xref: /illumos-gate/usr/src/cmd/sgs/libelf/common/update.c (revision b1e2e3fb17324e9ddf43db264a0c64da7756d9e6)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  *	Copyright (c) 1988 AT&T
29  *	  All Rights Reserved
30  */
31 
32 /*
33  * Copyright (c) 2018, Joyent, Inc.
34  */
35 
36 #include <memory.h>
37 #include <malloc.h>
38 #include <limits.h>
39 
40 #include <sgs.h>
41 #include "decl.h"
42 #include "msg.h"
43 
44 /*
45  * This module is compiled twice, the second time having
46  * -D_ELF64 defined.  The following set of macros, along
47  * with machelf.h, represent the differences between the
48  * two compilations.  Be careful *not* to add any class-
49  * dependent code (anything that has elf32 or elf64 in the
50  * name) to this code without hiding it behind a switch-
51  * able macro like these.
52  */
53 #if	defined(_ELF64)
54 
55 #define	FSZ_LONG	ELF64_FSZ_XWORD
56 #define	ELFCLASS	ELFCLASS64
57 #define	_elf_snode_init	_elf64_snode_init
58 #define	_elfxx_cookscn	_elf64_cookscn
59 #define	_elf_upd_lib	_elf64_upd_lib
60 #define	elf_fsize	elf64_fsize
61 #define	_elf_entsz	_elf64_entsz
62 #define	_elf_msize	_elf64_msize
63 #define	_elf_upd_usr	_elf64_upd_usr
64 #define	wrt		wrt64
65 #define	elf_xlatetof	elf64_xlatetof
66 #define	_elfxx_update	_elf64_update
67 #define	_elfxx_swap_wrimage	_elf64_swap_wrimage
68 
69 #else	/* ELF32 */
70 
71 #define	FSZ_LONG	ELF32_FSZ_WORD
72 #define	ELFCLASS	ELFCLASS32
73 #define	_elf_snode_init	_elf32_snode_init
74 #define	_elfxx_cookscn	_elf32_cookscn
75 #define	_elf_upd_lib	_elf32_upd_lib
76 #define	elf_fsize	elf32_fsize
77 #define	_elf_entsz	_elf32_entsz
78 #define	_elf_msize	_elf32_msize
79 #define	_elf_upd_usr	_elf32_upd_usr
80 #define	wrt		wrt32
81 #define	elf_xlatetof	elf32_xlatetof
82 #define	_elfxx_update	_elf32_update
83 #define	_elfxx_swap_wrimage	_elf32_swap_wrimage
84 
85 #endif /* ELF64 */
86 
87 
88 #if	!(defined(_LP64) && defined(_ELF64))
89 #define	TEST_SIZE
90 
91 /*
92  * Handle the decision of whether the current linker can handle the
93  * desired object size, and if not, which error to issue.
94  *
95  * Input is the desired size. On failure, an error has been issued
96  * and 0 is returned. On success, 1 is returned.
97  */
98 static int
99 test_size(Lword hi)
100 {
101 #ifndef _LP64			/* 32-bit linker */
102 	/*
103 	 * A 32-bit libelf is limited to a 2GB output file. This limit
104 	 * is due to the fact that off_t is a signed value, and that
105 	 * libelf cannot support large file support:
106 	 *	- ABI reasons
107 	 *	- Memory use generally is 2x output file size anyway,
108 	 *		so lifting the file size limit will just send
109 	 *		you crashing into the 32-bit VM limit.
110 	 * If the output is an ELFCLASS64 object, or an ELFCLASS32 object
111 	 * under 4GB, switching to the 64-bit version of libelf will help.
112 	 * However, an ELFCLASS32 object must not exceed 4GB.
113 	 */
114 	if (hi > INT_MAX) {	/* Bigger than 2GB */
115 #ifndef _ELF64
116 		/* ELFCLASS32 object is fundamentally too big? */
117 		if (hi > UINT_MAX) {
118 			_elf_seterr(EFMT_FBIG_CLASS32, 0);
119 			return (0);
120 		}
121 #endif				/* _ELF64 */
122 
123 		/* Should switch to the 64-bit libelf? */
124 		_elf_seterr(EFMT_FBIG_LARGEFILE, 0);
125 		return (0);
126 	}
127 #endif				/* !_LP64 */
128 
129 
130 #if	defined(_LP64) && !defined(_ELF64)   /* 64-bit linker, ELFCLASS32 */
131 	/*
132 	 * A 64-bit linker can produce any size output
133 	 * file, but if the resulting file is ELFCLASS32,
134 	 * it must not exceed 4GB.
135 	 */
136 	if (hi > UINT_MAX) {
137 		_elf_seterr(EFMT_FBIG_CLASS32, 0);
138 		return (0);
139 	}
140 #endif
141 
142 	return (1);
143 }
144 #endif				/* TEST_SIZE */
145 
146 /*
147  * Output file update
148  *	These functions walk an Elf structure, update its information,
149  *	and optionally write the output file.  Because the application
150  *	may control of the output file layout, two upd_... routines
151  *	exist.  They're similar but too different to merge cleanly.
152  *
153  *	The library defines a "dirty" bit to force parts of the file
154  *	to be written on update.  These routines ignore the dirty bit
155  *	and do everything.  A minimal update routine might be useful
156  *	someday.
157  */
158 
159 static size_t
160 _elf_upd_lib(Elf * elf)
161 {
162 	Lword		hi;
163 	Lword		hibit;
164 	Elf_Scn *	s;
165 	register Lword	sz;
166 	Ehdr *		eh = elf->ed_ehdr;
167 	unsigned	ver = eh->e_version;
168 	register char	*p = (char *)eh->e_ident;
169 	size_t		scncnt;
170 
171 	/*
172 	 * Ehdr and Phdr table go first
173 	 */
174 	p[EI_MAG0] = ELFMAG0;
175 	p[EI_MAG1] = ELFMAG1;
176 	p[EI_MAG2] = ELFMAG2;
177 	p[EI_MAG3] = ELFMAG3;
178 	p[EI_CLASS] = ELFCLASS;
179 	/* LINTED */
180 	p[EI_VERSION] = (Byte)ver;
181 	hi = elf_fsize(ELF_T_EHDR, 1, ver);
182 	/* LINTED */
183 	eh->e_ehsize = (Half)hi;
184 	if (eh->e_phnum != 0) {
185 		/* LINTED */
186 		eh->e_phentsize = (Half)elf_fsize(ELF_T_PHDR, 1, ver);
187 		/* LINTED */
188 		eh->e_phoff = (Off)hi;
189 		hi += eh->e_phentsize * eh->e_phnum;
190 	} else {
191 		eh->e_phoff = 0;
192 		eh->e_phentsize = 0;
193 	}
194 
195 	/*
196 	 * Obtain the first section header.  Typically, this section has NULL
197 	 * contents, however in the case of Extended ELF Sections this section
198 	 * is used to hold an alternative e_shnum, e_shstrndx and e_phnum.
199 	 * On initial allocation (see _elf_snode) the elements of this section
200 	 * would have been zeroed.  The e_shnum is initialized later, after the
201 	 * section header count has been determined.  The e_shstrndx and
202 	 * e_phnum may have already been initialized by the caller (for example,
203 	 * gelf_update_shdr() in mcs(1)).
204 	 */
205 	if ((s = elf->ed_hdscn) == 0) {
206 		eh->e_shnum = 0;
207 		scncnt = 0;
208 	} else {
209 		s = s->s_next;
210 		scncnt = 1;
211 	}
212 
213 	/*
214 	 * Loop through sections.  Compute section size before changing hi.
215 	 * Allow null buffers for NOBITS.
216 	 */
217 	hibit = 0;
218 	for (; s != 0; s = s->s_next) {
219 		register Dnode	*d;
220 		register Lword	fsz, j;
221 		Shdr *sh = s->s_shdr;
222 
223 		scncnt++;
224 		if (sh->sh_type == SHT_NULL) {
225 			*sh = _elf_snode_init.sb_shdr;
226 			continue;
227 		}
228 
229 		if ((s->s_myflags & SF_READY) == 0)
230 			(void) _elfxx_cookscn(s);
231 
232 		sh->sh_addralign = 1;
233 		if ((sz = (Lword)_elf_entsz(elf, sh->sh_type, ver)) != 0)
234 			/* LINTED */
235 			sh->sh_entsize = (Half)sz;
236 		sz = 0;
237 		for (d = s->s_hdnode; d != 0; d = d->db_next) {
238 			if ((fsz = elf_fsize(d->db_data.d_type,
239 			    1, ver)) == 0)
240 				return (0);
241 
242 			j = _elf_msize(d->db_data.d_type, ver);
243 			fsz *= (d->db_data.d_size / j);
244 			d->db_osz = (size_t)fsz;
245 			if ((j = d->db_data.d_align) > 1) {
246 				if (j > sh->sh_addralign)
247 					sh->sh_addralign = (Xword)j;
248 
249 				if (sz % j != 0)
250 					sz += j - sz % j;
251 			}
252 			d->db_data.d_off = (off_t)sz;
253 			d->db_xoff = sz;
254 			sz += fsz;
255 		}
256 
257 		sh->sh_size = (Xword) sz;
258 		/*
259 		 * We want to take into account the offsets for NOBITS
260 		 * sections and let the "sh_offsets" point to where
261 		 * the section would 'conceptually' fit within
262 		 * the file (as required by the ABI).
263 		 *
264 		 * But - we must also make sure that the NOBITS does
265 		 * not take up any actual space in the file.  We preserve
266 		 * the actual offset into the file in the 'hibit' variable.
267 		 * When we come to the first non-NOBITS section after a
268 		 * encountering a NOBITS section the hi counter is restored
269 		 * to its proper place in the file.
270 		 */
271 		if (sh->sh_type == SHT_NOBITS) {
272 			if (hibit == 0)
273 				hibit = hi;
274 		} else {
275 			if (hibit) {
276 				hi = hibit;
277 				hibit = 0;
278 			}
279 		}
280 		j = sh->sh_addralign;
281 		if ((fsz = hi % j) != 0)
282 			hi += j - fsz;
283 
284 		/* LINTED */
285 		sh->sh_offset = (Off)hi;
286 		hi += sz;
287 	}
288 
289 	/*
290 	 * if last section was a 'NOBITS' section then we need to
291 	 * restore the 'hi' counter to point to the end of the last
292 	 * non 'NOBITS' section.
293 	 */
294 	if (hibit) {
295 		hi = hibit;
296 		hibit = 0;
297 	}
298 
299 	/*
300 	 * Shdr table last
301 	 */
302 	if (scncnt != 0) {
303 		if (hi % FSZ_LONG != 0)
304 			hi += FSZ_LONG - hi % FSZ_LONG;
305 		/* LINTED */
306 		eh->e_shoff = (Off)hi;
307 		/*
308 		 * If we are using 'extended sections' then the
309 		 * e_shnum is stored in the sh_size field of the
310 		 * first section header.
311 		 *
312 		 * NOTE: we set e_shnum to '0' because it's specified
313 		 * this way in the gABI, and in the hopes that
314 		 * this will cause less problems to unaware
315 		 * tools then if we'd set it to SHN_XINDEX (0xffff).
316 		 */
317 		if (scncnt < SHN_LORESERVE)
318 			eh->e_shnum = scncnt;
319 		else {
320 			Shdr	*sh;
321 			sh = (Shdr *)elf->ed_hdscn->s_shdr;
322 			sh->sh_size = scncnt;
323 			eh->e_shnum = 0;
324 		}
325 		/* LINTED */
326 		eh->e_shentsize = (Half)elf_fsize(ELF_T_SHDR, 1, ver);
327 		hi += eh->e_shentsize * scncnt;
328 	} else {
329 		eh->e_shoff = 0;
330 		eh->e_shentsize = 0;
331 	}
332 
333 #ifdef TEST_SIZE
334 	if (test_size(hi) == 0)
335 		return (0);
336 #endif
337 
338 	return ((size_t)hi);
339 }
340 
341 
342 
343 static size_t
344 _elf_upd_usr(Elf * elf)
345 {
346 	Lword		hi;
347 	Elf_Scn *	s;
348 	register Lword	sz;
349 	Ehdr *		eh = elf->ed_ehdr;
350 	unsigned	ver = eh->e_version;
351 	register char	*p = (char *)eh->e_ident;
352 	size_t		scncnt;
353 
354 	/*
355 	 * Ehdr and Phdr table go first
356 	 */
357 	p[EI_MAG0] = ELFMAG0;
358 	p[EI_MAG1] = ELFMAG1;
359 	p[EI_MAG2] = ELFMAG2;
360 	p[EI_MAG3] = ELFMAG3;
361 	p[EI_CLASS] = ELFCLASS;
362 	/* LINTED */
363 	p[EI_VERSION] = (Byte)ver;
364 	hi = elf_fsize(ELF_T_EHDR, 1, ver);
365 	/* LINTED */
366 	eh->e_ehsize = (Half)hi;
367 
368 	/*
369 	 * If phnum is zero, phoff "should" be zero too,
370 	 * but the application is responsible for it.
371 	 * Allow a non-zero value here and update the
372 	 * hi water mark accordingly.
373 	 */
374 
375 	if (eh->e_phnum != 0)
376 		/* LINTED */
377 		eh->e_phentsize = (Half)elf_fsize(ELF_T_PHDR, 1, ver);
378 	else
379 		eh->e_phentsize = 0;
380 	if ((sz = eh->e_phoff + eh->e_phentsize * eh->e_phnum) > hi)
381 		hi = sz;
382 
383 	/*
384 	 * Loop through sections, skipping index zero.
385 	 * Compute section size before changing hi.
386 	 * Allow null buffers for NOBITS.
387 	 */
388 
389 	if ((s = elf->ed_hdscn) == 0) {
390 		eh->e_shnum = 0;
391 		scncnt = 0;
392 	} else {
393 		scncnt = 1;
394 		s = s->s_next;
395 	}
396 	for (; s != 0; s = s->s_next) {
397 		register Dnode	*d;
398 		register Lword	fsz, j;
399 		Shdr *sh = s->s_shdr;
400 
401 		if ((s->s_myflags & SF_READY) == 0)
402 			(void) _elfxx_cookscn(s);
403 
404 		++scncnt;
405 		sz = 0;
406 		for (d = s->s_hdnode; d != 0; d = d->db_next) {
407 			if ((fsz = elf_fsize(d->db_data.d_type, 1,
408 			    ver)) == 0)
409 				return (0);
410 			j = _elf_msize(d->db_data.d_type, ver);
411 			fsz *= (d->db_data.d_size / j);
412 			d->db_osz = (size_t)fsz;
413 
414 			if ((sh->sh_type != SHT_NOBITS) &&
415 			    ((j = (d->db_data.d_off + d->db_osz)) > sz))
416 				sz = j;
417 		}
418 		if (sh->sh_size < sz) {
419 			_elf_seterr(EFMT_SCNSZ, 0);
420 			return (0);
421 		}
422 		if ((sh->sh_type != SHT_NOBITS) &&
423 		    (hi < sh->sh_offset + sh->sh_size))
424 			hi = sh->sh_offset + sh->sh_size;
425 	}
426 
427 	/*
428 	 * Shdr table last.  Comment above for phnum/phoff applies here.
429 	 */
430 	if (scncnt != 0) {
431 		/* LINTED */
432 		eh->e_shentsize = (Half)elf_fsize(ELF_T_SHDR, 1, ver);
433 		if (scncnt < SHN_LORESERVE) {
434 			eh->e_shnum = scncnt;
435 		} else {
436 			Shdr *sh;
437 			sh = (Shdr *)elf->ed_hdscn->s_shdr;
438 			sh->sh_size = scncnt;
439 			eh->e_shnum = 0;
440 		}
441 	} else {
442 		eh->e_shentsize = 0;
443 	}
444 
445 	if ((sz = eh->e_shoff + eh->e_shentsize * scncnt) > hi)
446 		hi = sz;
447 
448 #ifdef TEST_SIZE
449 	if (test_size(hi) == 0)
450 		return (0);
451 #endif
452 
453 	return ((size_t)hi);
454 }
455 
456 
457 static size_t
458 wrt(Elf * elf, Xword outsz, unsigned fill, int update_cmd)
459 {
460 	Elf_Data		dst, src;
461 	unsigned		flag;
462 	Xword			hi, sz;
463 	char			*image;
464 	Elf_Scn			*s;
465 	Ehdr			*eh = elf->ed_ehdr;
466 	unsigned		ver = eh->e_version;
467 	unsigned		encode;
468 	int			byte;
469 	_elf_execfill_func_t	*execfill_func;
470 
471 	/*
472 	 * If this is an ELF_C_WRIMAGE write, then we encode into the
473 	 * byte order of the system we are running on rather than that of
474 	 * of the object. For ld.so.1, this is the same order, but
475 	 * for 'ld', it might not be in the case where we are cross
476 	 * linking an object for a different target. In this later case,
477 	 * the linker-host byte order is necessary so that the linker can
478 	 * manipulate the resulting  image. It is expected that the linker
479 	 * will call elf_swap_wrimage() if necessary to convert the image
480 	 * to the target byte order.
481 	 */
482 	encode = (update_cmd == ELF_C_WRIMAGE) ? _elf_sys_encoding() :
483 	    eh->e_ident[EI_DATA];
484 
485 	/*
486 	 * Two issues can cause trouble for the output file.
487 	 * First, begin() with ELF_C_RDWR opens a file for both
488 	 * read and write.  On the write update(), the library
489 	 * has to read everything it needs before truncating
490 	 * the file.  Second, using mmap for both read and write
491 	 * is too tricky.  Consequently, the library disables mmap
492 	 * on the read side.  Using mmap for the output saves swap
493 	 * space, because that mapping is SHARED, not PRIVATE.
494 	 *
495 	 * If the file is write-only, there can be nothing of
496 	 * interest to bother with.
497 	 *
498 	 * The following reads the entire file, which might be
499 	 * more than necessary.  Better safe than sorry.
500 	 */
501 
502 	if ((elf->ed_myflags & EDF_READ) &&
503 	    (_elf_vm(elf, (size_t)0, elf->ed_fsz) != OK_YES))
504 		return (0);
505 
506 	flag = elf->ed_myflags & EDF_WRALLOC;
507 	if ((image = _elf_outmap(elf->ed_fd, outsz, &flag)) == 0)
508 		return (0);
509 
510 	if (flag == 0)
511 		elf->ed_myflags |= EDF_IMALLOC;
512 
513 	/*
514 	 * If an error occurs below, a "dirty" bit may be cleared
515 	 * improperly.  To save a second pass through the file,
516 	 * this code sets the dirty bit on the elf descriptor
517 	 * when an error happens, assuming that will "cover" any
518 	 * accidents.
519 	 */
520 
521 	/*
522 	 * Hi is needed only when 'fill' is non-zero.
523 	 * Fill is non-zero only when the library
524 	 * calculates file/section/data buffer offsets.
525 	 * The lib guarantees they increase monotonically.
526 	 * That guarantees proper filling below.
527 	 */
528 
529 
530 	/*
531 	 * Ehdr first
532 	 */
533 
534 	src.d_buf = (Elf_Void *)eh;
535 	src.d_type = ELF_T_EHDR;
536 	src.d_size = sizeof (Ehdr);
537 	src.d_version = EV_CURRENT;
538 	dst.d_buf = (Elf_Void *)image;
539 	dst.d_size = eh->e_ehsize;
540 	dst.d_version = ver;
541 	if (elf_xlatetof(&dst, &src, encode) == 0)
542 		return (0);
543 	elf->ed_ehflags &= ~ELF_F_DIRTY;
544 	hi = eh->e_ehsize;
545 
546 	/*
547 	 * Phdr table if one exists
548 	 */
549 
550 	if (eh->e_phnum != 0) {
551 		unsigned	work;
552 		/*
553 		 * Unlike other library data, phdr table is
554 		 * in the user version.  Change src buffer
555 		 * version here, fix it after translation.
556 		 */
557 
558 		src.d_buf = (Elf_Void *)elf->ed_phdr;
559 		src.d_type = ELF_T_PHDR;
560 		src.d_size = elf->ed_phdrsz;
561 		ELFACCESSDATA(work, _elf_work)
562 		src.d_version = work;
563 		dst.d_buf = (Elf_Void *)(image + eh->e_phoff);
564 		dst.d_size = eh->e_phnum * eh->e_phentsize;
565 		hi = (Xword)(eh->e_phoff + dst.d_size);
566 		if (elf_xlatetof(&dst, &src, encode) == 0) {
567 			elf->ed_uflags |= ELF_F_DIRTY;
568 			return (0);
569 		}
570 		elf->ed_phflags &= ~ELF_F_DIRTY;
571 		src.d_version = EV_CURRENT;
572 	}
573 
574 	/*
575 	 * Loop through sections
576 	 */
577 
578 	ELFACCESSDATA(byte, _elf_byte);
579 	ELFACCESSDATA(execfill_func, _elf_execfill_func);
580 	for (s = elf->ed_hdscn; s != 0; s = s->s_next) {
581 		register Dnode	*d, *prevd;
582 		Xword		off = 0;
583 		Shdr		*sh = s->s_shdr;
584 		char		*start = image + sh->sh_offset;
585 		char		*here;
586 		_elf_execfill_func_t	*execfill;
587 
588 		/* Only use the execfill function on SHF_EXECINSTR sections */
589 		execfill = (sh->sh_flags & SHF_EXECINSTR) ?
590 		    execfill_func : NULL;
591 
592 		/*
593 		 * Just "clean" DIRTY flag for "empty" sections.  Even if
594 		 * NOBITS needs padding, the next thing in the
595 		 * file will provide it.  (And if this NOBITS is
596 		 * the last thing in the file, no padding needed.)
597 		 */
598 		if ((sh->sh_type == SHT_NOBITS) ||
599 		    (sh->sh_type == SHT_NULL)) {
600 			d = s->s_hdnode, prevd = 0;
601 			for (; d != 0; prevd = d, d = d->db_next)
602 				d->db_uflags &= ~ELF_F_DIRTY;
603 			continue;
604 		}
605 		/*
606 		 * Clear out the memory between the end of the last
607 		 * section and the begining of this section.
608 		 */
609 		if (fill && (sh->sh_offset > hi)) {
610 			sz = sh->sh_offset - hi;
611 			(void) memset(start - sz, byte, sz);
612 		}
613 
614 
615 		for (d = s->s_hdnode, prevd = 0;
616 		    d != 0; prevd = d, d = d->db_next) {
617 			d->db_uflags &= ~ELF_F_DIRTY;
618 			here = start + d->db_data.d_off;
619 
620 			/*
621 			 * Clear out the memory between the end of the
622 			 * last update and the start of this data buffer.
623 			 *
624 			 * These buffers represent input sections that have
625 			 * been concatenated into an output section, so if
626 			 * the output section is executable (SHF_EXECINSTR)
627 			 * and a fill function has been registered, use the
628 			 * function. Otherwise, use the fill byte.
629 			 */
630 			if (fill && (d->db_data.d_off > off)) {
631 				sz = (Xword)(d->db_data.d_off - off);
632 				if (execfill != NULL)
633 					(* execfill)(start,
634 					    here - start - sz, sz);
635 				else
636 					(void) memset(here - sz, byte, sz);
637 			}
638 
639 			if ((d->db_myflags & DBF_READY) == 0) {
640 				SCNLOCK(s);
641 				if (_elf_locked_getdata(s, &prevd->db_data) !=
642 				    &d->db_data) {
643 					elf->ed_uflags |= ELF_F_DIRTY;
644 					SCNUNLOCK(s);
645 					return (0);
646 				}
647 				SCNUNLOCK(s);
648 			}
649 			dst.d_buf = (Elf_Void *)here;
650 			dst.d_size = d->db_osz;
651 
652 			/*
653 			 * Copy the translated bits out to the destination
654 			 * image.
655 			 */
656 			if (elf_xlatetof(&dst, &d->db_data, encode) == 0) {
657 				elf->ed_uflags |= ELF_F_DIRTY;
658 				return (0);
659 			}
660 
661 			off = (Xword)(d->db_data.d_off + dst.d_size);
662 		}
663 		hi = sh->sh_offset + sh->sh_size;
664 	}
665 
666 	/*
667 	 * Shdr table last
668 	 */
669 
670 	if (fill && (eh->e_shoff > hi)) {
671 		sz = eh->e_shoff - hi;
672 		(void) memset(image + hi, byte, sz);
673 	}
674 
675 	src.d_type = ELF_T_SHDR;
676 	src.d_size = sizeof (Shdr);
677 	dst.d_buf = (Elf_Void *)(image + eh->e_shoff);
678 	dst.d_size = eh->e_shentsize;
679 	for (s = elf->ed_hdscn; s != 0; s = s->s_next) {
680 		assert((uintptr_t)dst.d_buf < ((uintptr_t)image + outsz));
681 		s->s_shflags &= ~ELF_F_DIRTY;
682 		s->s_uflags &= ~ELF_F_DIRTY;
683 		src.d_buf = s->s_shdr;
684 
685 		if (elf_xlatetof(&dst, &src, encode) == 0) {
686 			elf->ed_uflags |= ELF_F_DIRTY;
687 			return (0);
688 		}
689 
690 		dst.d_buf = (char *)dst.d_buf + eh->e_shentsize;
691 	}
692 	/*
693 	 * ELF_C_WRIMAGE signifyes that we build the memory image, but
694 	 * that we do not actually write it to disk.  This is used
695 	 * by ld(1) to build up a full image of an elf file and then
696 	 * to process the file before it's actually written out to
697 	 * disk.  This saves ld(1) the overhead of having to write
698 	 * the image out to disk twice.
699 	 */
700 	if (update_cmd == ELF_C_WRIMAGE) {
701 		elf->ed_uflags &= ~ELF_F_DIRTY;
702 		elf->ed_wrimage = image;
703 		elf->ed_wrimagesz = outsz;
704 		return (outsz);
705 	}
706 
707 	if (_elf_outsync(elf->ed_fd, image, outsz,
708 	    ((elf->ed_myflags & EDF_IMALLOC) ? 0 : 1)) != 0) {
709 		elf->ed_uflags &= ~ELF_F_DIRTY;
710 		elf->ed_myflags &= ~EDF_IMALLOC;
711 		return (outsz);
712 	}
713 
714 	elf->ed_uflags |= ELF_F_DIRTY;
715 	return (0);
716 }
717 
718 
719 
720 
721 /*
722  * The following is a private interface between the linkers (ld & ld.so.1)
723  * and libelf:
724  *
725  * elf_update(elf, ELF_C_WRIMAGE)
726  *	This will cause full image representing the elf file
727  *	described by the elf pointer to be built in memory.  If the
728  *	elf pointer has a valid file descriptor associated with it
729  *	we will attempt to build the memory image from mmap()'ed
730  *	storage.  If the elf descriptor does not have a valid
731  *	file descriptor (opened with elf_begin(0, ELF_C_IMAGE, 0))
732  *	then the image will be allocated from dynamic memory (malloc()).
733  *
734  *	elf_update() will return the size of the memory image built
735  *	when sucessful.
736  *
737  *	When a subsequent call to elf_update() with ELF_C_WRITE as
738  *	the command is performed it will sync the image created
739  *	by ELF_C_WRIMAGE to disk (if fd available) and
740  *	free the memory allocated.
741  */
742 
743 off_t
744 _elfxx_update(Elf * elf, Elf_Cmd cmd)
745 {
746 	size_t		sz;
747 	unsigned	u;
748 	Ehdr		*eh = elf->ed_ehdr;
749 
750 	ELFWLOCK(elf)
751 	switch (cmd) {
752 	default:
753 		_elf_seterr(EREQ_UPDATE, 0);
754 		ELFUNLOCK(elf)
755 		return (-1);
756 
757 	case ELF_C_WRIMAGE:
758 		if ((elf->ed_myflags & EDF_WRITE) == 0) {
759 			_elf_seterr(EREQ_UPDWRT, 0);
760 			ELFUNLOCK(elf)
761 			return (-1);
762 		}
763 		break;
764 	case ELF_C_WRITE:
765 		if ((elf->ed_myflags & EDF_WRITE) == 0) {
766 			_elf_seterr(EREQ_UPDWRT, 0);
767 			ELFUNLOCK(elf)
768 			return (-1);
769 		}
770 		if (elf->ed_wrimage) {
771 			if (elf->ed_myflags & EDF_WRALLOC) {
772 				free(elf->ed_wrimage);
773 				/*
774 				 * The size is still returned even
775 				 * though nothing is actually written
776 				 * out.  This is just to be consistant
777 				 * with the rest of the interface.
778 				 */
779 				sz = elf->ed_wrimagesz;
780 				elf->ed_wrimage = 0;
781 				elf->ed_wrimagesz = 0;
782 				ELFUNLOCK(elf);
783 				return ((off_t)sz);
784 			}
785 			sz = _elf_outsync(elf->ed_fd, elf->ed_wrimage,
786 			    elf->ed_wrimagesz,
787 			    (elf->ed_myflags & EDF_IMALLOC ? 0 : 1));
788 			elf->ed_myflags &= ~EDF_IMALLOC;
789 			elf->ed_wrimage = 0;
790 			elf->ed_wrimagesz = 0;
791 			ELFUNLOCK(elf);
792 			return ((off_t)sz);
793 		}
794 		/* FALLTHROUGH */
795 	case ELF_C_NULL:
796 		break;
797 	}
798 
799 	if (eh == 0) {
800 		_elf_seterr(ESEQ_EHDR, 0);
801 		ELFUNLOCK(elf)
802 		return (-1);
803 	}
804 
805 	if ((u = eh->e_version) > EV_CURRENT) {
806 		_elf_seterr(EREQ_VER, 0);
807 		ELFUNLOCK(elf)
808 		return (-1);
809 	}
810 
811 	if (u == EV_NONE)
812 		eh->e_version = EV_CURRENT;
813 
814 	if ((u = eh->e_ident[EI_DATA]) == ELFDATANONE) {
815 		unsigned	encode;
816 
817 		ELFACCESSDATA(encode, _elf_encode)
818 		if (encode == ELFDATANONE) {
819 			_elf_seterr(EREQ_ENCODE, 0);
820 			ELFUNLOCK(elf)
821 			return (-1);
822 		}
823 		/* LINTED */
824 		eh->e_ident[EI_DATA] = (Byte)encode;
825 	}
826 
827 	u = 1;
828 	if (elf->ed_uflags & ELF_F_LAYOUT) {
829 		sz = _elf_upd_usr(elf);
830 		u = 0;
831 	} else
832 		sz = _elf_upd_lib(elf);
833 
834 	if ((sz != 0) && ((cmd == ELF_C_WRITE) || (cmd == ELF_C_WRIMAGE)))
835 		sz = wrt(elf, (Xword)sz, u, cmd);
836 
837 	if (sz == 0) {
838 		ELFUNLOCK(elf)
839 		return (-1);
840 	}
841 
842 	ELFUNLOCK(elf)
843 	return ((off_t)sz);
844 }
845 
846 
847 /*
848  * When wrt() processes an ELF_C_WRIMAGE request, the resulting image
849  * gets the byte order (encoding) of the platform running the linker
850  * rather than that of the target host. This allows the linker to modify
851  * the image, prior to flushing it to the output file. This routine
852  * is used to re-translate such an image into the byte order of the
853  * target host.
854  */
855 int
856 _elfxx_swap_wrimage(Elf *elf)
857 {
858 	Elf_Data	dst, src;
859 	Elf_Scn		*s;
860 	Ehdr		*eh;
861 	Half		e_phnum;
862 	unsigned	ver;
863 	unsigned	encode;
864 
865 	/*
866 	 * Ehdr first
867 	 */
868 
869 	ELFWLOCK(elf);
870 	eh = elf->ed_ehdr;
871 	e_phnum = eh->e_phnum;
872 	ver = eh->e_version;
873 	encode = eh->e_ident[EI_DATA];
874 
875 	src.d_buf = dst.d_buf = (Elf_Void *)eh;
876 	src.d_type = dst.d_type = ELF_T_EHDR;
877 	src.d_size = dst.d_size = sizeof (Ehdr);
878 	src.d_version = dst.d_version = ver;
879 	if (elf_xlatetof(&dst, &src, encode) == 0) {
880 		ELFUNLOCK(elf);
881 		return (1);
882 	}
883 
884 	/*
885 	 * Phdr table if one exists
886 	 */
887 
888 	if (e_phnum != 0) {
889 		unsigned	work;
890 		/*
891 		 * Unlike other library data, phdr table is
892 		 * in the user version.
893 		 */
894 
895 		src.d_buf = dst.d_buf = (Elf_Void *)elf->ed_phdr;
896 		src.d_type = dst.d_type = ELF_T_PHDR;
897 		src.d_size = dst.d_size = elf->ed_phdrsz;
898 		ELFACCESSDATA(work, _elf_work)
899 		src.d_version = dst.d_version = work;
900 		if (elf_xlatetof(&dst, &src, encode) == 0) {
901 			ELFUNLOCK(elf);
902 			return (1);
903 		}
904 	}
905 
906 	/*
907 	 * Loop through sections
908 	 */
909 
910 	for (s = elf->ed_hdscn; s != 0; s = s->s_next) {
911 		register Dnode	*d, *prevd;
912 		Shdr		*sh = s->s_shdr;
913 
914 		if ((sh->sh_type == SHT_NOBITS) || (sh->sh_type == SHT_NULL))
915 			continue;
916 
917 		for (d = s->s_hdnode, prevd = 0;
918 		    d != 0; prevd = d, d = d->db_next) {
919 
920 			if ((d->db_myflags & DBF_READY) == 0) {
921 				SCNLOCK(s);
922 				if (_elf_locked_getdata(s, &prevd->db_data) !=
923 				    &d->db_data) {
924 					SCNUNLOCK(s);
925 					ELFUNLOCK(elf);
926 					return (1);
927 				}
928 				SCNUNLOCK(s);
929 			}
930 
931 			dst = d->db_data;
932 			if (elf_xlatetof(&dst, &d->db_data, encode) == 0) {
933 				ELFUNLOCK(elf);
934 				return (1);
935 			}
936 		}
937 	}
938 
939 	/*
940 	 * Shdr table
941 	 */
942 
943 	src.d_type = dst.d_type = ELF_T_SHDR;
944 	src.d_version = dst.d_version = ver;
945 	for (s = elf->ed_hdscn; s != 0; s = s->s_next) {
946 		src.d_buf = dst.d_buf = s->s_shdr;
947 		src.d_size = dst.d_size = sizeof (Shdr);
948 		if (elf_xlatetof(&dst, &src, encode) == 0) {
949 			ELFUNLOCK(elf);
950 			return (1);
951 		}
952 	}
953 
954 	ELFUNLOCK(elf);
955 	return (0);
956 }
957 
958 
959 
960 #ifndef _ELF64
961 /* class-independent, only needs to be compiled once */
962 
963 off_t
964 elf_update(Elf *elf, Elf_Cmd cmd)
965 {
966 	if (elf == 0)
967 		return (-1);
968 
969 	if (elf->ed_class == ELFCLASS32)
970 		return (_elf32_update(elf, cmd));
971 	else if (elf->ed_class == ELFCLASS64) {
972 		return (_elf64_update(elf, cmd));
973 	}
974 
975 	_elf_seterr(EREQ_CLASS, 0);
976 	return (-1);
977 }
978 
979 int
980 _elf_swap_wrimage(Elf *elf)
981 {
982 	if (elf == 0)
983 		return (0);
984 
985 	if (elf->ed_class == ELFCLASS32)
986 		return (_elf32_swap_wrimage(elf));
987 
988 	if (elf->ed_class == ELFCLASS64)
989 		return (_elf64_swap_wrimage(elf));
990 
991 	_elf_seterr(EREQ_CLASS, 0);
992 	return (0);
993 }
994 
995 /*
996  * 4106312, 4106398, This is an ad-hoc means for the 32-bit
997  * Elf64 version of libld.so.3 to get around the limitation
998  * of a 32-bit d_off field.  This is only intended to be
999  * used by libld to relocate symbols in large NOBITS sections.
1000  */
1001 Elf64_Off
1002 _elf_getxoff(Elf_Data * d)
1003 {
1004 	return (((Dnode *)d)->db_xoff);
1005 }
1006 #endif /* !_ELF64 */
1007