sparc_elf.c revision 4734:a4708faa3e85
1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22/*
23 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
24 * Use is subject to license terms.
25 */
26#pragma ident	"%Z%%M%	%I%	%E% SMI"
27
28/*
29 * SPARC V9 machine dependent and ELF file class dependent functions.
30 * Contains routines for performing function binding and symbol relocations.
31 */
32#include	"_synonyms.h"
33
34#include	<stdio.h>
35#include	<sys/elf.h>
36#include	<sys/elf_SPARC.h>
37#include	<sys/mman.h>
38#include	<dlfcn.h>
39#include	<synch.h>
40#include	<string.h>
41#include	<debug.h>
42#include	<reloc.h>
43#include	<conv.h>
44#include	"_rtld.h"
45#include	"_audit.h"
46#include	"_elf.h"
47#include	"msg.h"
48
49extern void	iflush_range(caddr_t, size_t);
50extern void	plt_upper_32(uintptr_t, uintptr_t);
51extern void	plt_upper_44(uintptr_t, uintptr_t);
52extern void	plt_full_range(uintptr_t, uintptr_t);
53extern void	elf_rtbndr(Rt_map *, ulong_t, caddr_t);
54extern void	elf_rtbndr_far(Rt_map *, ulong_t, caddr_t);
55
56
57int
58elf_mach_flags_check(Rej_desc *rej, Ehdr *ehdr)
59{
60	/*
61	 * Check machine type and flags.
62	 */
63	if (ehdr->e_flags & EF_SPARC_EXT_MASK) {
64		/*
65		 * Check vendor-specific extensions.
66		 */
67		if (ehdr->e_flags & EF_SPARC_HAL_R1) {
68			rej->rej_type = SGS_REJ_HAL;
69			rej->rej_info = (uint_t)ehdr->e_flags;
70			return (0);
71		}
72		if ((ehdr->e_flags & EF_SPARC_SUN_US3) & ~at_flags) {
73			rej->rej_type = SGS_REJ_US3;
74			rej->rej_info = (uint_t)ehdr->e_flags;
75			return (0);
76		}
77
78		/*
79		 * Generic check.
80		 * All of our 64-bit SPARC's support the US1 (UltraSPARC 1)
81		 * instructions so that bit isn't worth checking for explicitly.
82		 */
83		if ((ehdr->e_flags & EF_SPARC_EXT_MASK) & ~at_flags) {
84			rej->rej_type = SGS_REJ_BADFLAG;
85			rej->rej_info = (uint_t)ehdr->e_flags;
86			return (0);
87		}
88	} else if ((ehdr->e_flags & ~EF_SPARCV9_MM) != 0) {
89		rej->rej_type = SGS_REJ_BADFLAG;
90		rej->rej_info = (uint_t)ehdr->e_flags;
91		return (0);
92	}
93	return (1);
94}
95
96
97void
98ldso_plt_init(Rt_map * lmp)
99{
100	/*
101	 * There is no need to analyze ld.so because we don't map in any of
102	 * its dependencies.  However we may map these dependencies in later
103	 * (as if ld.so had dlopened them), so initialize the plt and the
104	 * permission information.
105	 */
106	if (PLTGOT(lmp)) {
107		Xword pltoff;
108
109		/*
110		 * Install the lm pointer in .PLT2 as per the ABI.
111		 */
112		pltoff = (2 * M_PLT_ENTSIZE) / M_PLT_INSSIZE;
113		elf_plt2_init(PLTGOT(lmp) + pltoff, lmp);
114
115		/*
116		 * The V9 ABI states that the first 32k PLT entries
117		 * use .PLT1, with .PLT0 used by the "latter" entries.
118		 * We don't currently implement the extendend format,
119		 * so install an error handler in .PLT0 to catch anyone
120		 * trying to use it.
121		 */
122		elf_plt_init(PLTGOT(lmp), (caddr_t)elf_rtbndr_far);
123
124		/*
125		 * Initialize .PLT1
126		 */
127		pltoff = M_PLT_ENTSIZE / M_PLT_INSSIZE;
128		elf_plt_init(PLTGOT(lmp) + pltoff, (caddr_t)elf_rtbndr);
129	}
130}
131
132/*
133 * elf_plt_write() will test to see how far away our destination
134 *	address lies.  If it is close enough that a branch can
135 *	be used instead of a jmpl - we will fill the plt in with
136 * 	single branch.  The branches are much quicker then
137 *	a jmpl instruction - see bug#4356879 for further
138 *	details.
139 *
140 *	NOTE: we pass in both a 'pltaddr' and a 'vpltaddr' since
141 *		librtld/dldump update PLT's who's physical
142 *		address is not the same as the 'virtual' runtime
143 *		address.
144 */
145Pltbindtype
146elf_plt_write(uintptr_t addr, uintptr_t vaddr, void *rptr, uintptr_t symval,
147	Xword pltndx)
148{
149	Rela		*rel = (Rela *)rptr;
150	uintptr_t	nsym = ~symval;
151	uintptr_t	vpltaddr, pltaddr;
152	long		disp;
153
154
155	pltaddr = addr + rel->r_offset;
156	vpltaddr = vaddr + rel->r_offset;
157	disp = symval - vpltaddr - 4;
158
159	if (pltndx >= (M64_PLT_NEARPLTS - M_PLT_XNumber)) {
160		*((Sxword *)pltaddr) = (uintptr_t)symval +
161		    (uintptr_t)rel->r_addend - vaddr;
162		DBG_CALL(pltcntfar++);
163		return (PLT_T_FAR);
164	}
165
166	/*
167	 * Test if the destination address is close enough to use
168	 * a ba,a... instruction to reach it.
169	 */
170	if (S_INRANGE(disp, 23) && !(rtld_flags & RT_FL_NOBAPLT)) {
171		uint_t		*pltent, bainstr;
172		Pltbindtype	rc;
173
174		pltent = (uint_t *)pltaddr;
175		/*
176		 * The
177		 *
178		 *	ba,a,pt %icc, <dest>
179		 *
180		 * is the most efficient of the PLT's.  If we
181		 * are within +-20 bits - use that branch.
182		 */
183		if (S_INRANGE(disp, 20)) {
184			bainstr = M_BA_A_PT;	/* ba,a,pt %icc,<dest> */
185			/* LINTED */
186			bainstr |= (uint_t)(S_MASK(19) & (disp >> 2));
187			rc = PLT_T_21D;
188			DBG_CALL(pltcnt21d++);
189		} else {
190			/*
191			 * Otherwise - we fall back to the good old
192			 *
193			 *	ba,a	<dest>
194			 *
195			 * Which still beats a jmpl instruction.
196			 */
197			bainstr = M_BA_A;		/* ba,a <dest> */
198			/* LINTED */
199			bainstr |= (uint_t)(S_MASK(22) & (disp >> 2));
200			rc = PLT_T_24D;
201			DBG_CALL(pltcnt24d++);
202		}
203
204		pltent[2] = M_NOP;		/* nop instr */
205		pltent[1] = bainstr;
206
207		iflush_range((char *)(&pltent[1]), 4);
208		pltent[0] = M_NOP;		/* nop instr */
209		iflush_range((char *)(&pltent[0]), 4);
210		return (rc);
211	}
212
213	if ((nsym >> 32) == 0) {
214		plt_upper_32(pltaddr, symval);
215		DBG_CALL(pltcntu32++);
216		return (PLT_T_U32);
217	}
218
219	if ((nsym >> 44) == 0) {
220		plt_upper_44(pltaddr, symval);
221		DBG_CALL(pltcntu44++);
222		return (PLT_T_U44);
223	}
224
225	/*
226	 * The PLT destination is not in reach of
227	 * a branch instruction - so we fall back
228	 * to a 'jmpl' sequence.
229	 */
230	plt_full_range(pltaddr, symval);
231	DBG_CALL(pltcntfull++);
232	return (PLT_T_FULL);
233}
234
235
236
237/*
238 * Once relocated, the following 6 instruction sequence moves
239 * a 64-bit immediate value into register %g1
240 */
241#define	VAL64_TO_G1 \
242/* 0x00 */	0x0b, 0x00, 0x00, 0x00,	/* sethi %hh(value), %g5 */ \
243/* 0x04 */	0x8a, 0x11, 0x60, 0x00,	/* or %g5, %hm(value), %g5 */ \
244/* 0x08 */	0x8b, 0x29, 0x70, 0x20,	/* sllx %g5, 32, %g5 */ \
245/* 0x0c */	0x03, 0x00, 0x00, 0x00,	/* sethi %lm(value), %g1 */ \
246/* 0x10 */	0x82, 0x10, 0x60, 0x00,	/* or %g1, %lo(value), %g1 */ \
247/* 0x14 */	0x82, 0x10, 0x40, 0x05	/* or %g1, %g5, %g1 */
248
249/*
250 * Local storage space created on the stack created for this glue
251 * code includes space for:
252 *		0x8	pointer to dyn_data
253 *		0x8	size prev stack frame
254 */
255static const Byte dyn_plt_template[] = {
256/* 0x0 */	0x2a, 0xcf, 0x80, 0x03,	/* brnz,a,pt %fp, 0xc	*/
257/* 0x4 */	0x82, 0x27, 0x80, 0x0e,	/* sub %fp, %sp, %g1 */
258/* 0x8 */	0x82, 0x10, 0x20, 0xb0,	/* mov 176, %g1	*/
259/* 0xc */	0x9d, 0xe3, 0xbf, 0x40,	/* save %sp, -192, %sp	*/
260/* 0x10 */	0xc2, 0x77, 0xa7, 0xef,	/* stx %g1, [%fp + 2031] */
261
262					/* store prev stack size */
263/* 0x14 */	VAL64_TO_G1,		/* dyn_data to g1 */
264/* 0x2c */	0xc2, 0x77, 0xa7, 0xf7,	/* stx %g1, [%fp + 2039] */
265
266/* 0x30 */	VAL64_TO_G1,		/* elf_plt_trace() addr to g1 */
267
268					/* Call to elf_plt_trace() via g1 */
269/* 0x48 */	0x9f, 0xc0, 0x60, 0x00,	/* jmpl ! link r[15] to addr in g1 */
270/* 0x4c */	0x01, 0x00, 0x00, 0x00	/* nop ! for jmpl delay slot *AND* */
271					/*	to get 8-byte alignment */
272};
273
274
275int	dyn_plt_ent_size = sizeof (dyn_plt_template) +
276		sizeof (Addr) +		/* reflmp */
277		sizeof (Addr) +		/* deflmp */
278		sizeof (Word) +		/* symndx */
279		sizeof (Word) +		/* sb_flags */
280		sizeof (Sym);		/* symdef */
281
282
283/*
284 * the dynamic plt entry is:
285 *
286 *	brnz,a,pt	%fp, 1f
287 *	sub     	%sp, %fp, %g1
288 *	mov     	SA(MINFRAME), %g1
289 * 1:
290 *	save    	%sp, -(SA(MINFRAME) + (2 * CLONGSIZE)), %sp
291 *
292 *	! store prev stack size
293 *	stx     	%g1, [%fp + STACK_BIAS - (2 * CLONGSIZE)]
294 *
295 * 2:
296 *	! move dyn_data to %g1
297 *	sethi   	%hh(dyn_data), %g5
298 *	or      	%g5, %hm(dyn_data), %g5
299 *	sllx    	%g5, 32, %g5
300 *	sethi   	%lm(dyn_data), %g1
301 *	or      	%g1, %lo(dyn_data), %g1
302 *	or      	%g1, %g5, %g1
303 *
304 *	! store dyn_data ptr on frame (from %g1)
305 *	 stx     	%g1, [%fp + STACK_BIAS - CLONGSIZE]
306 *
307 *	! Move address of elf_plt_trace() into %g1
308 *	[Uses same 6 instructions as shown at label 2: above. Not shown.]
309 *
310 *	! Use JMPL to make call. CALL instruction is limited to 30-bits.
311 *	! of displacement.
312 *	jmp1		%g1, %o7
313 *
314 *	! JMPL has a delay slot that must be filled. And, the sequence
315 *	! of instructions needs to have 8-byte alignment. This NOP does both.
316 *	! The alignment is needed for the data we put following the
317 *	! instruction.
318 *	nop
319 *
320 * dyn data:
321 *	Addr		reflmp
322 *	Addr		deflmp
323 *	Word		symndx
324 *	Word		sb_flags
325 *	Sym		symdef  (Elf64_Sym = 24-bytes)
326 */
327
328
329/*
330 * Relocate the instructions given by the VAL64_TO_G1 macro above.
331 * The arguments parallel those of do_reloc().
332 *
333 * entry:
334 *	off - Address of 1st instruction in sequence.
335 *	value - Value being relocated (addend)
336 *	sym - Name of value being relocated.
337 *	lml - link map list
338 *
339 * exit:
340 *	Returns TRUE for success, FALSE for failure.
341 */
342static int
343reloc_val64_to_g1(Byte *off, Addr *value, const char *sym, Lm_list *lml)
344{
345	Xword	tmp_value;
346
347	/*
348	 * relocating:
349	 *	sethi	%hh(value), %g5
350	 */
351	tmp_value = (Xword)value;
352	if (do_reloc(R_SPARC_HH22, off, &tmp_value, sym,
353	    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
354		return (0);
355	}
356
357	/*
358	 * relocating:
359	 *	or	%g5, %hm(value), %g5
360	 */
361	tmp_value = (Xword)value;
362	if (do_reloc(R_SPARC_HM10, off + 4, &tmp_value, sym,
363	    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
364		return (0);
365	}
366
367	/*
368	 * relocating:
369	 *	sethi	%lm(value), %g1
370	 */
371	tmp_value = (Xword)value;
372	if (do_reloc(R_SPARC_LM22, off + 12, &tmp_value, sym,
373	    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
374		return (0);
375	}
376
377	/*
378	 * relocating:
379	 *	or	%g1, %lo(value), %g1
380	 */
381	tmp_value = (Xword)value;
382	if (do_reloc(R_SPARC_LO10, off + 16, &tmp_value, sym,
383	    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
384		return (0);
385	}
386
387	return (1);
388}
389
390static caddr_t
391elf_plt_trace_write(caddr_t addr, Rela * rptr, Rt_map * rlmp, Rt_map * dlmp,
392    Sym * sym, uint_t symndx, ulong_t pltndx, caddr_t to, uint_t sb_flags,
393    int *fail)
394{
395	extern ulong_t	elf_plt_trace();
396	Addr		dyn_plt, *dyndata;
397
398	/*
399	 * If both pltenter & pltexit have been disabled there
400	 * there is no reason to even create the glue code.
401	 */
402	if ((sb_flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)) ==
403	    (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)) {
404		(void) elf_plt_write((uintptr_t)addr, (uintptr_t)addr,
405		    rptr, (uintptr_t)to, pltndx);
406		return (to);
407	}
408
409	/*
410	 * We only need to add the glue code if there is an auditing
411	 * library that is interested in this binding.
412	 */
413	dyn_plt = (Xword)AUDINFO(rlmp)->ai_dynplts +
414	    (pltndx * dyn_plt_ent_size);
415
416	/*
417	 * Have we initialized this dynamic plt entry yet?  If we haven't do it
418	 * now.  Otherwise this function has been called before, but from a
419	 * different plt (ie. from another shared object).  In that case
420	 * we just set the plt to point to the new dyn_plt.
421	 */
422	if (*(Word *)dyn_plt == 0) {
423		Sym	*symp;
424		Lm_list	*lml = LIST(rlmp);
425
426		(void) memcpy((void *)dyn_plt, dyn_plt_template,
427		    sizeof (dyn_plt_template));
428		dyndata = (Addr *)(dyn_plt + sizeof (dyn_plt_template));
429
430		/*
431		 * relocating:
432		 *	VAL64_TO_G1(dyndata)
433		 *	VAL64_TO_G1(&elf_plt_trace)
434		 */
435		if (!(reloc_val64_to_g1((Byte *) (dyn_plt + 0x14), dyndata,
436		    MSG_ORIG(MSG_SYM_LADYNDATA), lml) &&
437		    reloc_val64_to_g1((Byte *) (dyn_plt + 0x30),
438		    (Addr *)&elf_plt_trace, MSG_ORIG(MSG_SYM_ELFPLTTRACE),
439		    lml))) {
440			*fail = 1;
441			return (0);
442		}
443
444		*dyndata++ = (Addr)rlmp;
445		*dyndata++ = (Addr)dlmp;
446
447		/*
448		 * symndx in the high word, sb_flags in the low.
449		 */
450		*dyndata = (Addr)sb_flags;
451		*(Word *)dyndata = symndx;
452		dyndata++;
453
454		symp = (Sym *)dyndata;
455		*symp = *sym;
456		symp->st_value = (Addr)to;
457		iflush_range((void *)dyn_plt, sizeof (dyn_plt_template));
458	}
459
460	(void) elf_plt_write((uintptr_t)addr, (uintptr_t)addr, rptr,
461	    (uintptr_t)dyn_plt, pltndx);
462	return ((caddr_t)dyn_plt);
463}
464
465/*
466 * Function binding routine - invoked on the first call to a function through
467 * the procedure linkage table;
468 * passes first through an assembly language interface.
469 *
470 * Takes the address of the PLT entry where the call originated,
471 * the offset into the relocation table of the associated
472 * relocation entry and the address of the link map (rt_private_map struct)
473 * for the entry.
474 *
475 * Returns the address of the function referenced after re-writing the PLT
476 * entry to invoke the function directly.
477 *
478 * On error, causes process to terminate with a signal.
479 */
480
481ulong_t
482elf_bndr(Rt_map *lmp, ulong_t pltoff, caddr_t from)
483{
484	Rt_map		*nlmp, *llmp;
485	Addr		addr, vaddr, reloff, symval;
486	char		*name;
487	Rela		*rptr;
488	Sym		*sym, *nsym;
489	Xword		pltndx;
490	uint_t		binfo, sb_flags = 0;
491	ulong_t		rsymndx;
492	Slookup		sl;
493	Pltbindtype	pbtype;
494	int		entry, lmflags, farplt = 0;
495	uint_t		dbg_class;
496	Lm_list		*lml = LIST(lmp);
497
498	/*
499	 * For compatibility with libthread (TI_VERSION 1) we track the entry
500	 * value.  A zero value indicates we have recursed into ld.so.1 to
501	 * further process a locking request.  Under this recursion we disable
502	 * tsort and cleanup activities.
503	 */
504	entry = enter();
505
506	if ((lmflags = lml->lm_flags) & LML_FLG_RTLDLM) {
507		dbg_class = dbg_desc->d_class;
508		dbg_desc->d_class = 0;
509	}
510
511	/*
512	 * Must calculate true plt relocation address from reloc.
513	 * Take offset, subtract number of reserved PLT entries, and divide
514	 * by PLT entry size, which should give the index of the plt
515	 * entry (and relocation entry since they have been defined to be
516	 * in the same order).  Then we must multiply by the size of
517	 * a relocation entry, which will give us the offset of the
518	 * plt relocation entry from the start of them given by JMPREL(lm).
519	 */
520	addr = pltoff - M_PLT_RESERVSZ;
521
522	if (pltoff < (M64_PLT_NEARPLTS * M_PLT_ENTSIZE)) {
523		pltndx = addr / M_PLT_ENTSIZE;
524	} else {
525		ulong_t	pltblockoff;
526
527		pltblockoff = pltoff - (M64_PLT_NEARPLTS * M_PLT_ENTSIZE);
528		pltndx = M64_PLT_NEARPLTS +
529		    ((pltblockoff / M64_PLT_FBLOCKSZ) * M64_PLT_FBLKCNTS) +
530		    ((pltblockoff % M64_PLT_FBLOCKSZ) / M64_PLT_FENTSIZE) -
531		    M_PLT_XNumber;
532		farplt = 1;
533	}
534
535	/*
536	 * Perform some basic sanity checks.  If we didn't get a load map
537	 * or the plt offset is invalid then its possible someone has walked
538	 * over the plt entries or jumped to plt[01] out of the blue.
539	 */
540	if (!lmp || (!farplt && (addr % M_PLT_ENTSIZE) != 0) ||
541	    (farplt && (addr % M_PLT_INSSIZE))) {
542		Conv_inv_buf_t	inv_buf;
543
544		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_PLTREF),
545		    conv_reloc_SPARC_type(R_SPARC_JMP_SLOT, 0, &inv_buf),
546		    EC_NATPTR(lmp), EC_XWORD(pltoff), EC_NATPTR(from));
547		rtldexit(lml, 1);
548	}
549	reloff = pltndx * sizeof (Rela);
550
551	/*
552	 * Use relocation entry to get symbol table entry and symbol name.
553	 */
554	addr = (ulong_t)JMPREL(lmp);
555	rptr = (Rela *)(addr + reloff);
556	rsymndx = ELF_R_SYM(rptr->r_info);
557	sym = (Sym *)((ulong_t)SYMTAB(lmp) + (rsymndx * SYMENT(lmp)));
558	name = (char *)(STRTAB(lmp) + sym->st_name);
559
560	/*
561	 * Determine the last link-map of this list, this'll be the starting
562	 * point for any tsort() processing.
563	 */
564	llmp = lml->lm_tail;
565
566	/*
567	 * Find definition for symbol.
568	 */
569	sl.sl_name = name;
570	sl.sl_cmap = lmp;
571	sl.sl_imap = lml->lm_head;
572	sl.sl_hash = 0;
573	sl.sl_rsymndx = rsymndx;
574	sl.sl_flags = LKUP_DEFT;
575	if ((nsym = lookup_sym(&sl, &nlmp, &binfo)) == 0) {
576		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_NOSYM), NAME(lmp),
577		    demangle(name));
578		rtldexit(lml, 1);
579	}
580
581	symval = nsym->st_value;
582	if (!(FLAGS(nlmp) & FLG_RT_FIXED) &&
583	    (nsym->st_shndx != SHN_ABS))
584		symval += ADDR(nlmp);
585	if ((lmp != nlmp) && ((FLAGS1(nlmp) & FL1_RT_NOINIFIN) == 0)) {
586		/*
587		 * Record that this new link map is now bound to the caller.
588		 */
589		if (bind_one(lmp, nlmp, BND_REFER) == 0)
590			rtldexit(lml, 1);
591	}
592
593	if ((lml->lm_tflags | FLAGS1(lmp)) & LML_TFLG_AUD_SYMBIND) {
594		/* LINTED */
595		uint_t	symndx = (uint_t)(((uintptr_t)nsym -
596		    (uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp));
597
598		symval = audit_symbind(lmp, nlmp, nsym, symndx, symval,
599		    &sb_flags);
600	}
601
602	if (FLAGS(lmp) & FLG_RT_FIXED)
603		vaddr = 0;
604	else
605		vaddr = ADDR(lmp);
606
607	pbtype = PLT_T_NONE;
608	if (!(rtld_flags & RT_FL_NOBIND)) {
609		if (((lml->lm_tflags | FLAGS1(lmp)) &
610		    (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) &&
611		    AUDINFO(lmp)->ai_dynplts) {
612			int	fail = 0;
613			/* LINTED */
614			uint_t	symndx = (uint_t)(((uintptr_t)nsym -
615			    (uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp));
616
617			symval = (ulong_t)elf_plt_trace_write((caddr_t)vaddr,
618			    rptr, lmp, nlmp, nsym, symndx, pltndx,
619			    (caddr_t)symval, sb_flags, &fail);
620			if (fail)
621				rtldexit(lml, 1);
622		} else {
623			/*
624			 * Write standard PLT entry to jump directly
625			 * to newly bound function.
626			 */
627			pbtype = elf_plt_write((uintptr_t)vaddr,
628			    (uintptr_t)vaddr, rptr, symval, pltndx);
629		}
630	}
631
632	/*
633	 * Print binding information and rebuild PLT entry.
634	 */
635	DBG_CALL(Dbg_bind_global(lmp, (Addr)from, (Off)(from - ADDR(lmp)),
636	    (Xword)pltndx, pbtype, nlmp, (Addr)symval, nsym->st_value,
637	    name, binfo));
638
639	/*
640	 * Complete any processing for newly loaded objects.  Note we don't
641	 * know exactly where any new objects are loaded (we know the object
642	 * that supplied the symbol, but others may have been loaded lazily as
643	 * we searched for the symbol), so sorting starts from the last
644	 * link-map know on entry to this routine.
645	 */
646	if (entry)
647		load_completion(llmp);
648
649	/*
650	 * Some operations like dldump() or dlopen()'ing a relocatable object
651	 * result in objects being loaded on rtld's link-map, make sure these
652	 * objects are initialized also.
653	 */
654	if ((LIST(nlmp)->lm_flags & LML_FLG_RTLDLM) && LIST(nlmp)->lm_init)
655		load_completion(nlmp);
656
657	/*
658	 * If the object we've bound to is in the process of being initialized
659	 * by another thread, determine whether we should block.
660	 */
661	is_dep_ready(nlmp, lmp, DBG_WAIT_SYMBOL);
662
663	/*
664	 * Make sure the object to which we've bound has had it's .init fired.
665	 * Cleanup before return to user code.
666	 */
667	if (entry) {
668		is_dep_init(nlmp, lmp);
669		leave(LIST(lmp));
670	}
671
672	if (lmflags & LML_FLG_RTLDLM)
673		dbg_desc->d_class = dbg_class;
674
675	return (symval);
676}
677
678
679static int
680bindpltpad(Rt_map *lmp, List *padlist, Addr value, void **pltaddr,
681    const char *fname, const char *sname)
682{
683	Listnode	*lnp, *prevlnp;
684	Pltpadinfo	*pip;
685	void		*plt;
686	uintptr_t	pltoff;
687	Rela		rel;
688	int		i;
689
690	prevlnp = 0;
691	for (LIST_TRAVERSE(padlist, lnp, pip)) {
692		if (pip->pp_addr == value) {
693			*pltaddr = pip->pp_plt;
694			DBG_CALL(Dbg_bind_pltpad_from(lmp, (Addr)*pltaddr,
695			    sname));
696			return (1);
697		}
698		if (pip->pp_addr > value)
699			break;
700		prevlnp = lnp;
701	}
702
703	plt = PLTPAD(lmp);
704	pltoff = (uintptr_t)plt - (uintptr_t)ADDR(lmp);
705
706	PLTPAD(lmp) = (void *)((uintptr_t)PLTPAD(lmp) + M_PLT_ENTSIZE);
707
708	if (PLTPAD(lmp) > PLTPADEND(lmp)) {
709		/*
710		 * Just fail in usual relocation way
711		 */
712		*pltaddr = (void *)value;
713		return (1);
714	}
715	rel.r_offset = pltoff;
716	rel.r_info = 0;
717	rel.r_addend = 0;
718
719
720	/*
721	 * elf_plt_write assumes the plt was previously filled
722	 * with NOP's, so fill it in now.
723	 */
724	for (i = 0; i < (M_PLT_ENTSIZE / sizeof (uint_t)); i++) {
725		((uint_t *)plt)[i] = M_NOP;
726	}
727	iflush_range((caddr_t)plt, M_PLT_ENTSIZE);
728
729	(void) elf_plt_write(ADDR(lmp), ADDR(lmp), &rel, value, 0);
730
731	if ((pip = calloc(sizeof (Pltpadinfo), 1)) == 0)
732		return (0);
733	pip->pp_addr = value;
734	pip->pp_plt = plt;
735
736	if (prevlnp)
737		lnp = list_insert(padlist, pip, prevlnp);
738	else
739		lnp = list_prepend(padlist, pip);
740
741	if (!lnp) {
742		free(pip);
743		return (0);
744	}
745
746	*pltaddr = plt;
747	DBG_CALL(Dbg_bind_pltpad_to(lmp, (Addr)*pltaddr, fname, sname));
748	return (1);
749}
750
751/*
752 * Read and process the relocations for one link object, we assume all
753 * relocation sections for loadable segments are stored contiguously in
754 * the file.
755 */
756int
757elf_reloc(Rt_map *lmp, uint_t plt)
758{
759	ulong_t		relbgn, relend, relsiz, basebgn, pltbgn, pltend;
760	ulong_t		roffset, rsymndx, psymndx = 0, etext = ETEXT(lmp);
761	ulong_t		emap, pltndx;
762	uint_t		dsymndx, binfo, pbinfo;
763	Byte		rtype;
764	long		reladd;
765	Addr		value, pvalue;
766	Sym		*symref, *psymref, *symdef, *psymdef;
767	char		*name, *pname;
768	Rt_map		*_lmp, *plmp;
769	int		textrel = 0, ret = 1, noplt = 0;
770	long		relacount = RELACOUNT(lmp);
771	Rela		*rel;
772	Pltbindtype	pbtype;
773	List		pltpadlist = {0, 0};
774	Alist		*bound = 0;
775
776	/*
777	 * If an object has any DT_REGISTER entries associated with
778	 * it, they are processed now.
779	 */
780	if ((plt == 0) && (FLAGS(lmp) & FLG_RT_REGSYMS)) {
781		if (elf_regsyms(lmp) == 0)
782			return (0);
783	}
784
785	/*
786	 * Although only necessary for lazy binding, initialize the first
787	 * procedure linkage table entry to go to elf_rtbndr().  dbx(1) seems
788	 * to find this useful.
789	 */
790	if ((plt == 0) && PLTGOT(lmp)) {
791		Xword pltoff;
792
793		if ((ulong_t)PLTGOT(lmp) < etext) {
794			if (elf_set_prot(lmp, PROT_WRITE) == 0)
795				return (0);
796			textrel = 1;
797		}
798
799		/*
800		 * Install the lm pointer in .PLT2 as per the ABI.
801		 */
802		pltoff = (2 * M_PLT_ENTSIZE) / M_PLT_INSSIZE;
803		elf_plt2_init(PLTGOT(lmp) + pltoff, lmp);
804
805		/*
806		 * The V9 ABI states that the first 32k PLT entries
807		 * use .PLT1, with .PLT0 used by the "latter" entries.
808		 * We don't currently implement the extendend format,
809		 * so install an error handler in .PLT0 to catch anyone
810		 * trying to use it.
811		 */
812		elf_plt_init(PLTGOT(lmp), (caddr_t)elf_rtbndr_far);
813
814		/*
815		 * Initialize .PLT1
816		 */
817		pltoff = M_PLT_ENTSIZE / M_PLT_INSSIZE;
818		elf_plt_init(PLTGOT(lmp) + pltoff, (caddr_t)elf_rtbndr);
819	}
820
821	/*
822	 * Initialize the plt start and end addresses.
823	 */
824	if ((pltbgn = (ulong_t)JMPREL(lmp)) != 0)
825		pltend = pltbgn + (ulong_t)(PLTRELSZ(lmp));
826
827	/*
828	 * If we've been called upon to promote an RTLD_LAZY object to an
829	 * RTLD_NOW then we're only interested in scaning the .plt table.
830	 */
831	if (plt) {
832		relbgn = pltbgn;
833		relend = pltend;
834	} else {
835		/*
836		 * The relocation sections appear to the run-time linker as a
837		 * single table.  Determine the address of the beginning and end
838		 * of this table.  There are two different interpretations of
839		 * the ABI at this point:
840		 *
841		 *   o	The REL table and its associated RELSZ indicate the
842		 *	concatenation of *all* relocation sections (this is the
843		 *	model our link-editor constructs).
844		 *
845		 *   o	The REL table and its associated RELSZ indicate the
846		 *	concatenation of all *but* the .plt relocations.  These
847		 *	relocations are specified individually by the JMPREL and
848		 *	PLTRELSZ entries.
849		 *
850		 * Determine from our knowledege of the relocation range and
851		 * .plt range, the range of the total relocation table.  Note
852		 * that one other ABI assumption seems to be that the .plt
853		 * relocations always follow any other relocations, the
854		 * following range checking drops that assumption.
855		 */
856		relbgn = (ulong_t)(REL(lmp));
857		relend = relbgn + (ulong_t)(RELSZ(lmp));
858		if (pltbgn) {
859			if (!relbgn || (relbgn > pltbgn))
860				relbgn = pltbgn;
861			if (!relbgn || (relend < pltend))
862				relend = pltend;
863		}
864	}
865	if (!relbgn || (relbgn == relend)) {
866		DBG_CALL(Dbg_reloc_run(lmp, 0, plt, DBG_REL_NONE));
867		return (1);
868	}
869
870	relsiz = (ulong_t)(RELENT(lmp));
871	basebgn = ADDR(lmp);
872	emap = ADDR(lmp) + MSIZE(lmp);
873
874	DBG_CALL(Dbg_reloc_run(lmp, M_REL_SHT_TYPE, plt, DBG_REL_START));
875
876	/*
877	 * If we're processing in lazy mode there is no need to scan the
878	 * .rela.plt table.
879	 */
880	if (pltbgn && ((MODE(lmp) & RTLD_NOW) == 0))
881		noplt = 1;
882
883	/*
884	 * Loop through relocations.
885	 */
886	while (relbgn < relend) {
887		Addr		vaddr;
888		uint_t		sb_flags = 0;
889
890		rtype = (Byte)ELF_R_TYPE(((Rela *)relbgn)->r_info);
891
892		/*
893		 * If this is a RELATIVE relocation in a shared object
894		 * (the common case), and if we are not debugging, then
895		 * jump into a tighter relocaiton loop (elf_reloc_relacount)
896		 * Only make the jump if we've been given a hint on the
897		 * number of relocations.
898		 */
899		if ((rtype == R_SPARC_RELATIVE) &&
900		    ((FLAGS(lmp) & FLG_RT_FIXED) == 0) && (DBG_ENABLED == 0)) {
901			/*
902			 * It's possible that the relative relocation block
903			 * has relocations against the text segment as well
904			 * as the data segment.  Since our optimized relocation
905			 * engine does not check which segment the relocation
906			 * is against - just mprotect it now if it's been
907			 * marked as containing TEXTREL's.
908			 */
909			if ((textrel == 0) && (FLAGS1(lmp) & FL1_RT_TEXTREL)) {
910				if (elf_set_prot(lmp, PROT_WRITE) == 0) {
911					ret = 0;
912					break;
913				}
914				textrel = 1;
915			}
916			if (relacount) {
917				relbgn = elf_reloc_relacount(relbgn, relacount,
918				    relsiz, basebgn);
919				relacount = 0;
920			} else {
921				relbgn = elf_reloc_relative(relbgn, relend,
922				    relsiz, basebgn, etext, emap);
923			}
924			if (relbgn >= relend)
925				break;
926			rtype = (Byte)ELF_R_TYPE(((Rela *)relbgn)->r_info);
927		}
928
929		roffset = ((Rela *)relbgn)->r_offset;
930
931		reladd = (long)(((Rela *)relbgn)->r_addend);
932		rsymndx = ELF_R_SYM(((Rela *)relbgn)->r_info);
933
934		rel = (Rela *)relbgn;
935		relbgn += relsiz;
936
937		/*
938		 * Optimizations.
939		 */
940		if (rtype == R_SPARC_NONE)
941			continue;
942		if (noplt && ((ulong_t)rel >= pltbgn) &&
943		    ((ulong_t)rel < pltend)) {
944			relbgn = pltend;
945			continue;
946		}
947
948		if (rtype != R_SPARC_REGISTER) {
949			/*
950			 * If this is a shared object, add the base address
951			 * to offset.
952			 */
953			if (!(FLAGS(lmp) & FLG_RT_FIXED))
954				roffset += basebgn;
955
956			/*
957			 * If this relocation is not against part of the image
958			 * mapped into memory we skip it.
959			 */
960			if ((roffset < ADDR(lmp)) || (roffset > (ADDR(lmp) +
961			    MSIZE(lmp)))) {
962				elf_reloc_bad(lmp, (void *)rel, rtype, roffset,
963				    rsymndx);
964				continue;
965			}
966		}
967
968		/*
969		 * If we're promoting plts determine if this one has already
970		 * been written. An uninitialized plts' second instruction is a
971		 * branch.
972		 */
973		if (plt) {
974			uchar_t	*_roffset = (uchar_t *)roffset;
975
976			_roffset += M_PLT_INSSIZE;
977			/* LINTED */
978			if ((*(uint_t *)_roffset &
979			    (~(S_MASK(19)))) != M_BA_A_XCC)
980				continue;
981		}
982
983		binfo = 0;
984		pltndx = (ulong_t)-1;
985		pbtype = PLT_T_NONE;
986		/*
987		 * If a symbol index is specified then get the symbol table
988		 * entry, locate the symbol definition, and determine its
989		 * address.
990		 */
991		if (rsymndx) {
992			/*
993			 * Get the local symbol table entry.
994			 */
995			symref = (Sym *)((ulong_t)SYMTAB(lmp) +
996			    (rsymndx * SYMENT(lmp)));
997
998			/*
999			 * If this is a local symbol, just use the base address.
1000			 * (we should have no local relocations in the
1001			 * executable).
1002			 */
1003			if (ELF_ST_BIND(symref->st_info) == STB_LOCAL) {
1004				value = basebgn;
1005				name = (char *)0;
1006
1007				/*
1008				 * Special case TLS relocations.
1009				 */
1010				if ((rtype == R_SPARC_TLS_DTPMOD32) ||
1011				    (rtype == R_SPARC_TLS_DTPMOD64)) {
1012					/*
1013					 * Use the TLS modid.
1014					 */
1015					value = TLSMODID(lmp);
1016
1017				} else if ((rtype == R_SPARC_TLS_TPOFF32) ||
1018				    (rtype == R_SPARC_TLS_TPOFF64)) {
1019					if ((value = elf_static_tls(lmp, symref,
1020					    rel, rtype, 0, roffset, 0)) == 0) {
1021						ret = 0;
1022						break;
1023					}
1024				}
1025			} else {
1026				/*
1027				 * If the symbol index is equal to the previous
1028				 * symbol index relocation we processed then
1029				 * reuse the previous values. (Note that there
1030				 * have been cases where a relocation exists
1031				 * against a copy relocation symbol, our ld(1)
1032				 * should optimize this away, but make sure we
1033				 * don't use the same symbol information should
1034				 * this case exist).
1035				 */
1036				if ((rsymndx == psymndx) &&
1037				    (rtype != R_SPARC_COPY)) {
1038					/* LINTED */
1039					if (psymdef == 0) {
1040						DBG_CALL(Dbg_bind_weak(lmp,
1041						    (Addr)roffset, (Addr)
1042						    (roffset - basebgn), name));
1043						continue;
1044					}
1045					/* LINTED */
1046					value = pvalue;
1047					/* LINTED */
1048					name = pname;
1049					symdef = psymdef;
1050					/* LINTED */
1051					symref = psymref;
1052					/* LINTED */
1053					_lmp = plmp;
1054					/* LINTED */
1055					binfo = pbinfo;
1056
1057					if ((LIST(_lmp)->lm_tflags |
1058					    FLAGS1(_lmp)) &
1059					    LML_TFLG_AUD_SYMBIND) {
1060						value = audit_symbind(lmp, _lmp,
1061						    /* LINTED */
1062						    symdef, dsymndx, value,
1063						    &sb_flags);
1064					}
1065				} else {
1066					Slookup		sl;
1067					uchar_t		bind;
1068
1069					/*
1070					 * Lookup the symbol definition.
1071					 */
1072					name = (char *)(STRTAB(lmp) +
1073					    symref->st_name);
1074
1075					sl.sl_name = name;
1076					sl.sl_cmap = lmp;
1077					sl.sl_imap = 0;
1078					sl.sl_hash = 0;
1079					sl.sl_rsymndx = rsymndx;
1080
1081					if (rtype == R_SPARC_COPY)
1082						sl.sl_flags = LKUP_COPY;
1083					else
1084						sl.sl_flags = LKUP_DEFT;
1085
1086					sl.sl_flags |= LKUP_ALLCNTLIST;
1087
1088					if (rtype != R_SPARC_JMP_SLOT)
1089						sl.sl_flags |= LKUP_SPEC;
1090
1091					bind = ELF_ST_BIND(symref->st_info);
1092					if (bind == STB_WEAK)
1093						sl.sl_flags |= LKUP_WEAK;
1094
1095					symdef = lookup_sym(&sl, &_lmp, &binfo);
1096
1097					/*
1098					 * If the symbol is not found and the
1099					 * reference was not to a weak symbol,
1100					 * report an error.  Weak references
1101					 * may be unresolved.
1102					 * chkmsg: MSG_INTL(MSG_LDD_SYM_NFOUND)
1103					 */
1104					/* BEGIN CSTYLED */
1105					if (symdef == 0) {
1106					    Lm_list	*lml = LIST(lmp);
1107
1108					    if (bind != STB_WEAK) {
1109						if (lml->lm_flags &
1110						    LML_FLG_IGNRELERR) {
1111						    continue;
1112						} else if (lml->lm_flags &
1113						    LML_FLG_TRC_WARN) {
1114						    (void) printf(MSG_INTL(
1115							MSG_LDD_SYM_NFOUND),
1116							demangle(name),
1117							NAME(lmp));
1118						    continue;
1119						} else {
1120						    DBG_CALL(Dbg_reloc_in(lml,
1121							ELF_DBG_RTLD, M_MACH,
1122							M_REL_SHT_TYPE, rel,
1123							NULL, name));
1124						    eprintf(lml, ERR_FATAL,
1125							MSG_INTL(MSG_REL_NOSYM),
1126							NAME(lmp),
1127							demangle(name));
1128						    ret = 0;
1129						    break;
1130						}
1131					    } else {
1132						psymndx = rsymndx;
1133						psymdef = 0;
1134
1135						DBG_CALL(Dbg_bind_weak(lmp,
1136						    (Addr)roffset, (Addr)
1137						    (roffset - basebgn), name));
1138						continue;
1139					    }
1140					}
1141					/* END CSTYLED */
1142
1143					/*
1144					 * If symbol was found in an object
1145					 * other than the referencing object
1146					 * then record the binding.
1147					 */
1148					if ((lmp != _lmp) && ((FLAGS1(_lmp) &
1149					    FL1_RT_NOINIFIN) == 0)) {
1150						if (alist_test(&bound, _lmp,
1151						    sizeof (Rt_map *),
1152						    AL_CNT_RELBIND) == 0) {
1153							ret = 0;
1154							break;
1155						}
1156					}
1157
1158					/*
1159					 * Calculate the location of definition;
1160					 * symbol value plus base address of
1161					 * containing shared object.
1162					 */
1163					if (IS_SIZE(rtype))
1164						value = symdef->st_size;
1165					else
1166						value = symdef->st_value;
1167
1168					if (!(FLAGS(_lmp) & FLG_RT_FIXED) &&
1169					    !(IS_SIZE(rtype)) &&
1170					    (symdef->st_shndx != SHN_ABS) &&
1171					    (ELF_ST_TYPE(symdef->st_info) !=
1172					    STT_TLS))
1173						value += ADDR(_lmp);
1174
1175					/*
1176					 * Retain this symbol index and the
1177					 * value in case it can be used for the
1178					 * subsequent relocations.
1179					 */
1180					if (rtype != R_SPARC_COPY) {
1181						psymndx = rsymndx;
1182						pvalue = value;
1183						pname = name;
1184						psymdef = symdef;
1185						psymref = symref;
1186						plmp = _lmp;
1187						pbinfo = binfo;
1188					}
1189					if ((LIST(_lmp)->lm_tflags |
1190					    FLAGS1(_lmp)) &
1191					    LML_TFLG_AUD_SYMBIND) {
1192						/* LINTED */
1193						dsymndx = (((uintptr_t)symdef -
1194						    (uintptr_t)SYMTAB(_lmp)) /
1195						    SYMENT(_lmp));
1196						value = audit_symbind(lmp, _lmp,
1197						    symdef, dsymndx, value,
1198						    &sb_flags);
1199					}
1200				}
1201
1202				/*
1203				 * If relocation is PC-relative, subtract
1204				 * offset address.
1205				 */
1206				if (IS_PC_RELATIVE(rtype))
1207					value -= roffset;
1208
1209				/*
1210				 * Special case TLS relocations.
1211				 */
1212				if ((rtype == R_SPARC_TLS_DTPMOD32) ||
1213				    (rtype == R_SPARC_TLS_DTPMOD64)) {
1214					/*
1215					 * Relocation value is the TLS modid.
1216					 */
1217					value = TLSMODID(_lmp);
1218
1219				} else if ((rtype == R_SPARC_TLS_TPOFF64) ||
1220				    (rtype == R_SPARC_TLS_TPOFF32)) {
1221					if ((value = elf_static_tls(_lmp,
1222					    symdef, rel, rtype, name, roffset,
1223					    value)) == 0) {
1224						ret = 0;
1225						break;
1226					}
1227				}
1228			}
1229		} else {
1230			/*
1231			 * Special cases.
1232			 */
1233			if (rtype == R_SPARC_REGISTER) {
1234				/*
1235				 * A register symbol associated with symbol
1236				 * index 0 is initialized (i.e. relocated) to
1237				 * a constant in the r_addend field rather than
1238				 * to a symbol value.
1239				 */
1240				value = 0;
1241
1242			} else if ((rtype == R_SPARC_TLS_DTPMOD32) ||
1243			    (rtype == R_SPARC_TLS_DTPMOD64)) {
1244				/*
1245				 * TLS relocation value is the TLS modid.
1246				 */
1247				value = TLSMODID(lmp);
1248			} else
1249				value = basebgn;
1250			name = (char *)0;
1251		}
1252
1253		DBG_CALL(Dbg_reloc_in(LIST(lmp), ELF_DBG_RTLD, M_MACH,
1254		    M_REL_SHT_TYPE, rel, NULL, name));
1255
1256		/*
1257		 * If this object has relocations in the text segment, turn
1258		 * off the write protect.
1259		 */
1260		if ((rtype != R_SPARC_REGISTER) && (roffset < etext) &&
1261		    (textrel == 0)) {
1262			if (elf_set_prot(lmp, PROT_WRITE) == 0) {
1263				ret = 0;
1264				break;
1265			}
1266			textrel = 1;
1267		}
1268
1269		/*
1270		 * Call relocation routine to perform required relocation.
1271		 */
1272		switch (rtype) {
1273		case R_SPARC_REGISTER:
1274			/*
1275			 * The v9 ABI 4.2.4 says that system objects may,
1276			 * but are not required to, use register symbols
1277			 * to inidcate how they use global registers. Thus
1278			 * at least %g6, %g7 must be allowed in addition
1279			 * to %g2 and %g3.
1280			 */
1281			value += reladd;
1282			if (roffset == STO_SPARC_REGISTER_G1) {
1283				set_sparc_g1(value);
1284			} else if (roffset == STO_SPARC_REGISTER_G2) {
1285				set_sparc_g2(value);
1286			} else if (roffset == STO_SPARC_REGISTER_G3) {
1287				set_sparc_g3(value);
1288			} else if (roffset == STO_SPARC_REGISTER_G4) {
1289				set_sparc_g4(value);
1290			} else if (roffset == STO_SPARC_REGISTER_G5) {
1291				set_sparc_g5(value);
1292			} else if (roffset == STO_SPARC_REGISTER_G6) {
1293				set_sparc_g6(value);
1294			} else if (roffset == STO_SPARC_REGISTER_G7) {
1295				set_sparc_g7(value);
1296			} else {
1297				eprintf(LIST(lmp), ERR_FATAL,
1298				    MSG_INTL(MSG_REL_BADREG), NAME(lmp),
1299				    EC_ADDR(roffset));
1300				ret = 0;
1301				break;
1302			}
1303
1304			DBG_CALL(Dbg_reloc_apply_reg(LIST(lmp), ELF_DBG_RTLD,
1305			    M_MACH, (Xword)roffset, (Xword)value));
1306			break;
1307		case R_SPARC_COPY:
1308			if (elf_copy_reloc(name, symref, lmp, (void *)roffset,
1309			    symdef, _lmp, (const void *)value) == 0)
1310				ret = 0;
1311			break;
1312		case R_SPARC_JMP_SLOT:
1313			pltndx = ((uintptr_t)rel -
1314			    (uintptr_t)JMPREL(lmp)) / relsiz;
1315
1316			if (FLAGS(lmp) & FLG_RT_FIXED)
1317				vaddr = 0;
1318			else
1319				vaddr = ADDR(lmp);
1320
1321			if (((LIST(lmp)->lm_tflags | FLAGS1(lmp)) &
1322			    (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) &&
1323			    AUDINFO(lmp)->ai_dynplts) {
1324				int	fail = 0;
1325				/* LINTED */
1326				uint_t	symndx = (uint_t)(((uintptr_t)symdef -
1327				    (uintptr_t)SYMTAB(_lmp)) / SYMENT(_lmp));
1328
1329				(void) elf_plt_trace_write((caddr_t)vaddr,
1330				    (Rela *)rel, lmp, _lmp, symdef, symndx,
1331				    pltndx, (caddr_t)value, sb_flags, &fail);
1332				if (fail)
1333					ret = 0;
1334			} else {
1335				/*
1336				 * Write standard PLT entry to jump directly
1337				 * to newly bound function.
1338				 */
1339				DBG_CALL(Dbg_reloc_apply_val(LIST(lmp),
1340				    ELF_DBG_RTLD, (Xword)roffset,
1341				    (Xword)value));
1342				pbtype = elf_plt_write((uintptr_t)vaddr,
1343				    (uintptr_t)vaddr, (void *)rel, value,
1344				    pltndx);
1345			}
1346			break;
1347		case R_SPARC_WDISP30:
1348			if (PLTPAD(lmp) &&
1349			    (S_INRANGE((Sxword)value, 29) == 0)) {
1350				void *	plt = 0;
1351
1352				if (bindpltpad(lmp, &pltpadlist,
1353				    value + roffset, &plt,
1354				    NAME(_lmp), name) == 0) {
1355					ret = 0;
1356					break;
1357				}
1358				value = (Addr)((Addr)plt - roffset);
1359			}
1360			/* FALLTHROUGH */
1361		default:
1362			value += reladd;
1363			if (IS_EXTOFFSET(rtype))
1364				value += (Word)ELF_R_TYPE_DATA(rel->r_info);
1365
1366			/*
1367			 * Write the relocation out.  If this relocation is a
1368			 * common basic write, skip the doreloc() engine.
1369			 */
1370			if ((rtype == R_SPARC_GLOB_DAT) ||
1371			    (rtype == R_SPARC_64)) {
1372				if (roffset & 0x7) {
1373					Conv_inv_buf_t	inv_buf;
1374
1375					eprintf(LIST(lmp), ERR_FATAL,
1376					    MSG_INTL(MSG_REL_NONALIGN),
1377					    conv_reloc_SPARC_type(rtype,
1378					    0, &inv_buf),
1379					    NAME(lmp), demangle(name),
1380					    EC_OFF(roffset));
1381					ret = 0;
1382				} else
1383					*(ulong_t *)roffset += value;
1384			} else {
1385				if (do_reloc(rtype, (uchar_t *)roffset,
1386				    (Xword *)&value, name,
1387				    NAME(lmp), LIST(lmp)) == 0)
1388					ret = 0;
1389			}
1390
1391			/*
1392			 * The value now contains the 'bit-shifted' value that
1393			 * was or'ed into memory (this was set by do_reloc()).
1394			 */
1395			DBG_CALL(Dbg_reloc_apply_val(LIST(lmp), ELF_DBG_RTLD,
1396			    (Xword)roffset, (Xword)value));
1397
1398			/*
1399			 * If this relocation is against a text segment, make
1400			 * sure that the instruction cache is flushed.
1401			 */
1402			if (textrel)
1403				iflush_range((caddr_t)roffset, 0x4);
1404		}
1405
1406		if ((ret == 0) &&
1407		    ((LIST(lmp)->lm_flags & LML_FLG_TRC_WARN) == 0))
1408			break;
1409
1410		if (binfo) {
1411			DBG_CALL(Dbg_bind_global(lmp, (Addr)roffset,
1412			    (Off)(roffset - basebgn), pltndx, pbtype,
1413			    _lmp, (Addr)value, symdef->st_value, name, binfo));
1414		}
1415	}
1416
1417	/*
1418	 * Free up any items on the pltpadlist if it was allocated
1419	 */
1420	if (pltpadlist.head) {
1421		Listnode *	lnp;
1422		Listnode *	plnp;
1423		Pltpadinfo *	pip;
1424
1425		plnp = 0;
1426		for (LIST_TRAVERSE(&pltpadlist, lnp, pip)) {
1427			if (plnp != 0)
1428				free(plnp);
1429			free(pip);
1430			plnp = lnp;
1431		}
1432		if (plnp != 0)
1433			free(plnp);
1434	}
1435
1436	return (relocate_finish(lmp, bound, textrel, ret));
1437}
1438
1439/*
1440 * Provide a machine specific interface to the conversion routine.  By calling
1441 * the machine specific version, rather than the generic version, we insure that
1442 * the data tables/strings for all known machine versions aren't dragged into
1443 * ld.so.1.
1444 */
1445const char *
1446_conv_reloc_type(uint_t rel)
1447{
1448	static Conv_inv_buf_t	inv_buf;
1449
1450	return (conv_reloc_SPARC_type(rel, 0, &inv_buf));
1451}
1452