1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  *
26  * dldump(3c) creates a new file image from the specified input file.
27  */
28 #pragma ident	"%Z%%M%	%I%	%E% SMI"
29 
30 #include	<sys/param.h>
31 #include	<sys/procfs.h>
32 #include	<fcntl.h>
33 #include	<stdio.h>
34 #include	<libelf.h>
35 #include	<link.h>
36 #include	<dlfcn.h>
37 #include	<stdlib.h>
38 #include	<string.h>
39 #include	<unistd.h>
40 #include	<errno.h>
41 #include	"libld.h"
42 #include	"msg.h"
43 #include	"_librtld.h"
44 
45 /*
46  * Generic clean up routine
47  */
48 static void
49 cleanup(Elf *ielf, Elf *oelf, Elf *melf, Cache *icache, Cache *mcache,
50     int fd, const char *opath)
51 {
52 	if (icache) {
53 		Cache *	_icache = icache;
54 
55 		for (++_icache; _icache->c_flags != FLG_C_END; _icache++) {
56 			if (_icache->c_info)
57 				(void) free(_icache->c_info);
58 		}
59 		(void) free((void *)icache);
60 	}
61 	if (mcache)
62 		(void) free((void *)mcache);
63 
64 	if (ielf)
65 		(void) elf_end(ielf);
66 	if (oelf)
67 		(void) elf_end(oelf);
68 	if (melf)
69 		(void) elf_end(melf);
70 	if (fd)
71 		(void) close(fd);
72 	if (opath)
73 		(void) unlink(opath);
74 }
75 
76 /*
77  * The dldump(3x) interface directs control to the runtime linker.  The runtime
78  * linker brings in librtld.so.1 to provide the underlying support for this
79  * call (this is because librtld.so.1 requires libelf.so.1, and the whole wad
80  * is rather expensive to drag around with ld.so.1).
81  *
82  * rt_dldump(Rt_map * lmp, const char * opath, int flags, Addr addr)
83  *
84  * lmp provides the link-map of the ipath (the input file).
85  *
86  * opath specifies the output file.
87  *
88  * flags provides a variety of options that control how the new image will be
89  * relocated (if required).
90  *
91  * addr indicates the base address at which the associated input image is mapped
92  * within the process.
93  *
94  * The modes of operation and the various flags provide a number of combinations
95  * of images that can be created, some are useful, some maybe not.  The
96  * following provide a couple of basic models for dldump(3x) use:
97  *
98  *  new executable -	dldump(0, outfile, RTLD_MEMORY)
99  *
100  *			A dynamic executable may undergo some initialization
101  *			and the results of this saved in a new file for later
102  *			execution.  The executable will presumable update
103  *			parts of its data segment and heap (note that the heap
104  *			should be acquired using malloc() so that it follows
105  *			the end of the data segment for this technique to be
106  *			useful).  These updated memory elements are saved to the
107  *			new file, including a new .SUNW_heap section if
108  *			required.
109  *
110  *			For greatest flexibility, no relocated information
111  *			should be saved (by default any relocated information is
112  *			returned to the value it had in its original file).
113  *			This allows the new image to bind to new dynamic objects
114  *			when executed on the same or newer upgrades of the OS.
115  *
116  *			Fixing relocations by applying RTLD_REL_ALL will bind
117  *			the image to the dependencies presently mapped as part
118  *			of the process.  Thus the new executable will only work
119  *			correctly when these same dependencies map to exactly
120  *			to the same locations. (note that RTLD_REL_RELATIVE will
121  *			have no effect as dynamic executables commonly don't
122  *			contain any relative relocations).
123  *
124  *  new shared object -	dldump(infile, outfile, RTLD_REL_RELATIVE)
125  *
126  *			A shared object can be fixed to a known address so as
127  *			to reduce its relocation overhead on startup.  Because
128  *			the new file is fixed to a new base address (which is
129  *			the address at which the object was found mapped to the
130  *			process) it is now a dynamic executable.
131  *
132  *			Data changes that have occurred due to the object
133  *			gaining control (at the least this would be .init
134  *			processing) will not be carried over to the new image.
135  *
136  *			By only performing relative relocations all global
137  *			relocations are available for unique binding to each
138  *			process - thus interposition etc. is still available.
139  *
140  *			Using RTLD_REL_ALL will fix all relocations in the new
141  *			file, which will certainly provide for faster startup
142  *			of the new image, but at the loss of interposition
143  *			flexibility.
144  */
145 int
146 rt_dldump(Rt_map *lmp, const char *opath, int flags, Addr addr)
147 {
148 	Elf *		ielf = 0, *oelf = 0, *melf = 0;
149 	Ehdr		*iehdr, *oehdr, *mehdr;
150 	Phdr		*iphdr, *ophdr, *data_phdr = 0;
151 	Cache		*icache = 0, *_icache, *mcache = 0, *_mcache;
152 	Cache		*data_cache = 0, *dyn_cache = 0;
153 	Xword		rel_null_no = 0, rel_data_no = 0, rel_func_no = 0;
154 	Xword		rel_entsize;
155 	Rel		*rel_base = 0, *rel_null, *rel_data, *rel_func;
156 	Elf_Scn		*scn;
157 	Shdr		*shdr;
158 	Elf_Data	*data;
159 	Half		endx = 1;
160 	int		fd = 0, err, num;
161 	size_t		shstr_size = 1;
162 	Addr		edata;
163 	char		*shstr, *_shstr, *ipath = NAME(lmp);
164 	prstatus_t	*status = 0, _status;
165 	Lm_list		*lml = LIST(lmp);
166 
167 	if (lmp == lml_main.lm_head) {
168 		char	proc[16];
169 		int	pfd;
170 
171 		/*
172 		 * Get a /proc descriptor.
173 		 */
174 		(void) snprintf(proc, 16, MSG_ORIG(MSG_FMT_PROC),
175 		    (int)getpid());
176 		if ((pfd = open(proc, O_RDONLY)) == -1) {
177 			err = errno;
178 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN), proc,
179 			    strerror(err));
180 			return (1);
181 		}
182 
183 		/*
184 		 * If we've been asked to process the dynamic executable we
185 		 * might not know its full path (this is prior to realpath()
186 		 * processing becoming default), and thus use /proc to obtain a
187 		 * file descriptor of the input file.
188 		 */
189 		if ((fd = ioctl(pfd, PIOCOPENM, (void *)0)) == -1) {
190 			err = errno;
191 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_PROC), ipath,
192 			    strerror(err));
193 			(void) close(pfd);
194 			return (1);
195 		}
196 
197 		/*
198 		 * Obtain the process's status structure from which we can
199 		 * determine the size of the process's heap.  Note, if the
200 		 * application is using mapmalloc then the heap size is going
201 		 * to be zero, and if we're dumping a data section that makes
202 		 * reference to the malloc'ed area we're not going to get a
203 		 * useful image.
204 		 */
205 		if (!(flags & RTLD_NOHEAP)) {
206 			if (ioctl(pfd, PIOCSTATUS, (void *)&_status) == -1) {
207 				err = errno;
208 				eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_PROC),
209 				    ipath, strerror(err));
210 				(void) close(fd);
211 				(void) close(pfd);
212 				return (1);
213 			}
214 			if ((flags & RTLD_MEMORY) && _status.pr_brksize)
215 				status = &_status;
216 		}
217 		(void) close(pfd);
218 	} else {
219 		/*
220 		 * Open the specified file.
221 		 */
222 		if ((fd = open(ipath, O_RDONLY, 0)) == -1) {
223 			err = errno;
224 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN), ipath,
225 			    strerror(err));
226 			return (1);
227 		}
228 	}
229 
230 	/*
231 	 * Initialize with the ELF library and make sure this is a suitable
232 	 * ELF file we're dealing with.
233 	 */
234 	(void) elf_version(EV_CURRENT);
235 	if ((ielf = elf_begin(fd, ELF_C_READ, NULL)) == NULL) {
236 		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_BEGIN), ipath);
237 		cleanup(ielf, oelf, melf, icache, mcache, fd, 0);
238 		return (1);
239 	}
240 	(void) close(fd);
241 
242 	if ((elf_kind(ielf) != ELF_K_ELF) ||
243 	    ((iehdr = elf_getehdr(ielf)) == NULL) ||
244 	    ((iehdr->e_type != ET_EXEC) && (iehdr->e_type != ET_DYN))) {
245 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_IMG_ELF), ipath);
246 		cleanup(ielf, oelf, melf, icache, mcache, 0, 0);
247 		return (1);
248 	}
249 
250 	/*
251 	 * Make sure we can create the new output file.
252 	 */
253 	if ((fd = open(opath, (O_RDWR | O_CREAT | O_TRUNC), 0777)) == -1) {
254 		err = errno;
255 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN), opath,
256 		    strerror(err));
257 		cleanup(ielf, oelf, melf, icache, mcache, 0, 0);
258 		return (1);
259 	}
260 	if ((oelf = elf_begin(fd, ELF_C_WRITE, NULL)) == NULL) {
261 		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_BEGIN), opath);
262 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
263 		return (1);
264 	}
265 
266 	/*
267 	 * Obtain the input program headers.  Remember the last data segments
268 	 * program header entry as this will be updated later to reflect any new
269 	 * heap section size.
270 	 */
271 	if ((iphdr = elf_getphdr(ielf)) == NULL) {
272 		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_GETPHDR), ipath);
273 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
274 		return (1);
275 	}
276 
277 	for (num = 0, ophdr = iphdr; num != iehdr->e_phnum; num++, ophdr++) {
278 		/*
279 		 * Save the program header that contains the NOBITS section, or
280 		 * the last loadable program header if no NOBITS exists.  A
281 		 * NOBITS section translates to a memory size requirement that
282 		 * is greater than the file data it is mapped from.  Note that
283 		 * we inspect all headers just incase there only exist text
284 		 * segments.
285 		 */
286 		if (ophdr->p_type == PT_LOAD) {
287 			if (ophdr->p_filesz != ophdr->p_memsz)
288 				data_phdr = ophdr;
289 			else if (data_phdr) {
290 				if (data_phdr->p_vaddr < ophdr->p_vaddr)
291 					data_phdr = ophdr;
292 			} else
293 				data_phdr = ophdr;
294 		}
295 	}
296 
297 	/*
298 	 * If there is no data segment, and a heap section is required,
299 	 * warn the user and disable the heap addition (Note that you can't
300 	 * simply append the heap to the last segment, as it might be a text
301 	 * segment, and would therefore have the wrong permissions).
302 	 */
303 	if (status && !data_phdr) {
304 		eprintf(lml, ERR_WARNING, MSG_INTL(MSG_IMG_DATASEG), ipath);
305 		status = 0;
306 	}
307 
308 	/*
309 	 * Obtain the input files section header string table.
310 	 */
311 	if ((scn = elf_getscn(ielf, iehdr->e_shstrndx)) == NULL) {
312 		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_GETSCN), ipath);
313 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
314 		return (1);
315 	}
316 	if ((data = elf_getdata(scn, NULL)) == NULL) {
317 		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_GETDATA), ipath);
318 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
319 		return (1);
320 	}
321 	shstr = (char *)data->d_buf;
322 
323 	/*
324 	 * Construct a cache to maintain the input files section information.
325 	 * Obtain an extra cache element if a heap addition is required.  Also
326 	 * add an additional entry (marked FLG_C_END) to make the processing of
327 	 * this cache easier.
328 	 */
329 	num = iehdr->e_shnum;
330 	if (status)
331 		num++;
332 	if ((icache = malloc((num + 1) * sizeof (Cache))) == 0) {
333 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
334 		return (1);
335 	}
336 	icache[num].c_flags = FLG_C_END;
337 
338 	_icache = icache;
339 	_icache++;
340 
341 	/*
342 	 * Traverse each section from the input file collecting the appropriate
343 	 * ELF information.  Indicate how the section will be processed to
344 	 * generate the output image.
345 	 */
346 	for (scn = 0; scn = elf_nextscn(ielf, scn); _icache++) {
347 
348 		if ((_icache->c_shdr = shdr = elf_getshdr(scn)) == NULL) {
349 			eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_GETSHDR), ipath);
350 			cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
351 			return (1);
352 		}
353 
354 		if ((_icache->c_data = elf_getdata(scn, NULL)) == NULL) {
355 			eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_GETDATA), ipath);
356 			cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
357 			return (1);
358 		}
359 		_icache->c_name = shstr + (size_t)(shdr->sh_name);
360 		_icache->c_scn = scn;
361 		_icache->c_flags = 0;
362 		_icache->c_info = 0;
363 
364 		/*
365 		 * If the section has no address it is not part of the mapped
366 		 * image, and is unlikely to require any further processing.
367 		 * The section header string table will be rewritten (this isn't
368 		 * always necessary, it's only really required when relocation
369 		 * sections are renamed or sections are stripped, but we do
370 		 * things the same way regardless).
371 		 */
372 		if (shdr->sh_addr == 0) {
373 			if ((shdr->sh_type == SHT_STRTAB) &&
374 			    ((strcmp(_icache->c_name,
375 			    MSG_ORIG(MSG_SCN_SHSTR))) == 0))
376 				_icache->c_flags = FLG_C_SHSTR;
377 			else if (flags & RTLD_STRIP) {
378 				_icache->c_flags = FLG_C_EXCLUDE;
379 				continue;
380 			}
381 		}
382 
383 		/*
384 		 * Skip relocation sections for the time being, they'll be
385 		 * analyzed after all sections have been processed.
386 		 */
387 		if ((shdr->sh_type == M_REL_SHT_TYPE) && shdr->sh_addr)
388 			continue;
389 
390 		/*
391 		 * Sections at this point will simply be passed through to the
392 		 * output file.  Keep track of the section header string table
393 		 * size.
394 		 */
395 		shstr_size += strlen(_icache->c_name) + 1;
396 
397 		/*
398 		 * If a heap section is to be added to the output image,
399 		 * indicate that it will be added following the last data
400 		 * section.
401 		 */
402 		if (shdr->sh_addr && ((shdr->sh_addr + shdr->sh_size) ==
403 		    (data_phdr->p_vaddr + data_phdr->p_memsz))) {
404 			data_cache = _icache;
405 
406 			if (status) {
407 				_icache++;
408 				_icache->c_name =
409 					(char *)MSG_ORIG(MSG_SCN_HEAP);
410 				_icache->c_flags = FLG_C_HEAP;
411 
412 				_icache->c_scn = 0;
413 				_icache->c_shdr = 0;
414 				_icache->c_data = 0;
415 				_icache->c_info = 0;
416 
417 				shstr_size += strlen(_icache->c_name) + 1;
418 			}
419 		}
420 	}
421 
422 	/*
423 	 * Now that we've processed all input sections count the relocation
424 	 * entries (relocation sections need to reference their symbol tables).
425 	 */
426 	_icache = icache;
427 	for (_icache++; _icache->c_flags != FLG_C_END; _icache++) {
428 
429 		if ((shdr = _icache->c_shdr) == 0)
430 			continue;
431 
432 		/*
433 		 * If any form of relocations are to be applied to the output
434 		 * image determine what relocation counts exist.  These will be
435 		 * used to reorganize (localize) the relocation records.
436 		 */
437 		if ((shdr->sh_type == M_REL_SHT_TYPE) && shdr->sh_addr) {
438 			rel_entsize = shdr->sh_entsize;
439 
440 			if (count_reloc(icache, _icache, lmp, flags, addr,
441 			    &rel_null_no, &rel_data_no, &rel_func_no)) {
442 				cleanup(ielf, oelf, melf, icache, mcache,
443 				    fd, opath);
444 				return (1);
445 			}
446 		}
447 	}
448 
449 	/*
450 	 * If any form of relocations are to be applied to the output image
451 	 * then we will reorganize (localize) the relocation records.  If this
452 	 * reorganization occurs, the relocation sections will no longer have a
453 	 * one-to-one relationship with the section they relocate, hence we
454 	 * rename them to a more generic name.
455 	 */
456 	_icache = icache;
457 	for (_icache++; _icache->c_flags != FLG_C_END; _icache++) {
458 
459 		if ((shdr = _icache->c_shdr) == 0)
460 			continue;
461 
462 		if ((shdr->sh_type == M_REL_SHT_TYPE) && shdr->sh_addr) {
463 			if (rel_null_no) {
464 				_icache->c_flags = FLG_C_RELOC;
465 				_icache->c_name =
466 				    (char *)MSG_ORIG(MSG_SCN_RELOC);
467 			}
468 			shstr_size += strlen(_icache->c_name) + 1;
469 		}
470 	}
471 
472 
473 	/*
474 	 * If there is no data section, and a heap is required, warn the user
475 	 * and disable the heap addition.
476 	 */
477 	if (!data_cache) {
478 		eprintf(lml, ERR_WARNING, MSG_INTL(MSG_IMG_DATASEC), ipath);
479 		status = 0;
480 		endx = 0;
481 	}
482 
483 	/*
484 	 * Determine the value of _edata (which will also be _end) and its
485 	 * section index for updating the data segments phdr and symbol table
486 	 * information later.  If a new heap section is being added, update
487 	 * the values appropriately.
488 	 */
489 	edata = data_phdr->p_vaddr + data_phdr->p_memsz;
490 	if (status)
491 		edata += status->pr_brksize;
492 
493 	if (endx) {
494 		/* LINTED */
495 		endx = (Half)elf_ndxscn(data_cache->c_scn);
496 		if (status)
497 			endx++;
498 	}
499 
500 	/*
501 	 * We're now ready to construct the new elf image.
502 	 *
503 	 * Obtain a new elf header and initialize it with any basic information
504 	 * that isn't calculated as part of elf_update().
505 	 */
506 	if ((oehdr = elf_newehdr(oelf)) == NULL) {
507 		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_NEWEHDR), opath);
508 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
509 		return (1);
510 	}
511 	oehdr->e_machine = iehdr->e_machine;
512 	oehdr->e_flags = iehdr->e_flags;
513 	oehdr->e_type = ET_EXEC;
514 	oehdr->e_entry = iehdr->e_entry;
515 	if (addr)
516 		oehdr->e_entry += addr;
517 
518 	/*
519 	 * Obtain a new set of program headers.  Initialize these with the same
520 	 * information as the input program headers.  Update the virtual address
521 	 * and the data segments size to reflect any new heap section.
522 	 */
523 	if ((ophdr = elf_newphdr(oelf, iehdr->e_phnum)) == NULL) {
524 		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_NEWPHDR), opath);
525 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
526 		return (1);
527 	}
528 	for (num = 0; num != iehdr->e_phnum; num++, iphdr++, ophdr++) {
529 		*ophdr = *iphdr;
530 		if ((ophdr->p_type != PT_INTERP) && (ophdr->p_type != PT_NOTE))
531 			ophdr->p_vaddr += addr;
532 		if (data_phdr == iphdr) {
533 			if (status)
534 				ophdr->p_memsz = edata - ophdr->p_vaddr;
535 			ophdr->p_filesz = ophdr->p_memsz;
536 		}
537 	}
538 
539 	/*
540 	 * Establish a buffer for the new section header string table.  This
541 	 * will be filled in as each new section is created.
542 	 */
543 	if ((shstr = malloc(shstr_size)) == 0) {
544 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
545 		return (1);
546 	}
547 	_shstr = shstr;
548 	*_shstr++ = '\0';
549 
550 	/*
551 	 * Use the input files cache information to generate new sections.
552 	 */
553 	_icache = icache;
554 	for (_icache++; _icache->c_flags != FLG_C_END; _icache++) {
555 		/*
556 		 * Skip any excluded sections.
557 		 */
558 		if (_icache->c_flags == FLG_C_EXCLUDE)
559 			continue;
560 
561 		/*
562 		 * Create a matching section header in the output file.
563 		 */
564 		if ((scn = elf_newscn(oelf)) == NULL) {
565 			eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_NEWSCN), opath);
566 			cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
567 			return (1);
568 		}
569 		if ((shdr = elf_getshdr(scn)) == NULL) {
570 			eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_NEWSHDR), opath);
571 			cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
572 			return (1);
573 		}
574 
575 		/*
576 		 * If this is the heap section initialize the appropriate
577 		 * entries, otherwise simply use the original section header
578 		 * information.
579 		 */
580 		if (_icache->c_flags == FLG_C_HEAP) {
581 			shdr->sh_type = SHT_PROGBITS;
582 			shdr->sh_flags = SHF_ALLOC | SHF_WRITE;
583 		} else
584 			*shdr = *_icache->c_shdr;
585 
586 		/*
587 		 * Create a matching data buffer for this section.
588 		 */
589 		if ((data = elf_newdata(scn)) == NULL) {
590 			eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_NEWDATA), opath);
591 			cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
592 			return (1);
593 		}
594 
595 		/*
596 		 * Determine what data will be used for this section.
597 		 */
598 		if (_icache->c_flags == FLG_C_SHSTR) {
599 			/*
600 			 * Reassign the shstrtab to the new data buffer we're
601 			 * creating.  Insure that the new elf header references
602 			 * this section header table.
603 			 */
604 			*data = *_icache->c_data;
605 
606 			data->d_buf = (void *)shstr;
607 			data->d_size = shstr_size;
608 
609 			_icache->c_info = shstr;
610 
611 			/* LINTED */
612 			oehdr->e_shstrndx = (Half)elf_ndxscn(scn);
613 
614 		} else if (_icache->c_flags == FLG_C_HEAP) {
615 			/*
616 			 * Assign the heap to the appropriate memory offset.
617 			 */
618 			data->d_buf = status->pr_brkbase;
619 			data->d_type = ELF_T_BYTE;
620 			data->d_size = (size_t)status->pr_brksize;
621 			data->d_off = 0;
622 			data->d_align = 1;
623 			data->d_version = EV_CURRENT;
624 
625 			shdr->sh_addr = data_cache->c_shdr->sh_addr +
626 			    data_cache->c_shdr->sh_size;
627 
628 		} else if (_icache->c_flags == FLG_C_RELOC) {
629 			/*
630 			 * If some relocations are to be saved in the new image
631 			 * then the relocation sections will be reorganized to
632 			 * localize their contents.  These relocation sections
633 			 * will no longer have a one-to-one relationship with
634 			 * the section they relocate, hence we rename them and
635 			 * remove their sh_info info.
636 			 */
637 			*data = *_icache->c_data;
638 
639 			shdr->sh_info = 0;
640 
641 		} else {
642 			/*
643 			 * By default simply pass the section through.  If
644 			 * we've been asked to use the memory image of the
645 			 * input file reestablish the data buffer address.
646 			 */
647 			*data = *_icache->c_data;
648 
649 			if ((shdr->sh_addr) && (flags & RTLD_MEMORY))
650 				data->d_buf = (void *)(shdr->sh_addr + addr);
651 
652 			/*
653 			 * Update any NOBITS section to indicate that it now
654 			 * contains data.  If this image is being created
655 			 * directly from the input file, zero out the .bss
656 			 * section (this saves ld.so.1 having to zero out memory
657 			 * or do any /dev/zero mappings).
658 			 */
659 			if (shdr->sh_type == SHT_NOBITS) {
660 				shdr->sh_type = SHT_PROGBITS;
661 				if (!(flags & RTLD_MEMORY)) {
662 					if ((data->d_buf = calloc(1,
663 					    data->d_size)) == 0) {
664 						cleanup(ielf, oelf, melf,
665 						    icache, mcache, fd, opath);
666 						return (1);
667 					}
668 				}
669 			}
670 		}
671 
672 		/*
673 		 * Update the section header string table.
674 		 */
675 		/* LINTED */
676 		shdr->sh_name = (Word)(_shstr - shstr);
677 		(void) strcpy(_shstr, _icache->c_name);
678 		_shstr = _shstr + strlen(_icache->c_name) + 1;
679 
680 		/*
681 		 * For each section that has a virtual address update its
682 		 * address to the fixed location of the new image.
683 		 */
684 		if (shdr->sh_addr)
685 			shdr->sh_addr += addr;
686 
687 		/*
688 		 * If we've inserted a new section any later sections may need
689 		 * their sh_link fields updated (.stabs comes to mind).
690 		 */
691 		if (status && endx && (shdr->sh_link >= endx))
692 			shdr->sh_link++;
693 	}
694 
695 	/*
696 	 * Generate the new image, and obtain a new elf descriptor that will
697 	 * allow us to write and update the new image.
698 	 */
699 	if (elf_update(oelf, ELF_C_WRIMAGE) == -1) {
700 		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_UPDATE), opath);
701 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
702 		return (1);
703 	}
704 	if ((melf = elf_begin(0, ELF_C_IMAGE, oelf)) == NULL) {
705 		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_BEGIN), opath);
706 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
707 		return (1);
708 	}
709 	if ((mehdr = elf_getehdr(melf)) == NULL) {
710 		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_GETEHDR), opath);
711 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
712 		return (1);
713 	}
714 
715 	/*
716 	 * Construct a cache to maintain the memory files section information.
717 	 */
718 	if ((mcache = malloc(mehdr->e_shnum * sizeof (Cache))) == 0) {
719 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
720 		return (1);
721 	}
722 	_mcache = mcache;
723 	_mcache++;
724 
725 	for (scn = 0; scn = elf_nextscn(melf, scn); _mcache++) {
726 
727 		if ((_mcache->c_shdr = elf_getshdr(scn)) == NULL) {
728 			eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_GETSHDR), opath);
729 			cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
730 			return (1);
731 		}
732 
733 		if ((_mcache->c_data = elf_getdata(scn, NULL)) == NULL) {
734 			eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_GETDATA), opath);
735 			cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
736 			return (1);
737 		}
738 	}
739 
740 	/*
741 	 * Now that we have a complete description of the new image update any
742 	 * sections that are required.
743 	 *
744 	 *  o	reset any symbol table entries.
745 	 *
746 	 *  o	reset any relocation entries.
747 	 *
748 	 *  o	reset dynamic entries.
749 	 */
750 	_mcache = &mcache[0];
751 	for (_icache = &icache[1]; _icache->c_flags != FLG_C_END; _icache++) {
752 
753 		if (_icache->c_flags == FLG_C_EXCLUDE)
754 			continue;
755 
756 		_mcache++;
757 		shdr = _mcache->c_shdr;
758 
759 		/*
760 		 * Update the symbol table entries.  _end and _edata will be
761 		 * changed to reflect any heap addition.  All global symbols
762 		 * will be updated to their new fixed address.
763 		 */
764 		if ((shdr->sh_type == SHT_SYMTAB) ||
765 		    (shdr->sh_type == SHT_DYNSYM)) {
766 			update_sym(mcache, _mcache, edata, endx, addr);
767 			continue;
768 		}
769 
770 		/*
771 		 * Update any relocations.  All relocation requirements will
772 		 * have been established in count_reloc().
773 		 */
774 		if (shdr->sh_type == M_REL_SHT_TYPE) {
775 			if (rel_base == (Rel *)0) {
776 				rel_base = (Rel *)_mcache->c_data->d_buf;
777 				rel_null = rel_base;
778 				rel_data = (Rel *)((Xword)rel_null +
779 				    (rel_null_no * rel_entsize));
780 				rel_func = (Rel *)((Xword)rel_data +
781 				    (rel_data_no * rel_entsize));
782 			}
783 
784 			update_reloc(mcache, icache, _icache, opath, lmp,
785 			    &rel_null, &rel_data, &rel_func);
786 			continue;
787 		}
788 
789 		/*
790 		 * Perform any dynamic entry updates after all relocation
791 		 * processing has been carried out (as its possible the .dynamic
792 		 * section could occur before the .rel sections, delay this
793 		 * processing until last).
794 		 */
795 		if (shdr->sh_type == SHT_DYNAMIC)
796 			dyn_cache = _mcache;
797 	}
798 
799 	if (dyn_cache) {
800 		Xword	off = (Xword)rel_base - (Xword)mehdr;
801 
802 		/*
803 		 * If we're dumping a fixed object (typically the dynamic
804 		 * executable) compensate for its real base address.
805 		 */
806 		if (!addr)
807 			off += ADDR(lmp);
808 
809 		if (update_dynamic(mcache, dyn_cache, lmp, flags, addr, off,
810 		    opath, rel_null_no, rel_data_no, rel_func_no, rel_entsize,
811 		    elf_checksum(melf))) {
812 			cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
813 			return (1);
814 		}
815 	}
816 
817 	/*
818 	 * Having completed all section updates write the memory file out.
819 	 */
820 	if (elf_update(oelf, ELF_C_WRITE) == -1) {
821 		eprintf(lml, ERR_ELF, MSG_ORIG(MSG_ELF_UPDATE), opath);
822 		cleanup(ielf, oelf, melf, icache, mcache, fd, opath);
823 		return (1);
824 	}
825 
826 	cleanup(ielf, oelf, melf, icache, mcache, fd, 0);
827 	return (0);
828 }
829