1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 
23 /*
24  *	Copyright (c) 1990, 1991 UNIX System Laboratories, Inc.
25  *	Copyright (c) 1988 AT&T
26  *	  All Rights Reserved
27  *
28  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
29  * Use is subject to license terms.
30  */
31 #pragma ident	"%Z%%M%	%I%	%E% SMI"
32 
33 #include	<string.h>
34 #include	<stdio.h>
35 #include	<sys/elf_386.h>
36 #include	"debug.h"
37 #include	"reloc.h"
38 #include	"msg.h"
39 #include	"_libld.h"
40 
41 Word
42 init_rel(Rel_desc *reld, void *reloc)
43 {
44 	Rel *	rel = (Rel *)reloc;
45 
46 	/* LINTED */
47 	reld->rel_rtype = (Word)ELF_R_TYPE(rel->r_info);
48 	reld->rel_roffset = rel->r_offset;
49 	reld->rel_raddend = 0;
50 	reld->rel_typedata = 0;
51 
52 	return ((Word)ELF_R_SYM(rel->r_info));
53 }
54 
55 void
56 mach_eflags(Ehdr *ehdr, Ofl_desc *ofl)
57 {
58 	ofl->ofl_e_flags |= ehdr->e_flags;
59 }
60 
61 void
62 mach_make_dynamic(Ofl_desc *ofl, size_t *cnt)
63 {
64 	if (!(ofl->ofl_flags & FLG_OF_RELOBJ)) {
65 		/*
66 		 * Create this entry if we are going to create a PLT table.
67 		 */
68 		if (ofl->ofl_pltcnt)
69 			(*cnt)++;		/* DT_PLTGOT */
70 	}
71 }
72 
73 void
74 mach_update_odynamic(Ofl_desc * ofl, Dyn ** dyn)
75 {
76 	if (!(ofl->ofl_flags & FLG_OF_RELOBJ)) {
77 		if (ofl->ofl_pltcnt) {
78 			(*dyn)->d_tag = DT_PLTGOT;
79 			(*dyn)->d_un.d_ptr = fillin_gotplt2(ofl);
80 			(*dyn)++;
81 		}
82 	}
83 }
84 
85 Xword
86 calc_plt_addr(Sym_desc *sdp, Ofl_desc *ofl)
87 {
88 	Xword	value;
89 
90 	value = (Xword)(ofl->ofl_osplt->os_shdr->sh_addr) +
91 	    M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) * M_PLT_ENTSIZE);
92 	return (value);
93 }
94 
95 /*
96  *  Build a single plt entry - code is:
97  *	if (building a.out)
98  *		JMP	*got_off
99  *	else
100  *		JMP	*got_off@GOT(%ebx)
101  *	PUSHL	&rel_off
102  *	JMP	-n(%pc)		# -n is pcrel offset to first plt entry
103  *
104  *	The got_off@GOT entry gets filled with the address of the PUSHL,
105  *	so the first pass through the plt jumps back here, jumping
106  *	in turn to the first plt entry, which jumps to the dynamic
107  *	linker.	 The dynamic linker then patches the GOT, rerouting
108  *	future plt calls to the proper destination.
109  */
110 static void
111 plt_entry(Ofl_desc * ofl, Word rel_off, Sym_desc * sdp)
112 {
113 	uchar_t		*pltent, *gotent;
114 	Sword		plt_off;
115 	Word		got_off;
116 
117 	got_off = sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE;
118 	plt_off = M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) *
119 	    M_PLT_ENTSIZE);
120 	pltent = (uchar_t *)(ofl->ofl_osplt->os_outdata->d_buf) + plt_off;
121 	gotent = (uchar_t *)(ofl->ofl_osgot->os_outdata->d_buf) + got_off;
122 
123 	/*
124 	 * Fill in the got entry with the address of the next instruction.
125 	 */
126 	/* LINTED */
127 	*(Word *)gotent = ofl->ofl_osplt->os_shdr->sh_addr + plt_off +
128 	    M_PLT_INSSIZE;
129 
130 	if (!(ofl->ofl_flags & FLG_OF_SHAROBJ)) {
131 		pltent[0] = M_SPECIAL_INST;
132 		pltent[1] = M_JMP_DISP_IND;
133 		pltent += 2;
134 		/* LINTED */
135 		*(Word *)pltent = (Word)(ofl->ofl_osgot->os_shdr->sh_addr +
136 			got_off);
137 	} else {
138 		pltent[0] = M_SPECIAL_INST;
139 		pltent[1] = M_JMP_REG_DISP_IND;
140 		pltent += 2;
141 		/* LINTED */
142 		*(Word *)pltent = (Word)got_off;
143 	}
144 	pltent += 4;
145 
146 	pltent[0] = M_INST_PUSHL;
147 	pltent++;
148 	/* LINTED */
149 	*(Word *)pltent = (Word)rel_off;
150 	pltent += 4;
151 
152 	plt_off = -(plt_off + 16);	/* JMP, PUSHL, JMP take 16 bytes */
153 	pltent[0] = M_INST_JMP;
154 	pltent++;
155 	/* LINTED */
156 	*(Word *)pltent = (Word)plt_off;
157 }
158 
159 uintptr_t
160 perform_outreloc(Rel_desc * orsp, Ofl_desc * ofl)
161 {
162 	Os_desc *	relosp, * osp = 0;
163 	Word		ndx, roffset, value;
164 	Rel		rea;
165 	char		*relbits;
166 	Sym_desc *	sdp, * psym = (Sym_desc *)0;
167 	int		sectmoved = 0;
168 
169 	sdp = orsp->rel_sym;
170 
171 	/*
172 	 * If the section this relocation is against has been discarded
173 	 * (-zignore), then also discard (skip) the relocation itself.
174 	 */
175 	if (orsp->rel_isdesc && ((orsp->rel_flags &
176 	    (FLG_REL_GOT | FLG_REL_BSS | FLG_REL_PLT | FLG_REL_NOINFO)) == 0) &&
177 	    (orsp->rel_isdesc->is_flags & FLG_IS_DISCARD)) {
178 		DBG_CALL(Dbg_reloc_discard(M_MACH, orsp));
179 		return (1);
180 	}
181 
182 	/*
183 	 * If this is a relocation against a move table, or expanded move
184 	 * table, adjust the relocation entries.
185 	 */
186 	if (orsp->rel_move)
187 		adj_movereloc(ofl, orsp);
188 
189 	/*
190 	 * If this is a relocation against a section using a partial initialized
191 	 * symbol, adjust the embedded symbol info.
192 	 *
193 	 * The second argument of the am_I_partial() is the value stored at the
194 	 * target address relocation is going to be applied.
195 	 */
196 	if (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION) {
197 		if (ofl->ofl_parsym.head &&
198 		    (sdp->sd_isc->is_flags & FLG_IS_RELUPD) &&
199 		    /* LINTED */
200 		    (psym = am_I_partial(orsp, *(Xword *)
201 		    ((uchar_t *)(orsp->rel_isdesc->is_indata->d_buf) +
202 		    orsp->rel_roffset)))) {
203 			DBG_CALL(Dbg_move_outsctadj(psym));
204 			sectmoved = 1;
205 		    }
206 	}
207 
208 	value = sdp->sd_sym->st_value;
209 
210 	if (orsp->rel_flags & FLG_REL_GOT) {
211 		osp = ofl->ofl_osgot;
212 		roffset = (Word)calc_got_offset(orsp, ofl);
213 	} else if (orsp->rel_flags & FLG_REL_PLT) {
214 		/*
215 		 * Note that relocations for PLT's actually
216 		 * cause a relocation againt the GOT.
217 		 */
218 		osp = ofl->ofl_osplt;
219 		roffset = (Word) (ofl->ofl_osgot->os_shdr->sh_addr) +
220 		    sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE;
221 
222 		plt_entry(ofl, osp->os_relosdesc->os_szoutrels, sdp);
223 
224 	} else if (orsp->rel_flags & FLG_REL_BSS) {
225 		/*
226 		 * This must be a R_386_COPY.  For these set the roffset to
227 		 * point to the new symbols location.
228 		 */
229 		osp = ofl->ofl_isbss->is_osdesc;
230 		roffset = (Word)value;
231 	} else {
232 		osp = orsp->rel_osdesc;
233 
234 		/*
235 		 * Calculate virtual offset of reference point; equals offset
236 		 * into section + vaddr of section for loadable sections, or
237 		 * offset plus section displacement for nonloadable sections.
238 		 */
239 		roffset = orsp->rel_roffset +
240 		    (Off)_elf_getxoff(orsp->rel_isdesc->is_indata);
241 		if (!(ofl->ofl_flags & FLG_OF_RELOBJ))
242 			roffset += orsp->rel_isdesc->is_osdesc->
243 			    os_shdr->sh_addr;
244 	}
245 
246 	if ((osp == 0) || ((relosp = osp->os_relosdesc) == 0))
247 		relosp = ofl->ofl_osrel;
248 
249 	/*
250 	 * Assign the symbols index for the output relocation.  If the
251 	 * relocation refers to a SECTION symbol then it's index is based upon
252 	 * the output sections symbols index.  Otherwise the index can be
253 	 * derived from the symbols index itself.
254 	 */
255 	if (orsp->rel_rtype == R_386_RELATIVE)
256 		ndx = STN_UNDEF;
257 	else if ((orsp->rel_flags & FLG_REL_SCNNDX) ||
258 	    (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION)) {
259 		if (sectmoved == 0) {
260 			/*
261 			 * Check for a null input section. This can
262 			 * occur if this relocation references a symbol
263 			 * generated by sym_add_sym().
264 			 */
265 			if ((sdp->sd_isc != 0) &&
266 			    (sdp->sd_isc->is_osdesc != 0))
267 				ndx = sdp->sd_isc->is_osdesc->os_scnsymndx;
268 			else
269 				ndx = sdp->sd_shndx;
270 		} else
271 			ndx = ofl->ofl_sunwdata1ndx;
272 	} else
273 		ndx = sdp->sd_symndx;
274 
275 	relbits = (char *)relosp->os_outdata->d_buf;
276 
277 	rea.r_info = ELF_R_INFO(ndx, orsp->rel_rtype);
278 	rea.r_offset = roffset;
279 	DBG_CALL(Dbg_reloc_out(M_MACH, SHT_REL, &rea, orsp->rel_sname,
280 	    relosp->os_name));
281 
282 	/*
283 	 * Assert we haven't walked off the end of our relocation table.
284 	 */
285 	assert(relosp->os_szoutrels <= relosp->os_shdr->sh_size);
286 
287 	(void) memcpy((relbits + relosp->os_szoutrels),
288 	    (char *)&rea, sizeof (Rel));
289 	relosp->os_szoutrels += sizeof (Rel);
290 
291 	/*
292 	 * Determine if this relocation is against a non-writable, allocatable
293 	 * section.  If so we may need to provide a text relocation diagnostic.
294 	 * Note that relocations against the .plt (R_386_JMP_SLOT) actually
295 	 * result in modifications to the .got.
296 	 */
297 	if (orsp->rel_rtype == R_386_JMP_SLOT)
298 		osp = ofl->ofl_osgot;
299 
300 	reloc_remain_entry(orsp, osp, ofl);
301 	return (1);
302 }
303 
304 /*
305  * i386 Instructions for TLS processing
306  */
307 static uchar_t tlsinstr_gd_ie[] = {
308 	/*
309 	 * 0x00	movl %gs:0x0, %eax
310 	 */
311 	0x65, 0xa1, 0x00, 0x00, 0x00, 0x00,
312 	/*
313 	 * 0x06	addl x(%eax), %eax
314 	 * 0x0c ...
315 	 */
316 	0x03, 0x80, 0x00, 0x00, 0x00, 0x00
317 };
318 
319 static uchar_t tlsinstr_gd_le[] = {
320 	/*
321 	 * 0x00 movl %gs:0x0, %eax
322 	 */
323 	0x65, 0xa1, 0x00, 0x00, 0x00, 0x00,
324 	/*
325 	 * 0x06 addl $0x0, %eax
326 	 */
327 	0x05, 0x00, 0x00, 0x00, 0x00,
328 	/*
329 	 * 0x0b nop
330 	 * 0x0c
331 	 */
332 	0x90
333 };
334 
335 static uchar_t tlsinstr_gd_ie_movgs[] = {
336 	/*
337 	 *	movl %gs:0x0,%eax
338 	 */
339 	0x65, 0xa1, 0x00, 0x00, 0x00, 00
340 };
341 
342 #define	TLS_GD_IE_MOV	0x8b	/* movl opcode */
343 #define	TLS_GD_IE_POP	0x58	/* popl + reg */
344 
345 #define	TLS_GD_LE_MOVL	0xb8	/* movl + reg */
346 
347 #define	TLS_NOP		0x90	/* NOP instruction */
348 
349 #define	MODRM_MSK_MOD	0xc0
350 #define	MODRM_MSK_RO	0x38
351 #define	MODRM_MSK_RM	0x07
352 
353 #define	SIB_MSK_SS	0xc0
354 #define	SIB_MSK_IND	0x38
355 #define	SIB_MSK_BS	0x07
356 
357 
358 Fixupret
359 tls_fixups(Rel_desc *arsp)
360 {
361 	Sym_desc	*sdp = arsp->rel_sym;
362 	Word		rtype = arsp->rel_rtype;
363 	uchar_t		*offset, r1, r2;
364 
365 	offset = (uchar_t *)((uintptr_t)arsp->rel_roffset +
366 	    (uintptr_t)_elf_getxoff(arsp->rel_isdesc->is_indata) +
367 	    (uintptr_t)arsp->rel_osdesc->os_outdata->d_buf);
368 
369 	if (sdp->sd_ref == REF_DYN_NEED) {
370 		/*
371 		 * IE reference model
372 		 */
373 		switch (rtype) {
374 		case R_386_TLS_GD:
375 			/*
376 			 * Transition:
377 			 *	0x0 leal x@tlsgd(,r1,1), %eax
378 			 *	0x7 call ___tls_get_addr
379 			 *	0xc
380 			 * To:
381 			 *	0x0 movl %gs:0, %eax
382 			 *	0x6 addl x@gotntpoff(r1), %eax
383 			 */
384 			DBG_CALL(Dbg_reloc_transition(M_MACH,
385 				rtype,
386 				R_386_TLS_GOTIE,
387 				arsp->rel_roffset,
388 				sdp->sd_name));
389 			arsp->rel_rtype = R_386_TLS_GOTIE;
390 			arsp->rel_roffset += 5;
391 			/*
392 			 * Addjust 'offset' to beginning of instruction
393 			 * sequence.
394 			 */
395 			offset -= 3;
396 			r1 = (offset[2] & SIB_MSK_IND) >> 3;
397 			(void) memcpy(offset, tlsinstr_gd_ie,
398 				sizeof (tlsinstr_gd_ie));
399 			/*
400 			 * set register %r1 into the addl
401 			 * instruction.
402 			 */
403 			offset[0x7] |= r1;
404 			return (FIX_RELOC);
405 		case R_386_TLS_GD_PLT:
406 			/*
407 			 * Fixup done via the TLS_GD relocation
408 			 */
409 			DBG_CALL(Dbg_reloc_transition(M_MACH,
410 				rtype,
411 				R_386_NONE,
412 				arsp->rel_roffset,
413 				sdp->sd_name));
414 			return (FIX_DONE);
415 		}
416 	}
417 
418 	/*
419 	 * LE reference model
420 	 */
421 	switch (rtype) {
422 	case R_386_TLS_GD:
423 		/*
424 		 * Transition:
425 		 *	0x0 leal x@tlsgd(,r1,1), %eax
426 		 *	0x7 call ___tls_get_addr
427 		 *	0xc
428 		 * To:
429 		 *	0x0 movl %gs:0, %eax
430 		 *	0x6 addl $x@ntpoff, %eax
431 		 *	0xb nop
432 		 *	0xc
433 		 */
434 		DBG_CALL(Dbg_reloc_transition(M_MACH,
435 			rtype,
436 			R_386_TLS_LE,
437 			arsp->rel_roffset,
438 			sdp->sd_name));
439 
440 		arsp->rel_rtype = R_386_TLS_LE;
441 		arsp->rel_roffset += 4;
442 		/*
443 		 * Addjust 'offset' to beginning of instruction
444 		 * sequence.
445 		 */
446 		offset -= 3;
447 		(void) memcpy(offset, tlsinstr_gd_le,
448 			sizeof (tlsinstr_gd_le));
449 		return (FIX_RELOC);
450 	case R_386_TLS_GD_PLT:
451 	case R_386_PLT32:
452 		/*
453 		 * Fixup done via the TLS_GD relocation
454 		 */
455 		DBG_CALL(Dbg_reloc_transition(M_MACH,
456 			rtype,
457 			R_386_NONE,
458 			arsp->rel_roffset,
459 			sdp->sd_name));
460 		return (FIX_DONE);
461 	case R_386_TLS_LDM_PLT:
462 		DBG_CALL(Dbg_reloc_transition(M_MACH,
463 			rtype,
464 			R_386_NONE,
465 			arsp->rel_roffset,
466 			sdp->sd_name));
467 		/*
468 		 * Transition:
469 		 *	call __tls_get_addr()
470 		 * to:
471 		 *	nop
472 		 *	nop
473 		 *	nop
474 		 *	nop
475 		 *	nop
476 		 */
477 		*(offset - 1) = TLS_NOP;
478 		*(offset) = TLS_NOP;
479 		*(offset + 1) = TLS_NOP;
480 		*(offset + 2) = TLS_NOP;
481 		*(offset + 3) = TLS_NOP;
482 		return (FIX_DONE);
483 	case R_386_TLS_LDM:
484 		DBG_CALL(Dbg_reloc_transition(M_MACH,
485 			rtype,
486 			R_386_NONE,
487 			arsp->rel_roffset,
488 			sdp->sd_name));
489 		/*
490 		 * Transition:
491 		 *
492 		 *  0x00 leal x1@tlsldm(%ebx), %eax
493 		 *  0x06 call ___tls_get_addr
494 		 *
495 		 * to:
496 		 *
497 		 *  0x00 movl %gs:0, %eax
498 		 */
499 		(void) memcpy(offset - 2, tlsinstr_gd_ie_movgs,
500 			sizeof (tlsinstr_gd_ie_movgs));
501 		return (FIX_DONE);
502 	case R_386_TLS_LDO_32:
503 		/*
504 		 *
505 		 *  Instructions:
506 		 *
507 		 *  0x10 leal x1@dtpoff(%eax), %edx	R_386_TLS_LDO_32
508 		 *		to
509 		 *  0x10 leal x1@ntpoff(%eax), %edx	R_386_TLS_LE
510 		 *
511 		 */
512 		offset -= 2;
513 
514 		DBG_CALL(Dbg_reloc_transition(M_MACH,
515 			rtype,
516 			R_386_TLS_LE,
517 			arsp->rel_roffset,
518 			sdp->sd_name));
519 		arsp->rel_rtype = R_386_TLS_LE;
520 		return (FIX_RELOC);
521 	case R_386_TLS_GOTIE:
522 		/*
523 		 * These transitions are a little different than the
524 		 * others, in that we could have multiple instructions
525 		 * pointed to by a single relocation.  Depending upon the
526 		 * instruction, we perform a different code transition.
527 		 *
528 		 * Here's the known transitions:
529 		 *
530 		 *  1) movl foo@gotntpoff(%reg1), %reg2
531 		 *	0x8b, 0x80 | (reg2 << 3) | reg1, foo@gotntpoff
532 		 *
533 		 *  2) addl foo@gotntpoff(%reg1), %reg2
534 		 *	0x03, 0x80 | (reg2 << 3) | reg1, foo@gotntpoff
535 		 *
536 		 *  Transitions IE -> LE
537 		 *
538 		 *  1) movl $foo@ntpoff, %reg2
539 		 *	0xc7, 0xc0 | reg2, foo@ntpoff
540 		 *
541 		 *  2) addl $foo@ntpoff, %reg2
542 		 *	0x81, 0xc0 | reg2, foo@ntpoff
543 		 *
544 		 *
545 		 * Note: reg1 != 4 (%esp)
546 		 */
547 		DBG_CALL(Dbg_reloc_transition(M_MACH,
548 			rtype,
549 			R_386_TLS_LE,
550 			arsp->rel_roffset,
551 			sdp->sd_name));
552 		arsp->rel_rtype = R_386_TLS_LE;
553 		offset -= 2;
554 		r2 = (offset[1] & MODRM_MSK_RO) >> 3;
555 		if (offset[0] == 0x8b) {
556 			/* case 1 above */
557 			offset[0] = 0xc7;	/* movl */
558 			offset[1] = 0xc0 | r2;
559 			return (FIX_RELOC);
560 		}
561 
562 		if (offset[0] == 0x03) {
563 			/* case 2 above */
564 			assert(offset[0] == 0x03);
565 			offset[0] = 0x81;	/* addl */
566 			offset[1] = 0xc0 | r2;
567 			return (FIX_RELOC);
568 		}
569 
570 		/*
571 		 * Unexpected instruction sequence - fatal error.
572 		 */
573 		eprintf(ERR_FATAL, MSG_INTL(MSG_REL_BADTLSINS),
574 		    conv_reloc_386_type_str(arsp->rel_rtype),
575 		    arsp->rel_isdesc->is_file->ifl_name,
576 		    demangle(arsp->rel_sname), arsp->rel_isdesc->is_name,
577 		    EC_OFF(arsp->rel_roffset));
578 		return (FIX_ERROR);
579 	case R_386_TLS_IE:
580 		/*
581 		 * These transitions are a little different than the
582 		 * others, in that we could have multiple instructions
583 		 * pointed to by a single relocation.  Depending upon the
584 		 * instruction, we perform a different code transition.
585 		 *
586 		 * Here's the known transitions:
587 		 *  1) movl foo@indntpoff, %eax
588 		 *	0xa1, foo@indntpoff
589 		 *
590 		 *  2) movl foo@indntpoff, %eax
591 		 *	0x8b, 0x05 | (reg << 3), foo@gotntpoff
592 		 *
593 		 *  3) addl foo@indntpoff, %eax
594 		 *	0x03, 0x05 | (reg << 3), foo@gotntpoff
595 		 *
596 		 *  Transitions IE -> LE
597 		 *
598 		 *  1) movl $foo@ntpoff, %eax
599 		 *	0xb8, foo@ntpoff
600 		 *
601 		 *  2) movl $foo@ntpoff, %reg
602 		 *	0xc7, 0xc0 | reg, foo@ntpoff
603 		 *
604 		 *  3) addl $foo@ntpoff, %reg
605 		 *	0x81, 0xc0 | reg, foo@ntpoff
606 		 */
607 		arsp->rel_rtype = R_386_TLS_LE;
608 		offset--;
609 		if (offset[0] == 0xa1) {
610 			/* case 1 above */
611 			offset[0] = 0xb8;	/*  movl */
612 			return (FIX_RELOC);
613 		}
614 
615 		offset--;
616 		if (offset[0] == 0x8b) {
617 			/* case 2 above */
618 			r2 = (offset[1] & MODRM_MSK_RO) >> 3;
619 			offset[0] = 0xc7;	/* movl */
620 			offset[1] = 0xc0 | r2;
621 			return (FIX_RELOC);
622 		}
623 		if (offset[0] == 0x03) {
624 			/* case 3 above */
625 			r2 = (offset[1] & MODRM_MSK_RO) >> 3;
626 			offset[0] = 0x81;	/* addl */
627 			offset[1] = 0xc0 | r2;
628 			return (FIX_RELOC);
629 		}
630 		/*
631 		 * Unexpected instruction sequence - fatal error.
632 		 */
633 		eprintf(ERR_FATAL, MSG_INTL(MSG_REL_BADTLSINS),
634 		    conv_reloc_386_type_str(arsp->rel_rtype),
635 		    arsp->rel_isdesc->is_file->ifl_name,
636 		    demangle(arsp->rel_sname), arsp->rel_isdesc->is_name,
637 		    EC_OFF(arsp->rel_roffset));
638 		return (FIX_ERROR);
639 	}
640 	return (FIX_RELOC);
641 }
642 
643 uintptr_t
644 do_activerelocs(Ofl_desc *ofl)
645 {
646 	Rel_desc	*arsp;
647 	Rel_cache	*rcp;
648 	Listnode	*lnp;
649 	uintptr_t	return_code = 1;
650 	Word		flags = ofl->ofl_flags;
651 	Word		dtflags1 = ofl->ofl_dtflags_1;
652 
653 	DBG_CALL(Dbg_reloc_doactiverel());
654 	/*
655 	 * Process active relocations.
656 	 */
657 	for (LIST_TRAVERSE(&ofl->ofl_actrels, lnp, rcp)) {
658 		/* LINTED */
659 		for (arsp = (Rel_desc *)(rcp + 1);
660 		    arsp < rcp->rc_free; arsp++) {
661 			uchar_t		*addr;
662 			Xword 		value;
663 			Sym_desc	*sdp;
664 			const char	*ifl_name;
665 			Xword		refaddr;
666 			int		moved = 0;
667 			Gotref		gref;
668 
669 			/*
670 			 * If the section this relocation is against has been
671 			 * discarded (-zignore), then discard (skip) the
672 			 * relocation itself.
673 			 */
674 			if ((arsp->rel_isdesc->is_flags & FLG_IS_DISCARD) &&
675 			    ((arsp->rel_flags &
676 			    (FLG_REL_GOT | FLG_REL_BSS |
677 			    FLG_REL_PLT | FLG_REL_NOINFO)) == 0)) {
678 				DBG_CALL(Dbg_reloc_discard(M_MACH, arsp));
679 				continue;
680 			}
681 
682 			/*
683 			 * We deteremine what the 'got reference'
684 			 * model (if required) is at this point.  This
685 			 * needs to be done before tls_fixup() since
686 			 * it may 'transition' our instructions.
687 			 *
688 			 * The got table entries have already been assigned,
689 			 * and we bind to those initial entries.
690 			 */
691 			if (arsp->rel_flags & FLG_REL_DTLS)
692 				gref = GOT_REF_TLSGD;
693 			else if (arsp->rel_flags & FLG_REL_MTLS)
694 				gref = GOT_REF_TLSLD;
695 			else if (arsp->rel_flags & FLG_REL_STLS)
696 				gref = GOT_REF_TLSIE;
697 			else
698 				gref = GOT_REF_GENERIC;
699 
700 			/*
701 			 * Perform any required TLS fixups.
702 			 */
703 			if (arsp->rel_flags & FLG_REL_TLSFIX) {
704 				Fixupret	ret;
705 
706 				if ((ret = tls_fixups(arsp)) == FIX_ERROR)
707 					return (S_ERROR);
708 				if (ret == FIX_DONE)
709 					continue;
710 			}
711 
712 			/*
713 			 * If this is a relocation against a move table, or
714 			 * expanded move table, adjust the relocation entries.
715 			 */
716 			if (arsp->rel_move)
717 				adj_movereloc(ofl, arsp);
718 
719 			sdp = arsp->rel_sym;
720 			refaddr = arsp->rel_roffset +
721 			    (Off)_elf_getxoff(arsp->rel_isdesc->is_indata);
722 
723 			if (arsp->rel_flags & FLG_REL_CLVAL)
724 				value = 0;
725 			else if (ELF_ST_TYPE(sdp->sd_sym->st_info) ==
726 			    STT_SECTION) {
727 				Sym_desc	*sym;
728 
729 				/*
730 				 * The value for a symbol pointing to a SECTION
731 				 * is based off of that sections position.
732 				 *
733 				 * The second argument of the am_I_partial() is
734 				 * the value stored at the target address
735 				 * relocation is going to be applied.
736 				 */
737 				if ((sdp->sd_isc->is_flags & FLG_IS_RELUPD) &&
738 				    /* LINTED */
739 				    (sym = am_I_partial(arsp, *(Xword *)
740 				    ((uchar_t *)
741 				    arsp->rel_isdesc->is_indata->d_buf +
742 				    arsp->rel_roffset)))) {
743 					/*
744 					 * If the symbol is moved,
745 					 * adjust the value
746 					 */
747 					value = sym->sd_sym->st_value;
748 					moved = 1;
749 				} else {
750 					value = _elf_getxoff(
751 					    sdp->sd_isc->is_indata);
752 					if (sdp->sd_isc->is_shdr->sh_flags &
753 					    SHF_ALLOC)
754 						value += sdp->sd_isc->
755 						    is_osdesc->os_shdr->sh_addr;
756 				}
757 				if (sdp->sd_isc->is_shdr->sh_flags & SHF_TLS)
758 					value -= ofl->ofl_tlsphdr->p_vaddr;
759 			} else {
760 				/*
761 				 * else the value is the symbols value
762 				 */
763 				value = sdp->sd_sym->st_value;
764 			}
765 
766 			/*
767 			 * Relocation against the GLOBAL_OFFSET_TABLE.
768 			 */
769 			if (arsp->rel_flags & FLG_REL_GOT)
770 				arsp->rel_osdesc = ofl->ofl_osgot;
771 
772 			/*
773 			 * If loadable and not producing a relocatable object
774 			 * add the sections virtual address to the reference
775 			 * address.
776 			 */
777 			if ((arsp->rel_flags & FLG_REL_LOAD) &&
778 			    ((flags & FLG_OF_RELOBJ) == 0))
779 				refaddr += arsp->rel_isdesc->is_osdesc->
780 				    os_shdr->sh_addr;
781 
782 			/*
783 			 * If this entry has a PLT assigned to it, it's
784 			 * value is actually the address of the PLT (and
785 			 * not the address of the function).
786 			 */
787 			if (IS_PLT(arsp->rel_rtype)) {
788 				if (sdp->sd_aux && sdp->sd_aux->sa_PLTndx)
789 					value = calc_plt_addr(sdp, ofl);
790 			}
791 
792 			/*
793 			 * Determine whether the value needs further adjustment.
794 			 * Filter through the attributes of the relocation to
795 			 * determine what adjustment is required.  Note, many
796 			 * of the following cases are only applicable when a
797 			 * .got is present.  As a .got is not generated when a
798 			 * relocatable object is being built, any adjustments
799 			 * that require a .got need to be skipped.
800 			 */
801 			if ((arsp->rel_flags & FLG_REL_GOT) &&
802 			    ((flags & FLG_OF_RELOBJ) == 0)) {
803 				Xword		R1addr;
804 				uintptr_t	R2addr;
805 				Word		gotndx;
806 				Gotndx		*gnp;
807 
808 				/*
809 				 * Perform relocation against GOT table.  Since
810 				 * this doesn't fit exactly into a relocation
811 				 * we place the appropriate byte in the GOT
812 				 * directly
813 				 *
814 				 * Calculate offset into GOT at which to apply
815 				 * the relocation.
816 				 */
817 				gnp = find_gotndx(&(sdp->sd_GOTndxs), gref,
818 				    ofl, 0);
819 				assert(gnp);
820 
821 				if (arsp->rel_rtype == R_386_TLS_DTPOFF32)
822 					gotndx = gnp->gn_gotndx + 1;
823 				else
824 					gotndx = gnp->gn_gotndx;
825 
826 				R1addr = (Xword)(gotndx * M_GOT_ENTSIZE);
827 
828 				/*
829 				 * Add the GOTs data's offset.
830 				 */
831 				R2addr = R1addr + (uintptr_t)
832 				    arsp->rel_osdesc->os_outdata->d_buf;
833 
834 				DBG_CALL(Dbg_reloc_doact(M_MACH,
835 				    arsp->rel_rtype, R1addr, value,
836 				    arsp->rel_sname, arsp->rel_osdesc));
837 
838 				/*
839 				 * And do it.
840 				 */
841 				*(Xword *)R2addr = value;
842 				continue;
843 
844 			} else if (IS_GOT_BASED(arsp->rel_rtype) &&
845 			    ((flags & FLG_OF_RELOBJ) == 0)) {
846 				value -= ofl->ofl_osgot->os_shdr->sh_addr;
847 
848 			} else if (IS_GOT_PC(arsp->rel_rtype) &&
849 			    ((flags & FLG_OF_RELOBJ) == 0)) {
850 				value =
851 				    (Xword)(ofl->ofl_osgot->os_shdr->sh_addr) -
852 				    refaddr;
853 
854 			} else if ((IS_PC_RELATIVE(arsp->rel_rtype)) &&
855 			    (((flags & FLG_OF_RELOBJ) == 0) ||
856 			    (arsp->rel_osdesc == sdp->sd_isc->is_osdesc))) {
857 				value -= refaddr;
858 
859 			} else if (IS_TLS_INS(arsp->rel_rtype) &&
860 			    IS_GOT_RELATIVE(arsp->rel_rtype) &&
861 			    ((flags & FLG_OF_RELOBJ) == 0)) {
862 				Gotndx	*gnp;
863 
864 				gnp = find_gotndx(&(sdp->sd_GOTndxs), gref,
865 				    ofl, 0);
866 				assert(gnp);
867 				value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE;
868 				if (arsp->rel_rtype == R_386_TLS_IE) {
869 					value +=
870 					    ofl->ofl_osgot->os_shdr->sh_addr;
871 				}
872 
873 			} else if (IS_GOT_RELATIVE(arsp->rel_rtype) &&
874 			    ((flags & FLG_OF_RELOBJ) == 0)) {
875 				Gotndx *gnp;
876 
877 				gnp = find_gotndx(&(sdp->sd_GOTndxs),
878 				    GOT_REF_GENERIC, ofl, 0);
879 				assert(gnp);
880 				value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE;
881 
882 			} else if ((arsp->rel_flags & FLG_REL_STLS) &&
883 			    ((flags & FLG_OF_RELOBJ) == 0)) {
884 				Xword	tlsstatsize;
885 
886 				/*
887 				 * This is the LE TLS reference model.  Static
888 				 * offset is hard-coded.
889 				 */
890 				tlsstatsize =
891 				    S_ROUND(ofl->ofl_tlsphdr->p_memsz,
892 				    M_TLSSTATALIGN);
893 				value = tlsstatsize - value;
894 
895 				/*
896 				 * Since this code is fixed up, it assumes a
897 				 * negative offset that can be added to the
898 				 * thread pointer.
899 				 */
900 				if ((arsp->rel_rtype == R_386_TLS_LDO_32) ||
901 				    (arsp->rel_rtype == R_386_TLS_LE))
902 					value = -value;
903 			}
904 
905 			if (arsp->rel_isdesc->is_file)
906 				ifl_name = arsp->rel_isdesc->is_file->ifl_name;
907 			else
908 				ifl_name = MSG_INTL(MSG_STR_NULL);
909 
910 			/*
911 			 * Make sure we have data to relocate.  Compiler and
912 			 * assembler developers have been known to generate
913 			 * relocations against invalid sections (normally .bss),
914 			 * so for their benefit give them sufficient information
915 			 * to help analyze the problem.  End users should never
916 			 * see this.
917 			 */
918 			if (arsp->rel_isdesc->is_indata->d_buf == 0) {
919 				eprintf(ERR_FATAL, MSG_INTL(MSG_REL_EMPTYSEC),
920 				    conv_reloc_386_type_str(arsp->rel_rtype),
921 				    ifl_name, demangle(arsp->rel_sname),
922 				    arsp->rel_isdesc->is_name);
923 				return (S_ERROR);
924 			}
925 
926 			/*
927 			 * Get the address of the data item we need to modify.
928 			 */
929 			addr = (uchar_t *)((uintptr_t)arsp->rel_roffset +
930 			    (uintptr_t)_elf_getxoff(arsp->rel_isdesc->
931 			    is_indata));
932 
933 			DBG_CALL(Dbg_reloc_doact(M_MACH, arsp->rel_rtype,
934 			    (uintptr_t)addr, value, arsp->rel_sname,
935 			    arsp->rel_osdesc));
936 			addr += (uintptr_t)arsp->rel_osdesc->os_outdata->d_buf;
937 
938 			if ((((uintptr_t)addr - (uintptr_t)ofl->ofl_ehdr) >
939 			    ofl->ofl_size) || (arsp->rel_roffset >
940 			    arsp->rel_osdesc->os_shdr->sh_size)) {
941 				int	class;
942 
943 				if (((uintptr_t)addr -
944 				    (uintptr_t)ofl->ofl_ehdr) > ofl->ofl_size)
945 					class = ERR_FATAL;
946 				else
947 					class = ERR_WARNING;
948 
949 				eprintf(class, MSG_INTL(MSG_REL_INVALOFFSET),
950 				    conv_reloc_386_type_str(arsp->rel_rtype),
951 				    ifl_name, arsp->rel_isdesc->is_name,
952 				    demangle(arsp->rel_sname),
953 				    EC_ADDR((uintptr_t)addr -
954 				    (uintptr_t)ofl->ofl_ehdr));
955 
956 				if (class == ERR_FATAL) {
957 					return_code = S_ERROR;
958 					continue;
959 				}
960 			}
961 
962 			/*
963 			 * The relocation is additive.  Ignore the previous
964 			 * symbol value if this local partial symbol is
965 			 * expanded.
966 			 */
967 			if (moved)
968 				value -= *addr;
969 
970 			/*
971 			 * If '-z noreloc' is specified - skip the do_reloc
972 			 * stage.
973 			 */
974 			if ((flags & FLG_OF_RELOBJ) ||
975 			    !(dtflags1 & DF_1_NORELOC)) {
976 				if (do_reloc((uchar_t)arsp->rel_rtype,
977 				    addr, &value, arsp->rel_sname,
978 				    ifl_name) == 0)
979 					return_code = S_ERROR;
980 			}
981 		}
982 	}
983 	return (return_code);
984 }
985 
986 /*
987  * Add an output relocation record.
988  */
989 uintptr_t
990 add_outrel(Word flags, Rel_desc *rsp, Ofl_desc *ofl)
991 {
992 	Rel_desc	*orsp;
993 	Rel_cache	*rcp;
994 	Sym_desc	*sdp = rsp->rel_sym;
995 
996 	/*
997 	 * Static executables *do not* want any relocations against them.
998 	 * Since our engine still creates relocations against a WEAK UNDEFINED
999 	 * symbol in a static executable, it's best to disable them here
1000 	 * instead of through out the relocation code.
1001 	 */
1002 	if ((ofl->ofl_flags & (FLG_OF_STATIC | FLG_OF_EXEC)) ==
1003 	    (FLG_OF_STATIC | FLG_OF_EXEC))
1004 		return (1);
1005 
1006 	/*
1007 	 * If no relocation cache structures are available allocate
1008 	 * a new one and link it into the cache list.
1009 	 */
1010 	if ((ofl->ofl_outrels.tail == 0) ||
1011 	    ((rcp = (Rel_cache *)ofl->ofl_outrels.tail->data) == 0) ||
1012 	    ((orsp = rcp->rc_free) == rcp->rc_end)) {
1013 		static size_t	nextsize = 0;
1014 		size_t		size;
1015 
1016 		/*
1017 		 * Output relocation numbers can vary considerably between
1018 		 * building executables or shared objects (pic vs. non-pic),
1019 		 * etc.  But, they typically aren't very large, so for these
1020 		 * objects use a standard bucket size.  For building relocatable
1021 		 * objects, typically there will be an output relocation for
1022 		 * every input relocation.
1023 		 */
1024 		if (nextsize == 0) {
1025 			if (ofl->ofl_flags & FLG_OF_RELOBJ) {
1026 				if ((size = ofl->ofl_relocincnt) == 0)
1027 					size = REL_LOIDESCNO;
1028 				if (size > REL_HOIDESCNO)
1029 					nextsize = REL_HOIDESCNO;
1030 				else
1031 					nextsize = REL_LOIDESCNO;
1032 			} else
1033 				nextsize = size = REL_HOIDESCNO;
1034 		} else
1035 			size = nextsize;
1036 
1037 		size = size * sizeof (Rel_desc);
1038 
1039 		if (((rcp = libld_malloc(sizeof (Rel_cache) + size)) == 0) ||
1040 		    (list_appendc(&ofl->ofl_outrels, rcp) == 0))
1041 			return (S_ERROR);
1042 
1043 		/* LINTED */
1044 		rcp->rc_free = orsp = (Rel_desc *)(rcp + 1);
1045 		/* LINTED */
1046 		rcp->rc_end = (Rel_desc *)((char *)rcp->rc_free + size);
1047 	}
1048 
1049 	/*
1050 	 * If we are adding a output relocation against a section
1051 	 * symbol (non-RELATIVE) then mark that section.  These sections
1052 	 * will be added to the .dynsym symbol table.
1053 	 */
1054 	if (sdp && (rsp->rel_rtype != M_R_RELATIVE) &&
1055 	    ((flags & FLG_REL_SCNNDX) ||
1056 	    (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION))) {
1057 
1058 		/*
1059 		 * If this is a COMMON symbol - no output section
1060 		 * exists yet - (it's created as part of sym_validate()).
1061 		 * So - we mark here that when it's created it should
1062 		 * be tagged with the FLG_OS_OUTREL flag.
1063 		 */
1064 		if ((sdp->sd_flags & FLG_SY_SPECSEC) &&
1065 		    (sdp->sd_shndx == SHN_COMMON)) {
1066 			if (ELF_ST_TYPE(sdp->sd_sym->st_info) != STT_TLS)
1067 				ofl->ofl_flags1 |= FLG_OF1_BSSOREL;
1068 			else
1069 				ofl->ofl_flags1 |= FLG_OF1_TLSOREL;
1070 		} else {
1071 			Os_desc	*osp = sdp->sd_isc->is_osdesc;
1072 
1073 			if ((osp->os_flags & FLG_OS_OUTREL) == 0) {
1074 				ofl->ofl_dynshdrcnt++;
1075 				osp->os_flags |= FLG_OS_OUTREL;
1076 			}
1077 		}
1078 	}
1079 
1080 	*orsp = *rsp;
1081 	orsp->rel_flags |= flags;
1082 
1083 	rcp->rc_free++;
1084 	ofl->ofl_outrelscnt++;
1085 
1086 	if (flags & FLG_REL_GOT)
1087 		ofl->ofl_relocgotsz += (Xword)sizeof (Rel);
1088 	else if (flags & FLG_REL_PLT)
1089 		ofl->ofl_relocpltsz += (Xword)sizeof (Rel);
1090 	else if (flags & FLG_REL_BSS)
1091 		ofl->ofl_relocbsssz += (Xword)sizeof (Rel);
1092 	else if (flags & FLG_REL_NOINFO)
1093 		ofl->ofl_relocrelsz += (Xword)sizeof (Rel);
1094 	else
1095 		orsp->rel_osdesc->os_szoutrels += (Xword)sizeof (Rel);
1096 
1097 	if (orsp->rel_rtype == M_R_RELATIVE)
1098 		ofl->ofl_relocrelcnt++;
1099 
1100 	/*
1101 	 * We don't perform sorting on PLT relocations because
1102 	 * they have already been assigned a PLT index and if we
1103 	 * were to sort them we would have to re-assign the plt indexes.
1104 	 */
1105 	if (!(flags & FLG_REL_PLT))
1106 		ofl->ofl_reloccnt++;
1107 
1108 	/*
1109 	 * Insure a GLOBAL_OFFSET_TABLE is generated if required.
1110 	 */
1111 	if (IS_GOT_REQUIRED(orsp->rel_rtype))
1112 		ofl->ofl_flags |= FLG_OF_BLDGOT;
1113 
1114 	/*
1115 	 * Identify and possibly warn of a displacement relocation.
1116 	 */
1117 	if (orsp->rel_flags & FLG_REL_DISP) {
1118 		ofl->ofl_dtflags_1 |= DF_1_DISPRELPND;
1119 
1120 		if (ofl->ofl_flags & FLG_OF_VERBOSE)
1121 			disp_errmsg(MSG_INTL(MSG_REL_DISPREL4), orsp, ofl);
1122 	}
1123 	DBG_CALL(Dbg_reloc_ors_entry(M_MACH, orsp));
1124 	return (1);
1125 }
1126 
1127 /*
1128  * Stub routine since register symbols are not supported on i386.
1129  */
1130 /* ARGSUSED */
1131 uintptr_t
1132 reloc_register(Rel_desc * rsp, Is_desc * isp, Ofl_desc * ofl)
1133 {
1134 	eprintf(ERR_FATAL, MSG_INTL(MSG_REL_NOREG));
1135 	return (S_ERROR);
1136 }
1137 
1138 /*
1139  * process relocation for a LOCAL symbol
1140  */
1141 uintptr_t
1142 reloc_local(Rel_desc * rsp, Ofl_desc * ofl)
1143 {
1144 	Word		flags = ofl->ofl_flags;
1145 	Sym_desc	*sdp = rsp->rel_sym;
1146 	Word		shndx = rsp->rel_sym->sd_shndx;
1147 
1148 	/*
1149 	 * if ((shared object) and (not pc relative relocation) and
1150 	 *    (not against ABS symbol))
1151 	 * then
1152 	 *	build R_386_RELATIVE
1153 	 * fi
1154 	 */
1155 	if ((flags & FLG_OF_SHAROBJ) && (rsp->rel_flags & FLG_REL_LOAD) &&
1156 	    !(IS_PC_RELATIVE(rsp->rel_rtype)) &&
1157 	    !(IS_GOT_BASED(rsp->rel_rtype)) &&
1158 	    !(rsp->rel_isdesc != NULL &&
1159 	    (rsp->rel_isdesc->is_shdr->sh_type == SHT_SUNW_dof)) &&
1160 	    (((sdp->sd_flags & FLG_SY_SPECSEC) == 0) ||
1161 	    (shndx != SHN_ABS) || (sdp->sd_aux && sdp->sd_aux->sa_symspec))) {
1162 		Word	ortype = rsp->rel_rtype;
1163 
1164 		rsp->rel_rtype = R_386_RELATIVE;
1165 		if (add_outrel(NULL, rsp, ofl) == S_ERROR)
1166 			return (S_ERROR);
1167 		rsp->rel_rtype = ortype;
1168 	}
1169 
1170 	/*
1171 	 * If the relocation is against a 'non-allocatable' section
1172 	 * and we can not resolve it now - then give a warning
1173 	 * message.
1174 	 *
1175 	 * We can not resolve the symbol if either:
1176 	 *	a) it's undefined
1177 	 *	b) it's defined in a shared library and a
1178 	 *	   COPY relocation hasn't moved it to the executable
1179 	 *
1180 	 * Note: because we process all of the relocations against the
1181 	 *	text segment before any others - we know whether
1182 	 *	or not a copy relocation will be generated before
1183 	 *	we get here (see reloc_init()->reloc_segments()).
1184 	 */
1185 	if (!(rsp->rel_flags & FLG_REL_LOAD) &&
1186 	    ((shndx == SHN_UNDEF) ||
1187 	    ((sdp->sd_ref == REF_DYN_NEED) &&
1188 	    ((sdp->sd_flags & FLG_SY_MVTOCOMM) == 0)))) {
1189 		/*
1190 		 * If the relocation is against a SHT_SUNW_ANNOTATE
1191 		 * section - then silently ignore that the relocation
1192 		 * can not be resolved.
1193 		 */
1194 		if (rsp->rel_osdesc &&
1195 		    (rsp->rel_osdesc->os_shdr->sh_type == SHT_SUNW_ANNOTATE))
1196 			return (0);
1197 		(void) eprintf(ERR_WARNING, MSG_INTL(MSG_REL_EXTERNSYM),
1198 		    conv_reloc_386_type_str(rsp->rel_rtype),
1199 		    rsp->rel_isdesc->is_file->ifl_name,
1200 		    demangle(rsp->rel_sname), rsp->rel_osdesc->os_name);
1201 		return (1);
1202 	}
1203 
1204 	/*
1205 	 * Perform relocation.
1206 	 */
1207 	return (add_actrel(NULL, rsp, ofl));
1208 }
1209 
1210 uintptr_t
1211 /* ARGSUSED */
1212 reloc_GOTOP(Boolean local, Rel_desc * rsp, Ofl_desc * ofl)
1213 {
1214 	/*
1215 	 * Stub routine for common code compatibility, we shouldn't
1216 	 * actually get here on x86.
1217 	 */
1218 	assert(0);
1219 	return (S_ERROR);
1220 }
1221 
1222 uintptr_t
1223 reloc_TLS(Boolean local, Rel_desc * rsp, Ofl_desc * ofl)
1224 {
1225 	Word		rtype = rsp->rel_rtype;
1226 	Sym_desc	*sdp = rsp->rel_sym;
1227 	Word		flags = ofl->ofl_flags;
1228 	Word		rflags;
1229 	Gotndx		*gnp;
1230 
1231 	/*
1232 	 * all TLS relocations are illegal in a static executable.
1233 	 */
1234 	if ((ofl->ofl_flags & (FLG_OF_STATIC | FLG_OF_EXEC)) ==
1235 	    (FLG_OF_STATIC | FLG_OF_EXEC)) {
1236 		eprintf(ERR_FATAL, MSG_INTL(MSG_REL_TLSSTAT),
1237 		    conv_reloc_386_type_str(rsp->rel_rtype),
1238 		    rsp->rel_isdesc->is_file->ifl_name,
1239 		    demangle(rsp->rel_sname));
1240 		return (S_ERROR);
1241 	}
1242 
1243 	/*
1244 	 * Any TLS relocation must be against a STT_TLS symbol, all others
1245 	 * are illegal.
1246 	 */
1247 	if (ELF_ST_TYPE(sdp->sd_sym->st_info) != STT_TLS) {
1248 		eprintf(ERR_FATAL, MSG_INTL(MSG_REL_TLSBADSYM),
1249 		    conv_reloc_386_type_str(rsp->rel_rtype),
1250 		    rsp->rel_isdesc->is_file->ifl_name,
1251 		    demangle(rsp->rel_sname),
1252 		    conv_info_type_str(ofl->ofl_e_machine,
1253 		    ELF_ST_TYPE(sdp->sd_sym->st_info)));
1254 		return (S_ERROR);
1255 	}
1256 
1257 	/*
1258 	 * We're a executable - use either the IE or LE
1259 	 * access model.
1260 	 */
1261 	if (flags & FLG_OF_EXEC) {
1262 		/*
1263 		 * If we are using either IE or LE reference
1264 		 * model set the DF_STATIC_TLS flag.
1265 		 */
1266 		ofl->ofl_dtflags |= DF_STATIC_TLS;
1267 
1268 		if (!local) {
1269 			Gotref	gref;
1270 			/*
1271 			 * IE access model
1272 			 */
1273 			/*
1274 			 * It's not possible for LD or LE reference
1275 			 * models to reference a symbol external to
1276 			 * the current object.
1277 			 */
1278 			if (IS_TLS_LD(rtype) || IS_TLS_LE(rtype)) {
1279 				eprintf(ERR_FATAL, MSG_INTL(MSG_REL_TLSBND),
1280 				    conv_reloc_386_type_str(rsp->rel_rtype),
1281 				    rsp->rel_isdesc->is_file->ifl_name,
1282 				    demangle(rsp->rel_sname),
1283 				    sdp->sd_file->ifl_name);
1284 				return (S_ERROR);
1285 			}
1286 
1287 			gref = GOT_REF_TLSIE;
1288 
1289 			/*
1290 			 * Assign a GOT entry for static TLS references
1291 			 */
1292 			if ((gnp = find_gotndx(&(sdp->sd_GOTndxs),
1293 			    gref, ofl, 0)) == 0) {
1294 				if (assign_gotndx(&(sdp->sd_GOTndxs),
1295 				    gnp, gref, ofl, rsp, sdp) == S_ERROR)
1296 					return (S_ERROR);
1297 				rsp->rel_rtype = R_386_TLS_TPOFF;
1298 				if (add_outrel((FLG_REL_GOT | FLG_REL_STLS),
1299 				    rsp, ofl) == S_ERROR)
1300 					return (S_ERROR);
1301 				rsp->rel_rtype = rtype;
1302 			}
1303 			if (IS_TLS_IE(rtype))
1304 				return (add_actrel(FLG_REL_STLS, rsp, ofl));
1305 
1306 			/*
1307 			 * If (GD or LD) reference models - fixups
1308 			 * are required.
1309 			 */
1310 			return (add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS),
1311 			    rsp, ofl));
1312 		}
1313 		/*
1314 		 * LE access model
1315 		 */
1316 		if (IS_TLS_LE(rtype) || (rtype == R_386_TLS_LDO_32))
1317 			return (add_actrel(FLG_REL_STLS, rsp, ofl));
1318 
1319 		return (add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS), rsp, ofl));
1320 	}
1321 
1322 	/*
1323 	 * Building a shared object
1324 	 */
1325 
1326 	/*
1327 	 * Building a shared object - only GD & LD access models
1328 	 * will work here.
1329 	 */
1330 	if (IS_TLS_IE(rtype) || IS_TLS_LE(rtype)) {
1331 		eprintf(ERR_FATAL, MSG_INTL(MSG_REL_TLSIE),
1332 		    conv_reloc_386_type_str(rsp->rel_rtype),
1333 		    rsp->rel_isdesc->is_file->ifl_name,
1334 		    demangle(rsp->rel_sname));
1335 		return (S_ERROR);
1336 	}
1337 
1338 	/*
1339 	 * LD access mode can only bind to local symbols.
1340 	 */
1341 	if (!local && IS_TLS_LD(rtype)) {
1342 		eprintf(ERR_FATAL, MSG_INTL(MSG_REL_TLSBND),
1343 		    conv_reloc_386_type_str(rsp->rel_rtype),
1344 		    rsp->rel_isdesc->is_file->ifl_name,
1345 		    demangle(rsp->rel_sname),
1346 		    sdp->sd_file->ifl_name);
1347 		return (S_ERROR);
1348 	}
1349 
1350 
1351 	if (IS_TLS_LD(rtype) && ((gnp = find_gotndx(&(sdp->sd_GOTndxs),
1352 	    GOT_REF_TLSLD, ofl, 0)) == 0)) {
1353 		if (assign_gotndx(&(sdp->sd_GOTndxs), gnp, GOT_REF_TLSLD,
1354 		    ofl, rsp, sdp) == S_ERROR)
1355 			return (S_ERROR);
1356 		rflags = FLG_REL_GOT | FLG_REL_MTLS;
1357 		if (local)
1358 			rflags |= FLG_REL_SCNNDX;
1359 		rsp->rel_rtype = R_386_TLS_DTPMOD32;
1360 		if (add_outrel(rflags, rsp, ofl) == S_ERROR)
1361 			return (S_ERROR);
1362 		rsp->rel_rtype = rtype;
1363 	} else if (IS_TLS_GD(rtype) && ((gnp = find_gotndx(&(sdp->sd_GOTndxs),
1364 	    GOT_REF_TLSGD, ofl, 0)) == 0)) {
1365 		if (assign_gotndx(&(sdp->sd_GOTndxs), gnp, GOT_REF_TLSGD,
1366 		    ofl, rsp, sdp) == S_ERROR)
1367 			return (S_ERROR);
1368 		rflags = FLG_REL_GOT | FLG_REL_DTLS;
1369 		if (local)
1370 			rflags |= FLG_REL_SCNNDX;
1371 		rsp->rel_rtype = R_386_TLS_DTPMOD32;
1372 		if (add_outrel(rflags, rsp, ofl) == S_ERROR)
1373 			return (S_ERROR);
1374 		if (local == TRUE) {
1375 			rsp->rel_rtype = R_386_TLS_DTPOFF32;
1376 			if (add_actrel((FLG_REL_GOT | FLG_REL_DTLS), rsp,
1377 			    ofl) == S_ERROR)
1378 				return (S_ERROR);
1379 		} else {
1380 			rsp->rel_rtype = R_386_TLS_DTPOFF32;
1381 			if (add_outrel((FLG_REL_GOT | FLG_REL_DTLS), rsp,
1382 			    ofl) == S_ERROR)
1383 				return (S_ERROR);
1384 		}
1385 		rsp->rel_rtype = rtype;
1386 	}
1387 	/*
1388 	 * For GD/LD TLS reference - TLS_{GD,LD}_CALL, this will eventually
1389 	 * cause a call to __tls_get_addr().  Let's convert this
1390 	 * relocation to that symbol now, and prepare for the PLT magic.
1391 	 */
1392 	if ((rtype == R_386_TLS_GD_PLT) || (rtype == R_386_TLS_LDM_PLT)) {
1393 		Sym_desc *	tlsgetsym;
1394 
1395 		if ((tlsgetsym = sym_add_u(MSG_ORIG(MSG_SYM_TLSGETADDR_UU),
1396 		    ofl)) == (Sym_desc *)S_ERROR)
1397 			return (S_ERROR);
1398 		rsp->rel_sym = tlsgetsym;
1399 		rsp->rel_sname = tlsgetsym->sd_name;
1400 		rsp->rel_rtype = R_386_PLT32;
1401 		if (reloc_plt(rsp, ofl) == S_ERROR)
1402 			return (S_ERROR);
1403 		rsp->rel_sym = sdp;
1404 		rsp->rel_sname = sdp->sd_name;
1405 		rsp->rel_rtype = rtype;
1406 		return (1);
1407 	}
1408 
1409 	if (IS_TLS_LD(rtype))
1410 		return (add_actrel(FLG_REL_MTLS, rsp, ofl));
1411 
1412 	return (add_actrel(FLG_REL_DTLS, rsp, ofl));
1413 }
1414 
1415 /* ARGSUSED3 */
1416 Gotndx *
1417 find_gotndx(List * lst, Gotref gref, Ofl_desc * ofl, Rel_desc * rdesc)
1418 {
1419 	Listnode *	lnp;
1420 	Gotndx *	gnp;
1421 
1422 	if ((gref == GOT_REF_TLSLD) && ofl->ofl_tlsldgotndx)
1423 		return (ofl->ofl_tlsldgotndx);
1424 
1425 	for (LIST_TRAVERSE(lst, lnp, gnp)) {
1426 		if (gnp->gn_gotref == gref)
1427 			return (gnp);
1428 	}
1429 	return ((Gotndx *)0);
1430 }
1431 
1432 Xword
1433 calc_got_offset(Rel_desc * rdesc, Ofl_desc * ofl)
1434 {
1435 	Os_desc		*osp = ofl->ofl_osgot;
1436 	Sym_desc	*sdp = rdesc->rel_sym;
1437 	Xword		gotndx;
1438 	Gotref		gref;
1439 	Gotndx		*gnp;
1440 
1441 	if (rdesc->rel_flags & FLG_REL_DTLS)
1442 		gref = GOT_REF_TLSGD;
1443 	else if (rdesc->rel_flags & FLG_REL_MTLS)
1444 		gref = GOT_REF_TLSLD;
1445 	else if (rdesc->rel_flags & FLG_REL_STLS)
1446 		gref = GOT_REF_TLSIE;
1447 	else
1448 		gref = GOT_REF_GENERIC;
1449 
1450 	gnp = find_gotndx(&(sdp->sd_GOTndxs), gref, ofl, 0);
1451 	assert(gnp);
1452 
1453 	gotndx = (Xword)gnp->gn_gotndx;
1454 
1455 	if ((rdesc->rel_flags & FLG_REL_DTLS) &&
1456 	    (rdesc->rel_rtype == R_386_TLS_DTPOFF32))
1457 		gotndx++;
1458 
1459 	return ((Xword)(osp->os_shdr->sh_addr + (gotndx * M_GOT_ENTSIZE)));
1460 }
1461 
1462 
1463 /* ARGSUSED4 */
1464 uintptr_t
1465 assign_gotndx(List * lst, Gotndx * pgnp, Gotref gref, Ofl_desc * ofl,
1466     Rel_desc * rsp, Sym_desc * sdp)
1467 {
1468 	Gotndx	*gnp;
1469 	uint_t	gotents;
1470 
1471 	if (pgnp)
1472 		return (1);
1473 
1474 	if ((gref == GOT_REF_TLSGD) || (gref == GOT_REF_TLSLD))
1475 		gotents = 2;
1476 	else
1477 		gotents = 1;
1478 
1479 	if ((gnp = libld_calloc(sizeof (Gotndx), 1)) == 0)
1480 		return (S_ERROR);
1481 	gnp->gn_gotndx = ofl->ofl_gotcnt;
1482 	gnp->gn_gotref = gref;
1483 
1484 	ofl->ofl_gotcnt += gotents;
1485 
1486 	if (gref == GOT_REF_TLSLD) {
1487 		ofl->ofl_tlsldgotndx = gnp;
1488 		return (1);
1489 	}
1490 
1491 	if (list_appendc(lst, (void *)gnp) == 0)
1492 		return (S_ERROR);
1493 
1494 	return (1);
1495 }
1496 
1497 
1498 void
1499 assign_plt_ndx(Sym_desc * sdp, Ofl_desc *ofl)
1500 {
1501 	sdp->sd_aux->sa_PLTndx = 1 + ofl->ofl_pltcnt++;
1502 	sdp->sd_aux->sa_PLTGOTndx = ofl->ofl_gotcnt++;
1503 	ofl->ofl_flags |= FLG_OF_BLDGOT;
1504 }
1505 
1506 /*
1507  * Initializes .got[0] with the _DYNAMIC symbol value.
1508  */
1509 uintptr_t
1510 fillin_gotplt1(Ofl_desc * ofl)
1511 {
1512 	if (ofl->ofl_osgot) {
1513 		Sym_desc *	sdp;
1514 
1515 		if ((sdp = sym_find(MSG_ORIG(MSG_SYM_DYNAMIC_U),
1516 		    SYM_NOHASH, 0, ofl)) != NULL) {
1517 			uchar_t	*genptr = ((uchar_t *)
1518 			    ofl->ofl_osgot->os_outdata->d_buf +
1519 			    (M_GOT_XDYNAMIC * M_GOT_ENTSIZE));
1520 			/* LINTED */
1521 			*(Word *)genptr = (Word)sdp->sd_sym->st_value;
1522 		}
1523 	}
1524 
1525 	/*
1526 	 * Fill in the reserved slot in the procedure linkage table the first
1527 	 * entry is:
1528 	 *  if (building a.out) {
1529 	 *	PUSHL	got[1]		    # the address of the link map entry
1530 	 *	JMP *	got[2]		    # the address of rtbinder
1531 	 *  } else {
1532 	 *	PUSHL	got[1]@GOT(%ebx)    # the address of the link map entry
1533 	 *	JMP *	got[2]@GOT(%ebx)    # the address of rtbinder
1534 	 *  }
1535 	 */
1536 	if ((ofl->ofl_flags & FLG_OF_DYNAMIC) && ofl->ofl_osplt) {
1537 		uchar_t *pltent;
1538 
1539 		pltent = (uchar_t *)ofl->ofl_osplt->os_outdata->d_buf;
1540 		if (!(ofl->ofl_flags & FLG_OF_SHAROBJ)) {
1541 			pltent[0] = M_SPECIAL_INST;
1542 			pltent[1] = M_PUSHL_DISP;
1543 			pltent += 2;
1544 			/* LINTED */
1545 			*(Word *)pltent = (Word)(ofl->ofl_osgot->os_shdr->
1546 				sh_addr + M_GOT_XLINKMAP * M_GOT_ENTSIZE);
1547 			pltent += 4;
1548 			pltent[0] = M_SPECIAL_INST;
1549 			pltent[1] = M_JMP_DISP_IND;
1550 			pltent += 2;
1551 			/* LINTED */
1552 			*(Word *)pltent = (Word)(ofl->ofl_osgot->os_shdr->
1553 				sh_addr + M_GOT_XRTLD * M_GOT_ENTSIZE);
1554 		} else {
1555 			pltent[0] = M_SPECIAL_INST;
1556 			pltent[1] = M_PUSHL_REG_DISP;
1557 			pltent += 2;
1558 			/* LINTED */
1559 			*(Word *)pltent = (Word)(M_GOT_XLINKMAP *
1560 				M_GOT_ENTSIZE);
1561 			pltent += 4;
1562 			pltent[0] = M_SPECIAL_INST;
1563 			pltent[1] = M_JMP_REG_DISP_IND;
1564 			pltent += 2;
1565 			/* LINTED */
1566 			*(Word *)pltent = (Word)(M_GOT_XRTLD *
1567 				M_GOT_ENTSIZE);
1568 		}
1569 	}
1570 	return (1);
1571 }
1572 
1573 /*
1574  * Return got[0].
1575  */
1576 Addr
1577 fillin_gotplt2(Ofl_desc * ofl)
1578 {
1579 	if (ofl->ofl_osgot)
1580 		return (ofl->ofl_osgot->os_shdr->sh_addr);
1581 	else
1582 		return (0);
1583 }
1584