xref: /titanic_50/usr/src/cmd/sgs/rtld/i386/i386_elf.c (revision a24e89c4a1eec8361718d94a6275e6720643284e)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  *	Copyright (c) 1988 AT&T
29  *	  All Rights Reserved
30  */
31 
32 /*
33  * x86 machine dependent and ELF file class dependent functions.
34  * Contains routines for performing function binding and symbol relocations.
35  */
36 
37 #include	<stdio.h>
38 #include	<sys/elf.h>
39 #include	<sys/elf_386.h>
40 #include	<sys/mman.h>
41 #include	<dlfcn.h>
42 #include	<synch.h>
43 #include	<string.h>
44 #include	<debug.h>
45 #include	<reloc.h>
46 #include	<conv.h>
47 #include	"_rtld.h"
48 #include	"_audit.h"
49 #include	"_elf.h"
50 #include	"_inline.h"
51 #include	"msg.h"
52 
53 extern void	elf_rtbndr(Rt_map *, ulong_t, caddr_t);
54 
55 int
56 elf_mach_flags_check(Rej_desc *rej, Ehdr *ehdr)
57 {
58 	/*
59 	 * Check machine type and flags.
60 	 */
61 	if (ehdr->e_flags != 0) {
62 		rej->rej_type = SGS_REJ_BADFLAG;
63 		rej->rej_info = (uint_t)ehdr->e_flags;
64 		return (0);
65 	}
66 	return (1);
67 }
68 
69 void
70 ldso_plt_init(Rt_map *lmp)
71 {
72 	/*
73 	 * There is no need to analyze ld.so because we don't map in any of
74 	 * its dependencies.  However we may map these dependencies in later
75 	 * (as if ld.so had dlopened them), so initialize the plt and the
76 	 * permission information.
77 	 */
78 	if (PLTGOT(lmp))
79 		elf_plt_init((PLTGOT(lmp)), (caddr_t)lmp);
80 }
81 
82 static const uchar_t dyn_plt_template[] = {
83 /* 0x00 */  0x55,				/* pushl %ebp */
84 /* 0x01 */  0x8b, 0xec,				/* movl %esp, %ebp */
85 /* 0x03 */  0x68, 0x00, 0x00, 0x00, 0x00,	/* pushl trace_fields */
86 /* 0x08 */  0xe9, 0xfc, 0xff, 0xff, 0xff, 0xff	/* jmp  elf_plt_trace */
87 };
88 int	dyn_plt_ent_size = sizeof (dyn_plt_template);
89 
90 /*
91  * the dynamic plt entry is:
92  *
93  *	pushl	%ebp
94  *	movl	%esp, %ebp
95  *	pushl	tfp
96  *	jmp	elf_plt_trace
97  * dyn_data:
98  *	.align  4
99  *	uintptr_t	reflmp
100  *	uintptr_t	deflmp
101  *	uint_t		symndx
102  *	uint_t		sb_flags
103  *	Sym		symdef
104  */
105 static caddr_t
106 elf_plt_trace_write(uint_t roffset, Rt_map *rlmp, Rt_map *dlmp, Sym *sym,
107     uint_t symndx, uint_t pltndx, caddr_t to, uint_t sb_flags, int *fail)
108 {
109 	extern int	elf_plt_trace();
110 	ulong_t		got_entry;
111 	uchar_t		*dyn_plt;
112 	uintptr_t	*dyndata;
113 
114 	/*
115 	 * We only need to add the glue code if there is an auditing
116 	 * library that is interested in this binding.
117 	 */
118 	dyn_plt = (uchar_t *)((uintptr_t)AUDINFO(rlmp)->ai_dynplts +
119 	    (pltndx * dyn_plt_ent_size));
120 
121 	/*
122 	 * Have we initialized this dynamic plt entry yet?  If we haven't do it
123 	 * now.  Otherwise this function has been called before, but from a
124 	 * different plt (ie. from another shared object).  In that case
125 	 * we just set the plt to point to the new dyn_plt.
126 	 */
127 	if (*dyn_plt == 0) {
128 		Sym	*symp;
129 		Word	symvalue;
130 		Lm_list	*lml = LIST(rlmp);
131 
132 		(void) memcpy((void *)dyn_plt, dyn_plt_template,
133 		    sizeof (dyn_plt_template));
134 		dyndata = (uintptr_t *)((uintptr_t)dyn_plt +
135 		    ROUND(sizeof (dyn_plt_template), M_WORD_ALIGN));
136 
137 		/*
138 		 * relocate:
139 		 *	pushl	dyn_data
140 		 */
141 		symvalue = (Word)dyndata;
142 		if (do_reloc_rtld(R_386_32, &dyn_plt[4], &symvalue,
143 		    MSG_ORIG(MSG_SYM_LADYNDATA),
144 		    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
145 			*fail = 1;
146 			return (0);
147 		}
148 
149 		/*
150 		 * jmps are relative, so I need to figure out the relative
151 		 * address to elf_plt_trace.
152 		 *
153 		 * relocating:
154 		 *	jmp	elf_plt_trace
155 		 */
156 		symvalue = (ulong_t)(elf_plt_trace) - (ulong_t)(dyn_plt + 9);
157 		if (do_reloc_rtld(R_386_PC32, &dyn_plt[9], &symvalue,
158 		    MSG_ORIG(MSG_SYM_ELFPLTTRACE),
159 		    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
160 			*fail = 1;
161 			return (0);
162 		}
163 
164 		*dyndata++ = (uintptr_t)rlmp;
165 		*dyndata++ = (uintptr_t)dlmp;
166 		*dyndata++ = (uint_t)symndx;
167 		*dyndata++ = (uint_t)sb_flags;
168 		symp = (Sym *)dyndata;
169 		*symp = *sym;
170 		symp->st_name += (Word)STRTAB(dlmp);
171 		symp->st_value = (Addr)to;
172 	}
173 
174 	got_entry = (ulong_t)roffset;
175 	*(ulong_t *)got_entry = (ulong_t)dyn_plt;
176 	return ((caddr_t)dyn_plt);
177 }
178 
179 /*
180  * Function binding routine - invoked on the first call to a function through
181  * the procedure linkage table;
182  * passes first through an assembly language interface.
183  *
184  * Takes the offset into the relocation table of the associated
185  * relocation entry and the address of the link map (rt_private_map struct)
186  * for the entry.
187  *
188  * Returns the address of the function referenced after re-writing the PLT
189  * entry to invoke the function directly.
190  *
191  * On error, causes process to terminate with a signal.
192  */
193 ulong_t
194 elf_bndr(Rt_map *lmp, ulong_t reloff, caddr_t from)
195 {
196 	Rt_map		*nlmp, *llmp;
197 	ulong_t		addr, symval, rsymndx;
198 	char		*name;
199 	Rel		*rptr;
200 	Sym		*rsym, *nsym;
201 	uint_t		binfo, sb_flags = 0, dbg_class;
202 	Slookup		sl;
203 	int		entry, lmflags;
204 	Lm_list		*lml;
205 
206 	/*
207 	 * For compatibility with libthread (TI_VERSION 1) we track the entry
208 	 * value.  A zero value indicates we have recursed into ld.so.1 to
209 	 * further process a locking request.  Under this recursion we disable
210 	 * tsort and cleanup activities.
211 	 */
212 	entry = enter(0);
213 
214 	lml = LIST(lmp);
215 	if ((lmflags = lml->lm_flags) & LML_FLG_RTLDLM) {
216 		dbg_class = dbg_desc->d_class;
217 		dbg_desc->d_class = 0;
218 	}
219 
220 	/*
221 	 * Perform some basic sanity checks.  If we didn't get a load map or
222 	 * the relocation offset is invalid then its possible someone has walked
223 	 * over the .got entries or jumped to plt0 out of the blue.
224 	 */
225 	if (!lmp || ((reloff % sizeof (Rel)) != 0)) {
226 		Conv_inv_buf_t inv_buf;
227 
228 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_PLTREF),
229 		    conv_reloc_386_type(R_386_JMP_SLOT, 0, &inv_buf),
230 		    EC_NATPTR(lmp), EC_XWORD(reloff), EC_NATPTR(from));
231 		rtldexit(lml, 1);
232 	}
233 
234 	/*
235 	 * Use relocation entry to get symbol table entry and symbol name.
236 	 */
237 	addr = (ulong_t)JMPREL(lmp);
238 	rptr = (Rel *)(addr + reloff);
239 	rsymndx = ELF_R_SYM(rptr->r_info);
240 	rsym = (Sym *)((ulong_t)SYMTAB(lmp) + (rsymndx * SYMENT(lmp)));
241 	name = (char *)(STRTAB(lmp) + rsym->st_name);
242 
243 	/*
244 	 * Determine the last link-map of this list, this'll be the starting
245 	 * point for any tsort() processing.
246 	 */
247 	llmp = lml->lm_tail;
248 
249 	/*
250 	 * Find definition for symbol.  Initialize the symbol lookup data
251 	 * structure.
252 	 */
253 	SLOOKUP_INIT(sl, name, lmp, lml->lm_head, ld_entry_cnt, 0,
254 	    rsymndx, rsym, 0, LKUP_DEFT);
255 
256 	if ((nsym = lookup_sym(&sl, &nlmp, &binfo, NULL)) == 0) {
257 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_NOSYM), NAME(lmp),
258 		    demangle(name));
259 		rtldexit(lml, 1);
260 	}
261 
262 	symval = nsym->st_value;
263 	if (!(FLAGS(nlmp) & FLG_RT_FIXED) &&
264 	    (nsym->st_shndx != SHN_ABS))
265 		symval += ADDR(nlmp);
266 	if ((lmp != nlmp) && ((FLAGS1(nlmp) & FL1_RT_NOINIFIN) == 0)) {
267 		/*
268 		 * Record that this new link map is now bound to the caller.
269 		 */
270 		if (bind_one(lmp, nlmp, BND_REFER) == 0)
271 			rtldexit(lml, 1);
272 	}
273 
274 	if ((lml->lm_tflags | AFLAGS(lmp)) & LML_TFLG_AUD_SYMBIND) {
275 		uint_t	symndx = (((uintptr_t)nsym -
276 		    (uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp));
277 		symval = audit_symbind(lmp, nlmp, nsym, symndx, symval,
278 		    &sb_flags);
279 	}
280 
281 	if (!(rtld_flags & RT_FL_NOBIND)) {
282 		addr = rptr->r_offset;
283 		if (!(FLAGS(lmp) & FLG_RT_FIXED))
284 			addr += ADDR(lmp);
285 		if (((lml->lm_tflags | AFLAGS(lmp)) &
286 		    (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) &&
287 		    AUDINFO(lmp)->ai_dynplts) {
288 			int	fail = 0;
289 			uint_t	pltndx = reloff / sizeof (Rel);
290 			uint_t	symndx = (((uintptr_t)nsym -
291 			    (uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp));
292 
293 			symval = (ulong_t)elf_plt_trace_write(addr, lmp, nlmp,
294 			    nsym, symndx, pltndx, (caddr_t)symval, sb_flags,
295 			    &fail);
296 			if (fail)
297 				rtldexit(lml, 1);
298 		} else {
299 			/*
300 			 * Write standard PLT entry to jump directly
301 			 * to newly bound function.
302 			 */
303 			*(ulong_t *)addr = symval;
304 		}
305 	}
306 
307 	/*
308 	 * Print binding information and rebuild PLT entry.
309 	 */
310 	DBG_CALL(Dbg_bind_global(lmp, (Addr)from, (Off)(from - ADDR(lmp)),
311 	    (Xword)(reloff / sizeof (Rel)), PLT_T_FULL, nlmp, (Addr)symval,
312 	    nsym->st_value, name, binfo));
313 
314 	/*
315 	 * Complete any processing for newly loaded objects.  Note we don't
316 	 * know exactly where any new objects are loaded (we know the object
317 	 * that supplied the symbol, but others may have been loaded lazily as
318 	 * we searched for the symbol), so sorting starts from the last
319 	 * link-map know on entry to this routine.
320 	 */
321 	if (entry)
322 		load_completion(llmp);
323 
324 	/*
325 	 * Some operations like dldump() or dlopen()'ing a relocatable object
326 	 * result in objects being loaded on rtld's link-map, make sure these
327 	 * objects are initialized also.
328 	 */
329 	if ((LIST(nlmp)->lm_flags & LML_FLG_RTLDLM) && LIST(nlmp)->lm_init)
330 		load_completion(nlmp);
331 
332 	/*
333 	 * Make sure the object to which we've bound has had it's .init fired.
334 	 * Cleanup before return to user code.
335 	 */
336 	if (entry) {
337 		is_dep_init(nlmp, lmp);
338 		leave(lml, 0);
339 	}
340 
341 	if (lmflags & LML_FLG_RTLDLM)
342 		dbg_desc->d_class = dbg_class;
343 
344 	return (symval);
345 }
346 
347 /*
348  * Read and process the relocations for one link object, we assume all
349  * relocation sections for loadable segments are stored contiguously in
350  * the file.
351  */
352 int
353 elf_reloc(Rt_map *lmp, uint_t plt, int *in_nfavl, APlist **textrel)
354 {
355 	ulong_t		relbgn, relend, relsiz, basebgn, pltbgn, pltend;
356 	ulong_t		_pltbgn, _pltend;
357 	ulong_t		dsymndx, roffset, rsymndx, psymndx = 0;
358 	uchar_t		rtype;
359 	long		value, pvalue;
360 	Sym		*symref, *psymref, *symdef, *psymdef;
361 	char		*name, *pname;
362 	Rt_map		*_lmp, *plmp;
363 	int		ret = 1, noplt = 0;
364 	int		relacount = RELACOUNT(lmp), plthint = 0;
365 	Rel		*rel;
366 	uint_t		binfo, pbinfo;
367 	APlist		*bound = NULL;
368 
369 	/*
370 	 * Although only necessary for lazy binding, initialize the first
371 	 * global offset entry to go to elf_rtbndr().  dbx(1) seems
372 	 * to find this useful.
373 	 */
374 	if ((plt == 0) && PLTGOT(lmp)) {
375 		mmapobj_result_t	*mpp;
376 
377 		/*
378 		 * Make sure the segment is writable.
379 		 */
380 		if ((((mpp =
381 		    find_segment((caddr_t)PLTGOT(lmp), lmp)) != NULL) &&
382 		    ((mpp->mr_prot & PROT_WRITE) == 0)) &&
383 		    ((set_prot(lmp, mpp, 1) == 0) ||
384 		    (aplist_append(textrel, mpp, AL_CNT_TEXTREL) == NULL)))
385 			return (0);
386 
387 		elf_plt_init(PLTGOT(lmp), (caddr_t)lmp);
388 	}
389 
390 	/*
391 	 * Initialize the plt start and end addresses.
392 	 */
393 	if ((pltbgn = (ulong_t)JMPREL(lmp)) != 0)
394 		pltend = pltbgn + (ulong_t)(PLTRELSZ(lmp));
395 
396 	relsiz = (ulong_t)(RELENT(lmp));
397 	basebgn = ADDR(lmp);
398 
399 	if (PLTRELSZ(lmp))
400 		plthint = PLTRELSZ(lmp) / relsiz;
401 
402 	/*
403 	 * If we've been called upon to promote an RTLD_LAZY object to an
404 	 * RTLD_NOW then we're only interested in scaning the .plt table.
405 	 * An uninitialized .plt is the case where the associated got entry
406 	 * points back to the plt itself.  Determine the range of the real .plt
407 	 * entries using the _PROCEDURE_LINKAGE_TABLE_ symbol.
408 	 */
409 	if (plt) {
410 		Slookup	sl;
411 
412 		relbgn = pltbgn;
413 		relend = pltend;
414 		if (!relbgn || (relbgn == relend))
415 			return (1);
416 
417 		/*
418 		 * Initialize the symbol lookup data structure.
419 		 */
420 		SLOOKUP_INIT(sl, MSG_ORIG(MSG_SYM_PLT), lmp, lmp, ld_entry_cnt,
421 		    elf_hash(MSG_ORIG(MSG_SYM_PLT)), 0, 0, 0, LKUP_DEFT);
422 
423 		if ((symdef = elf_find_sym(&sl, &_lmp, &binfo, NULL)) == 0)
424 			return (1);
425 
426 		_pltbgn = symdef->st_value;
427 		if (!(FLAGS(lmp) & FLG_RT_FIXED) &&
428 		    (symdef->st_shndx != SHN_ABS))
429 			_pltbgn += basebgn;
430 		_pltend = _pltbgn + (((PLTRELSZ(lmp) / relsiz)) *
431 		    M_PLT_ENTSIZE) + M_PLT_RESERVSZ;
432 
433 	} else {
434 		/*
435 		 * The relocation sections appear to the run-time linker as a
436 		 * single table.  Determine the address of the beginning and end
437 		 * of this table.  There are two different interpretations of
438 		 * the ABI at this point:
439 		 *
440 		 *   o	The REL table and its associated RELSZ indicate the
441 		 *	concatenation of *all* relocation sections (this is the
442 		 *	model our link-editor constructs).
443 		 *
444 		 *   o	The REL table and its associated RELSZ indicate the
445 		 *	concatenation of all *but* the .plt relocations.  These
446 		 *	relocations are specified individually by the JMPREL and
447 		 *	PLTRELSZ entries.
448 		 *
449 		 * Determine from our knowledege of the relocation range and
450 		 * .plt range, the range of the total relocation table.  Note
451 		 * that one other ABI assumption seems to be that the .plt
452 		 * relocations always follow any other relocations, the
453 		 * following range checking drops that assumption.
454 		 */
455 		relbgn = (ulong_t)(REL(lmp));
456 		relend = relbgn + (ulong_t)(RELSZ(lmp));
457 		if (pltbgn) {
458 			if (!relbgn || (relbgn > pltbgn))
459 				relbgn = pltbgn;
460 			if (!relbgn || (relend < pltend))
461 				relend = pltend;
462 		}
463 	}
464 	if (!relbgn || (relbgn == relend)) {
465 		DBG_CALL(Dbg_reloc_run(lmp, 0, plt, DBG_REL_NONE));
466 		return (1);
467 	}
468 	DBG_CALL(Dbg_reloc_run(lmp, M_REL_SHT_TYPE, plt, DBG_REL_START));
469 
470 	/*
471 	 * If we're processing a dynamic executable in lazy mode there is no
472 	 * need to scan the .rel.plt table, however if we're processing a shared
473 	 * object in lazy mode the .got addresses associated to each .plt must
474 	 * be relocated to reflect the location of the shared object.
475 	 */
476 	if (pltbgn && ((MODE(lmp) & RTLD_NOW) == 0) &&
477 	    (FLAGS(lmp) & FLG_RT_FIXED))
478 		noplt = 1;
479 
480 	/*
481 	 * Loop through relocations.
482 	 */
483 	while (relbgn < relend) {
484 		mmapobj_result_t	*mpp;
485 		uint_t			sb_flags = 0;
486 
487 		rtype = ELF_R_TYPE(((Rel *)relbgn)->r_info, M_MACH);
488 
489 		/*
490 		 * If this is a RELATIVE relocation in a shared object (the
491 		 * common case), and if we are not debugging, then jump into a
492 		 * tighter relocation loop (elf_reloc_relative).
493 		 */
494 		if ((rtype == R_386_RELATIVE) &&
495 		    ((FLAGS(lmp) & FLG_RT_FIXED) == 0) && (DBG_ENABLED == 0)) {
496 			if (relacount) {
497 				relbgn = elf_reloc_relative_count(relbgn,
498 				    relacount, relsiz, basebgn, lmp, textrel);
499 				relacount = 0;
500 			} else {
501 				relbgn = elf_reloc_relative(relbgn, relend,
502 				    relsiz, basebgn, lmp, textrel);
503 			}
504 			if (relbgn >= relend)
505 				break;
506 			rtype = ELF_R_TYPE(((Rel *)relbgn)->r_info, M_MACH);
507 		}
508 
509 		roffset = ((Rel *)relbgn)->r_offset;
510 
511 		/*
512 		 * If this is a shared object, add the base address to offset.
513 		 */
514 		if (!(FLAGS(lmp) & FLG_RT_FIXED)) {
515 			/*
516 			 * If we're processing lazy bindings, we have to step
517 			 * through the plt entries and add the base address
518 			 * to the corresponding got entry.
519 			 */
520 			if (plthint && (plt == 0) &&
521 			    (rtype == R_386_JMP_SLOT) &&
522 			    ((MODE(lmp) & RTLD_NOW) == 0)) {
523 				relbgn = elf_reloc_relative_count(relbgn,
524 				    plthint, relsiz, basebgn, lmp, textrel);
525 				plthint = 0;
526 				continue;
527 			}
528 			roffset += basebgn;
529 		}
530 
531 		rsymndx = ELF_R_SYM(((Rel *)relbgn)->r_info);
532 		rel = (Rel *)relbgn;
533 		relbgn += relsiz;
534 
535 		/*
536 		 * Optimizations.
537 		 */
538 		if (rtype == R_386_NONE)
539 			continue;
540 		if (noplt && ((ulong_t)rel >= pltbgn) &&
541 		    ((ulong_t)rel < pltend)) {
542 			relbgn = pltend;
543 			continue;
544 		}
545 
546 		/*
547 		 * If we're promoting plts, determine if this one has already
548 		 * been written.
549 		 */
550 		if (plt && ((*(ulong_t *)roffset < _pltbgn) ||
551 		    (*(ulong_t *)roffset > _pltend)))
552 			continue;
553 
554 		/*
555 		 * If this relocation is not against part of the image
556 		 * mapped into memory we skip it.
557 		 */
558 		if ((mpp = find_segment((caddr_t)roffset, lmp)) == NULL) {
559 			elf_reloc_bad(lmp, (void *)rel, rtype, roffset,
560 			    rsymndx);
561 			continue;
562 		}
563 
564 		binfo = 0;
565 		/*
566 		 * If a symbol index is specified then get the symbol table
567 		 * entry, locate the symbol definition, and determine its
568 		 * address.
569 		 */
570 		if (rsymndx) {
571 			/*
572 			 * Get the local symbol table entry.
573 			 */
574 			symref = (Sym *)((ulong_t)SYMTAB(lmp) +
575 			    (rsymndx * SYMENT(lmp)));
576 
577 			/*
578 			 * If this is a local symbol, just use the base address.
579 			 * (we should have no local relocations in the
580 			 * executable).
581 			 */
582 			if (ELF_ST_BIND(symref->st_info) == STB_LOCAL) {
583 				value = basebgn;
584 				name = (char *)0;
585 
586 				/*
587 				 * Special case TLS relocations.
588 				 */
589 				if (rtype == R_386_TLS_DTPMOD32) {
590 					/*
591 					 * Use the TLS modid.
592 					 */
593 					value = TLSMODID(lmp);
594 
595 				} else if (rtype == R_386_TLS_TPOFF) {
596 					if ((value = elf_static_tls(lmp, symref,
597 					    rel, rtype, 0, roffset, 0)) == 0) {
598 						ret = 0;
599 						break;
600 					}
601 				}
602 			} else {
603 				/*
604 				 * If the symbol index is equal to the previous
605 				 * symbol index relocation we processed then
606 				 * reuse the previous values. (Note that there
607 				 * have been cases where a relocation exists
608 				 * against a copy relocation symbol, our ld(1)
609 				 * should optimize this away, but make sure we
610 				 * don't use the same symbol information should
611 				 * this case exist).
612 				 */
613 				if ((rsymndx == psymndx) &&
614 				    (rtype != R_386_COPY)) {
615 					/* LINTED */
616 					if (psymdef == 0) {
617 						DBG_CALL(Dbg_bind_weak(lmp,
618 						    (Addr)roffset, (Addr)
619 						    (roffset - basebgn), name));
620 						continue;
621 					}
622 					/* LINTED */
623 					value = pvalue;
624 					/* LINTED */
625 					name = pname;
626 					/* LINTED */
627 					symdef = psymdef;
628 					/* LINTED */
629 					symref = psymref;
630 					/* LINTED */
631 					_lmp = plmp;
632 					/* LINTED */
633 					binfo = pbinfo;
634 
635 					if ((LIST(_lmp)->lm_tflags |
636 					    AFLAGS(_lmp)) &
637 					    LML_TFLG_AUD_SYMBIND) {
638 						value = audit_symbind(lmp, _lmp,
639 						    /* LINTED */
640 						    symdef, dsymndx, value,
641 						    &sb_flags);
642 					}
643 				} else {
644 					Slookup		sl;
645 
646 					/*
647 					 * Lookup the symbol definition.
648 					 * Initialize the symbol lookup data
649 					 * structure.
650 					 */
651 					name = (char *)(STRTAB(lmp) +
652 					    symref->st_name);
653 
654 					SLOOKUP_INIT(sl, name, lmp, 0,
655 					    ld_entry_cnt, 0, rsymndx, symref,
656 					    rtype, LKUP_STDRELOC);
657 
658 					symdef = lookup_sym(&sl, &_lmp,
659 					    &binfo, in_nfavl);
660 
661 					/*
662 					 * If the symbol is not found and the
663 					 * reference was not to a weak symbol,
664 					 * report an error.  Weak references
665 					 * may be unresolved.
666 					 */
667 					/* BEGIN CSTYLED */
668 					if (symdef == 0) {
669 					    if (sl.sl_bind != STB_WEAK) {
670 						if (elf_reloc_error(lmp, name,
671 						    rel, binfo))
672 							continue;
673 
674 					   	ret = 0;
675 						break;
676 
677 					    } else {
678 						psymndx = rsymndx;
679 						psymdef = 0;
680 
681 						DBG_CALL(Dbg_bind_weak(lmp,
682 						    (Addr)roffset, (Addr)
683 						    (roffset - basebgn), name));
684 						continue;
685 					    }
686 					}
687 					/* END CSTYLED */
688 
689 					/*
690 					 * If symbol was found in an object
691 					 * other than the referencing object
692 					 * then record the binding.
693 					 */
694 					if ((lmp != _lmp) && ((FLAGS1(_lmp) &
695 					    FL1_RT_NOINIFIN) == 0)) {
696 						if (aplist_test(&bound, _lmp,
697 						    AL_CNT_RELBIND) == 0) {
698 							ret = 0;
699 							break;
700 						}
701 					}
702 
703 					/*
704 					 * Calculate the location of definition;
705 					 * symbol value plus base address of
706 					 * containing shared object.
707 					 */
708 					if (IS_SIZE(rtype))
709 						value = symdef->st_size;
710 					else
711 						value = symdef->st_value;
712 
713 					if (!(FLAGS(_lmp) & FLG_RT_FIXED) &&
714 					    !(IS_SIZE(rtype)) &&
715 					    (symdef->st_shndx != SHN_ABS) &&
716 					    (ELF_ST_TYPE(symdef->st_info) !=
717 					    STT_TLS))
718 						value += ADDR(_lmp);
719 
720 					/*
721 					 * Retain this symbol index and the
722 					 * value in case it can be used for the
723 					 * subsequent relocations.
724 					 */
725 					if (rtype != R_386_COPY) {
726 						psymndx = rsymndx;
727 						pvalue = value;
728 						pname = name;
729 						psymdef = symdef;
730 						psymref = symref;
731 						plmp = _lmp;
732 						pbinfo = binfo;
733 					}
734 					if ((LIST(_lmp)->lm_tflags |
735 					    AFLAGS(_lmp)) &
736 					    LML_TFLG_AUD_SYMBIND) {
737 						dsymndx = (((uintptr_t)symdef -
738 						    (uintptr_t)SYMTAB(_lmp)) /
739 						    SYMENT(_lmp));
740 						value = audit_symbind(lmp, _lmp,
741 						    symdef, dsymndx, value,
742 						    &sb_flags);
743 					}
744 				}
745 
746 				/*
747 				 * If relocation is PC-relative, subtract
748 				 * offset address.
749 				 */
750 				if (IS_PC_RELATIVE(rtype))
751 					value -= roffset;
752 
753 				/*
754 				 * Special case TLS relocations.
755 				 */
756 				if (rtype == R_386_TLS_DTPMOD32) {
757 					/*
758 					 * Relocation value is the TLS modid.
759 					 */
760 					value = TLSMODID(_lmp);
761 
762 				} else if (rtype == R_386_TLS_TPOFF) {
763 					if ((value = elf_static_tls(_lmp,
764 					    symdef, rel, rtype, name, roffset,
765 					    value)) == 0) {
766 						ret = 0;
767 						break;
768 					}
769 				}
770 			}
771 		} else {
772 			/*
773 			 * Special cases.
774 			 */
775 			if (rtype == R_386_TLS_DTPMOD32) {
776 				/*
777 				 * TLS relocation value is the TLS modid.
778 				 */
779 				value = TLSMODID(lmp);
780 			} else
781 				value = basebgn;
782 			name = (char *)0;
783 		}
784 
785 		DBG_CALL(Dbg_reloc_in(LIST(lmp), ELF_DBG_RTLD, M_MACH,
786 		    M_REL_SHT_TYPE, rel, NULL, 0, name));
787 
788 		/*
789 		 * Make sure the segment is writable.
790 		 */
791 		if (((mpp->mr_prot & PROT_WRITE) == 0) &&
792 		    ((set_prot(lmp, mpp, 1) == 0) ||
793 		    (aplist_append(textrel, mpp, AL_CNT_TEXTREL) == NULL))) {
794 			ret = 0;
795 			break;
796 		}
797 
798 		/*
799 		 * Call relocation routine to perform required relocation.
800 		 */
801 		switch (rtype) {
802 		case R_386_COPY:
803 			if (elf_copy_reloc(name, symref, lmp, (void *)roffset,
804 			    symdef, _lmp, (const void *)value) == 0)
805 				ret = 0;
806 			break;
807 		case R_386_JMP_SLOT:
808 			if (((LIST(lmp)->lm_tflags | AFLAGS(lmp)) &
809 			    (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) &&
810 			    AUDINFO(lmp)->ai_dynplts) {
811 				int	fail = 0;
812 				int	pltndx = (((ulong_t)rel -
813 				    (uintptr_t)JMPREL(lmp)) / relsiz);
814 				int	symndx = (((uintptr_t)symdef -
815 				    (uintptr_t)SYMTAB(_lmp)) / SYMENT(_lmp));
816 
817 				(void) elf_plt_trace_write(roffset, lmp, _lmp,
818 				    symdef, symndx, pltndx, (caddr_t)value,
819 				    sb_flags, &fail);
820 				if (fail)
821 					ret = 0;
822 			} else {
823 				/*
824 				 * Write standard PLT entry to jump directly
825 				 * to newly bound function.
826 				 */
827 				DBG_CALL(Dbg_reloc_apply_val(LIST(lmp),
828 				    ELF_DBG_RTLD, (Xword)roffset,
829 				    (Xword)value));
830 				*(ulong_t *)roffset = value;
831 			}
832 			break;
833 		default:
834 			/*
835 			 * Write the relocation out.
836 			 */
837 			if (do_reloc_rtld(rtype, (uchar_t *)roffset,
838 			    (Word *)&value, name, NAME(lmp), LIST(lmp)) == 0)
839 				ret = 0;
840 
841 			DBG_CALL(Dbg_reloc_apply_val(LIST(lmp), ELF_DBG_RTLD,
842 			    (Xword)roffset, (Xword)value));
843 		}
844 
845 		if ((ret == 0) &&
846 		    ((LIST(lmp)->lm_flags & LML_FLG_TRC_WARN) == 0))
847 			break;
848 
849 		if (binfo) {
850 			DBG_CALL(Dbg_bind_global(lmp, (Addr)roffset,
851 			    (Off)(roffset - basebgn), (Xword)(-1), PLT_T_FULL,
852 			    _lmp, (Addr)value, symdef->st_value, name, binfo));
853 		}
854 	}
855 
856 	return (relocate_finish(lmp, bound, ret));
857 }
858 
859 /*
860  * Initialize the first few got entries so that function calls go to
861  * elf_rtbndr:
862  *
863  *	GOT[GOT_XLINKMAP] =	the address of the link map
864  *	GOT[GOT_XRTLD] =	the address of rtbinder
865  */
866 void
867 elf_plt_init(void *got, caddr_t l)
868 {
869 	uint_t		*_got;
870 	/* LINTED */
871 	Rt_map		*lmp = (Rt_map *)l;
872 
873 	_got = (uint_t *)got + M_GOT_XLINKMAP;
874 	*_got = (uint_t)lmp;
875 	_got = (uint_t *)got + M_GOT_XRTLD;
876 	*_got = (uint_t)elf_rtbndr;
877 }
878 
879 /*
880  * For SVR4 Intel compatability.  USL uses /usr/lib/libc.so.1 as the run-time
881  * linker, so the interpreter's address will differ from /usr/lib/ld.so.1.
882  * Further, USL has special _iob[] and _ctype[] processing that makes up for the
883  * fact that these arrays do not have associated copy relocations.  So we try
884  * and make up for that here.  Any relocations found will be added to the global
885  * copy relocation list and will be processed in setup().
886  */
887 static int
888 _elf_copy_reloc(const char *name, Rt_map *rlmp, Rt_map *dlmp)
889 {
890 	Sym		*symref, *symdef;
891 	caddr_t 	ref, def;
892 	Rt_map		*_lmp;
893 	Rel		rel;
894 	Slookup		sl;
895 	uint_t		binfo;
896 
897 	/*
898 	 * Determine if the special symbol exists as a reference in the dynamic
899 	 * executable, and that an associated definition exists in libc.so.1.
900 	 *
901 	 * Initialize the symbol lookup data structure.
902 	 */
903 	SLOOKUP_INIT(sl, name, rlmp, rlmp, ld_entry_cnt, 0, 0, 0, 0,
904 	    LKUP_FIRST);
905 
906 	if ((symref = lookup_sym(&sl, &_lmp, &binfo, NULL)) == 0)
907 		return (1);
908 
909 	sl.sl_imap = dlmp;
910 	sl.sl_flags = LKUP_DEFT;
911 
912 	if ((symdef = lookup_sym(&sl, &_lmp, &binfo, NULL)) == 0)
913 		return (1);
914 	if (strcmp(NAME(_lmp), MSG_ORIG(MSG_PTH_LIBC)))
915 		return (1);
916 
917 	/*
918 	 * Determine the reference and definition addresses.
919 	 */
920 	ref = (void *)(symref->st_value);
921 	if (!(FLAGS(rlmp) & FLG_RT_FIXED))
922 		ref += ADDR(rlmp);
923 	def = (void *)(symdef->st_value);
924 	if (!(FLAGS(_lmp) & FLG_RT_FIXED))
925 		def += ADDR(_lmp);
926 
927 	/*
928 	 * Set up a relocation entry for debugging and call the generic copy
929 	 * relocation function to provide symbol size error checking and to
930 	 * record the copy relocation that must be performed.
931 	 */
932 	rel.r_offset = (Addr)ref;
933 	rel.r_info = (Word)R_386_COPY;
934 	DBG_CALL(Dbg_reloc_in(LIST(rlmp), ELF_DBG_RTLD, M_MACH, M_REL_SHT_TYPE,
935 	    &rel, NULL, 0, name));
936 
937 	return (elf_copy_reloc((char *)name, symref, rlmp, (void *)ref, symdef,
938 	    _lmp, (void *)def));
939 }
940 
941 int
942 elf_copy_gen(Rt_map *lmp)
943 {
944 	if (interp && ((ulong_t)interp->i_faddr !=
945 	    r_debug.rtd_rdebug.r_ldbase) &&
946 	    !(strcmp(interp->i_name, MSG_ORIG(MSG_PTH_LIBC)))) {
947 
948 		DBG_CALL(Dbg_reloc_run(lmp, M_REL_SHT_TYPE, 0,
949 		    DBG_REL_START));
950 
951 		if (_elf_copy_reloc(MSG_ORIG(MSG_SYM_CTYPE), lmp,
952 		    (Rt_map *)NEXT(lmp)) == 0)
953 			return (0);
954 		if (_elf_copy_reloc(MSG_ORIG(MSG_SYM_IOB), lmp,
955 		    (Rt_map *)NEXT(lmp)) == 0)
956 			return (0);
957 	}
958 	return (1);
959 }
960 
961 /*
962  * Plt writing interface to allow debugging initialization to be generic.
963  */
964 Pltbindtype
965 /* ARGSUSED1 */
966 elf_plt_write(uintptr_t addr, uintptr_t vaddr, void *rptr, uintptr_t symval,
967 	Xword pltndx)
968 {
969 	Rel		*rel = (Rel*)rptr;
970 	uintptr_t	pltaddr;
971 
972 	pltaddr = addr + rel->r_offset;
973 	*(ulong_t *)pltaddr = (ulong_t)symval;
974 	DBG_CALL(pltcntfull++);
975 	return (PLT_T_FULL);
976 }
977 
978 /*
979  * Provide a machine specific interface to the conversion routine.  By calling
980  * the machine specific version, rather than the generic version, we insure that
981  * the data tables/strings for all known machine versions aren't dragged into
982  * ld.so.1.
983  */
984 const char *
985 _conv_reloc_type(uint_t rel)
986 {
987 	static Conv_inv_buf_t	inv_buf;
988 
989 	return (conv_reloc_386_type(rel, 0, &inv_buf));
990 }
991