xref: /openbsd-src/libexec/ld.so/resolve.c (revision 49fb1b5767076b68c85f45503adec31ca9267b61)
1 /*	$OpenBSD: resolve.c,v 1.85 2018/11/16 05:05:44 guenther Exp $ */
2 
3 /*
4  * Copyright (c) 1998 Per Fogelstrom, Opsycon AB
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
16  * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
17  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
19  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  *
27  */
28 
29 #define _DYN_LOADER
30 
31 #include <sys/types.h>
32 
33 #include <limits.h>
34 #include <nlist.h>
35 #include <link.h>
36 #include "syscall.h"
37 #include "archdep.h"
38 #include "path.h"
39 #include "resolve.h"
40 
41 /* substitution types */
42 typedef enum {
43 	SUBST_UNKNOWN, SUBST_ORIGIN, SUBST_OSNAME, SUBST_OSREL, SUBST_PLATFORM
44 } SUBST_TYPES;
45 
46 struct symlookup {
47 	const char		*sl_name;
48 	const elf_object_t	*sl_obj_out;
49 	const Elf_Sym		*sl_sym_out;
50 	const elf_object_t	*sl_weak_obj_out;
51 	const Elf_Sym		*sl_weak_sym_out;
52 	unsigned long		sl_elf_hash;
53 	int			sl_flags;
54 };
55 
56 elf_object_t *_dl_objects;
57 elf_object_t *_dl_last_object;
58 elf_object_t *_dl_loading_object;
59 
60 /*
61  * Add a new dynamic object to the object list.
62  */
63 void
64 _dl_add_object(elf_object_t *object)
65 {
66 	/*
67 	 * If a .so is marked nodelete, then the entire load group that it's
68 	 * in needs to be kept around forever, so add a reference there.
69 	 * XXX It would be better if we tracked inter-object dependencies
70 	 * from relocations and didn't leave dangling pointers when a load
71 	 * group was partially unloaded.  That would render this unnecessary.
72 	 */
73 	if (object->obj_flags & DF_1_NODELETE &&
74 	    (object->load_object->status & STAT_NODELETE) == 0) {
75 		DL_DEB(("objname %s is nodelete\n", object->load_name));
76 		object->load_object->opencount++;
77 		object->load_object->status |= STAT_NODELETE;
78 	}
79 
80 	/*
81 	 * if this is a new object, prev will be NULL
82 	 * != NULL if an object already in the list
83 	 * prev == NULL for the first item in the list, but that will
84 	 * be the executable.
85 	 */
86 	if (object->prev != NULL)
87 		return;
88 
89 	if (_dl_objects == NULL) {			/* First object ? */
90 		_dl_last_object = _dl_objects = object;
91 	} else {
92 		_dl_last_object->next = object;
93 		object->prev = _dl_last_object;
94 		_dl_last_object = object;
95 	}
96 }
97 
98 /*
99  * Identify substitution sequence name.
100  */
101 static int
102 _dl_subst_name(const char *name, size_t siz) {
103 	switch (siz) {
104 	case 5:
105 		if (_dl_strncmp(name, "OSREL", 5) == 0)
106 			return SUBST_OSREL;
107 		break;
108 	case 6:
109 		if (_dl_strncmp(name, "ORIGIN", 6) == 0)
110 			return SUBST_ORIGIN;
111 		if (_dl_strncmp(name, "OSNAME", 6) == 0)
112 			return SUBST_OSNAME;
113 		break;
114 	case 8:
115 		if (_dl_strncmp(name, "PLATFORM", 8) == 0)
116 			return SUBST_PLATFORM;
117 		break;
118 	}
119 
120 	return (SUBST_UNKNOWN);
121 }
122 
123 /*
124  * Perform $ORIGIN substitutions on path
125  */
126 static void
127 _dl_origin_subst_path(elf_object_t *object, const char *origin_path,
128     char **path)
129 {
130 	char tmp_path[PATH_MAX];
131 	char *new_path, *tp;
132 	const char *pp, *name, *value;
133 	static struct utsname uts;
134 	size_t value_len;
135 	int skip_brace;
136 
137 	if (uts.sysname[0] == '\0') {
138 		if (_dl_uname(&uts) != 0)
139 			return;
140 	}
141 
142 	tp = tmp_path;
143 	pp = *path;
144 
145 	while (*pp != '\0' && (tp - tmp_path) < sizeof(tmp_path)) {
146 
147 		/* copy over chars up to but not including $ */
148 		while (*pp != '\0' && *pp != '$' &&
149 		    (tp - tmp_path) < sizeof(tmp_path))
150 			*tp++ = *pp++;
151 
152 		/* substitution sequence detected */
153 		if (*pp == '$' && (tp - tmp_path) < sizeof(tmp_path)) {
154 			pp++;
155 
156 			if ((skip_brace = (*pp == '{')))
157 				pp++;
158 
159 			/* skip over name */
160 			name = pp;
161 			while (_dl_isalnum((unsigned char)*pp) || *pp == '_')
162 				pp++;
163 
164 			switch (_dl_subst_name(name, pp - name)) {
165 			case SUBST_ORIGIN:
166 				value = origin_path;
167 				break;
168 			case SUBST_OSNAME:
169 				value = uts.sysname;
170 				break;
171 			case SUBST_OSREL:
172 				value = uts.release;
173 				break;
174 			case SUBST_PLATFORM:
175 				value = uts.machine;
176 				break;
177 			default:
178 				value = "";
179 			}
180 
181 			value_len = _dl_strlen(value);
182 			if (value_len >= sizeof(tmp_path) - (tp - tmp_path))
183 				return;
184 
185 			_dl_bcopy(value, tp, value_len);
186 			tp += value_len;
187 
188 			if (skip_brace && *pp == '}')
189 				pp++;
190 		}
191 	}
192 
193 	/* no substitution made if result exceeds sizeof(tmp_path) */
194 	if (tp - tmp_path >= sizeof(tmp_path))
195 		return;
196 
197 	/* NULL terminate tmp_path */
198 	*tp = '\0';
199 
200 	if (_dl_strcmp(tmp_path, *path) == 0)
201 		return;
202 
203 	new_path = _dl_strdup(tmp_path);
204 	if (new_path == NULL)
205 		return;
206 
207 	DL_DEB(("orig_path %s\n", *path));
208 	DL_DEB(("new_path  %s\n", new_path));
209 
210 	_dl_free(*path);
211 	*path = new_path;
212 }
213 
214 /*
215  * Determine origin_path from object load_name. The origin_path argument
216  * must refer to a buffer capable of storing at least PATH_MAX characters.
217  * Returns 0 on success.
218  */
219 static int
220 _dl_origin_path(elf_object_t *object, char *origin_path)
221 {
222 	const char *dirname_path = _dl_dirname(object->load_name);
223 
224 	if (dirname_path == NULL)
225 		return -1;
226 
227 	if (_dl_realpath(dirname_path, origin_path) == NULL)
228 		return -1;
229 
230 	return 0;
231 }
232 
233 /*
234  * Perform $ORIGIN substitutions on runpath and rpath
235  */
236 static void
237 _dl_origin_subst(elf_object_t *object)
238 {
239 	char origin_path[PATH_MAX];
240 	char **pp;
241 
242 	if (_dl_origin_path(object, origin_path) != 0)
243 		return;
244 
245 	/* perform path substitutions on each segment of runpath and rpath */
246 	if (object->runpath != NULL) {
247 		for (pp = object->runpath; *pp != NULL; pp++)
248 			_dl_origin_subst_path(object, origin_path, pp);
249 	}
250 	if (object->rpath != NULL) {
251 		for (pp = object->rpath; *pp != NULL; pp++)
252 			_dl_origin_subst_path(object, origin_path, pp);
253 	}
254 }
255 
256 /*
257  * Initialize a new dynamic object.
258  */
259 elf_object_t *
260 _dl_finalize_object(const char *objname, Elf_Dyn *dynp, Elf_Phdr *phdrp,
261     int phdrc, const int objtype, const long lbase, const long obase)
262 {
263 	elf_object_t *object;
264 
265 #if 0
266 	_dl_printf("objname [%s], dynp %p, objtype %x lbase %lx, obase %lx\n",
267 	    objname, dynp, objtype, lbase, obase);
268 #endif
269 	object = _dl_calloc(1, sizeof(elf_object_t));
270 	if (object == NULL)
271 		_dl_oom();
272 	object->prev = object->next = NULL;
273 
274 	object->load_dyn = dynp;
275 	while (dynp->d_tag != DT_NULL) {
276 		if (dynp->d_tag < DT_NUM)
277 			object->Dyn.info[dynp->d_tag] = dynp->d_un.d_val;
278 		else if (dynp->d_tag >= DT_LOPROC &&
279 		    dynp->d_tag < DT_LOPROC + DT_PROCNUM)
280 			object->Dyn.info[dynp->d_tag + DT_NUM - DT_LOPROC] =
281 			    dynp->d_un.d_val;
282 		if (dynp->d_tag == DT_TEXTREL)
283 			object->dyn.textrel = 1;
284 		if (dynp->d_tag == DT_SYMBOLIC)
285 			object->dyn.symbolic = 1;
286 		if (dynp->d_tag == DT_BIND_NOW)
287 			object->obj_flags |= DF_1_NOW;
288 		if (dynp->d_tag == DT_FLAGS_1)
289 			object->obj_flags |= dynp->d_un.d_val;
290 		if (dynp->d_tag == DT_FLAGS) {
291 			object->dyn.flags |= dynp->d_un.d_val;
292 			if (dynp->d_un.d_val & DF_SYMBOLIC)
293 				object->dyn.symbolic = 1;
294 			if (dynp->d_un.d_val & DF_TEXTREL)
295 				object->dyn.textrel = 1;
296 			if (dynp->d_un.d_val & DF_ORIGIN)
297 				object->obj_flags |= DF_1_ORIGIN;
298 			if (dynp->d_un.d_val & DF_BIND_NOW)
299 				object->obj_flags |= DF_1_NOW;
300 		}
301 		if (dynp->d_tag == DT_RELACOUNT)
302 			object->relacount = dynp->d_un.d_val;
303 		if (dynp->d_tag == DT_RELCOUNT)
304 			object->relcount = dynp->d_un.d_val;
305 		dynp++;
306 	}
307 	DL_DEB((" flags %s = 0x%x\n", objname, object->obj_flags ));
308 	object->obj_type = objtype;
309 
310 	if (_dl_loading_object == NULL) {
311 		/*
312 		 * no loading object, object is the loading object,
313 		 * as it is either executable, or dlopened()
314 		 */
315 		_dl_loading_object = object;
316 	}
317 
318 	if ((object->obj_flags & DF_1_NOOPEN) != 0 &&
319 	    _dl_loading_object->obj_type == OBJTYPE_DLO &&
320 	    !_dl_traceld) {
321 		_dl_free(object);
322 		_dl_errno = DL_CANT_LOAD_OBJ;
323 		return(NULL);
324 	}
325 
326 	/*
327 	 *  Now relocate all pointer to dynamic info, but only
328 	 *  the ones which have pointer values.
329 	 */
330 	if (object->Dyn.info[DT_PLTGOT])
331 		object->Dyn.info[DT_PLTGOT] += obase;
332 	if (object->Dyn.info[DT_HASH])
333 		object->Dyn.info[DT_HASH] += obase;
334 	if (object->Dyn.info[DT_STRTAB])
335 		object->Dyn.info[DT_STRTAB] += obase;
336 	if (object->Dyn.info[DT_SYMTAB])
337 		object->Dyn.info[DT_SYMTAB] += obase;
338 	if (object->Dyn.info[DT_RELA])
339 		object->Dyn.info[DT_RELA] += obase;
340 	if (object->Dyn.info[DT_SONAME])
341 		object->Dyn.info[DT_SONAME] += object->Dyn.info[DT_STRTAB];
342 	if (object->Dyn.info[DT_RPATH])
343 		object->Dyn.info[DT_RPATH] += object->Dyn.info[DT_STRTAB];
344 	if (object->Dyn.info[DT_RUNPATH])
345 		object->Dyn.info[DT_RUNPATH] += object->Dyn.info[DT_STRTAB];
346 	if (object->Dyn.info[DT_REL])
347 		object->Dyn.info[DT_REL] += obase;
348 	if (object->Dyn.info[DT_INIT])
349 		object->Dyn.info[DT_INIT] += obase;
350 	if (object->Dyn.info[DT_FINI])
351 		object->Dyn.info[DT_FINI] += obase;
352 	if (object->Dyn.info[DT_JMPREL])
353 		object->Dyn.info[DT_JMPREL] += obase;
354 	if (object->Dyn.info[DT_INIT_ARRAY])
355 		object->Dyn.info[DT_INIT_ARRAY] += obase;
356 	if (object->Dyn.info[DT_FINI_ARRAY])
357 		object->Dyn.info[DT_FINI_ARRAY] += obase;
358 	if (object->Dyn.info[DT_PREINIT_ARRAY])
359 		object->Dyn.info[DT_PREINIT_ARRAY] += obase;
360 
361 	if (object->Dyn.info[DT_HASH] != 0) {
362 		Elf_Word *hashtab = (Elf_Word *)object->Dyn.info[DT_HASH];
363 
364 		object->nbuckets = hashtab[0];
365 		object->nchains = hashtab[1];
366 		object->buckets = hashtab + 2;
367 		object->chains = object->buckets + object->nbuckets;
368 	}
369 
370 	object->phdrp = phdrp;
371 	object->phdrc = phdrc;
372 	object->load_base = lbase;
373 	object->obj_base = obase;
374 	object->load_name = _dl_strdup(objname);
375 	if (object->load_name == NULL)
376 		_dl_oom();
377 	object->load_object = _dl_loading_object;
378 	if (object->load_object == object)
379 		DL_DEB(("head %s\n", object->load_name));
380 	DL_DEB(("obj %s has %s as head\n", object->load_name,
381 	    _dl_loading_object->load_name ));
382 	object->refcount = 0;
383 	TAILQ_INIT(&object->child_list);
384 	object->opencount = 0;	/* # dlopen() & exe */
385 	object->grprefcount = 0;
386 	/* default dev, inode for dlopen-able objects. */
387 	object->dev = 0;
388 	object->inode = 0;
389 	object->grpsym_gen = 0;
390 	TAILQ_INIT(&object->grpsym_list);
391 	TAILQ_INIT(&object->grpref_list);
392 
393 	if (object->dyn.runpath)
394 		object->runpath = _dl_split_path(object->dyn.runpath);
395 	/*
396 	 * DT_RPATH is ignored if DT_RUNPATH is present...except in
397 	 * the exe, whose DT_RPATH is a fallback for libs that don't
398 	 * use DT_RUNPATH
399 	 */
400 	if (object->dyn.rpath && (object->runpath == NULL ||
401 	    objtype == OBJTYPE_EXE))
402 		object->rpath = _dl_split_path(object->dyn.rpath);
403 	if ((object->obj_flags & DF_1_ORIGIN) && _dl_trust)
404 		_dl_origin_subst(object);
405 
406 	_dl_trace_object_setup(object);
407 
408 	return (object);
409 }
410 
411 static void
412 _dl_tailq_free(struct dep_node *n)
413 {
414 	struct dep_node *next;
415 
416 	while (n != NULL) {
417 		next = TAILQ_NEXT(n, next_sib);
418 		_dl_free(n);
419 		n = next;
420 	}
421 }
422 
423 static elf_object_t *free_objects;
424 
425 void
426 _dl_cleanup_objects()
427 {
428 	elf_object_t *nobj, *head;
429 	struct dep_node *n, *next;
430 
431 	n = TAILQ_FIRST(&_dlopened_child_list);
432 	while (n != NULL) {
433 		next = TAILQ_NEXT(n, next_sib);
434 		if (OBJECT_DLREF_CNT(n->data) == 0) {
435 			TAILQ_REMOVE(&_dlopened_child_list, n, next_sib);
436 			_dl_free(n);
437 		}
438 		n = next;
439 	}
440 
441 	head = free_objects;
442 	free_objects = NULL;
443 	while (head != NULL) {
444 		_dl_free(head->load_name);
445 		_dl_free((char *)head->sod.sod_name);
446 		_dl_free_path(head->runpath);
447 		_dl_free_path(head->rpath);
448 		_dl_tailq_free(TAILQ_FIRST(&head->grpsym_list));
449 		_dl_tailq_free(TAILQ_FIRST(&head->child_list));
450 		_dl_tailq_free(TAILQ_FIRST(&head->grpref_list));
451 		nobj = head->next;
452 		_dl_free(head);
453 		head = nobj;
454 	}
455 }
456 
457 void
458 _dl_remove_object(elf_object_t *object)
459 {
460 	object->prev->next = object->next;
461 	if (object->next)
462 		object->next->prev = object->prev;
463 
464 	if (_dl_last_object == object)
465 		_dl_last_object = object->prev;
466 
467 	object->next = free_objects;
468 	free_objects = object;
469 }
470 
471 /*
472  * mprotect a segment to the indicated protection.  If 'addr' is non-zero,
473  * then it's the start address, else the value of 'start_sym' is the start.
474  * The value of 'end_sym' is the end address.  The start is rounded down
475  * and the end is rounded up to page boundaries.  Returns 'addr' or the
476  * address of the start symbol.
477  */
478 void *
479 _dl_protect_segment(elf_object_t *object, Elf_Addr addr,
480     const char *start_sym, const char *end_sym, int prot)
481 {
482 	const Elf_Sym *this;
483 	Elf_Addr ooff, start, end;
484 
485 	if (addr == 0 && start_sym[2] == 'g' &&
486 	    (addr = object->relro_addr) != 0) {
487 		DL_DEB(("protect start RELRO = 0x%lx in %s\n",
488 		    addr, object->load_name));
489 	}
490 	else if (addr == 0) {
491 		this = NULL;
492 		ooff = _dl_find_symbol(start_sym, &this,
493 		    SYM_SEARCH_OBJ | SYM_NOWARNNOTFOUND | SYM_PLT, NULL,
494 		    object, NULL);
495 		/* If not found, nothing to do */
496 		if (this == NULL) {
497 			DL_DEB(("protect start \"%s\" not found in %s\n",
498 			    start_sym, object->load_name));
499 			return (NULL);
500 		}
501 		addr = ooff + this->st_value;
502 		DL_DEB(("protect start \"%s\" to %x = 0x%lx in %s\n",
503 		    start_sym, prot, addr, object->load_name));
504 	}
505 
506 	if (object->relro_addr != 0 && start_sym[2] == 'g') {
507 		end = object->relro_addr + object->relro_size;
508 		DL_DEB(("protect end RELRO = 0x%lx in %s\n",
509 		    end, object->load_name));
510 	} else {
511 		this = NULL;
512 		ooff = _dl_find_symbol(end_sym, &this,
513 		    SYM_SEARCH_OBJ | SYM_NOWARNNOTFOUND | SYM_PLT, NULL,
514 		    object, NULL);
515 		if (this == NULL) {
516 			DL_DEB(("protect end \"%s\" not found in %s\n",
517 			    end_sym, object->load_name));
518 			addr = 0;
519 		} else {
520 			end = ooff + this->st_value;
521 			DL_DEB(("protect end \"%s\" = 0x%lx in %s\n",
522 			    end_sym, end, object->load_name));
523 		}
524 	}
525 
526 	if (addr != 0 && addr < end) {
527 		start = ELF_TRUNC(addr, _dl_pagesz);
528 		end = ELF_ROUND(end, _dl_pagesz);
529 		_dl_mprotect((void *)start, end - start, prot);
530 	}
531 
532 	return ((void *)addr);
533 }
534 
535 
536 sym_cache *_dl_symcache;
537 int _dl_symcachestat_hits;
538 int _dl_symcachestat_lookups;
539 
540 
541 Elf_Addr
542 _dl_find_symbol_bysym(elf_object_t *req_obj, unsigned int symidx,
543     const Elf_Sym **this, int flags, const Elf_Sym *ref_sym, const elf_object_t **pobj)
544 {
545 	Elf_Addr ret;
546 	const Elf_Sym *sym;
547 	const char *symn;
548 	const elf_object_t *sobj;
549 
550 	_dl_symcachestat_lookups ++;
551 	if (_dl_symcache != NULL &&
552 	    symidx < req_obj->nchains &&
553 	    _dl_symcache[symidx].obj != NULL &&
554 	    _dl_symcache[symidx].sym != NULL &&
555 	    _dl_symcache[symidx].flags == flags) {
556 
557 		_dl_symcachestat_hits++;
558 		sobj = _dl_symcache[symidx].obj;
559 		*this = _dl_symcache[symidx].sym;
560 		if (pobj)
561 			*pobj = sobj;
562 		return sobj->obj_base;
563 	}
564 
565 	sym = req_obj->dyn.symtab;
566 	sym += symidx;
567 	symn = req_obj->dyn.strtab + sym->st_name;
568 
569 	ret = _dl_find_symbol(symn, this, flags, ref_sym, req_obj, &sobj);
570 
571 	if (pobj)
572 		*pobj = sobj;
573 
574 	if (_dl_symcache != NULL && symidx < req_obj->nchains) {
575 #if 0
576 		DL_DEB(("cache miss %d %p %p, %p %p %s %s %d %d %s\n",
577 		    symidx,
578 		    _dl_symcache[symidx].sym, *this,
579 		    _dl_symcache[symidx].obj, sobj, sobj->load_name,
580 		    sobj->dyn.strtab + (*this)->st_name,
581 		    _dl_symcache[symidx].flags, flags, req_obj->load_name));
582 #endif
583 
584 		_dl_symcache[symidx].sym = *this;
585 		_dl_symcache[symidx].obj = sobj;
586 		_dl_symcache[symidx].flags = flags;
587 	}
588 
589 	return ret;
590 }
591 
592 static int
593 matched_symbol(elf_object_t *obj, const Elf_Sym *sym, struct symlookup *sl)
594 {
595 	switch (ELF_ST_TYPE(sym->st_info)) {
596 	case STT_FUNC:
597 		/*
598 		 * Allow this symbol if we are referring to a function which
599 		 * has a value, even if section is UNDEF.  This allows &func
600 		 * to refer to PLT as per the ELF spec.  If flags has SYM_PLT
601 		 * set, we must have actual symbol, so this symbol is skipped.
602 		 */
603 		if ((sl->sl_flags & SYM_PLT) && sym->st_shndx == SHN_UNDEF)
604 			return 0;
605 		if (sym->st_value == 0)
606 			return 0;
607 		break;
608 	case STT_NOTYPE:
609 	case STT_OBJECT:
610 		if (sym->st_value == 0)
611 			return 0;
612 #if 0
613 		/* FALLTHROUGH */
614 	case STT_TLS:
615 #endif
616 		if (sym->st_shndx == SHN_UNDEF)
617 			return 0;
618 		break;
619 	default:
620 		return 0;
621 	}
622 
623 	if (sym != sl->sl_sym_out &&
624 	    _dl_strcmp(sl->sl_name, obj->dyn.strtab + sym->st_name))
625 		return 0;
626 
627 	if (ELF_ST_BIND(sym->st_info) == STB_GLOBAL) {
628 		sl->sl_sym_out = sym;
629 		sl->sl_obj_out = obj;
630 		return 1;
631 	} else if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
632 		if (sl->sl_weak_sym_out == NULL) {
633 			sl->sl_weak_sym_out = sym;
634 			sl->sl_weak_obj_out = obj;
635 		}
636 		/* done with this object, but need to check other objects */
637 		return -1;
638 	}
639 	return 0;
640 }
641 
642 static int
643 _dl_find_symbol_obj(elf_object_t *obj, struct symlookup *sl)
644 {
645 	const Elf_Sym	*symt = obj->dyn.symtab;
646 	long	si;
647 
648 	for (si = obj->buckets[sl->sl_elf_hash % obj->nbuckets];
649 	    si != STN_UNDEF; si = obj->chains[si]) {
650 		const Elf_Sym *sym = symt + si;
651 
652 		int r = matched_symbol(obj, sym, sl);
653 		if (r)
654 			return r > 0;
655 	}
656 	return 0;
657 }
658 
659 Elf_Addr
660 _dl_find_symbol(const char *name, const Elf_Sym **this,
661     int flags, const Elf_Sym *ref_sym, elf_object_t *req_obj,
662     const elf_object_t **pobj)
663 {
664 	const char *p = name;
665 	struct dep_node *n, *m;
666 	struct symlookup sl = {
667 		.sl_name = name,
668 		.sl_obj_out = NULL,
669 		.sl_weak_obj_out = NULL,
670 		.sl_weak_sym_out = NULL,
671 		.sl_elf_hash = 0,
672 		.sl_flags = flags,
673 	};
674 
675 	while (*p) {
676 		unsigned long g;
677 		sl.sl_elf_hash = (sl.sl_elf_hash << 4) + *p++;
678 		if ((g = sl.sl_elf_hash & 0xf0000000))
679 			sl.sl_elf_hash ^= g >> 24;
680 		sl.sl_elf_hash &= ~g;
681 	}
682 
683 	if (req_obj->dyn.symbolic)
684 		if (_dl_find_symbol_obj(req_obj, &sl))
685 			goto found;
686 
687 	if (flags & SYM_SEARCH_OBJ) {
688 		_dl_find_symbol_obj(req_obj, &sl);
689 		/* always just fallthrough to 'found' */
690 	} else if (flags & SYM_DLSYM) {
691 		if (_dl_find_symbol_obj(req_obj, &sl))
692 			goto found;
693 
694 		/* weak definition in the specified object is good enough */
695 		if (sl.sl_weak_obj_out != NULL)
696 			goto found;
697 
698 		/* search dlopened obj and all children */
699 		TAILQ_FOREACH(n, &req_obj->load_object->grpsym_list, next_sib) {
700 			if (_dl_find_symbol_obj(n->data, &sl))
701 				goto found;
702 		}
703 	} else {
704 		int skip = 0;
705 
706 		if ((flags & SYM_SEARCH_SELF) || (flags & SYM_SEARCH_NEXT))
707 			skip = 1;
708 
709 		/*
710 		 * search dlopened objects: global or req_obj == dlopened_obj
711 		 * and and it's children
712 		 */
713 		TAILQ_FOREACH(n, &_dlopened_child_list, next_sib) {
714 			if (((n->data->obj_flags & DF_1_GLOBAL) == 0) &&
715 			    (n->data != req_obj->load_object))
716 				continue;
717 
718 			TAILQ_FOREACH(m, &n->data->grpsym_list, next_sib) {
719 				if (skip == 1) {
720 					if (m->data == req_obj) {
721 						skip = 0;
722 						if (flags & SYM_SEARCH_NEXT)
723 							continue;
724 					} else
725 						continue;
726 				}
727 				if ((flags & SYM_SEARCH_OTHER) &&
728 				    (m->data == req_obj))
729 					continue;
730 				if (_dl_find_symbol_obj(m->data, &sl))
731 					goto found;
732 			}
733 		}
734 	}
735 
736 found:
737 	if (sl.sl_sym_out != NULL) {
738 		*this = sl.sl_sym_out;
739 	} else if (sl.sl_weak_obj_out != NULL) {
740 		sl.sl_obj_out = sl.sl_weak_obj_out;
741 		*this = sl.sl_weak_sym_out;
742 	} else {
743 		if ((ref_sym == NULL ||
744 		    (ELF_ST_BIND(ref_sym->st_info) != STB_WEAK)) &&
745 		    (flags & SYM_WARNNOTFOUND))
746 			_dl_printf("%s:%s: undefined symbol '%s'\n",
747 			    __progname, req_obj->load_name, name);
748 		return (0);
749 	}
750 
751 	if (ref_sym != NULL && ref_sym->st_size != 0 &&
752 	    (ref_sym->st_size != (*this)->st_size)  &&
753 	    (ELF_ST_TYPE((*this)->st_info) != STT_FUNC) ) {
754 		_dl_printf("%s:%s: %s : WARNING: "
755 		    "symbol(%s) size mismatch, relink your program\n",
756 		    __progname, req_obj->load_name, sl.sl_obj_out->load_name,
757 		    name);
758 	}
759 
760 	if (pobj != NULL)
761 		*pobj = sl.sl_obj_out;
762 
763 	return sl.sl_obj_out->obj_base;
764 }
765 
766 void
767 _dl_debug_state(void)
768 {
769 	/* Debugger stub */
770 }
771