xref: /illumos-gate/usr/src/cmd/sgs/rtld/common/dlfcns.c (revision 7eca354d)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1988 AT&T
24  *	  All Rights Reserved
25  *
26  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
27  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
28  */
29 
30 /*
31  * Programmatic interface to the run_time linker.
32  */
33 
34 #include	<sys/debug.h>
35 #include	<stdio.h>
36 #include	<string.h>
37 #include	<dlfcn.h>
38 #include	<synch.h>
39 #include	<limits.h>
40 #include	<debug.h>
41 #include	<conv.h>
42 #include	"_rtld.h"
43 #include	"_audit.h"
44 #include	"_elf.h"
45 #include	"_inline_gen.h"
46 #include	"msg.h"
47 
48 /*
49  * Determine who called us - given a pc determine in which object it resides.
50  *
51  * For dlopen() the link map of the caller must be passed to load_so() so that
52  * the appropriate search rules (4.x or 5.0) are used to locate any
53  * dependencies.  Also, if we've been called from a 4.x module it may be
54  * necessary to fix the specified pathname so that it conforms with the 5.0 elf
55  * rules.
56  *
57  * For dlsym() the link map of the caller is used to determine RTLD_NEXT
58  * requests, together with requests based off of a dlopen(0).
59  * For dladdr() this routines provides a generic means of scanning all loaded
60  * segments.
61  */
62 Rt_map *
_caller(caddr_t cpc,int flags)63 _caller(caddr_t cpc, int flags)
64 {
65 	Lm_list	*lml;
66 	Aliste	idx1;
67 
68 	for (APLIST_TRAVERSE(dynlm_list, idx1, lml)) {
69 		Aliste	idx2;
70 		Lm_cntl	*lmc;
71 
72 		for (ALIST_TRAVERSE(lml->lm_lists, idx2, lmc)) {
73 			Rt_map	*lmp;
74 
75 			for (lmp = lmc->lc_head; lmp;
76 			    lmp = NEXT_RT_MAP(lmp)) {
77 
78 				if (find_segment(cpc, lmp))
79 					return (lmp);
80 			}
81 		}
82 	}
83 
84 	/*
85 	 * No mapping can be determined.  If asked for a default, assume this
86 	 * is from the executable.
87 	 */
88 	if (flags & CL_EXECDEF)
89 		return ((Rt_map *)lml_main.lm_head);
90 
91 	return (0);
92 }
93 
94 #pragma weak _dlerror = dlerror
95 
96 /*
97  * External entry for dlerror(3dl).  Returns a pointer to the string describing
98  * the last occurring error.  The last occurring error is cleared.
99  */
100 char *
dlerror()101 dlerror()
102 {
103 	char	*error;
104 	Rt_map	*clmp;
105 	int	entry;
106 
107 	entry = enter(0);
108 
109 	clmp = _caller(caller(), CL_EXECDEF);
110 
111 	DBG_CALL(Dbg_dl_dlerror(clmp, lasterr));
112 
113 	error = lasterr;
114 	lasterr = NULL;
115 
116 	if (entry)
117 		leave(LIST(clmp), 0);
118 	return (error);
119 }
120 
121 /*
122  * Add a dependency as a group descriptor to a group handle.  Returns 0 on
123  * failure.  On success, returns the group descriptor, and if alep is non-NULL
124  * the *alep is set to ALE_EXISTS if the dependency already exists, or to
125  * ALE_CREATE if the dependency is newly created.
126  */
127 Grp_desc *
hdl_add(Grp_hdl * ghp,Rt_map * lmp,uint_t dflags,int * alep)128 hdl_add(Grp_hdl *ghp, Rt_map *lmp, uint_t dflags, int *alep)
129 {
130 	Grp_desc	*gdp;
131 	Aliste		idx;
132 	int		ale = ALE_CREATE;
133 	uint_t		oflags;
134 
135 	/*
136 	 * Make sure this dependency hasn't already been recorded.
137 	 */
138 	for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
139 		if (gdp->gd_depend == lmp) {
140 			ale = ALE_EXISTS;
141 			break;
142 		}
143 	}
144 
145 	if (ale == ALE_CREATE) {
146 		Grp_desc	gd;
147 
148 		/*
149 		 * Create a new handle descriptor.
150 		 */
151 		gd.gd_depend = lmp;
152 		gd.gd_flags = 0;
153 
154 		/*
155 		 * Indicate this object is a part of this handles group.
156 		 */
157 		if (aplist_append(&GROUPS(lmp), ghp, AL_CNT_GROUPS) == NULL)
158 			return (NULL);
159 
160 		/*
161 		 * Append the new dependency to this handle.
162 		 */
163 		if ((gdp = alist_append(&ghp->gh_depends, &gd,
164 		    sizeof (Grp_desc), AL_CNT_DEPENDS)) == NULL)
165 			return (NULL);
166 	}
167 
168 	oflags = gdp->gd_flags;
169 	gdp->gd_flags |= dflags;
170 
171 	if (DBG_ENABLED) {
172 		if (ale == ALE_CREATE) {
173 			DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_ADD,
174 			    gdp->gd_flags));
175 		} else if (gdp->gd_flags != oflags) {
176 			DBG_CALL(Dbg_file_hdl_action(ghp, lmp, DBG_DEP_UPDATE,
177 			    gdp->gd_flags));
178 		}
179 	}
180 
181 	if (alep)
182 		*alep = ale;
183 	return (gdp);
184 }
185 
186 /*
187  * Create a handle.
188  *
189  *   rlmp -	represents the reference link-map for which the handle is being
190  *		created.
191  *   clmp -	represents the caller who is requesting the handle.
192  *   hflags -	provide group handle flags (GPH_*) that affect the use of the
193  *		handle, such as dlopen(0), or use or use of RTLD_FIRST.
194  *   rdflags -	provide group dependency flags for the reference link-map rlmp,
195  *		such as whether the dependency can be used for dlsym(), can be
196  *		relocated against, or whether this objects dependencies should
197  *		be processed.
198  *   cdflags -	provide group dependency flags for the caller.
199  */
200 Grp_hdl *
hdl_create(Lm_list * lml,Rt_map * rlmp,Rt_map * clmp,uint_t hflags,uint_t rdflags,uint_t cdflags)201 hdl_create(Lm_list *lml, Rt_map *rlmp, Rt_map *clmp, uint_t hflags,
202     uint_t rdflags, uint_t cdflags)
203 {
204 	Grp_hdl	*ghp = NULL, *aghp;
205 	APlist	**alpp;
206 	Aliste	idx;
207 
208 	/*
209 	 * For dlopen(0) the handle is maintained as part of the link-map list,
210 	 * otherwise the handle is associated with the reference link-map.
211 	 */
212 	if (hflags & GPH_ZERO)
213 		alpp = &(lml->lm_handle);
214 	else
215 		alpp = &(HANDLES(rlmp));
216 
217 	/*
218 	 * Objects can contain multiple handles depending on the handle flags
219 	 * supplied.  Most RTLD flags pertain to the object itself and the
220 	 * bindings that it can achieve.  Multiple handles for these flags
221 	 * don't make sense.  But if the flag determines how the handle might
222 	 * be used, then multiple handles may exist.  Presently this only makes
223 	 * sense for RTLD_FIRST.  Determine if an appropriate handle already
224 	 * exists.
225 	 */
226 	for (APLIST_TRAVERSE(*alpp, idx, aghp)) {
227 		if ((aghp->gh_flags & GPH_FIRST) == (hflags & GPH_FIRST)) {
228 			ghp = aghp;
229 			break;
230 		}
231 	}
232 
233 	if (ghp == NULL) {
234 		uint_t	ndx;
235 
236 		/*
237 		 * If this is the first request for this handle, allocate and
238 		 * initialize a new handle.
239 		 */
240 		DBG_CALL(Dbg_file_hdl_title(DBG_HDL_CREATE));
241 
242 		if ((ghp = malloc(sizeof (Grp_hdl))) == NULL)
243 			return (NULL);
244 
245 		/*
246 		 * Associate the handle with the link-map list or the reference
247 		 * link-map as appropriate.
248 		 */
249 		if (aplist_append(alpp, ghp, AL_CNT_GROUPS) == NULL) {
250 			free(ghp);
251 			return (NULL);
252 		}
253 
254 		/*
255 		 * Record the existence of this handle for future verification.
256 		 */
257 		/* LINTED */
258 		ndx = (uintptr_t)ghp % HDLIST_SZ;
259 
260 		if (aplist_append(&hdl_alp[ndx], ghp, AL_CNT_HANDLES) == NULL) {
261 			(void) aplist_delete_value(*alpp, ghp);
262 			free(ghp);
263 			return (NULL);
264 		}
265 
266 		ghp->gh_depends = NULL;
267 		ghp->gh_refcnt = 1;
268 		ghp->gh_flags = hflags;
269 
270 		/*
271 		 * A dlopen(0) handle is identified by the GPH_ZERO flag, the
272 		 * head of the link-map list is defined as the owner.  There is
273 		 * no need to maintain a list of dependencies, for when this
274 		 * handle is used (for dlsym()) a dynamic search through the
275 		 * entire link-map list provides for searching all objects with
276 		 * GLOBAL visibility.
277 		 */
278 		if (hflags & GPH_ZERO) {
279 			ghp->gh_ownlmp = lml->lm_head;
280 			ghp->gh_ownlml = lml;
281 		} else {
282 			ghp->gh_ownlmp = rlmp;
283 			ghp->gh_ownlml = LIST(rlmp);
284 
285 			if (hdl_add(ghp, rlmp, rdflags, NULL) == NULL)
286 				return (NULL);
287 
288 			/*
289 			 * If this new handle is a private handle, there's no
290 			 * need to track the caller, so we're done.
291 			 */
292 			if (hflags & GPH_PRIVATE)
293 				return (ghp);
294 
295 			/*
296 			 * If this new handle is public, and isn't a special
297 			 * handle representing ld.so.1, indicate that a local
298 			 * group now exists.  This state allows singleton
299 			 * searches to be optimized.
300 			 */
301 			if ((hflags & GPH_LDSO) == 0)
302 				LIST(rlmp)->lm_flags |= LML_FLG_GROUPSEXIST;
303 		}
304 	} else {
305 		/*
306 		 * If a handle already exists, bump its reference count.
307 		 *
308 		 * If the previous reference count was 0, then this is a handle
309 		 * that an earlier call to dlclose() was unable to remove.  Such
310 		 * handles are put on the orphan list.  As this handle is back
311 		 * in use, it must be removed from the orphan list.
312 		 *
313 		 * Note, handles associated with a link-map list itself (i.e.
314 		 * dlopen(0)) can have a reference count of 0.  However, these
315 		 * handles are never deleted, and therefore are never moved to
316 		 * the orphan list.
317 		 */
318 		if ((ghp->gh_refcnt++ == 0) &&
319 		    ((ghp->gh_flags & GPH_ZERO) == 0)) {
320 			uint_t	ndx;
321 
322 			/* LINTED */
323 			ndx = (uintptr_t)ghp % HDLIST_SZ;
324 
325 			(void) aplist_delete_value(hdl_alp[HDLIST_ORP], ghp);
326 			(void) aplist_append(&hdl_alp[ndx], ghp,
327 			    AL_CNT_HANDLES);
328 
329 			if (DBG_ENABLED) {
330 				Aliste		idx;
331 				Grp_desc	*gdp;
332 
333 				DBG_CALL(Dbg_file_hdl_title(DBG_HDL_REINST));
334 				for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp))
335 					DBG_CALL(Dbg_file_hdl_action(ghp,
336 					    gdp->gd_depend, DBG_DEP_REINST, 0));
337 			}
338 		}
339 
340 		/*
341 		 * If we've been asked to create a private handle, there's no
342 		 * need to track the caller.
343 		 */
344 		if (hflags & GPH_PRIVATE) {
345 			/*
346 			 * Negate the reference count increment.
347 			 */
348 			ghp->gh_refcnt--;
349 			return (ghp);
350 		} else {
351 			/*
352 			 * If a private handle already exists, promote this
353 			 * handle to public by initializing both the reference
354 			 * count and the handle flags.
355 			 */
356 			if (ghp->gh_flags & GPH_PRIVATE) {
357 				ghp->gh_refcnt = 1;
358 				ghp->gh_flags &= ~GPH_PRIVATE;
359 				ghp->gh_flags |= hflags;
360 			}
361 		}
362 	}
363 
364 	/*
365 	 * Keep track of the parent (caller).  As this object can be referenced
366 	 * by different parents, this processing is carried out every time a
367 	 * handle is requested.
368 	 */
369 	if (clmp && (hdl_add(ghp, clmp, cdflags, NULL) == NULL))
370 		return (NULL);
371 
372 	return (ghp);
373 }
374 
375 /*
376  * Initialize a handle that has been created for an object that is already
377  * loaded.  The handle is initialized with the present dependencies of that
378  * object.  Once this initialization has occurred, any new objects that might
379  * be loaded as dependencies (lazy-loading) are added to the handle as each new
380  * object is loaded.
381  */
382 int
hdl_initialize(Grp_hdl * ghp,Rt_map * nlmp,int mode,int promote)383 hdl_initialize(Grp_hdl *ghp, Rt_map *nlmp, int mode, int promote)
384 {
385 	Aliste		idx;
386 	Grp_desc	*gdp;
387 
388 	/*
389 	 * If the handle has already been initialized, and the initial object's
390 	 * mode hasn't been promoted, there's no need to recompute the modes of
391 	 * any dependencies.  If the object we've added has just been opened,
392 	 * the objects dependencies will not yet have been processed.  These
393 	 * dependencies will be added on later calls to load_one().  Otherwise,
394 	 * this object already exists, so add all of its dependencies to the
395 	 * handle were operating on.
396 	 */
397 	if (((ghp->gh_flags & GPH_INITIAL) && (promote == 0)) ||
398 	    ((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0)) {
399 		ghp->gh_flags |= GPH_INITIAL;
400 		return (1);
401 	}
402 
403 	DBG_CALL(Dbg_file_hdl_title(DBG_HDL_ADD));
404 	for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
405 		Rt_map		*lmp = gdp->gd_depend;
406 		Aliste		idx1;
407 		Bnd_desc	*bdp;
408 
409 		/*
410 		 * If this dependency doesn't indicate that its dependencies
411 		 * should be added to a handle, ignore it.  This case identifies
412 		 * a parent of a dlopen(RTLD_PARENT) request.
413 		 */
414 		if ((gdp->gd_flags & GPD_ADDEPS) == 0)
415 			continue;
416 
417 		for (APLIST_TRAVERSE(DEPENDS(lmp), idx1, bdp)) {
418 			Rt_map	*dlmp = bdp->b_depend;
419 
420 			if ((bdp->b_flags & BND_NEEDED) == 0)
421 				continue;
422 
423 			if (hdl_add(ghp, dlmp,
424 			    (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS), NULL) == NULL)
425 				return (0);
426 
427 			(void) update_mode(dlmp, MODE(dlmp), mode);
428 		}
429 	}
430 	ghp->gh_flags |= GPH_INITIAL;
431 	return (1);
432 }
433 
434 /*
435  * Sanity check a program-provided handle.
436  */
437 static int
hdl_validate(Grp_hdl * ghp)438 hdl_validate(Grp_hdl *ghp)
439 {
440 	Aliste		idx;
441 	Grp_hdl		*lghp;
442 	uint_t		ndx;
443 
444 	/* LINTED */
445 	ndx = (uintptr_t)ghp % HDLIST_SZ;
446 
447 	for (APLIST_TRAVERSE(hdl_alp[ndx], idx, lghp)) {
448 		if ((lghp == ghp) && (ghp->gh_refcnt != 0))
449 			return (1);
450 	}
451 	return (0);
452 }
453 
454 /*
455  * Core dlclose activity.
456  */
457 int
dlclose_core(Grp_hdl * ghp,Rt_map * clmp,Lm_list * lml)458 dlclose_core(Grp_hdl *ghp, Rt_map *clmp, Lm_list *lml)
459 {
460 	int	error;
461 	Rt_map	*lmp;
462 
463 	/*
464 	 * If we're already at atexit() there's no point processing further,
465 	 * all objects have already been tsorted for fini processing.
466 	 */
467 	if (rtld_flags & RT_FL_ATEXIT)
468 		return (0);
469 
470 	/*
471 	 * Diagnose what we're up to.
472 	 */
473 	if (ghp->gh_flags & GPH_ZERO) {
474 		DBG_CALL(Dbg_dl_dlclose(clmp, MSG_ORIG(MSG_STR_ZERO),
475 		    DBG_DLCLOSE_IGNORE));
476 	} else {
477 		DBG_CALL(Dbg_dl_dlclose(clmp, NAME(ghp->gh_ownlmp),
478 		    DBG_DLCLOSE_NULL));
479 	}
480 
481 	/*
482 	 * Decrement reference count of this object.
483 	 */
484 	if (--(ghp->gh_refcnt))
485 		return (0);
486 
487 	/*
488 	 * If this handle is special (dlopen(0)), then leave it around - it
489 	 * has little overhead.
490 	 */
491 	if (ghp->gh_flags & GPH_ZERO)
492 		return (0);
493 
494 	/*
495 	 * If this handle is associated with an object that is not on the base
496 	 * link-map control list, or it has not yet been relocated, then this
497 	 * handle must have originated from an auditors interaction, or some
498 	 * permutation of RTLD_CONFGEN use (crle(1), moe(1), etc.).  User code
499 	 * can only execute and bind to relocated objects on the base link-map
500 	 * control list.  Outside of RTLD_CONFGEN use, a non-relocated object,
501 	 * or an object on a non-base link-map control list, is in the process
502 	 * of being loaded, and therefore we do not attempt to remove the
503 	 * handle.
504 	 */
505 	if (((lmp = ghp->gh_ownlmp) != NULL) &&
506 	    ((MODE(lmp) & RTLD_CONFGEN) == 0) &&
507 	    ((CNTL(lmp) != ALIST_OFF_DATA) ||
508 	    ((FLAGS(lmp) & FLG_RT_RELOCED) == 0)))
509 		return (0);
510 
511 	/*
512 	 * This handle is no longer being referenced, remove it.  If this handle
513 	 * is part of an alternative link-map list, determine if the whole list
514 	 * can be removed also.
515 	 */
516 	error = remove_hdl(ghp, clmp, NULL);
517 
518 	if ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)
519 		remove_lml(lml);
520 
521 	return (error);
522 }
523 
524 /*
525  * Internal dlclose activity.  Called from user level or directly for internal
526  * error cleanup.
527  */
528 int
dlclose_intn(Grp_hdl * ghp,Rt_map * clmp)529 dlclose_intn(Grp_hdl *ghp, Rt_map *clmp)
530 {
531 	Rt_map	*nlmp = NULL;
532 	Lm_list	*olml = NULL;
533 	int	error;
534 
535 	/*
536 	 * Although we're deleting object(s) it's quite possible that additional
537 	 * objects get loaded from running the .fini section(s) of the objects
538 	 * being deleted.  These objects will have been added to the same
539 	 * link-map list as those objects being deleted.  Remember this list
540 	 * for later investigation.
541 	 */
542 	olml = ghp->gh_ownlml;
543 
544 	error = dlclose_core(ghp, clmp, olml);
545 
546 	/*
547 	 * Determine whether the original link-map list still exists.  In the
548 	 * case of a dlclose of an alternative (dlmopen) link-map the whole
549 	 * list may have been removed.
550 	 */
551 	if (olml) {
552 		Aliste	idx;
553 		Lm_list	*lml;
554 
555 		for (APLIST_TRAVERSE(dynlm_list, idx, lml)) {
556 			if (olml == lml) {
557 				nlmp = olml->lm_head;
558 				break;
559 			}
560 		}
561 	}
562 	load_completion(nlmp);
563 	return (error);
564 }
565 
566 /*
567  * Argument checking for dlclose.  Only called via external entry.
568  */
569 static int
dlclose_check(void * handle,Rt_map * clmp)570 dlclose_check(void *handle, Rt_map *clmp)
571 {
572 	Grp_hdl	*ghp = (Grp_hdl *)handle;
573 
574 	if (hdl_validate(ghp) == 0) {
575 		Conv_inv_buf_t	inv_buf;
576 
577 		(void) conv_invalid_val(&inv_buf, EC_NATPTR(ghp), 0);
578 		DBG_CALL(Dbg_dl_dlclose(clmp, inv_buf.buf, DBG_DLCLOSE_NULL));
579 
580 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL),
581 		    EC_NATPTR(handle));
582 		return (1);
583 	}
584 	return (dlclose_intn(ghp, clmp));
585 }
586 
587 #pragma weak _dlclose = dlclose
588 
589 /*
590  * External entry for dlclose(3dl).  Returns 0 for success, non-zero otherwise.
591  */
592 int
dlclose(void * handle)593 dlclose(void *handle)
594 {
595 	int		error, entry;
596 	Rt_map		*clmp;
597 
598 	entry = enter(0);
599 
600 	clmp = _caller(caller(), CL_EXECDEF);
601 
602 	error = dlclose_check(handle, clmp);
603 
604 	if (entry)
605 		leave(LIST(clmp), 0);
606 	return (error);
607 }
608 
609 static uint_t	lmid = 0;
610 
611 /*
612  * The addition of new link-map lists is assumed to be in small quantities.
613  * Here, we assign a unique link-map id for diagnostic use.  Simply update the
614  * running link-map count until we max out.
615  */
616 int
newlmid(Lm_list * lml)617 newlmid(Lm_list *lml)
618 {
619 	char	buffer[MSG_LMID_ALT_SIZE + 12];
620 
621 	if (lmid == UINT_MAX) {
622 		lml->lm_lmid = UINT_MAX;
623 		(void) strncpy(buffer, MSG_ORIG(MSG_LMID_MAXED),
624 		    MSG_LMID_ALT_SIZE + 12);
625 	} else {
626 		lml->lm_lmid = lmid++;
627 		(void) snprintf(buffer, MSG_LMID_ALT_SIZE + 12,
628 		    MSG_ORIG(MSG_LMID_FMT), MSG_ORIG(MSG_LMID_ALT),
629 		    lml->lm_lmid);
630 	}
631 	if ((lml->lm_lmidstr = strdup(buffer)) == NULL)
632 		return (0);
633 
634 	return (1);
635 }
636 
637 /*
638  * Core dlopen activity.
639  */
640 static Grp_hdl *
dlmopen_core(Lm_list * lml,Lm_list * olml,const char * path,int mode,Rt_map * clmp,uint_t flags,uint_t orig,int * in_nfavl)641 dlmopen_core(Lm_list *lml, Lm_list *olml, const char *path, int mode,
642     Rt_map *clmp, uint_t flags, uint_t orig, int *in_nfavl)
643 {
644 	Alist		*palp = NULL;
645 	Rt_map		*nlmp;
646 	Grp_hdl		*ghp;
647 	Aliste		olmco, nlmco;
648 
649 	DBG_CALL(Dbg_dl_dlopen(clmp,
650 	    (path ? path : MSG_ORIG(MSG_STR_ZERO)), in_nfavl, mode));
651 
652 	/*
653 	 * Having diagnosed the originally defined modes, assign any defaults
654 	 * or corrections.
655 	 */
656 	if (((mode & (RTLD_GROUP | RTLD_WORLD)) == 0) &&
657 	    ((mode & RTLD_NOLOAD) == 0))
658 		mode |= (RTLD_GROUP | RTLD_WORLD);
659 	if ((mode & RTLD_NOW) && (rtld_flags2 & RT_FL2_BINDLAZY)) {
660 		mode &= ~RTLD_NOW;
661 		mode |= RTLD_LAZY;
662 	}
663 
664 	/*
665 	 * If the path specified is null then we're operating on global
666 	 * objects.  Associate a dummy handle with the link-map list.
667 	 */
668 	if (path == NULL) {
669 		Grp_hdl *ghp;
670 		uint_t	hflags, rdflags, cdflags;
671 		int	promote = 0;
672 
673 		/*
674 		 * Establish any flags for the handle (Grp_hdl).
675 		 *
676 		 *  -	This is a dummy, public, handle (0) that provides for a
677 		 *	dynamic	search of all global objects within the process.
678 		 *  -   Use of the RTLD_FIRST mode indicates that only the first
679 		 *	dependency on the handle (the referenced object) can be
680 		 *	used to satisfy dlsym() requests.
681 		 */
682 		hflags = (GPH_PUBLIC | GPH_ZERO);
683 		if (mode & RTLD_FIRST)
684 			hflags |= GPH_FIRST;
685 
686 		/*
687 		 * Establish the flags for the referenced dependency descriptor
688 		 * (Grp_desc).
689 		 *
690 		 *  -	The referenced object is available for dlsym().
691 		 *  -	The referenced object is available to relocate against.
692 		 *  -	The referenced object should have it's dependencies
693 		 *	added to this handle.
694 		 */
695 		rdflags = (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS);
696 
697 		/*
698 		 * Establish the flags for this callers dependency descriptor
699 		 * (Grp_desc).
700 		 *
701 		 *  -	The explicit creation of a handle creates a descriptor
702 		 *	for the referenced object and the parent (caller).
703 		 *  -	Use of the RTLD_PARENT flag indicates that the parent
704 		 *	can be relocated against.
705 		 */
706 		cdflags = GPD_PARENT;
707 		if (mode & RTLD_PARENT)
708 			cdflags |= GPD_RELOC;
709 
710 		if ((ghp = hdl_create(lml, 0, clmp, hflags, rdflags,
711 		    cdflags)) == NULL)
712 			return (NULL);
713 
714 		/*
715 		 * Traverse the main link-map control list, updating the mode
716 		 * of any objects as necessary.  Call the relocation engine if
717 		 * this mode promotes the existing state of any relocations.
718 		 * crle()'s first pass loads all objects necessary for building
719 		 * a configuration file, however none of them are relocated.
720 		 * crle()'s second pass relocates objects in preparation for
721 		 * dldump()'ing using dlopen(0, RTLD_NOW).
722 		 */
723 		if ((mode & (RTLD_NOW | RTLD_CONFGEN)) == RTLD_CONFGEN)
724 			return (ghp);
725 
726 		for (nlmp = lml->lm_head; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
727 			if (((MODE(nlmp) & RTLD_GLOBAL) == 0) ||
728 			    (FLAGS(nlmp) & FLG_RT_DELETE))
729 				continue;
730 
731 			if (update_mode(nlmp, MODE(nlmp), mode))
732 				promote = 1;
733 		}
734 		if (promote)
735 			(void) relocate_lmc(lml, ALIST_OFF_DATA, clmp,
736 			    lml->lm_head, in_nfavl);
737 
738 		return (ghp);
739 	}
740 
741 	/*
742 	 * Fix the pathname.  If this object expands to multiple paths (ie.
743 	 * $ISALIST or $HWCAP have been used), then make sure the user has also
744 	 * furnished the RTLD_FIRST flag.  As yet, we don't support opening
745 	 * more than one object at a time, so enforcing the RTLD_FIRST flag
746 	 * provides flexibility should we be able to support dlopening more
747 	 * than one object in the future.
748 	 */
749 	if (LM_FIX_NAME(clmp)(path, clmp, &palp, AL_CNT_NEEDED, orig) == 0)
750 		return (NULL);
751 
752 	if ((palp->al_arritems > 1) && ((mode & RTLD_FIRST) == 0)) {
753 		remove_alist(&palp, 1);
754 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_5));
755 		return (NULL);
756 	}
757 
758 	/*
759 	 * Establish a link-map control list for this request, and load the
760 	 * associated object.
761 	 */
762 	if ((nlmco = create_cntl(lml, 1)) == 0) {
763 		remove_alist(&palp, 1);
764 		return (NULL);
765 	}
766 	olmco = nlmco;
767 
768 	nlmp = load_one(lml, nlmco, palp, clmp, mode, (flags | FLG_RT_PUBHDL),
769 	    &ghp, in_nfavl);
770 
771 	/*
772 	 * Remove any expanded pathname infrastructure, and if the dependency
773 	 * couldn't be loaded, cleanup.
774 	 */
775 	remove_alist(&palp, 1);
776 	if (nlmp == NULL) {
777 		remove_cntl(lml, olmco);
778 		return (NULL);
779 	}
780 
781 	/*
782 	 * If loading an auditor was requested, and the auditor already existed,
783 	 * then the link-map returned will be to the original auditor.  The new
784 	 * link-map list that was initially created, and the associated link-map
785 	 * control list are no longer needed.  As the auditor is already loaded,
786 	 * we're probably done, but fall through in case additional relocations
787 	 * would be triggered by the mode of the caller.
788 	 */
789 	if ((flags & FLG_RT_AUDIT) && (LIST(nlmp) != lml)) {
790 		remove_cntl(lml, olmco);
791 		lml = LIST(nlmp);
792 		olmco = 0;
793 		nlmco = ALIST_OFF_DATA;
794 	}
795 
796 	/*
797 	 * Finish processing the objects associated with this request.
798 	 */
799 	if (((nlmp = analyze_lmc(lml, nlmco, nlmp, clmp, in_nfavl)) == NULL) ||
800 	    (relocate_lmc(lml, nlmco, clmp, nlmp, in_nfavl) == 0)) {
801 		ghp = NULL;
802 		nlmp = NULL;
803 	}
804 
805 	/*
806 	 * If the dlopen has failed, clean up any objects that might have been
807 	 * loaded successfully on this new link-map control list.
808 	 */
809 	if (olmco && (nlmp == NULL))
810 		remove_lmc(lml, clmp, olmco, path);
811 
812 	/*
813 	 * Finally, remove any temporary link-map control list.  Note, if this
814 	 * operation successfully established a new link-map list, then a base
815 	 * link-map control list will have been created, which must remain.
816 	 */
817 	if (olmco && ((nlmp == NULL) || (olml != (Lm_list *)LM_ID_NEWLM)))
818 		remove_cntl(lml, olmco);
819 
820 	return (ghp);
821 }
822 
823 /*
824  * dlopen() and dlsym() operations are the means by which a process can
825  * test for the existence of required dependencies.  If the necessary
826  * dependencies don't exist, then associated functionality can't be used.
827  * However, the lack of dependencies can be fixed, and the dlopen() and
828  * dlsym() requests can be repeated.  As we use a "not-found" AVL tree to
829  * cache any failed full path loads, secondary dlopen() and dlsym() requests
830  * will fail, even if the dependencies have been installed.
831  *
832  * dlopen() and dlsym() retry any failures by removing the "not-found" AVL
833  * tree.  Should any dependencies be found, their names are added to the
834  * FullPath AVL tree.  This routine removes any new "not-found" AVL tree,
835  * so that the dlopen() or dlsym() can replace the original "not-found" tree.
836  */
837 inline static void
nfavl_remove(avl_tree_t * avlt)838 nfavl_remove(avl_tree_t *avlt)
839 {
840 	PathNode	*pnp;
841 	void		*cookie = NULL;
842 
843 	if (avlt) {
844 		while ((pnp = avl_destroy_nodes(avlt, &cookie)) != NULL)
845 			free(pnp);
846 
847 		avl_destroy(avlt);
848 		free(avlt);
849 	}
850 }
851 
852 /*
853  * Internal dlopen() activity.  Called from user level or directly for internal
854  * opens that require a handle.
855  */
856 Grp_hdl *
dlmopen_intn(Lm_list * lml,const char * path,int mode,Rt_map * clmp,uint_t flags,uint_t orig)857 dlmopen_intn(Lm_list *lml, const char *path, int mode, Rt_map *clmp,
858     uint_t flags, uint_t orig)
859 {
860 	Lm_list	*olml = lml;
861 	Rt_map	*dlmp = NULL;
862 	Grp_hdl	*ghp;
863 	int	in_nfavl = 0;
864 
865 	/*
866 	 * Check for magic link-map list values:
867 	 *
868 	 *  LM_ID_BASE:		Operate on the PRIMARY (executables) link map
869 	 *  LM_ID_LDSO:		Operation on ld.so.1's link map
870 	 *  LM_ID_NEWLM:	Create a new link-map.
871 	 */
872 	if (lml == (Lm_list *)LM_ID_NEWLM) {
873 		if ((lml = calloc(1, sizeof (Lm_list))) == NULL)
874 			return (NULL);
875 
876 		/*
877 		 * Establish the new link-map flags from the callers and those
878 		 * explicitly provided.
879 		 */
880 		lml->lm_tflags = LIST(clmp)->lm_tflags;
881 		if (flags & FLG_RT_AUDIT) {
882 			/*
883 			 * Unset any auditing flags - an auditor shouldn't be
884 			 * audited.  Insure all audit dependencies are loaded.
885 			 */
886 			lml->lm_tflags &= ~LML_TFLG_AUD_MASK;
887 			lml->lm_tflags |= (LML_TFLG_NOLAZYLD |
888 			    LML_TFLG_LOADFLTR | LML_TFLG_NOAUDIT);
889 		}
890 
891 		if (aplist_append(&dynlm_list, lml, AL_CNT_DYNLIST) == NULL) {
892 			free(lml);
893 			return (NULL);
894 		}
895 		if (newlmid(lml) == 0) {
896 			(void) aplist_delete_value(dynlm_list, lml);
897 			free(lml);
898 			return (NULL);
899 		}
900 	} else if ((uintptr_t)lml < LM_ID_NUM) {
901 		if ((uintptr_t)lml == LM_ID_BASE)
902 			lml = &lml_main;
903 		else if ((uintptr_t)lml == LM_ID_LDSO)
904 			lml = &lml_rtld;
905 	}
906 
907 	/*
908 	 * Open the required object on the associated link-map list.
909 	 */
910 	ghp = dlmopen_core(lml, olml, path, mode, clmp, flags, orig, &in_nfavl);
911 
912 	/*
913 	 * If the object could not be found it is possible that the "not-found"
914 	 * AVL tree had indicated that the file does not exist.  In case the
915 	 * file system has changed since this "not-found" recording was made,
916 	 * retry the dlopen() with a clean "not-found" AVL tree.
917 	 */
918 	if ((ghp == NULL) && in_nfavl) {
919 		avl_tree_t	*oavlt = nfavl;
920 
921 		nfavl = NULL;
922 		ghp = dlmopen_core(lml, olml, path, mode, clmp, flags, orig,
923 		    NULL);
924 
925 		/*
926 		 * If the file is found, then its full path name will have been
927 		 * registered in the FullPath AVL tree.  Remove any new
928 		 * "not-found" AVL information, and restore the former AVL tree.
929 		 */
930 		nfavl_remove(nfavl);
931 		nfavl = oavlt;
932 	}
933 
934 	/*
935 	 * Establish the new link-map from which .init processing will begin.
936 	 * Ignore .init firing when constructing a configuration file (crle(1)).
937 	 */
938 	if (ghp && ((mode & RTLD_CONFGEN) == 0))
939 		dlmp = ghp->gh_ownlmp;
940 
941 	/*
942 	 * If loading an auditor was requested, and the auditor already existed,
943 	 * then the link-map returned will be to the original auditor.  Remove
944 	 * the link-map control list that was created for this request.
945 	 */
946 	if (dlmp && (flags & FLG_RT_AUDIT) && (LIST(dlmp) != lml)) {
947 		remove_lml(lml);
948 		lml = LIST(dlmp);
949 	}
950 
951 	/*
952 	 * If this load failed, remove any alternative link-map list.
953 	 */
954 	if ((ghp == NULL) &&
955 	    ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) == 0)) {
956 		remove_lml(lml);
957 		lml = NULL;
958 	}
959 
960 	/*
961 	 * Finish this load request.  If objects were loaded, .init processing
962 	 * is computed.  Finally, the debuggers are informed of the link-map
963 	 * lists being stable.
964 	 */
965 	load_completion(dlmp);
966 
967 	return (ghp);
968 }
969 
970 /*
971  * Argument checking for dlopen.  Only called via external entry.
972  */
973 static Grp_hdl *
dlmopen_check(Lm_list * lml,const char * path,int mode,Rt_map * clmp)974 dlmopen_check(Lm_list *lml, const char *path, int mode, Rt_map *clmp)
975 {
976 	/*
977 	 * Verify that a valid pathname has been supplied.
978 	 */
979 	if (path && (*path == '\0')) {
980 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
981 		return (0);
982 	}
983 
984 	/*
985 	 * Historically we've always verified the mode is either RTLD_NOW or
986 	 * RTLD_LAZY.  RTLD_NOLOAD is valid by itself.  Use of LM_ID_NEWLM
987 	 * requires a specific pathname, and use of RTLD_PARENT is meaningless.
988 	 */
989 	if ((mode & (RTLD_NOW | RTLD_LAZY | RTLD_NOLOAD)) == 0) {
990 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_1));
991 		return (0);
992 	}
993 	if ((mode & (RTLD_NOW | RTLD_LAZY)) == (RTLD_NOW | RTLD_LAZY)) {
994 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_2));
995 		return (0);
996 	}
997 	if ((lml == (Lm_list *)LM_ID_NEWLM) && (path == NULL)) {
998 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_3));
999 		return (0);
1000 	}
1001 	if ((lml == (Lm_list *)LM_ID_NEWLM) && (mode & RTLD_PARENT)) {
1002 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLMODE_4));
1003 		return (0);
1004 	}
1005 
1006 	return (dlmopen_intn(lml, path, mode, clmp, 0, 0));
1007 }
1008 
1009 #pragma weak _dlopen = dlopen
1010 
1011 /*
1012  * External entry for dlopen(3dl).  On success, returns a pointer (handle) to
1013  * the structure containing information about the newly added object, ie. can
1014  * be used by dlsym(). On failure, returns a null pointer.
1015  */
1016 void *
dlopen(const char * path,int mode)1017 dlopen(const char *path, int mode)
1018 {
1019 	int	entry;
1020 	Rt_map	*clmp;
1021 	Grp_hdl	*ghp;
1022 	Lm_list	*lml;
1023 
1024 	entry = enter(0);
1025 
1026 	clmp = _caller(caller(), CL_EXECDEF);
1027 	lml = LIST(clmp);
1028 
1029 	ghp = dlmopen_check(lml, path, mode, clmp);
1030 
1031 	if (entry)
1032 		leave(lml, 0);
1033 	return ((void *)ghp);
1034 }
1035 
1036 #pragma weak _dlmopen = dlmopen
1037 
1038 /*
1039  * External entry for dlmopen(3dl).
1040  */
1041 void *
dlmopen(Lmid_t lmid,const char * path,int mode)1042 dlmopen(Lmid_t lmid, const char *path, int mode)
1043 {
1044 	int	entry;
1045 	Rt_map	*clmp;
1046 	Grp_hdl	*ghp;
1047 
1048 	entry = enter(0);
1049 
1050 	clmp = _caller(caller(), CL_EXECDEF);
1051 
1052 	ghp = dlmopen_check((Lm_list *)lmid, path, mode, clmp);
1053 
1054 	if (entry)
1055 		leave(LIST(clmp), 0);
1056 	return ((void *)ghp);
1057 }
1058 
1059 /*
1060  * Handle processing for dlsym.
1061  */
1062 int
dlsym_handle(Grp_hdl * ghp,Slookup * slp,Sresult * srp,uint_t * binfo,int * in_nfavl)1063 dlsym_handle(Grp_hdl *ghp, Slookup *slp, Sresult *srp, uint_t *binfo,
1064     int *in_nfavl)
1065 {
1066 	Rt_map		*nlmp, * lmp = ghp->gh_ownlmp;
1067 	Rt_map		*clmp = slp->sl_cmap;
1068 	const char	*name = slp->sl_name;
1069 	Slookup		sl = *slp;
1070 
1071 	sl.sl_flags = (LKUP_FIRST | LKUP_DLSYM | LKUP_SPEC);
1072 
1073 	/*
1074 	 * Continue processing a dlsym request.  Lookup the required symbol in
1075 	 * each link-map specified by the handle.
1076 	 *
1077 	 * To leverage off of lazy loading, dlsym() requests can result in two
1078 	 * passes.  The first descends the link-maps of any objects already in
1079 	 * the address space.  If the symbol isn't located, and lazy
1080 	 * dependencies still exist, then a second pass is made to load these
1081 	 * dependencies if applicable.  This model means that in the case where
1082 	 * a symbol exists in more than one object, the one located may not be
1083 	 * constant - this is the standard issue with lazy loading. In addition,
1084 	 * attempting to locate a symbol that doesn't exist will result in the
1085 	 * loading of all lazy dependencies on the given handle, which can
1086 	 * defeat some of the advantages of lazy loading (look out JVM).
1087 	 */
1088 	if (ghp->gh_flags & GPH_ZERO) {
1089 		Lm_list	*lml;
1090 		uint_t	lazy = 0;
1091 
1092 		/*
1093 		 * If this symbol lookup is triggered from a dlopen(0) handle,
1094 		 * traverse the present link-map list looking for promiscuous
1095 		 * entries.
1096 		 */
1097 		for (nlmp = lmp; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
1098 			/*
1099 			 * If this handle indicates we're only to look in the
1100 			 * first object check whether we're done.
1101 			 */
1102 			if ((nlmp != lmp) && (ghp->gh_flags & GPH_FIRST))
1103 				return (0);
1104 
1105 			if (!(MODE(nlmp) & RTLD_GLOBAL))
1106 				continue;
1107 			if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1108 			    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1109 				continue;
1110 
1111 			sl.sl_imap = nlmp;
1112 			if (LM_LOOKUP_SYM(clmp)(&sl, srp, binfo, in_nfavl))
1113 				return (1);
1114 
1115 			/*
1116 			 * Keep track of any global pending lazy loads.
1117 			 */
1118 			lazy += LAZY(nlmp);
1119 		}
1120 
1121 		/*
1122 		 * If we're unable to locate the symbol and this link-map list
1123 		 * still has pending lazy dependencies, start loading them in an
1124 		 * attempt to exhaust the search.  Note that as we're already
1125 		 * traversing a dynamic linked list of link-maps there's no
1126 		 * need for elf_lazy_find_sym() to descend the link-maps itself.
1127 		 */
1128 		lml = LIST(lmp);
1129 		if (lazy) {
1130 			DBG_CALL(Dbg_syms_lazy_rescan(lml, name));
1131 
1132 			sl.sl_flags |= LKUP_NODESCENT;
1133 
1134 			for (nlmp = lmp; nlmp; nlmp = NEXT_RT_MAP(nlmp)) {
1135 
1136 				if (!(MODE(nlmp) & RTLD_GLOBAL) || !LAZY(nlmp))
1137 					continue;
1138 				if ((FLAGS(nlmp) & FLG_RT_DELETE) &&
1139 				    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
1140 					continue;
1141 
1142 				sl.sl_imap = nlmp;
1143 				if (elf_lazy_find_sym(&sl, srp, binfo,
1144 				    in_nfavl))
1145 					return (1);
1146 			}
1147 		}
1148 	} else {
1149 		/*
1150 		 * Traverse the dlopen() handle searching all presently loaded
1151 		 * link-maps.
1152 		 */
1153 		Grp_desc	*gdp;
1154 		Aliste		idx;
1155 		uint_t		lazy = 0;
1156 
1157 		for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1158 			nlmp = gdp->gd_depend;
1159 
1160 			if ((gdp->gd_flags & GPD_DLSYM) == 0)
1161 				continue;
1162 
1163 			sl.sl_imap = nlmp;
1164 			if (LM_LOOKUP_SYM(clmp)(&sl, srp, binfo, in_nfavl))
1165 				return (1);
1166 
1167 			if (ghp->gh_flags & GPH_FIRST)
1168 				return (0);
1169 
1170 			/*
1171 			 * Keep track of any pending lazy loads associated
1172 			 * with this handle.
1173 			 */
1174 			lazy += LAZY(nlmp);
1175 		}
1176 
1177 		/*
1178 		 * If we're unable to locate the symbol and this handle still
1179 		 * has pending lazy dependencies, start loading the lazy
1180 		 * dependencies, in an attempt to exhaust the search.
1181 		 */
1182 		if (lazy) {
1183 			DBG_CALL(Dbg_syms_lazy_rescan(LIST(lmp), name));
1184 
1185 			for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1186 				nlmp = gdp->gd_depend;
1187 
1188 				if (((gdp->gd_flags & GPD_DLSYM) == 0) ||
1189 				    (LAZY(nlmp) == 0))
1190 					continue;
1191 
1192 				sl.sl_imap = nlmp;
1193 				if (elf_lazy_find_sym(&sl, srp, binfo,
1194 				    in_nfavl))
1195 					return (1);
1196 			}
1197 		}
1198 	}
1199 	return (0);
1200 }
1201 
1202 /*
1203  * Determine whether a symbol resides in a caller.  This may be a reference,
1204  * which is associated with a specific dependency.
1205  */
1206 inline static Sym *
sym_lookup_in_caller(Rt_map * clmp,Slookup * slp,Sresult * srp,uint_t * binfo)1207 sym_lookup_in_caller(Rt_map *clmp, Slookup *slp, Sresult *srp, uint_t *binfo)
1208 {
1209 	if (THIS_IS_ELF(clmp) && SYMINTP(clmp)(slp, srp, binfo, NULL)) {
1210 		Sym	*sym = srp->sr_sym;
1211 
1212 		slp->sl_rsymndx = (((ulong_t)sym -
1213 		    (ulong_t)SYMTAB(clmp)) / SYMENT(clmp));
1214 		slp->sl_rsym = sym;
1215 		return (sym);
1216 	}
1217 	return (NULL);
1218 }
1219 
1220 /*
1221  * Core dlsym activity.  Selects symbol lookup method from handle.
1222  */
1223 static void *
dlsym_core(void * handle,const char * name,Rt_map * clmp,Rt_map ** dlmp,int * in_nfavl)1224 dlsym_core(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp,
1225     int *in_nfavl)
1226 {
1227 	Sym		*sym;
1228 	int		ret = 0;
1229 	Syminfo		*sip;
1230 	Slookup		sl;
1231 	Sresult		sr;
1232 	uint_t		binfo;
1233 
1234 	/*
1235 	 * Initialize the symbol lookup data structure.
1236 	 *
1237 	 * Standard relocations are evaluated using the symbol index of the
1238 	 * associated relocation symbol.  This index provides for loading
1239 	 * any lazy dependency and establishing a direct binding if necessary.
1240 	 * If a dlsym() operation originates from an object that contains a
1241 	 * symbol table entry for the same name, then we need to establish the
1242 	 * symbol index so that any dependency requirements can be triggered.
1243 	 *
1244 	 * Therefore, the first symbol lookup that is carried out is for the
1245 	 * symbol name within the calling object.  If this symbol exists, the
1246 	 * symbols index is computed, added to the Slookup data, and thus used
1247 	 * to seed the real symbol lookup.
1248 	 */
1249 	SLOOKUP_INIT(sl, name, clmp, clmp, ld_entry_cnt, elf_hash(name),
1250 	    0, 0, 0, LKUP_SYMNDX);
1251 	SRESULT_INIT(sr, name);
1252 	sym = sym_lookup_in_caller(clmp, &sl, &sr, &binfo);
1253 
1254 	SRESULT_INIT(sr, name);
1255 
1256 	if (sym && (ELF_ST_VISIBILITY(sym->st_other) == STV_SINGLETON)) {
1257 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1258 
1259 		/*
1260 		 * If a symbol reference is known, and that reference indicates
1261 		 * that the symbol is a singleton, then the search for the
1262 		 * symbol must follow the default search path.
1263 		 */
1264 		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, 0,
1265 		    DBG_DLSYM_SINGLETON));
1266 
1267 		sl.sl_imap = hlmp;
1268 		if (handle == RTLD_PROBE)
1269 			sl.sl_flags = LKUP_NOFALLBACK;
1270 		else
1271 			sl.sl_flags = LKUP_SPEC;
1272 		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1273 
1274 	} else if (handle == RTLD_NEXT) {
1275 		Rt_map	*nlmp;
1276 
1277 		/*
1278 		 * If this handle is RTLD_NEXT determine whether a lazy load
1279 		 * from the caller might provide the next object.  This mimics
1280 		 * the lazy loading initialization normally carried out by
1281 		 * lookup_sym(), however here, we must do this up-front, as
1282 		 * lookup_sym() will be used to inspect the next object.
1283 		 */
1284 		if ((sl.sl_rsymndx) && ((sip = SYMINFO(clmp)) != NULL)) {
1285 			/* LINTED */
1286 			sip = (Syminfo *)((char *)sip +
1287 			    (sl.sl_rsymndx * SYMINENT(clmp)));
1288 
1289 			if ((sip->si_flags & SYMINFO_FLG_DIRECT) &&
1290 			    (sip->si_boundto < SYMINFO_BT_LOWRESERVE))
1291 				(void) elf_lazy_load(clmp, &sl,
1292 				    sip->si_boundto, name, 0, NULL, in_nfavl);
1293 
1294 			/*
1295 			 * Clear the symbol index, so as not to confuse
1296 			 * lookup_sym() of the next object.
1297 			 */
1298 			sl.sl_rsymndx = 0;
1299 			sl.sl_rsym = NULL;
1300 		}
1301 
1302 		/*
1303 		 * If the handle is RTLD_NEXT, start searching in the next link
1304 		 * map from the callers.  Determine permissions from the
1305 		 * present link map.  Indicate to lookup_sym() that we're on an
1306 		 * RTLD_NEXT request so that it will use the callers link map to
1307 		 * start any possible lazy dependency loading.
1308 		 */
1309 		sl.sl_imap = nlmp = NEXT_RT_MAP(clmp);
1310 
1311 		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl,
1312 		    (nlmp ? NAME(nlmp) : MSG_INTL(MSG_STR_NULL)),
1313 		    DBG_DLSYM_NEXT));
1314 
1315 		if (nlmp == NULL)
1316 			return (0);
1317 
1318 		sl.sl_flags = LKUP_NEXT;
1319 		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1320 
1321 	} else if (handle == RTLD_SELF) {
1322 		/*
1323 		 * If the handle is RTLD_SELF start searching from the caller.
1324 		 */
1325 		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, NAME(clmp),
1326 		    DBG_DLSYM_SELF));
1327 
1328 		sl.sl_imap = clmp;
1329 		sl.sl_flags = (LKUP_SPEC | LKUP_SELF);
1330 		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1331 
1332 	} else if (handle == RTLD_DEFAULT) {
1333 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1334 
1335 		/*
1336 		 * If the handle is RTLD_DEFAULT mimic the standard symbol
1337 		 * lookup as would be triggered by a relocation.
1338 		 */
1339 		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, 0,
1340 		    DBG_DLSYM_DEFAULT));
1341 
1342 		sl.sl_imap = hlmp;
1343 		sl.sl_flags = LKUP_SPEC;
1344 		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1345 
1346 	} else if (handle == RTLD_PROBE) {
1347 		Rt_map	*hlmp = LIST(clmp)->lm_head;
1348 
1349 		/*
1350 		 * If the handle is RTLD_PROBE, mimic the standard symbol
1351 		 * lookup as would be triggered by a relocation, however do
1352 		 * not fall back to a lazy loading rescan if the symbol can't be
1353 		 * found within the currently loaded objects.  Note, a lazy
1354 		 * loaded dependency required by the caller might still get
1355 		 * loaded to satisfy this request, but no exhaustive lazy load
1356 		 * rescan is carried out.
1357 		 */
1358 		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl, 0,
1359 		    DBG_DLSYM_PROBE));
1360 
1361 		sl.sl_imap = hlmp;
1362 		sl.sl_flags = LKUP_NOFALLBACK;
1363 		ret = LM_LOOKUP_SYM(clmp)(&sl, &sr, &binfo, in_nfavl);
1364 
1365 	} else {
1366 		Grp_hdl *ghp = (Grp_hdl *)handle;
1367 
1368 		/*
1369 		 * Look in the shared object specified by the handle and in all
1370 		 * of its dependencies.
1371 		 */
1372 		DBG_CALL(Dbg_dl_dlsym(clmp, name, in_nfavl,
1373 		    NAME(ghp->gh_ownlmp), DBG_DLSYM_DEF));
1374 
1375 		ret = LM_DLSYM(clmp)(ghp, &sl, &sr, &binfo, in_nfavl);
1376 	}
1377 
1378 	if (ret && ((sym = sr.sr_sym) != NULL)) {
1379 		Lm_list	*lml = LIST(clmp);
1380 		Addr	addr = sym->st_value;
1381 
1382 		*dlmp = sr.sr_dmap;
1383 		if (!(FLAGS(*dlmp) & FLG_RT_FIXED))
1384 			addr += ADDR(*dlmp);
1385 
1386 		/*
1387 		 * Indicate that the defining object is now used.
1388 		 */
1389 		if (*dlmp != clmp)
1390 			FLAGS1(*dlmp) |= FL1_RT_USED;
1391 
1392 		DBG_CALL(Dbg_bind_global(clmp, 0, 0, (Xword)-1, PLT_T_NONE,
1393 		    *dlmp, addr, sym->st_value, sr.sr_name, binfo));
1394 
1395 		if ((lml->lm_tflags | AFLAGS(clmp) | AFLAGS(*dlmp)) &
1396 		    LML_TFLG_AUD_SYMBIND) {
1397 			uint_t	sb_flags = LA_SYMB_DLSYM;
1398 			/* LINTED */
1399 			uint_t	symndx = (uint_t)(((Xword)sym -
1400 			    (Xword)SYMTAB(*dlmp)) / SYMENT(*dlmp));
1401 			addr = audit_symbind(clmp, *dlmp, sym, symndx, addr,
1402 			    &sb_flags);
1403 		}
1404 		return ((void *)addr);
1405 	}
1406 
1407 	return (NULL);
1408 }
1409 
1410 /*
1411  * Internal dlsym activity.  Called from user level or directly for internal
1412  * symbol lookup.
1413  */
1414 void *
dlsym_intn(void * handle,const char * name,Rt_map * clmp,Rt_map ** dlmp)1415 dlsym_intn(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1416 {
1417 	Rt_map		*llmp = NULL;
1418 	void		*error;
1419 	Aliste		idx;
1420 	Grp_desc	*gdp;
1421 	int		in_nfavl = 0;
1422 
1423 	/*
1424 	 * While looking for symbols it's quite possible that additional objects
1425 	 * get loaded from lazy loading.  These objects will have been added to
1426 	 * the same link-map list as those objects on the handle.  Remember this
1427 	 * list for later investigation.
1428 	 */
1429 	if ((handle == RTLD_NEXT) || (handle == RTLD_DEFAULT) ||
1430 	    (handle == RTLD_SELF) || (handle == RTLD_PROBE))
1431 		llmp = LIST(clmp)->lm_tail;
1432 	else {
1433 		Grp_hdl	*ghp = (Grp_hdl *)handle;
1434 
1435 		if (ghp->gh_ownlmp)
1436 			llmp = LIST(ghp->gh_ownlmp)->lm_tail;
1437 		else {
1438 			for (ALIST_TRAVERSE(ghp->gh_depends, idx, gdp)) {
1439 				if ((llmp =
1440 				    LIST(gdp->gd_depend)->lm_tail) != NULL)
1441 					break;
1442 			}
1443 		}
1444 	}
1445 
1446 	error = dlsym_core(handle, name, clmp, dlmp, &in_nfavl);
1447 
1448 	/*
1449 	 * If the symbol could not be found it is possible that the "not-found"
1450 	 * AVL tree had indicated that a required file does not exist.  In case
1451 	 * the file system has changed since this "not-found" recording was
1452 	 * made, retry the dlsym() with a clean "not-found" AVL tree.
1453 	 */
1454 	if ((error == NULL) && in_nfavl) {
1455 		avl_tree_t	*oavlt = nfavl;
1456 
1457 		nfavl = NULL;
1458 		error = dlsym_core(handle, name, clmp, dlmp, NULL);
1459 
1460 		/*
1461 		 * If the symbol is found, then any file that was loaded will
1462 		 * have had its full path name registered in the FullPath AVL
1463 		 * tree.  Remove any new "not-found" AVL information, and
1464 		 * restore the former AVL tree.
1465 		 */
1466 		nfavl_remove(nfavl);
1467 		nfavl = oavlt;
1468 	}
1469 
1470 	if (error == NULL) {
1471 		/*
1472 		 * Cache the error message, as Java tends to fall through this
1473 		 * code many times.
1474 		 */
1475 		if (nosym_str == NULL)
1476 			nosym_str = MSG_INTL(MSG_GEN_NOSYM);
1477 		eprintf(LIST(clmp), ERR_FATAL, nosym_str, name);
1478 	}
1479 
1480 	load_completion(llmp);
1481 	return (error);
1482 }
1483 
1484 /*
1485  * Argument checking for dlsym.  Only called via external entry.
1486  */
1487 static void *
dlsym_check(void * handle,const char * name,Rt_map * clmp,Rt_map ** dlmp)1488 dlsym_check(void *handle, const char *name, Rt_map *clmp, Rt_map **dlmp)
1489 {
1490 	/*
1491 	 * Verify the arguments.
1492 	 */
1493 	if (name == NULL) {
1494 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_ILLSYM));
1495 		return (NULL);
1496 	}
1497 	if ((handle != RTLD_NEXT) && (handle != RTLD_DEFAULT) &&
1498 	    (handle != RTLD_SELF) && (handle != RTLD_PROBE) &&
1499 	    (hdl_validate((Grp_hdl *)handle) == 0)) {
1500 		eprintf(LIST(clmp), ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL),
1501 		    EC_NATPTR(handle));
1502 		return (NULL);
1503 	}
1504 	return (dlsym_intn(handle, name, clmp, dlmp));
1505 }
1506 
1507 
1508 #pragma weak _dlsym = dlsym
1509 
1510 /*
1511  * External entry for dlsym().  On success, returns the address of the specified
1512  * symbol.  On error returns a null.
1513  */
1514 void *
dlsym(void * handle,const char * name)1515 dlsym(void *handle, const char *name)
1516 {
1517 	int	entry;
1518 	Rt_map	*clmp, *dlmp = NULL;
1519 	void	*addr;
1520 
1521 	entry = enter(0);
1522 
1523 	clmp = _caller(caller(), CL_EXECDEF);
1524 
1525 	addr = dlsym_check(handle, name, clmp, &dlmp);
1526 
1527 	if (entry) {
1528 		if (dlmp)
1529 			is_dep_init(dlmp, clmp);
1530 		leave(LIST(clmp), 0);
1531 	}
1532 	return (addr);
1533 }
1534 
1535 /*
1536  * Core dladdr activity.
1537  */
1538 static void
dladdr_core(Rt_map * almp,void * addr,Dl_info_t * dlip,void ** info,int flags)1539 dladdr_core(Rt_map *almp, void *addr, Dl_info_t *dlip, void **info, int flags)
1540 {
1541 	/*
1542 	 * Set up generic information and any defaults.
1543 	 */
1544 	dlip->dli_fname = PATHNAME(almp);
1545 
1546 	dlip->dli_fbase = (void *)ADDR(almp);
1547 	dlip->dli_sname = NULL;
1548 	dlip->dli_saddr = NULL;
1549 
1550 	/*
1551 	 * Determine the nearest symbol to this address.
1552 	 */
1553 	LM_DLADDR(almp)((ulong_t)addr, almp, dlip, info, flags);
1554 }
1555 
1556 #pragma weak _dladdr = dladdr
1557 
1558 /*
1559  * External entry for dladdr(3dl) and dladdr1(3dl).  Returns an information
1560  * structure that reflects the symbol closest to the address specified.
1561  */
1562 int
dladdr(void * addr,Dl_info_t * dlip)1563 dladdr(void *addr, Dl_info_t *dlip)
1564 {
1565 	int	entry, ret;
1566 	Rt_map	*clmp, *almp;
1567 	Lm_list	*clml;
1568 
1569 	entry = enter(0);
1570 
1571 	clmp = _caller(caller(), CL_EXECDEF);
1572 	clml = LIST(clmp);
1573 
1574 	DBG_CALL(Dbg_dl_dladdr(clmp, addr));
1575 
1576 	/*
1577 	 * Use our calling technique to determine what object is associated
1578 	 * with the supplied address.  If a caller can't be determined,
1579 	 * indicate the failure.
1580 	 */
1581 	if ((almp = _caller(addr, CL_NONE)) == NULL) {
1582 		eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1583 		    EC_NATPTR(addr));
1584 		ret = 0;
1585 	} else {
1586 		dladdr_core(almp, addr, dlip, 0, 0);
1587 		ret = 1;
1588 	}
1589 
1590 	if (entry)
1591 		leave(clml, 0);
1592 	return (ret);
1593 }
1594 
1595 #pragma weak _dladdr1 = dladdr1
1596 
1597 int
dladdr1(void * addr,Dl_info_t * dlip,void ** info,int flags)1598 dladdr1(void *addr, Dl_info_t *dlip, void **info, int flags)
1599 {
1600 	int	entry, ret = 1;
1601 	Rt_map	*clmp, *almp;
1602 	Lm_list	*clml;
1603 
1604 	entry = enter(0);
1605 
1606 	clmp = _caller(caller(), CL_EXECDEF);
1607 	clml = LIST(clmp);
1608 
1609 	DBG_CALL(Dbg_dl_dladdr(clmp, addr));
1610 
1611 	/*
1612 	 * Validate any flags.
1613 	 */
1614 	if (flags) {
1615 		int	request;
1616 
1617 		if (((request = (flags & RTLD_DL_MASK)) != RTLD_DL_SYMENT) &&
1618 		    (request != RTLD_DL_LINKMAP)) {
1619 			eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLFLAGS),
1620 			    flags);
1621 			ret = 0;
1622 
1623 		} else if (info == NULL) {
1624 			eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLINFO),
1625 			    flags);
1626 			ret = 0;
1627 		}
1628 	}
1629 
1630 	/*
1631 	 * Use our calling technique to determine what object is associated
1632 	 * with the supplied address.  If a caller can't be determined,
1633 	 * indicate the failure.
1634 	 */
1635 	if (ret) {
1636 		if ((almp = _caller(addr, CL_NONE)) == NULL) {
1637 			eprintf(clml, ERR_FATAL, MSG_INTL(MSG_ARG_INVADDR),
1638 			    EC_NATPTR(addr));
1639 			ret = 0;
1640 		} else
1641 			dladdr_core(almp, addr, dlip, info, flags);
1642 	}
1643 
1644 	if (entry)
1645 		leave(clml, 0);
1646 	return (ret);
1647 }
1648 
1649 /*
1650  * Core dldump activity.
1651  */
1652 static int
dldump_core(Rt_map * clmp,Rt_map * lmp,const char * ipath,const char * opath,int flags)1653 dldump_core(Rt_map *clmp, Rt_map *lmp, const char *ipath, const char *opath,
1654     int flags)
1655 {
1656 	Lm_list	*lml = LIST(clmp);
1657 	Addr	addr = 0;
1658 
1659 	/*
1660 	 * Verify any arguments first.
1661 	 */
1662 	if ((opath == NULL) || (opath[0] == '\0') ||
1663 	    ((lmp == NULL) && (ipath[0] == '\0'))) {
1664 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLPATH));
1665 		return (1);
1666 	}
1667 
1668 	/*
1669 	 * If an input file is specified make sure its one of our dependencies
1670 	 * on the main link-map list.  Note, this has really all evolved for
1671 	 * crle(), which uses libcrle.so on an alternative link-map to trigger
1672 	 * dumping objects from the main link-map list.   If we ever want to
1673 	 * dump objects from alternative link-maps, this model is going to
1674 	 * have to be revisited.
1675 	 */
1676 	if (lmp == NULL) {
1677 		if ((lmp = is_so_loaded(&lml_main, ipath, NULL)) == NULL) {
1678 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NOFILE),
1679 			    ipath);
1680 			return (1);
1681 		}
1682 		if (FLAGS(lmp) & FLG_RT_ALTER) {
1683 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_ALTER), ipath);
1684 			return (1);
1685 		}
1686 		if (FLAGS(lmp) & FLG_RT_NODUMP) {
1687 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_GEN_NODUMP),
1688 			    ipath);
1689 			return (1);
1690 		}
1691 	}
1692 
1693 	/*
1694 	 * If the object being dump'ed isn't fixed identify its mapping.
1695 	 */
1696 	if (!(FLAGS(lmp) & FLG_RT_FIXED))
1697 		addr = ADDR(lmp);
1698 
1699 	/*
1700 	 * As rt_dldump() will effectively lazy load the necessary support
1701 	 * libraries, make sure ld.so.1 is initialized for plt relocations.
1702 	 */
1703 	if (elf_rtld_load() == 0)
1704 		return (0);
1705 
1706 	/*
1707 	 * Dump the required image.
1708 	 */
1709 	return (rt_dldump(lmp, opath, flags, addr));
1710 }
1711 
1712 #pragma weak _dldump = dldump
1713 
1714 /*
1715  * External entry for dldump(3c).  Returns 0 on success, non-zero otherwise.
1716  */
1717 int
dldump(const char * ipath,const char * opath,int flags)1718 dldump(const char *ipath, const char *opath, int flags)
1719 {
1720 	int	error, entry;
1721 	Rt_map	*clmp, *lmp;
1722 
1723 	entry = enter(0);
1724 
1725 	clmp = _caller(caller(), CL_EXECDEF);
1726 
1727 	if (ipath) {
1728 		lmp = NULL;
1729 	} else {
1730 		lmp = lml_main.lm_head;
1731 		ipath = NAME(lmp);
1732 	}
1733 
1734 	DBG_CALL(Dbg_dl_dldump(clmp, ipath, opath, flags));
1735 
1736 	error = dldump_core(clmp, lmp, ipath, opath, flags);
1737 
1738 	if (entry)
1739 		leave(LIST(clmp), 0);
1740 	return (error);
1741 }
1742 
1743 /*
1744  * get_linkmap_id() translates Lm_list * pointers to the Link_map id as used by
1745  * the rtld_db and dlmopen() interfaces.  It checks to see if the Link_map is
1746  * one of the primary ones and if so returns it's special token:
1747  *		LM_ID_BASE
1748  *		LM_ID_LDSO
1749  *
1750  * If it's not one of the primary link_map id's it will instead returns a
1751  * pointer to the Lm_list structure which uniquely identifies the Link_map.
1752  */
1753 Lmid_t
get_linkmap_id(Lm_list * lml)1754 get_linkmap_id(Lm_list *lml)
1755 {
1756 	if (lml->lm_flags & LML_FLG_BASELM)
1757 		return (LM_ID_BASE);
1758 	if (lml->lm_flags & LML_FLG_RTLDLM)
1759 		return (LM_ID_LDSO);
1760 
1761 	return ((Lmid_t)lml);
1762 }
1763 
1764 /*
1765  * Set a new deferred dependency name.
1766  */
1767 static int
set_def_need(Lm_list * lml,Dyninfo * dyip,const char * name)1768 set_def_need(Lm_list *lml, Dyninfo *dyip, const char *name)
1769 {
1770 	/*
1771 	 * If this dependency has already been established, then this dlinfo()
1772 	 * call is too late.
1773 	 */
1774 	if (dyip->di_info) {
1775 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_DEF_DEPLOADED),
1776 		    dyip->di_name);
1777 		return (-1);
1778 	}
1779 
1780 	/*
1781 	 * Assign the new dependency name.
1782 	 */
1783 	DBG_CALL(Dbg_file_deferred(lml, dyip->di_name, name));
1784 	dyip->di_flags |= FLG_DI_DEF_DONE;
1785 	dyip->di_name = name;
1786 	return (0);
1787 }
1788 
1789 /*
1790  * Extract information for a dlopen() handle.
1791  */
1792 static int
dlinfo_core(void * handle,int request,void * p,Rt_map * clmp)1793 dlinfo_core(void *handle, int request, void *p, Rt_map *clmp)
1794 {
1795 	Conv_inv_buf_t	inv_buf;
1796 	char		*handlename;
1797 	Lm_list		*lml = LIST(clmp);
1798 	Rt_map		*lmp = NULL;
1799 
1800 	/*
1801 	 * Determine whether a handle is provided.  A handle isn't needed for
1802 	 * all operations, but it is validated here for the initial diagnostic.
1803 	 */
1804 	if (handle == RTLD_SELF) {
1805 		lmp = clmp;
1806 	} else {
1807 		Grp_hdl	*ghp = (Grp_hdl *)handle;
1808 
1809 		if (hdl_validate(ghp))
1810 			lmp = ghp->gh_ownlmp;
1811 	}
1812 	if (lmp) {
1813 		handlename = NAME(lmp);
1814 	} else {
1815 		(void) conv_invalid_val(&inv_buf, EC_NATPTR(handle), 0);
1816 		handlename = inv_buf.buf;
1817 	}
1818 
1819 	DBG_CALL(Dbg_dl_dlinfo(clmp, handlename, request, p));
1820 
1821 	/*
1822 	 * Validate the request and return buffer.
1823 	 */
1824 	if ((request > RTLD_DI_MAX) || (p == NULL)) {
1825 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_ILLVAL));
1826 		return (-1);
1827 	}
1828 
1829 	/*
1830 	 * Return configuration cache name and address.
1831 	 */
1832 	if (request == RTLD_DI_CONFIGADDR) {
1833 		Dl_info_t	*dlip = (Dl_info_t *)p;
1834 
1835 		if ((config->c_name == NULL) || (config->c_bgn == 0) ||
1836 		    (config->c_end == 0)) {
1837 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOCONFIG));
1838 			return (-1);
1839 		}
1840 		dlip->dli_fname = config->c_name;
1841 		dlip->dli_fbase = (void *)config->c_bgn;
1842 		return (0);
1843 	}
1844 
1845 	/*
1846 	 * Return profiled object name (used by ldprof audit library).
1847 	 */
1848 	if (request == RTLD_DI_PROFILENAME) {
1849 		if (profile_name == NULL) {
1850 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_NOPROFNAME));
1851 			return (-1);
1852 		}
1853 
1854 		*(const char **)p = profile_name;
1855 		return (0);
1856 	}
1857 	if (request == RTLD_DI_PROFILEOUT) {
1858 		/*
1859 		 * If a profile destination directory hasn't been specified
1860 		 * provide a default.
1861 		 */
1862 		if (profile_out == NULL)
1863 			profile_out = MSG_ORIG(MSG_PTH_VARTMP);
1864 
1865 		*(const char **)p = profile_out;
1866 		return (0);
1867 	}
1868 
1869 	/*
1870 	 * Obtain or establish a termination signal.
1871 	 */
1872 	if (request == RTLD_DI_GETSIGNAL) {
1873 		*(int *)p = killsig;
1874 		return (0);
1875 	}
1876 
1877 	if (request == RTLD_DI_SETSIGNAL) {
1878 		sigset_t	set;
1879 		int		sig = *(int *)p;
1880 
1881 		/*
1882 		 * Determine whether the signal is in range.
1883 		 */
1884 		(void) sigfillset(&set);
1885 		if (sigismember(&set, sig) != 1) {
1886 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVSIG), sig);
1887 			return (-1);
1888 		}
1889 
1890 		killsig = sig;
1891 		return (0);
1892 	}
1893 
1894 	/*
1895 	 * For any other request a link-map is required.  Verify the handle.
1896 	 */
1897 	if (lmp == NULL) {
1898 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_ARG_INVHNDL),
1899 		    EC_NATPTR(handle));
1900 		return (-1);
1901 	}
1902 
1903 	/*
1904 	 * Obtain the process arguments, environment and auxv.  Note, as the
1905 	 * environment can be modified by the user (putenv(3c)), reinitialize
1906 	 * the environment pointer on each request.
1907 	 */
1908 	if (request == RTLD_DI_ARGSINFO) {
1909 		Dl_argsinfo_t	*aip = (Dl_argsinfo_t *)p;
1910 		Lm_list		*lml = LIST(lmp);
1911 
1912 		*aip = argsinfo;
1913 		if (lml->lm_flags & LML_FLG_ENVIRON)
1914 			aip->dla_envp = *(lml->lm_environ);
1915 
1916 		return (0);
1917 	}
1918 
1919 	/*
1920 	 * Return Lmid_t of the Link-Map list that the specified object is
1921 	 * loaded on.
1922 	 */
1923 	if (request == RTLD_DI_LMID) {
1924 		*(Lmid_t *)p = get_linkmap_id(LIST(lmp));
1925 		return (0);
1926 	}
1927 
1928 	/*
1929 	 * Return a pointer to the Link-Map structure associated with the
1930 	 * specified object.
1931 	 */
1932 	if (request == RTLD_DI_LINKMAP) {
1933 		*(Link_map **)p = (Link_map *)lmp;
1934 		return (0);
1935 	}
1936 
1937 	/*
1938 	 * Return search path information, or the size of the buffer required
1939 	 * to store the information.
1940 	 */
1941 	if ((request == RTLD_DI_SERINFO) || (request == RTLD_DI_SERINFOSIZE)) {
1942 		Spath_desc	sd = { search_rules, NULL, 0 };
1943 		Pdesc		*pdp;
1944 		Dl_serinfo_t	*info;
1945 		Dl_serpath_t	*path;
1946 		char		*strs;
1947 		size_t		size = sizeof (Dl_serinfo_t);
1948 		uint_t		cnt = 0;
1949 
1950 		info = (Dl_serinfo_t *)p;
1951 		path = &info->dls_serpath[0];
1952 		strs = (char *)&info->dls_serpath[info->dls_cnt];
1953 
1954 		/*
1955 		 * Traverse search path entries for this object.
1956 		 */
1957 		while ((pdp = get_next_dir(&sd, lmp, 0)) != NULL) {
1958 			size_t	_size;
1959 
1960 			if (pdp->pd_pname == NULL)
1961 				continue;
1962 
1963 			/*
1964 			 * If configuration information exists, it's possible
1965 			 * this path has been identified as non-existent, if so
1966 			 * ignore it.
1967 			 */
1968 			if (pdp->pd_info) {
1969 				Rtc_obj	*dobj = (Rtc_obj *)pdp->pd_info;
1970 				if (dobj->co_flags & RTC_OBJ_NOEXIST)
1971 					continue;
1972 			}
1973 
1974 			/*
1975 			 * Keep track of search path count and total info size.
1976 			 */
1977 			if (cnt++)
1978 				size += sizeof (Dl_serpath_t);
1979 			_size = pdp->pd_plen + 1;
1980 			size += _size;
1981 
1982 			if (request == RTLD_DI_SERINFOSIZE)
1983 				continue;
1984 
1985 			/*
1986 			 * If we're filling in search path information, confirm
1987 			 * there's sufficient space.
1988 			 */
1989 			if (size > info->dls_size) {
1990 				eprintf(lml, ERR_FATAL,
1991 				    MSG_INTL(MSG_ARG_SERSIZE),
1992 				    EC_OFF(info->dls_size));
1993 				return (-1);
1994 			}
1995 			if (cnt > info->dls_cnt) {
1996 				eprintf(lml, ERR_FATAL,
1997 				    MSG_INTL(MSG_ARG_SERCNT), info->dls_cnt);
1998 				return (-1);
1999 			}
2000 
2001 			/*
2002 			 * Append the path to the information buffer.
2003 			 */
2004 			(void) strcpy(strs, pdp->pd_pname);
2005 			path->dls_name = strs;
2006 			path->dls_flags = (pdp->pd_flags & LA_SER_MASK);
2007 
2008 			strs = strs + _size;
2009 			path++;
2010 		}
2011 
2012 		/*
2013 		 * If we're here to size the search buffer fill it in.
2014 		 */
2015 		if (request == RTLD_DI_SERINFOSIZE) {
2016 			info->dls_size = size;
2017 			info->dls_cnt = cnt;
2018 		}
2019 
2020 		return (0);
2021 	}
2022 
2023 	/*
2024 	 * Return the origin of the object associated with this link-map.
2025 	 * Basically return the dirname(1) of the objects fullpath.
2026 	 */
2027 	if (request == RTLD_DI_ORIGIN) {
2028 		char	*str = (char *)p;
2029 
2030 		(void) strncpy(str, ORIGNAME(lmp), DIRSZ(lmp));
2031 		str += DIRSZ(lmp);
2032 		*str = '\0';
2033 
2034 		return (0);
2035 	}
2036 
2037 	/*
2038 	 * Return the number of object mappings, or the mapping information for
2039 	 * this object.
2040 	 */
2041 	if (request == RTLD_DI_MMAPCNT) {
2042 		uint_t	*cnt = (uint_t *)p;
2043 
2044 		*cnt = MMAPCNT(lmp);
2045 		return (0);
2046 	}
2047 	if (request == RTLD_DI_MMAPS) {
2048 		Dl_mapinfo_t	*mip = (Dl_mapinfo_t *)p;
2049 
2050 		if (mip->dlm_acnt && mip->dlm_maps) {
2051 			uint_t	cnt = 0;
2052 
2053 			while ((cnt < mip->dlm_acnt) && (cnt < MMAPCNT(lmp))) {
2054 				mip->dlm_maps[cnt] = MMAPS(lmp)[cnt];
2055 				cnt++;
2056 			}
2057 			mip->dlm_rcnt = cnt;
2058 		}
2059 		return (0);
2060 	}
2061 
2062 	/*
2063 	 * Assign a new dependency name to a deferred dependency.
2064 	 */
2065 	if ((request == RTLD_DI_DEFERRED) ||
2066 	    (request == RTLD_DI_DEFERRED_SYM)) {
2067 		Dl_definfo_t	*dfip = (Dl_definfo_t *)p;
2068 		Dyninfo		*dyip;
2069 		const char	*dname, *rname;
2070 
2071 		/*
2072 		 * Verify the names.
2073 		 */
2074 		if ((dfip->dld_refname == NULL) ||
2075 		    (dfip->dld_depname == NULL)) {
2076 			eprintf(LIST(clmp), ERR_FATAL,
2077 			    MSG_INTL(MSG_ARG_ILLNAME));
2078 			return (-1);
2079 		}
2080 
2081 		dname = dfip->dld_depname;
2082 		rname = dfip->dld_refname;
2083 
2084 		/*
2085 		 * A deferred dependency can be determined by referencing a
2086 		 * symbol family member that is associated to the dependency,
2087 		 * or by looking for the dependency by its name.
2088 		 */
2089 		if (request == RTLD_DI_DEFERRED_SYM) {
2090 			Slookup		sl;
2091 			Sresult		sr;
2092 			uint_t		binfo;
2093 			Syminfo		*sip;
2094 
2095 			/*
2096 			 * Lookup the symbol in the associated object.
2097 			 */
2098 			SLOOKUP_INIT(sl, rname, lmp, lmp, ld_entry_cnt,
2099 			    elf_hash(rname), 0, 0, 0, LKUP_SYMNDX);
2100 			SRESULT_INIT(sr, rname);
2101 			if (sym_lookup_in_caller(clmp, &sl, &sr,
2102 			    &binfo) == NULL) {
2103 				eprintf(LIST(clmp), ERR_FATAL,
2104 				    MSG_INTL(MSG_DEF_NOSYMFOUND), rname);
2105 				return (-1);
2106 			}
2107 
2108 			/*
2109 			 * Use the symbols index to reference the Syminfo entry
2110 			 * and thus find the associated dependency.
2111 			 */
2112 			if (sl.sl_rsymndx && ((sip = SYMINFO(clmp)) != NULL)) {
2113 				/* LINTED */
2114 				sip = (Syminfo *)((char *)sip +
2115 				    (sl.sl_rsymndx * SYMINENT(lmp)));
2116 
2117 				if ((sip->si_flags & SYMINFO_FLG_DEFERRED) &&
2118 				    (sip->si_boundto < SYMINFO_BT_LOWRESERVE) &&
2119 				    ((dyip = DYNINFO(lmp)) != NULL)) {
2120 					dyip += sip->si_boundto;
2121 
2122 					if (!(dyip->di_flags & FLG_DI_IGNORE))
2123 						return (set_def_need(lml,
2124 						    dyip, dname));
2125 				}
2126 			}
2127 
2128 			/*
2129 			 * No deferred symbol found.
2130 			 */
2131 			eprintf(LIST(clmp), ERR_FATAL,
2132 			    MSG_INTL(MSG_DEF_NOSYMFOUND), rname);
2133 			return (-1);
2134 
2135 		} else {
2136 			Dyn	*dyn;
2137 
2138 			/*
2139 			 * Using the target objects dependency information, find
2140 			 * the associated deferred dependency.
2141 			 */
2142 			for (dyn = DYN(lmp), dyip = DYNINFO(lmp);
2143 			    !(dyip->di_flags & FLG_DI_IGNORE); dyn++, dyip++) {
2144 				const char	*oname;
2145 
2146 				if ((dyip->di_flags & FLG_DI_DEFERRED) == 0)
2147 					continue;
2148 
2149 				if (strcmp(rname, dyip->di_name) == 0)
2150 					return (set_def_need(lml, dyip, dname));
2151 
2152 				/*
2153 				 * If this dependency name has been changed by
2154 				 * a previous dlinfo(), check the original
2155 				 * dynamic entry string.  The user might be
2156 				 * attempting to re-change an entry using the
2157 				 * original name as the reference.
2158 				 */
2159 				if ((dyip->di_flags & FLG_DI_DEF_DONE) == 0)
2160 					continue;
2161 
2162 				oname = STRTAB(lmp) + dyn->d_un.d_val;
2163 				if (strcmp(rname, oname) == 0)
2164 					return (set_def_need(lml, dyip, dname));
2165 			}
2166 
2167 			/*
2168 			 * No deferred dependency found.
2169 			 */
2170 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_DEF_NODEPFOUND),
2171 			    rname);
2172 			return (-1);
2173 		}
2174 	}
2175 	return (0);
2176 }
2177 
2178 #pragma weak _dlinfo = dlinfo
2179 
2180 /*
2181  * External entry for dlinfo(3dl).
2182  */
2183 int
dlinfo(void * handle,int request,void * p)2184 dlinfo(void *handle, int request, void *p)
2185 {
2186 	int	error, entry;
2187 	Rt_map	*clmp;
2188 
2189 	entry = enter(0);
2190 
2191 	clmp = _caller(caller(), CL_EXECDEF);
2192 
2193 	error = dlinfo_core(handle, request, p, clmp);
2194 
2195 	if (entry)
2196 		leave(LIST(clmp), 0);
2197 	return (error);
2198 }
2199 
2200 /*
2201  * GNU defined function to iterate through the program headers for all
2202  * currently loaded dynamic objects. The caller supplies a callback function
2203  * which is called for each object.
2204  *
2205  * entry:
2206  *	callback - Callback function to call. The arguments to the callback
2207  *		function are:
2208  *		info - Address of dl_phdr_info structure
2209  *		size - sizeof (struct dl_phdr_info)
2210  *		data - Caller supplied value.
2211  *	data - Value supplied by caller, which is passed to callback without
2212  *		examination.
2213  *
2214  * exit:
2215  *	callback is called for each dynamic ELF object in the process address
2216  *	space, halting when a non-zero value is returned, or when the last
2217  *	object has been processed. The return value from the last call
2218  *	to callback is returned.
2219  *
2220  * note:
2221  *	The Linux implementation has added additional fields to the
2222  *	dl_phdr_info structure over time. The callback function is
2223  *	supposed to use the size field to determine which fields are
2224  *	present, and to avoid attempts to access non-existent fields.
2225  *	We have added those fields that are compatible with Solaris, and
2226  *	which are used by GNU C++ (g++) runtime exception handling support.
2227  *
2228  * note:
2229  *	We issue a callback for every ELF object mapped into the process
2230  *	address space at the time this routine is entered. These callbacks
2231  *	are arbitrary functions that can do anything, including possibly
2232  *	causing new objects to be mapped into the process, or unmapped.
2233  *	This complicates matters:
2234  *
2235  *	-	Adding new objects can cause the alists to be reallocated
2236  *		or for contents to move. This can happen explicitly via
2237  *		dlopen(), or implicitly via lazy loading. One might consider
2238  *		simply banning dlopen from a callback, but lazy loading must
2239  *		be allowed, in which case there's no reason to ban dlopen().
2240  *
2241  *	-	Removing objects can leave us holding references to freed
2242  *		memory that must not be accessed, and can cause the list
2243  *		items to move in a way that would cause us to miss reporting
2244  *		one, or double report others.
2245  *
2246  *	-	We cannot allocate memory to build a separate data structure,
2247  *		because the interface to dl_iterate_phdr() does not have a
2248  *		way to communicate allocation errors back to the caller.
2249  *		Even if we could, it would be difficult to do so efficiently.
2250  *
2251  *	-	It is possible for dl_iterate_phdr() to be called recursively
2252  *		from a callback, and there is no way for us to detect or manage
2253  *		this effectively, particularly as the user might use longjmp()
2254  *		to skip past us on return. Hence, we must be reentrant
2255  *		(stateless), further precluding the option of building a
2256  *		separate data structure.
2257  *
2258  *	Despite these constraints, we are able to traverse the link-map
2259  *	lists safely:
2260  *
2261  *	-	Once interposer (preload) objects have been processed at
2262  *		startup, we know that new objects are always placed at the
2263  *		end of the list. Hence, if we are reading a list when that
2264  *		happens, the new object will not alter the part of the list
2265  *		that we've already processed.
2266  *
2267  *	-	The alist _TRAVERSE macros recalculate the address of the
2268  *		current item from scratch on each iteration, rather than
2269  *		incrementing a pointer. Hence, alist additions that occur
2270  *		in mid-traverse will not cause confusion.
2271  *
2272  *	There is one limitation: We cannot continue operation if an object
2273  *	is removed from the process from within a callback. We detect when
2274  *	this happens and return immediately with a -1 return value.
2275  *
2276  * note:
2277  *	As currently implemented, if a callback causes an object to be loaded,
2278  *	that object may or may not be reported by the current invocation of
2279  *	dl_iterate_phdr(), based on whether or not we have already processed
2280  *	the link-map list that receives it. If we want to prevent this, it
2281  *	can be done efficiently by associating the current value of cnt_map
2282  *	with each new Rt_map entered into the system. Then this function can
2283  *	use that to detect and skip new objects that enter the system in
2284  *	mid-iteration. However, the Linux documentation is ambiguous on whether
2285  *	this is necessary, and it does not appear to matter in practice.
2286  *	We have therefore chosen not to do so at this time.
2287  */
2288 int
dl_iterate_phdr(int (* callback)(struct dl_phdr_info *,size_t,void *),void * data)2289 dl_iterate_phdr(int (*callback)(struct dl_phdr_info *, size_t, void *),
2290     void *data)
2291 {
2292 	struct dl_phdr_info	info;
2293 	u_longlong_t		l_cnt_map = cnt_map;
2294 	u_longlong_t		l_cnt_unmap = cnt_unmap;
2295 	Lm_list			*lml, *clml;
2296 	Lm_cntl			*lmc;
2297 	Rt_map			*lmp, *clmp;
2298 	Aliste			idx1, idx2;
2299 	Ehdr			*ehdr;
2300 	int			ret = 0;
2301 	int			entry;
2302 
2303 	entry = enter(0);
2304 	clmp = _caller(caller(), CL_EXECDEF);
2305 	clml = LIST(clmp);
2306 
2307 	DBG_CALL(Dbg_dl_iphdr_enter(clmp, cnt_map, cnt_unmap));
2308 
2309 	/* Issue a callback for each ELF object in the process */
2310 	for (APLIST_TRAVERSE(dynlm_list, idx1, lml)) {
2311 		for (ALIST_TRAVERSE(lml->lm_lists, idx2, lmc)) {
2312 			for (lmp = lmc->lc_head; lmp; lmp = NEXT_RT_MAP(lmp)) {
2313 #if defined(_sparc) && !defined(_LP64)
2314 				/*
2315 				 * On 32-bit sparc, the possibility exists that
2316 				 * this object is not ELF.
2317 				 */
2318 				if (THIS_IS_NOT_ELF(lmp))
2319 					continue;
2320 #endif
2321 				/* Prepare the object information structure */
2322 				ehdr = (Ehdr *) ADDR(lmp);
2323 				info.dlpi_addr = (ehdr->e_type == ET_EXEC) ?
2324 				    0 : ADDR(lmp);
2325 				info.dlpi_name = lmp->rt_pathname;
2326 				info.dlpi_phdr = (Phdr *)
2327 				    (ADDR(lmp) + ehdr->e_phoff);
2328 				info.dlpi_phnum = ehdr->e_phnum;
2329 				info.dlpi_adds = cnt_map;
2330 				info.dlpi_subs = cnt_unmap;
2331 
2332 				/* Issue the callback */
2333 				DBG_CALL(Dbg_dl_iphdr_callback(clml, &info));
2334 				leave(clml, thr_flg_reenter);
2335 				ret = (* callback)(&info, sizeof (info), data);
2336 				(void) enter(thr_flg_reenter);
2337 
2338 				/* Return immediately on non-zero result */
2339 				if (ret != 0)
2340 					goto done;
2341 
2342 				/* Adapt to object mapping changes */
2343 				if ((cnt_map == l_cnt_map) &&
2344 				    (cnt_unmap == l_cnt_unmap))
2345 					continue;
2346 
2347 				DBG_CALL(Dbg_dl_iphdr_mapchange(clml, cnt_map,
2348 				    cnt_unmap));
2349 
2350 				/* Stop if an object was unmapped */
2351 				if (cnt_unmap == l_cnt_unmap) {
2352 					l_cnt_map = cnt_map;
2353 					continue;
2354 				}
2355 
2356 				ret = -1;
2357 				DBG_CALL(Dbg_dl_iphdr_unmap_ret(clml));
2358 				goto done;
2359 			}
2360 		}
2361 	}
2362 
2363 done:
2364 	if (entry)
2365 		leave(LIST(clmp), 0);
2366 	return (ret);
2367 }
2368