1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
  24  */
  25 
  26 /* Get the x86 version of the relocation engine */
  27 #define DO_RELOC_LIBLD_X86
  28 
  29 #include        <string.h>
  30 #include        <stdio.h>
  31 #include        <strings.h>
  32 #include        <sys/elf_amd64.h>
  33 #include        <debug.h>
  34 #include        <reloc.h>
  35 #include        <i386/machdep_x86.h>
  36 #include        "msg.h"
  37 #include        "_libld.h"
  38 
  39 /*
  40  * This module uses do_reloc_ld() to execute several synthesized relocations.
  41  * That function expects to be passed two things that we need to construct
  42  * here:
  43  *
  44  * 1)   A Rel_desc descriptor for each relocation type, from which the
  45  *      rel_rtype field, and nothing else, is obtained. This is easily
  46  *      handled by constructing the necessary descriptors.
  47  *
  48  * 2)   A function, which called with the Rel_desc descriptor, returns
  49  *      a string representing the name of the symbol associated with
  50  *      the descriptor. The usual function for this is ld_reloc_sym_name().
  51  *      However, that function will not work in this case, as these synthetic
  52  *      relocations do not have an associated symbol. We supply the
  53  *      syn_rdesc_sym_name() function to simply return the fixed name.
  54  */
  55 static Rel_desc rdesc_r_amd64_gotpcrel = {
  56     NULL, NULL, NULL, 0, 0, 0, R_AMD64_GOTPCREL };
  57 static Rel_desc rdesc_r_amd64_32 = {
  58     NULL, NULL, NULL, 0, 0, 0, R_AMD64_32 };
  59 static Rel_desc rdesc_r_amd64_pc32 = {
  60     NULL, NULL, NULL, 0, 0, 0, R_AMD64_PC32 };
  61 
  62 /*ARGSUSED*/
  63 static const char *
  64 syn_rdesc_sym_name(Rel_desc *rdesc)
  65 {
  66         return (MSG_ORIG(MSG_SYM_PLTENT));
  67 }
  68 
  69 /*
  70  * Search the GOT index list for a GOT entry with a matching reference and the
  71  * proper addend.
  72  */
  73 static Gotndx *
  74 ld_find_got_ndx(Alist *alp, Gotref gref, Ofl_desc *ofl, Rel_desc *rdesc)
  75 {
  76         Aliste  idx;
  77         Gotndx  *gnp;
  78 
  79         assert(rdesc != 0);
  80 
  81         if ((gref == GOT_REF_TLSLD) && ofl->ofl_tlsldgotndx)
  82                 return (ofl->ofl_tlsldgotndx);
  83 
  84         for (ALIST_TRAVERSE(alp, idx, gnp)) {
  85                 if ((rdesc->rel_raddend == gnp->gn_addend) &&
  86                     (gnp->gn_gotref == gref)) {
  87                         return (gnp);
  88                 }
  89         }
  90         return (NULL);
  91 }
  92 
  93 static Xword
  94 ld_calc_got_offset(Rel_desc *rdesc, Ofl_desc *ofl)
  95 {
  96         Os_desc         *osp = ofl->ofl_osgot;
  97         Sym_desc        *sdp = rdesc->rel_sym;
  98         Xword           gotndx;
  99         Gotref          gref;
 100         Gotndx          *gnp;
 101 
 102         if (rdesc->rel_flags & FLG_REL_DTLS)
 103                 gref = GOT_REF_TLSGD;
 104         else if (rdesc->rel_flags & FLG_REL_MTLS)
 105                 gref = GOT_REF_TLSLD;
 106         else if (rdesc->rel_flags & FLG_REL_STLS)
 107                 gref = GOT_REF_TLSIE;
 108         else
 109                 gref = GOT_REF_GENERIC;
 110 
 111         gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, rdesc);
 112         assert(gnp);
 113 
 114         gotndx = (Xword)gnp->gn_gotndx;
 115 
 116         if ((rdesc->rel_flags & FLG_REL_DTLS) &&
 117             (rdesc->rel_rtype == R_AMD64_DTPOFF64))
 118                 gotndx++;
 119 
 120         return ((Xword)(osp->os_shdr->sh_addr + (gotndx * M_GOT_ENTSIZE)));
 121 }
 122 
 123 static Word
 124 ld_init_rel(Rel_desc *reld, Word *typedata, void *reloc)
 125 {
 126         Rela    *rel = (Rela *)reloc;
 127 
 128         /* LINTED */
 129         reld->rel_rtype = (Word)ELF_R_TYPE(rel->r_info, M_MACH);
 130         reld->rel_roffset = rel->r_offset;
 131         reld->rel_raddend = rel->r_addend;
 132         *typedata = 0;
 133 
 134         reld->rel_flags |= FLG_REL_RELA;
 135 
 136         return ((Word)ELF_R_SYM(rel->r_info));
 137 }
 138 
 139 static void
 140 ld_mach_eflags(Ehdr *ehdr, Ofl_desc *ofl)
 141 {
 142         ofl->ofl_dehdr->e_flags |= ehdr->e_flags;
 143 }
 144 
 145 static void
 146 ld_mach_make_dynamic(Ofl_desc *ofl, size_t *cnt)
 147 {
 148         if (!(ofl->ofl_flags & FLG_OF_RELOBJ)) {
 149                 /*
 150                  * Create this entry if we are going to create a PLT table.
 151                  */
 152                 if (ofl->ofl_pltcnt)
 153                         (*cnt)++;               /* DT_PLTGOT */
 154         }
 155 }
 156 
 157 static void
 158 ld_mach_update_odynamic(Ofl_desc *ofl, Dyn **dyn)
 159 {
 160         if (((ofl->ofl_flags & FLG_OF_RELOBJ) == 0) && ofl->ofl_pltcnt) {
 161                 (*dyn)->d_tag = DT_PLTGOT;
 162                 if (ofl->ofl_osgot)
 163                         (*dyn)->d_un.d_ptr = ofl->ofl_osgot->os_shdr->sh_addr;
 164                 else
 165                         (*dyn)->d_un.d_ptr = 0;
 166                 (*dyn)++;
 167         }
 168 }
 169 
 170 static Xword
 171 ld_calc_plt_addr(Sym_desc *sdp, Ofl_desc *ofl)
 172 {
 173         Xword   value;
 174 
 175         value = (Xword)(ofl->ofl_osplt->os_shdr->sh_addr) +
 176             M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) * M_PLT_ENTSIZE);
 177         return (value);
 178 }
 179 
 180 /*
 181  *  Build a single plt entry - code is:
 182  *      JMP     *name1@GOTPCREL(%rip)
 183  *      PUSHL   $index
 184  *      JMP     .PLT0
 185  */
 186 static uchar_t pltn_entry[M_PLT_ENTSIZE] = {
 187 /* 0x00 jmpq *name1@GOTPCREL(%rip) */   0xff, 0x25, 0x00, 0x00, 0x00, 0x00,
 188 /* 0x06 pushq $index */                 0x68, 0x00, 0x00, 0x00, 0x00,
 189 /* 0x0b jmpq  .plt0(%rip) */            0xe9, 0x00, 0x00, 0x00, 0x00
 190 /* 0x10 */
 191 };
 192 
 193 static uintptr_t
 194 plt_entry(Ofl_desc * ofl, Sym_desc * sdp)
 195 {
 196         uchar_t         *plt0, *pltent, *gotent;
 197         Sword           plt_off;
 198         Word            got_off;
 199         Xword           val1;
 200         int             bswap = (ofl->ofl_flags1 & FLG_OF1_ENCDIFF) != 0;
 201 
 202         got_off = sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE;
 203         plt_off = M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) *
 204             M_PLT_ENTSIZE);
 205         plt0 = (uchar_t *)(ofl->ofl_osplt->os_outdata->d_buf);
 206         pltent = plt0 + plt_off;
 207         gotent = (uchar_t *)(ofl->ofl_osgot->os_outdata->d_buf) + got_off;
 208 
 209         bcopy(pltn_entry, pltent, sizeof (pltn_entry));
 210         /*
 211          * Fill in the got entry with the address of the next instruction.
 212          */
 213         /* LINTED */
 214         *(Word *)gotent = ofl->ofl_osplt->os_shdr->sh_addr + plt_off +
 215             M_PLT_INSSIZE;
 216         if (bswap)
 217                 /* LINTED */
 218                 *(Word *)gotent = ld_bswap_Word(*(Word *)gotent);
 219 
 220         /*
 221          * If '-z noreloc' is specified - skip the do_reloc_ld
 222          * stage.
 223          */
 224         if (!OFL_DO_RELOC(ofl))
 225                 return (1);
 226 
 227         /*
 228          * patchup:
 229          *      jmpq    *name1@gotpcrel(%rip)
 230          *
 231          * NOTE: 0x06 represents next instruction.
 232          */
 233         val1 = (ofl->ofl_osgot->os_shdr->sh_addr + got_off) -
 234             (ofl->ofl_osplt->os_shdr->sh_addr + plt_off) - 0x06;
 235 
 236         if (do_reloc_ld(&rdesc_r_amd64_gotpcrel, &pltent[0x02], &val1,
 237             syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT), bswap,
 238             ofl->ofl_lml) == 0) {
 239                 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLTNFAIL),
 240                     sdp->sd_aux->sa_PLTndx, demangle(sdp->sd_name));
 241                 return (S_ERROR);
 242         }
 243 
 244         /*
 245          * patchup:
 246          *      pushq   $pltndx
 247          */
 248         val1 = (Xword)(sdp->sd_aux->sa_PLTndx - 1);
 249 
 250         if (do_reloc_ld(&rdesc_r_amd64_32, &pltent[0x07], &val1,
 251             syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT), bswap,
 252             ofl->ofl_lml) == 0) {
 253                 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLTNFAIL),
 254                     sdp->sd_aux->sa_PLTndx, demangle(sdp->sd_name));
 255                 return (S_ERROR);
 256         }
 257 
 258         /*
 259          * patchup:
 260          *      jmpq    .plt0(%rip)
 261          * NOTE: 0x10 represents next instruction. The rather complex
 262          * series of casts is necessary to sign extend an offset into
 263          * a 64-bit value while satisfying various compiler error
 264          * checks.  Handle with care.
 265          */
 266         val1 = (Xword)((intptr_t)((uintptr_t)plt0 -
 267             (uintptr_t)(&pltent[0x10])));
 268 
 269         if (do_reloc_ld(&rdesc_r_amd64_pc32, &pltent[0x0c], &val1,
 270             syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT), bswap,
 271             ofl->ofl_lml) == 0) {
 272                 ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLTNFAIL),
 273                     sdp->sd_aux->sa_PLTndx, demangle(sdp->sd_name));
 274                 return (S_ERROR);
 275         }
 276 
 277         return (1);
 278 }
 279 
 280 static uintptr_t
 281 ld_perform_outreloc(Rel_desc * orsp, Ofl_desc * ofl, Boolean *remain_seen)
 282 {
 283         Os_desc *       relosp, * osp = 0;
 284         Word            ndx;
 285         Xword           roffset, value;
 286         Sxword          raddend;
 287         Rela            rea;
 288         char            *relbits;
 289         Sym_desc *      sdp, * psym = (Sym_desc *)0;
 290         int             sectmoved = 0;
 291 
 292         raddend = orsp->rel_raddend;
 293         sdp = orsp->rel_sym;
 294 
 295         /*
 296          * If the section this relocation is against has been discarded
 297          * (-zignore), then also discard (skip) the relocation itself.
 298          */
 299         if (orsp->rel_isdesc && ((orsp->rel_flags &
 300             (FLG_REL_GOT | FLG_REL_BSS | FLG_REL_PLT | FLG_REL_NOINFO)) == 0) &&
 301             (orsp->rel_isdesc->is_flags & FLG_IS_DISCARD)) {
 302                 DBG_CALL(Dbg_reloc_discard(ofl->ofl_lml, M_MACH, orsp));
 303                 return (1);
 304         }
 305 
 306         /*
 307          * If this is a relocation against a move table, or expanded move
 308          * table, adjust the relocation entries.
 309          */
 310         if (RELAUX_GET_MOVE(orsp))
 311                 ld_adj_movereloc(ofl, orsp);
 312 
 313         /*
 314          * If this is a relocation against a section then we need to adjust the
 315          * raddend field to compensate for the new position of the input section
 316          * within the new output section.
 317          */
 318         if (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION) {
 319                 if (ofl->ofl_parsyms &&
 320                     (sdp->sd_isc->is_flags & FLG_IS_RELUPD) &&
 321                     /* LINTED */
 322                     (psym = ld_am_I_partial(orsp, orsp->rel_raddend))) {
 323                         DBG_CALL(Dbg_move_outsctadj(ofl->ofl_lml, psym));
 324                         sectmoved = 1;
 325                         if (ofl->ofl_flags & FLG_OF_RELOBJ)
 326                                 raddend = psym->sd_sym->st_value;
 327                         else
 328                                 raddend = psym->sd_sym->st_value -
 329                                     psym->sd_isc->is_osdesc->os_shdr->sh_addr;
 330                         /* LINTED */
 331                         raddend += (Off)_elf_getxoff(psym->sd_isc->is_indata);
 332                         if (psym->sd_isc->is_shdr->sh_flags & SHF_ALLOC)
 333                                 raddend +=
 334                                     psym->sd_isc->is_osdesc->os_shdr->sh_addr;
 335                 } else {
 336                         /* LINTED */
 337                         raddend += (Off)_elf_getxoff(sdp->sd_isc->is_indata);
 338                         if (sdp->sd_isc->is_shdr->sh_flags & SHF_ALLOC)
 339                                 raddend +=
 340                                     sdp->sd_isc->is_osdesc->os_shdr->sh_addr;
 341                 }
 342         }
 343 
 344         value = sdp->sd_sym->st_value;
 345 
 346         if (orsp->rel_flags & FLG_REL_GOT) {
 347                 /*
 348                  * Note: for GOT relative relocations on amd64
 349                  *       we discard the addend.  It was relevant
 350                  *       to the reference - not to the data item
 351                  *       being referenced (ie: that -4 thing).
 352                  */
 353                 raddend = 0;
 354                 osp = ofl->ofl_osgot;
 355                 roffset = ld_calc_got_offset(orsp, ofl);
 356 
 357         } else if (orsp->rel_flags & FLG_REL_PLT) {
 358                 /*
 359                  * Note that relocations for PLT's actually
 360                  * cause a relocation againt the GOT.
 361                  */
 362                 osp = ofl->ofl_osplt;
 363                 roffset = (ofl->ofl_osgot->os_shdr->sh_addr) +
 364                     sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE;
 365                 raddend = 0;
 366                 if (plt_entry(ofl, sdp) == S_ERROR)
 367                         return (S_ERROR);
 368 
 369         } else if (orsp->rel_flags & FLG_REL_BSS) {
 370                 /*
 371                  * This must be a R_AMD64_COPY.  For these set the roffset to
 372                  * point to the new symbols location.
 373                  */
 374                 osp = ofl->ofl_isbss->is_osdesc;
 375                 roffset = value;
 376 
 377                 /*
 378                  * The raddend doesn't mean anything in a R_SPARC_COPY
 379                  * relocation.  Null it out because it can confuse people.
 380                  */
 381                 raddend = 0;
 382         } else {
 383                 osp = RELAUX_GET_OSDESC(orsp);
 384 
 385                 /*
 386                  * Calculate virtual offset of reference point; equals offset
 387                  * into section + vaddr of section for loadable sections, or
 388                  * offset plus section displacement for nonloadable sections.
 389                  */
 390                 roffset = orsp->rel_roffset +
 391                     (Off)_elf_getxoff(orsp->rel_isdesc->is_indata);
 392                 if (!(ofl->ofl_flags & FLG_OF_RELOBJ))
 393                         roffset += orsp->rel_isdesc->is_osdesc->
 394                             os_shdr->sh_addr;
 395         }
 396 
 397         if ((osp == 0) || ((relosp = osp->os_relosdesc) == 0))
 398                 relosp = ofl->ofl_osrel;
 399 
 400         /*
 401          * Assign the symbols index for the output relocation.  If the
 402          * relocation refers to a SECTION symbol then it's index is based upon
 403          * the output sections symbols index.  Otherwise the index can be
 404          * derived from the symbols index itself.
 405          */
 406         if (orsp->rel_rtype == R_AMD64_RELATIVE)
 407                 ndx = STN_UNDEF;
 408         else if ((orsp->rel_flags & FLG_REL_SCNNDX) ||
 409             (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION)) {
 410                 if (sectmoved == 0) {
 411                         /*
 412                          * Check for a null input section. This can
 413                          * occur if this relocation references a symbol
 414                          * generated by sym_add_sym().
 415                          */
 416                         if (sdp->sd_isc && sdp->sd_isc->is_osdesc)
 417                                 ndx = sdp->sd_isc->is_osdesc->os_identndx;
 418                         else
 419                                 ndx = sdp->sd_shndx;
 420                 } else
 421                         ndx = ofl->ofl_parexpnndx;
 422         } else
 423                 ndx = sdp->sd_symndx;
 424 
 425         /*
 426          * Add the symbols 'value' to the addend field.
 427          */
 428         if (orsp->rel_flags & FLG_REL_ADVAL)
 429                 raddend += value;
 430 
 431         /*
 432          * The addend field for R_AMD64_DTPMOD64 means nothing.  The addend
 433          * is propagated in the corresponding R_AMD64_DTPOFF64 relocation.
 434          */
 435         if (orsp->rel_rtype == R_AMD64_DTPMOD64)
 436                 raddend = 0;
 437 
 438         relbits = (char *)relosp->os_outdata->d_buf;
 439 
 440         rea.r_info = ELF_R_INFO(ndx, orsp->rel_rtype);
 441         rea.r_offset = roffset;
 442         rea.r_addend = raddend;
 443         DBG_CALL(Dbg_reloc_out(ofl, ELF_DBG_LD, SHT_RELA, &rea, relosp->os_name,
 444             ld_reloc_sym_name(orsp)));
 445 
 446         /*
 447          * Assert we haven't walked off the end of our relocation table.
 448          */
 449         assert(relosp->os_szoutrels <= relosp->os_shdr->sh_size);
 450 
 451         (void) memcpy((relbits + relosp->os_szoutrels),
 452             (char *)&rea, sizeof (Rela));
 453         relosp->os_szoutrels += (Xword)sizeof (Rela);
 454 
 455         /*
 456          * Determine if this relocation is against a non-writable, allocatable
 457          * section.  If so we may need to provide a text relocation diagnostic.
 458          * Note that relocations against the .plt (R_AMD64_JUMP_SLOT) actually
 459          * result in modifications to the .got.
 460          */
 461         if (orsp->rel_rtype == R_AMD64_JUMP_SLOT)
 462                 osp = ofl->ofl_osgot;
 463 
 464         ld_reloc_remain_entry(orsp, osp, ofl, remain_seen);
 465         return (1);
 466 }
 467 
 468 /*
 469  * amd64 Instructions for TLS processing
 470  */
 471 static uchar_t tlsinstr_gd_ie[] = {
 472         /*
 473          *      0x00 movq %fs:0, %rax
 474          */
 475         0x64, 0x48, 0x8b, 0x04, 0x25,
 476         0x00, 0x00, 0x00, 0x00,
 477         /*
 478          *      0x09 addq x@gottpoff(%rip), %rax
 479          */
 480         0x48, 0x03, 0x05, 0x00, 0x00,
 481         0x00, 0x00
 482 };
 483 
 484 static uchar_t tlsinstr_gd_le[] = {
 485         /*
 486          *      0x00 movq %fs:0, %rax
 487          */
 488         0x64, 0x48, 0x8b, 0x04, 0x25,
 489         0x00, 0x00, 0x00, 0x00,
 490         /*
 491          *      0x09 leaq x@gottpoff(%rip), %rax
 492          */
 493         0x48, 0x8d, 0x80, 0x00, 0x00,
 494         0x00, 0x00
 495 };
 496 
 497 static uchar_t tlsinstr_ld_le[] = {
 498         /*
 499          * .byte 0x66
 500          */
 501         0x66,
 502         /*
 503          * .byte 0x66
 504          */
 505         0x66,
 506         /*
 507          * .byte 0x66
 508          */
 509         0x66,
 510         /*
 511          * movq %fs:0, %rax
 512          */
 513         0x64, 0x48, 0x8b, 0x04, 0x25,
 514         0x00, 0x00, 0x00, 0x00
 515 };
 516 
 517 
 518 static Fixupret
 519 tls_fixups(Ofl_desc *ofl, Rel_desc *arsp)
 520 {
 521         Sym_desc        *sdp = arsp->rel_sym;
 522         Word            rtype = arsp->rel_rtype;
 523         uchar_t         *offset;
 524 
 525         offset = (uchar_t *)((uintptr_t)arsp->rel_roffset +
 526             (uintptr_t)_elf_getxoff(arsp->rel_isdesc->is_indata) +
 527             (uintptr_t)RELAUX_GET_OSDESC(arsp)->os_outdata->d_buf);
 528 
 529         if (sdp->sd_ref == REF_DYN_NEED) {
 530                 /*
 531                  * IE reference model
 532                  */
 533                 switch (rtype) {
 534                 case R_AMD64_TLSGD:
 535                         /*
 536                          *  GD -> IE
 537                          *
 538                          * Transition:
 539                          *      0x00 .byte 0x66
 540                          *      0x01 leaq x@tlsgd(%rip), %rdi
 541                          *      0x08 .word 0x6666
 542                          *      0x0a rex64
 543                          *      0x0b call __tls_get_addr@plt
 544                          *      0x10
 545                          * To:
 546                          *      0x00 movq %fs:0, %rax
 547                          *      0x09 addq x@gottpoff(%rip), %rax
 548                          *      0x10
 549                          */
 550                         DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
 551                             R_AMD64_GOTTPOFF, arsp, ld_reloc_sym_name));
 552                         arsp->rel_rtype = R_AMD64_GOTTPOFF;
 553                         arsp->rel_roffset += 8;
 554                         arsp->rel_raddend = (Sxword)-4;
 555 
 556                         /*
 557                          * Adjust 'offset' to beginning of instruction
 558                          * sequence.
 559                          */
 560                         offset -= 4;
 561                         (void) memcpy(offset, tlsinstr_gd_ie,
 562                             sizeof (tlsinstr_gd_ie));
 563                         return (FIX_RELOC);
 564 
 565                 case R_AMD64_PLT32:
 566                         /*
 567                          * Fixup done via the TLS_GD relocation.
 568                          */
 569                         DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
 570                             R_AMD64_NONE, arsp, ld_reloc_sym_name));
 571                         return (FIX_DONE);
 572                 }
 573         }
 574 
 575         /*
 576          * LE reference model
 577          */
 578         switch (rtype) {
 579         case R_AMD64_TLSGD:
 580                 /*
 581                  * GD -> LE
 582                  *
 583                  * Transition:
 584                  *      0x00 .byte 0x66
 585                  *      0x01 leaq x@tlsgd(%rip), %rdi
 586                  *      0x08 .word 0x6666
 587                  *      0x0a rex64
 588                  *      0x0b call __tls_get_addr@plt
 589                  *      0x10
 590                  * To:
 591                  *      0x00 movq %fs:0, %rax
 592                  *      0x09 leaq x@tpoff(%rax), %rax
 593                  *      0x10
 594                  */
 595                 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
 596                     R_AMD64_TPOFF32, arsp, ld_reloc_sym_name));
 597                 arsp->rel_rtype = R_AMD64_TPOFF32;
 598                 arsp->rel_roffset += 8;
 599                 arsp->rel_raddend = 0;
 600 
 601                 /*
 602                  * Adjust 'offset' to beginning of instruction sequence.
 603                  */
 604                 offset -= 4;
 605                 (void) memcpy(offset, tlsinstr_gd_le, sizeof (tlsinstr_gd_le));
 606                 return (FIX_RELOC);
 607 
 608         case R_AMD64_GOTTPOFF:
 609                 /*
 610                  * IE -> LE
 611                  *
 612                  * Transition:
 613                  *      0x00 movq %fs:0, %rax
 614                  *      0x09 addq x@gottopoff(%rip), %rax
 615                  *      0x10
 616                  * To:
 617                  *      0x00 movq %fs:0, %rax
 618                  *      0x09 leaq x@tpoff(%rax), %rax
 619                  *      0x10
 620                  */
 621                 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
 622                     R_AMD64_TPOFF32, arsp, ld_reloc_sym_name));
 623                 arsp->rel_rtype = R_AMD64_TPOFF32;
 624                 arsp->rel_raddend = 0;
 625 
 626                 /*
 627                  * Adjust 'offset' to beginning of instruction sequence.
 628                  */
 629                 offset -= 12;
 630 
 631                 /*
 632                  * Same code sequence used in the GD -> LE transition.
 633                  */
 634                 (void) memcpy(offset, tlsinstr_gd_le, sizeof (tlsinstr_gd_le));
 635                 return (FIX_RELOC);
 636 
 637         case R_AMD64_TLSLD:
 638                 /*
 639                  * LD -> LE
 640                  *
 641                  * Transition
 642                  *      0x00 leaq x1@tlsgd(%rip), %rdi
 643                  *      0x07 call __tls_get_addr@plt
 644                  *      0x0c
 645                  * To:
 646                  *      0x00 .byte 0x66
 647                  *      0x01 .byte 0x66
 648                  *      0x02 .byte 0x66
 649                  *      0x03 movq %fs:0, %rax
 650                  */
 651                 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
 652                     R_AMD64_NONE, arsp, ld_reloc_sym_name));
 653                 offset -= 3;
 654                 (void) memcpy(offset, tlsinstr_ld_le, sizeof (tlsinstr_ld_le));
 655                 return (FIX_DONE);
 656 
 657         case R_AMD64_DTPOFF32:
 658                 /*
 659                  * LD->LE
 660                  *
 661                  * Transition:
 662                  *      0x00 leaq x1@dtpoff(%rax), %rcx
 663                  * To:
 664                  *      0x00 leaq x1@tpoff(%rax), %rcx
 665                  */
 666                 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
 667                     R_AMD64_TPOFF32, arsp, ld_reloc_sym_name));
 668                 arsp->rel_rtype = R_AMD64_TPOFF32;
 669                 arsp->rel_raddend = 0;
 670                 return (FIX_RELOC);
 671         }
 672 
 673         return (FIX_RELOC);
 674 }
 675 
 676 static uintptr_t
 677 ld_do_activerelocs(Ofl_desc *ofl)
 678 {
 679         Rel_desc        *arsp;
 680         Rel_cachebuf    *rcbp;
 681         Aliste          idx;
 682         uintptr_t       return_code = 1;
 683         ofl_flag_t      flags = ofl->ofl_flags;
 684 
 685         if (aplist_nitems(ofl->ofl_actrels.rc_list) != 0)
 686                 DBG_CALL(Dbg_reloc_doact_title(ofl->ofl_lml));
 687 
 688         /*
 689          * Process active relocations.
 690          */
 691         REL_CACHE_TRAVERSE(&ofl->ofl_actrels, idx, rcbp, arsp) {
 692                 uchar_t         *addr;
 693                 Xword           value;
 694                 Sym_desc        *sdp;
 695                 const char      *ifl_name;
 696                 Xword           refaddr;
 697                 int             moved = 0;
 698                 Gotref          gref;
 699                 Os_desc         *osp;
 700 
 701                 /*
 702                  * If the section this relocation is against has been discarded
 703                  * (-zignore), then discard (skip) the relocation itself.
 704                  */
 705                 if ((arsp->rel_isdesc->is_flags & FLG_IS_DISCARD) &&
 706                     ((arsp->rel_flags & (FLG_REL_GOT | FLG_REL_BSS |
 707                     FLG_REL_PLT | FLG_REL_NOINFO)) == 0)) {
 708                         DBG_CALL(Dbg_reloc_discard(ofl->ofl_lml, M_MACH, arsp));
 709                         continue;
 710                 }
 711 
 712                 /*
 713                  * We determine what the 'got reference' model (if required)
 714                  * is at this point.  This needs to be done before tls_fixup()
 715                  * since it may 'transition' our instructions.
 716                  *
 717                  * The got table entries have already been assigned,
 718                  * and we bind to those initial entries.
 719                  */
 720                 if (arsp->rel_flags & FLG_REL_DTLS)
 721                         gref = GOT_REF_TLSGD;
 722                 else if (arsp->rel_flags & FLG_REL_MTLS)
 723                         gref = GOT_REF_TLSLD;
 724                 else if (arsp->rel_flags & FLG_REL_STLS)
 725                         gref = GOT_REF_TLSIE;
 726                 else
 727                         gref = GOT_REF_GENERIC;
 728 
 729                 /*
 730                  * Perform any required TLS fixups.
 731                  */
 732                 if (arsp->rel_flags & FLG_REL_TLSFIX) {
 733                         Fixupret        ret;
 734 
 735                         if ((ret = tls_fixups(ofl, arsp)) == FIX_ERROR)
 736                                 return (S_ERROR);
 737                         if (ret == FIX_DONE)
 738                                 continue;
 739                 }
 740 
 741                 /*
 742                  * If this is a relocation against a move table, or
 743                  * expanded move table, adjust the relocation entries.
 744                  */
 745                 if (RELAUX_GET_MOVE(arsp))
 746                         ld_adj_movereloc(ofl, arsp);
 747 
 748                 sdp = arsp->rel_sym;
 749                 refaddr = arsp->rel_roffset +
 750                     (Off)_elf_getxoff(arsp->rel_isdesc->is_indata);
 751 
 752                 if ((arsp->rel_flags & FLG_REL_CLVAL) ||
 753                     (arsp->rel_flags & FLG_REL_GOTCL))
 754                         value = 0;
 755                 else if (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION) {
 756                         Sym_desc        *sym;
 757 
 758                         /*
 759                          * The value for a symbol pointing to a SECTION
 760                          * is based off of that sections position.
 761                          */
 762                         if ((sdp->sd_isc->is_flags & FLG_IS_RELUPD) &&
 763                             /* LINTED */
 764                             (sym = ld_am_I_partial(arsp, arsp->rel_raddend))) {
 765                                 /*
 766                                  * The symbol was moved, so adjust the value
 767                                  * relative to the new section.
 768                                  */
 769                                 value = sym->sd_sym->st_value;
 770                                 moved = 1;
 771 
 772                                 /*
 773                                  * The original raddend covers the displacement
 774                                  * from the section start to the desired
 775                                  * address. The value computed above gets us
 776                                  * from the section start to the start of the
 777                                  * symbol range. Adjust the old raddend to
 778                                  * remove the offset from section start to
 779                                  * symbol start, leaving the displacement
 780                                  * within the range of the symbol.
 781                                  */
 782                                 arsp->rel_raddend -= sym->sd_osym->st_value;
 783                         } else {
 784                                 value = _elf_getxoff(sdp->sd_isc->is_indata);
 785                                 if (sdp->sd_isc->is_shdr->sh_flags & SHF_ALLOC)
 786                                         value += sdp->sd_isc->is_osdesc->
 787                                             os_shdr->sh_addr;
 788                         }
 789                         if (sdp->sd_isc->is_shdr->sh_flags & SHF_TLS)
 790                                 value -= ofl->ofl_tlsphdr->p_vaddr;
 791 
 792                 } else if (IS_SIZE(arsp->rel_rtype)) {
 793                         /*
 794                          * Size relocations require the symbols size.
 795                          */
 796                         value = sdp->sd_sym->st_size;
 797 
 798                 } else if ((sdp->sd_flags & FLG_SY_CAP) &&
 799                     sdp->sd_aux && sdp->sd_aux->sa_PLTndx) {
 800                         /*
 801                          * If relocation is against a capabilities symbol, we
 802                          * need to jump to an associated PLT, so that at runtime
 803                          * ld.so.1 is involved to determine the best binding
 804                          * choice. Otherwise, the value is the symbols value.
 805                          */
 806                         value = ld_calc_plt_addr(sdp, ofl);
 807                 } else
 808                         value = sdp->sd_sym->st_value;
 809 
 810                 /*
 811                  * Relocation against the GLOBAL_OFFSET_TABLE.
 812                  */
 813                 if ((arsp->rel_flags & FLG_REL_GOT) &&
 814                     !ld_reloc_set_aux_osdesc(ofl, arsp, ofl->ofl_osgot))
 815                         return (S_ERROR);
 816                 osp = RELAUX_GET_OSDESC(arsp);
 817 
 818                 /*
 819                  * If loadable and not producing a relocatable object add the
 820                  * sections virtual address to the reference address.
 821                  */
 822                 if ((arsp->rel_flags & FLG_REL_LOAD) &&
 823                     ((flags & FLG_OF_RELOBJ) == 0))
 824                         refaddr += arsp->rel_isdesc->is_osdesc->
 825                             os_shdr->sh_addr;
 826 
 827                 /*
 828                  * If this entry has a PLT assigned to it, its value is actually
 829                  * the address of the PLT (and not the address of the function).
 830                  */
 831                 if (IS_PLT(arsp->rel_rtype)) {
 832                         if (sdp->sd_aux && sdp->sd_aux->sa_PLTndx)
 833                                 value = ld_calc_plt_addr(sdp, ofl);
 834                 }
 835 
 836                 /*
 837                  * Add relocations addend to value.  Add extra
 838                  * relocation addend if needed.
 839                  *
 840                  * Note: For GOT relative relocations on amd64 we discard the
 841                  * addend.  It was relevant to the reference - not to the
 842                  * data item being referenced (ie: that -4 thing).
 843                  */
 844                 if ((arsp->rel_flags & FLG_REL_GOT) == 0)
 845                         value += arsp->rel_raddend;
 846 
 847                 /*
 848                  * Determine whether the value needs further adjustment. Filter
 849                  * through the attributes of the relocation to determine what
 850                  * adjustment is required.  Note, many of the following cases
 851                  * are only applicable when a .got is present.  As a .got is
 852                  * not generated when a relocatable object is being built,
 853                  * any adjustments that require a .got need to be skipped.
 854                  */
 855                 if ((arsp->rel_flags & FLG_REL_GOT) &&
 856                     ((flags & FLG_OF_RELOBJ) == 0)) {
 857                         Xword           R1addr;
 858                         uintptr_t       R2addr;
 859                         Word            gotndx;
 860                         Gotndx          *gnp;
 861 
 862                         /*
 863                          * Perform relocation against GOT table. Since this
 864                          * doesn't fit exactly into a relocation we place the
 865                          * appropriate byte in the GOT directly
 866                          *
 867                          * Calculate offset into GOT at which to apply
 868                          * the relocation.
 869                          */
 870                         gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, arsp);
 871                         assert(gnp);
 872 
 873                         if (arsp->rel_rtype == R_AMD64_DTPOFF64)
 874                                 gotndx = gnp->gn_gotndx + 1;
 875                         else
 876                                 gotndx = gnp->gn_gotndx;
 877 
 878                         R1addr = (Xword)(gotndx * M_GOT_ENTSIZE);
 879 
 880                         /*
 881                          * Add the GOTs data's offset.
 882                          */
 883                         R2addr = R1addr + (uintptr_t)osp->os_outdata->d_buf;
 884 
 885                         DBG_CALL(Dbg_reloc_doact(ofl->ofl_lml, ELF_DBG_LD_ACT,
 886                             M_MACH, SHT_RELA, arsp, R1addr, value,
 887                             ld_reloc_sym_name));
 888 
 889                         /*
 890                          * And do it.
 891                          */
 892                         if (ofl->ofl_flags1 & FLG_OF1_ENCDIFF)
 893                                 *(Xword *)R2addr = ld_bswap_Xword(value);
 894                         else
 895                                 *(Xword *)R2addr = value;
 896                         continue;
 897 
 898                 } else if (IS_GOT_BASED(arsp->rel_rtype) &&
 899                     ((flags & FLG_OF_RELOBJ) == 0)) {
 900                         value -= ofl->ofl_osgot->os_shdr->sh_addr;
 901 
 902                 } else if (IS_GOTPCREL(arsp->rel_rtype) &&
 903                     ((flags & FLG_OF_RELOBJ) == 0)) {
 904                         Gotndx *gnp;
 905 
 906                         /*
 907                          * Calculation:
 908                          *      G + GOT + A - P
 909                          */
 910                         gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, arsp);
 911                         assert(gnp);
 912                         value = (Xword)(ofl->ofl_osgot->os_shdr-> sh_addr) +
 913                             ((Xword)gnp->gn_gotndx * M_GOT_ENTSIZE) +
 914                             arsp->rel_raddend - refaddr;
 915 
 916                 } else if (IS_GOT_PC(arsp->rel_rtype) &&
 917                     ((flags & FLG_OF_RELOBJ) == 0)) {
 918                         value = (Xword)(ofl->ofl_osgot->os_shdr->
 919                             sh_addr) - refaddr + arsp->rel_raddend;
 920 
 921                 } else if ((IS_PC_RELATIVE(arsp->rel_rtype)) &&
 922                     (((flags & FLG_OF_RELOBJ) == 0) ||
 923                     (osp == sdp->sd_isc->is_osdesc))) {
 924                         value -= refaddr;
 925 
 926                 } else if (IS_TLS_INS(arsp->rel_rtype) &&
 927                     IS_GOT_RELATIVE(arsp->rel_rtype) &&
 928                     ((flags & FLG_OF_RELOBJ) == 0)) {
 929                         Gotndx  *gnp;
 930 
 931                         gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, arsp);
 932                         assert(gnp);
 933                         value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE;
 934 
 935                 } else if (IS_GOT_RELATIVE(arsp->rel_rtype) &&
 936                     ((flags & FLG_OF_RELOBJ) == 0)) {
 937                         Gotndx *gnp;
 938 
 939                         gnp = ld_find_got_ndx(sdp->sd_GOTndxs, gref, ofl, arsp);
 940                         assert(gnp);
 941                         value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE;
 942 
 943                 } else if ((arsp->rel_flags & FLG_REL_STLS) &&
 944                     ((flags & FLG_OF_RELOBJ) == 0)) {
 945                         Xword   tlsstatsize;
 946 
 947                         /*
 948                          * This is the LE TLS reference model.  Static
 949                          * offset is hard-coded.
 950                          */
 951                         tlsstatsize = S_ROUND(ofl->ofl_tlsphdr->p_memsz,
 952                             M_TLSSTATALIGN);
 953                         value = tlsstatsize - value;
 954 
 955                         /*
 956                          * Since this code is fixed up, it assumes a negative
 957                          * offset that can be added to the thread pointer.
 958                          */
 959                         if (arsp->rel_rtype == R_AMD64_TPOFF32)
 960                                 value = -value;
 961                 }
 962 
 963                 if (arsp->rel_isdesc->is_file)
 964                         ifl_name = arsp->rel_isdesc->is_file->ifl_name;
 965                 else
 966                         ifl_name = MSG_INTL(MSG_STR_NULL);
 967 
 968                 /*
 969                  * Make sure we have data to relocate.  Compiler and assembler
 970                  * developers have been known to generate relocations against
 971                  * invalid sections (normally .bss), so for their benefit give
 972                  * them sufficient information to help analyze the problem.
 973                  * End users should never see this.
 974                  */
 975                 if (arsp->rel_isdesc->is_indata->d_buf == 0) {
 976                         Conv_inv_buf_t inv_buf;
 977 
 978                         ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_REL_EMPTYSEC),
 979                             conv_reloc_amd64_type(arsp->rel_rtype, 0, &inv_buf),
 980                             ifl_name, ld_reloc_sym_name(arsp),
 981                             EC_WORD(arsp->rel_isdesc->is_scnndx),
 982                             arsp->rel_isdesc->is_name);
 983                         return (S_ERROR);
 984                 }
 985 
 986                 /*
 987                  * Get the address of the data item we need to modify.
 988                  */
 989                 addr = (uchar_t *)((uintptr_t)arsp->rel_roffset +
 990                     (uintptr_t)_elf_getxoff(arsp->rel_isdesc->is_indata));
 991 
 992                 DBG_CALL(Dbg_reloc_doact(ofl->ofl_lml, ELF_DBG_LD_ACT,
 993                     M_MACH, SHT_RELA, arsp, EC_NATPTR(addr), value,
 994                     ld_reloc_sym_name));
 995                 addr += (uintptr_t)osp->os_outdata->d_buf;
 996 
 997                 if ((((uintptr_t)addr - (uintptr_t)ofl->ofl_nehdr) >
 998                     ofl->ofl_size) || (arsp->rel_roffset >
 999                     osp->os_shdr->sh_size)) {
1000                         int             class;
1001                         Conv_inv_buf_t inv_buf;
1002 
1003                         if (((uintptr_t)addr - (uintptr_t)ofl->ofl_nehdr) >
1004                             ofl->ofl_size)
1005                                 class = ERR_FATAL;
1006                         else
1007                                 class = ERR_WARNING;
1008 
1009                         ld_eprintf(ofl, class, MSG_INTL(MSG_REL_INVALOFFSET),
1010                             conv_reloc_amd64_type(arsp->rel_rtype, 0, &inv_buf),
1011                             ifl_name, EC_WORD(arsp->rel_isdesc->is_scnndx),
1012                             arsp->rel_isdesc->is_name, ld_reloc_sym_name(arsp),
1013                             EC_ADDR((uintptr_t)addr -
1014                             (uintptr_t)ofl->ofl_nehdr));
1015 
1016                         if (class == ERR_FATAL) {
1017                                 return_code = S_ERROR;
1018                                 continue;
1019                         }
1020                 }
1021 
1022                 /*
1023                  * The relocation is additive.  Ignore the previous symbol
1024                  * value if this local partial symbol is expanded.
1025                  */
1026                 if (moved)
1027                         value -= *addr;
1028 
1029                 /*
1030                  * If '-z noreloc' is specified - skip the do_reloc_ld stage.
1031                  */
1032                 if (OFL_DO_RELOC(ofl)) {
1033                         /*
1034                          * If this is a PROGBITS section and the running linker
1035                          * has a different byte order than the target host,
1036                          * tell do_reloc_ld() to swap bytes.
1037                          */
1038                         if (do_reloc_ld(arsp, addr, &value, ld_reloc_sym_name,
1039                             ifl_name, OFL_SWAP_RELOC_DATA(ofl, arsp),
1040                             ofl->ofl_lml) == 0) {
1041                                 ofl->ofl_flags |= FLG_OF_FATAL;
1042                                 return_code = S_ERROR;
1043                         }
1044                 }
1045         }
1046         return (return_code);
1047 }
1048 
1049 static uintptr_t
1050 ld_add_outrel(Word flags, Rel_desc *rsp, Ofl_desc *ofl)
1051 {
1052         Rel_desc        *orsp;
1053         Sym_desc        *sdp = rsp->rel_sym;
1054 
1055         /*
1056          * Static executables *do not* want any relocations against them.
1057          * Since our engine still creates relocations against a WEAK UNDEFINED
1058          * symbol in a static executable, it's best to disable them here
1059          * instead of through out the relocation code.
1060          */
1061         if (OFL_IS_STATIC_EXEC(ofl))
1062                 return (1);
1063 
1064         /*
1065          * If we are adding a output relocation against a section
1066          * symbol (non-RELATIVE) then mark that section.  These sections
1067          * will be added to the .dynsym symbol table.
1068          */
1069         if (sdp && (rsp->rel_rtype != M_R_RELATIVE) &&
1070             ((flags & FLG_REL_SCNNDX) ||
1071             (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION))) {
1072 
1073                 /*
1074                  * If this is a COMMON symbol - no output section
1075                  * exists yet - (it's created as part of sym_validate()).
1076                  * So - we mark here that when it's created it should
1077                  * be tagged with the FLG_OS_OUTREL flag.
1078                  */
1079                 if ((sdp->sd_flags & FLG_SY_SPECSEC) &&
1080                     (sdp->sd_sym->st_shndx == SHN_COMMON)) {
1081                         if (ELF_ST_TYPE(sdp->sd_sym->st_info) != STT_TLS)
1082                                 ofl->ofl_flags1 |= FLG_OF1_BSSOREL;
1083                         else
1084                                 ofl->ofl_flags1 |= FLG_OF1_TLSOREL;
1085                 } else {
1086                         Os_desc *osp;
1087                         Is_desc *isp = sdp->sd_isc;
1088 
1089                         if (isp && ((osp = isp->is_osdesc) != NULL) &&
1090                             ((osp->os_flags & FLG_OS_OUTREL) == 0)) {
1091                                 ofl->ofl_dynshdrcnt++;
1092                                 osp->os_flags |= FLG_OS_OUTREL;
1093                         }
1094                 }
1095         }
1096 
1097         /* Enter it into the output relocation cache */
1098         if ((orsp = ld_reloc_enter(ofl, &ofl->ofl_outrels, rsp, flags)) == NULL)
1099                 return (S_ERROR);
1100 
1101         if (flags & FLG_REL_GOT)
1102                 ofl->ofl_relocgotsz += (Xword)sizeof (Rela);
1103         else if (flags & FLG_REL_PLT)
1104                 ofl->ofl_relocpltsz += (Xword)sizeof (Rela);
1105         else if (flags & FLG_REL_BSS)
1106                 ofl->ofl_relocbsssz += (Xword)sizeof (Rela);
1107         else if (flags & FLG_REL_NOINFO)
1108                 ofl->ofl_relocrelsz += (Xword)sizeof (Rela);
1109         else
1110                 RELAUX_GET_OSDESC(orsp)->os_szoutrels += (Xword)sizeof (Rela);
1111 
1112         if (orsp->rel_rtype == M_R_RELATIVE)
1113                 ofl->ofl_relocrelcnt++;
1114 
1115         /*
1116          * We don't perform sorting on PLT relocations because
1117          * they have already been assigned a PLT index and if we
1118          * were to sort them we would have to re-assign the plt indexes.
1119          */
1120         if (!(flags & FLG_REL_PLT))
1121                 ofl->ofl_reloccnt++;
1122 
1123         /*
1124          * Insure a GLOBAL_OFFSET_TABLE is generated if required.
1125          */
1126         if (IS_GOT_REQUIRED(orsp->rel_rtype))
1127                 ofl->ofl_flags |= FLG_OF_BLDGOT;
1128 
1129         /*
1130          * Identify and possibly warn of a displacement relocation.
1131          */
1132         if (orsp->rel_flags & FLG_REL_DISP) {
1133                 ofl->ofl_dtflags_1 |= DF_1_DISPRELPND;
1134 
1135                 if (ofl->ofl_flags & FLG_OF_VERBOSE)
1136                         ld_disp_errmsg(MSG_INTL(MSG_REL_DISPREL4), orsp, ofl);
1137         }
1138         DBG_CALL(Dbg_reloc_ors_entry(ofl->ofl_lml, ELF_DBG_LD, SHT_RELA,
1139             M_MACH, orsp));
1140         return (1);
1141 }
1142 
1143 /*
1144  * process relocation for a LOCAL symbol
1145  */
1146 static uintptr_t
1147 ld_reloc_local(Rel_desc * rsp, Ofl_desc * ofl)
1148 {
1149         ofl_flag_t      flags = ofl->ofl_flags;
1150         Sym_desc        *sdp = rsp->rel_sym;
1151         Word            shndx = sdp->sd_sym->st_shndx;
1152         Word            ortype = rsp->rel_rtype;
1153 
1154         /*
1155          * if ((shared object) and (not pc relative relocation) and
1156          *    (not against ABS symbol))
1157          * then
1158          *      build R_AMD64_RELATIVE
1159          * fi
1160          */
1161         if ((flags & FLG_OF_SHAROBJ) && (rsp->rel_flags & FLG_REL_LOAD) &&
1162             !(IS_PC_RELATIVE(rsp->rel_rtype)) && !(IS_SIZE(rsp->rel_rtype)) &&
1163             !(IS_GOT_BASED(rsp->rel_rtype)) &&
1164             !(rsp->rel_isdesc != NULL &&
1165             (rsp->rel_isdesc->is_shdr->sh_type == SHT_SUNW_dof)) &&
1166             (((sdp->sd_flags & FLG_SY_SPECSEC) == 0) ||
1167             (shndx != SHN_ABS) || (sdp->sd_aux && sdp->sd_aux->sa_symspec))) {
1168 
1169                 /*
1170                  * R_AMD64_RELATIVE updates a 64bit address, if this
1171                  * relocation isn't a 64bit binding then we can not
1172                  * simplify it to a RELATIVE relocation.
1173                  */
1174                 if (reloc_table[ortype].re_fsize != sizeof (Addr)) {
1175                         return (ld_add_outrel(0, rsp, ofl));
1176                 }
1177 
1178                 rsp->rel_rtype = R_AMD64_RELATIVE;
1179                 if (ld_add_outrel(FLG_REL_ADVAL, rsp, ofl) == S_ERROR)
1180                         return (S_ERROR);
1181                 rsp->rel_rtype = ortype;
1182                 return (1);
1183         }
1184 
1185         /*
1186          * If the relocation is against a 'non-allocatable' section
1187          * and we can not resolve it now - then give a warning
1188          * message.
1189          *
1190          * We can not resolve the symbol if either:
1191          *      a) it's undefined
1192          *      b) it's defined in a shared library and a
1193          *         COPY relocation hasn't moved it to the executable
1194          *
1195          * Note: because we process all of the relocations against the
1196          *      text segment before any others - we know whether
1197          *      or not a copy relocation will be generated before
1198          *      we get here (see reloc_init()->reloc_segments()).
1199          */
1200         if (!(rsp->rel_flags & FLG_REL_LOAD) &&
1201             ((shndx == SHN_UNDEF) ||
1202             ((sdp->sd_ref == REF_DYN_NEED) &&
1203             ((sdp->sd_flags & FLG_SY_MVTOCOMM) == 0)))) {
1204                 Conv_inv_buf_t  inv_buf;
1205                 Os_desc         *osp = RELAUX_GET_OSDESC(rsp);
1206 
1207                 /*
1208                  * If the relocation is against a SHT_SUNW_ANNOTATE
1209                  * section - then silently ignore that the relocation
1210                  * can not be resolved.
1211                  */
1212                 if (osp && (osp->os_shdr->sh_type == SHT_SUNW_ANNOTATE))
1213                         return (0);
1214                 ld_eprintf(ofl, ERR_WARNING, MSG_INTL(MSG_REL_EXTERNSYM),
1215                     conv_reloc_amd64_type(rsp->rel_rtype, 0, &inv_buf),
1216                     rsp->rel_isdesc->is_file->ifl_name,
1217                     ld_reloc_sym_name(rsp), osp->os_name);
1218                 return (1);
1219         }
1220 
1221         /*
1222          * Perform relocation.
1223          */
1224         return (ld_add_actrel(NULL, rsp, ofl));
1225 }
1226 
1227 
1228 static uintptr_t
1229 ld_reloc_TLS(Boolean local, Rel_desc * rsp, Ofl_desc * ofl)
1230 {
1231         Word            rtype = rsp->rel_rtype;
1232         Sym_desc        *sdp = rsp->rel_sym;
1233         ofl_flag_t      flags = ofl->ofl_flags;
1234         Gotndx          *gnp;
1235 
1236         /*
1237          * If we're building an executable - use either the IE or LE access
1238          * model.  If we're building a shared object process any IE model.
1239          */
1240         if ((flags & FLG_OF_EXEC) || (IS_TLS_IE(rtype))) {
1241                 /*
1242                  * Set the DF_STATIC_TLS flag.
1243                  */
1244                 ofl->ofl_dtflags |= DF_STATIC_TLS;
1245 
1246                 if (!local || ((flags & FLG_OF_EXEC) == 0)) {
1247                         /*
1248                          * Assign a GOT entry for static TLS references.
1249                          */
1250                         if ((gnp = ld_find_got_ndx(sdp->sd_GOTndxs,
1251                             GOT_REF_TLSIE, ofl, rsp)) == NULL) {
1252 
1253                                 if (ld_assign_got_TLS(local, rsp, ofl, sdp,
1254                                     gnp, GOT_REF_TLSIE, FLG_REL_STLS,
1255                                     rtype, R_AMD64_TPOFF64, 0) == S_ERROR)
1256                                         return (S_ERROR);
1257                         }
1258 
1259                         /*
1260                          * IE access model.
1261                          */
1262                         if (IS_TLS_IE(rtype))
1263                                 return (ld_add_actrel(FLG_REL_STLS, rsp, ofl));
1264 
1265                         /*
1266                          * Fixups are required for other executable models.
1267                          */
1268                         return (ld_add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS),
1269                             rsp, ofl));
1270                 }
1271 
1272                 /*
1273                  * LE access model.
1274                  */
1275                 if (IS_TLS_LE(rtype))
1276                         return (ld_add_actrel(FLG_REL_STLS, rsp, ofl));
1277 
1278                 return (ld_add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS),
1279                     rsp, ofl));
1280         }
1281 
1282         /*
1283          * Building a shared object.
1284          *
1285          * Assign a GOT entry for a dynamic TLS reference.
1286          */
1287         if (IS_TLS_LD(rtype) && ((gnp = ld_find_got_ndx(sdp->sd_GOTndxs,
1288             GOT_REF_TLSLD, ofl, rsp)) == NULL)) {
1289 
1290                 if (ld_assign_got_TLS(local, rsp, ofl, sdp, gnp, GOT_REF_TLSLD,
1291                     FLG_REL_MTLS, rtype, R_AMD64_DTPMOD64, NULL) == S_ERROR)
1292                         return (S_ERROR);
1293 
1294         } else if (IS_TLS_GD(rtype) &&
1295             ((gnp = ld_find_got_ndx(sdp->sd_GOTndxs, GOT_REF_TLSGD,
1296             ofl, rsp)) == NULL)) {
1297 
1298                 if (ld_assign_got_TLS(local, rsp, ofl, sdp, gnp, GOT_REF_TLSGD,
1299                     FLG_REL_DTLS, rtype, R_AMD64_DTPMOD64,
1300                     R_AMD64_DTPOFF64) == S_ERROR)
1301                         return (S_ERROR);
1302         }
1303 
1304         if (IS_TLS_LD(rtype))
1305                 return (ld_add_actrel(FLG_REL_MTLS, rsp, ofl));
1306 
1307         return (ld_add_actrel(FLG_REL_DTLS, rsp, ofl));
1308 }
1309 
1310 /* ARGSUSED5 */
1311 static uintptr_t
1312 ld_assign_got_ndx(Alist **alpp, Gotndx *pgnp, Gotref gref, Ofl_desc *ofl,
1313     Rel_desc *rsp, Sym_desc *sdp)
1314 {
1315         Xword           raddend;
1316         Gotndx          gn, *gnp;
1317         Aliste          idx;
1318         uint_t          gotents;
1319 
1320         raddend = rsp->rel_raddend;
1321         if (pgnp && (pgnp->gn_addend == raddend) && (pgnp->gn_gotref == gref))
1322                 return (1);
1323 
1324         if ((gref == GOT_REF_TLSGD) || (gref == GOT_REF_TLSLD))
1325                 gotents = 2;
1326         else
1327                 gotents = 1;
1328 
1329         gn.gn_addend = raddend;
1330         gn.gn_gotndx = ofl->ofl_gotcnt;
1331         gn.gn_gotref = gref;
1332 
1333         ofl->ofl_gotcnt += gotents;
1334 
1335         if (gref == GOT_REF_TLSLD) {
1336                 if (ofl->ofl_tlsldgotndx == NULL) {
1337                         if ((gnp = libld_malloc(sizeof (Gotndx))) == NULL)
1338                                 return (S_ERROR);
1339                         (void) memcpy(gnp, &gn, sizeof (Gotndx));
1340                         ofl->ofl_tlsldgotndx = gnp;
1341                 }
1342                 return (1);
1343         }
1344 
1345         idx = 0;
1346         for (ALIST_TRAVERSE(*alpp, idx, gnp)) {
1347                 if (gnp->gn_addend > raddend)
1348                         break;
1349         }
1350 
1351         /*
1352          * GOT indexes are maintained on an Alist, where there is typically
1353          * only one index.  The usage of this list is to scan the list to find
1354          * an index, and then apply that index immediately to a relocation.
1355          * Thus there are no external references to these GOT index structures
1356          * that can be compromised by the Alist being reallocated.
1357          */
1358         if (alist_insert(alpp, &gn, sizeof (Gotndx),
1359             AL_CNT_SDP_GOT, idx) == NULL)
1360                 return (S_ERROR);
1361 
1362         return (1);
1363 }
1364 
1365 static void
1366 ld_assign_plt_ndx(Sym_desc * sdp, Ofl_desc *ofl)
1367 {
1368         sdp->sd_aux->sa_PLTndx = 1 + ofl->ofl_pltcnt++;
1369         sdp->sd_aux->sa_PLTGOTndx = ofl->ofl_gotcnt++;
1370         ofl->ofl_flags |= FLG_OF_BLDGOT;
1371 }
1372 
1373 static uchar_t plt0_template[M_PLT_ENTSIZE] = {
1374 /* 0x00 PUSHQ GOT+8(%rip) */    0xff, 0x35, 0x00, 0x00, 0x00, 0x00,
1375 /* 0x06 JMP   *GOT+16(%rip) */  0xff, 0x25, 0x00, 0x00, 0x00, 0x00,
1376 /* 0x0c NOP */                  0x90,
1377 /* 0x0d NOP */                  0x90,
1378 /* 0x0e NOP */                  0x90,
1379 /* 0x0f NOP */                  0x90
1380 };
1381 
1382 /*
1383  * Initializes .got[0] with the _DYNAMIC symbol value.
1384  */
1385 static uintptr_t
1386 ld_fillin_gotplt(Ofl_desc *ofl)
1387 {
1388         int     bswap = (ofl->ofl_flags1 & FLG_OF1_ENCDIFF) != 0;
1389 
1390         if (ofl->ofl_osgot) {
1391                 Sym_desc        *sdp;
1392 
1393                 if ((sdp = ld_sym_find(MSG_ORIG(MSG_SYM_DYNAMIC_U),
1394                     SYM_NOHASH, NULL, ofl)) != NULL) {
1395                         uchar_t *genptr;
1396 
1397                         genptr = ((uchar_t *)ofl->ofl_osgot->os_outdata->d_buf +
1398                             (M_GOT_XDYNAMIC * M_GOT_ENTSIZE));
1399                         /* LINTED */
1400                         *(Xword *)genptr = sdp->sd_sym->st_value;
1401                         if (bswap)
1402                                 /* LINTED */
1403                                 *(Xword *)genptr =
1404                                     /* LINTED */
1405                                     ld_bswap_Xword(*(Xword *)genptr);
1406                 }
1407         }
1408 
1409         /*
1410          * Fill in the reserved slot in the procedure linkage table the first
1411          * entry is:
1412          *      0x00 PUSHQ      GOT+8(%rip)         # GOT[1]
1413          *      0x06 JMP        *GOT+16(%rip)       # GOT[2]
1414          *      0x0c NOP
1415          *      0x0d NOP
1416          *      0x0e NOP
1417          *      0x0f NOP
1418          */
1419         if ((ofl->ofl_flags & FLG_OF_DYNAMIC) && ofl->ofl_osplt) {
1420                 uchar_t *pltent;
1421                 Xword   val1;
1422 
1423                 pltent = (uchar_t *)ofl->ofl_osplt->os_outdata->d_buf;
1424                 bcopy(plt0_template, pltent, sizeof (plt0_template));
1425 
1426                 /*
1427                  * If '-z noreloc' is specified - skip the do_reloc_ld
1428                  * stage.
1429                  */
1430                 if (!OFL_DO_RELOC(ofl))
1431                         return (1);
1432 
1433                 /*
1434                  * filin:
1435                  *      PUSHQ GOT + 8(%rip)
1436                  *
1437                  * Note: 0x06 below represents the offset to the
1438                  *       next instruction - which is what %rip will
1439                  *       be pointing at.
1440                  */
1441                 val1 = (ofl->ofl_osgot->os_shdr->sh_addr) +
1442                     (M_GOT_XLINKMAP * M_GOT_ENTSIZE) -
1443                     ofl->ofl_osplt->os_shdr->sh_addr - 0x06;
1444 
1445                 if (do_reloc_ld(&rdesc_r_amd64_gotpcrel, &pltent[0x02],
1446                     &val1, syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT),
1447                     bswap, ofl->ofl_lml) == 0) {
1448                         ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLT0FAIL));
1449                         return (S_ERROR);
1450                 }
1451 
1452                 /*
1453                  * filin:
1454                  *  JMP *GOT+16(%rip)
1455                  */
1456                 val1 = (ofl->ofl_osgot->os_shdr->sh_addr) +
1457                     (M_GOT_XRTLD * M_GOT_ENTSIZE) -
1458                     ofl->ofl_osplt->os_shdr->sh_addr - 0x0c;
1459 
1460                 if (do_reloc_ld(&rdesc_r_amd64_gotpcrel, &pltent[0x08],
1461                     &val1, syn_rdesc_sym_name, MSG_ORIG(MSG_SPECFIL_PLTENT),
1462                     bswap, ofl->ofl_lml) == 0) {
1463                         ld_eprintf(ofl, ERR_FATAL, MSG_INTL(MSG_PLT_PLT0FAIL));
1464                         return (S_ERROR);
1465                 }
1466         }
1467 
1468         return (1);
1469 }
1470 
1471 
1472 
1473 /*
1474  * Template for generating "void (*)(void)" function
1475  */
1476 static const uchar_t nullfunc_tmpl[] = {        /* amd64 */
1477 /* 0x00 */      0x55,                           /* pushq  %rbp */
1478 /* 0x01 */      0x48, 0x8b, 0xec,               /* movq   %rsp,%rbp */
1479 /* 0x04 */      0x48, 0x8b, 0xe5,               /* movq   %rbp,%rsp */
1480 /* 0x07 */      0x5d,                           /* popq   %rbp */
1481 /* 0x08 */      0xc3                            /* ret */
1482 };
1483 
1484 
1485 /*
1486  * Function used to provide fill padding in SHF_EXECINSTR sections
1487  *
1488  * entry:
1489  *
1490  *      base - base address of section being filled
1491  *      offset - starting offset for fill within memory referenced by base
1492  *      cnt - # bytes to be filled
1493  *
1494  * exit:
1495  *      The fill has been completed.
1496  */
1497 static void
1498 execfill(void *base, off_t off, size_t cnt)
1499 {
1500         /*
1501          * 0x90 is an X86 NOP instruction in both 32 and 64-bit worlds.
1502          * There are no alignment constraints.
1503          */
1504         (void) memset(off + (char *)base, 0x90, cnt);
1505 }
1506 
1507 
1508 /*
1509  * Return the ld_targ definition for this target.
1510  */
1511 const Target *
1512 ld_targ_init_x86(void)
1513 {
1514         static const Target _ld_targ = {
1515                 {                       /* Target_mach */
1516                         M_MACH,                 /* m_mach */
1517                         M_MACHPLUS,             /* m_machplus */
1518                         M_FLAGSPLUS,            /* m_flagsplus */
1519                         M_CLASS,                /* m_class */
1520                         M_DATA,                 /* m_data */
1521 
1522                         M_SEGM_ALIGN,           /* m_segm_align */
1523                         M_SEGM_ORIGIN,          /* m_segm_origin */
1524                         M_SEGM_AORIGIN,         /* m_segm_aorigin */
1525                         M_DATASEG_PERM,         /* m_dataseg_perm */
1526                         M_STACK_PERM,           /* m_stack_perm */
1527                         M_WORD_ALIGN,           /* m_word_align */
1528                         MSG_ORIG(MSG_PTH_RTLD_AMD64), /* m_def_interp */
1529 
1530                         /* Relocation type codes */
1531                         M_R_ARRAYADDR,          /* m_r_arrayaddr */
1532                         M_R_COPY,               /* m_r_copy */
1533                         M_R_GLOB_DAT,           /* m_r_glob_dat */
1534                         M_R_JMP_SLOT,           /* m_r_jmp_slot */
1535                         M_R_NUM,                /* m_r_num */
1536                         M_R_NONE,               /* m_r_none */
1537                         M_R_RELATIVE,           /* m_r_relative */
1538                         M_R_REGISTER,           /* m_r_register */
1539 
1540                         /* Relocation related constants */
1541                         M_REL_DT_COUNT,         /* m_rel_dt_count */
1542                         M_REL_DT_ENT,           /* m_rel_dt_ent */
1543                         M_REL_DT_SIZE,          /* m_rel_dt_size */
1544                         M_REL_DT_TYPE,          /* m_rel_dt_type */
1545                         M_REL_SHT_TYPE,         /* m_rel_sht_type */
1546 
1547                         /* GOT related constants */
1548                         M_GOT_ENTSIZE,          /* m_got_entsize */
1549                         M_GOT_XNumber,          /* m_got_xnumber */
1550 
1551                         /* PLT related constants */
1552                         M_PLT_ALIGN,            /* m_plt_align */
1553                         M_PLT_ENTSIZE,          /* m_plt_entsize */
1554                         M_PLT_RESERVSZ,         /* m_plt_reservsz */
1555                         M_PLT_SHF_FLAGS,        /* m_plt_shf_flags */
1556 
1557                         /* Section type of .eh_frame/.eh_frame_hdr sections */
1558                         SHT_AMD64_UNWIND,       /* m_sht_unwind */
1559 
1560                         M_DT_REGISTER,          /* m_dt_register */
1561                 },
1562                 {                       /* Target_machid */
1563                         M_ID_ARRAY,             /* id_array */
1564                         M_ID_BSS,               /* id_bss */
1565                         M_ID_CAP,               /* id_cap */
1566                         M_ID_CAPINFO,           /* id_capinfo */
1567                         M_ID_CAPCHAIN,          /* id_capchain */
1568                         M_ID_DATA,              /* id_data */
1569                         M_ID_DYNAMIC,           /* id_dynamic */
1570                         M_ID_DYNSORT,           /* id_dynsort */
1571                         M_ID_DYNSTR,            /* id_dynstr */
1572                         M_ID_DYNSYM,            /* id_dynsym */
1573                         M_ID_DYNSYM_NDX,        /* id_dynsym_ndx */
1574                         M_ID_GOT,               /* id_got */
1575                         M_ID_UNKNOWN,           /* id_gotdata (unused) */
1576                         M_ID_HASH,              /* id_hash */
1577                         M_ID_INTERP,            /* id_interp */
1578                         M_ID_LBSS,              /* id_lbss */
1579                         M_ID_LDYNSYM,           /* id_ldynsym */
1580                         M_ID_NOTE,              /* id_note */
1581                         M_ID_NULL,              /* id_null */
1582                         M_ID_PLT,               /* id_plt */
1583                         M_ID_REL,               /* id_rel */
1584                         M_ID_STRTAB,            /* id_strtab */
1585                         M_ID_SYMINFO,           /* id_syminfo */
1586                         M_ID_SYMTAB,            /* id_symtab */
1587                         M_ID_SYMTAB_NDX,        /* id_symtab_ndx */
1588                         M_ID_TEXT,              /* id_text */
1589                         M_ID_TLS,               /* id_tls */
1590                         M_ID_TLSBSS,            /* id_tlsbss */
1591                         M_ID_UNKNOWN,           /* id_unknown */
1592                         M_ID_UNWIND,            /* id_unwind */
1593                         M_ID_UNWINDHDR,         /* id_unwindhdr */
1594                         M_ID_USER,              /* id_user */
1595                         M_ID_VERSION,           /* id_version */
1596                 },
1597                 {                       /* Target_nullfunc */
1598                         nullfunc_tmpl,          /* nf_template */
1599                         sizeof (nullfunc_tmpl), /* nf_size */
1600                 },
1601                 {                       /* Target_fillfunc */
1602                         execfill                /* ff_execfill */
1603                 },
1604                 {                       /* Target_machrel */
1605                         reloc_table,
1606 
1607                         ld_init_rel,            /* mr_init_rel */
1608                         ld_mach_eflags,         /* mr_mach_eflags */
1609                         ld_mach_make_dynamic,   /* mr_mach_make_dynamic */
1610                         ld_mach_update_odynamic, /* mr_mach_update_odynamic */
1611                         ld_calc_plt_addr,       /* mr_calc_plt_addr */
1612                         ld_perform_outreloc,    /* mr_perform_outreloc */
1613                         ld_do_activerelocs,     /* mr_do_activerelocs */
1614                         ld_add_outrel,          /* mr_add_outrel */
1615                         NULL,                   /* mr_reloc_register */
1616                         ld_reloc_local,         /* mr_reloc_local */
1617                         NULL,                   /* mr_reloc_GOTOP */
1618                         ld_reloc_TLS,           /* mr_reloc_TLS */
1619                         NULL,                   /* mr_assign_got */
1620                         ld_find_got_ndx,        /* mr_find_got_ndx */
1621                         ld_calc_got_offset,     /* mr_calc_got_offset */
1622                         ld_assign_got_ndx,      /* mr_assign_got_ndx */
1623                         ld_assign_plt_ndx,      /* mr_assign_plt_ndx */
1624                         NULL,                   /* mr_allocate_got */
1625                         ld_fillin_gotplt,       /* mr_fillin_gotplt */
1626                 },
1627                 {                       /* Target_machsym */
1628                         NULL,                   /* ms_reg_check */
1629                         NULL,                   /* ms_mach_sym_typecheck */
1630                         NULL,                   /* ms_is_regsym */
1631                         NULL,                   /* ms_reg_find */
1632                         NULL                    /* ms_reg_enter */
1633                 }
1634         };
1635 
1636         return (&_ld_targ);
1637 }