddrs) {
207 
208 		/* Calculate the start and end of the mapping and section */
209 		mstart = mp->map_pmap.pr_vaddr;
210 		mend = mp->map_pmap.pr_vaddr + mp->map_pmap.pr_size;
211 		sstart = fptr->file_saddrs[i];
212 		send = fptr->file_saddrs[i + 1];
213 
214 		if (mend <= sstart) {
215 			/* This mapping is below the current section */
216 			mp++;
217 		} else if (mstart >= send) {
218 			/* This mapping is above the current section */
219 			i += 2;
220 		} else {
221 			/* This mapping overlaps the current section */
222 			if (mp->map_file == NULL) {
223 				dprintf("file_info_new: associating "
224 				    "segment at %p\n",
225 				    (void *)mp->map_pmap.pr_vaddr);
226 				mp->map_file = fptr;
227 				fptr->file_ref++;
228 			} else {
229 				dprintf("file_info_new: segment at %p "
230 				    "already associated with %s\n",
231 				    (void *)mp->map_pmap.pr_vaddr,
232 				    (mp == mptr ? "this file" :
233 				    mp->map_file->file_pname));
234 			}
235 			mp++;
236 		}
237 	}
238 
239 	return (fptr);
240 }
241 
242 /*
243  * Deallocation function for a file_info_t
244  */
245 static void
246 file_info_free(struct ps_prochandle *P, file_info_t *fptr)
247 {
248 	if (--fptr->file_ref == 0) {
249 		list_unlink(fptr);
250 		if (fptr->file_symtab.sym_elf) {
251 			(void) elf_end(fptr->file_symtab.sym_elf);
252 			free(fptr->file_symtab.sym_elfmem);
253 		}
254 		if (fptr->file_symtab.sym_byname)
255 			free(fptr->file_symtab.sym_byname);
256 		if (fptr->file_symtab.sym_byaddr)
257 			free(fptr->file_symtab.sym_byaddr);
258 
259 		if (fptr->file_dynsym.sym_elf) {
260 			(void) elf_end(fptr->file_dynsym.sym_elf);
261 			free(fptr->file_dynsym.sym_elfmem);
262 		}
263 		if (fptr->file_dynsym.sym_byname)
264 			free(fptr->file_dynsym.sym_byname);
265 		if (fptr->file_dynsym.sym_byaddr)
266 			free(fptr->file_dynsym.sym_byaddr);
267 
268 		if (fptr->file_lo)
269 			free(fptr->file_lo);
270 		if (fptr->file_lname)
271 			free(fptr->file_lname);
272 		if (fptr->file_rname)
273 			free(fptr->file_rname);
274 		if (fptr->file_elf)
275 			(void) elf_end(fptr->file_elf);
276 		if (fptr->file_elfmem != NULL)
277 			free(fptr->file_elfmem);
278 		if (fptr->file_fd >= 0)
279 			(void) close(fptr->file_fd);
280 		if (fptr->file_dbgelf)
281 			(void) elf_end(fptr->file_dbgelf);
282 		if (fptr->file_dbgfile >= 0)
283 			(void) close(fptr->file_dbgfile);
284 		if (fptr->file_ctfp) {
285 			ctf_close(fptr->file_ctfp);
286 			free(fptr->file_ctf_buf);
287 		}
288 		if (fptr->file_saddrs)
289 			free(fptr->file_saddrs);
290 		free(fptr);
291 		P->num_files--;
292 	}
293 }
294 
295 /*
296  * Deallocation function for a map_info_t
297  */
298 static void
299 map_info_free(struct ps_prochandle *P, map_info_t *mptr)
300 {
301 	file_info_t *fptr;
302 
303 	if ((fptr = mptr->map_file) != NULL) {
304 		if (fptr->file_map == mptr)
305 			fptr->file_map = NULL;
306 		file_info_free(P, fptr);
307 	}
308 	if (P->execname && mptr == P->map_exec) {
309 		free(P->execname);
310 		P->execname = NULL;
311 	}
312 	if (P->auxv && (mptr == P->map_exec || mptr == P->map_ldso)) {
313 		free(P->auxv);
314 		P->auxv = NULL;
315 		P->nauxv = 0;
316 	}
317 	if (mptr == P->map_exec)
318 		P->map_exec = NULL;
319 	if (mptr == P->map_ldso)
320 		P->map_ldso = NULL;
321 }
322 
323 /*
324  * Call-back function for librtld_db to iterate through all of its shared
325  * libraries.  We use this to get the load object names for the mappings.
326  */
327 static int
328 map_iter(const rd_loadobj_t *lop, void *cd)
329 {
330 	char buf[PATH_MAX];
331 	struct ps_prochandle *P = cd;
332 	map_info_t *mptr;
333 	file_info_t *fptr;
334 
335 	dprintf("encountered rd object at %p\n", (void *)lop->rl_base);
336 
337 	if ((mptr = Paddr2mptr(P, lop->rl_base)) == NULL) {
338 		dprintf("map_iter: base address doesn't match any mapping\n");
339 		return (1); /* Base address does not match any mapping */
340 	}
341 
342 	if ((fptr = mptr->map_file) == NULL &&
343 	    (fptr = file_info_new(P, mptr)) == NULL) {
344 		dprintf("map_iter: failed to allocate a new file_info_t\n");
345 		return (1); /* Failed to allocate a new file_info_t */
346 	}
347 
348 	if ((fptr->file_lo == NULL) &&
349 	    (fptr->file_lo = malloc(sizeof (rd_loadobj_t))) == NULL) {
350 		dprintf("map_iter: failed to allocate rd_loadobj_t\n");
351 		file_info_free(P, fptr);
352 		return (1); /* Failed to allocate rd_loadobj_t */
353 	}
354 
355 	fptr->file_map = mptr;
356 	*fptr->file_lo = *lop;
357 
358 	fptr->file_lo->rl_plt_base = fptr->file_plt_base;
359 	fptr->file_lo->rl_plt_size = fptr->file_plt_size;
360 
361 	if (fptr->file_lname) {
362 		free(fptr->file_lname);
363 		fptr->file_lname = NULL;
364 		fptr->file_lbase = NULL;
365 	}
366 	if (fptr->file_rname) {
367 		free(fptr->file_rname);
368 		fptr->file_rname = NULL;
369 		fptr->file_rbase = NULL;
370 	}
371 
372 	if (Pread_string(P, buf, sizeof (buf), lop->rl_nameaddr) > 0) {
373 		if ((fptr->file_lname = strdup(buf)) != NULL)
374 			fptr->file_lbase = basename(fptr->file_lname);
375 	} else {
376 		dprintf("map_iter: failed to read string at %p\n",
377 		    (void *)lop->rl_nameaddr);
378 	}
379 
380 	if ((Pfindmap(P, mptr, buf, sizeof (buf)) != NULL) &&
381 	    ((fptr->file_rname = strdup(buf)) != NULL))
382 		fptr->file_rbase = basename(fptr->file_rname);
383 
384 	dprintf("loaded rd object %s lmid %lx\n",
385 	    fptr->file_lname ? buf : "<NULL>", lop->rl_lmident);
386 	return (1);
387 }
388 
389 static void
390 map_set(struct ps_prochandle *P, map_info_t *mptr, const char *lname)
391 {
392 	file_info_t *fptr;
393 	char buf[PATH_MAX];
394 
395 	if ((fptr = mptr->map_file) == NULL &&
396 	    (fptr = file_info_new(P, mptr)) == NULL)
397 		return; /* Failed to allocate a new file_info_t */
398 
399 	fptr->file_map = mptr;
400 
401 	if ((fptr->file_lo == NULL) &&
402 	    (fptr->file_lo = malloc(sizeof (rd_loadobj_t))) == NULL) {
403 		file_info_free(P, fptr);
404 		return; /* Failed to allocate rd_loadobj_t */
405 	}
406 
407 	(void) memset(fptr->file_lo, 0, sizeof (rd_loadobj_t));
408 	fptr->file_lo->rl_base = mptr->map_pmap.pr_vaddr;
409 	fptr->file_lo->rl_bend =
410 	    mptr->map_pmap.pr_vaddr + mptr->map_pmap.pr_size;
411 
412 	fptr->file_lo->rl_plt_base = fptr->file_plt_base;
413 	fptr->file_lo->rl_plt_size = fptr->file_plt_size;
414 
415 	if ((fptr->file_lname == NULL) &&
416 	    (fptr->file_lname = strdup(lname)) != NULL)
417 		fptr->file_lbase = basename(fptr->file_lname);
418 
419 	if ((Pfindmap(P, mptr, buf, sizeof (buf)) != NULL) &&
420 	    ((fptr->file_rname = strdup(buf)) != NULL))
421 		fptr->file_rbase = basename(fptr->file_rname);
422 }
423 
424 static void
425 load_static_maps(struct ps_prochandle *P)
426 {
427 	map_info_t *mptr;
428 
429 	/*
430 	 * Construct the map for the a.out.
431 	 */
432 	if ((mptr = object_name_to_map(P, PR_LMID_EVERY, PR_OBJ_EXEC)) != NULL)
433 		map_set(P, mptr, "a.out");
434 
435 	/*
436 	 * If the dynamic linker exists for this process,
437 	 * construct the map for it.
438 	 */
439 	if (Pgetauxval(P, AT_BASE) != -1L &&
440 	    (mptr = object_name_to_map(P, PR_LMID_EVERY, PR_OBJ_LDSO)) != NULL)
441 		map_set(P, mptr, "ld.so.1");
442 }
443 
444 int
445 Preadmaps(struct ps_prochandle *P, prmap_t **Pmapp, ssize_t *nmapp)
446 {
447 	return (P->ops.pop_read_maps(P, Pmapp, nmapp, P->data));
448 }
449 
450 /*
451  * Go through all the address space mappings, validating or updating
452  * the information already gathered, or gathering new information.
453  *
454  * This function is only called when we suspect that the mappings have changed
455  * because this is the first time we're calling it or because of rtld activity.
456  */
457 void
458 Pupdate_maps(struct ps_prochandle *P)
459 {
460 	prmap_t *Pmap = NULL;
461 	prmap_t *pmap;
462 	ssize_t nmap;
463 	int i;
464 	uint_t oldmapcount;
465 	map_info_t *newmap, *newp;
466 	map_info_t *mptr;
467 
468 	if (P->info_valid || P->state == PS_UNDEAD)
469 		return;
470 
471 	Preadauxvec(P);
472 
473 	if (Preadmaps(P, &Pmap, &nmap) != 0)
474 		return;
475 
476 	if ((newmap = calloc(1, nmap * sizeof (map_info_t))) == NULL)
477 		return;
478 
479 	/*
480 	 * We try to merge any file information we may have for existing
481 	 * mappings, to avoid having to rebuild the file info.
482 	 */
483 	mptr = P->mappings;
484 	pmap = Pmap;
485 	newp = newmap;
486 	oldmapcount = P->map_count;
487 	for (i = 0; i < nmap; i++, pmap++, newp++) {
488 
489 		if (oldmapcount == 0) {
490 			/*
491 			 * We've exhausted all the old mappings.  Every new
492 			 * mapping should be added.
493 			 */
494 			newp->map_pmap = *pmap;
495 
496 		} else if (pmap->pr_vaddr == mptr->map_pmap.pr_vaddr &&
497 		    pmap->pr_size == mptr->map_pmap.pr_size &&
498 		    pmap->pr_offset == mptr->map_pmap.pr_offset &&
499 		    (pmap->pr_mflags & ~(MA_BREAK | MA_STACK)) ==
500 		    (mptr->map_pmap.pr_mflags & ~(MA_BREAK | MA_STACK)) &&
501 		    pmap->pr_pagesize == mptr->map_pmap.pr_pagesize &&
502 		    pmap->pr_shmid == mptr->map_pmap.pr_shmid &&
503 		    strcmp(pmap->pr_mapname, mptr->map_pmap.pr_mapname) == 0) {
504 
505 			/*
506 			 * This mapping matches exactly.  Copy over the old
507 			 * mapping, taking care to get the latest flags.
508 			 * Make sure the associated file_info_t is updated
509 			 * appropriately.
510 			 */
511 			*newp = *mptr;
512 			if (P->map_exec == mptr)
513 				P->map_exec = newp;
514 			if (P->map_ldso == mptr)
515 				P->map_ldso = newp;
516 			newp->map_pmap.pr_mflags = pmap->pr_mflags;
517 			if (mptr->map_file != NULL &&
518 			    mptr->map_file->file_map == mptr)
519 				mptr->map_file->file_map = newp;
520 			oldmapcount--;
521 			mptr++;
522 
523 		} else if (pmap->pr_vaddr + pmap->pr_size >
524 		    mptr->map_pmap.pr_vaddr) {
525 
526 			/*
527 			 * The old mapping doesn't exist any more, remove it
528 			 * from the list.
529 			 */
530 			map_info_free(P, mptr);
531 			oldmapcount--;
532 			i--;
533 			newp--;
534 			pmap--;
535 			mptr++;
536 
537 		} else {
538 
539 			/*
540 			 * This is a new mapping, add it directly.
541 			 */
542 			newp->map_pmap = *pmap;
543 		}
544 	}
545 
546 	/*
547 	 * Free any old maps
548 	 */
549 	while (oldmapcount) {
550 		map_info_free(P, mptr);
551 		oldmapcount--;
552 		mptr++;
553 	}
554 
555 	free(Pmap);
556 	if (P->mappings != NULL)
557 		free(P->mappings);
558 	P->mappings = newmap;
559 	P->map_count = P->map_alloc = nmap;
560 	P->info_valid = 1;
561 
562 	/*
563 	 * Consult librtld_db to get the load object
564 	 * names for all of the shared libraries.
565 	 */
566 	if (P->rap != NULL)
567 		(void) rd_loadobj_iter(P->rap, map_iter, P);
568 }
569 
570 /*
571  * Update all of the mappings and rtld_db as if by Pupdate_maps(), and then
572  * forcibly cache all of the symbol tables associated with all object files.
573  */
574 void
575 Pupdate_syms(struct ps_prochandle *P)
576 {
577 	file_info_t *fptr;
578 	int i;
579 
580 	Pupdate_maps(P);
581 
582 	for (i = 0, fptr = list_next(&P->file_head); i < P->num_files;
583 	    i++, fptr = list_next(fptr)) {
584 		Pbuild_file_symtab(P, fptr);
585 		(void) Pbuild_file_ctf(P, fptr);
586 	}
587 }
588 
589 /*
590  * Return the librtld_db agent handle for the victim process.
591  * The handle will become invalid at the next successful exec() and the
592  * client (caller of proc_rd_agent()) must not use it beyond that point.
593  * If the process is already dead, we've already tried our best to
594  * create the agent during core file initialization.
595  */
596 rd_agent_t *
597 Prd_agent(struct ps_prochandle *P)
598 {
599 	if (P->rap == NULL && P->state != PS_DEAD && P->state != PS_IDLE) {
600 		Pupdate_maps(P);
601 		if (P->num_files == 0)
602 			load_static_maps(P);
603 		rd_log(_libproc_debug);
604 		if ((P->rap = rd_new(P)) != NULL)
605 			(void) rd_loadobj_iter(P->rap, map_iter, P);
606 	}
607 	return (P->rap);
608 }
609 
610 /*
611  * Return the prmap_t structure containing 'addr', but only if it
612  * is in the dynamic linker's link map and is the text section.
613  */
614 const prmap_t *
615 Paddr_to_text_map(struct ps_prochandle *P, uintptr_t addr)
616 {
617 	map_info_t *mptr;
618 
619 	if (!P->info_valid)
620 		Pupdate_maps(P);
621 
622 	if ((mptr = Paddr2mptr(P, addr)) != NULL) {
623 		file_info_t *fptr = build_map_symtab(P, mptr);
624 		const prmap_t *pmp = &mptr->map_pmap;
625 
626 		/*
627 		 * Assume that if rl_data_base is NULL, it means that no
628 		 * data section was found for this load object, and that
629 		 * a section must be text. Otherwise, a section will be
630 		 * text unless it ends above the start of the data
631 		 * section.
632 		 */
633 		if (fptr != NULL && fptr->file_lo != NULL &&
634 		    (fptr->file_lo->rl_data_base == (uintptr_t)NULL ||
635 		    pmp->pr_vaddr + pmp->pr_size <=
636 		    fptr->file_lo->rl_data_base))
637 			return (pmp);
638 	}
639 
640 	return (NULL);
641 }
642 
643 /*
644  * Return the prmap_t structure containing 'addr' (no restrictions on
645  * the type of mapping).
646  */
647 const prmap_t *
648 Paddr_to_map(struct ps_prochandle *P, uintptr_t addr)
649 {
650 	map_info_t *mptr;
651 
652 	if (!P->info_valid)
653 		Pupdate_maps(P);
654 
655 	if ((mptr = Paddr2mptr(P, addr)) != NULL)
656 		return (&mptr->map_pmap);
657 
658 	return (NULL);
659 }
660 
661 /*
662  * Convert a full or partial load object name to the prmap_t for its
663  * corresponding primary text mapping.
664  */
665 const prmap_t *
666 Plmid_to_map(struct ps_prochandle *P, Lmid_t lmid, const char *name)
667 {
668 	map_info_t *mptr;
669 
670 	if (name == PR_OBJ_EVERY)
671 		return (NULL); /* A reasonable mistake */
672 
673 	if ((mptr = object_name_to_map(P, lmid, name)) != NULL)
674 		return (&mptr->map_pmap);
675 
676 	return (NULL);
677 }
678 
679 const prmap_t *
680 Pname_to_map(struct ps_prochandle *P, const char *name)
681 {
682 	return (Plmid_to_map(P, PR_LMID_EVERY, name));
683 }
684 
685 const rd_loadobj_t *
686 Paddr_to_loadobj(struct ps_prochandle *P, uintptr_t addr)
687 {
688 	map_info_t *mptr;
689 
690 	if (!P->info_valid)
691 		Pupdate_maps(P);
692 
693 	if ((mptr = Paddr2mptr(P, addr)) == NULL)
694 		return (NULL);
695 
696 	/*
697 	 * By building the symbol table, we implicitly bring the PLT
698 	 * information up to date in the load object.
699 	 */
700 	(void) build_map_symtab(P, mptr);
701 
702 	return (mptr->map_file->file_lo);
703 }
704 
705 const rd_loadobj_t *
706 Plmid_to_loadobj(struct ps_prochandle *P, Lmid_t lmid, const char *name)
707 {
708 	map_info_t *mptr;
709 
710 	if (name == PR_OBJ_EVERY)
711 		return (NULL);
712 
713 	if ((mptr = object_name_to_map(P, lmid, name)) == NULL)
714 		return (NULL);
715 
716 	/*
717 	 * By building the symbol table, we implicitly bring the PLT
718 	 * information up to date in the load object.
719 	 */
720 	(void) build_map_symtab(P, mptr);
721 
722 	return (mptr->map_file->file_lo);
723 }
724 
725 const rd_loadobj_t *
726 Pname_to_loadobj(struct ps_prochandle *P, const char *name)
727 {
728 	return (Plmid_to_loadobj(P, PR_LMID_EVERY, name));
729 }
730 
731 ctf_file_t *
732 Pbuild_file_ctf(struct ps_prochandle *P, file_info_t *fptr)
733 {
734 	ctf_sect_t ctdata, symtab, strtab;
735 	sym_tbl_t *symp;
736 	int err;
737 
738 	if (fptr->file_ctfp != NULL)
739 		return (fptr->file_ctfp);
740 
741 	Pbuild_file_symtab(P, fptr);
742 
743 	if (fptr->file_ctf_size == 0)
744 		return (NULL);
745 
746 	symp = fptr->file_ctf_dyn ? &fptr->file_dynsym : &fptr->file_symtab;
747 	if (symp->sym_data_pri == NULL)
748 		return (NULL);
749 
750 	/*
751 	 * The buffer may alread be allocated if this is a core file that
752 	 * contained CTF data for this file.
753 	 */
754 	if (fptr->file_ctf_buf == NULL) {
755 		fptr->file_ctf_buf = malloc(fptr->file_ctf_size);
756 		if (fptr->file_ctf_buf == NULL) {
757 			dprintf("failed to allocate ctf buffer\n");
758 			return (NULL);
759 		}
760 
761 		if (pread(fptr->file_fd, fptr->file_ctf_buf,
762 		    fptr->file_ctf_size, fptr->file_ctf_off) !=
763 		    fptr->file_ctf_size) {
764 			free(fptr->file_ctf_buf);
765 			fptr->file_ctf_buf = NULL;
766 			dprintf("failed to read ctf data\n");
767 			return (NULL);
768 		}
769 	}
770 
771 	ctdata.cts_name = ".SUNW_ctf";
772 	ctdata.cts_type = SHT_PROGBITS;
773 	ctdata.cts_flags = 0;
774 	ctdata.cts_data = fptr->file_ctf_buf;
775 	ctdata.cts_size = fptr->file_ctf_size;
776 	ctdata.cts_entsize = 1;
777 	ctdata.cts_offset = 0;
778 
779 	symtab.cts_name = fptr->file_ctf_dyn ? ".dynsym" : ".symtab";
780 	symtab.cts_type = symp->sym_hdr_pri.sh_type;
781 	symtab.cts_flags = symp->sym_hdr_pri.sh_flags;
782 	symtab.cts_data = symp->sym_data_pri->d_buf;
783 	symtab.cts_size = symp->sym_hdr_pri.sh_size;
784 	symtab.cts_entsize = symp->sym_hdr_pri.sh_entsize;
785 	symtab.cts_offset = symp->sym_hdr_pri.sh_offset;
786 
787 	strtab.cts_name = fptr->file_ctf_dyn ? ".dynstr" : ".strtab";
788 	strtab.cts_type = symp->sym_strhdr.sh_type;
789 	strtab.cts_flags = symp->sym_strhdr.sh_flags;
790 	strtab.cts_data = symp->sym_strs;
791 	strtab.cts_size = symp->sym_strhdr.sh_size;
792 	strtab.cts_entsize = symp->sym_strhdr.sh_entsize;
793 	strtab.cts_offset = symp->sym_strhdr.sh_offset;
794 
795 	fptr->file_ctfp = ctf_bufopen(&ctdata, &symtab, &strtab, &err);
796 	if (fptr->file_ctfp == NULL) {
797 		dprintf("ctf_bufopen() failed, error code %d\n", err);
798 		free(fptr->file_ctf_buf);
799 		fptr->file_ctf_buf = NULL;
800 		return (NULL);
801 	}
802 
803 	dprintf("loaded %lu bytes of CTF data for %s\n",
804 	    (ulong_t)fptr->file_ctf_size, fptr->file_pname);
805 
806 	return (fptr->file_ctfp);
807 }
808 
809 ctf_file_t *
810 Paddr_to_ctf(struct ps_prochandle *P, uintptr_t addr)
811 {
812 	map_info_t *mptr;
813 	file_info_t *fptr;
814 
815 	if (!P->info_valid)
816 		Pupdate_maps(P);
817 
818 	if ((mptr = Paddr2mptr(P, addr)) == NULL ||
819 	    (fptr = mptr->map_file) == NULL)
820 		return (NULL);
821 
822 	return (Pbuild_file_ctf(P, fptr));
823 }
824 
825 ctf_file_t *
826 Plmid_to_ctf(struct ps_prochandle *P, Lmid_t lmid, const char *name)
827 {
828 	map_info_t *mptr;
829 	file_info_t *fptr = NULL;
830 
831 	if (name == PR_OBJ_EVERY)
832 		return (NULL);
833 
834 	/*
835 	 * While most idle files are all ELF objects, not all of them have
836 	 * mapping information available. There's nothing which would make
837 	 * sense to fake up for ET_REL. Instead, if we're being asked for their
838 	 * executable object and we know that the information is valid and they
839 	 * only have a single file, we jump straight to that file pointer.
840 	 */
841 	if (P->state == PS_IDLE && name == PR_OBJ_EXEC && P->info_valid == 1 &&
842 	    P->num_files == 1 && P->mappings == NULL) {
843 		fptr = list_next(&P->file_head);
844 	}
845 
846 	if (fptr == NULL) {
847 		if ((mptr = object_name_to_map(P, lmid, name)) == NULL ||
848 		    (fptr = mptr->map_file) == NULL)
849 			return (NULL);
850 	}
851 
852 	return (Pbuild_file_ctf(P, fptr));
853 }
854 
855 ctf_file_t *
856 Pname_to_ctf(struct ps_prochandle *P, const char *name)
857 {
858 	return (Plmid_to_ctf(P, PR_LMID_EVERY, name));
859 }
860 
861 void
862 Preadauxvec(struct ps_prochandle *P)
863 {
864 	if (P->auxv != NULL) {
865 		free(P->auxv);
866 		P->auxv = NULL;
867 		P->nauxv = 0;
868 	}
869 
870 	P->ops.pop_read_aux(P, &P->auxv, &P->nauxv, P->data);
871 }
872 
873 /*
874  * Return a requested element from the process's aux vector.
875  * Return -1 on failure (this is adequate for our purposes).
876  */
877 long
878 Pgetauxval(struct ps_prochandle *P, int type)
879 {
880 	auxv_t *auxv;
881 
882 	if (P->auxv == NULL)
883 		Preadauxvec(P);
884 
885 	if (P->auxv == NULL)
886 		return (-1);
887 
888 	for (auxv = P->auxv; auxv->a_type != AT_NULL; auxv++) {
889 		if (auxv->a_type == type)
890 			return (auxv->a_un.a_val);
891 	}
892 
893 	return (-1);
894 }
895 
896 /*
897  * Return a pointer to our internal copy of the process's aux vector.
898  * The caller should not hold on to this pointer across any libproc calls.
899  */
900 const auxv_t *
901 Pgetauxvec(struct ps_prochandle *P)
902 {
903 	static const auxv_t empty = { AT_NULL, 0L };
904 
905 	if (P->auxv == NULL)
906 		Preadauxvec(P);
907 
908 	if (P->auxv == NULL)
909 		return (&empty);
910 
911 	return (P->auxv);
912 }
913 
914 /*
915  * Return 1 if the given mapping corresponds to the given file_info_t's
916  * load object; return 0 otherwise.
917  */
918 static int
919 is_mapping_in_file(struct ps_prochandle *P, map_info_t *mptr, file_info_t *fptr)
920 {
921 	prmap_t *pmap = &mptr->map_pmap;
922 	rd_loadobj_t *lop = fptr->file_lo;
923 	uint_t i;
924 	uintptr_t mstart, mend, sstart, send;
925 
926 	/*
927 	 * We can get for free the start address of the text and data
928 	 * sections of the load object. Start by seeing if the mapping
929 	 * encloses either of these.
930 	 */
931 	if ((pmap->pr_vaddr <= lop->rl_base &&
932 	    lop->rl_base < pmap->pr_vaddr + pmap->pr_size) ||
933 	    (pmap->pr_vaddr <= lop->rl_data_base &&
934 	    lop->rl_data_base < pmap->pr_vaddr + pmap->pr_size))
935 		return (1);
936 
937 	/*
938 	 * It's still possible that this mapping correponds to the load
939 	 * object. Consider the example of a mapping whose start and end
940 	 * addresses correspond to those of the load object's text section.
941 	 * If the mapping splits, e.g. as a result of a segment demotion,
942 	 * then although both mappings are still backed by the same section,
943 	 * only one will be seen to enclose that section's start address.
944 	 * Thus, to be rigorous, we ask not whether this mapping encloses
945 	 * the start of a section, but whether there exists a section that
946 	 * overlaps this mapping.
947 	 *
948 	 * If we don't already have the section addresses, and we successfully
949 	 * get them, then we cache them in case we come here again.
950 	 */
951 	if (fptr->file_saddrs == NULL &&
952 	    (fptr->file_saddrs = get_saddrs(P,
953 	    fptr->file_map->map_pmap.pr_vaddr, &fptr->file_nsaddrs)) == NULL)
954 		return (0);
955 
956 	mstart = mptr->map_pmap.pr_vaddr;
957 	mend = mptr->map_pmap.pr_vaddr + mptr->map_pmap.pr_size;
958 	for (i = 0; i < fptr->file_nsaddrs; i += 2) {
959 		/* Does this section overlap the mapping? */
960 		sstart = fptr->file_saddrs[i];
961 		send = fptr->file_saddrs[i + 1];
962 		if (!(mend <= sstart || mstart >= send))
963 			return (1);
964 	}
965 
966 	return (0);
967 }
968 
969 /*
970  * Find or build the symbol table for the given mapping.
971  */
972 static file_info_t *
973 build_map_symtab(struct ps_prochandle *P, map_info_t *mptr)
974 {
975 	prmap_t *pmap = &mptr->map_pmap;
976 	file_info_t *fptr;
977 	uint_t i;
978 
979 	if ((fptr = mptr->map_file) != NULL) {
980 		Pbuild_file_symtab(P, fptr);
981 		return (fptr);
982 	}
983 
984 	if (pmap->pr_mapname[0] == '\0')
985 		return (NULL);
986 
987 	/*
988 	 * Attempt to find a matching file.
989 	 * (A file can be mapped at several different addresses.)
990 	 */
991 	for (i = 0, fptr = list_next(&P->file_head); i < P->num_files;
992 	    i++, fptr = list_next(fptr)) {
993 		if (strcmp(fptr->file_pname, pmap->pr_mapname) == 0 &&
994 		    fptr->file_lo && is_mapping_in_file(P, mptr, fptr)) {
995 			mptr->map_file = fptr;
996 			fptr->file_ref++;
997 			Pbuild_file_symtab(P, fptr);
998 			return (fptr);
999 		}
1000 	}
1001 
1002 	/*
1003 	 * If we need to create a new file_info structure, iterate
1004 	 * through the load objects in order to attempt to connect
1005 	 * this new file with its primary text mapping.  We again
1006 	 * need to handle ld.so as a special case because we need
1007 	 * to be able to bootstrap librtld_db.
1008 	 */
1009 	if ((fptr = file_info_new(P, mptr)) == NULL)
1010 		return (NULL);
1011 
1012 	if (P->map_ldso != mptr) {
1013 		if (P->rap != NULL)
1014 			(void) rd_loadobj_iter(P->rap, map_iter, P);
1015 		else
1016 			(void) Prd_agent(P);
1017 	} else {
1018 		fptr->file_map = mptr;
1019 	}
1020 
1021 	/*
1022 	 * If librtld_db wasn't able to help us connect the file to a primary
1023 	 * text mapping, set file_map to the current mapping because we require
1024 	 * fptr->file_map to be set in Pbuild_file_symtab.  librtld_db may be
1025 	 * unaware of what's going on in the rare case that a legitimate ELF
1026 	 * file has been mmap(2)ed into the process address space *without*
1027 	 * the use of dlopen(3x).
1028 	 */
1029 	if (fptr->file_map == NULL)
1030 		fptr->file_map = mptr;
1031 
1032 	Pbuild_file_symtab(P, fptr);
1033 
1034 	return (fptr);
1035 }
1036 
1037 static int
1038 read_ehdr32(struct ps_prochandle *P, Elf32_Ehdr *ehdr, uint_t *phnum,
1039     uintptr_t addr)
1040 {
1041 	if (Pread(P, ehdr, sizeof (*ehdr), addr) != sizeof (*ehdr))
1042 		return (-1);
1043 
1044 	if (ehdr->e_ident[EI_MAG0] != ELFMAG0 ||
1045 	    ehdr->e_ident[EI_MAG1] != ELFMAG1 ||
1046 	    ehdr->e_ident[EI_MAG2] != ELFMAG2 ||
1047 	    ehdr->e_ident[EI_MAG3] != ELFMAG3 ||
1048 	    ehdr->e_ident[EI_CLASS] != ELFCLASS32 ||
1049 #ifdef _BIG_ENDIAN
1050 	    ehdr->e_ident[EI_DATA] != ELFDATA2MSB ||
1051 #else
1052 	    ehdr->e_ident[EI_DATA] != ELFDATA2LSB ||
1053 #endif
1054 	    ehdr->e_ident[EI_VERSION] != EV_CURRENT)
1055 		return (-1);
1056 
1057 	if ((*phnum = ehdr->e_phnum) == PN_XNUM) {
1058 		Elf32_Shdr shdr0;
1059 
1060 		if (ehdr->e_shoff == 0 || ehdr->e_shentsize < sizeof (shdr0) ||
1061 		    Pread(P, &shdr0, sizeof (shdr0), addr + ehdr->e_shoff) !=
1062 		    sizeof (shdr0))
1063 			return (-1);
1064 
1065 		if (shdr0.sh_info != 0)
1066 			*phnum = shdr0.sh_info;
1067 	}
1068 
1069 	return (0);
1070 }
1071 
1072 static int
1073 read_dynamic_phdr32(struct ps_prochandle *P, const Elf32_Ehdr *ehdr,
1074     uint_t phnum, Elf32_Phdr *phdr, uintptr_t addr)
1075 {
1076 	uint_t i;
1077 
1078 	for (i = 0; i < phnum; i++) {
1079 		uintptr_t a = addr + ehdr->e_phoff + i * ehdr->e_phentsize;
1080 		if (Pread(P, phdr, sizeof (*phdr), a) != sizeof (*phdr))
1081 			return (-1);
1082 
1083 		if (phdr->p_type == PT_DYNAMIC)
1084 			return (0);
1085 	}
1086 
1087 	return (-1);
1088 }
1089 
1090 #ifdef _LP64
1091 static int
1092 read_ehdr64(struct ps_prochandle *P, Elf64_Ehdr *ehdr, uint_t *phnum,
1093     uintptr_t addr)
1094 {
1095 	if (Pread(P, ehdr, sizeof (Elf64_Ehdr), addr) != sizeof (Elf64_Ehdr))
1096 		return (-1);
1097 
1098 	if (ehdr->e_ident[EI_MAG0] != ELFMAG0 ||
1099 	    ehdr->e_ident[EI_MAG1] != ELFMAG1 ||
1100 	    ehdr->e_ident[EI_MAG2] != ELFMAG2 ||
1101 	    ehdr->e_ident[EI_MAG3] != ELFMAG3 ||
1102 	    ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
1103 #ifdef _BIG_ENDIAN
1104 	    ehdr->e_ident[EI_DATA] != ELFDATA2MSB ||
1105 #else
1106 	    ehdr->e_ident[EI_DATA] != ELFDATA2LSB ||
1107 #endif
1108 	    ehdr->e_ident[EI_VERSION] != EV_CURRENT)
1109 		return (-1);
1110 
1111 	if ((*phnum = ehdr->e_phnum) == PN_XNUM) {
1112 		Elf64_Shdr shdr0;
1113 
1114 		if (ehdr->e_shoff == 0 || ehdr->e_shentsize < sizeof (shdr0) ||
1115 		    Pread(P, &shdr0, sizeof (shdr0), addr + ehdr->e_shoff) !=
1116 		    sizeof (shdr0))
1117 			return (-1);
1118 
1119 		if (shdr0.sh_info != 0)
1120 			*phnum = shdr0.sh_info;
1121 	}
1122 
1123 	return (0);
1124 }
1125 
1126 static int
1127 read_dynamic_phdr64(struct ps_prochandle *P, const Elf64_Ehdr *ehdr,
1128     uint_t phnum, Elf64_Phdr *phdr, uintptr_t addr)
1129 {
1130 	uint_t i;
1131 
1132 	for (i = 0; i < phnum; i++) {
1133 		uintptr_t a = addr + ehdr->e_phoff + i * ehdr->e_phentsize;
1134 		if (Pread(P, phdr, sizeof (*phdr), a) != sizeof (*phdr))
1135 			return (-1);
1136 
1137 		if (phdr->p_type == PT_DYNAMIC)
1138 			return (0);
1139 	}
1140 
1141 	return (-1);
1142 }
1143 #endif	/* _LP64 */
1144 
1145 /*
1146  * The text segment for each load object contains the elf header and
1147  * program headers. We can use this information to determine if the
1148  * file that corresponds to the load object is the same file that
1149  * was loaded into the process's address space. There can be a discrepency
1150  * if a file is recompiled after the process is started or if the target
1151  * represents a core file from a differently configured system -- two
1152  * common examples. The DT_CHECKSUM entry in the dynamic section
1153  * provides an easy method of comparison. It is important to note that
1154  * the dynamic section usually lives in the data segment, but the meta
1155  * data we use to find the dynamic section lives in the text segment so
1156  * if either of those segments is absent we can't proceed.
1157  *
1158  * We're looking through the elf file for several items: the symbol tables
1159  * (both dynsym and symtab), the procedure linkage table (PLT) base,
1160  * size, and relocation base, and the CTF information. Most of this can
1161  * be recovered from the loaded image of the file itself, the exceptions
1162  * being the symtab and CTF data.
1163  *
1164  * First we try to open the file that we think corresponds to the load
1165  * object, if the DT_CHECKSUM values match, we're all set, and can simply
1166  * recover all the information we need from the file. If the values of
1167  * DT_CHECKSUM don't match, or if we can't access the file for whatever
1168  * reasaon, we fake up a elf file to use in its stead. If we can't read
1169  * the elf data in the process's address space, we fall back to using
1170  * the file even though it may give inaccurate information.
1171  *
1172  * The elf file that we fake up has to consist of sections for the
1173  * dynsym, the PLT and the dynamic section. Note that in the case of a
1174  * core file, we'll get the CTF data in the file_info_t later on from
1175  * a section embedded the core file (if it's present).
1176  *
1177  * file_differs() conservatively looks for mismatched files, identifying
1178  * a match when there is any ambiguity (since that's the legacy behavior).
1179  */
1180 static int
1181 file_differs(struct ps_prochandle *P, Elf *elf, file_info_t *fptr)
1182 {
1183 	Elf_Scn *scn;
1184 	GElf_Shdr shdr;
1185 	GElf_Dyn dyn;
1186 	Elf_Data *data;
1187 	uint_t i, ndyn;
1188 	GElf_Xword cksum;
1189 	uintptr_t addr;
1190 
1191 	if (fptr->file_map == NULL)
1192 		return (0);
1193 
1194 	if ((Pcontent(P) & (CC_CONTENT_TEXT | CC_CONTENT_DATA)) !=
1195 	    (CC_CONTENT_TEXT | CC_CONTENT_DATA))
1196 		return (0);
1197 
1198 	/*
1199 	 * First, we find the checksum value in the elf file.
1200 	 */
1201 	scn = NULL;
1202 	while ((scn = elf_nextscn(elf, scn)) != NULL) {
1203 		if (gelf_getshdr(scn, &shdr) != NULL &&
1204 		    shdr.sh_type == SHT_DYNAMIC)
1205 			goto found_shdr;
1206 	}
1207 	return (0);
1208 
1209 found_shdr:
1210 	if ((data = elf_getdata(scn, NULL)) == NULL)
1211 		return (0);
1212 
1213 	if (P->status.pr_dmodel == PR_MODEL_ILP32)
1214 		ndyn = shdr.sh_size / sizeof (Elf32_Dyn);
1215 #ifdef _LP64
1216 	else if (P->status.pr_dmodel == PR_MODEL_LP64)
1217 		ndyn = shdr.sh_size / sizeof (Elf64_Dyn);
1218 #endif
1219 	else
1220 		return (0);
1221 
1222 	for (i = 0; i < ndyn; i++) {
1223 		if (gelf_getdyn(data, i, &dyn) != NULL &&
1224 		    dyn.d_tag == DT_CHECKSUM)
1225 			goto found_cksum;
1226 	}
1227 
1228 	/*
1229 	 * The in-memory ELF has no DT_CHECKSUM section, but we will report it
1230 	 * as matching the file anyhow.
1231 	 */
1232 	return (0);
1233 
1234 found_cksum:
1235 	cksum = dyn.d_un.d_val;
1236 	dprintf("elf cksum value is %llx\n", (u_longlong_t)cksum);
1237 
1238 	/*
1239 	 * Get the base of the text mapping that corresponds to this file.
1240 	 */
1241 	addr = fptr->file_map->map_pmap.pr_vaddr;
1242 
1243 	if (P->status.pr_dmodel == PR_MODEL_ILP32) {
1244 		Elf32_Ehdr ehdr;
1245 		Elf32_Phdr phdr;
1246 		Elf32_Dyn dync, *dynp;
1247 		uint_t phnum, i;
1248 
1249 		if (read_ehdr32(P, &ehdr, &phnum, addr) != 0 ||
1250 		    read_dynamic_phdr32(P, &ehdr, phnum, &phdr, addr) != 0)
1251 			return (0);
1252 
1253 		if (ehdr.e_type == ET_DYN)
1254 			phdr.p_vaddr += addr;
1255 		if ((dynp = malloc(phdr.p_filesz)) == NULL)
1256 			return (0);
1257 		dync.d_tag = DT_NULL;
1258 		if (Pread(P, dynp, phdr.p_filesz, phdr.p_vaddr) !=
1259 		    phdr.p_filesz) {
1260 			free(dynp);
1261 			return (0);
1262 		}
1263 
1264 		for (i = 0; i < phdr.p_filesz / sizeof (Elf32_Dyn); i++) {
1265 			if (dynp[i].d_tag == DT_CHECKSUM)
1266 				dync = dynp[i];
1267 		}
1268 
1269 		free(dynp);
1270 
1271 		if (dync.d_tag != DT_CHECKSUM)
1272 			return (0);
1273 
1274 		dprintf("image cksum value is %llx\n",
1275 		    (u_longlong_t)dync.d_un.d_val);
1276 		return (dync.d_un.d_val != cksum);
1277 #ifdef _LP64
1278 	} else if (P->status.pr_dmodel == PR_MODEL_LP64) {
1279 		Elf64_Ehdr ehdr;
1280 		Elf64_Phdr phdr;
1281 		Elf64_Dyn dync, *dynp;
1282 		uint_t phnum, i;
1283 
1284 		if (read_ehdr64(P, &ehdr, &phnum, addr) != 0 ||
1285 		    read_dynamic_phdr64(P, &ehdr, phnum, &phdr, addr) != 0)
1286 			return (0);
1287 
1288 		if (ehdr.e_type == ET_DYN)
1289 			phdr.p_vaddr += addr;
1290 		if ((dynp = malloc(phdr.p_filesz)) == NULL)
1291 			return (0);
1292 		dync.d_tag = DT_NULL;
1293 		if (Pread(P, dynp, phdr.p_filesz, phdr.p_vaddr) !=
1294 		    phdr.p_filesz) {
1295 			free(dynp);
1296 			return (0);
1297 		}
1298 
1299 		for (i = 0; i < phdr.p_filesz / sizeof (Elf64_Dyn); i++) {
1300 			if (dynp[i].d_tag == DT_CHECKSUM)
1301 				dync = dynp[i];
1302 		}
1303 
1304 		free(dynp);
1305 
1306 		if (dync.d_tag != DT_CHECKSUM)
1307 			return (0);
1308 
1309 		dprintf("image cksum value is %llx\n",
1310 		    (u_longlong_t)dync.d_un.d_val);
1311 		return (dync.d_un.d_val != cksum);
1312 #endif	/* _LP64 */
1313 	}
1314 
1315 	return (0);
1316 }
1317 
1318 /*
1319  * Read data from the specified process and construct an in memory
1320  * image of an ELF file that represents it well enough to let
1321  * us probe it for information.
1322  */
1323 static Elf *
1324 fake_elf(struct ps_prochandle *P, file_info_t *fptr)
1325 {
1326 	Elf *elf;
1327 	uintptr_t addr;
1328 	uint_t phnum;
1329 
1330 	if (fptr->file_map == NULL)
1331 		return (NULL);
1332 
1333 	if ((Pcontent(P) & (CC_CONTENT_TEXT | CC_CONTENT_DATA)) !=
1334 	    (CC_CONTENT_TEXT | CC_CONTENT_DATA))
1335 		return (NULL);
1336 
1337 	addr = fptr->file_map->map_pmap.pr_vaddr;
1338 
1339 	if (P->status.pr_dmodel == PR_MODEL_ILP32) {
1340 		Elf32_Ehdr ehdr;
1341 		Elf32_Phdr phdr;
1342 
1343 		if ((read_ehdr32(P, &ehdr, &phnum, addr) != 0) ||
1344 		    read_dynamic_phdr32(P, &ehdr, phnum, &phdr, addr) != 0)
1345 			return (NULL);
1346 
1347 		elf = fake_elf32(P, fptr, addr, &ehdr, phnum, &phdr);
1348 #ifdef _LP64
1349 	} else {
1350 		Elf64_Ehdr ehdr;
1351 		Elf64_Phdr phdr;
1352 
1353 		if (read_ehdr64(P, &ehdr, &phnum, addr) != 0 ||
1354 		    read_dynamic_phdr64(P, &ehdr, phnum, &phdr, addr) != 0)
1355 			return (NULL);
1356 
1357 		elf = fake_elf64(P, fptr, addr, &ehdr, phnum, &phdr);
1358 #endif
1359 	}
1360 
1361 	return (elf);
1362 }
1363 
1364 /*
1365  * We wouldn't need these if qsort(3C) took an argument for the callback...
1366  */
1367 static mutex_t sort_mtx = DEFAULTMUTEX;
1368 static char *sort_strs;
1369 static GElf_Sym *sort_syms;
1370 
1371 int
1372 byaddr_cmp_common(GElf_Sym *a, char *aname, GElf_Sym *b, char *bname)
1373 {
1374 	if (a->st_value < b->st_value)
1375 		return (-1);
1376 	if (a->st_value > b->st_value)
1377 		return (1);
1378 
1379 	/*
1380 	 * Prefer the function to the non-function.
1381 	 */
1382 	if (GELF_ST_TYPE(a->st_info) != GELF_ST_TYPE(b->st_info)) {
1383 		if (GELF_ST_TYPE(a->st_info) == STT_FUNC)
1384 			return (-1);
1385 		if (GELF_ST_TYPE(b->st_info) == STT_FUNC)
1386 			return (1);
1387 	}
1388 
1389 	/*
1390 	 * Prefer the weak or strong global symbol to the local symbol.
1391 	 */
1392 	if (GELF_ST_BIND(a->st_info) != GELF_ST_BIND(b->st_info)) {
1393 		if (GELF_ST_BIND(b->st_info) == STB_LOCAL)
1394 			return (-1);
1395 		if (GELF_ST_BIND(a->st_info) == STB_LOCAL)
1396 			return (1);
1397 	}
1398 
1399 	/*
1400 	 * Prefer the symbol that doesn't begin with a '$' since compilers and
1401 	 * other symbol generators often use it as a prefix.
1402 	 */
1403 	if (*bname == '$')
1404 		return (-1);
1405 	if (*aname == '$')
1406 		return (1);
1407 
1408 	/*
1409 	 * Prefer the name with fewer leading underscores in the name.
1410 	 */
1411 	while (*aname == '_' && *bname == '_') {
1412 		aname++;
1413 		bname++;
1414 	}
1415 
1416 	if (*bname == '_')
1417 		return (-1);
1418 	if (*aname == '_')
1419 		return (1);
1420 
1421 	/*
1422 	 * Prefer the symbol with the smaller size.
1423 	 */
1424 	if (a->st_size < b->st_size)
1425 		return (-1);
1426 	if (a->st_size > b->st_size)
1427 		return (1);
1428 
1429 	/*
1430 	 * All other factors being equal, fall back to lexicographic order.
1431 	 */
1432 	return (strcmp(aname, bname));
1433 }
1434 
1435 static int
1436 byaddr_cmp(const void *aa, const void *bb)
1437 {
1438 	GElf_Sym *a = &sort_syms[*(uint_t *)aa];
1439 	GElf_Sym *b = &sort_syms[*(uint_t *)bb];
1440 	char *aname = sort_strs + a->st_name;
1441 	char *bname = sort_strs + b->st_name;
1442 
1443 	return (byaddr_cmp_common(a, aname, b, bname));
1444 }
1445 
1446 static int
1447 byname_cmp(const void *aa, const void *bb)
1448 {
1449 	GElf_Sym *a = &sort_syms[*(uint_t *)aa];
1450 	GElf_Sym *b = &sort_syms[*(uint_t *)bb];
1451 	char *aname = sort_strs + a->st_name;
1452 	char *bname = sort_strs + b->st_name;
1453 
1454 	return (strcmp(aname, bname));
1455 }
1456 
1457 /*
1458  * Given a symbol index, look up the corresponding symbol from the
1459  * given symbol table.
1460  *
1461  * This function allows the caller to treat the symbol table as a single
1462  * logical entity even though there may be 2 actual ELF symbol tables
1463  * involved. See the comments in Pcontrol.h for details.
1464  */
1465 static GElf_Sym *
1466 symtab_getsym(sym_tbl_t *symtab, int ndx, GElf_Sym *dst)
1467 {
1468 	/* If index is in range of primary symtab, look it up there */
1469 	if (ndx >= symtab->sym_symn_aux) {
1470 		return (gelf_getsym(symtab->sym_data_pri,
1471 		    ndx - symtab->sym_symn_aux, dst));
1472 	}
1473 
1474 	/* Not in primary: Look it up in the auxiliary symtab */
1475 	return (gelf_getsym(symtab->sym_data_aux, ndx, dst));
1476 }
1477 
1478 void
1479 optimize_symtab(sym_tbl_t *symtab)
1480 {
1481 	GElf_Sym *symp, *syms;
1482 	uint_t i, *indexa, *indexb;
1483 	size_t symn, strsz, count;
1484 
1485 	if (symtab == NULL || symtab->sym_data_pri == NULL ||
1486 	    symtab->sym_byaddr != NULL)
1487 		return;
1488 
1489 	symn = symtab->sym_symn;
1490 	strsz = symtab->sym_strsz;
1491 
1492 	symp = syms = malloc(sizeof (GElf_Sym) * symn);
1493 	if (symp == NULL) {
1494 		dprintf("optimize_symtab: failed to malloc symbol array");
1495 		return;
1496 	}
1497 
1498 	/*
1499 	 * First record all the symbols into a table and count up the ones
1500 	 * that we're interested in. We mark symbols as invalid by setting
1501 	 * the st_name to an illegal value.
1502 	 */
1503 	for (i = 0, count = 0; i < symn; i++, symp++) {
1504 		if (symtab_getsym(symtab, i, symp) != NULL &&
1505 		    symp->st_name < strsz &&
1506 		    IS_DATA_TYPE(GELF_ST_TYPE(symp->st_info)))
1507 			count++;
1508 		else
1509 			symp->st_name = strsz;
1510 	}
1511 
1512 	/*
1513 	 * Allocate sufficient space for both tables and populate them
1514 	 * with the same symbols we just counted.
1515 	 */
1516 	symtab->sym_count = count;
1517 	indexa = symtab->sym_byaddr = calloc(sizeof (uint_t), count);
1518 	indexb = symtab->sym_byname = calloc(sizeof (uint_t), count);
1519 	if (indexa == NULL || indexb == NULL) {
1520 		dprintf(
1521 		    "optimize_symtab: failed to malloc symbol index arrays");
1522 		symtab->sym_count = 0;
1523 		if (indexa != NULL) {	/* First alloc succeeded. Free it */
1524 			free(indexa);
1525 			symtab->sym_byaddr = NULL;
1526 		}
1527 		free(syms);
1528 		return;
1529 	}
1530 	for (i = 0, symp = syms; i < symn; i++, symp++) {
1531 		if (symp->st_name < strsz)
1532 			*indexa++ = *indexb++ = i;
1533 	}
1534 
1535 	/*
1536 	 * Sort the two tables according to the appropriate criteria,
1537 	 * unless the user has overridden this behaviour.
1538 	 *
1539 	 * An example where we might not sort the tables is the relatively
1540 	 * unusual case of a process with very large symbol tables in which
1541 	 * we perform few lookups. In such a case the total time would be
1542 	 * dominated by the sort. It is difficult to determine a priori
1543 	 * how many lookups an arbitrary client will perform, and
1544 	 * hence whether the symbol tables should be sorted. We therefore
1545 	 * sort the tables by default, but provide the user with a
1546 	 * "chicken switch" in the form of the LIBPROC_NO_QSORT
1547 	 * environment variable.
1548 	 */
1549 	if (!_libproc_no_qsort) {
1550 		(void) mutex_lock(&sort_mtx);
1551 		sort_strs = symtab->sym_strs;
1552 		sort_syms = syms;
1553 
1554 		qsort(symtab->sym_byaddr, count, sizeof (uint_t), byaddr_cmp);
1555 		qsort(symtab->sym_byname, count, sizeof (uint_t), byname_cmp);
1556 
1557 		sort_strs = NULL;
1558 		sort_syms = NULL;
1559 		(void) mutex_unlock(&sort_mtx);
1560 	}
1561 
1562 	free(syms);
1563 }
1564 
1565 
1566 static Elf *
1567 build_fake_elf(struct ps_prochandle *P, file_info_t *fptr, GElf_Ehdr *ehdr,
1568     size_t *nshdrs, Elf_Data **shdata)
1569 {
1570 	size_t shstrndx;
1571 	Elf_Scn *scn;
1572 	Elf *elf;
1573 
1574 	if ((elf = fake_elf(P, fptr)) == NULL ||
1575 	    elf_kind(elf) != ELF_K_ELF ||
1576 	    gelf_getehdr(elf, ehdr) == NULL ||
1577 	    elf_getshdrnum(elf, nshdrs) == -1 ||
1578 	    elf_getshdrstrndx(elf, &shstrndx) == -1 ||
1579 	    (scn = elf_getscn(elf, shstrndx)) == NULL ||
1580 	    (*shdata = elf_getdata(scn, NULL)) == NULL) {
1581 		if (elf != NULL)
1582 			(void) elf_end(elf);
1583 		dprintf("failed to fake up ELF file\n");
1584 		return (NULL);
1585 	}
1586 
1587 	return (elf);
1588 }
1589 
1590 /*
1591  * Try and find the file described by path in the file system and validate that
1592  * it matches our CRC before we try and process it for symbol information.
1593  *
1594  * Before we validate the crc, we check to ensure that it's a normal file
1595  * and not anything else.
1596  */
1597 static boolean_t
1598 build_alt_debug(file_info_t *fptr, const char *path, uint32_t crc)
1599 {
1600 	int fd;
1601 	struct stat st;
1602 	Elf *elf;
1603 	Elf_Scn *scn;
1604 	GElf_Shdr symshdr, strshdr;
1605 	Elf_Data *symdata, *strdata;
1606 	uint32_t c = -1U;
1607 
1608 	if ((fd = open(path, O_RDONLY)) < 0)
1609 		return (B_FALSE);
1610 
1611 	if (fstat(fd, &st) != 0) {
1612 		(void) close(fd);
1613 		return (B_FALSE);
1614 	}
1615 
1616 	if (S_ISREG(st.st_mode) == 0) {
1617 		(void) close(fd);
1618 		return (B_FALSE);
1619 	}
1620 
1621 	for (;;) {
1622 		char buf[4096];
1623 		ssize_t ret = read(fd, buf, sizeof (buf));
1624 		if (ret == -1) {
1625 			if (ret == EINTR)
1626 				continue;
1627 			(void) close(fd);
1628 			return (B_FALSE);
1629 		}
1630 		if (ret == 0) {
1631 			c = ~c;
1632 			if (c != crc) {
1633 				dprintf("crc mismatch, found: 0x%x "
1634 				    "expected 0x%x\n", c, crc);
1635 				(void) close(fd);
1636 				return (B_FALSE);
1637 			}
1638 			break;
1639 		}
1640 		CRC32(c, buf, ret, c, psym_crc32);
1641 	}
1642 
1643 	elf = elf_begin(fd, ELF_C_READ, NULL);
1644 	if (elf == NULL) {
1645 		(void) close(fd);
1646 		return (B_FALSE);
1647 	}
1648 
1649 	if (elf_kind(elf) != ELF_K_ELF) {
1650 		goto fail;
1651 	}
1652 
1653 	/*
1654 	 * Do two passes, first see if we have a symbol header, then see if we
1655 	 * can find the corresponding linked string table.
1656 	 */
1657 	scn = NULL;
1658 	for (scn = elf_nextscn(elf, scn); scn != NULL;
1659 	    scn = elf_nextscn(elf, scn)) {
1660 
1661 		if (gelf_getshdr(scn, &symshdr) == NULL)
1662 			goto fail;
1663 
1664 		if (symshdr.sh_type != SHT_SYMTAB)
1665 			continue;
1666 
1667 		if ((symdata = elf_getdata(scn, NULL)) == NULL)
1668 			goto fail;
1669 
1670 		break;
1671 	}
1672 	if (scn == NULL)
1673 		goto fail;
1674 
1675 	if ((scn = elf_getscn(elf, symshdr.sh_link)) == NULL)
1676 		goto fail;
1677 
1678 	if (gelf_getshdr(scn, &strshdr) == NULL)
1679 		goto fail;
1680 
1681 	if ((strdata = elf_getdata(scn, NULL)) == NULL)
1682 		goto fail;
1683 
1684 	fptr->file_symtab.sym_data_pri = symdata;
1685 	fptr->file_symtab.sym_symn += symshdr.sh_size / symshdr.sh_entsize;
1686 	fptr->file_symtab.sym_strs = strdata->d_buf;
1687 	fptr->file_symtab.sym_strsz = strdata->d_size;
1688 	fptr->file_symtab.sym_hdr_pri = symshdr;
1689 	fptr->file_symtab.sym_strhdr = strshdr;
1690 
1691 	dprintf("successfully loaded additional debug symbols for %s from %s\n",
1692 	    fptr->file_rname, path);
1693 
1694 	fptr->file_dbgfile = fd;
1695 	fptr->file_dbgelf = elf;
1696 	return (B_TRUE);
1697 fail:
1698 	(void) elf_end(elf);
1699 	(void) close(fd);
1700 	return (B_FALSE);
1701 }
1702 
1703 /*
1704  * We're here because the object in question has no symbol information, that's a
1705  * bit unfortunate. However, we've found that there's a .gnu_debuglink sitting
1706  * around. By convention that means that given the current location of the
1707  * object on disk, and the debug name that we found in the binary we need to
1708  * search the following locations for a matching file.
1709  *
1710  * <dirname>/.debug/<debug-name>
1711  * /usr/lib/debug/<dirname>/<debug-name>
1712  *
1713  * In the future, we should consider supporting looking in the prefix's
1714  * lib/debug directory for a matching object.
1715  */
1716 static void
1717 find_alt_debug(file_info_t *fptr, const char *name, uint32_t crc)
1718 {
1719 	boolean_t r;
1720 	char *dup = NULL, *path = NULL, *dname;
1721 
1722 	dprintf("find_alt_debug: looking for %s, crc 0x%x\n", name, crc);
1723 	if (fptr->file_rname == NULL) {
1724 		dprintf("find_alt_debug: encountered null file_rname\n");
1725 		return;
1726 	}
1727 
1728 	dup = strdup(fptr->file_rname);
1729 	if (dup == NULL)
1730 		return;
1731 
1732 	dname = dirname(dup);
1733 	if (asprintf(&path, "%s/.debug/%s", dname, name) != -1) {
1734 		dprintf("attempting to load alternate debug information "
1735 		    "from %s\n", path);
1736 		r = build_alt_debug(fptr, path, crc);
1737 		free(path);
1738 		if (r == B_TRUE)
1739 			goto out;
1740 	}
1741 
1742 	if (asprintf(&path, "/usr/lib/debug/%s/%s", dname, name) != -1) {
1743 		dprintf("attempting to load alternate debug information "
1744 		    "from %s\n", path);
1745 		r = build_alt_debug(fptr, path, crc);
1746 		free(path);
1747 		if (r == B_TRUE)
1748 			goto out;
1749 	}
1750 out:
1751 	free(dup);
1752 }
1753 
1754 /*
1755  * Build the symbol table for the given mapped file.
1756  */
1757 void
1758 Pbuild_file_symtab(struct ps_prochandle *P, file_info_t *fptr)
1759 {
1760 	char objectfile[PATH_MAX];
1761 	uint_t i;
1762 
1763 	GElf_Ehdr ehdr;
1764 	GElf_Sym s;
1765 
1766 	Elf_Data *shdata;
1767 	Elf_Scn *scn;
1768 	Elf *elf;
1769 	size_t nshdrs, shstrndx;
1770 
1771 	struct {
1772 		GElf_Shdr c_shdr;
1773 		Elf_Data *c_data;
1774 		const char *c_name;
1775 	} *cp, *cache = NULL, *dyn = NULL, *plt = NULL, *ctf = NULL,
1776 	*dbglink = NULL;
1777 
1778 	if (fptr->file_init)
1779 		return;	/* We've already processed this file */
1780 
1781 	/*
1782 	 * Mark the file_info struct as having the symbol table initialized
1783 	 * even if we fail below.  We tried once; we don't try again.
1784 	 */
1785 	fptr->file_init = 1;
1786 
1787 	if (elf_version(EV_CURRENT) == EV_NONE) {
1788 		dprintf("libproc ELF version is more recent than libelf\n");
1789 		return;
1790 	}
1791 
1792 	if (P->state == PS_DEAD || P->state == PS_IDLE) {
1793 		char *name;
1794 		/*
1795 		 * If we're a not live, we can't open files from the /proc
1796 		 * object directory; we have only the mapping and file names
1797 		 * to guide us.  We prefer the file_lname, but need to handle
1798 		 * the case of it being NULL in order to bootstrap: we first
1799 		 * come here during rd_new() when the only information we have
1800 		 * is interpreter name associated with the AT_BASE mapping.
1801 		 *
1802 		 * Also, if the zone associated with the core file seems
1803 		 * to exists on this machine we'll try to open the object
1804 		 * file within the zone.
1805 		 */
1806 		if (fptr->file_rname != NULL)
1807 			name = fptr->file_rname;
1808 		else if (fptr->file_lname != NULL)
1809 			name = fptr->file_lname;
1810 		else
1811 			name = fptr->file_pname;
1812 		(void) strlcpy(objectfile, name, sizeof (objectfile));
1813 	} else {
1814 		(void) snprintf(objectfile, sizeof (objectfile),
1815 		    "%s/%d/object/%s",
1816 		    procfs_path, (int)P->pid, fptr->file_pname);
1817 	}
1818 
1819 	/*
1820 	 * Open the object file, create the elf file, and then get the elf
1821 	 * header and .shstrtab data buffer so we can process sections by
1822 	 * name. If anything goes wrong try to fake up an elf file from
1823 	 * the in-core elf image.
1824 	 */
1825 
1826 	if (_libproc_incore_elf || (P->flags & INCORE)) {
1827 		dprintf("Pbuild_file_symtab: using in-core data for: %s\n",
1828 		    fptr->file_pname);
1829 
1830 		if ((elf = build_fake_elf(P, fptr, &ehdr, &nshdrs, &shdata)) ==
1831 		    NULL)
1832 			return;
1833 
1834 	} else if ((fptr->file_fd = open(objectfile, O_RDONLY)) < 0) {
1835 		dprintf("Pbuild_file_symtab: failed to open %s: %s\n",
1836 		    objectfile, strerror(errno));
1837 
1838 		if ((elf = build_fake_elf(P, fptr, &ehdr, &nshdrs, &shdata)) ==
1839 		    NULL)
1840 			return;
1841 
1842 	} else if ((elf = elf_begin(fptr->file_fd, ELF_C_READ, NULL)) == NULL ||
1843 	    elf_kind(elf) != ELF_K_ELF ||
1844 	    gelf_getehdr(elf, &ehdr) == NULL ||
1845 	    elf_getshdrnum(elf, &nshdrs) == -1 ||
1846 	    elf_getshdrstrndx(elf, &shstrndx) == -1 ||
1847 	    (scn = elf_getscn(elf, shstrndx)) == NULL ||
1848 	    (shdata = elf_getdata(scn, NULL)) == NULL) {
1849 		int err = elf_errno();
1850 
1851 		dprintf("failed to process ELF file %s: %s\n",
1852 		    objectfile, (err == 0) ? "<null>" : elf_errmsg(err));
1853 		(void) elf_end(elf);
1854 
1855 		if ((elf = build_fake_elf(P, fptr, &ehdr, &nshdrs, &shdata)) ==
1856 		    NULL)
1857 			return;
1858 
1859 	} else if (file_differs(P, elf, fptr)) {
1860 		Elf *newelf;
1861 
1862 		/*
1863 		 * Before we get too excited about this elf file, we'll check
1864 		 * its checksum value against the value we have in memory. If
1865 		 * they don't agree, we try to fake up a new elf file and
1866 		 * proceed with that instead.
1867 		 */
1868 		dprintf("ELF file %s (%lx) doesn't match in-core image\n",
1869 		    fptr->file_pname,
1870 		    (ulong_t)fptr->file_map->map_pmap.pr_vaddr);
1871 
1872 		if ((newelf = build_fake_elf(P, fptr, &ehdr, &nshdrs, &shdata))
1873 		    != NULL) {
1874 			(void) elf_end(elf);
1875 			elf = newelf;
1876 			dprintf("switched to faked up ELF file\n");
1877 
1878 			/*
1879 			 * Check to see if the file that we just discovered
1880 			 * to be an imposter matches the execname that was
1881 			 * determined by Pfindexec().  If it does, we (clearly)
1882 			 * don't have the right binary, and we zero out
1883 			 * execname before anyone gets hurt.
1884 			 */
1885 			if (fptr->file_rname != NULL && P->execname != NULL &&
1886 			    strcmp(fptr->file_rname, P->execname) == 0) {
1887 				dprintf("file/in-core image mismatch was "
1888 				    "on P->execname; discarding\n");
1889 				free(P->execname);
1890 				P->execname = NULL;
1891 			}
1892 		}
1893 	}
1894 
1895 	if ((cache = malloc(nshdrs * sizeof (*cache))) == NULL) {
1896 		dprintf("failed to malloc section cache for %s\n", objectfile);
1897 		goto bad;
1898 	}
1899 
1900 	dprintf("processing ELF file %s\n", objectfile);
1901 	fptr->file_class = ehdr.e_ident[EI_CLASS];
1902 	fptr->file_etype = ehdr.e_type;
1903 	fptr->file_elf = elf;
1904 	fptr->file_shstrs = shdata->d_buf;
1905 	fptr->file_shstrsz = shdata->d_size;
1906 
1907 	/*
1908 	 * Iterate through each section, caching its section header, data
1909 	 * pointer, and name.  We use this for handling sh_link values below.
1910 	 */
1911 	for (cp = cache + 1, scn = NULL; scn = elf_nextscn(elf, scn); cp++) {
1912 		if (gelf_getshdr(scn, &cp->c_shdr) == NULL) {
1913 			dprintf("Pbuild_file_symtab: Failed to get section "
1914 			    "header\n");
1915 			goto bad; /* Failed to get section header */
1916 		}
1917 
1918 		if ((cp->c_data = elf_getdata(scn, NULL)) == NULL) {
1919 			dprintf("Pbuild_file_symtab: Failed to get section "
1920 			    "data\n");
1921 			goto bad; /* Failed to get section data */
1922 		}
1923 
1924 		if (cp->c_shdr.sh_name >= shdata->d_size) {
1925 			dprintf("Pbuild_file_symtab: corrupt section name");
1926 			goto bad; /* Corrupt section name */
1927 		}
1928 
1929 		cp->c_name = (const char *)shdata->d_buf + cp->c_shdr.sh_name;
1930 	}
1931 
1932 	/*
1933 	 * Now iterate through the section cache in order to locate info
1934 	 * for the .symtab, .dynsym, .SUNW_ldynsym, .dynamic, .plt,
1935 	 * and .SUNW_ctf sections:
1936 	 */
1937 	for (i = 1, cp = cache + 1; i < nshdrs; i++, cp++) {
1938 		GElf_Shdr *shp = &cp->c_shdr;
1939 
1940 		if (shp->sh_type == SHT_SYMTAB || shp->sh_type == SHT_DYNSYM) {
1941 			sym_tbl_t *symp = shp->sh_type == SHT_SYMTAB ?
1942 			    &fptr->file_symtab : &fptr->file_dynsym;
1943 			/*
1944 			 * It's possible that the we already got the symbol
1945 			 * table from the core file itself. Either the file
1946 			 * differs in which case our faked up elf file will
1947 			 * only contain the dynsym (not the symtab) or the
1948 			 * file matches in which case we'll just be replacing
1949 			 * the symbol table we pulled out of the core file
1950 			 * with an equivalent one. In either case, this
1951 			 * check isn't essential, but it's a good idea.
1952 			 */
1953 			if (symp->sym_data_pri == NULL) {
1954 				dprintf("Symbol table found for %s\n",
1955 				    objectfile);
1956 				symp->sym_data_pri = cp->c_data;
1957 				symp->sym_symn +=
1958 				    shp->sh_size / shp->sh_entsize;
1959 				symp->sym_strs =
1960 				    cache[shp->sh_link].c_data->d_buf;
1961 				symp->sym_strsz =
1962 				    cache[shp->sh_link].c_data->d_size;
1963 				symp->sym_hdr_pri = cp->c_shdr;
1964 				symp->sym_strhdr = cache[shp->sh_link].c_shdr;
1965 			} else {
1966 				dprintf("Symbol table already there for %s\n",
1967 				    objectfile);
1968 			}
1969 		} else if (shp->sh_type == SHT_SUNW_LDYNSYM) {
1970 			/* .SUNW_ldynsym section is auxiliary to .dynsym */
1971 			if (fptr->file_dynsym.sym_data_aux == NULL) {
1972 				dprintf(".SUNW_ldynsym symbol table"
1973 				    " found for %s\n", objectfile);
1974 				fptr->file_dynsym.sym_data_aux = cp->c_data;
1975 				fptr->file_dynsym.sym_symn_aux =
1976 				    shp->sh_size / shp->sh_entsize;
1977 				fptr->file_dynsym.sym_symn +=
1978 				    fptr->file_dynsym.sym_symn_aux;
1979 				fptr->file_dynsym.sym_hdr_aux = cp->c_shdr;
1980 			} else {
1981 				dprintf(".SUNW_ldynsym symbol table already"
1982 				    " there for %s\n", objectfile);
1983 			}
1984 		} else if (shp->sh_type == SHT_DYNAMIC) {
1985 			dyn = cp;
1986 		} else if (strcmp(cp->c_name, ".plt") == 0) {
1987 			plt = cp;
1988 		} else if (strcmp(cp->c_name, ".SUNW_ctf") == 0) {
1989 			/*
1990 			 * Skip over bogus CTF sections so they don't come back
1991 			 * to haunt us later.
1992 			 */
1993 			if (shp->sh_link == 0 ||
1994 			    shp->sh_link >= nshdrs ||
1995 			    (cache[shp->sh_link].c_shdr.sh_type != SHT_DYNSYM &&
1996 			    cache[shp->sh_link].c_shdr.sh_type != SHT_SYMTAB)) {
1997 				dprintf("Bad sh_link %d for "
1998 				    "CTF\n", shp->sh_link);
1999 				continue;
2000 			}
2001 			ctf = cp;
2002 		} else if (strcmp(cp->c_name, ".gnu_debuglink") == 0) {
2003 			dprintf("found .gnu_debuglink section for %s\n",
2004 			    fptr->file_rname);
2005 			/*
2006 			 * Let's make sure of a few things before we do this.
2007 			 */
2008 			if (cp->c_shdr.sh_type == SHT_PROGBITS &&
2009 			    cp->c_data->d_buf != NULL) {
2010 				dprintf(".gnu_debuglink passes initial "
2011 				    "sanity\n");
2012 				dbglink = cp;
2013 			}
2014 		}
2015 	}
2016 
2017 	/*
2018 	 * If we haven't found any symbol table information and we have found a
2019 	 * .gnu_debuglink, it's time to try and figure out where we might find
2020 	 * this. To do so, we're going to first verify that the elf data seems
2021 	 * somewhat sane, eg. the elf data should be a string, so we want to
2022 	 * verify we have a null-terminator.
2023 	 */
2024 	if (fptr->file_symtab.sym_data_pri == NULL && dbglink != NULL) {
2025 		char *c = dbglink->c_data->d_buf;
2026 		size_t i;
2027 		boolean_t found = B_FALSE;
2028 		Elf_Data *ed = dbglink->c_data;
2029 		uint32_t crc;
2030 
2031 		for (i = 0; i < ed->d_size; i++) {
2032 			if (c[i] == '\0') {
2033 				uintptr_t off;
2034 				dprintf("got .gnu_debuglink terminator at "
2035 				    "offset %lu\n", (unsigned long)i);
2036 				/*
2037 				 * After the null terminator, there should be
2038 				 * padding, followed by a 4 byte CRC of the
2039 				 * file. If we don't see this, we're going to
2040 				 * assume this is bogus.
2041 				 */
2042 				if ((i % sizeof (uint32_t)) == 0) {
2043 					i += 4;
2044 				} else {
2045 					i += sizeof (uint32_t) -
2046 					    (i % sizeof (uint32_t));
2047 				}
2048 				if (i + sizeof (uint32_t) ==
2049 				    dbglink->c_data->d_size) {
2050 					found = B_TRUE;
2051 					off = (uintptr_t)ed->d_buf + i;
2052 					crc = *(uint32_t *)off;
2053 				} else {
2054 					dprintf(".gnu_debuglink size mismatch, "
2055 					    "expected: %lu, found: %lu\n",
2056 					    (unsigned long)i,
2057 					    (unsigned long)ed->d_size);
2058 				}
2059 				break;
2060 			}
2061 		}
2062 
2063 		if (found == B_TRUE)
2064 			find_alt_debug(fptr, dbglink->c_data->d_buf, crc);
2065 	}
2066 
2067 	/*
2068 	 * At this point, we've found all the symbol tables we're ever going
2069 	 * to find: the ones in the loop above and possibly the symtab that
2070 	 * was included in the core file. Before we perform any lookups, we
2071 	 * create sorted versions to optimize for lookups.
2072 	 */
2073 	optimize_symtab(&fptr->file_symtab);
2074 	optimize_symtab(&fptr->file_dynsym);
2075 
2076 	/*
2077 	 * Fill in the base address of the text mapping for shared libraries.
2078 	 * This allows us to translate symbols before librtld_db is ready.
2079 	 */
2080 	if (fptr->file_etype == ET_DYN) {
2081 		fptr->file_dyn_base = fptr->file_map->map_pmap.pr_vaddr -
2082 		    fptr->file_map->map_pmap.pr_offset;
2083 		dprintf("setting file_dyn_base for %s to %lx\n",
2084 		    objectfile, (long)fptr->file_dyn_base);
2085 	}
2086 
2087 	/*
2088 	 * Record the CTF section information in the file info structure.
2089 	 */
2090 	if (ctf != NULL) {
2091 		fptr->file_ctf_off = ctf->c_shdr.sh_offset;
2092 		fptr->file_ctf_size = ctf->c_shdr.sh_size;
2093 		if (ctf->c_shdr.sh_link != 0 &&
2094 		    cache[ctf->c_shdr.sh_link].c_shdr.sh_type == SHT_DYNSYM)
2095 			fptr->file_ctf_dyn = 1;
2096 	}
2097 
2098 	if (fptr->file_lo == NULL)
2099 		goto done; /* Nothing else to do if no load object info */
2100 
2101 	/*
2102 	 * If the object is a shared library and we have a different rl_base
2103 	 * value, reset file_dyn_base according to librtld_db's information.
2104 	 */
2105 	if (fptr->file_etype == ET_DYN &&
2106 	    fptr->file_lo->rl_base != fptr->file_dyn_base) {
2107 		dprintf("resetting file_dyn_base for %s to %lx\n",
2108 		    objectfile, (long)fptr->file_lo->rl_base);
2109 		fptr->file_dyn_base = fptr->file_lo->rl_base;
2110 	}
2111 
2112 	/*
2113 	 * Fill in the PLT information for this file if a PLT symbol is found.
2114 	 */
2115 	if (sym_by_name(&fptr->file_dynsym, "_PROCEDURE_LINKAGE_TABLE_", &s,
2116 	    NULL) != NULL) {
2117 		fptr->file_plt_base = s.st_value + fptr->file_dyn_base;
2118 		fptr->file_plt_size = (plt != NULL) ? plt->c_shdr.sh_size : 0;
2119 
2120 		/*
2121 		 * Bring the load object up to date; it is the only way the
2122 		 * user has to access the PLT data. The PLT information in the
2123 		 * rd_loadobj_t is not set in the call to map_iter() (the
2124 		 * callback for rd_loadobj_iter) where we set file_lo.
2125 		 */
2126 		fptr->file_lo->rl_plt_base = fptr->file_plt_base;
2127 		fptr->file_lo->rl_plt_size = fptr->file_plt_size;
2128 
2129 		dprintf("PLT found at %p, size = %lu\n",
2130 		    (void *)fptr->file_plt_base, (ulong_t)fptr->file_plt_size);
2131 	}
2132 
2133 	/*
2134 	 * Fill in the PLT information.
2135 	 */
2136 	if (dyn != NULL) {
2137 		uintptr_t dynaddr = dyn->c_shdr.sh_addr + fptr->file_dyn_base;
2138 		size_t ndyn = dyn->c_shdr.sh_size / dyn->c_shdr.sh_entsize;
2139 		GElf_Dyn d;
2140 
2141 		for (i = 0; i < ndyn; i++) {
2142 			if (gelf_getdyn(dyn->c_data, i, &d) == NULL)
2143 				continue;
2144 
2145 			switch (d.d_tag) {
2146 			case DT_JMPREL:
2147 				dprintf("DT_JMPREL is %p\n",
2148 				    (void *)(uintptr_t)d.d_un.d_ptr);
2149 				fptr->file_jmp_rel =
2150 				    d.d_un.d_ptr + fptr->file_dyn_base;
2151 				break;
2152 			case DT_STRTAB:
2153 				dprintf("DT_STRTAB is %p\n",
2154 				    (void *)(uintptr_t)d.d_un.d_ptr);
2155 				break;
2156 			case DT_PLTGOT:
2157 				dprintf("DT_PLTGOT is %p\n",
2158 				    (void *)(uintptr_t)d.d_un.d_ptr);
2159 				break;
2160 			case DT_SUNW_SYMTAB:
2161 				dprintf("DT_SUNW_SYMTAB is %p\n",
2162 				    (void *)(uintptr_t)d.d_un.d_ptr);
2163 				break;
2164 			case DT_SYMTAB:
2165 				dprintf("DT_SYMTAB is %p\n",
2166 				    (void *)(uintptr_t)d.d_un.d_ptr);
2167 				break;
2168 			case DT_HASH:
2169 				dprintf("DT_HASH is %p\n",
2170 				    (void *)(uintptr_t)d.d_un.d_ptr);
2171 				break;
2172 			}
2173 		}
2174 
2175 		dprintf("_DYNAMIC found at %p, %lu entries, DT_JMPREL = %p\n",
2176 		    (void *)dynaddr, (ulong_t)ndyn, (void *)fptr->file_jmp_rel);
2177 	}
2178 
2179 done:
2180 	free(cache);
2181 	return;
2182 
2183 bad:
2184 	if (cache != NULL)
2185 		free(cache);
2186 
2187 	(void) elf_end(elf);
2188 	fptr->file_elf = NULL;
2189 	if (fptr->file_elfmem != NULL) {
2190 		free(fptr->file_elfmem);
2191 		fptr->file_elfmem = NULL;
2192 	}
2193 	(void) close(fptr->file_fd);
2194 	if (fptr->file_dbgelf != NULL)
2195 		(void) elf_end(fptr->file_dbgelf);
2196 	fptr->file_dbgelf = NULL;
2197 	if (fptr->file_dbgfile >= 0)
2198 		(void) close(fptr->file_dbgfile);
2199 	fptr->file_fd = -1;
2200 	fptr->file_dbgfile = -1;
2201 }
2202 
2203 /*
2204  * Given a process virtual address, return the map_info_t containing it.
2205  * If none found, return NULL.
2206  */
2207 map_info_t *
2208 Paddr2mptr(struct ps_prochandle *P, uintptr_t addr)
2209 {
2210 	int lo = 0;
2211 	int hi = P->map_count - 1;
2212 	int mid;
2213 	map_info_t *mp;
2214 
2215 	while (lo <= hi) {
2216 
2217 		mid = (lo + hi) / 2;
2218 		mp = &P->mappings[mid];
2219 
2220 		/* check that addr is in [vaddr, vaddr + size) */
2221 		if ((addr - mp->map_pmap.pr_vaddr) < mp->map_pmap.pr_size)
2222 			return (mp);
2223 
2224 		if (addr < mp->map_pmap.pr_vaddr)
2225 			hi = mid - 1;
2226 		else
2227 			lo = mid + 1;
2228 	}
2229 
2230 	return (NULL);
2231 }
2232 
2233 /*
2234  * Return the map_info_t for the executable file.
2235  * If not found, return NULL.
2236  */
2237 static map_info_t *
2238 exec_map(struct ps_prochandle *P)
2239 {
2240 	uint_t i;
2241 	map_info_t *mptr;
2242 	map_info_t *mold = NULL;
2243 	file_info_t *fptr;
2244 	uintptr_t base;
2245 
2246 	for (i = 0, mptr = P->mappings; i < P->map_count; i++, mptr++) {
2247 		if (mptr->map_pmap.pr_mapname[0] == '\0')
2248 			continue;
2249 		if (strcmp(mptr->map_pmap.pr_mapname, "a.out") == 0) {
2250 			if ((fptr = mptr->map_file) != NULL &&
2251 			    fptr->file_lo != NULL) {
2252 				base = fptr->file_lo->rl_base;
2253 				if (base >= mptr->map_pmap.pr_vaddr &&
2254 				    base < mptr->map_pmap.pr_vaddr +
2255 				    mptr->map_pmap.pr_size)	/* text space */
2256 					return (mptr);
2257 				mold = mptr;	/* must be the data */
2258 				continue;
2259 			}
2260 			/* This is a poor way to test for text space */
2261 			if (!(mptr->map_pmap.pr_mflags & MA_EXEC) ||
2262 			    (mptr->map_pmap.pr_mflags & MA_WRITE)) {
2263 				mold = mptr;
2264 				continue;
2265 			}
2266 			return (mptr);
2267 		}
2268 	}
2269 
2270 	return (mold);
2271 }
2272 
2273 /*
2274  * Given a shared object name, return the map_info_t for it.  If no matching
2275  * object is found, return NULL.  Normally, the link maps contain the full
2276  * object pathname, e.g. /usr/lib/libc.so.1.  We allow the object name to
2277  * take one of the following forms:
2278  *
2279  * 1. An exact match (i.e. a full pathname): "/usr/lib/libc.so.1"
2280  * 2. An exact basename match: "libc.so.1"
2281  * 3. An initial basename match up to a '.' suffix: "libc.so" or "libc"
2282  * 4. The literal string "a.out" is an alias for the executable mapping
2283  *
2284  * The third case is a convenience for callers and may not be necessary.
2285  *
2286  * As the exact same object name may be loaded on different link maps (see
2287  * dlmopen(3DL)), we also allow the caller to resolve the object name by
2288  * specifying a particular link map id.  If lmid is PR_LMID_EVERY, the
2289  * first matching name will be returned, regardless of the link map id.
2290  */
2291 static map_info_t *
2292 object_to_map(struct ps_prochandle *P, Lmid_t lmid, const char *objname)
2293 {
2294 	map_info_t *mp;
2295 	file_info_t *fp;
2296 	size_t objlen;
2297 	uint_t i;
2298 
2299 	/*
2300 	 * If we have no rtld_db, then always treat a request as one for all
2301 	 * link maps.
2302 	 */
2303 	if (P->rap == NULL)
2304 		lmid = PR_LMID_EVERY;
2305 
2306 	/*
2307 	 * First pass: look for exact matches of the entire pathname or
2308 	 * basename (cases 1 and 2 above):
2309 	 */
2310 	for (i = 0, mp = P->mappings; i < P->map_count; i++, mp++) {
2311 
2312 		if (mp->map_pmap.pr_mapname[0] == '\0' ||
2313 		    (fp = mp->map_file) == NULL ||
2314 		    ((fp->file_lname == NULL) && (fp->file_rname == NULL)))
2315 			continue;
2316 
2317 		if (lmid != PR_LMID_EVERY &&
2318 		    (fp->file_lo == NULL || lmid != fp->file_lo->rl_lmident))
2319 			continue;
2320 
2321 		/*
2322 		 * If we match, return the primary text mapping; otherwise
2323 		 * just return the mapping we matched.
2324 		 */
2325 		if ((fp->file_lbase && strcmp(fp->file_lbase, objname) == 0) ||
2326 		    (fp->file_rbase && strcmp(fp->file_rbase, objname) == 0) ||
2327 		    (fp->file_lname && strcmp(fp->file_lname, objname) == 0) ||
2328 		    (fp->file_rname && strcmp(fp->file_rname, objname) == 0))
2329 			return (fp->file_map ? fp->file_map : mp);
2330 	}
2331 
2332 	objlen = strlen(objname);
2333 
2334 	/*
2335 	 * Second pass: look for partial matches (case 3 above):
2336 	 */
2337 	for (i = 0, mp = P->mappings; i < P->map_count; i++, mp++) {
2338 
2339 		if (mp->map_pmap.pr_mapname[0] == '\0' ||
2340 		    (fp = mp->map_file) == NULL ||
2341 		    ((fp->file_lname == NULL) && (fp->file_rname == NULL)))
2342 			continue;
2343 
2344 		if (lmid != PR_LMID_EVERY &&
2345 		    (fp->file_lo == NULL || lmid != fp->file_lo->rl_lmident))
2346 			continue;
2347 
2348 		/*
2349 		 * If we match, return the primary text mapping; otherwise
2350 		 * just return the mapping we matched.
2351 		 */
2352 		if ((fp->file_lbase != NULL) &&
2353 		    (strncmp(fp->file_lbase, objname, objlen) == 0) &&
2354 		    (fp->file_lbase[objlen] == '.'))
2355 			return (fp->file_map ? fp->file_map : mp);
2356 		if ((fp->file_rbase != NULL) &&
2357 		    (strncmp(fp->file_rbase, objname, objlen) == 0) &&
2358 		    (fp->file_rbase[objlen] == '.'))
2359 			return (fp->file_map ? fp->file_map : mp);
2360 	}
2361 
2362 	/*
2363 	 * One last check: we allow "a.out" to always alias the executable,
2364 	 * assuming this name was not in use for something else.
2365 	 */
2366 	if ((lmid == PR_LMID_EVERY || lmid == LM_ID_BASE) &&
2367 	    (strcmp(objname, "a.out") == 0))
2368 		return (P->map_exec);
2369 
2370 	return (NULL);
2371 }
2372 
2373 static map_info_t *
2374 object_name_to_map(struct ps_prochandle *P, Lmid_t lmid, const char *name)
2375 {
2376 	map_info_t *mptr;
2377 
2378 	if (!P->info_valid)
2379 		Pupdate_maps(P);
2380 
2381 	if (P->map_exec == NULL && ((mptr = Paddr2mptr(P,
2382 	    Pgetauxval(P, AT_ENTRY))) != NULL || (mptr = exec_map(P)) != NULL))
2383 		P->map_exec = mptr;
2384 
2385 	if (P->map_ldso == NULL && (mptr = Paddr2mptr(P,
2386 	    Pgetauxval(P, AT_BASE))) != NULL)
2387 		P->map_ldso = mptr;
2388 
2389 	if (name == PR_OBJ_EXEC)
2390 		mptr = P->map_exec;
2391 	else if (name == PR_OBJ_LDSO)
2392 		mptr = P->map_ldso;
2393 	else if (Prd_agent(P) != NULL || P->state == PS_IDLE)
2394 		mptr = object_to_map(P, lmid, name);
2395 	else
2396 		mptr = NULL;
2397 
2398 	return (mptr);
2399 }
2400 
2401 /*
2402  * When two symbols are found by address, decide which one is to be preferred.
2403  */
2404 static GElf_Sym *
2405 sym_prefer(GElf_Sym *sym1, char *name1, GElf_Sym *sym2, char *name2)
2406 {
2407 	/*
2408 	 * Prefer the non-NULL symbol.
2409 	 */
2410 	if (sym1 == NULL)
2411 		return (sym2);
2412 	if (sym2 == NULL)
2413 		return (sym1);
2414 
2415 	/*
2416 	 * Defer to the sort ordering...
2417 	 */
2418 	return (byaddr_cmp_common(sym1, name1, sym2, name2) <= 0 ? sym1 : sym2);
2419 }
2420 
2421 /*
2422  * Use a binary search to do the work of sym_by_addr().
2423  */
2424 static GElf_Sym *
2425 sym_by_addr_binary(sym_tbl_t *symtab, GElf_Addr addr, GElf_Sym *symp,
2426     uint_t *idp)
2427 {
2428 	GElf_Sym sym, osym;
2429 	uint_t i, oid, *byaddr = symtab->sym_byaddr;
2430 	int min, max, mid, omid, found = 0;
2431 
2432 	if (symtab->sym_data_pri == NULL || symtab->sym_count == 0)
2433 		return (NULL);
2434 
2435 	min = 0;
2436 	max = symtab->sym_count - 1;
2437 	osym.st_value = 0;
2438 
2439 	/*
2440 	 * We can't return when we've found a match, we have to continue
2441 	 * searching for the closest matching symbol.
2442 	 */
2443 	while (min <= max) {
2444 		mid = (max + min) / 2;
2445 
2446 		i = byaddr[mid];
2447 		(void) symtab_getsym(symtab, i, &sym);
2448 
2449 		if (addr >= sym.st_value &&
2450 		    addr < sym.st_value + sym.st_size &&
2451 		    (!found || sym.st_value > osym.st_value)) {
2452 			osym = sym;
2453 			omid = mid;
2454 			oid = i;
2455 			found = 1;
2456 		}
2457 
2458 		if (addr < sym.st_value)
2459 			max = mid - 1;
2460 		else
2461 			min = mid + 1;
2462 	}
2463 
2464 	if (!found)
2465 		return (NULL);
2466 
2467 	/*
2468 	 * There may be many symbols with identical values so we walk
2469 	 * backward in the byaddr table to find the best match.
2470 	 */
2471 	do {
2472 		sym = osym;
2473 		i = oid;
2474 
2475 		if (omid == 0)
2476 			break;
2477 
2478 		oid = byaddr[--omid];
2479 		(void) symtab_getsym(symtab, oid, &osym);
2480 	} while (addr >= osym.st_value &&
2481 	    addr < sym.st_value + osym.st_size &&
2482 	    osym.st_value == sym.st_value);
2483 
2484 	*symp = sym;
2485 	if (idp != NULL)
2486 		*idp = i;
2487 	return (symp);
2488 }
2489 
2490 /*
2491  * Use a linear search to do the work of sym_by_addr().
2492  */
2493 static GElf_Sym *
2494 sym_by_addr_linear(sym_tbl_t *symtab, GElf_Addr addr, GElf_Sym *symbolp,
2495     uint_t *idp)
2496 {
2497 	size_t symn = symtab->sym_symn;
2498 	char *strs = symtab->sym_strs;
2499 	GElf_Sym sym, *symp = NULL;
2500 	GElf_Sym osym, *osymp = NULL;
2501 	int i, id;
2502 
2503 	if (symtab->sym_data_pri == NULL || symn == 0 || strs == NULL)
2504 		return (NULL);
2505 
2506 	for (i = 0; i < symn; i++) {
2507 		if ((symp = symtab_getsym(symtab, i, &sym)) != NULL) {
2508 			if (addr >= sym.st_value &&
2509 			    addr < sym.st_value + sym.st_size) {
2510 				if (osymp)
2511 					symp = sym_prefer(
2512 					    symp, strs + symp->st_name,
2513 					    osymp, strs + osymp->st_name);
2514 				if (symp != osymp) {
2515 					osym = sym;
2516 					osymp = &osym;
2517 					id = i;
2518 				}
2519 			}
2520 		}
2521 	}
2522 	if (osymp) {
2523 		*symbolp = osym;
2524 		if (idp)
2525 			*idp = id;
2526 		return (symbolp);
2527 	}
2528 	return (NULL);
2529 }
2530 
2531 /*
2532  * Look up a symbol by address in the specified symbol table.
2533  * Adjustment to 'addr' must already have been made for the
2534  * offset of the symbol if this is a dynamic library symbol table.
2535  *
2536  * Use a linear or a binary search depending on whether or not we
2537  * chose to sort the table in optimize_symtab().
2538  */
2539 static GElf_Sym *
2540 sym_by_addr(sym_tbl_t *symtab, GElf_Addr addr, GElf_Sym *symp, uint_t *idp)
2541 {
2542 	if (_libproc_no_qsort) {
2543 		return (sym_by_addr_linear(symtab, addr, symp, idp));
2544 	} else {
2545 		return (sym_by_addr_binary(symtab, addr, symp, idp));
2546 	}
2547 }
2548 
2549 /*
2550  * Use a binary search to do the work of sym_by_name().
2551  */
2552 static GElf_Sym *
2553 sym_by_name_binary(sym_tbl_t *symtab, const char *name, GElf_Sym *symp,
2554     uint_t *idp)
2555 {
2556 	char *strs = symtab->sym_strs;
2557 	uint_t i, *byname = symtab->sym_byname;
2558 	int min, mid, max, cmp;
2559 
2560 	if (symtab->sym_data_pri == NULL || strs == NULL ||
2561 	    symtab->sym_count == 0)
2562 		return (NULL);
2563 
2564 	min = 0;
2565 	max = symtab->sym_count - 1;
2566 
2567 	while (min <= max) {
2568 		mid = (max + min) / 2;
2569 
2570 		i = byname[mid];
2571 		(void) symtab_getsym(symtab, i, symp);
2572 
2573 		if ((cmp = strcmp(name, strs + symp->st_name)) == 0) {
2574 			if (idp != NULL)
2575 				*idp = i;
2576 			return (symp);
2577 		}
2578 
2579 		if (cmp < 0)
2580 			max = mid - 1;
2581 		else
2582 			min = mid + 1;
2583 	}
2584 
2585 	return (NULL);
2586 }
2587 
2588 /*
2589  * Use a linear search to do the work of sym_by_name().
2590  */
2591 static GElf_Sym *
2592 sym_by_name_linear(sym_tbl_t *symtab, const char *name, GElf_Sym *symp,
2593     uint_t *idp)
2594 {
2595 	size_t symn = symtab->sym_symn;
2596 	char *strs = symtab->sym_strs;
2597 	int i;
2598 
2599 	if (symtab->sym_data_pri == NULL || symn == 0 || strs == NULL)
2600 		return (NULL);
2601 
2602 	for (i = 0; i < symn; i++) {
2603 		if (symtab_getsym(symtab, i, symp) &&
2604 		    strcmp(name, strs + symp->st_name) == 0) {
2605 			if (idp)
2606 				*idp = i;
2607 			return (symp);
2608 		}
2609 	}
2610 
2611 	return (NULL);
2612 }
2613 
2614 /*
2615  * Look up a symbol by name in the specified symbol table.
2616  *
2617  * Use a linear or a binary search depending on whether or not we
2618  * chose to sort the table in optimize_symtab().
2619  */
2620 static GElf_Sym *
2621 sym_by_name(sym_tbl_t *symtab, const char *name, GElf_Sym *symp, uint_t *idp)
2622 {
2623 	if (_libproc_no_qsort) {
2624 		return (sym_by_name_linear(symtab, name, symp, idp));
2625 	} else {
2626 		return (sym_by_name_binary(symtab, name, symp, idp));
2627 	}
2628 }
2629 
2630 /*
2631  * Search the process symbol tables looking for a symbol whose
2632  * value to value+size contain the address specified by addr.
2633  * Return values are:
2634  *	sym_name_buffer containing the symbol name
2635  *	GElf_Sym symbol table entry
2636  *	prsyminfo_t ancillary symbol information
2637  * Returns 0 on success, -1 on failure.
2638  */
2639 static int
2640 i_Pxlookup_by_addr(
2641 	struct ps_prochandle *P,
2642 	int lmresolve,			/* use resolve linker object names */
2643 	uintptr_t addr,			/* process address being sought */
2644 	char *sym_name_buffer,		/* buffer for the symbol name */
2645 	size_t bufsize,			/* size of sym_name_buffer */
2646 	GElf_Sym *symbolp,		/* returned symbol table entry */
2647 	prsyminfo_t *sip)		/* returned symbol info */
2648 {
2649 	GElf_Sym	*symp;
2650 	char		*name;
2651 	GElf_Sym	sym1, *sym1p = NULL;
2652 	GElf_Sym	sym2, *sym2p = NULL;
2653 	char		*name1 = NULL;
2654 	char		*name2 = NULL;
2655 	uint_t		i1;
2656 	uint_t		i2;
2657 	map_info_t	*mptr;
2658 	file_info_t	*fptr;
2659 
2660 	(void) Prd_agent(P);
2661 
2662 	if ((mptr = Paddr2mptr(P, addr)) == NULL ||	/* no such address */
2663 	    (fptr = build_map_symtab(P, mptr)) == NULL || /* no mapped file */
2664 	    fptr->file_elf == NULL)			/* not an ELF file */
2665 		return (-1);
2666 
2667 	/*
2668 	 * Adjust the address by the load object base address in
2669 	 * case the address turns out to be in a shared library.
2670 	 */
2671 	addr -= fptr->file_dyn_base;
2672 
2673 	/*
2674 	 * Search both symbol tables, symtab first, then dynsym.
2675 	 */
2676 	if ((sym1p = sym_by_addr(&fptr->file_symtab, addr, &sym1, &i1)) != NULL)
2677 		name1 = fptr->file_symtab.sym_strs + sym1.st_name;
2678 	if ((sym2p = sym_by_addr(&fptr->file_dynsym, addr, &sym2, &i2)) != NULL)
2679 		name2 = fptr->file_dynsym.sym_strs + sym2.st_name;
2680 
2681 	if ((symp = sym_prefer(sym1p, name1, sym2p, name2)) == NULL)
2682 		return (-1);
2683 
2684 	name = (symp == sym1p) ? name1 : name2;
2685 	if (bufsize > 0) {
2686 		(void) strncpy(sym_name_buffer, name, bufsize);
2687 		sym_name_buffer[bufsize - 1] = '\0';
2688 	}
2689 
2690 	*symbolp = *symp;
2691 	if (sip != NULL) {
2692 		sip->prs_name = bufsize == 0 ? NULL : sym_name_buffer;
2693 		if (lmresolve && (fptr->file_rname != NULL))
2694 			sip->prs_object = fptr->file_rbase;
2695 		else
2696 			sip->prs_object = fptr->file_lbase;
2697 		sip->prs_id = (symp == sym1p) ? i1 : i2;
2698 		sip->prs_table = (symp == sym1p) ? PR_SYMTAB : PR_DYNSYM;
2699 		sip->prs_lmid = (fptr->file_lo == NULL) ? LM_ID_BASE :
2700 		    fptr->file_lo->rl_lmident;
2701 	}
2702 
2703 	if (GELF_ST_TYPE(symbolp->st_info) != STT_TLS)
2704 		symbolp->st_value += fptr->file_dyn_base;
2705 
2706 	return (0);
2707 }
2708 
2709 int
2710 Pxlookup_by_addr(struct ps_prochandle *P, uintptr_t addr, char *buf,
2711     size_t bufsize, GElf_Sym *symp, prsyminfo_t *sip)
2712 {
2713 	return (i_Pxlookup_by_addr(P, B_FALSE, addr, buf, bufsize, symp, sip));
2714 }
2715 
2716 int
2717 Pxlookup_by_addr_resolved(struct ps_prochandle *P, uintptr_t addr, char *buf,
2718     size_t bufsize, GElf_Sym *symp, prsyminfo_t *sip)
2719 {
2720 	return (i_Pxlookup_by_addr(P, B_TRUE, addr, buf, bufsize, symp, sip));
2721 }
2722 
2723 int
2724 Plookup_by_addr(struct ps_prochandle *P, uintptr_t addr, char *buf,
2725     size_t size, GElf_Sym *symp)
2726 {
2727 	return (i_Pxlookup_by_addr(P, B_FALSE, addr, buf, size, symp, NULL));
2728 }
2729 
2730 /*
2731  * Search the process symbol tables looking for a symbol whose name matches the
2732  * specified name and whose object and link map optionally match the specified
2733  * parameters.  On success, the function returns 0 and fills in the GElf_Sym
2734  * symbol table entry.  On failure, -1 is returned.
2735  */
2736 int
2737 Pxlookup_by_name(
2738 	struct ps_prochandle *P,
2739 	Lmid_t lmid,			/* link map to match, or -1 for any */
2740 	const char *oname,		/* load object name */
2741 	const char *sname,		/* symbol name */
2742 	GElf_Sym *symp,			/* returned symbol table entry */
2743 	prsyminfo_t *sip)		/* returned symbol info */
2744 {
2745 	map_info_t *mptr;
2746 	file_info_t *fptr;
2747 	int cnt;
2748 
2749 	GElf_Sym sym;
2750 	prsyminfo_t si;
2751 	int rv = -1;
2752 	uint_t id;
2753 
2754 	if (oname == PR_OBJ_EVERY) {
2755 		/* create all the file_info_t's for all the mappings */
2756 		(void) Prd_agent(P);
2757 		cnt = P->num_files;
2758 		fptr = list_next(&P->file_head);
2759 	} else {
2760 		cnt = 1;
2761 		if ((mptr = object_name_to_map(P, lmid, oname)) == NULL ||
2762 		    (fptr = build_map_symtab(P, mptr)) == NULL)
2763 			return (-1);
2764 	}
2765 
2766 	/*
2767 	 * Iterate through the loaded object files and look for the symbol
2768 	 * name in the .symtab and .dynsym of each.  If we encounter a match
2769 	 * with SHN_UNDEF, keep looking in hopes of finding a better match.
2770 	 * This means that a name such as "puts" will match the puts function
2771 	 * in libc instead of matching the puts PLT entry in the a.out file.
2772 	 */
2773 	for (; cnt > 0; cnt--, fptr = list_next(fptr)) {
2774 		Pbuild_file_symtab(P, fptr);
2775 
2776 		if (fptr->file_elf == NULL)
2777 			continue;
2778 
2779 		if (lmid != PR_LMID_EVERY && fptr->file_lo != NULL &&
2780 		    lmid != fptr->file_lo->rl_lmident)
2781 			continue;
2782 
2783 		if (fptr->file_symtab.sym_data_pri != NULL &&
2784 		    sym_by_name(&fptr->file_symtab, sname, symp, &id)) {
2785 			if (sip != NULL) {
2786 				sip->prs_id = id;
2787 				sip->prs_table = PR_SYMTAB;
2788 				sip->prs_object = oname;
2789 				sip->prs_name = sname;
2790 				sip->prs_lmid = fptr->file_lo == NULL ?
2791 				    LM_ID_BASE : fptr->file_lo->rl_lmident;
2792 			}
2793 		} else if (fptr->file_dynsym.sym_data_pri != NULL &&
2794 		    sym_by_name(&fptr->file_dynsym, sname, symp, &id)) {
2795 			if (sip != NULL) {
2796 				sip->prs_id = id;
2797 				sip->prs_table = PR_DYNSYM;
2798 				sip->prs_object = oname;
2799 				sip->prs_name = sname;
2800 				sip->prs_lmid = fptr->file_lo == NULL ?
2801 				    LM_ID_BASE : fptr->file_lo->rl_lmident;
2802 			}
2803 		} else {
2804 			continue;
2805 		}
2806 
2807 		if (GELF_ST_TYPE(symp->st_info) != STT_TLS)
2808 			symp->st_value += fptr->file_dyn_base;
2809 
2810 		if (symp->st_shndx != SHN_UNDEF)
2811 			return (0);
2812 
2813 		if (rv != 0) {
2814 			if (sip != NULL)
2815 				si = *sip;
2816 			sym = *symp;
2817 			rv = 0;
2818 		}
2819 	}
2820 
2821 	if (rv == 0) {
2822 		if (sip != NULL)
2823 			*sip = si;
2824 		*symp = sym;
2825 	}
2826 
2827 	return (rv);
2828 }
2829 
2830 /*
2831  * Search the process symbol tables looking for a symbol whose name matches the
2832  * specified name, but without any restriction on the link map id.
2833  */
2834 int
2835 Plookup_by_name(struct ps_prochandle *P, const char *object,
2836     const char *symbol, GElf_Sym *symp)
2837 {
2838 	return (Pxlookup_by_name(P, PR_LMID_EVERY, object, symbol, symp, NULL));
2839 }
2840 
2841 /*
2842  * Iterate over the process's address space mappings.
2843  */
2844 static int
2845 i_Pmapping_iter(struct ps_prochandle *P, boolean_t lmresolve,
2846     proc_map_f *func, void *cd)
2847 {
2848 	map_info_t *mptr;
2849 	file_info_t *fptr;
2850 	char *object_name;
2851 	int rc = 0;
2852 	int i;
2853 
2854 	/* create all the file_info_t's for all the mappings */
2855 	(void) Prd_agent(P);
2856 
2857 	for (i = 0, mptr = P->mappings; i < P->map_count; i++, mptr++) {
2858 		if ((fptr = mptr->map_file) == NULL)
2859 			object_name = NULL;
2860 		else if (lmresolve && (fptr->file_rname != NULL))
2861 			object_name = fptr->file_rname;
2862 		else
2863 			object_name = fptr->file_lname;
2864 		if ((rc = func(cd, &mptr->map_pmap, object_name)) != 0)
2865 			return (rc);
2866 	}
2867 	return (0);
2868 }
2869 
2870 int
2871 Pmapping_iter(struct ps_prochandle *P, proc_map_f *func, void *cd)
2872 {
2873 	return (i_Pmapping_iter(P, B_FALSE, func, cd));
2874 }
2875 
2876 int
2877 Pmapping_iter_resolved(struct ps_prochandle *P, proc_map_f *func, void *cd)
2878 {
2879 	return (i_Pmapping_iter(P, B_TRUE, func, cd));
2880 }
2881 
2882 /*
2883  * Iterate over the process's mapped objects.
2884  */
2885 static int
2886 i_Pobject_iter(struct ps_prochandle *P, boolean_t lmresolve,
2887     proc_map_f *func, void *cd)
2888 {
2889 	map_info_t *mptr;
2890 	file_info_t *fptr;
2891 	uint_t cnt;
2892 	int rc = 0;
2893 
2894 	(void) Prd_agent(P); /* create file_info_t's for all the mappings */
2895 	Pupdate_maps(P);
2896 
2897 	for (cnt = P->num_files, fptr = list_next(&P->file_head);
2898 	    cnt; cnt--, fptr = list_next(fptr)) {
2899 		const char *lname;
2900 
2901 		if (lmresolve && (fptr->file_rname != NULL))
2902 			lname = fptr->file_rname;
2903 		else if (fptr->file_lname != NULL)
2904 			lname = fptr->file_lname;
2905 		else
2906 			lname = "";
2907 
2908 		if ((mptr = fptr->file_map) == NULL)
2909 			continue;
2910 
2911 		if ((rc = func(cd, &mptr->map_pmap, lname)) != 0)
2912 			return (rc);
2913 
2914 		if (!P->info_valid)
2915 			Pupdate_maps(P);
2916 	}
2917 	return (0);
2918 }
2919 
2920 int
2921 Pobject_iter(struct ps_prochandle *P, proc_map_f *func, void *cd)
2922 {
2923 	return (i_Pobject_iter(P, B_FALSE, func, cd));
2924 }
2925 
2926 int
2927 Pobject_iter_resolved(struct ps_prochandle *P, proc_map_f *func, void *cd)
2928 {
2929 	return (i_Pobject_iter(P, B_TRUE, func, cd));
2930 }
2931 
2932 static char *
2933 i_Pobjname(struct ps_prochandle *P, boolean_t lmresolve, uintptr_t addr,
2934     char *buffer, size_t bufsize)
2935 {
2936 	map_info_t *mptr;
2937 	file_info_t *fptr;
2938 
2939 	/* create all the file_info_t's for all the mappings */
2940 	(void) Prd_agent(P);
2941 
2942 	if ((mptr = Paddr2mptr(P, addr)) == NULL)
2943 		return (NULL);
2944 
2945 	if (!lmresolve) {
2946 		if (((fptr = mptr->map_file) == NULL) ||
2947 		    (fptr->file_lname == NULL))
2948 			return (NULL);
2949 		(void) strlcpy(buffer, fptr->file_lname, bufsize);
2950 		return (buffer);
2951 	}
2952 
2953 	/* Check for a cached copy of the resolved path */
2954 	if (Pfindmap(P, mptr, buffer, bufsize) != NULL)
2955 		return (buffer);
2956 
2957 	return (NULL);
2958 }
2959 
2960 /*
2961  * Given a virtual address, return the name of the underlying
2962  * mapped object (file) as provided by the dynamic linker.
2963  * Return NULL if we can't find any name information for the object.
2964  */
2965 char *
2966 Pobjname(struct ps_prochandle *P, uintptr_t addr,
2967     char *buffer, size_t bufsize)
2968 {
2969 	return (i_Pobjname(P, B_FALSE, addr, buffer, bufsize));
2970 }
2971 
2972 /*
2973  * Given a virtual address, try to return a filesystem path to the
2974  * underlying mapped object (file).  If we're in the global zone,
2975  * this path could resolve to an object in another zone.  If we're
2976  * unable return a valid filesystem path, we'll fall back to providing
2977  * the mapped object (file) name provided by the dynamic linker in
2978  * the target process (ie, the object reported by Pobjname()).
2979  */
2980 char *
2981 Pobjname_resolved(struct ps_prochandle *P, uintptr_t addr,
2982     char *buffer, size_t bufsize)
2983 {
2984 	return (i_Pobjname(P, B_TRUE, addr, buffer, bufsize));
2985 }
2986 
2987 /*
2988  * Given a virtual address, return the link map id of the underlying mapped
2989  * object (file), as provided by the dynamic linker.  Return -1 on failure.
2990  */
2991 int
2992 Plmid(struct ps_prochandle *P, uintptr_t addr, Lmid_t *lmidp)
2993 {
2994 	map_info_t *mptr;
2995 	file_info_t *fptr;
2996 
2997 	/* create all the file_info_t's for all the mappings */
2998 	(void) Prd_agent(P);
2999 
3000 	if ((mptr = Paddr2mptr(P, addr)) != NULL &&
3001 	    (fptr = mptr->map_file) != NULL && fptr->file_lo != NULL) {
3002 		*lmidp = fptr->file_lo->rl_lmident;
3003 		return (0);
3004 	}
3005 
3006 	return (-1);
3007 }
3008 
3009 /*
3010  * Given an object name and optional lmid, iterate over the object's symbols.
3011  * If which == PR_SYMTAB, search the normal symbol table.
3012  * If which == PR_DYNSYM, search the dynamic symbol table.
3013  */
3014 static int
3015 Psymbol_iter_com(struct ps_prochandle *P, Lmid_t lmid, const char *object_name,
3016     int which, int mask, pr_order_t order, proc_xsym_f *func, void *cd)
3017 {
3018 #if STT_NUM != (STT_TLS + 1)
3019 #error "STT_NUM has grown. update Psymbol_iter_com()"
3020 #endif
3021 
3022 	GElf_Sym sym;
3023 	GElf_Shdr shdr;
3024 	map_info_t *mptr;
3025 	file_info_t *fptr;
3026 	sym_tbl_t *symtab;
3027 	size_t symn;
3028 	const char *strs;
3029 	size_t strsz;
3030 	prsyminfo_t si;
3031 	int rv;
3032 	uint_t *map, i, count, ndx;
3033 
3034 	if ((mptr = object_name_to_map(P, lmid, object_name)) == NULL)
3035 		return (-1);
3036 
3037 	if ((fptr = build_map_symtab(P, mptr)) == NULL || /* no mapped file */
3038 	    fptr->file_elf == NULL)			/* not an ELF file */
3039 		return (-1);
3040 
3041 	/*
3042 	 * Search the specified symbol table.
3043 	 */
3044 	switch (which) {
3045 	case PR_SYMTAB:
3046 		symtab = &fptr->file_symtab;
3047 		si.prs_table = PR_SYMTAB;
3048 		break;
3049 	case PR_DYNSYM:
3050 		symtab = &fptr->file_dynsym;
3051 		si.prs_table = PR_DYNSYM;
3052 		break;
3053 	default:
3054 		return (-1);
3055 	}
3056 
3057 	si.prs_object = object_name;
3058 	si.prs_lmid = fptr->file_lo == NULL ?
3059 	    LM_ID_BASE : fptr->file_lo->rl_lmident;
3060 
3061 	symn = symtab->sym_symn;
3062 	strs = symtab->sym_strs;
3063 	strsz = symtab->sym_strsz;
3064 
3065 	switch (order) {
3066 	case PRO_NATURAL:
3067 		map = NULL;
3068 		count = symn;
3069 		break;
3070 	case PRO_BYNAME:
3071 		map = symtab->sym_byname;
3072 		count = symtab->sym_count;
3073 		break;
3074 	case PRO_BYADDR:
3075 		map = symtab->sym_byaddr;
3076 		count = symtab->sym_count;
3077 		break;
3078 	default:
3079 		return (-1);
3080 	}
3081 
3082 	if (symtab->sym_data_pri == NULL || strs == NULL || count == 0)
3083 		return (-1);
3084 
3085 	rv = 0;
3086 
3087 	for (i = 0; i < count; i++) {
3088 		ndx = map == NULL ? i : map[i];
3089 		if (symtab_getsym(symtab, ndx, &sym) != NULL) {
3090 			uint_t s_bind, s_type, type;
3091 
3092 			if (sym.st_name >= strsz)	/* invalid st_name */
3093 				continue;
3094 
3095 			s_bind = GELF_ST_BIND(sym.st_info);
3096 			s_type = GELF_ST_TYPE(sym.st_info);
3097 
3098 			/*
3099 			 * In case you haven't already guessed, this relies on
3100 			 * the bitmask used in <libproc.h> for encoding symbol
3101 			 * type and binding matching the order of STB and STT
3102 			 * constants in <sys/elf.h>.  Changes to ELF must
3103 			 * maintain binary compatibility, so I think this is
3104 			 * reasonably fair game.
3105 			 */
3106 			if (s_bind < STB_NUM && s_type < STT_NUM) {
3107 				type = (1 << (s_type + 8)) | (1 << s_bind);
3108 				if ((type & ~mask) != 0)
3109 					continue;
3110 			} else
3111 				continue; /* Invalid type or binding */
3112 
3113 			if (GELF_ST_TYPE(sym.st_info) != STT_TLS)
3114 				sym.st_value += fptr->file_dyn_base;
3115 
3116 			si.prs_name = strs + sym.st_name;
3117 
3118 			/*
3119 			 * If symbol's type is STT_SECTION, then try to lookup
3120 			 * the name of the corresponding section.
3121 			 */
3122 			if (GELF_ST_TYPE(sym.st_info) == STT_SECTION &&
3123 			    fptr->file_shstrs != NULL &&
3124 			    gelf_getshdr(elf_getscn(fptr->file_elf,
3125 			    sym.st_shndx), &shdr) != NULL &&
3126 			    shdr.sh_name != 0 &&
3127 			    shdr.sh_name < fptr->file_shstrsz)
3128 				si.prs_name = fptr->file_shstrs + shdr.sh_name;
3129 
3130 			si.prs_id = ndx;
3131 			if ((rv = func(cd, &sym, si.prs_name, &si)) != 0)
3132 				break;
3133 		}
3134 	}
3135 
3136 	return (rv);
3137 }
3138 
3139 int
3140 Pxsymbol_iter(struct ps_prochandle *P, Lmid_t lmid, const char *object_name,
3141     int which, int mask, proc_xsym_f *func, void *cd)
3142 {
3143 	return (Psymbol_iter_com(P, lmid, object_name, which, mask,
3144 	    PRO_NATURAL, func, cd));
3145 }
3146 
3147 int
3148 Psymbol_iter_by_lmid(struct ps_prochandle *P, Lmid_t lmid,
3149     const char *object_name, int which, int mask, proc_sym_f *func, void *cd)
3150 {
3151 	return (Psymbol_iter_com(P, lmid, object_name, which, mask,
3152 	    PRO_NATURAL, (proc_xsym_f *)(uintptr_t)func, cd));
3153 }
3154 
3155 int
3156 Psymbol_iter(struct ps_prochandle *P,
3157     const char *object_name, int which, int mask, proc_sym_f *func, void *cd)
3158 {
3159 	return (Psymbol_iter_com(P, PR_LMID_EVERY, object_name, which, mask,
3160 	    PRO_NATURAL, (proc_xsym_f *)(uintptr_t)func, cd));
3161 }
3162 
3163 int
3164 Psymbol_iter_by_addr(struct ps_prochandle *P,
3165     const char *object_name, int which, int mask, proc_sym_f *func, void *cd)
3166 {
3167 	return (Psymbol_iter_com(P, PR_LMID_EVERY, object_name, which, mask,
3168 	    PRO_BYADDR, (proc_xsym_f *)(uintptr_t)func, cd));
3169 }
3170 
3171 int
3172 Psymbol_iter_by_name(struct ps_prochandle *P,
3173     const char *object_name, int which, int mask, proc_sym_f *func, void *cd)
3174 {
3175 	return (Psymbol_iter_com(P, PR_LMID_EVERY, object_name, which, mask,
3176 	    PRO_BYNAME, (proc_xsym_f *)(uintptr_t)func, cd));
3177 }
3178 
3179 /*
3180  * Get the platform string.
3181  */
3182 char *
3183 Pplatform(struct ps_prochandle *P, char *s, size_t n)
3184 {
3185 	return (P->ops.pop_platform(P, s, n, P->data));
3186 }
3187 
3188 /*
3189  * Get the uname(2) information.
3190  */
3191 int
3192 Puname(struct ps_prochandle *P, struct utsname *u)
3193 {
3194 	return (P->ops.pop_uname(P, u, P->data));
3195 }
3196 
3197 /*
3198  * Called from Pcreate(), Pgrab(), and Pfgrab_core() to initialize
3199  * the symbol table heads in the new ps_prochandle.
3200  */
3201 void
3202 Pinitsym(struct ps_prochandle *P)
3203 {
3204 	P->num_files = 0;
3205 	list_link(&P->file_head, NULL);
3206 }
3207 
3208 /*
3209  * Called from Prelease() to destroy the symbol tables.
3210  * Must be called by the client after an exec() in the victim process.
3211  */
3212 void
3213 Preset_maps(struct ps_prochandle *P)
3214 {
3215 	int i;
3216 
3217 	if (P->rap != NULL) {
3218 		rd_delete(P->rap);
3219 		P->rap = NULL;
3220 	}
3221 
3222 	if (P->execname != NULL) {
3223 		free(P->execname);
3224 		P->execname = NULL;
3225 	}
3226 
3227 	if (P->auxv != NULL) {
3228 		free(P->auxv);
3229 		P->auxv = NULL;
3230 		P->nauxv = 0;
3231 	}
3232 
3233 	for (i = 0; i < P->map_count; i++)
3234 		map_info_free(P, &P->mappings[i]);
3235 
3236 	if (P->mappings != NULL) {
3237 		free(P->mappings);
3238 		P->mappings = NULL;
3239 	}
3240 	P->map_count = P->map_alloc = 0;
3241 
3242 	P->info_valid = 0;
3243 }
3244 
3245 typedef struct getenv_data {
3246 	char *buf;
3247 	size_t bufsize;
3248 	const char *search;
3249 	size_t searchlen;
3250 } getenv_data_t;
3251 
3252 /*ARGSUSED*/
3253 static int
3254 getenv_func(void *data, struct ps_prochandle *P, uintptr_t addr,
3255     const char *nameval)
3256 {
3257 	getenv_data_t *d = data;
3258 	size_t len;
3259 
3260 	if (nameval == NULL)
3261 		return (0);
3262 
3263 	if (d->searchlen < strlen(nameval) &&
3264 	    strncmp(nameval, d->search, d->searchlen) == 0 &&
3265 	    nameval[d->searchlen] == '=') {
3266 		len = MIN(strlen(nameval), d->bufsize - 1);
3267 		(void) strncpy(d->buf, nameval, len);
3268 		d->buf[len] = '\0';
3269 		return (1);
3270 	}
3271 
3272 	return (0);
3273 }
3274 
3275 char *
3276 Pgetenv(struct ps_prochandle *P, const char *name, char *buf, size_t buflen)
3277 {
3278 	getenv_data_t d;
3279 
3280 	d.buf = buf;
3281 	d.bufsize = buflen;
3282 	d.search = name;
3283 	d.searchlen = strlen(name);
3284 
3285 	if (Penv_iter(P, getenv_func, &d) == 1) {
3286 		char *equals = strchr(d.buf, '=');
3287 
3288 		if (equals != NULL) {
3289 			(void) memmove(d.buf, equals + 1,
3290 			    d.buf + buflen - equals - 1);
3291 			d.buf[d.buf + buflen - equals] = '\0';
3292 
3293 			return (buf);
3294 		}
3295 	}
3296 
3297 	return (NULL);
3298 }
3299 
3300 /* number of argument or environment pointers to read all at once */
3301 #define	NARG	100
3302 
3303 int
3304 Penv_iter(struct ps_prochandle *P, proc_env_f *func, void *data)
3305 {
3306 	const psinfo_t *psp;
3307 	uintptr_t envpoff;
3308 	GElf_Sym sym;
3309 	int ret;
3310 	char *buf, *nameval;
3311 	size_t buflen;
3312 
3313 	int nenv = NARG;
3314 	long envp[NARG];
3315 
3316 	/*
3317 	 * Attempt to find the "_environ" variable in the process.
3318 	 * Failing that, use the original value provided by Ppsinfo().
3319 	 */
3320 	if ((psp = Ppsinfo(P)) == NULL)
3321 		return (-1);
3322 
3323 	envpoff = psp->pr_envp; /* Default if no _environ found */
3324 
3325 	if (Plookup_by_name(P, PR_OBJ_EXEC, "_environ", &sym) == 0) {
3326 		if (P->status.pr_dmodel == PR_MODEL_NATIVE) {
3327 			if (Pread(P, &envpoff, sizeof (envpoff),
3328 			    sym.st_value) != sizeof (envpoff))
3329 				envpoff = psp->pr_envp;
3330 		} else if (P->status.pr_dmodel == PR_MODEL_ILP32) {
3331 			uint32_t envpoff32;
3332 
3333 			if (Pread(P, &envpoff32, sizeof (envpoff32),
3334 			    sym.st_value) != sizeof (envpoff32))
3335 				envpoff = psp->pr_envp;
3336 			else
3337 				envpoff = envpoff32;
3338 		}
3339 	}
3340 
3341 	buflen = 128;
3342 	buf = malloc(buflen);
3343 
3344 	ret = 0;
3345 	for (;;) {
3346 		uintptr_t envoff;
3347 
3348 		if (nenv == NARG) {
3349 			(void) memset(envp, 0, sizeof (envp));
3350 			if (P->status.pr_dmodel == PR_MODEL_NATIVE) {
3351 				if (Pread(P, envp,
3352 				    sizeof (envp), envpoff) <= 0) {
3353 					ret = -1;
3354 					break;
3355 				}
3356 			} else if (P->status.pr_dmodel == PR_MODEL_ILP32) {
3357 				uint32_t e32[NARG];
3358 				int i;
3359 
3360 				(void) memset(e32, 0, sizeof (e32));
3361 				if (Pread(P, e32, sizeof (e32), envpoff) <= 0) {
3362 					ret = -1;
3363 					break;
3364 				}
3365 				for (i = 0; i < NARG; i++)
3366 					envp[i] = e32[i];
3367 			}
3368 			nenv = 0;
3369 		}
3370 
3371 		if ((envoff = envp[nenv++]) == (uintptr_t)NULL)
3372 			break;
3373 
3374 		/*
3375 		 * Attempt to read the string from the process.
3376 		 */
3377 again:
3378 		ret = Pread_string(P, buf, buflen, envoff);
3379 
3380 		if (ret <= 0) {
3381 			nameval = NULL;
3382 		} else if (ret == buflen - 1) {
3383 			free(buf);
3384 			/*
3385 			 * Bail if we have a corrupted environment
3386 			 */
3387 			if (buflen >= ARG_MAX)
3388 				return (-1);
3389 			buflen *= 2;
3390 			buf = malloc(buflen);
3391 			goto again;
3392 		} else {
3393 			nameval = buf;
3394 		}
3395 
3396 		if ((ret = func(data, P, envoff, nameval)) != 0)
3397 			break;
3398 
3399 		envpoff += (P->status.pr_dmodel == PR_MODEL_LP64)? 8 : 4;
3400 	}
3401 
3402 	free(buf);
3403 
3404 	return (ret);
3405 }
3406