amd64_elf.c revision 6206:6b0ed502a8e7 
1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22/*
23 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
24 * Use is subject to license terms.
25 */
26#pragma ident	"%Z%%M%	%I%	%E% SMI"
27
28/*
29 * amd64 machine dependent and ELF file class dependent functions.
30 * Contains routines for performing function binding and symbol relocations.
31 */
32#include	"_synonyms.h"
33
34#include	<stdio.h>
35#include	<sys/elf.h>
36#include	<sys/elf_amd64.h>
37#include	<sys/mman.h>
38#include	<dlfcn.h>
39#include	<synch.h>
40#include	<string.h>
41#include	<debug.h>
42#include	<reloc.h>
43#include	<conv.h>
44#include	"_rtld.h"
45#include	"_audit.h"
46#include	"_elf.h"
47#include	"msg.h"
48
49
50extern void	elf_rtbndr(Rt_map *, ulong_t, caddr_t);
51
52int
53elf_mach_flags_check(Rej_desc *rej, Ehdr *ehdr)
54{
55	/*
56	 * Check machine type and flags.
57	 */
58	if (ehdr->e_flags != 0) {
59		rej->rej_type = SGS_REJ_BADFLAG;
60		rej->rej_info = (uint_t)ehdr->e_flags;
61		return (0);
62	}
63	return (1);
64}
65
66void
67ldso_plt_init(Rt_map * lmp)
68{
69	/*
70	 * There is no need to analyze ld.so because we don't map in any of
71	 * its dependencies.  However we may map these dependencies in later
72	 * (as if ld.so had dlopened them), so initialize the plt and the
73	 * permission information.
74	 */
75	if (PLTGOT(lmp))
76		elf_plt_init((void *)(PLTGOT(lmp)), (caddr_t)lmp);
77}
78
79static const uchar_t dyn_plt_template[] = {
80/* 0x00 */  0x55,			/* pushq %rbp */
81/* 0x01 */  0x48, 0x89, 0xe5,		/* movq  %rsp, %rbp */
82/* 0x04 */  0x48, 0x83, 0xec, 0x10,	/* subq	 $0x10, %rsp */
83/* 0x08 */  0x4c, 0x8d, 0x1d, 0x00,	/* leaq  trace_fields(%rip), %r11 */
84		0x00, 0x00, 0x00,
85/* 0x0f */  0x4c, 0x89, 0x5d, 0xf8,	/* movq  %r11, -0x8(%rbp) */
86/* 0x13 */  0x49, 0xbb, 0x00, 0x00, 	/* movq  $elf_plt_trace, %r11 */
87		0x00, 0x00, 0x00,
88		0x00, 0x00, 0x00,
89/* 0x1d */  0x41, 0xff, 0xe3		/* jmp   *%r11 */
90/* 0x20 */
91};
92
93/*
94 * And the virutal outstanding relocations against the
95 * above block are:
96 *
97 *	reloc		offset	Addend	symbol
98 *	R_AMD64_PC32	0x0b	-4	trace_fields
99 *	R_AMD64_64	0x15	0	elf_plt_trace
100 */
101
102#define	TRCREL1OFF	0x0b
103#define	TRCREL2OFF	0x15
104
105int	dyn_plt_ent_size = sizeof (dyn_plt_template);
106
107/*
108 * the dynamic plt entry is:
109 *
110 *	pushq	%rbp
111 *	movq	%rsp, %rbp
112 *	subq	$0x10, %rsp
113 *	leaq	trace_fields(%rip), %r11
114 *	movq	%r11, -0x8(%rbp)
115 *	movq	$elf_plt_trace, %r11
116 *	jmp	*%r11
117 * dyn_data:
118 *	.align  8
119 *	uintptr_t	reflmp
120 *	uintptr_t	deflmp
121 *	uint_t		symndx
122 *	uint_t		sb_flags
123 *	Sym		symdef
124 */
125static caddr_t
126elf_plt_trace_write(ulong_t roffset, Rt_map *rlmp, Rt_map *dlmp, Sym *sym,
127    uint_t symndx, uint_t pltndx, caddr_t to, uint_t sb_flags, int *fail)
128{
129	extern int	elf_plt_trace();
130	ulong_t		got_entry;
131	uchar_t		*dyn_plt;
132	uintptr_t	*dyndata;
133
134
135	/*
136	 * We only need to add the glue code if there is an auditing
137	 * library that is interested in this binding.
138	 */
139	dyn_plt = (uchar_t *)((uintptr_t)AUDINFO(rlmp)->ai_dynplts +
140	    (pltndx * dyn_plt_ent_size));
141
142	/*
143	 * Have we initialized this dynamic plt entry yet?  If we haven't do it
144	 * now.  Otherwise this function has been called before, but from a
145	 * different plt (ie. from another shared object).  In that case
146	 * we just set the plt to point to the new dyn_plt.
147	 */
148	if (*dyn_plt == 0) {
149		Sym *	symp;
150		Xword	symvalue;
151		Lm_list	*lml = LIST(rlmp);
152
153		(void) memcpy((void *)dyn_plt, dyn_plt_template,
154		    sizeof (dyn_plt_template));
155		dyndata = (uintptr_t *)((uintptr_t)dyn_plt +
156		    ROUND(sizeof (dyn_plt_template), M_WORD_ALIGN));
157
158		/*
159		 * relocate:
160		 *	leaq	trace_fields(%rip), %r11
161		 *	R_AMD64_PC32	0x0b	-4	trace_fields
162		 */
163		symvalue = (Xword)((uintptr_t)dyndata -
164		    (uintptr_t)(&dyn_plt[TRCREL1OFF]) - 4);
165		if (do_reloc_rtld(R_AMD64_PC32, &dyn_plt[TRCREL1OFF],
166		    &symvalue, MSG_ORIG(MSG_SYM_LADYNDATA),
167		    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
168			*fail = 1;
169			return (0);
170		}
171
172		/*
173		 * relocating:
174		 *	movq	$elf_plt_trace, %r11
175		 *	R_AMD64_64	0x15	0	elf_plt_trace
176		 */
177		symvalue = (Xword)elf_plt_trace;
178		if (do_reloc_rtld(R_AMD64_64, &dyn_plt[TRCREL2OFF],
179		    &symvalue, MSG_ORIG(MSG_SYM_ELFPLTTRACE),
180		    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
181			*fail = 1;
182			return (0);
183		}
184
185		*dyndata++ = (uintptr_t)rlmp;
186		*dyndata++ = (uintptr_t)dlmp;
187		*dyndata = (uintptr_t)(((uint64_t)sb_flags << 32) | symndx);
188		dyndata++;
189		symp = (Sym *)dyndata;
190		*symp = *sym;
191		symp->st_value = (Addr)to;
192	}
193
194	got_entry = (ulong_t)roffset;
195	*(ulong_t *)got_entry = (ulong_t)dyn_plt;
196	return ((caddr_t)dyn_plt);
197}
198
199
200/*
201 * Function binding routine - invoked on the first call to a function through
202 * the procedure linkage table;
203 * passes first through an assembly language interface.
204 *
205 * Takes the offset into the relocation table of the associated
206 * relocation entry and the address of the link map (rt_private_map struct)
207 * for the entry.
208 *
209 * Returns the address of the function referenced after re-writing the PLT
210 * entry to invoke the function directly.
211 *
212 * On error, causes process to terminate with a signal.
213 */
214ulong_t
215elf_bndr(Rt_map *lmp, ulong_t pltndx, caddr_t from)
216{
217	Rt_map		*nlmp, * llmp;
218	ulong_t		addr, reloff, symval, rsymndx;
219	char		*name;
220	Rela		*rptr;
221	Sym		*rsym, *nsym;
222	uint_t		binfo, sb_flags = 0, dbg_class;
223	Slookup		sl;
224	int		entry, lmflags;
225	Lm_list		*lml;
226
227	/*
228	 * For compatibility with libthread (TI_VERSION 1) we track the entry
229	 * value.  A zero value indicates we have recursed into ld.so.1 to
230	 * further process a locking request.  Under this recursion we disable
231	 * tsort and cleanup activities.
232	 */
233	entry = enter();
234
235	lml = LIST(lmp);
236	if ((lmflags = lml->lm_flags) & LML_FLG_RTLDLM) {
237		dbg_class = dbg_desc->d_class;
238		dbg_desc->d_class = 0;
239	}
240
241	/*
242	 * Perform some basic sanity checks.  If we didn't get a load map or
243	 * the relocation offset is invalid then its possible someone has walked
244	 * over the .got entries or jumped to plt0 out of the blue.
245	 */
246	if ((!lmp) && (pltndx <=
247	    (ulong_t)PLTRELSZ(lmp) / (ulong_t)RELENT(lmp))) {
248		Conv_inv_buf_t inv_buf;
249
250		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_PLTREF),
251		    conv_reloc_amd64_type(R_AMD64_JUMP_SLOT, 0, &inv_buf),
252		    EC_NATPTR(lmp), EC_XWORD(pltndx), EC_NATPTR(from));
253		rtldexit(lml, 1);
254	}
255	reloff = pltndx * (ulong_t)RELENT(lmp);
256
257	/*
258	 * Use relocation entry to get symbol table entry and symbol name.
259	 */
260	addr = (ulong_t)JMPREL(lmp);
261	rptr = (Rela *)(addr + reloff);
262	rsymndx = ELF_R_SYM(rptr->r_info);
263	rsym = (Sym *)((ulong_t)SYMTAB(lmp) + (rsymndx * SYMENT(lmp)));
264	name = (char *)(STRTAB(lmp) + rsym->st_name);
265
266	/*
267	 * Determine the last link-map of this list, this'll be the starting
268	 * point for any tsort() processing.
269	 */
270	llmp = lml->lm_tail;
271
272	/*
273	 * Find definition for symbol.  Initialize the symbol lookup data
274	 * structure.
275	 */
276	SLOOKUP_INIT(sl, name, lmp, lml->lm_head, ld_entry_cnt, 0,
277	    rsymndx, rsym, 0, LKUP_DEFT);
278
279	if ((nsym = lookup_sym(&sl, &nlmp, &binfo)) == 0) {
280		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_NOSYM), NAME(lmp),
281		    demangle(name));
282		rtldexit(lml, 1);
283	}
284
285	symval = nsym->st_value;
286	if (!(FLAGS(nlmp) & FLG_RT_FIXED) &&
287	    (nsym->st_shndx != SHN_ABS))
288		symval += ADDR(nlmp);
289	if ((lmp != nlmp) && ((FLAGS1(nlmp) & FL1_RT_NOINIFIN) == 0)) {
290		/*
291		 * Record that this new link map is now bound to the caller.
292		 */
293		if (bind_one(lmp, nlmp, BND_REFER) == 0)
294			rtldexit(lml, 1);
295	}
296
297	if ((lml->lm_tflags | FLAGS1(lmp)) & LML_TFLG_AUD_SYMBIND) {
298		uint_t	symndx = (((uintptr_t)nsym -
299		    (uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp));
300		symval = audit_symbind(lmp, nlmp, nsym, symndx, symval,
301		    &sb_flags);
302	}
303
304	if (!(rtld_flags & RT_FL_NOBIND)) {
305		addr = rptr->r_offset;
306		if (!(FLAGS(lmp) & FLG_RT_FIXED))
307			addr += ADDR(lmp);
308		if (((lml->lm_tflags | FLAGS1(lmp)) &
309		    (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) &&
310		    AUDINFO(lmp)->ai_dynplts) {
311			int	fail = 0;
312			uint_t	pltndx = reloff / sizeof (Rela);
313			uint_t	symndx = (((uintptr_t)nsym -
314			    (uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp));
315
316			symval = (ulong_t)elf_plt_trace_write(addr, lmp, nlmp,
317			    nsym, symndx, pltndx, (caddr_t)symval, sb_flags,
318			    &fail);
319			if (fail)
320				rtldexit(lml, 1);
321		} else {
322			/*
323			 * Write standard PLT entry to jump directly
324			 * to newly bound function.
325			 */
326			*(ulong_t *)addr = symval;
327		}
328	}
329
330	/*
331	 * Print binding information and rebuild PLT entry.
332	 */
333	DBG_CALL(Dbg_bind_global(lmp, (Addr)from, (Off)(from - ADDR(lmp)),
334	    (Xword)(reloff / sizeof (Rela)), PLT_T_FULL, nlmp,
335	    (Addr)symval, nsym->st_value, name, binfo));
336
337	/*
338	 * Complete any processing for newly loaded objects.  Note we don't
339	 * know exactly where any new objects are loaded (we know the object
340	 * that supplied the symbol, but others may have been loaded lazily as
341	 * we searched for the symbol), so sorting starts from the last
342	 * link-map know on entry to this routine.
343	 */
344	if (entry)
345		load_completion(llmp);
346
347	/*
348	 * Some operations like dldump() or dlopen()'ing a relocatable object
349	 * result in objects being loaded on rtld's link-map, make sure these
350	 * objects are initialized also.
351	 */
352	if ((lml->lm_flags & LML_FLG_RTLDLM) && LIST(nlmp)->lm_init)
353		load_completion(nlmp);
354
355	/*
356	 * If the object we've bound to is in the process of being initialized
357	 * by another thread, determine whether we should block.
358	 */
359	is_dep_ready(nlmp, lmp, DBG_WAIT_SYMBOL);
360
361	/*
362	 * Make sure the object to which we've bound has had it's .init fired.
363	 * Cleanup before return to user code.
364	 */
365	if (entry) {
366		is_dep_init(nlmp, lmp);
367		leave(lml);
368	}
369
370	if (lmflags & LML_FLG_RTLDLM)
371		dbg_desc->d_class = dbg_class;
372
373	return (symval);
374}
375
376
377/*
378 * When the relocation loop realizes that it's dealing with relative
379 * relocations in a shared object, it breaks into this tighter loop
380 * as an optimization.
381 */
382ulong_t
383elf_reloc_relative(ulong_t relbgn, ulong_t relend, ulong_t relsiz,
384    ulong_t basebgn, ulong_t etext, ulong_t emap)
385{
386	ulong_t roffset = ((Rela *)relbgn)->r_offset;
387	char rtype;
388
389	do {
390		roffset += basebgn;
391
392		/*
393		 * If this relocation is against an address not mapped in,
394		 * then break out of the relative relocation loop, falling
395		 * back on the main relocation loop.
396		 */
397		if (roffset < etext || roffset > emap)
398			break;
399
400		/*
401		 * Perform the actual relocation.
402		 */
403		*((ulong_t *)roffset) = basebgn +
404		    ((Rela *)relbgn)->r_addend;
405
406		relbgn += relsiz;
407
408		if (relbgn >= relend)
409			break;
410
411		rtype = ELF_R_TYPE(((Rela *)relbgn)->r_info, M_MACH);
412		roffset = ((Rela *)relbgn)->r_offset;
413
414	} while (rtype == R_AMD64_RELATIVE);
415
416	return (relbgn);
417}
418
419/*
420 * This is the tightest loop for RELATIVE relocations for those
421 * objects built with the DT_RELACOUNT .dynamic entry.
422 */
423ulong_t
424elf_reloc_relacount(ulong_t relbgn, ulong_t relacount, ulong_t relsiz,
425    ulong_t basebgn)
426{
427	ulong_t roffset = ((Rela *) relbgn)->r_offset;
428
429	for (; relacount; relacount--) {
430		roffset += basebgn;
431
432		/*
433		 * Perform the actual relocation.
434		 */
435		*((ulong_t *)roffset) = basebgn +
436		    ((Rela *)relbgn)->r_addend;
437
438		relbgn += relsiz;
439
440		roffset = ((Rela *)relbgn)->r_offset;
441
442	}
443
444	return (relbgn);
445}
446
447/*
448 * Read and process the relocations for one link object, we assume all
449 * relocation sections for loadable segments are stored contiguously in
450 * the file.
451 */
452int
453elf_reloc(Rt_map *lmp, uint_t plt)
454{
455	ulong_t		relbgn, relend, relsiz, basebgn;
456	ulong_t		pltbgn, pltend, _pltbgn, _pltend;
457	ulong_t		roffset, rsymndx, psymndx = 0, etext = ETEXT(lmp);
458	ulong_t		emap, dsymndx;
459	uchar_t		rtype;
460	long		reladd, value, pvalue;
461	Sym		*symref, *psymref, *symdef, *psymdef;
462	char		*name, *pname;
463	Rt_map		*_lmp, *plmp;
464	int		textrel = 0, ret = 1, noplt = 0;
465	int		relacount = RELACOUNT(lmp), plthint = 0;
466	Rela		*rel;
467	uint_t		binfo, pbinfo;
468	APlist		*bound = NULL;
469
470	/*
471	 * Although only necessary for lazy binding, initialize the first
472	 * global offset entry to go to elf_rtbndr().  dbx(1) seems
473	 * to find this useful.
474	 */
475	if ((plt == 0) && PLTGOT(lmp)) {
476		if ((ulong_t)PLTGOT(lmp) < etext) {
477			if (elf_set_prot(lmp, PROT_WRITE) == 0)
478				return (0);
479			textrel = 1;
480		}
481		elf_plt_init((void *)PLTGOT(lmp), (caddr_t)lmp);
482	}
483
484	/*
485	 * Initialize the plt start and end addresses.
486	 */
487	if ((pltbgn = (ulong_t)JMPREL(lmp)) != 0)
488		pltend = pltbgn + (ulong_t)(PLTRELSZ(lmp));
489
490
491	relsiz = (ulong_t)(RELENT(lmp));
492	basebgn = ADDR(lmp);
493	emap = ADDR(lmp) + MSIZE(lmp);
494
495	if (PLTRELSZ(lmp))
496		plthint = PLTRELSZ(lmp) / relsiz;
497
498	/*
499	 * If we've been called upon to promote an RTLD_LAZY object to an
500	 * RTLD_NOW then we're only interested in scaning the .plt table.
501	 * An uninitialized .plt is the case where the associated got entry
502	 * points back to the plt itself.  Determine the range of the real .plt
503	 * entries using the _PROCEDURE_LINKAGE_TABLE_ symbol.
504	 */
505	if (plt) {
506		Slookup	sl;
507
508		relbgn = pltbgn;
509		relend = pltend;
510		if (!relbgn || (relbgn == relend))
511			return (1);
512
513		/*
514		 * Initialize the symbol lookup data structure.
515		 */
516		SLOOKUP_INIT(sl, MSG_ORIG(MSG_SYM_PLT), lmp, lmp, ld_entry_cnt,
517		    elf_hash(MSG_ORIG(MSG_SYM_PLT)), 0, 0, 0, LKUP_DEFT);
518
519		if ((symdef = elf_find_sym(&sl, &_lmp, &binfo)) == 0)
520			return (1);
521
522		_pltbgn = symdef->st_value;
523		if (!(FLAGS(lmp) & FLG_RT_FIXED) &&
524		    (symdef->st_shndx != SHN_ABS))
525			_pltbgn += basebgn;
526		_pltend = _pltbgn + (((PLTRELSZ(lmp) / relsiz)) *
527		    M_PLT_ENTSIZE) + M_PLT_RESERVSZ;
528
529	} else {
530		/*
531		 * The relocation sections appear to the run-time linker as a
532		 * single table.  Determine the address of the beginning and end
533		 * of this table.  There are two different interpretations of
534		 * the ABI at this point:
535		 *
536		 *   o	The REL table and its associated RELSZ indicate the
537		 *	concatenation of *all* relocation sections (this is the
538		 *	model our link-editor constructs).
539		 *
540		 *   o	The REL table and its associated RELSZ indicate the
541		 *	concatenation of all *but* the .plt relocations.  These
542		 *	relocations are specified individually by the JMPREL and
543		 *	PLTRELSZ entries.
544		 *
545		 * Determine from our knowledege of the relocation range and
546		 * .plt range, the range of the total relocation table.  Note
547		 * that one other ABI assumption seems to be that the .plt
548		 * relocations always follow any other relocations, the
549		 * following range checking drops that assumption.
550		 */
551		relbgn = (ulong_t)(REL(lmp));
552		relend = relbgn + (ulong_t)(RELSZ(lmp));
553		if (pltbgn) {
554			if (!relbgn || (relbgn > pltbgn))
555				relbgn = pltbgn;
556			if (!relbgn || (relend < pltend))
557				relend = pltend;
558		}
559	}
560	if (!relbgn || (relbgn == relend)) {
561		DBG_CALL(Dbg_reloc_run(lmp, 0, plt, DBG_REL_NONE));
562		return (1);
563	}
564	DBG_CALL(Dbg_reloc_run(lmp, M_REL_SHT_TYPE, plt, DBG_REL_START));
565
566	/*
567	 * If we're processing a dynamic executable in lazy mode there is no
568	 * need to scan the .rel.plt table, however if we're processing a shared
569	 * object in lazy mode the .got addresses associated to each .plt must
570	 * be relocated to reflect the location of the shared object.
571	 */
572	if (pltbgn && ((MODE(lmp) & RTLD_NOW) == 0) &&
573	    (FLAGS(lmp) & FLG_RT_FIXED))
574		noplt = 1;
575
576	/*
577	 * Loop through relocations.
578	 */
579	while (relbgn < relend) {
580		uint_t	sb_flags = 0;
581
582		rtype = ELF_R_TYPE(((Rela *)relbgn)->r_info, M_MACH);
583
584		/*
585		 * If this is a RELATIVE relocation in a shared object (the
586		 * common case), and if we are not debugging, then jump into a
587		 * tighter relocation loop (elf_reloc_relative).  Only make the
588		 * jump if we've been given a hint on the number of relocations.
589		 */
590		if ((rtype == R_AMD64_RELATIVE) &&
591		    ((FLAGS(lmp) & FLG_RT_FIXED) == 0) && (DBG_ENABLED == 0)) {
592			/*
593			 * It's possible that the relative relocation block
594			 * has relocations against the text segment as well
595			 * as the data segment.  Since our optimized relocation
596			 * engine does not check which segment the relocation
597			 * is against - just mprotect it now if it's been
598			 * marked as containing TEXTREL's.
599			 */
600			if ((textrel == 0) && (FLAGS1(lmp) & FL1_RT_TEXTREL)) {
601				if (elf_set_prot(lmp, PROT_WRITE) == 0) {
602					ret = 0;
603					break;
604				}
605				textrel = 1;
606			}
607			if (relacount) {
608				relbgn = elf_reloc_relacount(relbgn, relacount,
609				    relsiz, basebgn);
610				relacount = 0;
611			} else {
612				relbgn = elf_reloc_relative(relbgn, relend,
613				    relsiz, basebgn, etext, emap);
614			}
615
616			if (relbgn >= relend)
617				break;
618			rtype = ELF_R_TYPE(((Rela *)relbgn)->r_info, M_MACH);
619		}
620
621		roffset = ((Rela *)relbgn)->r_offset;
622
623		/*
624		 * If this is a shared object, add the base address to offset.
625		 */
626		if (!(FLAGS(lmp) & FLG_RT_FIXED)) {
627
628
629			/*
630			 * If we're processing lazy bindings, we have to step
631			 * through the plt entries and add the base address
632			 * to the corresponding got entry.
633			 */
634			if (plthint && (plt == 0) &&
635			    (rtype == R_AMD64_JUMP_SLOT) &&
636			    ((MODE(lmp) & RTLD_NOW) == 0)) {
637				/*
638				 * The PLT relocations (for lazy bindings)
639				 * are additive to what's already in the GOT.
640				 * This differs to what happens in
641				 * elf_reloc_relacount() and that's why we
642				 * just do it inline here.
643				 */
644				for (roffset = ((Rela *)relbgn)->r_offset;
645				    plthint; plthint--) {
646					roffset += basebgn;
647
648					/*
649					 * Perform the actual relocation.
650					 */
651					*((ulong_t *)roffset) += basebgn;
652
653					relbgn += relsiz;
654					roffset = ((Rela *)relbgn)->r_offset;
655
656				}
657				continue;
658			}
659			roffset += basebgn;
660		}
661
662		reladd = (long)(((Rela *)relbgn)->r_addend);
663		rsymndx = ELF_R_SYM(((Rela *)relbgn)->r_info);
664		rel = (Rela *)relbgn;
665		relbgn += relsiz;
666
667		/*
668		 * Optimizations.
669		 */
670		if (rtype == R_AMD64_NONE)
671			continue;
672		if (noplt && ((ulong_t)rel >= pltbgn) &&
673		    ((ulong_t)rel < pltend)) {
674			relbgn = pltend;
675			continue;
676		}
677
678		/*
679		 * If this relocation is not against part of the image
680		 * mapped into memory we skip it.
681		 */
682		if ((roffset < ADDR(lmp)) || (roffset > (ADDR(lmp) +
683		    MSIZE(lmp)))) {
684			elf_reloc_bad(lmp, (void *)rel, rtype, roffset,
685			    rsymndx);
686			continue;
687		}
688
689		/*
690		 * If we're promoting plts determine if this one has already
691		 * been written.
692		 */
693		if (plt) {
694			if ((*(ulong_t *)roffset < _pltbgn) ||
695			    (*(ulong_t *)roffset > _pltend))
696				continue;
697		}
698
699		binfo = 0;
700		/*
701		 * If a symbol index is specified then get the symbol table
702		 * entry, locate the symbol definition, and determine its
703		 * address.
704		 */
705		if (rsymndx) {
706			/*
707			 * Get the local symbol table entry.
708			 */
709			symref = (Sym *)((ulong_t)SYMTAB(lmp) +
710			    (rsymndx * SYMENT(lmp)));
711
712			/*
713			 * If this is a local symbol, just use the base address.
714			 * (we should have no local relocations in the
715			 * executable).
716			 */
717			if (ELF_ST_BIND(symref->st_info) == STB_LOCAL) {
718				value = basebgn;
719				name = (char *)0;
720
721				/*
722				 * Special case TLS relocations.
723				 */
724				if (rtype == R_AMD64_DTPMOD64) {
725					/*
726					 * Use the TLS modid.
727					 */
728					value = TLSMODID(lmp);
729
730				} else if ((rtype == R_AMD64_TPOFF64) ||
731				    (rtype == R_AMD64_TPOFF32)) {
732					if ((value = elf_static_tls(lmp, symref,
733					    rel, rtype, 0, roffset, 0)) == 0) {
734						ret = 0;
735						break;
736					}
737				}
738			} else {
739				/*
740				 * If the symbol index is equal to the previous
741				 * symbol index relocation we processed then
742				 * reuse the previous values. (Note that there
743				 * have been cases where a relocation exists
744				 * against a copy relocation symbol, our ld(1)
745				 * should optimize this away, but make sure we
746				 * don't use the same symbol information should
747				 * this case exist).
748				 */
749				if ((rsymndx == psymndx) &&
750				    (rtype != R_AMD64_COPY)) {
751					/* LINTED */
752					if (psymdef == 0) {
753						DBG_CALL(Dbg_bind_weak(lmp,
754						    (Addr)roffset, (Addr)
755						    (roffset - basebgn), name));
756						continue;
757					}
758					/* LINTED */
759					value = pvalue;
760					/* LINTED */
761					name = pname;
762					/* LINTED */
763					symdef = psymdef;
764					/* LINTED */
765					symref = psymref;
766					/* LINTED */
767					_lmp = plmp;
768					/* LINTED */
769					binfo = pbinfo;
770
771					if ((LIST(_lmp)->lm_tflags |
772					    FLAGS1(_lmp)) &
773					    LML_TFLG_AUD_SYMBIND) {
774						value = audit_symbind(lmp, _lmp,
775						    /* LINTED */
776						    symdef, dsymndx, value,
777						    &sb_flags);
778					}
779				} else {
780					Slookup		sl;
781
782					/*
783					 * Lookup the symbol definition.
784					 * Initialize the symbol lookup data
785					 * structure.
786					 */
787					name = (char *)(STRTAB(lmp) +
788					    symref->st_name);
789
790					SLOOKUP_INIT(sl, name, lmp, 0,
791					    ld_entry_cnt, 0, rsymndx, symref,
792					    rtype, LKUP_STDRELOC);
793
794					symdef = lookup_sym(&sl, &_lmp, &binfo);
795
796					/*
797					 * If the symbol is not found and the
798					 * reference was not to a weak symbol,
799					 * report an error.  Weak references
800					 * may be unresolved.
801					 */
802					/* BEGIN CSTYLED */
803					if (symdef == 0) {
804					    if (sl.sl_bind != STB_WEAK) {
805						if (elf_reloc_error(lmp, name,
806						    rel, binfo))
807							continue;
808
809						    ret = 0;
810						    break;
811
812					    } else {
813						psymndx = rsymndx;
814						psymdef = 0;
815
816						DBG_CALL(Dbg_bind_weak(lmp,
817						    (Addr)roffset, (Addr)
818						    (roffset - basebgn), name));
819						continue;
820					    }
821					}
822					/* END CSTYLED */
823
824					/*
825					 * If symbol was found in an object
826					 * other than the referencing object
827					 * then record the binding.
828					 */
829					if ((lmp != _lmp) && ((FLAGS1(_lmp) &
830					    FL1_RT_NOINIFIN) == 0)) {
831						if (aplist_test(&bound, _lmp,
832						    AL_CNT_RELBIND) == 0) {
833							ret = 0;
834							break;
835						}
836					}
837
838					/*
839					 * Calculate the location of definition;
840					 * symbol value plus base address of
841					 * containing shared object.
842					 */
843					if (IS_SIZE(rtype))
844						value = symdef->st_size;
845					else
846						value = symdef->st_value;
847
848					if (!(FLAGS(_lmp) & FLG_RT_FIXED) &&
849					    !(IS_SIZE(rtype)) &&
850					    (symdef->st_shndx != SHN_ABS) &&
851					    (ELF_ST_TYPE(symdef->st_info) !=
852					    STT_TLS))
853						value += ADDR(_lmp);
854
855					/*
856					 * Retain this symbol index and the
857					 * value in case it can be used for the
858					 * subsequent relocations.
859					 */
860					if (rtype != R_AMD64_COPY) {
861						psymndx = rsymndx;
862						pvalue = value;
863						pname = name;
864						psymdef = symdef;
865						psymref = symref;
866						plmp = _lmp;
867						pbinfo = binfo;
868					}
869					if ((LIST(_lmp)->lm_tflags |
870					    FLAGS1(_lmp)) &
871					    LML_TFLG_AUD_SYMBIND) {
872						dsymndx = (((uintptr_t)symdef -
873						    (uintptr_t)SYMTAB(_lmp)) /
874						    SYMENT(_lmp));
875						value = audit_symbind(lmp, _lmp,
876						    symdef, dsymndx, value,
877						    &sb_flags);
878					}
879				}
880
881				/*
882				 * If relocation is PC-relative, subtract
883				 * offset address.
884				 */
885				if (IS_PC_RELATIVE(rtype))
886					value -= roffset;
887
888				/*
889				 * Special case TLS relocations.
890				 */
891				if (rtype == R_AMD64_DTPMOD64) {
892					/*
893					 * Relocation value is the TLS modid.
894					 */
895					value = TLSMODID(_lmp);
896
897				} else if ((rtype == R_AMD64_TPOFF64) ||
898				    (rtype == R_AMD64_TPOFF32)) {
899					if ((value = elf_static_tls(_lmp,
900					    symdef, rel, rtype, name, roffset,
901					    value)) == 0) {
902						ret = 0;
903						break;
904					}
905				}
906			}
907		} else {
908			/*
909			 * Special cases.
910			 */
911			if (rtype == R_AMD64_DTPMOD64) {
912				/*
913				 * TLS relocation value is the TLS modid.
914				 */
915				value = TLSMODID(lmp);
916			} else
917				value = basebgn;
918			name = (char *)0;
919		}
920
921		DBG_CALL(Dbg_reloc_in(LIST(lmp), ELF_DBG_RTLD, M_MACH,
922		    M_REL_SHT_TYPE, rel, NULL, name));
923
924		/*
925		 * If this object has relocations in the text segment, turn
926		 * off the write protect.
927		 */
928		if ((roffset < etext) && (textrel == 0)) {
929			if (elf_set_prot(lmp, PROT_WRITE) == 0) {
930				ret = 0;
931				break;
932			}
933			textrel = 1;
934		}
935
936		/*
937		 * Call relocation routine to perform required relocation.
938		 */
939		switch (rtype) {
940		case R_AMD64_COPY:
941			if (elf_copy_reloc(name, symref, lmp, (void *)roffset,
942			    symdef, _lmp, (const void *)value) == 0)
943				ret = 0;
944			break;
945		case R_AMD64_JUMP_SLOT:
946			if (((LIST(lmp)->lm_tflags | FLAGS1(lmp)) &
947			    (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) &&
948			    AUDINFO(lmp)->ai_dynplts) {
949				int	fail = 0;
950				int	pltndx = (((ulong_t)rel -
951				    (uintptr_t)JMPREL(lmp)) / relsiz);
952				int	symndx = (((uintptr_t)symdef -
953				    (uintptr_t)SYMTAB(_lmp)) / SYMENT(_lmp));
954
955				(void) elf_plt_trace_write(roffset, lmp, _lmp,
956				    symdef, symndx, pltndx, (caddr_t)value,
957				    sb_flags, &fail);
958				if (fail)
959					ret = 0;
960			} else {
961				/*
962				 * Write standard PLT entry to jump directly
963				 * to newly bound function.
964				 */
965				DBG_CALL(Dbg_reloc_apply_val(LIST(lmp),
966				    ELF_DBG_RTLD, (Xword)roffset,
967				    (Xword)value));
968				*(ulong_t *)roffset = value;
969			}
970			break;
971		default:
972			value += reladd;
973			/*
974			 * Write the relocation out.
975			 */
976			if (do_reloc_rtld(rtype, (uchar_t *)roffset,
977			    (Xword *)&value, name, NAME(lmp), LIST(lmp)) == 0)
978				ret = 0;
979
980			DBG_CALL(Dbg_reloc_apply_val(LIST(lmp), ELF_DBG_RTLD,
981			    (Xword)roffset, (Xword)value));
982		}
983
984		if ((ret == 0) &&
985		    ((LIST(lmp)->lm_flags & LML_FLG_TRC_WARN) == 0))
986			break;
987
988		if (binfo) {
989			DBG_CALL(Dbg_bind_global(lmp, (Addr)roffset,
990			    (Off)(roffset - basebgn), (Xword)(-1), PLT_T_FULL,
991			    _lmp, (Addr)value, symdef->st_value, name, binfo));
992		}
993	}
994
995	return (relocate_finish(lmp, bound, textrel, ret));
996}
997
998/*
999 * Initialize the first few got entries so that function calls go to
1000 * elf_rtbndr:
1001 *
1002 *	GOT[GOT_XLINKMAP] =	the address of the link map
1003 *	GOT[GOT_XRTLD] =	the address of rtbinder
1004 */
1005void
1006elf_plt_init(void *got, caddr_t l)
1007{
1008	uint64_t	*_got;
1009	/* LINTED */
1010	Rt_map		*lmp = (Rt_map *)l;
1011
1012	_got = (uint64_t *)got + M_GOT_XLINKMAP;
1013	*_got = (uint64_t)lmp;
1014	_got = (uint64_t *)got + M_GOT_XRTLD;
1015	*_got = (uint64_t)elf_rtbndr;
1016}
1017
1018/*
1019 * Plt writing interface to allow debugging initialization to be generic.
1020 */
1021Pltbindtype
1022/* ARGSUSED1 */
1023elf_plt_write(uintptr_t addr, uintptr_t vaddr, void *rptr, uintptr_t symval,
1024	Xword pltndx)
1025{
1026	Rela		*rel = (Rela*)rptr;
1027	uintptr_t	pltaddr;
1028
1029	pltaddr = addr + rel->r_offset;
1030	*(ulong_t *)pltaddr = (ulong_t)symval + rel->r_addend;
1031	DBG_CALL(pltcntfull++);
1032	return (PLT_T_FULL);
1033}
1034
1035/*
1036 * Provide a machine specific interface to the conversion routine.  By calling
1037 * the machine specific version, rather than the generic version, we insure that
1038 * the data tables/strings for all known machine versions aren't dragged into
1039 * ld.so.1.
1040 */
1041const char *
1042_conv_reloc_type(uint_t rel)
1043{
1044	static Conv_inv_buf_t inv_buf;
1045
1046	return (conv_reloc_amd64_type(rel, 0, &inv_buf));
1047}
1048