xref: /titanic_51/usr/src/cmd/sgs/rtld/sparc/sparc_elf.c (revision 62d876e79d199d6a57e256b10da194220541faa8)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1988 AT&T
24  *	  All Rights Reserved
25  *
26  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
27  * Use is subject to license terms.
28  */
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 /*
32  * SPARC machine dependent and ELF file class dependent functions.
33  * Contains routines for performing function binding and symbol relocations.
34  */
35 #include	"_synonyms.h"
36 
37 #include	<stdio.h>
38 #include	<sys/elf.h>
39 #include	<sys/elf_SPARC.h>
40 #include	<sys/mman.h>
41 #include	<dlfcn.h>
42 #include	<synch.h>
43 #include	<string.h>
44 #include	<debug.h>
45 #include	<reloc.h>
46 #include	<conv.h>
47 #include	"_rtld.h"
48 #include	"_audit.h"
49 #include	"_elf.h"
50 #include	"msg.h"
51 
52 
53 extern void	iflush_range(caddr_t, size_t);
54 extern void	plt_full_range(uintptr_t, uintptr_t);
55 
56 
57 int
58 elf_mach_flags_check(Rej_desc *rej, Ehdr *ehdr)
59 {
60 	/*
61 	 * Check machine type and flags.
62 	 */
63 	if (ehdr->e_machine != EM_SPARC) {
64 		if (ehdr->e_machine != EM_SPARC32PLUS) {
65 			rej->rej_type = SGS_REJ_MACH;
66 			rej->rej_info = (uint_t)ehdr->e_machine;
67 			return (0);
68 		}
69 		if ((ehdr->e_flags & EF_SPARC_32PLUS) == 0) {
70 			rej->rej_type = SGS_REJ_MISFLAG;
71 			rej->rej_info = (uint_t)ehdr->e_flags;
72 			return (0);
73 		}
74 		if ((ehdr->e_flags & ~at_flags) & EF_SPARC_32PLUS_MASK) {
75 			rej->rej_type = SGS_REJ_BADFLAG;
76 			rej->rej_info = (uint_t)ehdr->e_flags;
77 			return (0);
78 		}
79 	} else if ((ehdr->e_flags & ~EF_SPARCV9_MM) != 0) {
80 		rej->rej_type = SGS_REJ_BADFLAG;
81 		rej->rej_info = (uint_t)ehdr->e_flags;
82 		return (0);
83 	}
84 	return (1);
85 }
86 
87 void
88 ldso_plt_init(Rt_map * lmp)
89 {
90 	/*
91 	 * There is no need to analyze ld.so because we don't map in any of
92 	 * its dependencies.  However we may map these dependencies in later
93 	 * (as if ld.so had dlopened them), so initialize the plt and the
94 	 * permission information.
95 	 */
96 	if (PLTGOT(lmp))
97 		elf_plt_init((PLTGOT(lmp)), (caddr_t)lmp);
98 }
99 
100 /*
101  * elf_plt_write() will test to see how far away our destination
102  *	address lies.  If it is close enough that a branch can
103  *	be used instead of a jmpl - we will fill the plt in with
104  * 	single branch.  The branches are much quicker then
105  *	a jmpl instruction - see bug#4356879 for further
106  *	details.
107  *
108  *	NOTE: we pass in both a 'pltaddr' and a 'vpltaddr' since
109  *		librtld/dldump update PLT's who's physical
110  *		address is not the same as the 'virtual' runtime
111  *		address.
112  */
113 Pltbindtype
114 /* ARGSUSED4 */
115 elf_plt_write(uintptr_t addr, uintptr_t vaddr, void *rptr, uintptr_t symval,
116 	Xword pltndx)
117 {
118 	Rela		*rel = (Rela *)rptr;
119 	uintptr_t	vpltaddr, pltaddr;
120 	long		disp;
121 
122 
123 	pltaddr = addr + rel->r_offset;
124 	vpltaddr = vaddr + rel->r_offset;
125 	disp = symval - vpltaddr - 4;
126 
127 	/*
128 	 * Test if the destination address is close enough to use
129 	 * a ba,a... instruction to reach it.
130 	 */
131 	if (S_INRANGE(disp, 23) && !(rtld_flags & RT_FL_NOBAPLT)) {
132 		uint_t		*pltent, bainstr;
133 		Pltbindtype	rc;
134 
135 		pltent = (uint_t *)pltaddr;
136 		/*
137 		 * The
138 		 *
139 		 *	ba,a,pt %icc, <dest>
140 		 *
141 		 * is the most efficient of the PLT's.  If we
142 		 * are within +-20 bits *and* running on a
143 		 * v8plus architecture - use that branch.
144 		 */
145 		if ((at_flags & EF_SPARC_32PLUS) &&
146 		    S_INRANGE(disp, 20)) {
147 			bainstr = M_BA_A_PT;	/* ba,a,pt %icc,<dest> */
148 			bainstr |= (S_MASK(19) & (disp >> 2));
149 			rc = PLT_T_21D;
150 			DBG_CALL(pltcnt21d++);
151 		} else {
152 			/*
153 			 * Otherwise - we fall back to the good old
154 			 *
155 			 *	ba,a	<dest>
156 			 *
157 			 * Which still beats a jmpl instruction.
158 			 */
159 			bainstr = M_BA_A;		/* ba,a <dest> */
160 			bainstr |= (S_MASK(22) & (disp >> 2));
161 			rc = PLT_T_24D;
162 			DBG_CALL(pltcnt24d++);
163 		}
164 
165 		pltent[2] = M_NOP;		/* nop instr */
166 		pltent[1] = bainstr;
167 
168 		iflush_range((char *)(&pltent[1]), 4);
169 		pltent[0] = M_NOP;		/* nop instr */
170 		iflush_range((char *)(&pltent[0]), 4);
171 		return (rc);
172 	}
173 
174 	/*
175 	 * The PLT destination is not in reach of
176 	 * a branch instruction - so we fall back
177 	 * to a 'jmpl' sequence.
178 	 */
179 	plt_full_range(pltaddr, symval);
180 	DBG_CALL(pltcntfull++);
181 	return (PLT_T_FULL);
182 }
183 
184 
185 /*
186  * Local storage space created on the stack created for this glue
187  * code includes space for:
188  *		0x4	pointer to dyn_data
189  *		0x4	size prev stack frame
190  */
191 static const uchar_t dyn_plt_template[] = {
192 /* 0x00 */	0x80, 0x90, 0x00, 0x1e,	/* tst   %fp */
193 /* 0x04 */	0x02, 0x80, 0x00, 0x04, /* be    0x14 */
194 /* 0x08 */	0x82, 0x27, 0x80, 0x0e,	/* sub   %sp, %fp, %g1 */
195 /* 0x0c */	0x10, 0x80, 0x00, 0x03, /* ba	 0x20 */
196 /* 0x10 */	0x01, 0x00, 0x00, 0x00, /* nop */
197 /* 0x14 */	0x82, 0x10, 0x20, 0x60, /* mov	0x60, %g1 */
198 /* 0x18 */	0x9d, 0xe3, 0xbf, 0x98,	/* save	%sp, -0x68, %sp */
199 /* 0x1c */	0xc2, 0x27, 0xbf, 0xf8,	/* st	%g1, [%fp + -0x8] */
200 /* 0x20 */	0x03, 0x00, 0x00, 0x00,	/* sethi %hi(val), %g1 */
201 /* 0x24 */	0x82, 0x10, 0x60, 0x00, /* or	 %g1, %lo(val), %g1 */
202 /* 0x28 */	0x40, 0x00, 0x00, 0x00,	/* call  <rel_addr> */
203 /* 0x2c */	0xc2, 0x27, 0xbf, 0xfc	/* st    %g1, [%fp + -0x4] */
204 };
205 
206 int	dyn_plt_ent_size = sizeof (dyn_plt_template) +
207 		sizeof (uintptr_t) +	/* reflmp */
208 		sizeof (uintptr_t) +	/* deflmp */
209 		sizeof (ulong_t) +	/* symndx */
210 		sizeof (ulong_t) +	/* sb_flags */
211 		sizeof (Sym);		/* symdef */
212 
213 /*
214  * the dynamic plt entry is:
215  *
216  *	tst	%fp
217  *	be	1f
218  *	nop
219  *	sub	%sp, %fp, %g1
220  *	ba	2f
221  *	nop
222  * 1:
223  *	mov	SA(MINFRAME), %g1	! if %fp is null this is the
224  *					!   'minimum stack'.  %fp is null
225  *					!   on the initial stack frame
226  * 2:
227  *	save	%sp, -(SA(MINFRAME) + 2 * CLONGSIZE), %sp
228  *	st	%g1, [%fp + -0x8] ! store prev_stack size in [%fp - 8]
229  *	sethi	%hi(dyn_data), %g1
230  *	or	%g1, %lo(dyn_data), %g1
231  *	call	elf_plt_trace
232  *	st	%g1, [%fp + -0x4] ! store dyn_data ptr in [%fp - 4]
233  * dyn data:
234  *	uintptr_t	reflmp
235  *	uintptr_t	deflmp
236  *	ulong_t		symndx
237  *	ulong_t		sb_flags
238  *	Sym		symdef
239  */
240 static caddr_t
241 elf_plt_trace_write(caddr_t addr, Rela *rptr, Rt_map *rlmp, Rt_map *dlmp,
242     Sym *sym, ulong_t symndx, ulong_t pltndx, caddr_t to, ulong_t sb_flags,
243     int *fail)
244 {
245 	extern ulong_t	elf_plt_trace();
246 	uintptr_t	dyn_plt, *dyndata;
247 
248 	/*
249 	 * If both pltenter & pltexit have been disabled there
250 	 * there is no reason to even create the glue code.
251 	 */
252 	if ((sb_flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)) ==
253 	    (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)) {
254 		(void) elf_plt_write((uintptr_t)addr, (uintptr_t)addr,
255 		    rptr, (uintptr_t)to, pltndx);
256 		return (to);
257 	}
258 
259 	/*
260 	 * We only need to add the glue code if there is an auditing
261 	 * library that is interested in this binding.
262 	 */
263 	dyn_plt = (uintptr_t)AUDINFO(rlmp)->ai_dynplts +
264 		(pltndx * dyn_plt_ent_size);
265 
266 	/*
267 	 * Have we initialized this dynamic plt entry yet?  If we haven't do it
268 	 * now.  Otherwise this function has been called before, but from a
269 	 * different plt (ie. from another shared object).  In that case
270 	 * we just set the plt to point to the new dyn_plt.
271 	 */
272 	if (*(uint_t *)dyn_plt == 0) {
273 		Sym	*symp;
274 		Xword	symvalue;
275 		Lm_list	*lml = LIST(rlmp);
276 
277 		(void) memcpy((void *)dyn_plt, dyn_plt_template,
278 		    sizeof (dyn_plt_template));
279 		dyndata = (uintptr_t *)(dyn_plt + sizeof (dyn_plt_template));
280 
281 		/*
282 		 * relocating:
283 		 *	sethi	%hi(dyndata), %g1
284 		 */
285 		symvalue = (Xword)dyndata;
286 		if (do_reloc(R_SPARC_HI22, (uchar_t *)(dyn_plt + 0x20),
287 		    &symvalue, MSG_ORIG(MSG_SYM_LADYNDATA),
288 		    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
289 			*fail = 1;
290 			return (0);
291 		}
292 
293 		/*
294 		 * relocating:
295 		 *	or	%g1, %lo(dyndata), %g1
296 		 */
297 		symvalue = (Xword)dyndata;
298 		if (do_reloc(R_SPARC_LO10, (uchar_t *)(dyn_plt + 0x24),
299 		    &symvalue, MSG_ORIG(MSG_SYM_LADYNDATA),
300 		    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
301 			*fail = 1;
302 			return (0);
303 		}
304 
305 		/*
306 		 * relocating:
307 		 *	call	elf_plt_trace
308 		 */
309 		symvalue = (Xword)((uintptr_t)&elf_plt_trace -
310 		    (dyn_plt + 0x28));
311 		if (do_reloc(R_SPARC_WDISP30, (uchar_t *)(dyn_plt + 0x28),
312 		    &symvalue, MSG_ORIG(MSG_SYM_ELFPLTTRACE),
313 		    MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
314 			*fail = 1;
315 			return (0);
316 		}
317 
318 		*dyndata++ = (uintptr_t)rlmp;
319 		*dyndata++ = (uintptr_t)dlmp;
320 		*(ulong_t *)dyndata++ = symndx;
321 		*(ulong_t *)dyndata++ = sb_flags;
322 		symp = (Sym *)dyndata;
323 		*symp = *sym;
324 		symp->st_name += (Word)STRTAB(dlmp);
325 		symp->st_value = (Addr)to;
326 
327 		iflush_range((void *)dyn_plt, sizeof (dyn_plt_template));
328 	}
329 
330 	(void) elf_plt_write((uintptr_t)addr, (uintptr_t)addr,
331 		rptr, (uintptr_t)dyn_plt, 0);
332 	return ((caddr_t)dyn_plt);
333 }
334 
335 
336 /*
337  * Function binding routine - invoked on the first call to a function through
338  * the procedure linkage table;
339  * passes first through an assembly language interface.
340  *
341  * Takes the address of the PLT entry where the call originated,
342  * the offset into the relocation table of the associated
343  * relocation entry and the address of the link map (rt_private_map struct)
344  * for the entry.
345  *
346  * Returns the address of the function referenced after re-writing the PLT
347  * entry to invoke the function directly.
348  *
349  * On error, causes process to terminate with a signal.
350  */
351 ulong_t
352 elf_bndr(Rt_map *lmp, ulong_t pltoff, caddr_t from)
353 {
354 	Rt_map		*nlmp, *llmp;
355 	ulong_t		addr, vaddr, reloff, symval, rsymndx;
356 	char		*name;
357 	Rela		*rptr;
358 	Sym		*sym, *nsym;
359 	Xword		pltndx;
360 	uint_t		binfo, sb_flags = 0;
361 	Slookup		sl;
362 	Pltbindtype	pbtype;
363 	int		entry, lmflags;
364 	uint_t		dbg_class;
365 	Lm_list		*lml = LIST(lmp);
366 
367 	/*
368 	 * For compatibility with libthread (TI_VERSION 1) we track the entry
369 	 * value.  A zero value indicates we have recursed into ld.so.1 to
370 	 * further process a locking request.  Under this recursion we disable
371 	 * tsort and cleanup activities.
372 	 */
373 	entry = enter();
374 
375 	if ((lmflags = lml->lm_flags) & LML_FLG_RTLDLM) {
376 		dbg_class = dbg_desc->d_class;
377 		dbg_desc->d_class = 0;
378 	}
379 
380 	/*
381 	 * Must calculate true plt relocation address from reloc.
382 	 * Take offset, subtract number of reserved PLT entries, and divide
383 	 * by PLT entry size, which should give the index of the plt
384 	 * entry (and relocation entry since they have been defined to be
385 	 * in the same order).  Then we must multiply by the size of
386 	 * a relocation entry, which will give us the offset of the
387 	 * plt relocation entry from the start of them given by JMPREL(lm).
388 	 */
389 	addr = pltoff - M_PLT_RESERVSZ;
390 	pltndx = addr / M_PLT_ENTSIZE;
391 
392 	/*
393 	 * Perform some basic sanity checks.  If we didn't get a load map
394 	 * or the plt offset is invalid then its possible someone has walked
395 	 * over the plt entries or jumped to plt0 out of the blue.
396 	 */
397 	if (!lmp || ((addr % M_PLT_ENTSIZE) != 0)) {
398 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_PLTREF),
399 		    conv_reloc_SPARC_type(R_SPARC_JMP_SLOT, 0),
400 		    EC_NATPTR(lmp), EC_XWORD(pltoff), EC_NATPTR(from));
401 		rtldexit(lml, 1);
402 	}
403 	reloff = pltndx * sizeof (Rela);
404 
405 	/*
406 	 * Use relocation entry to get symbol table entry and symbol name.
407 	 */
408 	addr = (ulong_t)JMPREL(lmp);
409 	rptr = (Rela *)(addr + reloff);
410 	rsymndx = ELF_R_SYM(rptr->r_info);
411 	sym = (Sym *)((ulong_t)SYMTAB(lmp) + (rsymndx * SYMENT(lmp)));
412 	name = (char *)(STRTAB(lmp) + sym->st_name);
413 
414 	/*
415 	 * Determine the last link-map of this list, this'll be the starting
416 	 * point for any tsort() processing.
417 	 */
418 	llmp = lml->lm_tail;
419 
420 	/*
421 	 * Find definition for symbol.
422 	 */
423 	sl.sl_name = name;
424 	sl.sl_cmap = lmp;
425 	sl.sl_imap = lml->lm_head;
426 	sl.sl_hash = 0;
427 	sl.sl_rsymndx = rsymndx;
428 	sl.sl_flags = LKUP_DEFT;
429 
430 	if ((nsym = lookup_sym(&sl, &nlmp, &binfo)) == 0) {
431 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_NOSYM), NAME(lmp),
432 		    demangle(name));
433 		rtldexit(lml, 1);
434 	}
435 
436 	symval = nsym->st_value;
437 	if (!(FLAGS(nlmp) & FLG_RT_FIXED) &&
438 	    (nsym->st_shndx != SHN_ABS))
439 		symval += ADDR(nlmp);
440 	if ((lmp != nlmp) && ((FLAGS1(nlmp) & FL1_RT_NOINIFIN) == 0)) {
441 		/*
442 		 * Record that this new link map is now bound to the caller.
443 		 */
444 		if (bind_one(lmp, nlmp, BND_REFER) == 0)
445 			rtldexit(lml, 1);
446 	}
447 
448 	if ((lml->lm_tflags | FLAGS1(lmp)) & LML_TFLG_AUD_SYMBIND) {
449 		ulong_t	symndx = (((uintptr_t)nsym -
450 			(uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp));
451 
452 		symval = audit_symbind(lmp, nlmp, nsym, symndx, symval,
453 			&sb_flags);
454 	}
455 
456 	if (FLAGS(lmp) & FLG_RT_FIXED)
457 		vaddr = 0;
458 	else
459 		vaddr = ADDR(lmp);
460 
461 	pbtype = PLT_T_NONE;
462 	if (!(rtld_flags & RT_FL_NOBIND)) {
463 		if (((lml->lm_tflags | FLAGS1(lmp)) &
464 		    (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) &&
465 		    AUDINFO(lmp)->ai_dynplts) {
466 			int	fail = 0;
467 			ulong_t	symndx = (((uintptr_t)nsym -
468 				(uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp));
469 
470 			symval = (ulong_t)elf_plt_trace_write((caddr_t)vaddr,
471 			    rptr, lmp, nlmp, nsym, symndx, pltndx,
472 			    (caddr_t)symval, sb_flags, &fail);
473 			if (fail)
474 				rtldexit(lml, 1);
475 		} else {
476 			/*
477 			 * Write standard PLT entry to jump directly
478 			 * to newly bound function.
479 			 */
480 			pbtype = elf_plt_write((uintptr_t)vaddr,
481 				(uintptr_t)vaddr, rptr, symval, pltndx);
482 		}
483 	}
484 
485 	/*
486 	 * Print binding information and rebuild PLT entry.
487 	 */
488 	DBG_CALL(Dbg_bind_global(lmp, (Addr)from, (Off)(from - ADDR(lmp)),
489 	    pltndx, pbtype, nlmp, (Addr)symval, nsym->st_value, name, binfo));
490 
491 	/*
492 	 * Complete any processing for newly loaded objects.  Note we don't
493 	 * know exactly where any new objects are loaded (we know the object
494 	 * that supplied the symbol, but others may have been loaded lazily as
495 	 * we searched for the symbol), so sorting starts from the last
496 	 * link-map know on entry to this routine.
497 	 */
498 	if (entry)
499 		load_completion(llmp, lmp);
500 
501 	/*
502 	 * Some operations like dldump() or dlopen()'ing a relocatable object
503 	 * result in objects being loaded on rtld's link-map, make sure these
504 	 * objects are initialized also.
505 	 */
506 	if ((LIST(nlmp)->lm_flags & LML_FLG_RTLDLM) && LIST(nlmp)->lm_init)
507 		load_completion(nlmp, 0);
508 
509 	/*
510 	 * If the object we've bound to is in the process of being initialized
511 	 * by another thread, determine whether we should block.
512 	 */
513 	is_dep_ready(nlmp, lmp, DBG_WAIT_SYMBOL);
514 
515 	/*
516 	 * Make sure the object to which we've bound has had it's .init fired.
517 	 * Cleanup before return to user code.
518 	 */
519 	if (entry) {
520 		is_dep_init(nlmp, lmp);
521 		leave(lml);
522 	}
523 
524 	if (lmflags & LML_FLG_RTLDLM)
525 		dbg_desc->d_class = dbg_class;
526 
527 	return (symval);
528 }
529 
530 
531 /*
532  * Read and process the relocations for one link object, we assume all
533  * relocation sections for loadable segments are stored contiguously in
534  * the file.
535  */
536 int
537 elf_reloc(Rt_map *lmp, uint_t plt)
538 {
539 	ulong_t		relbgn, relend, relsiz, basebgn, pltbgn, pltend;
540 	ulong_t		roffset, rsymndx, psymndx = 0, etext = ETEXT(lmp);
541 	ulong_t		emap, dsymndx, pltndx;
542 	uchar_t		rtype;
543 	long		reladd, value, pvalue;
544 	Sym		*symref, *psymref, *symdef, *psymdef;
545 	char		*name, *pname;
546 	Rt_map		*_lmp, *plmp;
547 	int		textrel = 0, ret = 1, noplt = 0;
548 	long		relacount = RELACOUNT(lmp);
549 	Rela		*rel;
550 	Pltbindtype	pbtype;
551 	uint_t		binfo, pbinfo;
552 	Alist		*bound = 0;
553 
554 	/*
555 	 * If an object has any DT_REGISTER entries associated with
556 	 * it, they are processed now.
557 	 */
558 	if ((plt == 0) && (FLAGS(lmp) & FLG_RT_REGSYMS)) {
559 		if (elf_regsyms(lmp) == 0)
560 			return (0);
561 	}
562 
563 	/*
564 	 * Although only necessary for lazy binding, initialize the first
565 	 * procedure linkage table entry to go to elf_rtbndr().  dbx(1) seems
566 	 * to find this useful.
567 	 */
568 	if ((plt == 0) && PLTGOT(lmp)) {
569 		if ((ulong_t)PLTGOT(lmp) < etext) {
570 			if (elf_set_prot(lmp, PROT_WRITE) == 0)
571 				return (0);
572 			textrel = 1;
573 		}
574 		elf_plt_init(PLTGOT(lmp), (caddr_t)lmp);
575 	}
576 
577 	/*
578 	 * Initialize the plt start and end addresses.
579 	 */
580 	if ((pltbgn = (ulong_t)JMPREL(lmp)) != 0)
581 		pltend = pltbgn + (ulong_t)(PLTRELSZ(lmp));
582 
583 	/*
584 	 * If we've been called upon to promote an RTLD_LAZY object to an
585 	 * RTLD_NOW then we're only interested in scaning the .plt table.
586 	 */
587 	if (plt) {
588 		relbgn = pltbgn;
589 		relend = pltend;
590 	} else {
591 		/*
592 		 * The relocation sections appear to the run-time linker as a
593 		 * single table.  Determine the address of the beginning and end
594 		 * of this table.  There are two different interpretations of
595 		 * the ABI at this point:
596 		 *
597 		 *   o	The REL table and its associated RELSZ indicate the
598 		 *	concatenation of *all* relocation sections (this is the
599 		 *	model our link-editor constructs).
600 		 *
601 		 *   o	The REL table and its associated RELSZ indicate the
602 		 *	concatenation of all *but* the .plt relocations.  These
603 		 *	relocations are specified individually by the JMPREL and
604 		 *	PLTRELSZ entries.
605 		 *
606 		 * Determine from our knowledege of the relocation range and
607 		 * .plt range, the range of the total relocation table.  Note
608 		 * that one other ABI assumption seems to be that the .plt
609 		 * relocations always follow any other relocations, the
610 		 * following range checking drops that assumption.
611 		 */
612 		relbgn = (ulong_t)(REL(lmp));
613 		relend = relbgn + (ulong_t)(RELSZ(lmp));
614 		if (pltbgn) {
615 			if (!relbgn || (relbgn > pltbgn))
616 				relbgn = pltbgn;
617 			if (!relbgn || (relend < pltend))
618 				relend = pltend;
619 		}
620 	}
621 	if (!relbgn || (relbgn == relend)) {
622 		DBG_CALL(Dbg_reloc_run(lmp, 0, plt, DBG_REL_NONE));
623 		return (1);
624 	}
625 
626 	relsiz = (ulong_t)(RELENT(lmp));
627 	basebgn = ADDR(lmp);
628 	emap = ADDR(lmp) + MSIZE(lmp);
629 
630 	DBG_CALL(Dbg_reloc_run(lmp, M_REL_SHT_TYPE, plt, DBG_REL_START));
631 
632 	/*
633 	 * If we're processing in lazy mode there is no need to scan the
634 	 * .rela.plt table.
635 	 */
636 	if (pltbgn && ((MODE(lmp) & RTLD_NOW) == 0))
637 		noplt = 1;
638 
639 	/*
640 	 * Loop through relocations.
641 	 */
642 	while (relbgn < relend) {
643 		Addr		vaddr;
644 		uint_t		sb_flags = 0;
645 
646 		rtype = ELF_R_TYPE(((Rela *)relbgn)->r_info);
647 
648 		/*
649 		 * If this is a RELATIVE relocation in a shared object (the
650 		 * common case), and if we are not debugging, then jump into a
651 		 * tighter relocation loop (elf_reloc_relative).  Only make the
652 		 * jump if we've been given a hint on the number of relocations.
653 		 */
654 		if ((rtype == R_SPARC_RELATIVE) &&
655 		    ((FLAGS(lmp) & FLG_RT_FIXED) == 0) && (DBG_ENABLED == 0)) {
656 			/*
657 			 * It's possible that the relative relocation block
658 			 * has relocations against the text segment as well
659 			 * as the data segment.  Since our optimized relocation
660 			 * engine does not check which segment the relocation
661 			 * is against - just mprotect it now if it's been
662 			 * marked as containing TEXTREL's.
663 			 */
664 			if ((textrel == 0) && (FLAGS1(lmp) & FL1_RT_TEXTREL)) {
665 				if (elf_set_prot(lmp, PROT_WRITE) == 0) {
666 					ret = 0;
667 					break;
668 				}
669 				textrel = 1;
670 			}
671 			if (relacount) {
672 				relbgn = elf_reloc_relacount(relbgn, relacount,
673 				    relsiz, basebgn);
674 				relacount = 0;
675 			} else {
676 				relbgn = elf_reloc_relative(relbgn, relend,
677 				    relsiz, basebgn, etext, emap);
678 			}
679 			if (relbgn >= relend)
680 				break;
681 			rtype = ELF_R_TYPE(((Rela *)relbgn)->r_info);
682 		}
683 
684 		roffset = ((Rela *)relbgn)->r_offset;
685 
686 		reladd = (long)(((Rela *)relbgn)->r_addend);
687 		rsymndx = ELF_R_SYM(((Rela *)relbgn)->r_info);
688 
689 		rel = (Rela *)relbgn;
690 		relbgn += relsiz;
691 
692 		/*
693 		 * Optimizations.
694 		 */
695 		if (rtype == R_SPARC_NONE)
696 			continue;
697 		if (noplt && ((ulong_t)rel >= pltbgn) &&
698 		    ((ulong_t)rel < pltend)) {
699 			relbgn = pltend;
700 			continue;
701 		}
702 
703 		if (rtype != R_SPARC_REGISTER) {
704 			/*
705 			 * If this is a shared object, add the base address
706 			 * to offset.
707 			 */
708 			if (!(FLAGS(lmp) & FLG_RT_FIXED))
709 				roffset += basebgn;
710 
711 			/*
712 			 * If this relocation is not against part of the image
713 			 * mapped into memory we skip it.
714 			 */
715 			if ((roffset < ADDR(lmp)) || (roffset > (ADDR(lmp) +
716 			    MSIZE(lmp)))) {
717 				elf_reloc_bad(lmp, (void *)rel, rtype, roffset,
718 				    rsymndx);
719 				continue;
720 			}
721 		}
722 
723 		/*
724 		 * If we're promoting plts determine if this one has already
725 		 * been written. An uninitialized plts' second instruction is a
726 		 * branch.
727 		 */
728 		if (plt) {
729 			ulong_t	*_roffset = (ulong_t *)roffset;
730 
731 			_roffset++;
732 			if ((*_roffset & (~(S_MASK(22)))) != M_BA_A)
733 				continue;
734 		}
735 
736 		binfo = 0;
737 		pltndx = (ulong_t)-1;
738 		pbtype = PLT_T_NONE;
739 		/*
740 		 * If a symbol index is specified then get the symbol table
741 		 * entry, locate the symbol definition, and determine its
742 		 * address.
743 		 */
744 		if (rsymndx) {
745 			/*
746 			 * Get the local symbol table entry.
747 			 */
748 			symref = (Sym *)((ulong_t)SYMTAB(lmp) +
749 			    (rsymndx * SYMENT(lmp)));
750 
751 			/*
752 			 * If this is a local symbol, just use the base address.
753 			 * (we should have no local relocations in the
754 			 * executable).
755 			 */
756 			if (ELF_ST_BIND(symref->st_info) == STB_LOCAL) {
757 				value = basebgn;
758 				name = (char *)0;
759 
760 				/*
761 				 * Special case TLS relocations.
762 				 */
763 				if (rtype == R_SPARC_TLS_DTPMOD32) {
764 					/*
765 					 * Use the TLS modid.
766 					 */
767 					value = TLSMODID(lmp);
768 
769 				} else if (rtype == R_SPARC_TLS_TPOFF32) {
770 					if ((value = elf_static_tls(lmp, symref,
771 					    rel, rtype, 0, roffset, 0)) == 0) {
772 						ret = 0;
773 						break;
774 					}
775 				}
776 			} else {
777 				/*
778 				 * If the symbol index is equal to the previous
779 				 * symbol index relocation we processed then
780 				 * reuse the previous values. (Note that there
781 				 * have been cases where a relocation exists
782 				 * against a copy relocation symbol, our ld(1)
783 				 * should optimize this away, but make sure we
784 				 * don't use the same symbol information should
785 				 * this case exist).
786 				 */
787 				if ((rsymndx == psymndx) &&
788 				    (rtype != R_SPARC_COPY)) {
789 					/* LINTED */
790 					if (psymdef == 0) {
791 						DBG_CALL(Dbg_bind_weak(lmp,
792 						    (Addr)roffset, (Addr)
793 						    (roffset - basebgn), name));
794 						continue;
795 					}
796 					/* LINTED */
797 					value = pvalue;
798 					/* LINTED */
799 					name = pname;
800 					symdef = psymdef;
801 					/* LINTED */
802 					symref = psymref;
803 					/* LINTED */
804 					_lmp = plmp;
805 					/* LINTED */
806 					binfo = pbinfo;
807 
808 					if ((LIST(_lmp)->lm_tflags |
809 					    FLAGS1(_lmp)) &
810 					    LML_TFLG_AUD_SYMBIND) {
811 						value = audit_symbind(lmp, _lmp,
812 						    /* LINTED */
813 						    symdef, dsymndx, value,
814 						    &sb_flags);
815 					}
816 				} else {
817 					Slookup		sl;
818 					uchar_t		bind;
819 
820 					/*
821 					 * Lookup the symbol definition.
822 					 */
823 					name = (char *)(STRTAB(lmp) +
824 					    symref->st_name);
825 
826 					sl.sl_name = name;
827 					sl.sl_cmap = lmp;
828 					sl.sl_imap = 0;
829 					sl.sl_hash = 0;
830 					sl.sl_rsymndx = rsymndx;
831 
832 					if (rtype == R_SPARC_COPY)
833 						sl.sl_flags = LKUP_COPY;
834 					else
835 						sl.sl_flags = LKUP_DEFT;
836 
837 					sl.sl_flags |= LKUP_ALLCNTLIST;
838 
839 					if (rtype != R_SPARC_JMP_SLOT)
840 						sl.sl_flags |= LKUP_SPEC;
841 
842 					bind = ELF_ST_BIND(symref->st_info);
843 					if (bind == STB_WEAK)
844 						sl.sl_flags |= LKUP_WEAK;
845 
846 					symdef = lookup_sym(&sl, &_lmp, &binfo);
847 
848 					/*
849 					 * If the symbol is not found and the
850 					 * reference was not to a weak symbol,
851 					 * report an error.  Weak references
852 					 * may be unresolved.
853 					 */
854 					if (symdef == 0) {
855 					    Lm_list	*lml = LIST(lmp);
856 
857 					    if (bind != STB_WEAK) {
858 						if (lml->lm_flags &
859 						    LML_FLG_IGNRELERR) {
860 						    continue;
861 						} else if (lml->lm_flags &
862 						    LML_FLG_TRC_WARN) {
863 						    (void) printf(MSG_INTL(
864 							MSG_LDD_SYM_NFOUND),
865 							demangle(name),
866 							NAME(lmp));
867 						    continue;
868 						} else {
869 						    DBG_CALL(Dbg_reloc_in(lml,
870 							ELF_DBG_RTLD, M_MACH,
871 							M_REL_SHT_TYPE, rel,
872 							NULL, name));
873 						    eprintf(lml, ERR_FATAL,
874 							MSG_INTL(MSG_REL_NOSYM),
875 							NAME(lmp),
876 							demangle(name));
877 						    ret = 0;
878 						    break;
879 						}
880 					    } else {
881 						psymndx = rsymndx;
882 						psymdef = 0;
883 
884 						DBG_CALL(Dbg_bind_weak(lmp,
885 						    (Addr)roffset, (Addr)
886 						    (roffset - basebgn), name));
887 						continue;
888 					    }
889 					}
890 
891 					/*
892 					 * If symbol was found in an object
893 					 * other than the referencing object
894 					 * then record the binding.
895 					 */
896 					if ((lmp != _lmp) && ((FLAGS1(_lmp) &
897 					    FL1_RT_NOINIFIN) == 0)) {
898 						if (alist_test(&bound, _lmp,
899 						    sizeof (Rt_map *),
900 						    AL_CNT_RELBIND) == 0) {
901 							ret = 0;
902 							break;
903 						}
904 					}
905 
906 					/*
907 					 * Calculate the location of definition;
908 					 * symbol value plus base address of
909 					 * containing shared object.
910 					 */
911 					if (IS_SIZE(rtype))
912 						value = symdef->st_size;
913 					else
914 						value = symdef->st_value;
915 
916 					if (!(FLAGS(_lmp) & FLG_RT_FIXED) &&
917 					    !(IS_SIZE(rtype)) &&
918 					    (symdef->st_shndx != SHN_ABS) &&
919 					    (ELF_ST_TYPE(symdef->st_info) !=
920 					    STT_TLS))
921 						value += ADDR(_lmp);
922 
923 					/*
924 					 * Retain this symbol index and the
925 					 * value in case it can be used for the
926 					 * subsequent relocations.
927 					 */
928 					if (rtype != R_SPARC_COPY) {
929 						psymndx = rsymndx;
930 						pvalue = value;
931 						pname = name;
932 						psymdef = symdef;
933 						psymref = symref;
934 						plmp = _lmp;
935 						pbinfo = binfo;
936 					}
937 					if ((LIST(_lmp)->lm_tflags |
938 					    FLAGS1(_lmp)) &
939 					    LML_TFLG_AUD_SYMBIND) {
940 						dsymndx = (((uintptr_t)symdef -
941 						    (uintptr_t)SYMTAB(_lmp)) /
942 						    SYMENT(_lmp));
943 						value = audit_symbind(lmp, _lmp,
944 						    symdef, dsymndx, value,
945 						    &sb_flags);
946 					}
947 				}
948 
949 				/*
950 				 * If relocation is PC-relative, subtract
951 				 * offset address.
952 				 */
953 				if (IS_PC_RELATIVE(rtype))
954 					value -= roffset;
955 
956 				/*
957 				 * Special case TLS relocations.
958 				 */
959 				if (rtype == R_SPARC_TLS_DTPMOD32) {
960 					/*
961 					 * Relocation value is the TLS modid.
962 					 */
963 					value = TLSMODID(_lmp);
964 
965 				} else if (rtype == R_SPARC_TLS_TPOFF32) {
966 					if ((value = elf_static_tls(_lmp,
967 					    symdef, rel, rtype, name, roffset,
968 					    value)) == 0) {
969 						ret = 0;
970 						break;
971 					}
972 				}
973 			}
974 		} else {
975 			/*
976 			 * Special cases.
977 			 */
978 			if (rtype == R_SPARC_REGISTER) {
979 				/*
980 				 * A register symbol associated with symbol
981 				 * index 0 is initialized (i.e. relocated) to
982 				 * a constant in the r_addend field rather than
983 				 * to a symbol value.
984 				 */
985 				value = 0;
986 
987 			} else if (rtype == R_SPARC_TLS_DTPMOD32) {
988 				/*
989 				 * TLS relocation value is the TLS modid.
990 				 */
991 				value = TLSMODID(lmp);
992 			} else
993 				value = basebgn;
994 			name = (char *)0;
995 		}
996 
997 		DBG_CALL(Dbg_reloc_in(LIST(lmp), ELF_DBG_RTLD, M_MACH,
998 		    M_REL_SHT_TYPE, rel, NULL, name));
999 
1000 		/*
1001 		 * If this object has relocations in the text segment, turn
1002 		 * off the write protect.
1003 		 */
1004 		if ((rtype != R_SPARC_REGISTER) && (roffset < etext) &&
1005 		    (textrel == 0)) {
1006 			if (elf_set_prot(lmp, PROT_WRITE) == 0) {
1007 				ret = 0;
1008 				break;
1009 			}
1010 			textrel = 1;
1011 		}
1012 
1013 		/*
1014 		 * Call relocation routine to perform required relocation.
1015 		 */
1016 		switch (rtype) {
1017 		case R_SPARC_REGISTER:
1018 			/*
1019 			 * The v9 ABI 4.2.4 says that system objects may,
1020 			 * but are not required to, use register symbols
1021 			 * to inidcate how they use global registers. Thus
1022 			 * at least %g6, %g7 must be allowed in addition
1023 			 * to %g2 and %g3.
1024 			 */
1025 			value += reladd;
1026 			if (roffset == STO_SPARC_REGISTER_G1) {
1027 				set_sparc_g1(value);
1028 			} else if (roffset == STO_SPARC_REGISTER_G2) {
1029 				set_sparc_g2(value);
1030 			} else if (roffset == STO_SPARC_REGISTER_G3) {
1031 				set_sparc_g3(value);
1032 			} else if (roffset == STO_SPARC_REGISTER_G4) {
1033 				set_sparc_g4(value);
1034 			} else if (roffset == STO_SPARC_REGISTER_G5) {
1035 				set_sparc_g5(value);
1036 			} else if (roffset == STO_SPARC_REGISTER_G6) {
1037 				set_sparc_g6(value);
1038 			} else if (roffset == STO_SPARC_REGISTER_G7) {
1039 				set_sparc_g7(value);
1040 			} else {
1041 				eprintf(LIST(lmp), ERR_FATAL,
1042 				    MSG_INTL(MSG_REL_BADREG), NAME(lmp),
1043 				    EC_ADDR(roffset));
1044 				ret = 0;
1045 				break;
1046 			}
1047 
1048 			DBG_CALL(Dbg_reloc_apply_reg(LIST(lmp), ELF_DBG_RTLD,
1049 			    M_MACH, (Xword)roffset, (Xword)value));
1050 			break;
1051 		case R_SPARC_COPY:
1052 			if (elf_copy_reloc(name, symref, lmp, (void *)roffset,
1053 			    symdef, _lmp, (const void *)value) == 0)
1054 				ret = 0;
1055 			break;
1056 		case R_SPARC_JMP_SLOT:
1057 			pltndx = ((ulong_t)rel -
1058 				(uintptr_t)JMPREL(lmp)) / relsiz;
1059 
1060 			if (FLAGS(lmp) & FLG_RT_FIXED)
1061 				vaddr = 0;
1062 			else
1063 				vaddr = ADDR(lmp);
1064 
1065 			if (((LIST(lmp)->lm_tflags | FLAGS1(lmp)) &
1066 			    (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) &&
1067 			    AUDINFO(lmp)->ai_dynplts) {
1068 				int	fail = 0;
1069 				ulong_t	symndx = (((uintptr_t)symdef -
1070 					(uintptr_t)SYMTAB(_lmp)) /
1071 					SYMENT(_lmp));
1072 
1073 				(void) elf_plt_trace_write((caddr_t)vaddr,
1074 				    (Rela *)rel, lmp, _lmp, symdef, symndx,
1075 				    pltndx, (caddr_t)value, sb_flags, &fail);
1076 				if (fail)
1077 					ret = 0;
1078 			} else {
1079 				/*
1080 				 * Write standard PLT entry to jump directly
1081 				 * to newly bound function.
1082 				 */
1083 				DBG_CALL(Dbg_reloc_apply_val(LIST(lmp),
1084 				    ELF_DBG_RTLD, (Xword)roffset,
1085 				    (Xword)value));
1086 				pbtype = elf_plt_write((uintptr_t)vaddr,
1087 				    (uintptr_t)vaddr, (void *)rel, value,
1088 				    pltndx);
1089 			}
1090 			break;
1091 		default:
1092 			value += reladd;
1093 
1094 			/*
1095 			 * Write the relocation out.  If this relocation is a
1096 			 * common basic write, skip the doreloc() engine.
1097 			 */
1098 			if ((rtype == R_SPARC_GLOB_DAT) ||
1099 			    (rtype == R_SPARC_32)) {
1100 				if (roffset & 0x3) {
1101 					eprintf(LIST(lmp), ERR_FATAL,
1102 					    MSG_INTL(MSG_REL_NONALIGN),
1103 					    conv_reloc_SPARC_type(rtype, 0),
1104 					    NAME(lmp), demangle(name),
1105 					    EC_OFF(roffset));
1106 					ret = 0;
1107 				} else
1108 					*(uint_t *)roffset += value;
1109 			} else {
1110 				if (do_reloc(rtype, (uchar_t *)roffset,
1111 				    (Xword *)&value, name,
1112 				    NAME(lmp), LIST(lmp)) == 0)
1113 					ret = 0;
1114 			}
1115 
1116 			/*
1117 			 * The value now contains the 'bit-shifted' value that
1118 			 * was or'ed into memory (this was set by do_reloc()).
1119 			 */
1120 			DBG_CALL(Dbg_reloc_apply_val(LIST(lmp), ELF_DBG_RTLD,
1121 			    (Xword)roffset, (Xword)value));
1122 
1123 			/*
1124 			 * If this relocation is against a text segment, make
1125 			 * sure that the instruction cache is flushed.
1126 			 */
1127 			if (textrel)
1128 				iflush_range((caddr_t)roffset, 0x4);
1129 		}
1130 
1131 		if ((ret == 0) &&
1132 		    ((LIST(lmp)->lm_flags & LML_FLG_TRC_WARN) == 0))
1133 			break;
1134 
1135 		if (binfo) {
1136 			DBG_CALL(Dbg_bind_global(lmp, (Addr)roffset,
1137 			    (Off)(roffset - basebgn), pltndx, pbtype,
1138 			    _lmp, (Addr)value, symdef->st_value, name, binfo));
1139 		}
1140 	}
1141 
1142 	return (relocate_finish(lmp, bound, textrel, ret));
1143 }
1144 
1145 /*
1146  * Provide a machine specific interface to the conversion routine.  By calling
1147  * the machine specific version, rather than the generic version, we insure that
1148  * the data tables/strings for all known machine versions aren't dragged into
1149  * ld.so.1.
1150  */
1151 const char *
1152 _conv_reloc_type(uint_t rel)
1153 {
1154 	return (conv_reloc_SPARC_type(rel, 0));
1155 }
1156