xref: /openbsd-src/libexec/ld.so/resolve.c (revision c90a81c56dcebd6a1b73fe4aff9b03385b8e63b3)
1 /*	$OpenBSD: resolve.c,v 1.87 2018/11/28 03:18:00 guenther Exp $ */
2 
3 /*
4  * Copyright (c) 1998 Per Fogelstrom, Opsycon AB
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
16  * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
17  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
19  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  *
27  */
28 
29 #define _DYN_LOADER
30 
31 #include <sys/types.h>
32 
33 #include <limits.h>
34 #include <nlist.h>
35 #include <link.h>
36 #include "syscall.h"
37 #include "archdep.h"
38 #include "path.h"
39 #include "resolve.h"
40 
41 /* substitution types */
42 typedef enum {
43 	SUBST_UNKNOWN, SUBST_ORIGIN, SUBST_OSNAME, SUBST_OSREL, SUBST_PLATFORM
44 } SUBST_TYPES;
45 
46 struct symlookup {
47 	const char		*sl_name;
48 	const elf_object_t	*sl_obj_out;
49 	const Elf_Sym		*sl_sym_out;
50 	const elf_object_t	*sl_weak_obj_out;
51 	const Elf_Sym		*sl_weak_sym_out;
52 	unsigned long		sl_elf_hash;
53 	uint32_t		sl_gnu_hash;
54 	int			sl_flags;
55 };
56 
57 elf_object_t *_dl_objects;
58 elf_object_t *_dl_last_object;
59 elf_object_t *_dl_loading_object;
60 
61 /*
62  * Add a new dynamic object to the object list.
63  */
64 void
65 _dl_add_object(elf_object_t *object)
66 {
67 	/*
68 	 * If a .so is marked nodelete, then the entire load group that it's
69 	 * in needs to be kept around forever, so add a reference there.
70 	 * XXX It would be better if we tracked inter-object dependencies
71 	 * from relocations and didn't leave dangling pointers when a load
72 	 * group was partially unloaded.  That would render this unnecessary.
73 	 */
74 	if (object->obj_flags & DF_1_NODELETE &&
75 	    (object->load_object->status & STAT_NODELETE) == 0) {
76 		DL_DEB(("objname %s is nodelete\n", object->load_name));
77 		object->load_object->opencount++;
78 		object->load_object->status |= STAT_NODELETE;
79 	}
80 
81 	/*
82 	 * if this is a new object, prev will be NULL
83 	 * != NULL if an object already in the list
84 	 * prev == NULL for the first item in the list, but that will
85 	 * be the executable.
86 	 */
87 	if (object->prev != NULL)
88 		return;
89 
90 	if (_dl_objects == NULL) {			/* First object ? */
91 		_dl_last_object = _dl_objects = object;
92 	} else {
93 		_dl_last_object->next = object;
94 		object->prev = _dl_last_object;
95 		_dl_last_object = object;
96 	}
97 }
98 
99 /*
100  * Identify substitution sequence name.
101  */
102 static int
103 _dl_subst_name(const char *name, size_t siz) {
104 	switch (siz) {
105 	case 5:
106 		if (_dl_strncmp(name, "OSREL", 5) == 0)
107 			return SUBST_OSREL;
108 		break;
109 	case 6:
110 		if (_dl_strncmp(name, "ORIGIN", 6) == 0)
111 			return SUBST_ORIGIN;
112 		if (_dl_strncmp(name, "OSNAME", 6) == 0)
113 			return SUBST_OSNAME;
114 		break;
115 	case 8:
116 		if (_dl_strncmp(name, "PLATFORM", 8) == 0)
117 			return SUBST_PLATFORM;
118 		break;
119 	}
120 
121 	return (SUBST_UNKNOWN);
122 }
123 
124 /*
125  * Perform $ORIGIN substitutions on path
126  */
127 static void
128 _dl_origin_subst_path(elf_object_t *object, const char *origin_path,
129     char **path)
130 {
131 	char tmp_path[PATH_MAX];
132 	char *new_path, *tp;
133 	const char *pp, *name, *value;
134 	static struct utsname uts;
135 	size_t value_len;
136 	int skip_brace;
137 
138 	if (uts.sysname[0] == '\0') {
139 		if (_dl_uname(&uts) != 0)
140 			return;
141 	}
142 
143 	tp = tmp_path;
144 	pp = *path;
145 
146 	while (*pp != '\0' && (tp - tmp_path) < sizeof(tmp_path)) {
147 
148 		/* copy over chars up to but not including $ */
149 		while (*pp != '\0' && *pp != '$' &&
150 		    (tp - tmp_path) < sizeof(tmp_path))
151 			*tp++ = *pp++;
152 
153 		/* substitution sequence detected */
154 		if (*pp == '$' && (tp - tmp_path) < sizeof(tmp_path)) {
155 			pp++;
156 
157 			if ((skip_brace = (*pp == '{')))
158 				pp++;
159 
160 			/* skip over name */
161 			name = pp;
162 			while (_dl_isalnum((unsigned char)*pp) || *pp == '_')
163 				pp++;
164 
165 			switch (_dl_subst_name(name, pp - name)) {
166 			case SUBST_ORIGIN:
167 				value = origin_path;
168 				break;
169 			case SUBST_OSNAME:
170 				value = uts.sysname;
171 				break;
172 			case SUBST_OSREL:
173 				value = uts.release;
174 				break;
175 			case SUBST_PLATFORM:
176 				value = uts.machine;
177 				break;
178 			default:
179 				value = "";
180 			}
181 
182 			value_len = _dl_strlen(value);
183 			if (value_len >= sizeof(tmp_path) - (tp - tmp_path))
184 				return;
185 
186 			_dl_bcopy(value, tp, value_len);
187 			tp += value_len;
188 
189 			if (skip_brace && *pp == '}')
190 				pp++;
191 		}
192 	}
193 
194 	/* no substitution made if result exceeds sizeof(tmp_path) */
195 	if (tp - tmp_path >= sizeof(tmp_path))
196 		return;
197 
198 	/* NULL terminate tmp_path */
199 	*tp = '\0';
200 
201 	if (_dl_strcmp(tmp_path, *path) == 0)
202 		return;
203 
204 	new_path = _dl_strdup(tmp_path);
205 	if (new_path == NULL)
206 		return;
207 
208 	DL_DEB(("orig_path %s\n", *path));
209 	DL_DEB(("new_path  %s\n", new_path));
210 
211 	_dl_free(*path);
212 	*path = new_path;
213 }
214 
215 /*
216  * Determine origin_path from object load_name. The origin_path argument
217  * must refer to a buffer capable of storing at least PATH_MAX characters.
218  * Returns 0 on success.
219  */
220 static int
221 _dl_origin_path(elf_object_t *object, char *origin_path)
222 {
223 	const char *dirname_path = _dl_dirname(object->load_name);
224 
225 	if (dirname_path == NULL)
226 		return -1;
227 
228 	if (_dl_realpath(dirname_path, origin_path) == NULL)
229 		return -1;
230 
231 	return 0;
232 }
233 
234 /*
235  * Perform $ORIGIN substitutions on runpath and rpath
236  */
237 static void
238 _dl_origin_subst(elf_object_t *object)
239 {
240 	char origin_path[PATH_MAX];
241 	char **pp;
242 
243 	if (_dl_origin_path(object, origin_path) != 0)
244 		return;
245 
246 	/* perform path substitutions on each segment of runpath and rpath */
247 	if (object->runpath != NULL) {
248 		for (pp = object->runpath; *pp != NULL; pp++)
249 			_dl_origin_subst_path(object, origin_path, pp);
250 	}
251 	if (object->rpath != NULL) {
252 		for (pp = object->rpath; *pp != NULL; pp++)
253 			_dl_origin_subst_path(object, origin_path, pp);
254 	}
255 }
256 
257 /*
258  * Initialize a new dynamic object.
259  */
260 elf_object_t *
261 _dl_finalize_object(const char *objname, Elf_Dyn *dynp, Elf_Phdr *phdrp,
262     int phdrc, const int objtype, const long lbase, const long obase)
263 {
264 	elf_object_t *object;
265 	Elf_Addr gnu_hash = 0;
266 
267 #if 0
268 	_dl_printf("objname [%s], dynp %p, objtype %x lbase %lx, obase %lx\n",
269 	    objname, dynp, objtype, lbase, obase);
270 #endif
271 	object = _dl_calloc(1, sizeof(elf_object_t));
272 	if (object == NULL)
273 		_dl_oom();
274 	object->prev = object->next = NULL;
275 
276 	object->load_dyn = dynp;
277 	while (dynp->d_tag != DT_NULL) {
278 		if (dynp->d_tag < DT_NUM)
279 			object->Dyn.info[dynp->d_tag] = dynp->d_un.d_val;
280 		else if (dynp->d_tag >= DT_LOPROC &&
281 		    dynp->d_tag < DT_LOPROC + DT_PROCNUM)
282 			object->Dyn.info[dynp->d_tag + DT_NUM - DT_LOPROC] =
283 			    dynp->d_un.d_val;
284 		if (dynp->d_tag == DT_TEXTREL)
285 			object->dyn.textrel = 1;
286 		if (dynp->d_tag == DT_SYMBOLIC)
287 			object->dyn.symbolic = 1;
288 		if (dynp->d_tag == DT_BIND_NOW)
289 			object->obj_flags |= DF_1_NOW;
290 		if (dynp->d_tag == DT_FLAGS_1)
291 			object->obj_flags |= dynp->d_un.d_val;
292 		if (dynp->d_tag == DT_FLAGS) {
293 			object->dyn.flags |= dynp->d_un.d_val;
294 			if (dynp->d_un.d_val & DF_SYMBOLIC)
295 				object->dyn.symbolic = 1;
296 			if (dynp->d_un.d_val & DF_TEXTREL)
297 				object->dyn.textrel = 1;
298 			if (dynp->d_un.d_val & DF_ORIGIN)
299 				object->obj_flags |= DF_1_ORIGIN;
300 			if (dynp->d_un.d_val & DF_BIND_NOW)
301 				object->obj_flags |= DF_1_NOW;
302 		}
303 		if (dynp->d_tag == DT_RELACOUNT)
304 			object->relacount = dynp->d_un.d_val;
305 		if (dynp->d_tag == DT_RELCOUNT)
306 			object->relcount = dynp->d_un.d_val;
307 		if (dynp->d_tag == DT_GNU_HASH)
308 			gnu_hash = dynp->d_un.d_val;
309 		dynp++;
310 	}
311 	DL_DEB((" flags %s = 0x%x\n", objname, object->obj_flags ));
312 	object->obj_type = objtype;
313 
314 	if (_dl_loading_object == NULL) {
315 		/*
316 		 * no loading object, object is the loading object,
317 		 * as it is either executable, or dlopened()
318 		 */
319 		_dl_loading_object = object;
320 	}
321 
322 	if ((object->obj_flags & DF_1_NOOPEN) != 0 &&
323 	    _dl_loading_object->obj_type == OBJTYPE_DLO &&
324 	    !_dl_traceld) {
325 		_dl_free(object);
326 		_dl_errno = DL_CANT_LOAD_OBJ;
327 		return(NULL);
328 	}
329 
330 	/*
331 	 *  Now relocate all pointer to dynamic info, but only
332 	 *  the ones which have pointer values.
333 	 */
334 	if (object->Dyn.info[DT_PLTGOT])
335 		object->Dyn.info[DT_PLTGOT] += obase;
336 	if (object->Dyn.info[DT_STRTAB])
337 		object->Dyn.info[DT_STRTAB] += obase;
338 	if (object->Dyn.info[DT_SYMTAB])
339 		object->Dyn.info[DT_SYMTAB] += obase;
340 	if (object->Dyn.info[DT_RELA])
341 		object->Dyn.info[DT_RELA] += obase;
342 	if (object->Dyn.info[DT_SONAME])
343 		object->Dyn.info[DT_SONAME] += object->Dyn.info[DT_STRTAB];
344 	if (object->Dyn.info[DT_RPATH])
345 		object->Dyn.info[DT_RPATH] += object->Dyn.info[DT_STRTAB];
346 	if (object->Dyn.info[DT_RUNPATH])
347 		object->Dyn.info[DT_RUNPATH] += object->Dyn.info[DT_STRTAB];
348 	if (object->Dyn.info[DT_REL])
349 		object->Dyn.info[DT_REL] += obase;
350 	if (object->Dyn.info[DT_INIT])
351 		object->Dyn.info[DT_INIT] += obase;
352 	if (object->Dyn.info[DT_FINI])
353 		object->Dyn.info[DT_FINI] += obase;
354 	if (object->Dyn.info[DT_JMPREL])
355 		object->Dyn.info[DT_JMPREL] += obase;
356 	if (object->Dyn.info[DT_INIT_ARRAY])
357 		object->Dyn.info[DT_INIT_ARRAY] += obase;
358 	if (object->Dyn.info[DT_FINI_ARRAY])
359 		object->Dyn.info[DT_FINI_ARRAY] += obase;
360 	if (object->Dyn.info[DT_PREINIT_ARRAY])
361 		object->Dyn.info[DT_PREINIT_ARRAY] += obase;
362 
363 	if (gnu_hash) {
364 		Elf32_Word *hashtab = (Elf32_Word *)(gnu_hash + obase);
365 		Elf32_Word nbuckets = hashtab[0];
366 		Elf32_Word nmaskwords = hashtab[2];
367 
368 		/* validity check */
369 		if (nbuckets > 0 && (nmaskwords & (nmaskwords - 1)) == 0) {
370 			Elf32_Word symndx = hashtab[1];
371 			int bloom_size32 = (ELFSIZE / 32) * nmaskwords;
372 
373 			object->nbuckets = nbuckets;
374 			object->symndx_gnu = symndx;
375 			object->mask_bm_gnu = nmaskwords - 1;
376 			object->shift2_gnu = hashtab[3];
377 			object->bloom_gnu = (Elf_Addr *)(hashtab + 4);
378 			object->buckets_gnu = hashtab + 4 + bloom_size32;
379 			object->chains_gnu = object->buckets_gnu + nbuckets
380 			    - symndx;
381 
382 			/*
383 			 * If the ELF hash is present, get the total symbol
384 			 * count ("nchains") from there.  Otherwise, count
385 			 * the entries in the GNU hash chain.
386 			 */
387 			if (object->Dyn.info[DT_HASH] == 0) {
388 				Elf32_Word n;
389 
390 				for (n = 0; n < nbuckets; n++) {
391 					Elf_Word bkt = object->buckets_gnu[n];
392 					const Elf32_Word *hashval;
393 					if (bkt == 0)
394 						continue;
395 					hashval = &object->chains_gnu[bkt];
396 					do {
397 						symndx++;
398 					} while ((*hashval++ & 1U) == 0);
399 				}
400 				object->nchains = symndx;
401 			}
402 			object->status |= STAT_GNU_HASH;
403 		}
404 	}
405 	if (object->Dyn.info[DT_HASH] != 0) {
406 		Elf_Word *hashtab = (Elf_Word *)(object->Dyn.info[DT_HASH]
407 		    + obase);
408 
409 		object->nchains = hashtab[1];
410 		if (object->nbuckets == 0) {
411 			object->nbuckets = hashtab[0];
412 			object->buckets_elf = hashtab + 2;
413 			object->chains_elf = object->buckets_elf +
414 			    object->nbuckets;
415 		}
416 	}
417 
418 	object->phdrp = phdrp;
419 	object->phdrc = phdrc;
420 	object->load_base = lbase;
421 	object->obj_base = obase;
422 	object->load_name = _dl_strdup(objname);
423 	if (object->load_name == NULL)
424 		_dl_oom();
425 	object->load_object = _dl_loading_object;
426 	if (object->load_object == object)
427 		DL_DEB(("head %s\n", object->load_name));
428 	DL_DEB(("obj %s has %s as head\n", object->load_name,
429 	    _dl_loading_object->load_name ));
430 	object->refcount = 0;
431 	TAILQ_INIT(&object->child_list);
432 	object->opencount = 0;	/* # dlopen() & exe */
433 	object->grprefcount = 0;
434 	/* default dev, inode for dlopen-able objects. */
435 	object->dev = 0;
436 	object->inode = 0;
437 	object->grpsym_gen = 0;
438 	TAILQ_INIT(&object->grpsym_list);
439 	TAILQ_INIT(&object->grpref_list);
440 
441 	if (object->dyn.runpath)
442 		object->runpath = _dl_split_path(object->dyn.runpath);
443 	/*
444 	 * DT_RPATH is ignored if DT_RUNPATH is present...except in
445 	 * the exe, whose DT_RPATH is a fallback for libs that don't
446 	 * use DT_RUNPATH
447 	 */
448 	if (object->dyn.rpath && (object->runpath == NULL ||
449 	    objtype == OBJTYPE_EXE))
450 		object->rpath = _dl_split_path(object->dyn.rpath);
451 	if ((object->obj_flags & DF_1_ORIGIN) && _dl_trust)
452 		_dl_origin_subst(object);
453 
454 	_dl_trace_object_setup(object);
455 
456 	return (object);
457 }
458 
459 static void
460 _dl_tailq_free(struct dep_node *n)
461 {
462 	struct dep_node *next;
463 
464 	while (n != NULL) {
465 		next = TAILQ_NEXT(n, next_sib);
466 		_dl_free(n);
467 		n = next;
468 	}
469 }
470 
471 static elf_object_t *free_objects;
472 
473 void
474 _dl_cleanup_objects()
475 {
476 	elf_object_t *nobj, *head;
477 	struct dep_node *n, *next;
478 
479 	n = TAILQ_FIRST(&_dlopened_child_list);
480 	while (n != NULL) {
481 		next = TAILQ_NEXT(n, next_sib);
482 		if (OBJECT_DLREF_CNT(n->data) == 0) {
483 			TAILQ_REMOVE(&_dlopened_child_list, n, next_sib);
484 			_dl_free(n);
485 		}
486 		n = next;
487 	}
488 
489 	head = free_objects;
490 	free_objects = NULL;
491 	while (head != NULL) {
492 		_dl_free(head->load_name);
493 		_dl_free((char *)head->sod.sod_name);
494 		_dl_free_path(head->runpath);
495 		_dl_free_path(head->rpath);
496 		_dl_tailq_free(TAILQ_FIRST(&head->grpsym_list));
497 		_dl_tailq_free(TAILQ_FIRST(&head->child_list));
498 		_dl_tailq_free(TAILQ_FIRST(&head->grpref_list));
499 		nobj = head->next;
500 		_dl_free(head);
501 		head = nobj;
502 	}
503 }
504 
505 void
506 _dl_remove_object(elf_object_t *object)
507 {
508 	object->prev->next = object->next;
509 	if (object->next)
510 		object->next->prev = object->prev;
511 
512 	if (_dl_last_object == object)
513 		_dl_last_object = object->prev;
514 
515 	object->next = free_objects;
516 	free_objects = object;
517 }
518 
519 
520 sym_cache *_dl_symcache;
521 int _dl_symcachestat_hits;
522 int _dl_symcachestat_lookups;
523 
524 
525 Elf_Addr
526 _dl_find_symbol_bysym(elf_object_t *req_obj, unsigned int symidx,
527     const Elf_Sym **this, int flags, const Elf_Sym *ref_sym, const elf_object_t **pobj)
528 {
529 	Elf_Addr ret;
530 	const Elf_Sym *sym;
531 	const char *symn;
532 	const elf_object_t *sobj;
533 
534 	_dl_symcachestat_lookups ++;
535 	if (_dl_symcache != NULL &&
536 	    symidx < req_obj->nchains &&
537 	    _dl_symcache[symidx].obj != NULL &&
538 	    _dl_symcache[symidx].sym != NULL &&
539 	    _dl_symcache[symidx].flags == flags) {
540 
541 		_dl_symcachestat_hits++;
542 		sobj = _dl_symcache[symidx].obj;
543 		*this = _dl_symcache[symidx].sym;
544 		if (pobj)
545 			*pobj = sobj;
546 		return sobj->obj_base;
547 	}
548 
549 	sym = req_obj->dyn.symtab;
550 	sym += symidx;
551 	symn = req_obj->dyn.strtab + sym->st_name;
552 
553 	ret = _dl_find_symbol(symn, this, flags, ref_sym, req_obj, &sobj);
554 
555 	if (pobj)
556 		*pobj = sobj;
557 
558 	if (_dl_symcache != NULL && symidx < req_obj->nchains) {
559 #if 0
560 		DL_DEB(("cache miss %d %p %p, %p %p %s %s %d %d %s\n",
561 		    symidx,
562 		    _dl_symcache[symidx].sym, *this,
563 		    _dl_symcache[symidx].obj, sobj, sobj->load_name,
564 		    sobj->dyn.strtab + (*this)->st_name,
565 		    _dl_symcache[symidx].flags, flags, req_obj->load_name));
566 #endif
567 
568 		_dl_symcache[symidx].sym = *this;
569 		_dl_symcache[symidx].obj = sobj;
570 		_dl_symcache[symidx].flags = flags;
571 	}
572 
573 	return ret;
574 }
575 
576 static int
577 matched_symbol(elf_object_t *obj, const Elf_Sym *sym, struct symlookup *sl)
578 {
579 	switch (ELF_ST_TYPE(sym->st_info)) {
580 	case STT_FUNC:
581 		/*
582 		 * Allow this symbol if we are referring to a function which
583 		 * has a value, even if section is UNDEF.  This allows &func
584 		 * to refer to PLT as per the ELF spec.  If flags has SYM_PLT
585 		 * set, we must have actual symbol, so this symbol is skipped.
586 		 */
587 		if ((sl->sl_flags & SYM_PLT) && sym->st_shndx == SHN_UNDEF)
588 			return 0;
589 		if (sym->st_value == 0)
590 			return 0;
591 		break;
592 	case STT_NOTYPE:
593 	case STT_OBJECT:
594 		if (sym->st_value == 0)
595 			return 0;
596 #if 0
597 		/* FALLTHROUGH */
598 	case STT_TLS:
599 #endif
600 		if (sym->st_shndx == SHN_UNDEF)
601 			return 0;
602 		break;
603 	default:
604 		return 0;
605 	}
606 
607 	if (sym != sl->sl_sym_out &&
608 	    _dl_strcmp(sl->sl_name, obj->dyn.strtab + sym->st_name))
609 		return 0;
610 
611 	if (ELF_ST_BIND(sym->st_info) == STB_GLOBAL) {
612 		sl->sl_sym_out = sym;
613 		sl->sl_obj_out = obj;
614 		return 1;
615 	} else if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
616 		if (sl->sl_weak_sym_out == NULL) {
617 			sl->sl_weak_sym_out = sym;
618 			sl->sl_weak_obj_out = obj;
619 		}
620 		/* done with this object, but need to check other objects */
621 		return -1;
622 	}
623 	return 0;
624 }
625 
626 static int
627 _dl_find_symbol_obj(elf_object_t *obj, struct symlookup *sl)
628 {
629 	const Elf_Sym	*symt = obj->dyn.symtab;
630 
631 	if (obj->status & STAT_GNU_HASH) {
632 		uint32_t hash = sl->sl_gnu_hash;
633 		Elf_Addr bloom_word;
634 		unsigned int h1;
635 		unsigned int h2;
636 		Elf32_Word bucket;
637 		const Elf32_Word *hashval;
638 
639 		/* pick right bitmask word from Bloom filter array */
640 		bloom_word = obj->bloom_gnu[(hash / ELFSIZE) &
641 		    obj->mask_bm_gnu];
642 
643 		/* calculate modulus ELFSIZE of gnu hash and its derivative */
644 		h1 = hash & (ELFSIZE - 1);
645 		h2 = (hash >> obj->shift2_gnu) & (ELFSIZE - 1);
646 
647 		/* Filter out the "definitely not in set" queries */
648 		if (((bloom_word >> h1) & (bloom_word >> h2) & 1) == 0)
649 			return 0;
650 
651 		/* Locate hash chain and corresponding value element */
652 		bucket = obj->buckets_gnu[hash % obj->nbuckets];
653 		if (bucket == 0)
654 			return 0;
655 		hashval = &obj->chains_gnu[bucket];
656 		do {
657 			if (((*hashval ^ hash) >> 1) == 0) {
658 				const Elf_Sym *sym = symt +
659 				    (hashval - obj->chains_gnu);
660 
661 				int r = matched_symbol(obj, sym, sl);
662 				if (r)
663 					return r > 0;
664 			}
665 		} while ((*hashval++ & 1U) == 0);
666 	} else {
667 		Elf_Word si;
668 
669 		for (si = obj->buckets_elf[sl->sl_elf_hash % obj->nbuckets];
670 		    si != STN_UNDEF; si = obj->chains_elf[si]) {
671 			const Elf_Sym *sym = symt + si;
672 
673 			int r = matched_symbol(obj, sym, sl);
674 			if (r)
675 				return r > 0;
676 		}
677 	}
678 	return 0;
679 }
680 
681 Elf_Addr
682 _dl_find_symbol(const char *name, const Elf_Sym **this,
683     int flags, const Elf_Sym *ref_sym, elf_object_t *req_obj,
684     const elf_object_t **pobj)
685 {
686 	const unsigned char *p;
687 	unsigned char c;
688 	struct dep_node *n, *m;
689 	struct symlookup sl = {
690 		.sl_name = name,
691 		.sl_obj_out = NULL,
692 		.sl_weak_obj_out = NULL,
693 		.sl_weak_sym_out = NULL,
694 		.sl_elf_hash = 0,
695 		.sl_gnu_hash = 5381,
696 		.sl_flags = flags,
697 	};
698 
699 	/* Calculate both hashes in one pass */
700 	for (p = (const unsigned char *)name; (c = *p) != '\0'; p++) {
701 		unsigned long g;
702 		sl.sl_elf_hash = (sl.sl_elf_hash << 4) + c;
703 		if ((g = sl.sl_elf_hash & 0xf0000000))
704 			sl.sl_elf_hash ^= g >> 24;
705 		sl.sl_elf_hash &= ~g;
706 		sl.sl_gnu_hash = sl.sl_gnu_hash * 33 + c;
707 	}
708 
709 	if (req_obj->dyn.symbolic)
710 		if (_dl_find_symbol_obj(req_obj, &sl))
711 			goto found;
712 
713 	if (flags & SYM_DLSYM) {
714 		if (_dl_find_symbol_obj(req_obj, &sl))
715 			goto found;
716 
717 		/* weak definition in the specified object is good enough */
718 		if (sl.sl_weak_obj_out != NULL)
719 			goto found;
720 
721 		/* search dlopened obj and all children */
722 		TAILQ_FOREACH(n, &req_obj->load_object->grpsym_list, next_sib) {
723 			if (_dl_find_symbol_obj(n->data, &sl))
724 				goto found;
725 		}
726 	} else {
727 		int skip = 0;
728 
729 		if ((flags & SYM_SEARCH_SELF) || (flags & SYM_SEARCH_NEXT))
730 			skip = 1;
731 
732 		/*
733 		 * search dlopened objects: global or req_obj == dlopened_obj
734 		 * and and it's children
735 		 */
736 		TAILQ_FOREACH(n, &_dlopened_child_list, next_sib) {
737 			if (((n->data->obj_flags & DF_1_GLOBAL) == 0) &&
738 			    (n->data != req_obj->load_object))
739 				continue;
740 
741 			TAILQ_FOREACH(m, &n->data->grpsym_list, next_sib) {
742 				if (skip == 1) {
743 					if (m->data == req_obj) {
744 						skip = 0;
745 						if (flags & SYM_SEARCH_NEXT)
746 							continue;
747 					} else
748 						continue;
749 				}
750 				if ((flags & SYM_SEARCH_OTHER) &&
751 				    (m->data == req_obj))
752 					continue;
753 				if (_dl_find_symbol_obj(m->data, &sl))
754 					goto found;
755 			}
756 		}
757 	}
758 
759 found:
760 	if (sl.sl_sym_out != NULL) {
761 		*this = sl.sl_sym_out;
762 	} else if (sl.sl_weak_obj_out != NULL) {
763 		sl.sl_obj_out = sl.sl_weak_obj_out;
764 		*this = sl.sl_weak_sym_out;
765 	} else {
766 		if ((ref_sym == NULL ||
767 		    (ELF_ST_BIND(ref_sym->st_info) != STB_WEAK)) &&
768 		    (flags & SYM_WARNNOTFOUND))
769 			_dl_printf("%s:%s: undefined symbol '%s'\n",
770 			    __progname, req_obj->load_name, name);
771 		return (0);
772 	}
773 
774 	if (ref_sym != NULL && ref_sym->st_size != 0 &&
775 	    (ref_sym->st_size != (*this)->st_size)  &&
776 	    (ELF_ST_TYPE((*this)->st_info) != STT_FUNC) ) {
777 		_dl_printf("%s:%s: %s : WARNING: "
778 		    "symbol(%s) size mismatch, relink your program\n",
779 		    __progname, req_obj->load_name, sl.sl_obj_out->load_name,
780 		    name);
781 	}
782 
783 	if (pobj != NULL)
784 		*pobj = sl.sl_obj_out;
785 
786 	return sl.sl_obj_out->obj_base;
787 }
788 
789 void
790 _dl_debug_state(void)
791 {
792 	/* Debugger stub */
793 }
794