xref: /titanic_44/usr/src/cmd/sgs/libelf/common/update.c (revision a05fd0c9b9aa46cf66ddea7617e56facdf1f4aaf)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  *	Copyright (c) 1988 AT&T
29  *	  All Rights Reserved
30  */
31 
32 #include <memory.h>
33 #include <malloc.h>
34 #include <limits.h>
35 
36 #include <sgs.h>
37 #include "decl.h"
38 #include "msg.h"
39 
40 /*
41  * This module is compiled twice, the second time having
42  * -D_ELF64 defined.  The following set of macros, along
43  * with machelf.h, represent the differences between the
44  * two compilations.  Be careful *not* to add any class-
45  * dependent code (anything that has elf32 or elf64 in the
46  * name) to this code without hiding it behind a switch-
47  * able macro like these.
48  */
49 #if	defined(_ELF64)
50 
51 #define	FSZ_LONG	ELF64_FSZ_XWORD
52 #define	ELFCLASS	ELFCLASS64
53 #define	_elf_snode_init	_elf64_snode_init
54 #define	_elfxx_cookscn	_elf64_cookscn
55 #define	_elf_upd_lib	_elf64_upd_lib
56 #define	elf_fsize	elf64_fsize
57 #define	_elf_entsz	_elf64_entsz
58 #define	_elf_msize	_elf64_msize
59 #define	_elf_upd_usr	_elf64_upd_usr
60 #define	wrt		wrt64
61 #define	elf_xlatetof	elf64_xlatetof
62 #define	_elfxx_update	_elf64_update
63 #define	_elfxx_swap_wrimage	_elf64_swap_wrimage
64 
65 #else	/* ELF32 */
66 
67 #define	FSZ_LONG	ELF32_FSZ_WORD
68 #define	ELFCLASS	ELFCLASS32
69 #define	_elf_snode_init	_elf32_snode_init
70 #define	_elfxx_cookscn	_elf32_cookscn
71 #define	_elf_upd_lib	_elf32_upd_lib
72 #define	elf_fsize	elf32_fsize
73 #define	_elf_entsz	_elf32_entsz
74 #define	_elf_msize	_elf32_msize
75 #define	_elf_upd_usr	_elf32_upd_usr
76 #define	wrt		wrt32
77 #define	elf_xlatetof	elf32_xlatetof
78 #define	_elfxx_update	_elf32_update
79 #define	_elfxx_swap_wrimage	_elf32_swap_wrimage
80 
81 #endif /* ELF64 */
82 
83 
84 #if	!(defined(_LP64) && defined(_ELF64))
85 #define	TEST_SIZE
86 
87 /*
88  * Handle the decision of whether the current linker can handle the
89  * desired object size, and if not, which error to issue.
90  *
91  * Input is the desired size. On failure, an error has been issued
92  * and 0 is returned. On success, 1 is returned.
93  */
94 static int
95 test_size(Lword hi)
96 {
97 #ifndef _LP64			/* 32-bit linker */
98 	/*
99 	 * A 32-bit libelf is limited to a 2GB output file. This limit
100 	 * is due to the fact that off_t is a signed value, and that
101 	 * libelf cannot support large file support:
102 	 *	- ABI reasons
103 	 *	- Memory use generally is 2x output file size anyway,
104 	 *		so lifting the file size limit will just send
105 	 *		you crashing into the 32-bit VM limit.
106 	 * If the output is an ELFCLASS64 object, or an ELFCLASS32 object
107 	 * under 4GB, switching to the 64-bit version of libelf will help.
108 	 * However, an ELFCLASS32 object must not exceed 4GB.
109 	 */
110 	if (hi > INT_MAX) {	/* Bigger than 2GB */
111 #ifndef _ELF64
112 		/* ELFCLASS32 object is fundamentally too big? */
113 		if (hi > UINT_MAX) {
114 			_elf_seterr(EFMT_FBIG_CLASS32, 0);
115 			return (0);
116 		}
117 #endif				/* _ELF64 */
118 
119 		/* Should switch to the 64-bit libelf? */
120 		_elf_seterr(EFMT_FBIG_LARGEFILE, 0);
121 		return (0);
122 	}
123 #endif				/* !_LP64 */
124 
125 
126 #if	defined(_LP64) && !defined(_ELF64)   /* 64-bit linker, ELFCLASS32 */
127 	/*
128 	 * A 64-bit linker can produce any size output
129 	 * file, but if the resulting file is ELFCLASS32,
130 	 * it must not exceed 4GB.
131 	 */
132 	if (hi > UINT_MAX) {
133 		_elf_seterr(EFMT_FBIG_CLASS32, 0);
134 		return (0);
135 	}
136 #endif
137 
138 	return (1);
139 }
140 #endif				/* TEST_SIZE */
141 
142 /*
143  * Output file update
144  *	These functions walk an Elf structure, update its information,
145  *	and optionally write the output file.  Because the application
146  *	may control of the output file layout, two upd_... routines
147  *	exist.  They're similar but too different to merge cleanly.
148  *
149  *	The library defines a "dirty" bit to force parts of the file
150  *	to be written on update.  These routines ignore the dirty bit
151  *	and do everything.  A minimal update routine might be useful
152  *	someday.
153  */
154 
155 static size_t
156 _elf_upd_lib(Elf * elf)
157 {
158 	NOTE(ASSUMING_PROTECTED(*elf))
159 	Lword		hi;
160 	Lword		hibit;
161 	Elf_Scn *	s;
162 	register Lword	sz;
163 	Ehdr *		eh = elf->ed_ehdr;
164 	unsigned	ver = eh->e_version;
165 	register char	*p = (char *)eh->e_ident;
166 	size_t		scncnt;
167 
168 	/*
169 	 * Ehdr and Phdr table go first
170 	 */
171 	p[EI_MAG0] = ELFMAG0;
172 	p[EI_MAG1] = ELFMAG1;
173 	p[EI_MAG2] = ELFMAG2;
174 	p[EI_MAG3] = ELFMAG3;
175 	p[EI_CLASS] = ELFCLASS;
176 	/* LINTED */
177 	p[EI_VERSION] = (Byte)ver;
178 	hi = elf_fsize(ELF_T_EHDR, 1, ver);
179 	/* LINTED */
180 	eh->e_ehsize = (Half)hi;
181 	if (eh->e_phnum != 0) {
182 		/* LINTED */
183 		eh->e_phentsize = (Half)elf_fsize(ELF_T_PHDR, 1, ver);
184 		/* LINTED */
185 		eh->e_phoff = (Off)hi;
186 		hi += eh->e_phentsize * eh->e_phnum;
187 	} else {
188 		eh->e_phoff = 0;
189 		eh->e_phentsize = 0;
190 	}
191 
192 	/*
193 	 * Obtain the first section header.  Typically, this section has NULL
194 	 * contents, however in the case of Extended ELF Sections this section
195 	 * is used to hold an alternative e_shnum, e_shstrndx and e_phnum.
196 	 * On initial allocation (see _elf_snode) the elements of this section
197 	 * would have been zeroed.  The e_shnum is initialized later, after the
198 	 * section header count has been determined.  The e_shstrndx and
199 	 * e_phnum may have already been initialized by the caller (for example,
200 	 * gelf_update_shdr() in mcs(1)).
201 	 */
202 	if ((s = elf->ed_hdscn) == 0) {
203 		eh->e_shnum = 0;
204 		scncnt = 0;
205 	} else {
206 		s = s->s_next;
207 		scncnt = 1;
208 	}
209 
210 	/*
211 	 * Loop through sections.  Compute section size before changing hi.
212 	 * Allow null buffers for NOBITS.
213 	 */
214 	hibit = 0;
215 	for (; s != 0; s = s->s_next) {
216 		register Dnode	*d;
217 		register Lword	fsz, j;
218 		Shdr *sh = s->s_shdr;
219 
220 		scncnt++;
221 		if (sh->sh_type == SHT_NULL) {
222 			*sh = _elf_snode_init.sb_shdr;
223 			continue;
224 		}
225 
226 		if ((s->s_myflags & SF_READY) == 0)
227 			(void) _elfxx_cookscn(s);
228 
229 		sh->sh_addralign = 1;
230 		if ((sz = (Lword)_elf_entsz(elf, sh->sh_type, ver)) != 0)
231 			/* LINTED */
232 			sh->sh_entsize = (Half)sz;
233 		sz = 0;
234 		for (d = s->s_hdnode; d != 0; d = d->db_next) {
235 			if ((fsz = elf_fsize(d->db_data.d_type,
236 			    1, ver)) == 0)
237 				return (0);
238 
239 			j = _elf_msize(d->db_data.d_type, ver);
240 			fsz *= (d->db_data.d_size / j);
241 			d->db_osz = (size_t)fsz;
242 			if ((j = d->db_data.d_align) > 1) {
243 				if (j > sh->sh_addralign)
244 					sh->sh_addralign = (Xword)j;
245 
246 				if (sz % j != 0)
247 					sz += j - sz % j;
248 			}
249 			d->db_data.d_off = (off_t)sz;
250 			d->db_xoff = sz;
251 			sz += fsz;
252 		}
253 
254 		sh->sh_size = (Xword) sz;
255 		/*
256 		 * We want to take into account the offsets for NOBITS
257 		 * sections and let the "sh_offsets" point to where
258 		 * the section would 'conceptually' fit within
259 		 * the file (as required by the ABI).
260 		 *
261 		 * But - we must also make sure that the NOBITS does
262 		 * not take up any actual space in the file.  We preserve
263 		 * the actual offset into the file in the 'hibit' variable.
264 		 * When we come to the first non-NOBITS section after a
265 		 * encountering a NOBITS section the hi counter is restored
266 		 * to its proper place in the file.
267 		 */
268 		if (sh->sh_type == SHT_NOBITS) {
269 			if (hibit == 0)
270 				hibit = hi;
271 		} else {
272 			if (hibit) {
273 				hi = hibit;
274 				hibit = 0;
275 			}
276 		}
277 		j = sh->sh_addralign;
278 		if ((fsz = hi % j) != 0)
279 			hi += j - fsz;
280 
281 		/* LINTED */
282 		sh->sh_offset = (Off)hi;
283 		hi += sz;
284 	}
285 
286 	/*
287 	 * if last section was a 'NOBITS' section then we need to
288 	 * restore the 'hi' counter to point to the end of the last
289 	 * non 'NOBITS' section.
290 	 */
291 	if (hibit) {
292 		hi = hibit;
293 		hibit = 0;
294 	}
295 
296 	/*
297 	 * Shdr table last
298 	 */
299 	if (scncnt != 0) {
300 		if (hi % FSZ_LONG != 0)
301 			hi += FSZ_LONG - hi % FSZ_LONG;
302 		/* LINTED */
303 		eh->e_shoff = (Off)hi;
304 		/*
305 		 * If we are using 'extended sections' then the
306 		 * e_shnum is stored in the sh_size field of the
307 		 * first section header.
308 		 *
309 		 * NOTE: we set e_shnum to '0' because it's specified
310 		 * this way in the gABI, and in the hopes that
311 		 * this will cause less problems to unaware
312 		 * tools then if we'd set it to SHN_XINDEX (0xffff).
313 		 */
314 		if (scncnt < SHN_LORESERVE)
315 			eh->e_shnum = scncnt;
316 		else {
317 			Shdr	*sh;
318 			sh = (Shdr *)elf->ed_hdscn->s_shdr;
319 			sh->sh_size = scncnt;
320 			eh->e_shnum = 0;
321 		}
322 		/* LINTED */
323 		eh->e_shentsize = (Half)elf_fsize(ELF_T_SHDR, 1, ver);
324 		hi += eh->e_shentsize * scncnt;
325 	} else {
326 		eh->e_shoff = 0;
327 		eh->e_shentsize = 0;
328 	}
329 
330 #ifdef TEST_SIZE
331 	if (test_size(hi) == 0)
332 		return (0);
333 #endif
334 
335 	return ((size_t)hi);
336 }
337 
338 
339 
340 static size_t
341 _elf_upd_usr(Elf * elf)
342 {
343 	NOTE(ASSUMING_PROTECTED(*elf))
344 	Lword		hi;
345 	Elf_Scn *	s;
346 	register Lword	sz;
347 	Ehdr *		eh = elf->ed_ehdr;
348 	unsigned	ver = eh->e_version;
349 	register char	*p = (char *)eh->e_ident;
350 	size_t		scncnt;
351 
352 	/*
353 	 * Ehdr and Phdr table go first
354 	 */
355 	p[EI_MAG0] = ELFMAG0;
356 	p[EI_MAG1] = ELFMAG1;
357 	p[EI_MAG2] = ELFMAG2;
358 	p[EI_MAG3] = ELFMAG3;
359 	p[EI_CLASS] = ELFCLASS;
360 	/* LINTED */
361 	p[EI_VERSION] = (Byte)ver;
362 	hi = elf_fsize(ELF_T_EHDR, 1, ver);
363 	/* LINTED */
364 	eh->e_ehsize = (Half)hi;
365 
366 	/*
367 	 * If phnum is zero, phoff "should" be zero too,
368 	 * but the application is responsible for it.
369 	 * Allow a non-zero value here and update the
370 	 * hi water mark accordingly.
371 	 */
372 
373 	if (eh->e_phnum != 0)
374 		/* LINTED */
375 		eh->e_phentsize = (Half)elf_fsize(ELF_T_PHDR, 1, ver);
376 	else
377 		eh->e_phentsize = 0;
378 	if ((sz = eh->e_phoff + eh->e_phentsize * eh->e_phnum) > hi)
379 		hi = sz;
380 
381 	/*
382 	 * Loop through sections, skipping index zero.
383 	 * Compute section size before changing hi.
384 	 * Allow null buffers for NOBITS.
385 	 */
386 
387 	if ((s = elf->ed_hdscn) == 0) {
388 		eh->e_shnum = 0;
389 		scncnt = 0;
390 	} else {
391 		scncnt = 1;
392 		s = s->s_next;
393 	}
394 	for (; s != 0; s = s->s_next) {
395 		register Dnode	*d;
396 		register Lword	fsz, j;
397 		Shdr *sh = s->s_shdr;
398 
399 		if ((s->s_myflags & SF_READY) == 0)
400 			(void) _elfxx_cookscn(s);
401 
402 		++scncnt;
403 		sz = 0;
404 		for (d = s->s_hdnode; d != 0; d = d->db_next) {
405 			if ((fsz = elf_fsize(d->db_data.d_type, 1,
406 			    ver)) == 0)
407 				return (0);
408 			j = _elf_msize(d->db_data.d_type, ver);
409 			fsz *= (d->db_data.d_size / j);
410 			d->db_osz = (size_t)fsz;
411 
412 			if ((sh->sh_type != SHT_NOBITS) &&
413 			    ((j = (d->db_data.d_off + d->db_osz)) > sz))
414 				sz = j;
415 		}
416 		if (sh->sh_size < sz) {
417 			_elf_seterr(EFMT_SCNSZ, 0);
418 			return (0);
419 		}
420 		if ((sh->sh_type != SHT_NOBITS) &&
421 		    (hi < sh->sh_offset + sh->sh_size))
422 			hi = sh->sh_offset + sh->sh_size;
423 	}
424 
425 	/*
426 	 * Shdr table last.  Comment above for phnum/phoff applies here.
427 	 */
428 	if (scncnt != 0) {
429 		/* LINTED */
430 		eh->e_shentsize = (Half)elf_fsize(ELF_T_SHDR, 1, ver);
431 		if (scncnt < SHN_LORESERVE) {
432 			eh->e_shnum = scncnt;
433 		} else {
434 			Shdr *sh;
435 			sh = (Shdr *)elf->ed_hdscn->s_shdr;
436 			sh->sh_size = scncnt;
437 			eh->e_shnum = 0;
438 		}
439 	} else {
440 		eh->e_shentsize = 0;
441 	}
442 
443 	if ((sz = eh->e_shoff + eh->e_shentsize * scncnt) > hi)
444 		hi = sz;
445 
446 #ifdef TEST_SIZE
447 	if (test_size(hi) == 0)
448 		return (0);
449 #endif
450 
451 	return ((size_t)hi);
452 }
453 
454 
455 static size_t
456 wrt(Elf * elf, Xword outsz, unsigned fill, int update_cmd)
457 {
458 	NOTE(ASSUMING_PROTECTED(*elf))
459 	Elf_Data		dst, src;
460 	unsigned		flag;
461 	Xword			hi, sz;
462 	char			*image;
463 	Elf_Scn			*s;
464 	Ehdr			*eh = elf->ed_ehdr;
465 	unsigned		ver = eh->e_version;
466 	unsigned		encode;
467 	int			byte;
468 	_elf_execfill_func_t	*execfill_func;
469 
470 	/*
471 	 * If this is an ELF_C_WRIMAGE write, then we encode into the
472 	 * byte order of the system we are running on rather than that of
473 	 * of the object. For ld.so.1, this is the same order, but
474 	 * for 'ld', it might not be in the case where we are cross
475 	 * linking an object for a different target. In this later case,
476 	 * the linker-host byte order is necessary so that the linker can
477 	 * manipulate the resulting  image. It is expected that the linker
478 	 * will call elf_swap_wrimage() if necessary to convert the image
479 	 * to the target byte order.
480 	 */
481 	encode = (update_cmd == ELF_C_WRIMAGE) ? _elf_sys_encoding() :
482 	    eh->e_ident[EI_DATA];
483 
484 	/*
485 	 * Two issues can cause trouble for the output file.
486 	 * First, begin() with ELF_C_RDWR opens a file for both
487 	 * read and write.  On the write update(), the library
488 	 * has to read everything it needs before truncating
489 	 * the file.  Second, using mmap for both read and write
490 	 * is too tricky.  Consequently, the library disables mmap
491 	 * on the read side.  Using mmap for the output saves swap
492 	 * space, because that mapping is SHARED, not PRIVATE.
493 	 *
494 	 * If the file is write-only, there can be nothing of
495 	 * interest to bother with.
496 	 *
497 	 * The following reads the entire file, which might be
498 	 * more than necessary.  Better safe than sorry.
499 	 */
500 
501 	if ((elf->ed_myflags & EDF_READ) &&
502 	    (_elf_vm(elf, (size_t)0, elf->ed_fsz) != OK_YES))
503 		return (0);
504 
505 	flag = elf->ed_myflags & EDF_WRALLOC;
506 	if ((image = _elf_outmap(elf->ed_fd, outsz, &flag)) == 0)
507 		return (0);
508 
509 	if (flag == 0)
510 		elf->ed_myflags |= EDF_IMALLOC;
511 
512 	/*
513 	 * If an error occurs below, a "dirty" bit may be cleared
514 	 * improperly.  To save a second pass through the file,
515 	 * this code sets the dirty bit on the elf descriptor
516 	 * when an error happens, assuming that will "cover" any
517 	 * accidents.
518 	 */
519 
520 	/*
521 	 * Hi is needed only when 'fill' is non-zero.
522 	 * Fill is non-zero only when the library
523 	 * calculates file/section/data buffer offsets.
524 	 * The lib guarantees they increase monotonically.
525 	 * That guarantees proper filling below.
526 	 */
527 
528 
529 	/*
530 	 * Ehdr first
531 	 */
532 
533 	src.d_buf = (Elf_Void *)eh;
534 	src.d_type = ELF_T_EHDR;
535 	src.d_size = sizeof (Ehdr);
536 	src.d_version = EV_CURRENT;
537 	dst.d_buf = (Elf_Void *)image;
538 	dst.d_size = eh->e_ehsize;
539 	dst.d_version = ver;
540 	if (elf_xlatetof(&dst, &src, encode) == 0)
541 		return (0);
542 	elf->ed_ehflags &= ~ELF_F_DIRTY;
543 	hi = eh->e_ehsize;
544 
545 	/*
546 	 * Phdr table if one exists
547 	 */
548 
549 	if (eh->e_phnum != 0) {
550 		unsigned	work;
551 		/*
552 		 * Unlike other library data, phdr table is
553 		 * in the user version.  Change src buffer
554 		 * version here, fix it after translation.
555 		 */
556 
557 		src.d_buf = (Elf_Void *)elf->ed_phdr;
558 		src.d_type = ELF_T_PHDR;
559 		src.d_size = elf->ed_phdrsz;
560 		ELFACCESSDATA(work, _elf_work)
561 		src.d_version = work;
562 		dst.d_buf = (Elf_Void *)(image + eh->e_phoff);
563 		dst.d_size = eh->e_phnum * eh->e_phentsize;
564 		hi = (Xword)(eh->e_phoff + dst.d_size);
565 		if (elf_xlatetof(&dst, &src, encode) == 0) {
566 			elf->ed_uflags |= ELF_F_DIRTY;
567 			return (0);
568 		}
569 		elf->ed_phflags &= ~ELF_F_DIRTY;
570 		src.d_version = EV_CURRENT;
571 	}
572 
573 	/*
574 	 * Loop through sections
575 	 */
576 
577 	ELFACCESSDATA(byte, _elf_byte);
578 	ELFACCESSDATA(execfill_func, _elf_execfill_func);
579 	for (s = elf->ed_hdscn; s != 0; s = s->s_next) {
580 		register Dnode	*d, *prevd;
581 		Xword		off = 0;
582 		Shdr		*sh = s->s_shdr;
583 		char		*start = image + sh->sh_offset;
584 		char		*here;
585 		_elf_execfill_func_t	*execfill;
586 
587 		/* Only use the execfill function on SHF_EXECINSTR sections */
588 		execfill = (sh->sh_flags & SHF_EXECINSTR) ?
589 		    execfill_func : NULL;
590 
591 		/*
592 		 * Just "clean" DIRTY flag for "empty" sections.  Even if
593 		 * NOBITS needs padding, the next thing in the
594 		 * file will provide it.  (And if this NOBITS is
595 		 * the last thing in the file, no padding needed.)
596 		 */
597 		if ((sh->sh_type == SHT_NOBITS) ||
598 		    (sh->sh_type == SHT_NULL)) {
599 			d = s->s_hdnode, prevd = 0;
600 			for (; d != 0; prevd = d, d = d->db_next)
601 				d->db_uflags &= ~ELF_F_DIRTY;
602 			continue;
603 		}
604 		/*
605 		 * Clear out the memory between the end of the last
606 		 * section and the begining of this section.
607 		 */
608 		if (fill && (sh->sh_offset > hi)) {
609 			sz = sh->sh_offset - hi;
610 			(void) memset(start - sz, byte, sz);
611 		}
612 
613 
614 		for (d = s->s_hdnode, prevd = 0;
615 		    d != 0; prevd = d, d = d->db_next) {
616 			d->db_uflags &= ~ELF_F_DIRTY;
617 			here = start + d->db_data.d_off;
618 
619 			/*
620 			 * Clear out the memory between the end of the
621 			 * last update and the start of this data buffer.
622 			 *
623 			 * These buffers represent input sections that have
624 			 * been concatenated into an output section, so if
625 			 * the output section is executable (SHF_EXECINSTR)
626 			 * and a fill function has been registered, use the
627 			 * function. Otherwise, use the fill byte.
628 			 */
629 			if (fill && (d->db_data.d_off > off)) {
630 				sz = (Xword)(d->db_data.d_off - off);
631 				if (execfill != NULL)
632 					(* execfill)(start,
633 					    here - start - sz, sz);
634 				else
635 					(void) memset(here - sz, byte, sz);
636 			}
637 
638 			if ((d->db_myflags & DBF_READY) == 0) {
639 				SCNLOCK(s);
640 				if (_elf_locked_getdata(s, &prevd->db_data) !=
641 				    &d->db_data) {
642 					elf->ed_uflags |= ELF_F_DIRTY;
643 					SCNUNLOCK(s);
644 					return (0);
645 				}
646 				SCNUNLOCK(s);
647 			}
648 			dst.d_buf = (Elf_Void *)here;
649 			dst.d_size = d->db_osz;
650 
651 			/*
652 			 * Copy the translated bits out to the destination
653 			 * image.
654 			 */
655 			if (elf_xlatetof(&dst, &d->db_data, encode) == 0) {
656 				elf->ed_uflags |= ELF_F_DIRTY;
657 				return (0);
658 			}
659 
660 			off = (Xword)(d->db_data.d_off + dst.d_size);
661 		}
662 		hi = sh->sh_offset + sh->sh_size;
663 	}
664 
665 	/*
666 	 * Shdr table last
667 	 */
668 
669 	if (fill && (eh->e_shoff > hi)) {
670 		sz = eh->e_shoff - hi;
671 		(void) memset(image + hi, byte, sz);
672 	}
673 
674 	src.d_type = ELF_T_SHDR;
675 	src.d_size = sizeof (Shdr);
676 	dst.d_buf = (Elf_Void *)(image + eh->e_shoff);
677 	dst.d_size = eh->e_shentsize;
678 	for (s = elf->ed_hdscn; s != 0; s = s->s_next) {
679 		assert((uintptr_t)dst.d_buf < ((uintptr_t)image + outsz));
680 		s->s_shflags &= ~ELF_F_DIRTY;
681 		s->s_uflags &= ~ELF_F_DIRTY;
682 		src.d_buf = s->s_shdr;
683 
684 		if (elf_xlatetof(&dst, &src, encode) == 0) {
685 			elf->ed_uflags |= ELF_F_DIRTY;
686 			return (0);
687 		}
688 
689 		dst.d_buf = (char *)dst.d_buf + eh->e_shentsize;
690 	}
691 	/*
692 	 * ELF_C_WRIMAGE signifyes that we build the memory image, but
693 	 * that we do not actually write it to disk.  This is used
694 	 * by ld(1) to build up a full image of an elf file and then
695 	 * to process the file before it's actually written out to
696 	 * disk.  This saves ld(1) the overhead of having to write
697 	 * the image out to disk twice.
698 	 */
699 	if (update_cmd == ELF_C_WRIMAGE) {
700 		elf->ed_uflags &= ~ELF_F_DIRTY;
701 		elf->ed_wrimage = image;
702 		elf->ed_wrimagesz = outsz;
703 		return (outsz);
704 	}
705 
706 	if (_elf_outsync(elf->ed_fd, image, outsz,
707 	    ((elf->ed_myflags & EDF_IMALLOC) ? 0 : 1)) != 0) {
708 		elf->ed_uflags &= ~ELF_F_DIRTY;
709 		elf->ed_myflags &= ~EDF_IMALLOC;
710 		return (outsz);
711 	}
712 
713 	elf->ed_uflags |= ELF_F_DIRTY;
714 	return (0);
715 }
716 
717 
718 
719 
720 /*
721  * The following is a private interface between the linkers (ld & ld.so.1)
722  * and libelf:
723  *
724  * elf_update(elf, ELF_C_WRIMAGE)
725  *	This will cause full image representing the elf file
726  *	described by the elf pointer to be built in memory.  If the
727  *	elf pointer has a valid file descriptor associated with it
728  *	we will attempt to build the memory image from mmap()'ed
729  *	storage.  If the elf descriptor does not have a valid
730  *	file descriptor (opened with elf_begin(0, ELF_C_IMAGE, 0))
731  *	then the image will be allocated from dynamic memory (malloc()).
732  *
733  *	elf_update() will return the size of the memory image built
734  *	when sucessful.
735  *
736  *	When a subsequent call to elf_update() with ELF_C_WRITE as
737  *	the command is performed it will sync the image created
738  *	by ELF_C_WRIMAGE to disk (if fd available) and
739  *	free the memory allocated.
740  */
741 
742 off_t
743 _elfxx_update(Elf * elf, Elf_Cmd cmd)
744 {
745 	size_t		sz;
746 	unsigned	u;
747 	Ehdr		*eh = elf->ed_ehdr;
748 
749 	if (elf == 0)
750 		return (-1);
751 
752 	ELFWLOCK(elf)
753 	switch (cmd) {
754 	default:
755 		_elf_seterr(EREQ_UPDATE, 0);
756 		ELFUNLOCK(elf)
757 		return (-1);
758 
759 	case ELF_C_WRIMAGE:
760 		if ((elf->ed_myflags & EDF_WRITE) == 0) {
761 			_elf_seterr(EREQ_UPDWRT, 0);
762 			ELFUNLOCK(elf)
763 			return (-1);
764 		}
765 		break;
766 	case ELF_C_WRITE:
767 		if ((elf->ed_myflags & EDF_WRITE) == 0) {
768 			_elf_seterr(EREQ_UPDWRT, 0);
769 			ELFUNLOCK(elf)
770 			return (-1);
771 		}
772 		if (elf->ed_wrimage) {
773 			if (elf->ed_myflags & EDF_WRALLOC) {
774 				free(elf->ed_wrimage);
775 				/*
776 				 * The size is still returned even
777 				 * though nothing is actually written
778 				 * out.  This is just to be consistant
779 				 * with the rest of the interface.
780 				 */
781 				sz = elf->ed_wrimagesz;
782 				elf->ed_wrimage = 0;
783 				elf->ed_wrimagesz = 0;
784 				ELFUNLOCK(elf);
785 				return ((off_t)sz);
786 			}
787 			sz = _elf_outsync(elf->ed_fd, elf->ed_wrimage,
788 			    elf->ed_wrimagesz,
789 			    (elf->ed_myflags & EDF_IMALLOC ? 0 : 1));
790 			elf->ed_myflags &= ~EDF_IMALLOC;
791 			elf->ed_wrimage = 0;
792 			elf->ed_wrimagesz = 0;
793 			ELFUNLOCK(elf);
794 			return ((off_t)sz);
795 		}
796 		/* FALLTHROUGH */
797 	case ELF_C_NULL:
798 		break;
799 	}
800 
801 	if (eh == 0) {
802 		_elf_seterr(ESEQ_EHDR, 0);
803 		ELFUNLOCK(elf)
804 		return (-1);
805 	}
806 
807 	if ((u = eh->e_version) > EV_CURRENT) {
808 		_elf_seterr(EREQ_VER, 0);
809 		ELFUNLOCK(elf)
810 		return (-1);
811 	}
812 
813 	if (u == EV_NONE)
814 		eh->e_version = EV_CURRENT;
815 
816 	if ((u = eh->e_ident[EI_DATA]) == ELFDATANONE) {
817 		unsigned	encode;
818 
819 		ELFACCESSDATA(encode, _elf_encode)
820 		if (encode == ELFDATANONE) {
821 			_elf_seterr(EREQ_ENCODE, 0);
822 			ELFUNLOCK(elf)
823 			return (-1);
824 		}
825 		/* LINTED */
826 		eh->e_ident[EI_DATA] = (Byte)encode;
827 	}
828 
829 	u = 1;
830 	if (elf->ed_uflags & ELF_F_LAYOUT) {
831 		sz = _elf_upd_usr(elf);
832 		u = 0;
833 	} else
834 		sz = _elf_upd_lib(elf);
835 
836 	if ((sz != 0) && ((cmd == ELF_C_WRITE) || (cmd == ELF_C_WRIMAGE)))
837 		sz = wrt(elf, (Xword)sz, u, cmd);
838 
839 	if (sz == 0) {
840 		ELFUNLOCK(elf)
841 		return (-1);
842 	}
843 
844 	ELFUNLOCK(elf)
845 	return ((off_t)sz);
846 }
847 
848 
849 /*
850  * When wrt() processes an ELF_C_WRIMAGE request, the resulting image
851  * gets the byte order (encoding) of the platform running the linker
852  * rather than that of the target host. This allows the linker to modify
853  * the image, prior to flushing it to the output file. This routine
854  * is used to re-translate such an image into the byte order of the
855  * target host.
856  */
857 int
858 _elfxx_swap_wrimage(Elf *elf)
859 {
860 	Elf_Data	dst, src;
861 	Elf_Scn		*s;
862 	Ehdr		*eh;
863 	Half		e_phnum;
864 	unsigned	ver;
865 	unsigned	encode;
866 
867 	/*
868 	 * Ehdr first
869 	 */
870 
871 	ELFWLOCK(elf);
872 	eh = elf->ed_ehdr;
873 	e_phnum = eh->e_phnum;
874 	ver = eh->e_version;
875 	encode = eh->e_ident[EI_DATA];
876 
877 	src.d_buf = dst.d_buf = (Elf_Void *)eh;
878 	src.d_type = dst.d_type = ELF_T_EHDR;
879 	src.d_size = dst.d_size = sizeof (Ehdr);
880 	src.d_version = dst.d_version = ver;
881 	if (elf_xlatetof(&dst, &src, encode) == 0) {
882 		ELFUNLOCK(elf);
883 		return (1);
884 	}
885 
886 	/*
887 	 * Phdr table if one exists
888 	 */
889 
890 	if (e_phnum != 0) {
891 		unsigned	work;
892 		/*
893 		 * Unlike other library data, phdr table is
894 		 * in the user version.
895 		 */
896 
897 		src.d_buf = dst.d_buf = (Elf_Void *)elf->ed_phdr;
898 		src.d_type = dst.d_type = ELF_T_PHDR;
899 		src.d_size = dst.d_size = elf->ed_phdrsz;
900 		ELFACCESSDATA(work, _elf_work)
901 		src.d_version = dst.d_version = work;
902 		if (elf_xlatetof(&dst, &src, encode) == 0) {
903 			ELFUNLOCK(elf);
904 			return (1);
905 		}
906 	}
907 
908 	/*
909 	 * Loop through sections
910 	 */
911 
912 	for (s = elf->ed_hdscn; s != 0; s = s->s_next) {
913 		register Dnode	*d, *prevd;
914 		Shdr		*sh = s->s_shdr;
915 
916 		if ((sh->sh_type == SHT_NOBITS) || (sh->sh_type == SHT_NULL))
917 			continue;
918 
919 		for (d = s->s_hdnode, prevd = 0;
920 		    d != 0; prevd = d, d = d->db_next) {
921 
922 			if ((d->db_myflags & DBF_READY) == 0) {
923 				SCNLOCK(s);
924 				if (_elf_locked_getdata(s, &prevd->db_data) !=
925 				    &d->db_data) {
926 					SCNUNLOCK(s);
927 					ELFUNLOCK(elf);
928 					return (1);
929 				}
930 				SCNUNLOCK(s);
931 			}
932 
933 			dst = d->db_data;
934 			if (elf_xlatetof(&dst, &d->db_data, encode) == 0) {
935 				ELFUNLOCK(elf);
936 				return (1);
937 			}
938 		}
939 	}
940 
941 	/*
942 	 * Shdr table
943 	 */
944 
945 	src.d_type = dst.d_type = ELF_T_SHDR;
946 	src.d_version = dst.d_version = ver;
947 	for (s = elf->ed_hdscn; s != 0; s = s->s_next) {
948 		src.d_buf = dst.d_buf = s->s_shdr;
949 		src.d_size = dst.d_size = sizeof (Shdr);
950 		if (elf_xlatetof(&dst, &src, encode) == 0) {
951 			ELFUNLOCK(elf);
952 			return (1);
953 		}
954 	}
955 
956 	ELFUNLOCK(elf);
957 	return (0);
958 }
959 
960 
961 
962 #ifndef _ELF64
963 /* class-independent, only needs to be compiled once */
964 
965 off_t
966 elf_update(Elf *elf, Elf_Cmd cmd)
967 {
968 	if (elf == 0)
969 		return (-1);
970 
971 	if (elf->ed_class == ELFCLASS32)
972 		return (_elf32_update(elf, cmd));
973 	else if (elf->ed_class == ELFCLASS64) {
974 		return (_elf64_update(elf, cmd));
975 	}
976 
977 	_elf_seterr(EREQ_CLASS, 0);
978 	return (-1);
979 }
980 
981 int
982 _elf_swap_wrimage(Elf *elf)
983 {
984 	if (elf == 0)
985 		return (0);
986 
987 	if (elf->ed_class == ELFCLASS32)
988 		return (_elf32_swap_wrimage(elf));
989 
990 	if (elf->ed_class == ELFCLASS64)
991 		return (_elf64_swap_wrimage(elf));
992 
993 	_elf_seterr(EREQ_CLASS, 0);
994 	return (0);
995 }
996 
997 /*
998  * 4106312, 4106398, This is an ad-hoc means for the 32-bit
999  * Elf64 version of libld.so.3 to get around the limitation
1000  * of a 32-bit d_off field.  This is only intended to be
1001  * used by libld to relocate symbols in large NOBITS sections.
1002  */
1003 Elf64_Off
1004 _elf_getxoff(Elf_Data * d)
1005 {
1006 	return (((Dnode *)d)->db_xoff);
1007 }
1008 #endif /* !_ELF64 */
1009