/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright (c) 2012, Joyent, Inc. All rights reserved.
 */

/*
 * SPARC V9 machine dependent and ELF file class dependent functions.
 * Contains routines for performing function binding and symbol relocations.
 */

#include        <stdio.h>
#include        <sys/elf.h>
#include        <sys/elf_SPARC.h>
#include        <sys/mman.h>
#include        <dlfcn.h>
#include        <synch.h>
#include        <string.h>
#include        <debug.h>
#include        <reloc.h>
#include        <conv.h>
#include        "_rtld.h"
#include        "_audit.h"
#include        "_elf.h"
#include        "_inline_gen.h"
#include        "_inline_reloc.h"
#include        "msg.h"

extern void     iflush_range(caddr_t, size_t);
extern void     plt_upper_32(uintptr_t, uintptr_t);
extern void     plt_upper_44(uintptr_t, uintptr_t);
extern void     plt_full_range(uintptr_t, uintptr_t);
extern void     elf_rtbndr(Rt_map *, ulong_t, caddr_t);
extern void     elf_rtbndr_far(Rt_map *, ulong_t, caddr_t);

int
elf_mach_flags_check(Rej_desc *rej, Ehdr *ehdr)
{
        /*
         * Check machine type and flags.
         */
        if (ehdr->e_flags & EF_SPARC_EXT_MASK) {
                /*
                 * Check vendor-specific extensions.
                 */
                if (ehdr->e_flags & EF_SPARC_HAL_R1) {
                        rej->rej_type = SGS_REJ_HAL;
                        rej->rej_info = (uint_t)ehdr->e_flags;
                        return (0);
                }
                if ((ehdr->e_flags & EF_SPARC_SUN_US3) & ~at_flags) {
                        rej->rej_type = SGS_REJ_US3;
                        rej->rej_info = (uint_t)ehdr->e_flags;
                        return (0);
                }

                /*
                 * Generic check.
                 * All of our 64-bit SPARC's support the US1 (UltraSPARC 1)
                 * instructions so that bit isn't worth checking for explicitly.
                 */
                if ((ehdr->e_flags & EF_SPARC_EXT_MASK) & ~at_flags) {
                        rej->rej_type = SGS_REJ_BADFLAG;
                        rej->rej_info = (uint_t)ehdr->e_flags;
                        return (0);
                }
        } else if ((ehdr->e_flags & ~EF_SPARCV9_MM) != 0) {
                rej->rej_type = SGS_REJ_BADFLAG;
                rej->rej_info = (uint_t)ehdr->e_flags;
                return (0);
        }
        return (1);
}


void
ldso_plt_init(Rt_map *lmp)
{
        /*
         * There is no need to analyze ld.so because we don't map in any of
         * its dependencies.  However we may map these dependencies in later
         * (as if ld.so had dlopened them), so initialize the plt and the
         * permission information.
         */
        if (PLTGOT(lmp)) {
                Xword pltoff;

                /*
                 * Install the lm pointer in .PLT2 as per the ABI.
                 */
                pltoff = (2 * M_PLT_ENTSIZE) / M_PLT_INSSIZE;
                elf_plt2_init(PLTGOT(lmp) + pltoff, lmp);

                /*
                 * The V9 ABI states that the first 32k PLT entries
                 * use .PLT1, with .PLT0 used by the "latter" entries.
                 * We don't currently implement the extendend format,
                 * so install an error handler in .PLT0 to catch anyone
                 * trying to use it.
                 */
                elf_plt_init(PLTGOT(lmp), (caddr_t)elf_rtbndr_far);

                /*
                 * Initialize .PLT1
                 */
                pltoff = M_PLT_ENTSIZE / M_PLT_INSSIZE;
                elf_plt_init(PLTGOT(lmp) + pltoff, (caddr_t)elf_rtbndr);
        }
}

/*
 * elf_plt_write() will test to see how far away our destination
 *      address lies.  If it is close enough that a branch can
 *      be used instead of a jmpl - we will fill the plt in with
 *      single branch.  The branches are much quicker then
 *      a jmpl instruction - see bug#4356879 for further
 *      details.
 *
 *      NOTE: we pass in both a 'pltaddr' and a 'vpltaddr' since
 *              librtld/dldump update PLT's who's physical
 *              address is not the same as the 'virtual' runtime
 *              address.
 */
Pltbindtype
elf_plt_write(uintptr_t addr, uintptr_t vaddr, void *rptr, uintptr_t symval,
        Xword pltndx)
{
        Rela            *rel = (Rela *)rptr;
        uintptr_t       nsym = ~symval;
        uintptr_t       vpltaddr, pltaddr;
        long            disp;


        pltaddr = addr + rel->r_offset;
        vpltaddr = vaddr + rel->r_offset;
        disp = symval - vpltaddr - 4;

        if (pltndx >= (M64_PLT_NEARPLTS - M_PLT_XNumber)) {
                *((Sxword *)pltaddr) = (uintptr_t)symval +
                    (uintptr_t)rel->r_addend - vaddr;
                DBG_CALL(pltcntfar++);
                return (PLT_T_FAR);
        }

        /*
         * Test if the destination address is close enough to use
         * a ba,a... instruction to reach it.
         */
        if (S_INRANGE(disp, 23) && !(rtld_flags & RT_FL_NOBAPLT)) {
                uint_t          *pltent, bainstr;
                Pltbindtype     rc;

                pltent = (uint_t *)pltaddr;

                /*
                 * The
                 *
                 *      ba,a,pt %icc, <dest>
                 *
                 * is the most efficient of the PLT's.  If we
                 * are within +-20 bits - use that branch.
                 */
                if (S_INRANGE(disp, 20)) {
                        bainstr = M_BA_A_PT;    /* ba,a,pt %icc,<dest> */
                        /* LINTED */
                        bainstr |= (uint_t)(S_MASK(19) & (disp >> 2));
                        rc = PLT_T_21D;
                        DBG_CALL(pltcnt21d++);
                } else {
                        /*
                         * Otherwise - we fall back to the good old
                         *
                         *      ba,a    <dest>
                         *
                         * Which still beats a jmpl instruction.
                         */
                        bainstr = M_BA_A;               /* ba,a <dest> */
                        /* LINTED */
                        bainstr |= (uint_t)(S_MASK(22) & (disp >> 2));
                        rc = PLT_T_24D;
                        DBG_CALL(pltcnt24d++);
                }

                pltent[2] = M_NOP;              /* nop instr */
                pltent[1] = bainstr;

                iflush_range((char *)(&pltent[1]), 4);
                pltent[0] = M_NOP;              /* nop instr */
                iflush_range((char *)(&pltent[0]), 4);
                return (rc);
        }

        if ((nsym >> 32) == 0) {
                plt_upper_32(pltaddr, symval);
                DBG_CALL(pltcntu32++);
                return (PLT_T_U32);
        }

        if ((nsym >> 44) == 0) {
                plt_upper_44(pltaddr, symval);
                DBG_CALL(pltcntu44++);
                return (PLT_T_U44);
        }

        /*
         * The PLT destination is not in reach of
         * a branch instruction - so we fall back
         * to a 'jmpl' sequence.
         */
        plt_full_range(pltaddr, symval);
        DBG_CALL(pltcntfull++);
        return (PLT_T_FULL);
}

/*
 * Once relocated, the following 6 instruction sequence moves
 * a 64-bit immediate value into register %g1
 */
#define VAL64_TO_G1 \
/* 0x00 */      0x0b, 0x00, 0x00, 0x00, /* sethi %hh(value), %g5 */ \
/* 0x04 */      0x8a, 0x11, 0x60, 0x00, /* or %g5, %hm(value), %g5 */ \
/* 0x08 */      0x8b, 0x29, 0x70, 0x20, /* sllx %g5, 32, %g5 */ \
/* 0x0c */      0x03, 0x00, 0x00, 0x00, /* sethi %lm(value), %g1 */ \
/* 0x10 */      0x82, 0x10, 0x60, 0x00, /* or %g1, %lo(value), %g1 */ \
/* 0x14 */      0x82, 0x10, 0x40, 0x05  /* or %g1, %g5, %g1 */

/*
 * Local storage space created on the stack created for this glue
 * code includes space for:
 *              0x8     pointer to dyn_data
 *              0x8     size prev stack frame
 */
static const Byte dyn_plt_template[] = {
/* 0x0 */       0x2a, 0xcf, 0x80, 0x03, /* brnz,a,pt %fp, 0xc   */
/* 0x4 */       0x82, 0x27, 0x80, 0x0e, /* sub %fp, %sp, %g1 */
/* 0x8 */       0x82, 0x10, 0x20, 0xb0, /* mov 176, %g1 */
/* 0xc */       0x9d, 0xe3, 0xbf, 0x40, /* save %sp, -192, %sp  */
/* 0x10 */      0xc2, 0x77, 0xa7, 0xef, /* stx %g1, [%fp + 2031] */

                                        /* store prev stack size */
/* 0x14 */      VAL64_TO_G1,            /* dyn_data to g1 */
/* 0x2c */      0xc2, 0x77, 0xa7, 0xf7, /* stx %g1, [%fp + 2039] */

/* 0x30 */      VAL64_TO_G1,            /* elf_plt_trace() addr to g1 */

                                        /* Call to elf_plt_trace() via g1 */
/* 0x48 */      0x9f, 0xc0, 0x60, 0x00, /* jmpl ! link r[15] to addr in g1 */
/* 0x4c */      0x01, 0x00, 0x00, 0x00  /* nop ! for jmpl delay slot *AND* */
                                        /*      to get 8-byte alignment */
};

int     dyn_plt_ent_size = sizeof (dyn_plt_template) +
                sizeof (Addr) +         /* reflmp */
                sizeof (Addr) +         /* deflmp */
                sizeof (Word) +         /* symndx */
                sizeof (Word) +         /* sb_flags */
                sizeof (Sym);           /* symdef */

/*
 * the dynamic plt entry is:
 *
 *      brnz,a,pt       %fp, 1f
 *      sub             %sp, %fp, %g1
 *      mov             SA(MINFRAME), %g1
 * 1:
 *      save            %sp, -(SA(MINFRAME) + (2 * CLONGSIZE)), %sp
 *
 *      ! store prev stack size
 *      stx             %g1, [%fp + STACK_BIAS - (2 * CLONGSIZE)]
 *
 * 2:
 *      ! move dyn_data to %g1
 *      sethi           %hh(dyn_data), %g5
 *      or              %g5, %hm(dyn_data), %g5
 *      sllx            %g5, 32, %g5
 *      sethi           %lm(dyn_data), %g1
 *      or              %g1, %lo(dyn_data), %g1
 *      or              %g1, %g5, %g1
 *
 *      ! store dyn_data ptr on frame (from %g1)
 *       stx            %g1, [%fp + STACK_BIAS - CLONGSIZE]
 *
 *      ! Move address of elf_plt_trace() into %g1
 *      [Uses same 6 instructions as shown at label 2: above. Not shown.]
 *
 *      ! Use JMPL to make call. CALL instruction is limited to 30-bits.
 *      ! of displacement.
 *      jmp1            %g1, %o7
 *
 *      ! JMPL has a delay slot that must be filled. And, the sequence
 *      ! of instructions needs to have 8-byte alignment. This NOP does both.
 *      ! The alignment is needed for the data we put following the
 *      ! instruction.
 *      nop
 *
 * dyn data:
 *      Addr            reflmp
 *      Addr            deflmp
 *      Word            symndx
 *      Word            sb_flags
 *      Sym             symdef  (Elf64_Sym = 24-bytes)
 */

/*
 * Relocate the instructions given by the VAL64_TO_G1 macro above.
 * The arguments parallel those of do_reloc_rtld().
 *
 * entry:
 *      off - Address of 1st instruction in sequence.
 *      value - Value being relocated (addend)
 *      sym - Name of value being relocated.
 *      lml - link map list
 *
 * exit:
 *      Returns TRUE for success, FALSE for failure.
 */
static int
reloc_val64_to_g1(uchar_t *off, Addr *value, const char *sym, Lm_list *lml)
{
        Xword   tmp_value;

        /*
         * relocating:
         *      sethi   %hh(value), %g5
         */
        tmp_value = (Xword)value;
        if (do_reloc_rtld(R_SPARC_HH22, off, &tmp_value, sym,
            MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
                return (0);
        }

        /*
         * relocating:
         *      or      %g5, %hm(value), %g5
         */
        tmp_value = (Xword)value;
        if (do_reloc_rtld(R_SPARC_HM10, off + 4, &tmp_value, sym,
            MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
                return (0);
        }

        /*
         * relocating:
         *      sethi   %lm(value), %g1
         */
        tmp_value = (Xword)value;
        if (do_reloc_rtld(R_SPARC_LM22, off + 12, &tmp_value, sym,
            MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
                return (0);
        }

        /*
         * relocating:
         *      or      %g1, %lo(value), %g1
         */
        tmp_value = (Xword)value;
        if (do_reloc_rtld(R_SPARC_LO10, off + 16, &tmp_value, sym,
            MSG_ORIG(MSG_SPECFIL_DYNPLT), lml) == 0) {
                return (0);
        }

        return (1);
}

static caddr_t
elf_plt_trace_write(caddr_t addr, Rela *rptr, Rt_map *rlmp, Rt_map *dlmp,
    Sym *sym, uint_t symndx, ulong_t pltndx, caddr_t to, uint_t sb_flags,
    int *fail)
{
        extern ulong_t  elf_plt_trace();
        uchar_t         *dyn_plt;
        uintptr_t       *dyndata;

        /*
         * If both pltenter & pltexit have been disabled there
         * there is no reason to even create the glue code.
         */
        if ((sb_flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)) ==
            (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)) {
                (void) elf_plt_write((uintptr_t)addr, (uintptr_t)addr,
                    rptr, (uintptr_t)to, pltndx);
                return (to);
        }

        /*
         * We only need to add the glue code if there is an auditing
         * library that is interested in this binding.
         */
        dyn_plt = (uchar_t *)((uintptr_t)AUDINFO(rlmp)->ai_dynplts +
            (pltndx * dyn_plt_ent_size));

        /*
         * Have we initialized this dynamic plt entry yet?  If we haven't do it
         * now.  Otherwise this function has been called before, but from a
         * different plt (ie. from another shared object).  In that case
         * we just set the plt to point to the new dyn_plt.
         */
        if (*dyn_plt == 0) {
                Sym     *symp;
                Lm_list *lml = LIST(rlmp);

                (void) memcpy((void *)dyn_plt, dyn_plt_template,
                    sizeof (dyn_plt_template));
                dyndata = (uintptr_t *)((uintptr_t)dyn_plt +
                    sizeof (dyn_plt_template));

                /*
                 * relocating:
                 *      VAL64_TO_G1(dyndata)
                 *      VAL64_TO_G1(&elf_plt_trace)
                 */
                if (!(reloc_val64_to_g1((dyn_plt + 0x14), dyndata,
                    MSG_ORIG(MSG_SYM_LADYNDATA), lml) &&
                    reloc_val64_to_g1((dyn_plt + 0x30), (Addr *)&elf_plt_trace,
                    MSG_ORIG(MSG_SYM_ELFPLTTRACE), lml))) {
                        *fail = 1;
                        return (0);
                }

                *dyndata++ = (Addr)rlmp;
                *dyndata++ = (Addr)dlmp;

                /*
                 * symndx in the high word, sb_flags in the low.
                 */
                *dyndata = (Addr)sb_flags;
                *(Word *)dyndata = symndx;
                dyndata++;

                symp = (Sym *)dyndata;
                *symp = *sym;
                symp->st_value = (Addr)to;
                iflush_range((void *)dyn_plt, sizeof (dyn_plt_template));
        }

        (void) elf_plt_write((uintptr_t)addr, (uintptr_t)addr, rptr,
            (uintptr_t)dyn_plt, pltndx);
        return ((caddr_t)dyn_plt);
}

/*
 * Function binding routine - invoked on the first call to a function through
 * the procedure linkage table;
 * passes first through an assembly language interface.
 *
 * Takes the address of the PLT entry where the call originated,
 * the offset into the relocation table of the associated
 * relocation entry and the address of the link map (rt_private_map struct)
 * for the entry.
 *
 * Returns the address of the function referenced after re-writing the PLT
 * entry to invoke the function directly.
 *
 * On error, causes process to terminate with a signal.
 */
ulong_t
elf_bndr(Rt_map *lmp, ulong_t pltoff, caddr_t from)
{
        Rt_map          *nlmp, *llmp;
        Addr            addr, vaddr, reloff, symval;
        char            *name;
        Rela            *rptr;
        Sym             *rsym, *nsym;
        Xword           pltndx;
        uint_t          binfo, sb_flags = 0, dbg_class;
        ulong_t         rsymndx;
        Slookup         sl;
        Sresult         sr;
        Pltbindtype     pbtype;
        int             entry, lmflags, farplt = 0;
        Lm_list         *lml;

        /*
         * For compatibility with libthread (TI_VERSION 1) we track the entry
         * value.  A zero value indicates we have recursed into ld.so.1 to
         * further process a locking request.  Under this recursion we disable
         * tsort and cleanup activities.
         */
        entry = enter(0);

        lml = LIST(lmp);
        if ((lmflags = lml->lm_flags) & LML_FLG_RTLDLM) {
                dbg_class = dbg_desc->d_class;
                dbg_desc->d_class = 0;
        }

        /*
         * Must calculate true plt relocation address from reloc.
         * Take offset, subtract number of reserved PLT entries, and divide
         * by PLT entry size, which should give the index of the plt
         * entry (and relocation entry since they have been defined to be
         * in the same order).  Then we must multiply by the size of
         * a relocation entry, which will give us the offset of the
         * plt relocation entry from the start of them given by JMPREL(lm).
         */
        addr = pltoff - M_PLT_RESERVSZ;

        if (pltoff < (M64_PLT_NEARPLTS * M_PLT_ENTSIZE)) {
                pltndx = addr / M_PLT_ENTSIZE;
        } else {
                ulong_t pltblockoff;

                pltblockoff = pltoff - (M64_PLT_NEARPLTS * M_PLT_ENTSIZE);
                pltndx = M64_PLT_NEARPLTS +
                    ((pltblockoff / M64_PLT_FBLOCKSZ) * M64_PLT_FBLKCNTS) +
                    ((pltblockoff % M64_PLT_FBLOCKSZ) / M64_PLT_FENTSIZE) -
                    M_PLT_XNumber;
                farplt = 1;
        }

        /*
         * Perform some basic sanity checks.  If we didn't get a load map
         * or the plt offset is invalid then its possible someone has walked
         * over the plt entries or jumped to plt[01] out of the blue.
         */
        if (!lmp || (!farplt && (addr % M_PLT_ENTSIZE) != 0) ||
            (farplt && (addr % M_PLT_INSSIZE))) {
                Conv_inv_buf_t  inv_buf;

                eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_PLTREF),
                    conv_reloc_SPARC_type(R_SPARC_JMP_SLOT, 0, &inv_buf),
                    EC_NATPTR(lmp), EC_XWORD(pltoff), EC_NATPTR(from));
                rtldexit(lml, 1);
        }
        reloff = pltndx * sizeof (Rela);

        /*
         * Use relocation entry to get symbol table entry and symbol name.
         */
        addr = (ulong_t)JMPREL(lmp);
        rptr = (Rela *)(addr + reloff);
        rsymndx = ELF_R_SYM(rptr->r_info);
        rsym = (Sym *)((ulong_t)SYMTAB(lmp) + (rsymndx * SYMENT(lmp)));
        name = (char *)(STRTAB(lmp) + rsym->st_name);

        /*
         * Determine the last link-map of this list, this'll be the starting
         * point for any tsort() processing.
         */
        llmp = lml->lm_tail;

        /*
         * Find definition for symbol.  Initialize the symbol lookup, and symbol
         * result, data structures.
         */
        SLOOKUP_INIT(sl, name, lmp, lml->lm_head, ld_entry_cnt, 0,
            rsymndx, rsym, 0, LKUP_DEFT);
        SRESULT_INIT(sr, name);

        if (lookup_sym(&sl, &sr, &binfo, NULL) == 0) {
                eprintf(lml, ERR_FATAL, MSG_INTL(MSG_REL_NOSYM), NAME(lmp),
                    demangle(name));
                rtldexit(lml, 1);
        }

        name = (char *)sr.sr_name;
        nlmp = sr.sr_dmap;
        nsym = sr.sr_sym;

        symval = nsym->st_value;

        if (!(FLAGS(nlmp) & FLG_RT_FIXED) &&
            (nsym->st_shndx != SHN_ABS))
                symval += ADDR(nlmp);
        if ((lmp != nlmp) && ((FLAGS1(nlmp) & FL1_RT_NOINIFIN) == 0)) {
                /*
                 * Record that this new link map is now bound to the caller.
                 */
                if (bind_one(lmp, nlmp, BND_REFER) == 0)
                        rtldexit(lml, 1);
        }

        if ((lml->lm_tflags | AFLAGS(lmp) | AFLAGS(nlmp)) &
            LML_TFLG_AUD_SYMBIND) {
                /* LINTED */
                uint_t  symndx = (uint_t)(((uintptr_t)nsym -
                    (uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp));

                symval = audit_symbind(lmp, nlmp, nsym, symndx, symval,
                    &sb_flags);
        }

        if (FLAGS(lmp) & FLG_RT_FIXED)
                vaddr = 0;
        else
                vaddr = ADDR(lmp);

        pbtype = PLT_T_NONE;
        if (!(rtld_flags & RT_FL_NOBIND)) {
                if (((lml->lm_tflags | AFLAGS(lmp)) &
                    (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) &&
                    AUDINFO(lmp)->ai_dynplts) {
                        int     fail = 0;
                        /* LINTED */
                        uint_t  symndx = (uint_t)(((uintptr_t)nsym -
                            (uintptr_t)SYMTAB(nlmp)) / SYMENT(nlmp));

                        symval = (ulong_t)elf_plt_trace_write((caddr_t)vaddr,
                            rptr, lmp, nlmp, nsym, symndx, pltndx,
                            (caddr_t)symval, sb_flags, &fail);
                        if (fail)
                                rtldexit(lml, 1);
                } else {
                        /*
                         * Write standard PLT entry to jump directly
                         * to newly bound function.
                         */
                        pbtype = elf_plt_write((uintptr_t)vaddr,
                            (uintptr_t)vaddr, rptr, symval, pltndx);
                }
        }

        /*
         * Print binding information and rebuild PLT entry.
         */
        DBG_CALL(Dbg_bind_global(lmp, (Addr)from, (Off)(from - ADDR(lmp)),
            (Xword)pltndx, pbtype, nlmp, (Addr)symval, nsym->st_value,
            name, binfo));

        /*
         * Complete any processing for newly loaded objects.  Note we don't
         * know exactly where any new objects are loaded (we know the object
         * that supplied the symbol, but others may have been loaded lazily as
         * we searched for the symbol), so sorting starts from the last
         * link-map know on entry to this routine.
         */
        if (entry)
                load_completion(llmp);

        /*
         * Some operations like dldump() or dlopen()'ing a relocatable object
         * result in objects being loaded on rtld's link-map, make sure these
         * objects are initialized also.
         */
        if ((LIST(nlmp)->lm_flags & LML_FLG_RTLDLM) && LIST(nlmp)->lm_init)
                load_completion(nlmp);

        /*
         * Make sure the object to which we've bound has had it's .init fired.
         * Cleanup before return to user code.
         */
        if (entry) {
                is_dep_init(nlmp, lmp);
                leave(lml, 0);
        }

        if (lmflags & LML_FLG_RTLDLM)
                dbg_desc->d_class = dbg_class;

        return (symval);
}

static int
bindpltpad(Rt_map *lmp, Alist **padlist, Addr value, void **pltaddr,
    const char *fname, const char *sname)
{
        Aliste          idx = 0;
        Pltpadinfo      ppi, *ppip;
        void            *plt;
        uintptr_t       pltoff;
        Rela            rel;
        int             i;

        for (ALIST_TRAVERSE(*padlist, idx, ppip)) {
                if (ppip->pp_addr == value) {
                        *pltaddr = ppip->pp_plt;
                        DBG_CALL(Dbg_bind_pltpad_from(lmp, (Addr)*pltaddr,
                            sname));
                        return (1);
                }
                if (ppip->pp_addr > value)
                        break;
        }

        plt = PLTPAD(lmp);
        pltoff = (uintptr_t)plt - (uintptr_t)ADDR(lmp);

        PLTPAD(lmp) = (void *)((uintptr_t)PLTPAD(lmp) + M_PLT_ENTSIZE);

        if (PLTPAD(lmp) > PLTPADEND(lmp)) {
                /*
                 * Just fail in usual relocation way
                 */
                *pltaddr = (void *)value;
                return (1);
        }
        rel.r_offset = pltoff;
        rel.r_info = 0;
        rel.r_addend = 0;

        /*
         * elf_plt_write assumes the plt was previously filled
         * with NOP's, so fill it in now.
         */
        for (i = 0; i < (M_PLT_ENTSIZE / sizeof (uint_t)); i++) {
                ((uint_t *)plt)[i] = M_NOP;
        }
        iflush_range((caddr_t)plt, M_PLT_ENTSIZE);

        (void) elf_plt_write(ADDR(lmp), ADDR(lmp), &rel, value, 0);

        ppi.pp_addr = value;
        ppi.pp_plt = plt;

        if (alist_insert(padlist, &ppi, sizeof (Pltpadinfo),
            AL_CNT_PLTPAD, idx) == NULL)
                return (0);

        *pltaddr = plt;
        DBG_CALL(Dbg_bind_pltpad_to(lmp, (Addr)*pltaddr, fname, sname));
        return (1);
}

/*
 * Read and process the relocations for one link object, we assume all
 * relocation sections for loadable segments are stored contiguously in
 * the file.
 */
int
elf_reloc(Rt_map *lmp, uint_t plt, int *in_nfavl, APlist **textrel)
{
        ulong_t         relbgn, relend, relsiz, basebgn, pltbgn, pltend;
        ulong_t         pltndx, roffset, rsymndx, psymndx = 0;
        uint_t          dsymndx, binfo, pbinfo;
        uchar_t         rtype;
        long            reladd;
        Addr            value, pvalue;
        Sym             *symref, *psymref, *symdef, *psymdef;
        Syminfo         *sip;
        char            *name, *pname;
        Rt_map          *_lmp, *plmp;
        int             ret = 1, noplt = 0;
        long            relacount = RELACOUNT(lmp);
        Rela            *rel;
        Pltbindtype     pbtype;
        Alist           *pltpadlist = NULL;
        APlist          *bound = NULL;

        /*
         * If an object has any DT_REGISTER entries associated with
         * it, they are processed now.
         */
        if ((plt == 0) && (FLAGS(lmp) & FLG_RT_REGSYMS)) {
                if (elf_regsyms(lmp) == 0)
                        return (0);
        }

        /*
         * Although only necessary for lazy binding, initialize the first
         * procedure linkage table entry to go to elf_rtbndr().  dbx(1) seems
         * to find this useful.
         */
        if ((plt == 0) && PLTGOT(lmp)) {
                mmapobj_result_t        *mpp;
                Xword                   pltoff;

                /*
                 * Make sure the segment is writable.
                 */
                if ((((mpp =
                    find_segment((caddr_t)PLTGOT(lmp), lmp)) != NULL) &&
                    ((mpp->mr_prot & PROT_WRITE) == 0)) &&
                    ((set_prot(lmp, mpp, 1) == 0) ||
                    (aplist_append(textrel, mpp, AL_CNT_TEXTREL) == NULL)))
                        return (0);

                /*
                 * Install the lm pointer in .PLT2 as per the ABI.
                 */
                pltoff = (2 * M_PLT_ENTSIZE) / M_PLT_INSSIZE;
                elf_plt2_init(PLTGOT(lmp) + pltoff, lmp);

                /*
                 * The V9 ABI states that the first 32k PLT entries
                 * use .PLT1, with .PLT0 used by the "latter" entries.
                 * We don't currently implement the extendend format,
                 * so install an error handler in .PLT0 to catch anyone
                 * trying to use it.
                 */
                elf_plt_init(PLTGOT(lmp), (caddr_t)elf_rtbndr_far);

                /*
                 * Initialize .PLT1
                 */
                pltoff = M_PLT_ENTSIZE / M_PLT_INSSIZE;
                elf_plt_init(PLTGOT(lmp) + pltoff, (caddr_t)elf_rtbndr);
        }

        /*
         * Initialize the plt start and end addresses.
         */
        if ((pltbgn = (ulong_t)JMPREL(lmp)) != 0)
                pltend = pltbgn + (ulong_t)(PLTRELSZ(lmp));

        /*
         * If we've been called upon to promote an RTLD_LAZY object to an
         * RTLD_NOW then we're only interested in scaning the .plt table.
         */
        if (plt) {
                relbgn = pltbgn;
                relend = pltend;
        } else {
                /*
                 * The relocation sections appear to the run-time linker as a
                 * single table.  Determine the address of the beginning and end
                 * of this table.  There are two different interpretations of
                 * the ABI at this point:
                 *
                 *   o  The REL table and its associated RELSZ indicate the
                 *      concatenation of *all* relocation sections (this is the
                 *      model our link-editor constructs).
                 *
                 *   o  The REL table and its associated RELSZ indicate the
                 *      concatenation of all *but* the .plt relocations.  These
                 *      relocations are specified individually by the JMPREL and
                 *      PLTRELSZ entries.
                 *
                 * Determine from our knowledege of the relocation range and
                 * .plt range, the range of the total relocation table.  Note
                 * that one other ABI assumption seems to be that the .plt
                 * relocations always follow any other relocations, the
                 * following range checking drops that assumption.
                 */
                relbgn = (ulong_t)(REL(lmp));
                relend = relbgn + (ulong_t)(RELSZ(lmp));
                if (pltbgn) {
                        if (!relbgn || (relbgn > pltbgn))
                                relbgn = pltbgn;
                        if (!relbgn || (relend < pltend))
                                relend = pltend;
                }
        }
        if (!relbgn || (relbgn == relend)) {
                DBG_CALL(Dbg_reloc_run(lmp, 0, plt, DBG_REL_NONE));
                return (1);
        }

        relsiz = (ulong_t)(RELENT(lmp));
        basebgn = ADDR(lmp);

        DBG_CALL(Dbg_reloc_run(lmp, M_REL_SHT_TYPE, plt, DBG_REL_START));

        /*
         * If we're processing in lazy mode there is no need to scan the
         * .rela.plt table.
         */
        if (pltbgn && ((MODE(lmp) & RTLD_NOW) == 0))
                noplt = 1;

        sip = SYMINFO(lmp);
        /*
         * Loop through relocations.
         */
        while (relbgn < relend) {
                mmapobj_result_t        *mpp;
                uint_t                  sb_flags = 0;
                Addr                    vaddr;

                rtype = ELF_R_TYPE(((Rela *)relbgn)->r_info, M_MACH);

                /*
                 * If this is a RELATIVE relocation in a shared object
                 * (the common case), and if we are not debugging, then
                 * jump into a tighter relocaiton loop (elf_reloc_relacount)
                 * Only make the jump if we've been given a hint on the
                 * number of relocations.
                 */
                if ((rtype == R_SPARC_RELATIVE) &&
                    ((FLAGS(lmp) & FLG_RT_FIXED) == 0) && (DBG_ENABLED == 0)) {
                        if (relacount) {
                                relbgn = elf_reloc_relative_count(relbgn,
                                    relacount, relsiz, basebgn, lmp,
                                    textrel, 0);
                                relacount = 0;
                        } else {
                                relbgn = elf_reloc_relative(relbgn, relend,
                                    relsiz, basebgn, lmp, textrel, 0);
                        }
                        if (relbgn >= relend)
                                break;
                        rtype = ELF_R_TYPE(((Rela *)relbgn)->r_info, M_MACH);
                }

                roffset = ((Rela *)relbgn)->r_offset;

                reladd = (long)(((Rela *)relbgn)->r_addend);
                rsymndx = ELF_R_SYM(((Rela *)relbgn)->r_info);
                rel = (Rela *)relbgn;
                relbgn += relsiz;

                /*
                 * Optimizations.
                 */
                if (rtype == R_SPARC_NONE)
                        continue;
                if (noplt && ((ulong_t)rel >= pltbgn) &&
                    ((ulong_t)rel < pltend)) {
                        relbgn = pltend;
                        continue;
                }

                if (rtype != R_SPARC_REGISTER) {
                        /*
                         * If this is a shared object, add the base address
                         * to offset.
                         */
                        if (!(FLAGS(lmp) & FLG_RT_FIXED))
                                roffset += basebgn;

                        /*
                         * If this relocation is not against part of the image
                         * mapped into memory we skip it.
                         */
                        if ((mpp = find_segment((caddr_t)roffset,
                            lmp)) == NULL) {
                                elf_reloc_bad(lmp, (void *)rel, rtype, roffset,
                                    rsymndx);
                                continue;
                        }
                }

                /*
                 * If we're promoting plts, determine if this one has already
                 * been written. An uninitialized plts' second instruction is a
                 * branch.
                 */
                if (plt) {
                        uchar_t *_roffset = (uchar_t *)roffset;

                        _roffset += M_PLT_INSSIZE;
                        /* LINTED */
                        if ((*(uint_t *)_roffset &
                            (~(S_MASK(19)))) != M_BA_A_XCC)
                                continue;
                }

                binfo = 0;
                pltndx = (ulong_t)-1;
                pbtype = PLT_T_NONE;

                /*
                 * If a symbol index is specified then get the symbol table
                 * entry, locate the symbol definition, and determine its
                 * address.
                 */
                if (rsymndx) {
                        /*
                         * If a Syminfo section is provided, determine if this
                         * symbol is deferred, and if so, skip this relocation.
                         */
                        if (sip && is_sym_deferred((ulong_t)rel, basebgn, lmp,
                            textrel, sip, rsymndx))
                                continue;

                        /*
                         * Get the local symbol table entry.
                         */
                        symref = (Sym *)((ulong_t)SYMTAB(lmp) +
                            (rsymndx * SYMENT(lmp)));

                        /*
                         * If this is a local symbol, just use the base address.
                         * (we should have no local relocations in the
                         * executable).
                         */
                        if (ELF_ST_BIND(symref->st_info) == STB_LOCAL) {
                                value = basebgn;
                                name = NULL;

                                /*
                                 * Special case TLS relocations.
                                 */
                                if ((rtype == R_SPARC_TLS_DTPMOD32) ||
                                    (rtype == R_SPARC_TLS_DTPMOD64)) {
                                        /*
                                         * Use the TLS modid.
                                         */
                                        value = TLSMODID(lmp);

                                } else if ((rtype == R_SPARC_TLS_TPOFF32) ||
                                    (rtype == R_SPARC_TLS_TPOFF64)) {
                                        if ((value = elf_static_tls(lmp, symref,
                                            rel, rtype, 0, roffset, 0)) == 0) {
                                                ret = 0;
                                                break;
                                        }
                                }
                        } else {
                                /*
                                 * If the symbol index is equal to the previous
                                 * symbol index relocation we processed then
                                 * reuse the previous values. (Note that there
                                 * have been cases where a relocation exists
                                 * against a copy relocation symbol, our ld(1)
                                 * should optimize this away, but make sure we
                                 * don't use the same symbol information should
                                 * this case exist).
                                 */
                                if ((rsymndx == psymndx) &&
                                    (rtype != R_SPARC_COPY)) {
                                        /* LINTED */
                                        if (psymdef == 0) {
                                                DBG_CALL(Dbg_bind_weak(lmp,
                                                    (Addr)roffset, (Addr)
                                                    (roffset - basebgn), name));
                                                continue;
                                        }
                                        /* LINTED */
                                        value = pvalue;
                                        /* LINTED */
                                        name = pname;
                                        symdef = psymdef;
                                        /* LINTED */
                                        symref = psymref;
                                        /* LINTED */
                                        _lmp = plmp;
                                        /* LINTED */
                                        binfo = pbinfo;

                                        if ((LIST(_lmp)->lm_tflags |
                                            AFLAGS(_lmp)) &
                                            LML_TFLG_AUD_SYMBIND) {
                                                value = audit_symbind(lmp, _lmp,
                                                    /* LINTED */
                                                    symdef, dsymndx, value,
                                                    &sb_flags);
                                        }
                                } else {
                                        Slookup         sl;
                                        Sresult         sr;

                                        /*
                                         * Lookup the symbol definition.
                                         * Initialize the symbol lookup, and
                                         * symbol result, data structures.
                                         */
                                        name = (char *)(STRTAB(lmp) +
                                            symref->st_name);

                                        SLOOKUP_INIT(sl, name, lmp, 0,
                                            ld_entry_cnt, 0, rsymndx, symref,
                                            rtype, LKUP_STDRELOC);
                                        SRESULT_INIT(sr, name);
                                        symdef = NULL;

                                        if (lookup_sym(&sl, &sr, &binfo,
                                            in_nfavl)) {
                                                name = (char *)sr.sr_name;
                                                _lmp = sr.sr_dmap;
                                                symdef = sr.sr_sym;
                                        }

                                        /*
                                         * If the symbol is not found and the
                                         * reference was not to a weak symbol,
                                         * report an error.  Weak references
                                         * may be unresolved.
                                         */
                                        /* BEGIN CSTYLED */
                                        if (symdef == 0) {
                                            if (sl.sl_bind != STB_WEAK) {
                                                if (elf_reloc_error(lmp, name,
                                                    rel, binfo))
                                                        continue;

                                                ret = 0;
                                                break;

                                            } else {
                                                psymndx = rsymndx;
                                                psymdef = 0;

                                                DBG_CALL(Dbg_bind_weak(lmp,
                                                    (Addr)roffset, (Addr)
                                                    (roffset - basebgn), name));
                                                continue;
                                            }
                                        }
                                        /* END CSTYLED */

                                        /*
                                         * If symbol was found in an object
                                         * other than the referencing object
                                         * then record the binding.
                                         */
                                        if ((lmp != _lmp) && ((FLAGS1(_lmp) &
                                            FL1_RT_NOINIFIN) == 0)) {
                                                if (aplist_test(&bound, _lmp,
                                                    AL_CNT_RELBIND) == 0) {
                                                        ret = 0;
                                                        break;
                                                }
                                        }

                                        /*
                                         * Calculate the location of definition;
                                         * symbol value plus base address of
                                         * containing shared object.
                                         */
                                        if (IS_SIZE(rtype))
                                                value = symdef->st_size;
                                        else
                                                value = symdef->st_value;

                                        if (!(FLAGS(_lmp) & FLG_RT_FIXED) &&
                                            !(IS_SIZE(rtype)) &&
                                            (symdef->st_shndx != SHN_ABS) &&
                                            (ELF_ST_TYPE(symdef->st_info) !=
                                            STT_TLS))
                                                value += ADDR(_lmp);

                                        /*
                                         * Retain this symbol index and the
                                         * value in case it can be used for the
                                         * subsequent relocations.
                                         */
                                        if (rtype != R_SPARC_COPY) {
                                                psymndx = rsymndx;
                                                pvalue = value;
                                                pname = name;
                                                psymdef = symdef;
                                                psymref = symref;
                                                plmp = _lmp;
                                                pbinfo = binfo;
                                        }
                                        if ((LIST(_lmp)->lm_tflags |
                                            AFLAGS(_lmp)) &
                                            LML_TFLG_AUD_SYMBIND) {
                                                /* LINTED */
                                                dsymndx = (((uintptr_t)symdef -
                                                    (uintptr_t)SYMTAB(_lmp)) /
                                                    SYMENT(_lmp));
                                                value = audit_symbind(lmp, _lmp,
                                                    symdef, dsymndx, value,
                                                    &sb_flags);
                                        }
                                }

                                /*
                                 * If relocation is PC-relative, subtract
                                 * offset address.
                                 */
                                if (IS_PC_RELATIVE(rtype))
                                        value -= roffset;

                                /*
                                 * Special case TLS relocations.
                                 */
                                if ((rtype == R_SPARC_TLS_DTPMOD32) ||
                                    (rtype == R_SPARC_TLS_DTPMOD64)) {
                                        /*
                                         * Relocation value is the TLS modid.
                                         */
                                        value = TLSMODID(_lmp);

                                } else if ((rtype == R_SPARC_TLS_TPOFF64) ||
                                    (rtype == R_SPARC_TLS_TPOFF32)) {
                                        if ((value = elf_static_tls(_lmp,
                                            symdef, rel, rtype, name, roffset,
                                            value)) == 0) {
                                                ret = 0;
                                                break;
                                        }
                                }
                        }
                } else {
                        /*
                         * Special cases.
                         */
                        if (rtype == R_SPARC_REGISTER) {
                                /*
                                 * A register symbol associated with symbol
                                 * index 0 is initialized (i.e. relocated) to
                                 * a constant in the r_addend field rather than
                                 * to a symbol value.
                                 */
                                value = 0;

                        } else if ((rtype == R_SPARC_TLS_DTPMOD32) ||
                            (rtype == R_SPARC_TLS_DTPMOD64)) {
                                /*
                                 * TLS relocation value is the TLS modid.
                                 */
                                value = TLSMODID(lmp);
                        } else
                                value = basebgn;

                        name = NULL;
                }

                DBG_CALL(Dbg_reloc_in(LIST(lmp), ELF_DBG_RTLD, M_MACH,
                    M_REL_SHT_TYPE, rel, NULL, 0, name));

                /*
                 * Make sure the segment is writable.
                 */
                if ((rtype != R_SPARC_REGISTER) &&
                    ((mpp->mr_prot & PROT_WRITE) == 0) &&
                    ((set_prot(lmp, mpp, 1) == 0) ||
                    (aplist_append(textrel, mpp, AL_CNT_TEXTREL) == NULL))) {
                        ret = 0;
                        break;
                }

                /*
                 * Call relocation routine to perform required relocation.
                 */
                switch (rtype) {
                case R_SPARC_REGISTER:
                        /*
                         * The v9 ABI 4.2.4 says that system objects may,
                         * but are not required to, use register symbols
                         * to inidcate how they use global registers. Thus
                         * at least %g6, %g7 must be allowed in addition
                         * to %g2 and %g3.
                         */
                        value += reladd;
                        if (roffset == STO_SPARC_REGISTER_G1) {
                                set_sparc_g1(value);
                        } else if (roffset == STO_SPARC_REGISTER_G2) {
                                set_sparc_g2(value);
                        } else if (roffset == STO_SPARC_REGISTER_G3) {
                                set_sparc_g3(value);
                        } else if (roffset == STO_SPARC_REGISTER_G4) {
                                set_sparc_g4(value);
                        } else if (roffset == STO_SPARC_REGISTER_G5) {
                                set_sparc_g5(value);
                        } else if (roffset == STO_SPARC_REGISTER_G6) {
                                set_sparc_g6(value);
                        } else if (roffset == STO_SPARC_REGISTER_G7) {
                                set_sparc_g7(value);
                        } else {
                                eprintf(LIST(lmp), ERR_FATAL,
                                    MSG_INTL(MSG_REL_BADREG), NAME(lmp),
                                    EC_ADDR(roffset));
                                ret = 0;
                                break;
                        }

                        DBG_CALL(Dbg_reloc_apply_reg(LIST(lmp), ELF_DBG_RTLD,
                            M_MACH, (Xword)roffset, (Xword)value));
                        break;
                case R_SPARC_COPY:
                        if (elf_copy_reloc(name, symref, lmp, (void *)roffset,
                            symdef, _lmp, (const void *)value) == 0)
                                ret = 0;
                        break;
                case R_SPARC_JMP_SLOT:
                        pltndx = ((uintptr_t)rel -
                            (uintptr_t)JMPREL(lmp)) / relsiz;

                        if (FLAGS(lmp) & FLG_RT_FIXED)
                                vaddr = 0;
                        else
                                vaddr = ADDR(lmp);

                        if (((LIST(lmp)->lm_tflags | AFLAGS(lmp)) &
                            (LML_TFLG_AUD_PLTENTER | LML_TFLG_AUD_PLTEXIT)) &&
                            AUDINFO(lmp)->ai_dynplts) {
                                int     fail = 0;
                                /* LINTED */
                                uint_t  symndx = (uint_t)(((uintptr_t)symdef -
                                    (uintptr_t)SYMTAB(_lmp)) / SYMENT(_lmp));

                                (void) elf_plt_trace_write((caddr_t)vaddr,
                                    (Rela *)rel, lmp, _lmp, symdef, symndx,
                                    pltndx, (caddr_t)value, sb_flags, &fail);
                                if (fail)
                                        ret = 0;
                        } else {
                                /*
                                 * Write standard PLT entry to jump directly
                                 * to newly bound function.
                                 */
                                DBG_CALL(Dbg_reloc_apply_val(LIST(lmp),
                                    ELF_DBG_RTLD, (Xword)roffset,
                                    (Xword)value));
                                pbtype = elf_plt_write((uintptr_t)vaddr,
                                    (uintptr_t)vaddr, (void *)rel, value,
                                    pltndx);
                        }
                        break;
                case R_SPARC_WDISP30:
                        if (PLTPAD(lmp) &&
                            (S_INRANGE((Sxword)value, 29) == 0)) {
                                void *  plt = 0;

                                if (bindpltpad(lmp, &pltpadlist,
                                    value + roffset, &plt,
                                    NAME(_lmp), name) == 0) {
                                        ret = 0;
                                        break;
                                }
                                value = (Addr)((Addr)plt - roffset);
                        }
                        /* FALLTHROUGH */
                default:
                        value += reladd;
                        if (IS_EXTOFFSET(rtype))
                                value += (Word)ELF_R_TYPE_DATA(rel->r_info);

                        /*
                         * Write the relocation out.  If this relocation is a
                         * common basic write, skip the doreloc() engine.
                         */
                        if ((rtype == R_SPARC_GLOB_DAT) ||
                            (rtype == R_SPARC_64)) {
                                if (roffset & 0x7) {
                                        Conv_inv_buf_t  inv_buf;

                                        eprintf(LIST(lmp), ERR_FATAL,
                                            MSG_INTL(MSG_REL_NONALIGN),
                                            conv_reloc_SPARC_type(rtype,
                                            0, &inv_buf),
                                            NAME(lmp), demangle(name),
                                            EC_OFF(roffset));
                                        ret = 0;
                                } else
                                        *(ulong_t *)roffset += value;
                        } else {
                                if (do_reloc_rtld(rtype, (uchar_t *)roffset,
                                    (Xword *)&value, name,
                                    NAME(lmp), LIST(lmp)) == 0)
                                        ret = 0;
                        }

                        /*
                         * The value now contains the 'bit-shifted' value that
                         * was or'ed into memory (this was set by
                         * do_reloc_rtld()).
                         */
                        DBG_CALL(Dbg_reloc_apply_val(LIST(lmp), ELF_DBG_RTLD,
                            (Xword)roffset, (Xword)value));

                        /*
                         * If this relocation is against a text segment, make
                         * sure that the instruction cache is flushed.
                         */
                        if (textrel)
                                iflush_range((caddr_t)roffset, 0x4);
                }

                if ((ret == 0) &&
                    ((LIST(lmp)->lm_flags & LML_FLG_TRC_WARN) == 0))
                        break;

                if (binfo) {
                        DBG_CALL(Dbg_bind_global(lmp, (Addr)roffset,
                            (Off)(roffset - basebgn), pltndx, pbtype,
                            _lmp, (Addr)value, symdef->st_value, name, binfo));
                }
        }

        /*
         * Free up any items on the pltpadlist if it was allocated
         */
        if (pltpadlist)
                free(pltpadlist);

        return (relocate_finish(lmp, bound, ret));
}

/*
 * Provide a machine specific interface to the conversion routine.  By calling
 * the machine specific version, rather than the generic version, we insure that
 * the data tables/strings for all known machine versions aren't dragged into
 * ld.so.1.
 */
const char *
_conv_reloc_type(uint_t rel)
{
        static Conv_inv_buf_t   inv_buf;

        return (conv_reloc_SPARC_type(rel, 0, &inv_buf));
}