xref: /titanic_50/usr/src/cmd/sgs/libld/common/machrel.intel.c (revision d4c0a8c59bf9b2697b3dda08963d7f424dcba394)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1990, 1991 UNIX System Laboratories, Inc.
24  *	Copyright (c) 1988 AT&T
25  *	  All Rights Reserved
26  *
27  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
28  * Use is subject to license terms.
29  */
30 #pragma ident	"%Z%%M%	%I%	%E% SMI"
31 
32 #include	<string.h>
33 #include	<stdio.h>
34 #include	<sys/elf_386.h>
35 #include	<debug.h>
36 #include	<reloc.h>
37 #include	"msg.h"
38 #include	"_libld.h"
39 
40 Word
41 ld_init_rel(Rel_desc *reld, void *reloc)
42 {
43 	Rel *	rel = (Rel *)reloc;
44 
45 	/* LINTED */
46 	reld->rel_rtype = (Word)ELF_R_TYPE(rel->r_info);
47 	reld->rel_roffset = rel->r_offset;
48 	reld->rel_raddend = 0;
49 	reld->rel_typedata = 0;
50 
51 	return ((Word)ELF_R_SYM(rel->r_info));
52 }
53 
54 void
55 ld_mach_eflags(Ehdr *ehdr, Ofl_desc *ofl)
56 {
57 	ofl->ofl_dehdr->e_flags |= ehdr->e_flags;
58 }
59 
60 void
61 ld_mach_make_dynamic(Ofl_desc *ofl, size_t *cnt)
62 {
63 	if (!(ofl->ofl_flags & FLG_OF_RELOBJ)) {
64 		/*
65 		 * Create this entry if we are going to create a PLT table.
66 		 */
67 		if (ofl->ofl_pltcnt)
68 			(*cnt)++;		/* DT_PLTGOT */
69 	}
70 }
71 
72 void
73 ld_mach_update_odynamic(Ofl_desc *ofl, Dyn **dyn)
74 {
75 	if (((ofl->ofl_flags & FLG_OF_RELOBJ) == 0) && ofl->ofl_pltcnt) {
76 		(*dyn)->d_tag = DT_PLTGOT;
77 		if (ofl->ofl_osgot)
78 			(*dyn)->d_un.d_ptr = ofl->ofl_osgot->os_shdr->sh_addr;
79 		else
80 			(*dyn)->d_un.d_ptr = 0;
81 		(*dyn)++;
82 	}
83 }
84 
85 Xword
86 ld_calc_plt_addr(Sym_desc *sdp, Ofl_desc *ofl)
87 {
88 	Xword	value;
89 
90 	value = (Xword)(ofl->ofl_osplt->os_shdr->sh_addr) +
91 	    M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) * M_PLT_ENTSIZE);
92 	return (value);
93 }
94 
95 /*
96  *  Build a single plt entry - code is:
97  *	if (building a.out)
98  *		JMP	*got_off
99  *	else
100  *		JMP	*got_off@GOT(%ebx)
101  *	PUSHL	&rel_off
102  *	JMP	-n(%pc)		# -n is pcrel offset to first plt entry
103  *
104  *	The got_off@GOT entry gets filled with the address of the PUSHL,
105  *	so the first pass through the plt jumps back here, jumping
106  *	in turn to the first plt entry, which jumps to the dynamic
107  *	linker.	 The dynamic linker then patches the GOT, rerouting
108  *	future plt calls to the proper destination.
109  */
110 static void
111 plt_entry(Ofl_desc * ofl, Word rel_off, Sym_desc * sdp)
112 {
113 	uchar_t		*pltent, *gotent;
114 	Sword		plt_off;
115 	Word		got_off;
116 
117 	got_off = sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE;
118 	plt_off = M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) *
119 	    M_PLT_ENTSIZE);
120 	pltent = (uchar_t *)(ofl->ofl_osplt->os_outdata->d_buf) + plt_off;
121 	gotent = (uchar_t *)(ofl->ofl_osgot->os_outdata->d_buf) + got_off;
122 
123 	/*
124 	 * Fill in the got entry with the address of the next instruction.
125 	 */
126 	/* LINTED */
127 	*(Word *)gotent = ofl->ofl_osplt->os_shdr->sh_addr + plt_off +
128 	    M_PLT_INSSIZE;
129 
130 	if (!(ofl->ofl_flags & FLG_OF_SHAROBJ)) {
131 		pltent[0] = M_SPECIAL_INST;
132 		pltent[1] = M_JMP_DISP_IND;
133 		pltent += 2;
134 		/* LINTED */
135 		*(Word *)pltent = (Word)(ofl->ofl_osgot->os_shdr->sh_addr +
136 		    got_off);
137 	} else {
138 		pltent[0] = M_SPECIAL_INST;
139 		pltent[1] = M_JMP_REG_DISP_IND;
140 		pltent += 2;
141 		/* LINTED */
142 		*(Word *)pltent = (Word)got_off;
143 	}
144 	pltent += 4;
145 
146 	pltent[0] = M_INST_PUSHL;
147 	pltent++;
148 	/* LINTED */
149 	*(Word *)pltent = (Word)rel_off;
150 	pltent += 4;
151 
152 	plt_off = -(plt_off + 16);	/* JMP, PUSHL, JMP take 16 bytes */
153 	pltent[0] = M_INST_JMP;
154 	pltent++;
155 	/* LINTED */
156 	*(Word *)pltent = (Word)plt_off;
157 }
158 
159 uintptr_t
160 ld_perform_outreloc(Rel_desc * orsp, Ofl_desc * ofl)
161 {
162 	Os_desc *	relosp, * osp = 0;
163 	Word		ndx, roffset, value;
164 	Rel		rea;
165 	char		*relbits;
166 	Sym_desc *	sdp, * psym = (Sym_desc *)0;
167 	int		sectmoved = 0;
168 
169 	sdp = orsp->rel_sym;
170 
171 	/*
172 	 * If the section this relocation is against has been discarded
173 	 * (-zignore), then also discard (skip) the relocation itself.
174 	 */
175 	if (orsp->rel_isdesc && ((orsp->rel_flags &
176 	    (FLG_REL_GOT | FLG_REL_BSS | FLG_REL_PLT | FLG_REL_NOINFO)) == 0) &&
177 	    (orsp->rel_isdesc->is_flags & FLG_IS_DISCARD)) {
178 		DBG_CALL(Dbg_reloc_discard(ofl->ofl_lml, M_MACH, orsp));
179 		return (1);
180 	}
181 
182 	/*
183 	 * If this is a relocation against a move table, or expanded move
184 	 * table, adjust the relocation entries.
185 	 */
186 	if (orsp->rel_move)
187 		ld_adj_movereloc(ofl, orsp);
188 
189 	/*
190 	 * If this is a relocation against a section using a partial initialized
191 	 * symbol, adjust the embedded symbol info.
192 	 *
193 	 * The second argument of the am_I_partial() is the value stored at the
194 	 * target address relocation is going to be applied.
195 	 */
196 	if (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION) {
197 		if (ofl->ofl_parsym.head &&
198 		    (sdp->sd_isc->is_flags & FLG_IS_RELUPD) &&
199 		    /* LINTED */
200 		    (psym = ld_am_I_partial(orsp, *(Xword *)
201 		    ((uchar_t *)(orsp->rel_isdesc->is_indata->d_buf) +
202 		    orsp->rel_roffset)))) {
203 			DBG_CALL(Dbg_move_outsctadj(ofl->ofl_lml, psym));
204 			sectmoved = 1;
205 		}
206 	}
207 
208 	value = sdp->sd_sym->st_value;
209 
210 	if (orsp->rel_flags & FLG_REL_GOT) {
211 		osp = ofl->ofl_osgot;
212 		roffset = (Word)ld_calc_got_offset(orsp, ofl);
213 
214 	} else if (orsp->rel_flags & FLG_REL_PLT) {
215 		/*
216 		 * Note that relocations for PLT's actually
217 		 * cause a relocation againt the GOT.
218 		 */
219 		osp = ofl->ofl_osplt;
220 		roffset = (Word) (ofl->ofl_osgot->os_shdr->sh_addr) +
221 		    sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE;
222 
223 		plt_entry(ofl, osp->os_relosdesc->os_szoutrels, sdp);
224 
225 	} else if (orsp->rel_flags & FLG_REL_BSS) {
226 		/*
227 		 * This must be a R_386_COPY.  For these set the roffset to
228 		 * point to the new symbols location.
229 		 */
230 		osp = ofl->ofl_isbss->is_osdesc;
231 		roffset = (Word)value;
232 	} else {
233 		osp = orsp->rel_osdesc;
234 
235 		/*
236 		 * Calculate virtual offset of reference point; equals offset
237 		 * into section + vaddr of section for loadable sections, or
238 		 * offset plus section displacement for nonloadable sections.
239 		 */
240 		roffset = orsp->rel_roffset +
241 		    (Off)_elf_getxoff(orsp->rel_isdesc->is_indata);
242 		if (!(ofl->ofl_flags & FLG_OF_RELOBJ))
243 			roffset += orsp->rel_isdesc->is_osdesc->
244 			    os_shdr->sh_addr;
245 	}
246 
247 	if ((osp == 0) || ((relosp = osp->os_relosdesc) == 0))
248 		relosp = ofl->ofl_osrel;
249 
250 	/*
251 	 * Assign the symbols index for the output relocation.  If the
252 	 * relocation refers to a SECTION symbol then it's index is based upon
253 	 * the output sections symbols index.  Otherwise the index can be
254 	 * derived from the symbols index itself.
255 	 */
256 	if (orsp->rel_rtype == R_386_RELATIVE)
257 		ndx = STN_UNDEF;
258 	else if ((orsp->rel_flags & FLG_REL_SCNNDX) ||
259 	    (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION)) {
260 		if (sectmoved == 0) {
261 			/*
262 			 * Check for a null input section. This can
263 			 * occur if this relocation references a symbol
264 			 * generated by sym_add_sym().
265 			 */
266 			if ((sdp->sd_isc != 0) &&
267 			    (sdp->sd_isc->is_osdesc != 0))
268 				ndx = sdp->sd_isc->is_osdesc->os_scnsymndx;
269 			else
270 				ndx = sdp->sd_shndx;
271 		} else
272 			ndx = ofl->ofl_sunwdata1ndx;
273 	} else
274 		ndx = sdp->sd_symndx;
275 
276 	/*
277 	 * If we have a replacement value for the relocation
278 	 * target, put it in place now.
279 	 */
280 	if (orsp->rel_flags & FLG_REL_NADDEND) {
281 		Xword	addend = orsp->rel_raddend;
282 		uchar_t	*addr;
283 
284 		/*
285 		 * Get the address of the data item we need to modify.
286 		 */
287 		addr = (uchar_t *)((uintptr_t)orsp->rel_roffset +
288 		    (uintptr_t)_elf_getxoff(orsp->rel_isdesc->is_indata));
289 		addr += (uintptr_t)orsp->rel_osdesc->os_outdata->d_buf;
290 		if (ld_reloc_targval_set(ofl, orsp, addr, addend) == 0)
291 			return (S_ERROR);
292 	}
293 
294 	relbits = (char *)relosp->os_outdata->d_buf;
295 
296 	rea.r_info = ELF_R_INFO(ndx, orsp->rel_rtype);
297 	rea.r_offset = roffset;
298 	DBG_CALL(Dbg_reloc_out(ofl, ELF_DBG_LD, SHT_REL, &rea, relosp->os_name,
299 	    orsp->rel_sname));
300 
301 	/*
302 	 * Assert we haven't walked off the end of our relocation table.
303 	 */
304 	assert(relosp->os_szoutrels <= relosp->os_shdr->sh_size);
305 
306 	(void) memcpy((relbits + relosp->os_szoutrels),
307 	    (char *)&rea, sizeof (Rel));
308 	relosp->os_szoutrels += sizeof (Rel);
309 
310 	/*
311 	 * Determine if this relocation is against a non-writable, allocatable
312 	 * section.  If so we may need to provide a text relocation diagnostic.
313 	 * Note that relocations against the .plt (R_386_JMP_SLOT) actually
314 	 * result in modifications to the .got.
315 	 */
316 	if (orsp->rel_rtype == R_386_JMP_SLOT)
317 		osp = ofl->ofl_osgot;
318 
319 	ld_reloc_remain_entry(orsp, osp, ofl);
320 	return (1);
321 }
322 
323 /*
324  * i386 Instructions for TLS processing
325  */
326 static uchar_t tlsinstr_gd_ie[] = {
327 	/*
328 	 * 0x00	movl %gs:0x0, %eax
329 	 */
330 	0x65, 0xa1, 0x00, 0x00, 0x00, 0x00,
331 	/*
332 	 * 0x06	addl x(%eax), %eax
333 	 * 0x0c ...
334 	 */
335 	0x03, 0x80, 0x00, 0x00, 0x00, 0x00
336 };
337 
338 static uchar_t tlsinstr_gd_le[] = {
339 	/*
340 	 * 0x00 movl %gs:0x0, %eax
341 	 */
342 	0x65, 0xa1, 0x00, 0x00, 0x00, 0x00,
343 	/*
344 	 * 0x06 addl $0x0, %eax
345 	 */
346 	0x05, 0x00, 0x00, 0x00, 0x00,
347 	/*
348 	 * 0x0b nop
349 	 * 0x0c
350 	 */
351 	0x90
352 };
353 
354 static uchar_t tlsinstr_gd_ie_movgs[] = {
355 	/*
356 	 *	movl %gs:0x0,%eax
357 	 */
358 	0x65, 0xa1, 0x00, 0x00, 0x00, 00
359 };
360 
361 #define	TLS_GD_IE_MOV	0x8b	/* movl opcode */
362 #define	TLS_GD_IE_POP	0x58	/* popl + reg */
363 
364 #define	TLS_GD_LE_MOVL	0xb8	/* movl + reg */
365 
366 #define	TLS_NOP		0x90	/* NOP instruction */
367 
368 #define	MODRM_MSK_MOD	0xc0
369 #define	MODRM_MSK_RO	0x38
370 #define	MODRM_MSK_RM	0x07
371 
372 #define	SIB_MSK_SS	0xc0
373 #define	SIB_MSK_IND	0x38
374 #define	SIB_MSK_BS	0x07
375 
376 static Fixupret
377 tls_fixups(Ofl_desc *ofl, Rel_desc *arsp)
378 {
379 	Sym_desc	*sdp = arsp->rel_sym;
380 	Word		rtype = arsp->rel_rtype;
381 	uchar_t		*offset, r1, r2;
382 
383 	offset = (uchar_t *)((uintptr_t)arsp->rel_roffset +
384 	    (uintptr_t)_elf_getxoff(arsp->rel_isdesc->is_indata) +
385 	    (uintptr_t)arsp->rel_osdesc->os_outdata->d_buf);
386 
387 	if (sdp->sd_ref == REF_DYN_NEED) {
388 		/*
389 		 * IE reference model
390 		 */
391 		switch (rtype) {
392 		case R_386_TLS_GD:
393 			/*
394 			 * Transition:
395 			 *	0x0 leal x@tlsgd(,r1,1), %eax
396 			 *	0x7 call ___tls_get_addr
397 			 *	0xc
398 			 * To:
399 			 *	0x0 movl %gs:0, %eax
400 			 *	0x6 addl x@gotntpoff(r1), %eax
401 			 */
402 			DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
403 			    R_386_TLS_GOTIE, arsp));
404 			arsp->rel_rtype = R_386_TLS_GOTIE;
405 			arsp->rel_roffset += 5;
406 
407 			/*
408 			 * Adjust 'offset' to beginning of instruction
409 			 * sequence.
410 			 */
411 			offset -= 3;
412 			r1 = (offset[2] & SIB_MSK_IND) >> 3;
413 			(void) memcpy(offset, tlsinstr_gd_ie,
414 			    sizeof (tlsinstr_gd_ie));
415 
416 			/*
417 			 * set register %r1 into the addl
418 			 * instruction.
419 			 */
420 			offset[0x7] |= r1;
421 			return (FIX_RELOC);
422 
423 		case R_386_TLS_GD_PLT:
424 			/*
425 			 * Fixup done via the TLS_GD relocation
426 			 */
427 			DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
428 			    R_386_NONE, arsp));
429 			return (FIX_DONE);
430 		}
431 	}
432 
433 	/*
434 	 * LE reference model
435 	 */
436 	switch (rtype) {
437 	case R_386_TLS_GD:
438 		/*
439 		 * Transition:
440 		 *	0x0 leal x@tlsgd(,r1,1), %eax
441 		 *	0x7 call ___tls_get_addr
442 		 *	0xc
443 		 * To:
444 		 *	0x0 movl %gs:0, %eax
445 		 *	0x6 addl $x@ntpoff, %eax
446 		 *	0xb nop
447 		 *	0xc
448 		 */
449 		DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
450 		    R_386_TLS_LE, arsp));
451 
452 		arsp->rel_rtype = R_386_TLS_LE;
453 		arsp->rel_roffset += 4;
454 
455 		/*
456 		 * Adjust 'offset' to beginning of instruction
457 		 * sequence.
458 		 */
459 		offset -= 3;
460 		(void) memcpy(offset, tlsinstr_gd_le,
461 		    sizeof (tlsinstr_gd_le));
462 		return (FIX_RELOC);
463 
464 	case R_386_TLS_GD_PLT:
465 	case R_386_PLT32:
466 		/*
467 		 * Fixup done via the TLS_GD relocation
468 		 */
469 		DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
470 		    R_386_NONE, arsp));
471 		return (FIX_DONE);
472 
473 	case R_386_TLS_LDM_PLT:
474 		DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
475 		    R_386_NONE, arsp));
476 
477 		/*
478 		 * Transition:
479 		 *	call __tls_get_addr()
480 		 * to:
481 		 *	nop
482 		 *	nop
483 		 *	nop
484 		 *	nop
485 		 *	nop
486 		 */
487 		*(offset - 1) = TLS_NOP;
488 		*(offset) = TLS_NOP;
489 		*(offset + 1) = TLS_NOP;
490 		*(offset + 2) = TLS_NOP;
491 		*(offset + 3) = TLS_NOP;
492 		return (FIX_DONE);
493 
494 	case R_386_TLS_LDM:
495 		DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
496 		    R_386_NONE, arsp));
497 
498 		/*
499 		 * Transition:
500 		 *
501 		 *  0x00 leal x1@tlsldm(%ebx), %eax
502 		 *  0x06 call ___tls_get_addr
503 		 *
504 		 * to:
505 		 *
506 		 *  0x00 movl %gs:0, %eax
507 		 */
508 		(void) memcpy(offset - 2, tlsinstr_gd_ie_movgs,
509 		    sizeof (tlsinstr_gd_ie_movgs));
510 		return (FIX_DONE);
511 
512 	case R_386_TLS_LDO_32:
513 		/*
514 		 *  Instructions:
515 		 *
516 		 *  0x10 leal x1@dtpoff(%eax), %edx	R_386_TLS_LDO_32
517 		 *		to
518 		 *  0x10 leal x1@ntpoff(%eax), %edx	R_386_TLS_LE
519 		 *
520 		 */
521 		offset -= 2;
522 
523 		DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
524 		    R_386_TLS_LE, arsp));
525 		arsp->rel_rtype = R_386_TLS_LE;
526 		return (FIX_RELOC);
527 
528 	case R_386_TLS_GOTIE:
529 		/*
530 		 * These transitions are a little different than the
531 		 * others, in that we could have multiple instructions
532 		 * pointed to by a single relocation.  Depending upon the
533 		 * instruction, we perform a different code transition.
534 		 *
535 		 * Here's the known transitions:
536 		 *
537 		 *  1) movl foo@gotntpoff(%reg1), %reg2
538 		 *	0x8b, 0x80 | (reg2 << 3) | reg1, foo@gotntpoff
539 		 *
540 		 *  2) addl foo@gotntpoff(%reg1), %reg2
541 		 *	0x03, 0x80 | (reg2 << 3) | reg1, foo@gotntpoff
542 		 *
543 		 *  Transitions IE -> LE
544 		 *
545 		 *  1) movl $foo@ntpoff, %reg2
546 		 *	0xc7, 0xc0 | reg2, foo@ntpoff
547 		 *
548 		 *  2) addl $foo@ntpoff, %reg2
549 		 *	0x81, 0xc0 | reg2, foo@ntpoff
550 		 *
551 		 * Note: reg1 != 4 (%esp)
552 		 */
553 		DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
554 		    R_386_TLS_LE, arsp));
555 		arsp->rel_rtype = R_386_TLS_LE;
556 
557 		offset -= 2;
558 		r2 = (offset[1] & MODRM_MSK_RO) >> 3;
559 		if (offset[0] == 0x8b) {
560 			/* case 1 above */
561 			offset[0] = 0xc7;	/* movl */
562 			offset[1] = 0xc0 | r2;
563 			return (FIX_RELOC);
564 		}
565 
566 		if (offset[0] == 0x03) {
567 			/* case 2 above */
568 			assert(offset[0] == 0x03);
569 			offset[0] = 0x81;	/* addl */
570 			offset[1] = 0xc0 | r2;
571 			return (FIX_RELOC);
572 		}
573 
574 		/*
575 		 * Unexpected instruction sequence - fatal error.
576 		 */
577 		{
578 			Conv_inv_buf_t	inv_buf;
579 
580 			eprintf(ofl->ofl_lml, ERR_FATAL,
581 			    MSG_INTL(MSG_REL_BADTLSINS),
582 			    conv_reloc_386_type(arsp->rel_rtype, 0, &inv_buf),
583 			    arsp->rel_isdesc->is_file->ifl_name,
584 			    demangle(arsp->rel_sname),
585 			    arsp->rel_isdesc->is_name,
586 			    EC_OFF(arsp->rel_roffset));
587 		}
588 		return (FIX_ERROR);
589 
590 	case R_386_TLS_IE:
591 		/*
592 		 * These transitions are a little different than the
593 		 * others, in that we could have multiple instructions
594 		 * pointed to by a single relocation.  Depending upon the
595 		 * instruction, we perform a different code transition.
596 		 *
597 		 * Here's the known transitions:
598 		 *  1) movl foo@indntpoff, %eax
599 		 *	0xa1, foo@indntpoff
600 		 *
601 		 *  2) movl foo@indntpoff, %eax
602 		 *	0x8b, 0x05 | (reg << 3), foo@gotntpoff
603 		 *
604 		 *  3) addl foo@indntpoff, %eax
605 		 *	0x03, 0x05 | (reg << 3), foo@gotntpoff
606 		 *
607 		 *  Transitions IE -> LE
608 		 *
609 		 *  1) movl $foo@ntpoff, %eax
610 		 *	0xb8, foo@ntpoff
611 		 *
612 		 *  2) movl $foo@ntpoff, %reg
613 		 *	0xc7, 0xc0 | reg, foo@ntpoff
614 		 *
615 		 *  3) addl $foo@ntpoff, %reg
616 		 *	0x81, 0xc0 | reg, foo@ntpoff
617 		 */
618 		arsp->rel_rtype = R_386_TLS_LE;
619 		offset--;
620 		if (offset[0] == 0xa1) {
621 			/* case 1 above */
622 			offset[0] = 0xb8;	/*  movl */
623 			return (FIX_RELOC);
624 		}
625 
626 		offset--;
627 		if (offset[0] == 0x8b) {
628 			/* case 2 above */
629 			r2 = (offset[1] & MODRM_MSK_RO) >> 3;
630 			offset[0] = 0xc7;	/* movl */
631 			offset[1] = 0xc0 | r2;
632 			return (FIX_RELOC);
633 		}
634 		if (offset[0] == 0x03) {
635 			/* case 3 above */
636 			r2 = (offset[1] & MODRM_MSK_RO) >> 3;
637 			offset[0] = 0x81;	/* addl */
638 			offset[1] = 0xc0 | r2;
639 			return (FIX_RELOC);
640 		}
641 		/*
642 		 * Unexpected instruction sequence - fatal error.
643 		 */
644 		{
645 			Conv_inv_buf_t	inv_buf;
646 
647 			eprintf(ofl->ofl_lml, ERR_FATAL,
648 			    MSG_INTL(MSG_REL_BADTLSINS),
649 			    conv_reloc_386_type(arsp->rel_rtype, 0, &inv_buf),
650 			    arsp->rel_isdesc->is_file->ifl_name,
651 			    demangle(arsp->rel_sname),
652 			    arsp->rel_isdesc->is_name,
653 			    EC_OFF(arsp->rel_roffset));
654 		}
655 		return (FIX_ERROR);
656 	}
657 	return (FIX_RELOC);
658 }
659 
660 uintptr_t
661 ld_do_activerelocs(Ofl_desc *ofl)
662 {
663 	Rel_desc	*arsp;
664 	Rel_cache	*rcp;
665 	Listnode	*lnp;
666 	uintptr_t	return_code = 1;
667 	Word		flags = ofl->ofl_flags;
668 
669 	if (ofl->ofl_actrels.head)
670 		DBG_CALL(Dbg_reloc_doact_title(ofl->ofl_lml));
671 
672 	/*
673 	 * Process active relocations.
674 	 */
675 	for (LIST_TRAVERSE(&ofl->ofl_actrels, lnp, rcp)) {
676 		/* LINTED */
677 		for (arsp = (Rel_desc *)(rcp + 1);
678 		    arsp < rcp->rc_free; arsp++) {
679 			uchar_t		*addr;
680 			Xword 		value;
681 			Sym_desc	*sdp;
682 			const char	*ifl_name;
683 			Xword		refaddr;
684 			int		moved = 0;
685 			Gotref		gref;
686 
687 			/*
688 			 * If the section this relocation is against has been
689 			 * discarded (-zignore), then discard (skip) the
690 			 * relocation itself.
691 			 */
692 			if ((arsp->rel_isdesc->is_flags & FLG_IS_DISCARD) &&
693 			    ((arsp->rel_flags &
694 			    (FLG_REL_GOT | FLG_REL_BSS |
695 			    FLG_REL_PLT | FLG_REL_NOINFO)) == 0)) {
696 				DBG_CALL(Dbg_reloc_discard(ofl->ofl_lml,
697 				    M_MACH, arsp));
698 				continue;
699 			}
700 
701 			/*
702 			 * We deteremine what the 'got reference'
703 			 * model (if required) is at this point.  This
704 			 * needs to be done before tls_fixup() since
705 			 * it may 'transition' our instructions.
706 			 *
707 			 * The got table entries have already been assigned,
708 			 * and we bind to those initial entries.
709 			 */
710 			if (arsp->rel_flags & FLG_REL_DTLS)
711 				gref = GOT_REF_TLSGD;
712 			else if (arsp->rel_flags & FLG_REL_MTLS)
713 				gref = GOT_REF_TLSLD;
714 			else if (arsp->rel_flags & FLG_REL_STLS)
715 				gref = GOT_REF_TLSIE;
716 			else
717 				gref = GOT_REF_GENERIC;
718 
719 			/*
720 			 * Perform any required TLS fixups.
721 			 */
722 			if (arsp->rel_flags & FLG_REL_TLSFIX) {
723 				Fixupret	ret;
724 
725 				if ((ret = tls_fixups(ofl, arsp)) == FIX_ERROR)
726 					return (S_ERROR);
727 				if (ret == FIX_DONE)
728 					continue;
729 			}
730 
731 			/*
732 			 * If this is a relocation against a move table, or
733 			 * expanded move table, adjust the relocation entries.
734 			 */
735 			if (arsp->rel_move)
736 				ld_adj_movereloc(ofl, arsp);
737 
738 			sdp = arsp->rel_sym;
739 			refaddr = arsp->rel_roffset +
740 			    (Off)_elf_getxoff(arsp->rel_isdesc->is_indata);
741 
742 			if (arsp->rel_flags & FLG_REL_CLVAL)
743 				value = 0;
744 			else if (ELF_ST_TYPE(sdp->sd_sym->st_info) ==
745 			    STT_SECTION) {
746 				Sym_desc	*sym;
747 
748 				/*
749 				 * The value for a symbol pointing to a SECTION
750 				 * is based off of that sections position.
751 				 *
752 				 * The second argument of the ld_am_I_partial()
753 				 * is the value stored at the target address
754 				 * relocation is going to be applied.
755 				 */
756 				if ((sdp->sd_isc->is_flags & FLG_IS_RELUPD) &&
757 				    /* LINTED */
758 				    (sym = ld_am_I_partial(arsp, *(Xword *)
759 				    ((uchar_t *)
760 				    arsp->rel_isdesc->is_indata->d_buf +
761 				    arsp->rel_roffset)))) {
762 					/*
763 					 * If the symbol is moved,
764 					 * adjust the value
765 					 */
766 					value = sym->sd_sym->st_value;
767 					moved = 1;
768 				} else {
769 					value = _elf_getxoff(
770 					    sdp->sd_isc->is_indata);
771 					if (sdp->sd_isc->is_shdr->sh_flags &
772 					    SHF_ALLOC)
773 						value += sdp->sd_isc->
774 						    is_osdesc->os_shdr->sh_addr;
775 				}
776 				if (sdp->sd_isc->is_shdr->sh_flags & SHF_TLS)
777 					value -= ofl->ofl_tlsphdr->p_vaddr;
778 
779 			} else if (IS_SIZE(arsp->rel_rtype)) {
780 				/*
781 				 * Size relocations require the symbols size.
782 				 */
783 				value = sdp->sd_sym->st_size;
784 			} else {
785 				/*
786 				 * Else the value is the symbols value.
787 				 */
788 				value = sdp->sd_sym->st_value;
789 			}
790 
791 			/*
792 			 * Relocation against the GLOBAL_OFFSET_TABLE.
793 			 */
794 			if (arsp->rel_flags & FLG_REL_GOT)
795 				arsp->rel_osdesc = ofl->ofl_osgot;
796 
797 			/*
798 			 * If loadable and not producing a relocatable object
799 			 * add the sections virtual address to the reference
800 			 * address.
801 			 */
802 			if ((arsp->rel_flags & FLG_REL_LOAD) &&
803 			    ((flags & FLG_OF_RELOBJ) == 0))
804 				refaddr += arsp->rel_isdesc->is_osdesc->
805 				    os_shdr->sh_addr;
806 
807 			/*
808 			 * If this entry has a PLT assigned to it, it's
809 			 * value is actually the address of the PLT (and
810 			 * not the address of the function).
811 			 */
812 			if (IS_PLT(arsp->rel_rtype)) {
813 				if (sdp->sd_aux && sdp->sd_aux->sa_PLTndx)
814 					value = ld_calc_plt_addr(sdp, ofl);
815 			}
816 
817 			/*
818 			 * Determine whether the value needs further adjustment.
819 			 * Filter through the attributes of the relocation to
820 			 * determine what adjustment is required.  Note, many
821 			 * of the following cases are only applicable when a
822 			 * .got is present.  As a .got is not generated when a
823 			 * relocatable object is being built, any adjustments
824 			 * that require a .got need to be skipped.
825 			 */
826 			if ((arsp->rel_flags & FLG_REL_GOT) &&
827 			    ((flags & FLG_OF_RELOBJ) == 0)) {
828 				Xword		R1addr;
829 				uintptr_t	R2addr;
830 				Word		gotndx;
831 				Gotndx		*gnp;
832 
833 				/*
834 				 * Perform relocation against GOT table.  Since
835 				 * this doesn't fit exactly into a relocation
836 				 * we place the appropriate byte in the GOT
837 				 * directly
838 				 *
839 				 * Calculate offset into GOT at which to apply
840 				 * the relocation.
841 				 */
842 				gnp = ld_find_gotndx(&(sdp->sd_GOTndxs), gref,
843 				    ofl, 0);
844 				assert(gnp);
845 
846 				if (arsp->rel_rtype == R_386_TLS_DTPOFF32)
847 					gotndx = gnp->gn_gotndx + 1;
848 				else
849 					gotndx = gnp->gn_gotndx;
850 
851 				R1addr = (Xword)(gotndx * M_GOT_ENTSIZE);
852 
853 				/*
854 				 * Add the GOTs data's offset.
855 				 */
856 				R2addr = R1addr + (uintptr_t)
857 				    arsp->rel_osdesc->os_outdata->d_buf;
858 
859 				DBG_CALL(Dbg_reloc_doact(ofl->ofl_lml,
860 				    ELF_DBG_LD, M_MACH, SHT_REL,
861 				    arsp->rel_rtype, R1addr, value,
862 				    arsp->rel_sname, arsp->rel_osdesc));
863 
864 				/*
865 				 * And do it.
866 				 */
867 				if (ofl->ofl_flags1 & FLG_OF1_ENCDIFF)
868 					*(Xword *)R2addr =
869 					    ld_byteswap_Xword(value);
870 				else
871 					*(Xword *)R2addr = value;
872 				continue;
873 
874 			} else if (IS_GOT_BASED(arsp->rel_rtype) &&
875 			    ((flags & FLG_OF_RELOBJ) == 0)) {
876 				value -= ofl->ofl_osgot->os_shdr->sh_addr;
877 
878 			} else if (IS_GOT_PC(arsp->rel_rtype) &&
879 			    ((flags & FLG_OF_RELOBJ) == 0)) {
880 				value =
881 				    (Xword)(ofl->ofl_osgot->os_shdr->sh_addr) -
882 				    refaddr;
883 
884 			} else if ((IS_PC_RELATIVE(arsp->rel_rtype)) &&
885 			    (((flags & FLG_OF_RELOBJ) == 0) ||
886 			    (arsp->rel_osdesc == sdp->sd_isc->is_osdesc))) {
887 				value -= refaddr;
888 
889 			} else if (IS_TLS_INS(arsp->rel_rtype) &&
890 			    IS_GOT_RELATIVE(arsp->rel_rtype) &&
891 			    ((flags & FLG_OF_RELOBJ) == 0)) {
892 				Gotndx	*gnp;
893 
894 				gnp = ld_find_gotndx(&(sdp->sd_GOTndxs), gref,
895 				    ofl, 0);
896 				assert(gnp);
897 				value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE;
898 				if (arsp->rel_rtype == R_386_TLS_IE) {
899 					value +=
900 					    ofl->ofl_osgot->os_shdr->sh_addr;
901 				}
902 
903 			} else if (IS_GOT_RELATIVE(arsp->rel_rtype) &&
904 			    ((flags & FLG_OF_RELOBJ) == 0)) {
905 				Gotndx *gnp;
906 
907 				gnp = ld_find_gotndx(&(sdp->sd_GOTndxs),
908 				    GOT_REF_GENERIC, ofl, 0);
909 				assert(gnp);
910 				value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE;
911 
912 			} else if ((arsp->rel_flags & FLG_REL_STLS) &&
913 			    ((flags & FLG_OF_RELOBJ) == 0)) {
914 				Xword	tlsstatsize;
915 
916 				/*
917 				 * This is the LE TLS reference model.  Static
918 				 * offset is hard-coded.
919 				 */
920 				tlsstatsize =
921 				    S_ROUND(ofl->ofl_tlsphdr->p_memsz,
922 				    M_TLSSTATALIGN);
923 				value = tlsstatsize - value;
924 
925 				/*
926 				 * Since this code is fixed up, it assumes a
927 				 * negative offset that can be added to the
928 				 * thread pointer.
929 				 */
930 				if ((arsp->rel_rtype == R_386_TLS_LDO_32) ||
931 				    (arsp->rel_rtype == R_386_TLS_LE))
932 					value = -value;
933 			}
934 
935 			if (arsp->rel_isdesc->is_file)
936 				ifl_name = arsp->rel_isdesc->is_file->ifl_name;
937 			else
938 				ifl_name = MSG_INTL(MSG_STR_NULL);
939 
940 			/*
941 			 * Make sure we have data to relocate.  Compiler and
942 			 * assembler developers have been known to generate
943 			 * relocations against invalid sections (normally .bss),
944 			 * so for their benefit give them sufficient information
945 			 * to help analyze the problem.  End users should never
946 			 * see this.
947 			 */
948 			if (arsp->rel_isdesc->is_indata->d_buf == 0) {
949 				Conv_inv_buf_t	inv_buf;
950 
951 				eprintf(ofl->ofl_lml, ERR_FATAL,
952 				    MSG_INTL(MSG_REL_EMPTYSEC),
953 				    conv_reloc_386_type(arsp->rel_rtype,
954 				    0, &inv_buf),
955 				    ifl_name, demangle(arsp->rel_sname),
956 				    arsp->rel_isdesc->is_name);
957 				return (S_ERROR);
958 			}
959 
960 			/*
961 			 * Get the address of the data item we need to modify.
962 			 */
963 			addr = (uchar_t *)((uintptr_t)arsp->rel_roffset +
964 			    (uintptr_t)_elf_getxoff(arsp->rel_isdesc->
965 			    is_indata));
966 
967 			DBG_CALL(Dbg_reloc_doact(ofl->ofl_lml, ELF_DBG_LD,
968 			    M_MACH, SHT_REL, arsp->rel_rtype, EC_NATPTR(addr),
969 			    value, arsp->rel_sname, arsp->rel_osdesc));
970 			addr += (uintptr_t)arsp->rel_osdesc->os_outdata->d_buf;
971 
972 			if ((((uintptr_t)addr - (uintptr_t)ofl->ofl_nehdr) >
973 			    ofl->ofl_size) || (arsp->rel_roffset >
974 			    arsp->rel_osdesc->os_shdr->sh_size)) {
975 				Conv_inv_buf_t	inv_buf;
976 				int		class;
977 
978 				if (((uintptr_t)addr -
979 				    (uintptr_t)ofl->ofl_nehdr) > ofl->ofl_size)
980 					class = ERR_FATAL;
981 				else
982 					class = ERR_WARNING;
983 
984 				eprintf(ofl->ofl_lml, class,
985 				    MSG_INTL(MSG_REL_INVALOFFSET),
986 				    conv_reloc_386_type(arsp->rel_rtype,
987 				    0, &inv_buf),
988 				    ifl_name, arsp->rel_isdesc->is_name,
989 				    demangle(arsp->rel_sname),
990 				    EC_ADDR((uintptr_t)addr -
991 				    (uintptr_t)ofl->ofl_nehdr));
992 
993 				if (class == ERR_FATAL) {
994 					return_code = S_ERROR;
995 					continue;
996 				}
997 			}
998 
999 			/*
1000 			 * The relocation is additive.  Ignore the previous
1001 			 * symbol value if this local partial symbol is
1002 			 * expanded.
1003 			 */
1004 			if (moved)
1005 				value -= *addr;
1006 
1007 			/*
1008 			 * If we have a replacement value for the relocation
1009 			 * target, put it in place now.
1010 			 */
1011 			if (arsp->rel_flags & FLG_REL_NADDEND) {
1012 				Xword addend = arsp->rel_raddend;
1013 
1014 				if (ld_reloc_targval_set(ofl, arsp,
1015 				    addr, addend) == 0)
1016 					return (S_ERROR);
1017 			}
1018 
1019 			/*
1020 			 * If '-z noreloc' is specified - skip the do_reloc_ld
1021 			 * stage.
1022 			 */
1023 			if (OFL_DO_RELOC(ofl)) {
1024 				if (do_reloc_ld((uchar_t)arsp->rel_rtype, addr,
1025 				    &value, arsp->rel_sname, ifl_name,
1026 				    OFL_SWAP_RELOC_DATA(ofl, arsp),
1027 				    ofl->ofl_lml) == 0)
1028 					return_code = S_ERROR;
1029 			}
1030 		}
1031 	}
1032 	return (return_code);
1033 }
1034 
1035 /*
1036  * Add an output relocation record.
1037  */
1038 uintptr_t
1039 ld_add_outrel(Word flags, Rel_desc *rsp, Ofl_desc *ofl)
1040 {
1041 	Rel_desc	*orsp;
1042 	Rel_cache	*rcp;
1043 	Sym_desc	*sdp = rsp->rel_sym;
1044 
1045 	/*
1046 	 * Static executables *do not* want any relocations against them.
1047 	 * Since our engine still creates relocations against a WEAK UNDEFINED
1048 	 * symbol in a static executable, it's best to disable them here
1049 	 * instead of through out the relocation code.
1050 	 */
1051 	if ((ofl->ofl_flags & (FLG_OF_STATIC | FLG_OF_EXEC)) ==
1052 	    (FLG_OF_STATIC | FLG_OF_EXEC))
1053 		return (1);
1054 
1055 	/*
1056 	 * If no relocation cache structures are available allocate
1057 	 * a new one and link it into the cache list.
1058 	 */
1059 	if ((ofl->ofl_outrels.tail == 0) ||
1060 	    ((rcp = (Rel_cache *)ofl->ofl_outrels.tail->data) == 0) ||
1061 	    ((orsp = rcp->rc_free) == rcp->rc_end)) {
1062 		static size_t	nextsize = 0;
1063 		size_t		size;
1064 
1065 		/*
1066 		 * Output relocation numbers can vary considerably between
1067 		 * building executables or shared objects (pic vs. non-pic),
1068 		 * etc.  But, they typically aren't very large, so for these
1069 		 * objects use a standard bucket size.  For building relocatable
1070 		 * objects, typically there will be an output relocation for
1071 		 * every input relocation.
1072 		 */
1073 		if (nextsize == 0) {
1074 			if (ofl->ofl_flags & FLG_OF_RELOBJ) {
1075 				if ((size = ofl->ofl_relocincnt) == 0)
1076 					size = REL_LOIDESCNO;
1077 				if (size > REL_HOIDESCNO)
1078 					nextsize = REL_HOIDESCNO;
1079 				else
1080 					nextsize = REL_LOIDESCNO;
1081 			} else
1082 				nextsize = size = REL_HOIDESCNO;
1083 		} else
1084 			size = nextsize;
1085 
1086 		size = size * sizeof (Rel_desc);
1087 
1088 		if (((rcp = libld_malloc(sizeof (Rel_cache) + size)) == 0) ||
1089 		    (list_appendc(&ofl->ofl_outrels, rcp) == 0))
1090 			return (S_ERROR);
1091 
1092 		/* LINTED */
1093 		rcp->rc_free = orsp = (Rel_desc *)(rcp + 1);
1094 		/* LINTED */
1095 		rcp->rc_end = (Rel_desc *)((char *)rcp->rc_free + size);
1096 	}
1097 
1098 	/*
1099 	 * If we are adding a output relocation against a section
1100 	 * symbol (non-RELATIVE) then mark that section.  These sections
1101 	 * will be added to the .dynsym symbol table.
1102 	 */
1103 	if (sdp && (rsp->rel_rtype != M_R_RELATIVE) &&
1104 	    ((flags & FLG_REL_SCNNDX) ||
1105 	    (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION))) {
1106 
1107 		/*
1108 		 * If this is a COMMON symbol - no output section
1109 		 * exists yet - (it's created as part of sym_validate()).
1110 		 * So - we mark here that when it's created it should
1111 		 * be tagged with the FLG_OS_OUTREL flag.
1112 		 */
1113 		if ((sdp->sd_flags & FLG_SY_SPECSEC) &&
1114 		    (sdp->sd_sym->st_shndx == SHN_COMMON)) {
1115 			if (ELF_ST_TYPE(sdp->sd_sym->st_info) != STT_TLS)
1116 				ofl->ofl_flags1 |= FLG_OF1_BSSOREL;
1117 			else
1118 				ofl->ofl_flags1 |= FLG_OF1_TLSOREL;
1119 		} else {
1120 			Os_desc	*osp = sdp->sd_isc->is_osdesc;
1121 
1122 			if (osp && ((osp->os_flags & FLG_OS_OUTREL) == 0)) {
1123 				ofl->ofl_dynshdrcnt++;
1124 				osp->os_flags |= FLG_OS_OUTREL;
1125 			}
1126 		}
1127 	}
1128 
1129 	*orsp = *rsp;
1130 	orsp->rel_flags |= flags;
1131 
1132 	rcp->rc_free++;
1133 	ofl->ofl_outrelscnt++;
1134 
1135 	if (flags & FLG_REL_GOT)
1136 		ofl->ofl_relocgotsz += (Xword)sizeof (Rel);
1137 	else if (flags & FLG_REL_PLT)
1138 		ofl->ofl_relocpltsz += (Xword)sizeof (Rel);
1139 	else if (flags & FLG_REL_BSS)
1140 		ofl->ofl_relocbsssz += (Xword)sizeof (Rel);
1141 	else if (flags & FLG_REL_NOINFO)
1142 		ofl->ofl_relocrelsz += (Xword)sizeof (Rel);
1143 	else
1144 		orsp->rel_osdesc->os_szoutrels += (Xword)sizeof (Rel);
1145 
1146 	if (orsp->rel_rtype == M_R_RELATIVE)
1147 		ofl->ofl_relocrelcnt++;
1148 
1149 	/*
1150 	 * We don't perform sorting on PLT relocations because
1151 	 * they have already been assigned a PLT index and if we
1152 	 * were to sort them we would have to re-assign the plt indexes.
1153 	 */
1154 	if (!(flags & FLG_REL_PLT))
1155 		ofl->ofl_reloccnt++;
1156 
1157 	/*
1158 	 * Insure a GLOBAL_OFFSET_TABLE is generated if required.
1159 	 */
1160 	if (IS_GOT_REQUIRED(orsp->rel_rtype))
1161 		ofl->ofl_flags |= FLG_OF_BLDGOT;
1162 
1163 	/*
1164 	 * Identify and possibly warn of a displacement relocation.
1165 	 */
1166 	if (orsp->rel_flags & FLG_REL_DISP) {
1167 		ofl->ofl_dtflags_1 |= DF_1_DISPRELPND;
1168 
1169 		if (ofl->ofl_flags & FLG_OF_VERBOSE)
1170 			ld_disp_errmsg(MSG_INTL(MSG_REL_DISPREL4), orsp, ofl);
1171 	}
1172 	DBG_CALL(Dbg_reloc_ors_entry(ofl->ofl_lml, ELF_DBG_LD, SHT_REL,
1173 	    M_MACH, orsp));
1174 	return (1);
1175 }
1176 
1177 /*
1178  * Stub routine since register symbols are not supported on i386.
1179  */
1180 /* ARGSUSED */
1181 uintptr_t
1182 ld_reloc_register(Rel_desc * rsp, Is_desc * isp, Ofl_desc * ofl)
1183 {
1184 	eprintf(ofl->ofl_lml, ERR_FATAL, MSG_INTL(MSG_REL_NOREG));
1185 	return (S_ERROR);
1186 }
1187 
1188 /*
1189  * process relocation for a LOCAL symbol
1190  */
1191 uintptr_t
1192 ld_reloc_local(Rel_desc * rsp, Ofl_desc * ofl)
1193 {
1194 	Word		flags = ofl->ofl_flags;
1195 	Sym_desc	*sdp = rsp->rel_sym;
1196 	Word		shndx = sdp->sd_sym->st_shndx;
1197 
1198 	/*
1199 	 * if ((shared object) and (not pc relative relocation) and
1200 	 *    (not against ABS symbol))
1201 	 * then
1202 	 *	build R_386_RELATIVE
1203 	 * fi
1204 	 */
1205 	if ((flags & FLG_OF_SHAROBJ) && (rsp->rel_flags & FLG_REL_LOAD) &&
1206 	    !(IS_PC_RELATIVE(rsp->rel_rtype)) && !(IS_SIZE(rsp->rel_rtype)) &&
1207 	    !(IS_GOT_BASED(rsp->rel_rtype)) &&
1208 	    !(rsp->rel_isdesc != NULL &&
1209 	    (rsp->rel_isdesc->is_shdr->sh_type == SHT_SUNW_dof)) &&
1210 	    (((sdp->sd_flags & FLG_SY_SPECSEC) == 0) ||
1211 	    (shndx != SHN_ABS) || (sdp->sd_aux && sdp->sd_aux->sa_symspec))) {
1212 		Word	ortype = rsp->rel_rtype;
1213 
1214 		rsp->rel_rtype = R_386_RELATIVE;
1215 		if (ld_add_outrel(NULL, rsp, ofl) == S_ERROR)
1216 			return (S_ERROR);
1217 		rsp->rel_rtype = ortype;
1218 	}
1219 
1220 	/*
1221 	 * If the relocation is against a 'non-allocatable' section
1222 	 * and we can not resolve it now - then give a warning
1223 	 * message.
1224 	 *
1225 	 * We can not resolve the symbol if either:
1226 	 *	a) it's undefined
1227 	 *	b) it's defined in a shared library and a
1228 	 *	   COPY relocation hasn't moved it to the executable
1229 	 *
1230 	 * Note: because we process all of the relocations against the
1231 	 *	text segment before any others - we know whether
1232 	 *	or not a copy relocation will be generated before
1233 	 *	we get here (see reloc_init()->reloc_segments()).
1234 	 */
1235 	if (!(rsp->rel_flags & FLG_REL_LOAD) &&
1236 	    ((shndx == SHN_UNDEF) ||
1237 	    ((sdp->sd_ref == REF_DYN_NEED) &&
1238 	    ((sdp->sd_flags & FLG_SY_MVTOCOMM) == 0)))) {
1239 		Conv_inv_buf_t inv_buf;
1240 
1241 		/*
1242 		 * If the relocation is against a SHT_SUNW_ANNOTATE
1243 		 * section - then silently ignore that the relocation
1244 		 * can not be resolved.
1245 		 */
1246 		if (rsp->rel_osdesc &&
1247 		    (rsp->rel_osdesc->os_shdr->sh_type == SHT_SUNW_ANNOTATE))
1248 			return (0);
1249 		eprintf(ofl->ofl_lml, ERR_WARNING, MSG_INTL(MSG_REL_EXTERNSYM),
1250 		    conv_reloc_386_type(rsp->rel_rtype, 0, &inv_buf),
1251 		    rsp->rel_isdesc->is_file->ifl_name,
1252 		    demangle(rsp->rel_sname), rsp->rel_osdesc->os_name);
1253 		return (1);
1254 	}
1255 
1256 	/*
1257 	 * Perform relocation.
1258 	 */
1259 	return (ld_add_actrel(NULL, rsp, ofl));
1260 }
1261 
1262 uintptr_t
1263 /* ARGSUSED */
1264 ld_reloc_GOTOP(Boolean local, Rel_desc * rsp, Ofl_desc * ofl)
1265 {
1266 	/*
1267 	 * Stub routine for common code compatibility, we shouldn't
1268 	 * actually get here on x86.
1269 	 */
1270 	assert(0);
1271 	return (S_ERROR);
1272 }
1273 
1274 uintptr_t
1275 ld_reloc_TLS(Boolean local, Rel_desc * rsp, Ofl_desc * ofl)
1276 {
1277 	Word		rtype = rsp->rel_rtype;
1278 	Sym_desc	*sdp = rsp->rel_sym;
1279 	Word		flags = ofl->ofl_flags;
1280 	Gotndx		*gnp;
1281 
1282 	/*
1283 	 * If we're building an executable - use either the IE or LE access
1284 	 * model.  If we're building a shared object process any IE model.
1285 	 */
1286 	if ((flags & FLG_OF_EXEC) || (IS_TLS_IE(rtype))) {
1287 		/*
1288 		 * Set the DF_STATIC_TLS flag.
1289 		 */
1290 		ofl->ofl_dtflags |= DF_STATIC_TLS;
1291 
1292 		if (!local || ((flags & FLG_OF_EXEC) == 0)) {
1293 			/*
1294 			 * Assign a GOT entry for static TLS references.
1295 			 */
1296 			if ((gnp = ld_find_gotndx(&(sdp->sd_GOTndxs),
1297 			    GOT_REF_TLSIE, ofl, 0)) == 0) {
1298 
1299 				if (ld_assign_got_TLS(local, rsp, ofl, sdp,
1300 				    gnp, GOT_REF_TLSIE, FLG_REL_STLS,
1301 				    rtype, R_386_TLS_TPOFF, 0) == S_ERROR)
1302 					return (S_ERROR);
1303 			}
1304 
1305 			/*
1306 			 * IE access model.
1307 			 */
1308 			if (IS_TLS_IE(rtype)) {
1309 				if (ld_add_actrel(FLG_REL_STLS,
1310 				    rsp, ofl) == S_ERROR)
1311 					return (S_ERROR);
1312 
1313 				/*
1314 				 * A non-pic shared object needs to adjust the
1315 				 * active relocation (indntpoff).
1316 				 */
1317 				if (((flags & FLG_OF_EXEC) == 0) &&
1318 				    (rtype == R_386_TLS_IE)) {
1319 					rsp->rel_rtype = R_386_RELATIVE;
1320 					return (ld_add_outrel(NULL, rsp, ofl));
1321 				}
1322 				return (1);
1323 			}
1324 
1325 			/*
1326 			 * Fixups are required for other executable models.
1327 			 */
1328 			return (ld_add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS),
1329 			    rsp, ofl));
1330 		}
1331 
1332 		/*
1333 		 * LE access model.
1334 		 */
1335 		if (IS_TLS_LE(rtype) || (rtype == R_386_TLS_LDO_32))
1336 			return (ld_add_actrel(FLG_REL_STLS, rsp, ofl));
1337 
1338 		return (ld_add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS),
1339 		    rsp, ofl));
1340 	}
1341 
1342 	/*
1343 	 * Building a shared object.
1344 	 *
1345 	 * Assign a GOT entry for a dynamic TLS reference.
1346 	 */
1347 	if (IS_TLS_LD(rtype) && ((gnp = ld_find_gotndx(&(sdp->sd_GOTndxs),
1348 	    GOT_REF_TLSLD, ofl, 0)) == 0)) {
1349 
1350 		if (ld_assign_got_TLS(local, rsp, ofl, sdp, gnp, GOT_REF_TLSLD,
1351 		    FLG_REL_MTLS, rtype, R_386_TLS_DTPMOD32, 0) == S_ERROR)
1352 			return (S_ERROR);
1353 
1354 	} else if (IS_TLS_GD(rtype) &&
1355 	    ((gnp = ld_find_gotndx(&(sdp->sd_GOTndxs), GOT_REF_TLSGD,
1356 	    ofl, 0)) == 0)) {
1357 
1358 		if (ld_assign_got_TLS(local, rsp, ofl, sdp, gnp, GOT_REF_TLSGD,
1359 		    FLG_REL_DTLS, rtype, R_386_TLS_DTPMOD32,
1360 		    R_386_TLS_DTPOFF32) == S_ERROR)
1361 			return (S_ERROR);
1362 	}
1363 
1364 	/*
1365 	 * For GD/LD TLS reference - TLS_{GD,LD}_CALL, this will eventually
1366 	 * cause a call to __tls_get_addr().  Convert this relocation to that
1367 	 * symbol now, and prepare for the PLT magic.
1368 	 */
1369 	if ((rtype == R_386_TLS_GD_PLT) || (rtype == R_386_TLS_LDM_PLT)) {
1370 		Sym_desc	*tlsgetsym;
1371 
1372 		if ((tlsgetsym = ld_sym_add_u(MSG_ORIG(MSG_SYM_TLSGETADDR_UU),
1373 		    ofl, MSG_STR_TLSREL)) == (Sym_desc *)S_ERROR)
1374 			return (S_ERROR);
1375 
1376 		rsp->rel_sym = tlsgetsym;
1377 		rsp->rel_sname = tlsgetsym->sd_name;
1378 		rsp->rel_rtype = R_386_PLT32;
1379 
1380 		if (ld_reloc_plt(rsp, ofl) == S_ERROR)
1381 			return (S_ERROR);
1382 
1383 		rsp->rel_sym = sdp;
1384 		rsp->rel_sname = sdp->sd_name;
1385 		rsp->rel_rtype = rtype;
1386 		return (1);
1387 	}
1388 
1389 	if (IS_TLS_LD(rtype))
1390 		return (ld_add_actrel(FLG_REL_MTLS, rsp, ofl));
1391 
1392 	return (ld_add_actrel(FLG_REL_DTLS, rsp, ofl));
1393 }
1394 
1395 /* ARGSUSED3 */
1396 Gotndx *
1397 ld_find_gotndx(List * lst, Gotref gref, Ofl_desc * ofl, Rel_desc * rdesc)
1398 {
1399 	Listnode *	lnp;
1400 	Gotndx *	gnp;
1401 
1402 	if ((gref == GOT_REF_TLSLD) && ofl->ofl_tlsldgotndx)
1403 		return (ofl->ofl_tlsldgotndx);
1404 
1405 	for (LIST_TRAVERSE(lst, lnp, gnp)) {
1406 		if (gnp->gn_gotref == gref)
1407 			return (gnp);
1408 	}
1409 	return ((Gotndx *)0);
1410 }
1411 
1412 Xword
1413 ld_calc_got_offset(Rel_desc * rdesc, Ofl_desc * ofl)
1414 {
1415 	Os_desc		*osp = ofl->ofl_osgot;
1416 	Sym_desc	*sdp = rdesc->rel_sym;
1417 	Xword		gotndx;
1418 	Gotref		gref;
1419 	Gotndx		*gnp;
1420 
1421 	if (rdesc->rel_flags & FLG_REL_DTLS)
1422 		gref = GOT_REF_TLSGD;
1423 	else if (rdesc->rel_flags & FLG_REL_MTLS)
1424 		gref = GOT_REF_TLSLD;
1425 	else if (rdesc->rel_flags & FLG_REL_STLS)
1426 		gref = GOT_REF_TLSIE;
1427 	else
1428 		gref = GOT_REF_GENERIC;
1429 
1430 	gnp = ld_find_gotndx(&(sdp->sd_GOTndxs), gref, ofl, 0);
1431 	assert(gnp);
1432 
1433 	gotndx = (Xword)gnp->gn_gotndx;
1434 
1435 	if ((rdesc->rel_flags & FLG_REL_DTLS) &&
1436 	    (rdesc->rel_rtype == R_386_TLS_DTPOFF32))
1437 		gotndx++;
1438 
1439 	return ((Xword)(osp->os_shdr->sh_addr + (gotndx * M_GOT_ENTSIZE)));
1440 }
1441 
1442 
1443 /* ARGSUSED4 */
1444 uintptr_t
1445 ld_assign_got_ndx(List * lst, Gotndx * pgnp, Gotref gref, Ofl_desc * ofl,
1446     Rel_desc * rsp, Sym_desc * sdp)
1447 {
1448 	Gotndx	*gnp;
1449 	uint_t	gotents;
1450 
1451 	if (pgnp)
1452 		return (1);
1453 
1454 	if ((gref == GOT_REF_TLSGD) || (gref == GOT_REF_TLSLD))
1455 		gotents = 2;
1456 	else
1457 		gotents = 1;
1458 
1459 	if ((gnp = libld_calloc(sizeof (Gotndx), 1)) == 0)
1460 		return (S_ERROR);
1461 	gnp->gn_gotndx = ofl->ofl_gotcnt;
1462 	gnp->gn_gotref = gref;
1463 
1464 	ofl->ofl_gotcnt += gotents;
1465 
1466 	if (gref == GOT_REF_TLSLD) {
1467 		ofl->ofl_tlsldgotndx = gnp;
1468 		return (1);
1469 	}
1470 
1471 	if (list_appendc(lst, (void *)gnp) == 0)
1472 		return (S_ERROR);
1473 
1474 	return (1);
1475 }
1476 
1477 void
1478 ld_assign_plt_ndx(Sym_desc * sdp, Ofl_desc *ofl)
1479 {
1480 	sdp->sd_aux->sa_PLTndx = 1 + ofl->ofl_pltcnt++;
1481 	sdp->sd_aux->sa_PLTGOTndx = ofl->ofl_gotcnt++;
1482 	ofl->ofl_flags |= FLG_OF_BLDGOT;
1483 }
1484 
1485 /*
1486  * Initializes .got[0] with the _DYNAMIC symbol value.
1487  */
1488 uintptr_t
1489 ld_fillin_gotplt(Ofl_desc *ofl)
1490 {
1491 	Word	flags = ofl->ofl_flags;
1492 
1493 	if (ofl->ofl_osgot) {
1494 		Sym_desc	*sdp;
1495 
1496 		if ((sdp = ld_sym_find(MSG_ORIG(MSG_SYM_DYNAMIC_U),
1497 		    SYM_NOHASH, 0, ofl)) != NULL) {
1498 			uchar_t	*genptr;
1499 
1500 			genptr = ((uchar_t *)ofl->ofl_osgot->os_outdata->d_buf +
1501 			    (M_GOT_XDYNAMIC * M_GOT_ENTSIZE));
1502 			/* LINTED */
1503 			*(Word *)genptr = (Word)sdp->sd_sym->st_value;
1504 		}
1505 	}
1506 
1507 	/*
1508 	 * Fill in the reserved slot in the procedure linkage table the first
1509 	 * entry is:
1510 	 *  if (building a.out) {
1511 	 *	PUSHL	got[1]		    # the address of the link map entry
1512 	 *	JMP *	got[2]		    # the address of rtbinder
1513 	 *  } else {
1514 	 *	PUSHL	got[1]@GOT(%ebx)    # the address of the link map entry
1515 	 *	JMP *	got[2]@GOT(%ebx)    # the address of rtbinder
1516 	 *  }
1517 	 */
1518 	if ((flags & FLG_OF_DYNAMIC) && ofl->ofl_osplt) {
1519 		uchar_t *pltent;
1520 
1521 		pltent = (uchar_t *)ofl->ofl_osplt->os_outdata->d_buf;
1522 		if (!(flags & FLG_OF_SHAROBJ)) {
1523 			pltent[0] = M_SPECIAL_INST;
1524 			pltent[1] = M_PUSHL_DISP;
1525 			pltent += 2;
1526 			/* LINTED */
1527 			*(Word *)pltent = (Word)(ofl->ofl_osgot->os_shdr->
1528 			    sh_addr + M_GOT_XLINKMAP * M_GOT_ENTSIZE);
1529 			pltent += 4;
1530 			pltent[0] = M_SPECIAL_INST;
1531 			pltent[1] = M_JMP_DISP_IND;
1532 			pltent += 2;
1533 			/* LINTED */
1534 			*(Word *)pltent = (Word)(ofl->ofl_osgot->os_shdr->
1535 			    sh_addr + M_GOT_XRTLD * M_GOT_ENTSIZE);
1536 		} else {
1537 			pltent[0] = M_SPECIAL_INST;
1538 			pltent[1] = M_PUSHL_REG_DISP;
1539 			pltent += 2;
1540 			/* LINTED */
1541 			*(Word *)pltent = (Word)(M_GOT_XLINKMAP *
1542 			    M_GOT_ENTSIZE);
1543 			pltent += 4;
1544 			pltent[0] = M_SPECIAL_INST;
1545 			pltent[1] = M_JMP_REG_DISP_IND;
1546 			pltent += 2;
1547 			/* LINTED */
1548 			*(Word *)pltent = (Word)(M_GOT_XRTLD *
1549 			    M_GOT_ENTSIZE);
1550 		}
1551 	}
1552 	return (1);
1553 }
1554