Home | History | Annotate | Download | only in sparcv9
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 
     22 /*
     23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
     24  * Use is subject to license terms.
     25  */
     26 
     27 /*
     28  * SPARC V9 machine dependent and ELF file class dependent functions.
     29  * Contains routines for performing function binding and symbol relocations.
     30  */
     31 
     32 #include	<stdio.h>
     33 #include	<sys/elf.h>
     34 #include	<sys/elf_SPARC.h>
     35 #include	<sys/mman.h>
     36 #include	<dlfcn.h>
     37 #include	<synch.h>
     38 #include	<string.h>
     39 #include	<debug.h>
     40 #include	<reloc.h>
     41 #include	<conv.h>
     42 #include	"_rtld.h"
     43 #include	"_audit.h"
     44 #include	"_elf.h"
     45 #include	"_inline.h"
     46 #include	"msg.h"
     47 
     48 extern void	iflush_range(caddr_t, size_t);
     49 extern void	plt_upper_32(uintptr_t, uintptr_t);
     50 extern void	plt_upper_44(uintptr_t, uintptr_t);
     51 extern void	plt_full_range(uintptr_t, uintptr_t);
     52 extern void	elf_rtbndr(Rt_map *, ulong_t, caddr_t);
     53 extern void	elf_rtbndr_far(Rt_map *, ulong_t, caddr_t);
     54 
     55 int
     56 elf_mach_flags_check(Rej_desc *rej, Ehdr *ehdr)
     57 {
     58 	/*
     59 	 * Check machine type and flags.
     60 	 */
     61 	if (ehdr->e_flags & EF_SPARC_EXT_MASK) {
     62 		/*
     63 		 * Check vendor-specific extensions.
     64 		 */
     65 		if (ehdr->e_flags & EF_SPARC_HAL_R1) {
     66 			rej->rej_type = SGS_REJ_HAL;
     67 			rej->rej_info = (uint_t)ehdr->e_flags;
     68 			return (0);
     69 		}
     70 		if ((ehdr->e_flags & EF_SPARC_SUN_US3) & ~at_flags) {
     71 			rej->rej_type = SGS_REJ_US3;
     72 			rej->rej_info = (uint_t)ehdr->e_flags;
     73 			return (0);
     74 		}
     75 
     76 		/*
     77 		 * Generic check.
     78 		 * All of our 64-bit SPARC's support the US1 (UltraSPARC 1)
     79 		 * instructions so that bit isn't worth checking for explicitly.
     80 		 */
     81 		if ((ehdr->e_flags & EF_SPARC_EXT_MASK) & ~at_flags) {
     82 			rej->rej_type = SGS_REJ_BADFLAG;
     83 			rej->rej_info = (uint_t)ehdr->e_flags;
     84 			return (0);
     85 		}
     86 	} else if ((ehdr->e_flags & ~EF_SPARCV9_MM) != 0) {
     87 		rej->rej_type = SGS_REJ_BADFLAG;
     88 		rej->rej_info = (uint_t)ehdr->e_flags;
     89 		return (0);
     90 	}
     91 	return (1);
     92 }
     93 
     94 
     95 void
     96 ldso_plt_init(Rt_map *lmp)
     97 {
     98 	/*
     99 	 * There is no need to analyze ld.so because we don't map in any of
    100 	 * its dependencies.  However we may map these dependencies in later
    101 	 * (as if ld.so had dlopened them), so initialize the plt and the
    102 	 * permission information.
    103 	 */
    104 	if (PLTGOT(lmp)) {
    105 		Xword pltoff;
    106 
    107 		/*
    108 		 * Install the lm pointer in .PLT2 as per the ABI.
    109 		 */
    110 		pltoff = (2 * M_PLT_ENTSIZE) / M_PLT_INSSIZE;
    111 		elf_plt2_init(PLTGOT(lmp) + pltoff, lmp);
    112 
    113 		/*
    114 		 * The V9 ABI states that the first 32k PLT entries
    115 		 * use .PLT1, with .PLT0 used by the "latter" entries.
    116 		 * We don't currently implement the extendend format,
    117 		 * so install an error handler in .PLT0 to catch anyone
    118 		 * trying to use it.
    119 		 */
    120 		elf_plt_init(PLTGOT(lmp), (caddr_t)elf_rtbndr_far);
    121 
    122 		/*
    123 		 * Initialize .PLT1
    124 		 */
    125 		pltoff = M_PLT_ENTSIZE / M_PLT_INSSIZE;
    126 		elf_plt_init(PLTGOT(lmp) + pltoff, (caddr_t)elf_rtbndr);
    127 	}
    128 }
    129 
    130 /*
    131  * elf_plt_write() will test to see how far away our destination
    132  *	address lies.  If it is close enough that a branch can
    133  *	be used instead of a jmpl - we will fill the plt in with
    134  * 	single branch.  The branches are much quicker then
    135  *	a jmpl instruction - see bug#4356879 for further
    136  *	details.
    137  *
    138  *	NOTE: we pass in both a 'pltaddr' and a 'vpltaddr' since
    139  *		librtld/dldump update PLT's who's physical
    140  *		address is not the same as the 'virtual' runtime
    141  *		address.
    142  */
    143 Pltbindtype
    144 elf_plt_write(uintptr_t addr, uintptr_t vaddr, void *rptr, uintptr_t symval,
    145 	Xword pltndx)
    146 {
    147 	Rela		*rel = (Rela *)rptr;
    148 	uintptr_t	nsym = ~symval;
    149 	uintptr_t	vpltaddr, pltaddr;
    150 	long		disp;
    151 
    152 
    153 	pltaddr = addr + rel->r_offset;
    154 	vpltaddr = vaddr + rel->r_offset;
    155 	disp = symval - vpltaddr - 4;
    156 
    157 	if (pltndx >= (M64_PLT_NEARPLTS - M_PLT_XNumber)) {
    158 		*((Sxword *)pltaddr) = (uintptr_t)symval +
    159 		    (uintptr_t)rel->r_addend - vaddr;
    160 		DBG_CALL(pltcntfar++);
    161 		return (PLT_T_FAR);
    162 	}
    163 
    164 	/*
    165 	 * Test if the destination address is close enough to use
    166 	 * a ba,a... instruction to reach it.
    167 	 */
    168 	if (S_INRANGE(disp, 23) && !(rtld_flags & RT_FL_NOBAPLT)) {
    169 		uint_t		*pltent, bainstr;
    170 		Pltbindtype	rc;
    171 
    172 		pltent = (uint_t *)pltaddr;
    173 
    174 		/*
    175 		 * The
    176 		 *
    177 		 *	ba,a,pt %icc, <dest>
    178 		 *
    179 		 * is the most efficient of the PLT's.  If we
    180 		 * are within +-20 bits - use that branch.
    181 		 */
    182 		if (S_INRANGE(disp, 20)) {
    183 			bainstr = M_BA_A_PT;	/* ba,a,pt %icc,<dest> */
    184 			/* LINTED */
    185 			bainstr |= (uint_t)(S_MASK(19) & (disp >> 2));
    186 			rc = PLT_T_21D;
    187 			DBG_CALL(pltcnt21d++);
    188 		} else {
    189 			/*
    190 			 * Otherwise - we fall back to the good old
    191 			 *
    192 			 *	ba,a	<dest>
    193 			 *
    194 			 * Which still beats a jmpl instruction.
    195 			 */
    196 			bainstr = M_BA_A;		/* ba,a <dest> */
    197 			/* LINTED */
    198 			bainstr |= (uint_t)(S_MASK(22) & (disp >> 2));
    199 			rc = PLT_T_24D;
    200 			DBG_CALL(pltcnt24d++);
    201 		}
    202 
    203 		pltent[2] = M_NOP;		/* nop instr */
    204 		pltent[1] = bainstr;
    205 
    206 		iflush_range((char *)(&pltent[1]), 4);
    207 		pltent[0] = M_NOP;		/* nop instr */
    208 		iflush_range((char *)(&pltent[0]), 4);
    209 		return (rc);
    210 	}
    211 
    212 	if ((nsym >> 32) == 0) {
    213 		plt_upper_32(pltaddr, symval);
    214 		DBG_CALL(pltcntu32++);
    215 		return (PLT_T_U32);
    216 	}
    217 
    218 	if ((nsym >> 44) == 0) {
    219 		plt_upper_44(pltaddr, symval);
    220 		DBG_CALL(pltcntu44++);
    221 		return (PLT_T_U44);
    222 	}
    223 
    224 	/*
    225 	 * The PLT destination is not in reach of
    226 	 * a branch instruction - so we fall back
    227 	 * to a 'jmpl' sequence.
    228 	 */
    229 	plt_full_range(pltaddr, symval);
    230 	DBG_CALL(pltcntfull++);
    231 	return (PLT_T_FULL);
    232 }
    233 
    234 /*
    235  * Once relocated, the following 6 instruction sequence moves
    236  * a 64-bit immediate value into register %g1
    237  */
    238 #define	VAL64_TO_G1 \
    239 /* 0x00 */	0x0b, 0x00, 0x00, 0x00,	/* sethi %hh(value), %g5 */ \
    240 /* 0x04 */	0x8a, 0x11, 0x60, 0x00,	/* or %g5, %hm(value), %g5 */ \
    241 /* 0x08 */	0x8b, 0x29, 0x70, 0x20,	/* sllx %g5, 32, %g5 */ \
    242 /* 0x0c */	0x03, 0x00, 0x00, 0x00,	/* sethi %lm(value), %g1 */ \
    243 /* 0x10 */	0x82, 0x10, 0x60, 0x00,	/* or %g1, %lo(value), %g1 */ \
    244 /* 0x14 */	0x82, 0x10, 0x40, 0x05	/* or %g1, %g5, %g1 */
    245 
    246 /*
    247  * Local storage space created on the stack created for this glue
    248  * code includes space for:
    249  *		0x8	pointer to dyn_data
    250  *		0x8	size prev stack frame
    251  */
    252 static const Byte dyn_plt_template[] = {
    253 /* 0x0 */	0x2a, 0xcf, 0x80, 0x03,	/* brnz,a,pt %fp, 0xc	*/
    254 /* 0x4 */	0x82, 0x27, 0x80, 0x0e,	/* sub %fp, %sp, %g1 */
    255 /* 0x8 */	0x82, 0x10, 0x20, 0xb0,	/* mov 176, %g1	*/
    256 /* 0xc */	0x9d, 0xe3, 0xbf, 0x40,	/* save %sp, -192, %sp	*/
    257 /* 0x10 */	0xc2, 0x77, 0xa7, 0xef,	/* stx %g1, [%fp + 2031] */
    258 
    259 					/* store prev stack size */
    260 /* 0x14 */	VAL64_TO_G1,		/* dyn_data to g1 */
    261 /* 0x2c */	0xc2, 0x77, 0xa7, 0xf7,	/* stx %g1, [%fp + 2039] */
    262 
    263 /* 0x30 */	VAL64_TO_G1,		/* elf_plt_trace() addr to g1 */
    264 
    265 					/* Call to elf_plt_trace() via g1 */
    266 /* 0x48 */	0x9f, 0xc0, 0x60, 0x00,	/* jmpl ! link r[15] to addr in g1 */
    267 /* 0x4c */	0x01, 0x00, 0x00, 0x00	/* nop ! for jmpl delay slot *AND* */
    268 					/*	to get 8-byte alignment */
    269 };
    270 
    271 int	dyn_plt_ent_size = sizeof (dyn_plt_template) +
    272 		sizeof (Addr) +		/* reflmp */
    273 		sizeof (Addr) +		/* deflmp */
    274 		sizeof (Word) +		/* symndx */
    275 		sizeof (Word) +		/* sb_flags */
    276 		sizeof (Sym);		/* symdef */
    277 
    278 /*
    279  * the dynamic plt entry is:
    280  *
    281  *	brnz,a,pt	%fp, 1f
    282  *	sub     	%sp, %fp, %g1
    283  *	mov     	SA(MINFRAME), %g1
    284  * 1:
    285  *	save    	%sp, -(SA(MINFRAME) + (2 * CLONGSIZE)), %sp
    286  *
    287  *	! store prev stack size
    288  *	stx     	%g1, [%fp + STACK_BIAS - (2 * CLONGSIZE)]
    289  *
    290  * 2:
    291  *	! move dyn_data to %g1
    292  *	sethi   	%hh(dyn_data), %g5
    293  *	or      	%g5, %hm(dyn_data), %g5
    294  *	sllx    	%g5, 32, %g5
    295  *	sethi   	%lm(dyn_data), %g1
    296  *	or      	%g1, %lo(dyn_data), %g1
    297  *	or      	%g1, %g5, %g1
    298  *
    299  *	! store dyn_data ptr on frame (from %g1)
    300  *	 stx     	%g1, [%fp + STACK_BIAS - CLONGSIZE]
    301  *
    302  *	! Move address of elf_plt_trace() into %g1
    303  *	[Uses same 6 instructions as shown at label 2: above. Not shown.]
    304  *
    305  *	! Use JMPL to make call. CALL instruction is limited to 30-bits.
    306  *	! of displacement.
    307  *	jmp1		%g1, %o7
    308  *
    309  *	! JMPL has a delay slot that must be filled. And, the sequence
    310  *	! of instructions needs to have 8-byte alignment. This NOP does both.
    311  *	! The alignment is needed for the data we put following the
    312  *	! instruction.
    313  *	nop
    314  *
    315  * dyn data:
    316  *	Addr		reflmp
    317  *	Addr		deflmp
    318  *	Word		symndx
    319  *	Word		sb_flags
    320  *	Sym		symdef  (Elf64_Sym = 24-bytes)
    321  */
    322 
    323 /*
    324  * Relocate the instructions given by the VAL64_TO_G1 macro above.
    325  * The arguments parallel those of do_reloc_rtld().
    326  *
    327  * entry:
    328  *	off - Address of 1st instruction in sequence.
    329  *	value - Value being relocated (addend)
    330  *	sym - Name of value being relocated.
    331  *	lml - link map list
    332  *
    333  * exit:
    334  *	Returns TRUE for success, FALSE for failure.
    335  */
    336 static int
    337 reloc_val64_to_g1(uchar_t *off, Addr *value, const char *sym, Lm_list *lml)
    338 {
    339 	Xword	tmp_value;
    340 
    341 	/*
    342 	 * relocating:
    343 	 *	sethi	%hh(value), %g5
    344 	 */
    345 	tmp_value = (Xword)value;
    346 	if (do_reloc_rtld(R_SPARC_HH22, off, &tmp_value, sym,
    347 	    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
    348 		return (0);
    349 	}
    350 
    351 	/*
    352 	 * relocating:
    353 	 *	or	%g5, %hm(value), %g5
    354 	 */
    355 	tmp_value = (Xword)value;
    356 	if (do_reloc_rtld(R_SPARC_HM10, off + 4, &tmp_value, sym,
    357 	    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
    358 		return (0);
    359 	}
    360 
    361 	/*
    362 	 * relocating:
    363 	 *	sethi	%lm(value), %g1
    364 	 */
    365 	tmp_value = (Xword)value;
    366 	if (do_reloc_rtld(R_SPARC_LM22, off + 12, &tmp_value, sym,
    367 	    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
    368 		return (0);
    369 	}
    370 
    371 	/*
    372 	 * relocating:
    373 	 *	or	%g1, %lo(value), %g1
    374 	 */
    375 	tmp_value = (Xword)value;
    376 	if (do_reloc_rtld(R_SPARC_LO10, off + 16, &tmp_value, sym,
    377 	    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
    378 		return (0);
    379 	}
    380 
    381 	return (1);
    382 }
    383 
    384 static caddr_t
    385 elf_plt_trace_write(caddr_t addr, Rela *rptr, Rt_map *rlmp, Rt_map *dlmp,
    386     Sym *sym, uint_t symndx, ulong_t pltndx, caddr_t to, uint_t sb_flags,
    387     int *fail)
    388 {
    389 	extern ulong_t	elf_plt_trace();
    390 	uchar_t		*dyn_plt;
    391 	uintptr_t	*dyndata;
    392 
    393 	/*
    394 	 * If both pltenter & pltexit have been disabled there
    395 	 * there is no reason to even create the glue code.
    396 	 */
    397 	if ((sb_flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)) ==
    398 	    (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)) {
    399 		(void) elf_plt_write((uintptr_t)addr, (uintptr_t)addr,
    400 		    rptr, (uintptr_t)to, pltndx);
    401 		return (to);
    402 	}
    403 
    404 	/*
    405 	 * We only need to add the glue code if there is an auditing
    406 	 * library that is interested in this binding.
    407 	 */
    408 	dyn_plt = (uchar_t *)((uintptr_t)AUDINFO(rlmp)->ai_dynplts +
    409 	    (pltndx * dyn_plt_ent_size));
    410 
    411 	/*
    412 	 * Have we initialized this dynamic plt entry yet?  If we haven't do it
    413 	 * now.  Otherwise this function has been called before, but from a
    414 	 * different plt (ie. from another shared object).  In that case
    415 	 * we just set the plt to point to the new dyn_plt.
    416 	 */
    417 	if (*dyn_plt == 0) {
    418 		Sym	*symp;
    419 		Lm_list	*lml = LIST(rlmp);
    420 
    421 		(void) memcpy((void *)dyn_plt, dyn_plt_template,
    422 		    sizeof (dyn_plt_template));
    423 		dyndata = (uintptr_t *)((uintptr_t)dyn_plt +
    424 		    sizeof (dyn_plt_template));
    425 
    426 		/*
    427 		 * relocating:
    428 		 *	VAL64_TO_G1(dyndata)
    429 		 *	VAL64_TO_G1(&elf_plt_trace)
    430 		 */
    431 		if (!(reloc_val64_to_g1((dyn_plt + 0x14), dyndata,
    432 		    MSG_ORIG(MSG_SYM_LADYNDATA), lml) &&
    433 		    reloc_val64_to_g1((dyn_plt + 0x30), (Addr *)&elf_plt_trace,
    434 		    MSG_ORIG(MSG_SYM_ELFPLTTRACE), lml))) {
    435 			*fail = 1;
    436 			return (0);
    437 		}
    438 
    439 		*dyndata++ = (Addr)rlmp;
    440 		*dyndata++ = (Addr)dlmp;
    441 
    442 		/*
    443 		 * symndx in the high word, sb_flags in the low.
    444 		 */
    445 		*dyndata = (Addr)sb_flags;
    446 		*(Word *)dyndata = symndx;
    447 		dyndata++;
    448 
    449 		symp = (Sym *)dyndata;
    450 		*symp = *sym;
    451 		symp->st_value = (Addr)to;
    452 		iflush_range((void *)dyn_plt, sizeof (dyn_plt_template));
    453 	}
    454 
    455 	(void) elf_plt_write((uintptr_t)addr, (uintptr_t)addr, rptr,
    456 	    (uintptr_t)dyn_plt, pltndx);
    457 	return ((caddr_t)dyn_plt);
    458 }
    459 
    460 /*
    461  * Function binding routine - invoked on the first call to a function through
    462  * the procedure linkage table;
    463  * passes first through an assembly language interface.
    464  *
    465  * Takes the address of the PLT entry where the call originated,
    466  * the offset into the relocation table of the associated
    467  * relocation entry and the address of the link map (rt_private_map struct)
    468  * for the entry.
    469  *
    470  * Returns the address of the function referenced after re-writing the PLT
    471  * entry to invoke the function directly.
    472  *
    473  * On error, causes process to terminate with a signal.
    474  */
    475 ulong_t
    476 elf_bndr(Rt_map *lmp, ulong_t pltoff, caddr_t from)
    477 {
    478 	Rt_map		*nlmp, *llmp;
    479 	Addr		addr, vaddr, reloff, symval;
    480 	char		*name;
    481 	Rela		*rptr;
    482 	Sym		*rsym, *nsym;
    483 	Xword		pltndx;
    484 	uint_t		binfo, sb_flags = 0, dbg_class;
    485 	ulong_t		rsymndx;
    486 	Slookup		sl;
    487 	Pltbindtype	pbtype;
    488 	int		entry, lmflags, farplt = 0;
    489 	Lm_list		*lml;
    490 
    491 	/*
    492 	 * For compatibility with libthread (TI_VERSION 1) we track the entry
    493 	 * value.  A zero value indicates we have recursed into ld.so.1 to
    494 	 * further process a locking request.  Under this recursion we disable
    495 	 * tsort and cleanup activities.
    496 	 */
    497 	entry = enter(0);
    498 
    499 	lml = LIST(lmp);
    500 	if ((lmflags = lml->lm_flags) & LML_FLG_RTLDLM) {
    501 		dbg_class = dbg_desc->d_class;
    502 		dbg_desc->d_class = 0;
    503 	}
    504 
    505 	/*
    506 	 * Must calculate true plt relocation address from reloc.
    507 	 * Take offset, subtract number of reserved PLT entries, and divide
    508 	 * by PLT entry size, which should give the index of the plt
    509 	 * entry (and relocation entry since they have been defined to be
    510 	 * in the same order).  Then we must multiply by the size of
    511 	 * a relocation entry, which will give us the offset of the
    512 	 * plt relocation entry from the start of them given by JMPREL(lm).
    513 	 */
    514 	addr = pltoff - M_PLT_RESERVSZ;
    515 
    516 	if (pltoff < (M64_PLT_NEARPLTS * M_PLT_ENTSIZE)) {
    517 		pltndx = addr / M_PLT_ENTSIZE;
    518 	} else {
    519 		ulong_t	pltblockoff;
    520 
    521 		pltblockoff = pltoff - (M64_PLT_NEARPLTS * M_PLT_ENTSIZE);
    522 		pltndx = M64_PLT_NEARPLTS +
    523 		    ((pltblockoff / M64_PLT_FBLOCKSZ) * M64_PLT_FBLKCNTS) +
    524 		    ((pltblockoff % M64_PLT_FBLOCKSZ) / M64_PLT_FENTSIZE) -
    525 		    M_PLT_XNumber;
    526 		farplt = 1;
    527 	}
    528 
    529 	/*
    530 	 * Perform some basic sanity checks.  If we didn't get a load map
    531 	 * or the plt offset is invalid then its possible someone has walked
    532 	 * over the plt entries or jumped to plt[01] out of the blue.
    533 	 */
    534 	if (!lmp || (!farplt && (addr % M_PLT_ENTSIZE) != 0) ||
    535 	    (farplt && (addr % M_PLT_INSSIZE))) {
    536 		Conv_inv_buf_t	inv_buf;
    537 
    538 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_PLTREF),
    539 		    conv_reloc_SPARC_type(R_SPARC_JMP_SLOT, 0, &inv_buf),
    540 		    EC_NATPTR(lmp), EC_XWORD(pltoff), EC_NATPTR(from));
    541 		rtldexit(lml, 1);
    542 	}
    543 	reloff = pltndx * sizeof (Rela);
    544 
    545 	/*
    546 	 * Use relocation entry to get symbol table entry and symbol name.
    547 	 */
    548 	addr = (ulong_t)JMPREL(lmp);
    549 	rptr = (Rela *)(addr + reloff);
    550 	rsymndx = ELF_R_SYM(rptr->r_info);
    551 	rsym = (Sym *)((ulong_t)SYMTAB(lmp) + (rsymndx * SYMENT(lmp)));
    552 	name = (char *)(STRTAB(lmp) + rsym->st_name);
    553 
    554 	/*
    555 	 * Determine the last link-map of this list, this'll be the starting
    556 	 * point for any tsort() processing.
    557 	 */
    558 	llmp = lml->lm_tail;
    559 
    560 	/*
    561 	 * Find definition for symbol.  Initialize the symbol lookup data
    562 	 * structure.
    563 	 */
    564 	SLOOKUP_INIT(sl, name, lmp, lml->lm_head, ld_entry_cnt, 0,
    565 	    rsymndx, rsym, 0, LKUP_DEFT);
    566 
    567 	if ((nsym = lookup_sym(&sl, &nlmp, &binfo, NULL)) == 0) {
    568 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_NOSYM), NAME(lmp),
    569 		    demangle(name));
    570 		rtldexit(lml, 1);
    571 	}
    572 
    573 	symval = nsym->st_value;
    574 	if (!(FLAGS(nlmp) & FLG_RT_FIXED) &&
    575 	    (nsym->st_shndx != SHN_ABS))
    576 		symval += ADDR(nlmp);
    577 	if ((lmp != nlmp) && ((FLAGS1(nlmp) & FL1_RT_NOINIFIN) == 0)) {
    578 		/*
    579 		 * Record that this new link map is now bound to the caller.
    580 		 */
    581 		if (bind_one(lmp, nlmp, BND_REFER) == 0)
    582 			rtldexit(lml, 1);
    583 	}
    584 
    585 	if ((lml->lm_tflags | AFLAGS(lmp)) & LML_TFLG_AUD_SYMBIND) {
    586 		/* LINTED */
    587 		uint_t	symndx = (uint_t)(((uintptr_t)nsym -
    588 		    (uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp));
    589 
    590 		symval = audit_symbind(lmp, nlmp, nsym, symndx, symval,
    591 		    &sb_flags);
    592 	}
    593 
    594 	if (FLAGS(lmp) & FLG_RT_FIXED)
    595 		vaddr = 0;
    596 	else
    597 		vaddr = ADDR(lmp);
    598 
    599 	pbtype = PLT_T_NONE;
    600 	if (!(rtld_flags & RT_FL_NOBIND)) {
    601 		if (((lml->lm_tflags | AFLAGS(lmp)) &
    602 		    (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) &&
    603 		    AUDINFO(lmp)->ai_dynplts) {
    604 			int	fail = 0;
    605 			/* LINTED */
    606 			uint_t	symndx = (uint_t)(((uintptr_t)nsym -
    607 			    (uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp));
    608 
    609 			symval = (ulong_t)elf_plt_trace_write((caddr_t)vaddr,
    610 			    rptr, lmp, nlmp, nsym, symndx, pltndx,
    611 			    (caddr_t)symval, sb_flags, &fail);
    612 			if (fail)
    613 				rtldexit(lml, 1);
    614 		} else {
    615 			/*
    616 			 * Write standard PLT entry to jump directly
    617 			 * to newly bound function.
    618 			 */
    619 			pbtype = elf_plt_write((uintptr_t)vaddr,
    620 			    (uintptr_t)vaddr, rptr, symval, pltndx);
    621 		}
    622 	}
    623 
    624 	/*
    625 	 * Print binding information and rebuild PLT entry.
    626 	 */
    627 	DBG_CALL(Dbg_bind_global(lmp, (Addr)from, (Off)(from - ADDR(lmp)),
    628 	    (Xword)pltndx, pbtype, nlmp, (Addr)symval, nsym->st_value,
    629 	    name, binfo));
    630 
    631 	/*
    632 	 * Complete any processing for newly loaded objects.  Note we don't
    633 	 * know exactly where any new objects are loaded (we know the object
    634 	 * that supplied the symbol, but others may have been loaded lazily as
    635 	 * we searched for the symbol), so sorting starts from the last
    636 	 * link-map know on entry to this routine.
    637 	 */
    638 	if (entry)
    639 		load_completion(llmp);
    640 
    641 	/*
    642 	 * Some operations like dldump() or dlopen()'ing a relocatable object
    643 	 * result in objects being loaded on rtld's link-map, make sure these
    644 	 * objects are initialized also.
    645 	 */
    646 	if ((LIST(nlmp)->lm_flags & LML_FLG_RTLDLM) && LIST(nlmp)->lm_init)
    647 		load_completion(nlmp);
    648 
    649 	/*
    650 	 * Make sure the object to which we've bound has had it's .init fired.
    651 	 * Cleanup before return to user code.
    652 	 */
    653 	if (entry) {
    654 		is_dep_init(nlmp, lmp);
    655 		leave(lml, 0);
    656 	}
    657 
    658 	if (lmflags & LML_FLG_RTLDLM)
    659 		dbg_desc->d_class = dbg_class;
    660 
    661 	return (symval);
    662 }
    663 
    664 static int
    665 bindpltpad(Rt_map *lmp, Alist **padlist, Addr value, void **pltaddr,
    666     const char *fname, const char *sname)
    667 {
    668 	Aliste		idx = 0;
    669 	Pltpadinfo	ppi, *ppip;
    670 	void		*plt;
    671 	uintptr_t	pltoff;
    672 	Rela		rel;
    673 	int		i;
    674 
    675 	for (ALIST_TRAVERSE(*padlist, idx, ppip)) {
    676 		if (ppip->pp_addr == value) {
    677 			*pltaddr = ppip->pp_plt;
    678 			DBG_CALL(Dbg_bind_pltpad_from(lmp, (Addr)*pltaddr,
    679 			    sname));
    680 			return (1);
    681 		}
    682 		if (ppip->pp_addr > value)
    683 			break;
    684 	}
    685 
    686 	plt = PLTPAD(lmp);
    687 	pltoff = (uintptr_t)plt - (uintptr_t)ADDR(lmp);
    688 
    689 	PLTPAD(lmp) = (void *)((uintptr_t)PLTPAD(lmp) + M_PLT_ENTSIZE);
    690 
    691 	if (PLTPAD(lmp) > PLTPADEND(lmp)) {
    692 		/*
    693 		 * Just fail in usual relocation way
    694 		 */
    695 		*pltaddr = (void *)value;
    696 		return (1);
    697 	}
    698 	rel.r_offset = pltoff;
    699 	rel.r_info = 0;
    700 	rel.r_addend = 0;
    701 
    702 	/*
    703 	 * elf_plt_write assumes the plt was previously filled
    704 	 * with NOP's, so fill it in now.
    705 	 */
    706 	for (i = 0; i < (M_PLT_ENTSIZE / sizeof (uint_t)); i++) {
    707 		((uint_t *)plt)[i] = M_NOP;
    708 	}
    709 	iflush_range((caddr_t)plt, M_PLT_ENTSIZE);
    710 
    711 	(void) elf_plt_write(ADDR(lmp), ADDR(lmp), &rel, value, 0);
    712 
    713 	ppi.pp_addr = value;
    714 	ppi.pp_plt = plt;
    715 
    716 	if (alist_insert(padlist, &ppi, sizeof (Pltpadinfo),
    717 	    AL_CNT_PLTPAD, idx) == NULL)
    718 		return (0);
    719 
    720 	*pltaddr = plt;
    721 	DBG_CALL(Dbg_bind_pltpad_to(lmp, (Addr)*pltaddr, fname, sname));
    722 	return (1);
    723 }
    724 
    725 /*
    726  * Read and process the relocations for one link object, we assume all
    727  * relocation sections for loadable segments are stored contiguously in
    728  * the file.
    729  */
    730 int
    731 elf_reloc(Rt_map *lmp, uint_t plt, int *in_nfavl, APlist **textrel)
    732 {
    733 	ulong_t		relbgn, relend, relsiz, basebgn, pltbgn, pltend;
    734 	ulong_t		pltndx, roffset, rsymndx, psymndx = 0;
    735 	uint_t		dsymndx, binfo, pbinfo;
    736 	Byte		rtype;
    737 	long		reladd;
    738 	Addr		value, pvalue;
    739 	Sym		*symref, *psymref, *symdef, *psymdef;
    740 	char		*name, *pname;
    741 	Rt_map		*_lmp, *plmp;
    742 	int		ret = 1, noplt = 0;
    743 	long		relacount = RELACOUNT(lmp);
    744 	Rela		*rel;
    745 	Pltbindtype	pbtype;
    746 	Alist		*pltpadlist = NULL;
    747 	APlist		*bound = NULL;
    748 
    749 	/*
    750 	 * If an object has any DT_REGISTER entries associated with
    751 	 * it, they are processed now.
    752 	 */
    753 	if ((plt == 0) && (FLAGS(lmp) & FLG_RT_REGSYMS)) {
    754 		if (elf_regsyms(lmp) == 0)
    755 			return (0);
    756 	}
    757 
    758 	/*
    759 	 * Although only necessary for lazy binding, initialize the first
    760 	 * procedure linkage table entry to go to elf_rtbndr().  dbx(1) seems
    761 	 * to find this useful.
    762 	 */
    763 	if ((plt == 0) && PLTGOT(lmp)) {
    764 		mmapobj_result_t	*mpp;
    765 		Xword			pltoff;
    766 
    767 		/*
    768 		 * Make sure the segment is writable.
    769 		 */
    770 		if ((((mpp =
    771 		    find_segment((caddr_t)PLTGOT(lmp), lmp)) != NULL) &&
    772 		    ((mpp->mr_prot & PROT_WRITE) == 0)) &&
    773 		    ((set_prot(lmp, mpp, 1) == 0) ||
    774 		    (aplist_append(textrel, mpp, AL_CNT_TEXTREL) == NULL)))
    775 			return (0);
    776 
    777 		/*
    778 		 * Install the lm pointer in .PLT2 as per the ABI.
    779 		 */
    780 		pltoff = (2 * M_PLT_ENTSIZE) / M_PLT_INSSIZE;
    781 		elf_plt2_init(PLTGOT(lmp) + pltoff, lmp);
    782 
    783 		/*
    784 		 * The V9 ABI states that the first 32k PLT entries
    785 		 * use .PLT1, with .PLT0 used by the "latter" entries.
    786 		 * We don't currently implement the extendend format,
    787 		 * so install an error handler in .PLT0 to catch anyone
    788 		 * trying to use it.
    789 		 */
    790 		elf_plt_init(PLTGOT(lmp), (caddr_t)elf_rtbndr_far);
    791 
    792 		/*
    793 		 * Initialize .PLT1
    794 		 */
    795 		pltoff = M_PLT_ENTSIZE / M_PLT_INSSIZE;
    796 		elf_plt_init(PLTGOT(lmp) + pltoff, (caddr_t)elf_rtbndr);
    797 	}
    798 
    799 	/*
    800 	 * Initialize the plt start and end addresses.
    801 	 */
    802 	if ((pltbgn = (ulong_t)JMPREL(lmp)) != 0)
    803 		pltend = pltbgn + (ulong_t)(PLTRELSZ(lmp));
    804 
    805 	/*
    806 	 * If we've been called upon to promote an RTLD_LAZY object to an
    807 	 * RTLD_NOW then we're only interested in scaning the .plt table.
    808 	 */
    809 	if (plt) {
    810 		relbgn = pltbgn;
    811 		relend = pltend;
    812 	} else {
    813 		/*
    814 		 * The relocation sections appear to the run-time linker as a
    815 		 * single table.  Determine the address of the beginning and end
    816 		 * of this table.  There are two different interpretations of
    817 		 * the ABI at this point:
    818 		 *
    819 		 *   o	The REL table and its associated RELSZ indicate the
    820 		 *	concatenation of *all* relocation sections (this is the
    821 		 *	model our link-editor constructs).
    822 		 *
    823 		 *   o	The REL table and its associated RELSZ indicate the
    824 		 *	concatenation of all *but* the .plt relocations.  These
    825 		 *	relocations are specified individually by the JMPREL and
    826 		 *	PLTRELSZ entries.
    827 		 *
    828 		 * Determine from our knowledege of the relocation range and
    829 		 * .plt range, the range of the total relocation table.  Note
    830 		 * that one other ABI assumption seems to be that the .plt
    831 		 * relocations always follow any other relocations, the
    832 		 * following range checking drops that assumption.
    833 		 */
    834 		relbgn = (ulong_t)(REL(lmp));
    835 		relend = relbgn + (ulong_t)(RELSZ(lmp));
    836 		if (pltbgn) {
    837 			if (!relbgn || (relbgn > pltbgn))
    838 				relbgn = pltbgn;
    839 			if (!relbgn || (relend < pltend))
    840 				relend = pltend;
    841 		}
    842 	}
    843 	if (!relbgn || (relbgn == relend)) {
    844 		DBG_CALL(Dbg_reloc_run(lmp, 0, plt, DBG_REL_NONE));
    845 		return (1);
    846 	}
    847 
    848 	relsiz = (ulong_t)(RELENT(lmp));
    849 	basebgn = ADDR(lmp);
    850 
    851 	DBG_CALL(Dbg_reloc_run(lmp, M_REL_SHT_TYPE, plt, DBG_REL_START));
    852 
    853 	/*
    854 	 * If we're processing in lazy mode there is no need to scan the
    855 	 * .rela.plt table.
    856 	 */
    857 	if (pltbgn && ((MODE(lmp) & RTLD_NOW) == 0))
    858 		noplt = 1;
    859 
    860 	/*
    861 	 * Loop through relocations.
    862 	 */
    863 	while (relbgn < relend) {
    864 		mmapobj_result_t	*mpp;
    865 		uint_t			sb_flags = 0;
    866 		Addr			vaddr;
    867 
    868 		rtype = (Byte)ELF_R_TYPE(((Rela *)relbgn)->r_info, M_MACH);
    869 
    870 		/*
    871 		 * If this is a RELATIVE relocation in a shared object
    872 		 * (the common case), and if we are not debugging, then
    873 		 * jump into a tighter relocaiton loop (elf_reloc_relacount)
    874 		 * Only make the jump if we've been given a hint on the
    875 		 * number of relocations.
    876 		 */
    877 		if ((rtype == R_SPARC_RELATIVE) &&
    878 		    ((FLAGS(lmp) & FLG_RT_FIXED) == 0) && (DBG_ENABLED == 0)) {
    879 			if (relacount) {
    880 				relbgn = elf_reloc_relative_count(relbgn,
    881 				    relacount, relsiz, basebgn, lmp, textrel);
    882 				relacount = 0;
    883 			} else {
    884 				relbgn = elf_reloc_relative(relbgn, relend,
    885 				    relsiz, basebgn, lmp, textrel);
    886 			}
    887 			if (relbgn >= relend)
    888 				break;
    889 			rtype = (Byte)ELF_R_TYPE(((Rela *)relbgn)->r_info,
    890 			    M_MACH);
    891 		}
    892 
    893 		roffset = ((Rela *)relbgn)->r_offset;
    894 
    895 		reladd = (long)(((Rela *)relbgn)->r_addend);
    896 		rsymndx = ELF_R_SYM(((Rela *)relbgn)->r_info);
    897 
    898 		rel = (Rela *)relbgn;
    899 		relbgn += relsiz;
    900 
    901 		/*
    902 		 * Optimizations.
    903 		 */
    904 		if (rtype == R_SPARC_NONE)
    905 			continue;
    906 		if (noplt && ((ulong_t)rel >= pltbgn) &&
    907 		    ((ulong_t)rel < pltend)) {
    908 			relbgn = pltend;
    909 			continue;
    910 		}
    911 
    912 		if (rtype != R_SPARC_REGISTER) {
    913 			/*
    914 			 * If this is a shared object, add the base address
    915 			 * to offset.
    916 			 */
    917 			if (!(FLAGS(lmp) & FLG_RT_FIXED))
    918 				roffset += basebgn;
    919 
    920 			/*
    921 			 * If this relocation is not against part of the image
    922 			 * mapped into memory we skip it.
    923 			 */
    924 			if ((mpp = find_segment((caddr_t)roffset,
    925 			    lmp)) == NULL) {
    926 				elf_reloc_bad(lmp, (void *)rel, rtype, roffset,
    927 				    rsymndx);
    928 				continue;
    929 			}
    930 		}
    931 
    932 		/*
    933 		 * If we're promoting plts, determine if this one has already
    934 		 * been written. An uninitialized plts' second instruction is a
    935 		 * branch.
    936 		 */
    937 		if (plt) {
    938 			uchar_t	*_roffset = (uchar_t *)roffset;
    939 
    940 			_roffset += M_PLT_INSSIZE;
    941 			/* LINTED */
    942 			if ((*(uint_t *)_roffset &
    943 			    (~(S_MASK(19)))) != M_BA_A_XCC)
    944 				continue;
    945 		}
    946 
    947 		binfo = 0;
    948 		pltndx = (ulong_t)-1;
    949 		pbtype = PLT_T_NONE;
    950 
    951 		/*
    952 		 * If a symbol index is specified then get the symbol table
    953 		 * entry, locate the symbol definition, and determine its
    954 		 * address.
    955 		 */
    956 		if (rsymndx) {
    957 			/*
    958 			 * Get the local symbol table entry.
    959 			 */
    960 			symref = (Sym *)((ulong_t)SYMTAB(lmp) +
    961 			    (rsymndx * SYMENT(lmp)));
    962 
    963 			/*
    964 			 * If this is a local symbol, just use the base address.
    965 			 * (we should have no local relocations in the
    966 			 * executable).
    967 			 */
    968 			if (ELF_ST_BIND(symref->st_info) == STB_LOCAL) {
    969 				value = basebgn;
    970 				name = (char *)0;
    971 
    972 				/*
    973 				 * Special case TLS relocations.
    974 				 */
    975 				if ((rtype == R_SPARC_TLS_DTPMOD32) ||
    976 				    (rtype == R_SPARC_TLS_DTPMOD64)) {
    977 					/*
    978 					 * Use the TLS modid.
    979 					 */
    980 					value = TLSMODID(lmp);
    981 
    982 				} else if ((rtype == R_SPARC_TLS_TPOFF32) ||
    983 				    (rtype == R_SPARC_TLS_TPOFF64)) {
    984 					if ((value = elf_static_tls(lmp, symref,
    985 					    rel, rtype, 0, roffset, 0)) == 0) {
    986 						ret = 0;
    987 						break;
    988 					}
    989 				}
    990 			} else {
    991 				/*
    992 				 * If the symbol index is equal to the previous
    993 				 * symbol index relocation we processed then
    994 				 * reuse the previous values. (Note that there
    995 				 * have been cases where a relocation exists
    996 				 * against a copy relocation symbol, our ld(1)
    997 				 * should optimize this away, but make sure we
    998 				 * don't use the same symbol information should
    999 				 * this case exist).
   1000 				 */
   1001 				if ((rsymndx == psymndx) &&
   1002 				    (rtype != R_SPARC_COPY)) {
   1003 					/* LINTED */
   1004 					if (psymdef == 0) {
   1005 						DBG_CALL(Dbg_bind_weak(lmp,
   1006 						    (Addr)roffset, (Addr)
   1007 						    (roffset - basebgn), name));
   1008 						continue;
   1009 					}
   1010 					/* LINTED */
   1011 					value = pvalue;
   1012 					/* LINTED */
   1013 					name = pname;
   1014 					symdef = psymdef;
   1015 					/* LINTED */
   1016 					symref = psymref;
   1017 					/* LINTED */
   1018 					_lmp = plmp;
   1019 					/* LINTED */
   1020 					binfo = pbinfo;
   1021 
   1022 					if ((LIST(_lmp)->lm_tflags |
   1023 					    AFLAGS(_lmp)) &
   1024 					    LML_TFLG_AUD_SYMBIND) {
   1025 						value = audit_symbind(lmp, _lmp,
   1026 						    /* LINTED */
   1027 						    symdef, dsymndx, value,
   1028 						    &sb_flags);
   1029 					}
   1030 				} else {
   1031 					Slookup		sl;
   1032 
   1033 					/*
   1034 					 * Lookup the symbol definition.
   1035 					 * Initialize the symbol lookup data
   1036 					 * structure.
   1037 					 */
   1038 					name = (char *)(STRTAB(lmp) +
   1039 					    symref->st_name);
   1040 
   1041 					SLOOKUP_INIT(sl, name, lmp, 0,
   1042 					    ld_entry_cnt, 0, rsymndx, symref,
   1043 					    rtype, LKUP_STDRELOC);
   1044 
   1045 					symdef = lookup_sym(&sl, &_lmp,
   1046 					    &binfo, in_nfavl);
   1047 
   1048 					/*
   1049 					 * If the symbol is not found and the
   1050 					 * reference was not to a weak symbol,
   1051 					 * report an error.  Weak references
   1052 					 * may be unresolved.
   1053 					 */
   1054 					/* BEGIN CSTYLED */
   1055 					if (symdef == 0) {
   1056 					    if (sl.sl_bind != STB_WEAK) {
   1057 						if (elf_reloc_error(lmp, name,
   1058 						    rel, binfo))
   1059 							continue;
   1060 
   1061 						ret = 0;
   1062 						break;
   1063 
   1064 					    } else {
   1065 						psymndx = rsymndx;
   1066 						psymdef = 0;
   1067 
   1068 						DBG_CALL(Dbg_bind_weak(lmp,
   1069 						    (Addr)roffset, (Addr)
   1070 						    (roffset - basebgn), name));
   1071 						continue;
   1072 					    }
   1073 					}
   1074 					/* END CSTYLED */
   1075 
   1076 					/*
   1077 					 * If symbol was found in an object
   1078 					 * other than the referencing object
   1079 					 * then record the binding.
   1080 					 */
   1081 					if ((lmp != _lmp) && ((FLAGS1(_lmp) &
   1082 					    FL1_RT_NOINIFIN) == 0)) {
   1083 						if (aplist_test(&bound, _lmp,
   1084 						    AL_CNT_RELBIND) == 0) {
   1085 							ret = 0;
   1086 							break;
   1087 						}
   1088 					}
   1089 
   1090 					/*
   1091 					 * Calculate the location of definition;
   1092 					 * symbol value plus base address of
   1093 					 * containing shared object.
   1094 					 */
   1095 					if (IS_SIZE(rtype))
   1096 						value = symdef->st_size;
   1097 					else
   1098 						value = symdef->st_value;
   1099 
   1100 					if (!(FLAGS(_lmp) & FLG_RT_FIXED) &&
   1101 					    !(IS_SIZE(rtype)) &&
   1102 					    (symdef->st_shndx != SHN_ABS) &&
   1103 					    (ELF_ST_TYPE(symdef->st_info) !=
   1104 					    STT_TLS))
   1105 						value += ADDR(_lmp);
   1106 
   1107 					/*
   1108 					 * Retain this symbol index and the
   1109 					 * value in case it can be used for the
   1110 					 * subsequent relocations.
   1111 					 */
   1112 					if (rtype != R_SPARC_COPY) {
   1113 						psymndx = rsymndx;
   1114 						pvalue = value;
   1115 						pname = name;
   1116 						psymdef = symdef;
   1117 						psymref = symref;
   1118 						plmp = _lmp;
   1119 						pbinfo = binfo;
   1120 					}
   1121 					if ((LIST(_lmp)->lm_tflags |
   1122 					    AFLAGS(_lmp)) &
   1123 					    LML_TFLG_AUD_SYMBIND) {
   1124 						/* LINTED */
   1125 						dsymndx = (((uintptr_t)symdef -
   1126 						    (uintptr_t)SYMTAB(_lmp)) /
   1127 						    SYMENT(_lmp));
   1128 						value = audit_symbind(lmp, _lmp,
   1129 						    symdef, dsymndx, value,
   1130 						    &sb_flags);
   1131 					}
   1132 				}
   1133 
   1134 				/*
   1135 				 * If relocation is PC-relative, subtract
   1136 				 * offset address.
   1137 				 */
   1138 				if (IS_PC_RELATIVE(rtype))
   1139 					value -= roffset;
   1140 
   1141 				/*
   1142 				 * Special case TLS relocations.
   1143 				 */
   1144 				if ((rtype == R_SPARC_TLS_DTPMOD32) ||
   1145 				    (rtype == R_SPARC_TLS_DTPMOD64)) {
   1146 					/*
   1147 					 * Relocation value is the TLS modid.
   1148 					 */
   1149 					value = TLSMODID(_lmp);
   1150 
   1151 				} else if ((rtype == R_SPARC_TLS_TPOFF64) ||
   1152 				    (rtype == R_SPARC_TLS_TPOFF32)) {
   1153 					if ((value = elf_static_tls(_lmp,
   1154 					    symdef, rel, rtype, name, roffset,
   1155 					    value)) == 0) {
   1156 						ret = 0;
   1157 						break;
   1158 					}
   1159 				}
   1160 			}
   1161 		} else {
   1162 			/*
   1163 			 * Special cases.
   1164 			 */
   1165 			if (rtype == R_SPARC_REGISTER) {
   1166 				/*
   1167 				 * A register symbol associated with symbol
   1168 				 * index 0 is initialized (i.e. relocated) to
   1169 				 * a constant in the r_addend field rather than
   1170 				 * to a symbol value.
   1171 				 */
   1172 				value = 0;
   1173 
   1174 			} else if ((rtype == R_SPARC_TLS_DTPMOD32) ||
   1175 			    (rtype == R_SPARC_TLS_DTPMOD64)) {
   1176 				/*
   1177 				 * TLS relocation value is the TLS modid.
   1178 				 */
   1179 				value = TLSMODID(lmp);
   1180 			} else
   1181 				value = basebgn;
   1182 			name = (char *)0;
   1183 		}
   1184 
   1185 		DBG_CALL(Dbg_reloc_in(LIST(lmp), ELF_DBG_RTLD, M_MACH,
   1186 		    M_REL_SHT_TYPE, rel, NULL, 0, name));
   1187 
   1188 		/*
   1189 		 * Make sure the segment is writable.
   1190 		 */
   1191 		if ((rtype != R_SPARC_REGISTER) &&
   1192 		    ((mpp->mr_prot & PROT_WRITE) == 0) &&
   1193 		    ((set_prot(lmp, mpp, 1) == 0) ||
   1194 		    (aplist_append(textrel, mpp, AL_CNT_TEXTREL) == NULL))) {
   1195 			ret = 0;
   1196 			break;
   1197 		}
   1198 
   1199 		/*
   1200 		 * Call relocation routine to perform required relocation.
   1201 		 */
   1202 		switch (rtype) {
   1203 		case R_SPARC_REGISTER:
   1204 			/*
   1205 			 * The v9 ABI 4.2.4 says that system objects may,
   1206 			 * but are not required to, use register symbols
   1207 			 * to inidcate how they use global registers. Thus
   1208 			 * at least %g6, %g7 must be allowed in addition
   1209 			 * to %g2 and %g3.
   1210 			 */
   1211 			value += reladd;
   1212 			if (roffset == STO_SPARC_REGISTER_G1) {
   1213 				set_sparc_g1(value);
   1214 			} else if (roffset == STO_SPARC_REGISTER_G2) {
   1215 				set_sparc_g2(value);
   1216 			} else if (roffset == STO_SPARC_REGISTER_G3) {
   1217 				set_sparc_g3(value);
   1218 			} else if (roffset == STO_SPARC_REGISTER_G4) {
   1219 				set_sparc_g4(value);
   1220 			} else if (roffset == STO_SPARC_REGISTER_G5) {
   1221 				set_sparc_g5(value);
   1222 			} else if (roffset == STO_SPARC_REGISTER_G6) {
   1223 				set_sparc_g6(value);
   1224 			} else if (roffset == STO_SPARC_REGISTER_G7) {
   1225 				set_sparc_g7(value);
   1226 			} else {
   1227 				eprintf(LIST(lmp), ERR_FATAL,
   1228 				    MSG_INTL(MSG_REL_BADREG), NAME(lmp),
   1229 				    EC_ADDR(roffset));
   1230 				ret = 0;
   1231 				break;
   1232 			}
   1233 
   1234 			DBG_CALL(Dbg_reloc_apply_reg(LIST(lmp), ELF_DBG_RTLD,
   1235 			    M_MACH, (Xword)roffset, (Xword)value));
   1236 			break;
   1237 		case R_SPARC_COPY:
   1238 			if (elf_copy_reloc(name, symref, lmp, (void *)roffset,
   1239 			    symdef, _lmp, (const void *)value) == 0)
   1240 				ret = 0;
   1241 			break;
   1242 		case R_SPARC_JMP_SLOT:
   1243 			pltndx = ((uintptr_t)rel -
   1244 			    (uintptr_t)JMPREL(lmp)) / relsiz;
   1245 
   1246 			if (FLAGS(lmp) & FLG_RT_FIXED)
   1247 				vaddr = 0;
   1248 			else
   1249 				vaddr = ADDR(lmp);
   1250 
   1251 			if (((LIST(lmp)->lm_tflags | AFLAGS(lmp)) &
   1252 			    (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) &&
   1253 			    AUDINFO(lmp)->ai_dynplts) {
   1254 				int	fail = 0;
   1255 				/* LINTED */
   1256 				uint_t	symndx = (uint_t)(((uintptr_t)symdef -
   1257 				    (uintptr_t)SYMTAB(_lmp)) / SYMENT(_lmp));
   1258 
   1259 				(void) elf_plt_trace_write((caddr_t)vaddr,
   1260 				    (Rela *)rel, lmp, _lmp, symdef, symndx,
   1261 				    pltndx, (caddr_t)value, sb_flags, &fail);
   1262 				if (fail)
   1263 					ret = 0;
   1264 			} else {
   1265 				/*
   1266 				 * Write standard PLT entry to jump directly
   1267 				 * to newly bound function.
   1268 				 */
   1269 				DBG_CALL(Dbg_reloc_apply_val(LIST(lmp),
   1270 				    ELF_DBG_RTLD, (Xword)roffset,
   1271 				    (Xword)value));
   1272 				pbtype = elf_plt_write((uintptr_t)vaddr,
   1273 				    (uintptr_t)vaddr, (void *)rel, value,
   1274 				    pltndx);
   1275 			}
   1276 			break;
   1277 		case R_SPARC_WDISP30:
   1278 			if (PLTPAD(lmp) &&
   1279 			    (S_INRANGE((Sxword)value, 29) == 0)) {
   1280 				void *	plt = 0;
   1281 
   1282 				if (bindpltpad(lmp, &pltpadlist,
   1283 				    value + roffset, &plt,
   1284 				    NAME(_lmp), name) == 0) {
   1285 					ret = 0;
   1286 					break;
   1287 				}
   1288 				value = (Addr)((Addr)plt - roffset);
   1289 			}
   1290 			/* FALLTHROUGH */
   1291 		default:
   1292 			value += reladd;
   1293 			if (IS_EXTOFFSET(rtype))
   1294 				value += (Word)ELF_R_TYPE_DATA(rel->r_info);
   1295 
   1296 			/*
   1297 			 * Write the relocation out.  If this relocation is a
   1298 			 * common basic write, skip the doreloc() engine.
   1299 			 */
   1300 			if ((rtype == R_SPARC_GLOB_DAT) ||
   1301 			    (rtype == R_SPARC_64)) {
   1302 				if (roffset & 0x7) {
   1303 					Conv_inv_buf_t	inv_buf;
   1304 
   1305 					eprintf(LIST(lmp), ERR_FATAL,
   1306 					    MSG_INTL(MSG_REL_NONALIGN),
   1307 					    conv_reloc_SPARC_type(rtype,
   1308 					    0, &inv_buf),
   1309 					    NAME(lmp), demangle(name),
   1310 					    EC_OFF(roffset));
   1311 					ret = 0;
   1312 				} else
   1313 					*(ulong_t *)roffset += value;
   1314 			} else {
   1315 				if (do_reloc_rtld(rtype, (uchar_t *)roffset,
   1316 				    (Xword *)&value, name,
   1317 				    NAME(lmp), LIST(lmp)) == 0)
   1318 					ret = 0;
   1319 			}
   1320 
   1321 			/*
   1322 			 * The value now contains the 'bit-shifted' value that
   1323 			 * was or'ed into memory (this was set by
   1324 			 * do_reloc_rtld()).
   1325 			 */
   1326 			DBG_CALL(Dbg_reloc_apply_val(LIST(lmp), ELF_DBG_RTLD,
   1327 			    (Xword)roffset, (Xword)value));
   1328 
   1329 			/*
   1330 			 * If this relocation is against a text segment, make
   1331 			 * sure that the instruction cache is flushed.
   1332 			 */
   1333 			if (textrel)
   1334 				iflush_range((caddr_t)roffset, 0x4);
   1335 		}
   1336 
   1337 		if ((ret == 0) &&
   1338 		    ((LIST(lmp)->lm_flags & LML_FLG_TRC_WARN) == 0))
   1339 			break;
   1340 
   1341 		if (binfo) {
   1342 			DBG_CALL(Dbg_bind_global(lmp, (Addr)roffset,
   1343 			    (Off)(roffset - basebgn), pltndx, pbtype,
   1344 			    _lmp, (Addr)value, symdef->st_value, name, binfo));
   1345 		}
   1346 	}
   1347 
   1348 	/*
   1349 	 * Free up any items on the pltpadlist if it was allocated
   1350 	 */
   1351 	if (pltpadlist)
   1352 		free(pltpadlist);
   1353 
   1354 	return (relocate_finish(lmp, bound, ret));
   1355 }
   1356 
   1357 /*
   1358  * Provide a machine specific interface to the conversion routine.  By calling
   1359  * the machine specific version, rather than the generic version, we insure that
   1360  * the data tables/strings for all known machine versions aren't dragged into
   1361  * ld.so.1.
   1362  */
   1363 const char *
   1364 _conv_reloc_type(uint_t rel)
   1365 {
   1366 	static Conv_inv_buf_t	inv_buf;
   1367 
   1368 	return (conv_reloc_SPARC_type(rel, 0, &inv_buf));
   1369 }
   1370