xref: /titanic_41/usr/src/cmd/sgs/elfdump/common/elfdump.c (revision 0a03bde8864a4d57fde5e2168a38596a10bfdc53)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  * Dump an elf file.
29  */
30 #include	<stddef.h>
31 #include	<sys/elf_386.h>
32 #include	<sys/elf_amd64.h>
33 #include	<sys/elf_SPARC.h>
34 #include	<_libelf.h>
35 #include	<dwarf.h>
36 #include	<stdio.h>
37 #include	<unistd.h>
38 #include	<errno.h>
39 #include	<strings.h>
40 #include	<debug.h>
41 #include	<conv.h>
42 #include	<msg.h>
43 #include	<_elfdump.h>
44 
45 
46 /*
47  * VERSYM_STATE is used to maintain information about the VERSYM section
48  * in the object being analyzed. It is filled in by versions(), and used
49  * by init_symtbl_state() when displaying symbol information.
50  *
51  * There are three forms of symbol versioning known to us:
52  *
53  * 1) The original form, introduced with Solaris 2.5, in which
54  *	the Versym contains indexes to Verdef records, and the
55  *	Versym values for UNDEF symbols resolved by other objects
56  *	are all set to 0.
57  * 2) The GNU form, which is backward compatible with the original
58  *	Solaris form, but which adds several extensions:
59  *	- The Versym also contains indexes to Verneed records, recording
60  *		which object/version contributed the external symbol at
61  *		link time. These indexes start with the next value following
62  *		the final Verdef index. The index is written to the previously
63  *		reserved vna_other field of the ELF Vernaux structure.
64  *	- The top bit of the Versym value is no longer part of the index,
65  *		but is used as a "hidden bit" to prevent binding to the symbol.
66  *	- Multiple implementations of a given symbol, contained in varying
67  *		versions are allowed, using special assembler pseudo ops,
68  *		and encoded in the symbol name using '@' characters.
69  * 3) Modified Solaris form, in which we adopt the first GNU extension
70  *	(Versym indexes to Verneed records), but not the others.
71  *
72  * elfdump can handle any of these cases. The presence of a DT_VERSYM
73  * dynamic element indicates a full GNU object. An object that lacks
74  * a DT_VERSYM entry, but which has non-zero vna_other fields in the Vernaux
75  * structures is a modified Solaris object. An object that has neither of
76  * these uses the original form.
77  *
78  * max_verndx contains the largest version index that can appear
79  * in a Versym entry. This can never be less than 1: In the case where
80  * there is no verdef/verneed sections, the [0] index is reserved
81  * for local symbols, and the [1] index for globals. If the original
82  * Solaris versioning rules are in effect and there is a verdef section,
83  * then max_verndex is the number of defined versions. If one of the
84  * other versioning forms is in effect, then:
85  *	1) If there is no verneed section, it is the same as for
86  *		original Solaris versioning.
87  *	2) If there is a verneed section, the vna_other field of the
88  *		Vernaux structs contain versions, and max_verndx is the
89  *		largest such index.
90  *
91  * If gnu_full is True, the object uses the full GNU form of versioning.
92  * The value of the gnu_full field is based on the presence of
93  * a DT_VERSYM entry in the dynamic section: GNU ld produces these, and
94  * Solaris ld does not.
95  *
96  * The gnu_needed field is True if the Versym contains indexes to
97  * Verneed records, as indicated by non-zero vna_other fields in the Verneed
98  * section. If gnu_full is True, then gnu_needed will always be true.
99  * However, gnu_needed can be true without gnu_full. This is the modified
100  * Solaris form.
101  */
102 typedef struct {
103 	Cache	*cache;		/* Pointer to cache entry for VERSYM */
104 	Versym	*data;		/* Pointer to versym array */
105 	int	gnu_full;	/* True if object uses GNU versioning rules */
106 	int	gnu_needed;	/* True if object uses VERSYM indexes for */
107 				/*	VERNEED (subset of gnu_full) */
108 	int	max_verndx;	/* largest versym index value */
109 } VERSYM_STATE;
110 
111 /*
112  * SYMTBL_STATE is used to maintain information about a single symbol
113  * table section, for use by the routines that display symbol information.
114  */
115 typedef struct {
116 	const char	*file;		/* Name of file */
117 	Ehdr		*ehdr;		/* ELF header for file */
118 	Cache		*cache;		/* Cache of all section headers */
119 	uchar_t		osabi;		/* OSABI to use */
120 	Word		shnum;		/* # of sections in cache */
121 	Cache		*seccache;	/* Cache of symbol table section hdr */
122 	Word		secndx;		/* Index of symbol table section hdr */
123 	const char	*secname;	/* Name of section */
124 	uint_t		flags;		/* Command line option flags */
125 	struct {			/* Extended section index data */
126 		int	checked;	/* TRUE if already checked for shxndx */
127 		Word	*data;		/* NULL, or extended section index */
128 					/*	used for symbol table entries */
129 		uint_t	n;		/* # items in shxndx.data */
130 	} shxndx;
131 	VERSYM_STATE	*versym;	/* NULL, or associated VERSYM section */
132 	Sym 		*sym;		/* Array of symbols */
133 	Word		symn;		/* # of symbols */
134 } SYMTBL_STATE;
135 
136 /*
137  * A variable of this type is used to track information related to
138  * .eh_frame and .eh_frame_hdr sections across calls to unwind_eh_frame().
139  */
140 typedef struct {
141 	Word		frame_cnt;	/* # .eh_frame sections seen */
142 	Word		frame_ndx;	/* Section index of 1st .eh_frame */
143 	Word		hdr_cnt;	/* # .eh_frame_hdr sections seen */
144 	Word		hdr_ndx;	/* Section index of 1st .eh_frame_hdr */
145 	uint64_t	frame_ptr;	/* Value of FramePtr field from first */
146 					/*	.eh_frame_hdr section */
147 	uint64_t	frame_base;	/* Data addr of 1st .eh_frame  */
148 } gnu_eh_state_t;
149 
150 /*
151  * C++ .exception_ranges entries make use of the signed ptrdiff_t
152  * type to record self-relative pointer values. We need a type
153  * for this that is matched to the ELFCLASS being processed.
154  */
155 #if	defined(_ELF64)
156 	typedef int64_t PTRDIFF_T;
157 #else
158 	typedef int32_t PTRDIFF_T;
159 #endif
160 
161 /*
162  * The Sun C++ ABI uses this struct to define each .exception_ranges
163  * entry. From the ABI:
164  *
165  * The field ret_addr is a self relative pointer to the start of the address
166  * range. The name was chosen because in the current implementation the range
167  * typically starts at the return address for a call site.
168  *
169  * The field length is the difference, in bytes, between the pc of the last
170  * instruction covered by the exception range and the first. When only a
171  * single call site is represented without optimization, this will equal zero.
172  *
173  * The field handler_addr is a relative pointer which stores the difference
174  * between the start of the exception range and the address of all code to
175  * catch exceptions and perform the cleanup for stack unwinding.
176  *
177  * The field type_block is a relative pointer which stores the difference
178  * between the start of the exception range and the address of an array used
179  * for storing a list of the types of exceptions which can be caught within
180  * the exception range.
181  */
182 typedef struct {
183 	PTRDIFF_T	ret_addr;
184 	Xword		length;
185 	PTRDIFF_T	handler_addr;
186 	PTRDIFF_T	type_block;
187 	Xword		reserved;
188 } exception_range_entry;
189 
190 /*
191  * Focal point for verifying symbol names.
192  */
193 static const char *
string(Cache * refsec,Word ndx,Cache * strsec,const char * file,Word name)194 string(Cache *refsec, Word ndx, Cache *strsec, const char *file, Word name)
195 {
196 	/*
197 	 * If an error in this routine is due to a property of the string
198 	 * section, as opposed to a bad offset into the section (a property of
199 	 * the referencing section), then we will detect the same error on
200 	 * every call involving those sections. We use these static variables
201 	 * to retain the information needed to only issue each such error once.
202 	 */
203 	static Cache	*last_refsec;	/* Last referencing section seen */
204 	static int	strsec_err;	/* True if error issued */
205 
206 	const char	*strs;
207 	Word		strn;
208 
209 	if (strsec->c_data == NULL)
210 		return (NULL);
211 
212 	strs = (char *)strsec->c_data->d_buf;
213 	strn = strsec->c_data->d_size;
214 
215 	/*
216 	 * We only print a diagnostic regarding a bad string table once per
217 	 * input section being processed. If the refsec has changed, reset
218 	 * our retained error state.
219 	 */
220 	if (last_refsec != refsec) {
221 		last_refsec = refsec;
222 		strsec_err = 0;
223 	}
224 
225 	/* Verify that strsec really is a string table */
226 	if (strsec->c_shdr->sh_type != SHT_STRTAB) {
227 		if (!strsec_err) {
228 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOTSTRTAB),
229 			    file, strsec->c_ndx, refsec->c_ndx);
230 			strsec_err = 1;
231 		}
232 		return (MSG_INTL(MSG_STR_UNKNOWN));
233 	}
234 
235 	/*
236 	 * Is the string table offset within range of the available strings?
237 	 */
238 	if (name >= strn) {
239 		/*
240 		 * Do we have a empty string table?
241 		 */
242 		if (strs == NULL) {
243 			if (!strsec_err) {
244 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
245 				    file, strsec->c_name);
246 				strsec_err = 1;
247 			}
248 		} else {
249 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSTOFF),
250 			    file, refsec->c_name, EC_WORD(ndx), strsec->c_name,
251 			    EC_WORD(name), EC_WORD(strn - 1));
252 		}
253 
254 		/*
255 		 * Return the empty string so that the calling function can
256 		 * continue it's output diagnostics.
257 		 */
258 		return (MSG_INTL(MSG_STR_UNKNOWN));
259 	}
260 	return (strs + name);
261 }
262 
263 /*
264  * Relocations can reference section symbols and standard symbols.  If the
265  * former, establish the section name.
266  */
267 static const char *
relsymname(Cache * cache,Cache * csec,Cache * strsec,Word symndx,Word symnum,Word relndx,Sym * syms,char * secstr,size_t secsz,const char * file)268 relsymname(Cache *cache, Cache *csec, Cache *strsec, Word symndx, Word symnum,
269     Word relndx, Sym *syms, char *secstr, size_t secsz, const char *file)
270 {
271 	Sym		*sym;
272 	const char	*name;
273 
274 	if (symndx >= symnum) {
275 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_RELBADSYMNDX),
276 		    file, EC_WORD(symndx), EC_WORD(relndx));
277 		return (MSG_INTL(MSG_STR_UNKNOWN));
278 	}
279 
280 	sym = (Sym *)(syms + symndx);
281 	name = string(csec, symndx, strsec, file, sym->st_name);
282 
283 	/*
284 	 * If the symbol represents a section offset construct an appropriate
285 	 * string.  Note, although section symbol table entries typically have
286 	 * a NULL name pointer, entries do exist that point into the string
287 	 * table to their own NULL strings.
288 	 */
289 	if ((ELF_ST_TYPE(sym->st_info) == STT_SECTION) &&
290 	    ((sym->st_name == 0) || (*name == '\0'))) {
291 		(void) snprintf(secstr, secsz, MSG_INTL(MSG_STR_SECTION),
292 		    cache[sym->st_shndx].c_name);
293 		return ((const char *)secstr);
294 	}
295 
296 	return (name);
297 }
298 
299 /*
300  * Focal point for establishing a string table section.  Data such as the
301  * dynamic information simply points to a string table.  Data such as
302  * relocations, reference a symbol table, which in turn is associated with a
303  * string table.
304  */
305 static int
stringtbl(Cache * cache,int symtab,Word ndx,Word shnum,const char * file,Word * symnum,Cache ** symsec,Cache ** strsec)306 stringtbl(Cache *cache, int symtab, Word ndx, Word shnum, const char *file,
307     Word *symnum, Cache **symsec, Cache **strsec)
308 {
309 	Shdr	*shdr = cache[ndx].c_shdr;
310 
311 	if (symtab) {
312 		/*
313 		 * Validate the symbol table section.
314 		 */
315 		if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
316 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
317 			    file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
318 			return (0);
319 		}
320 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
321 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
322 			    file, cache[ndx].c_name);
323 			return (0);
324 		}
325 
326 		/*
327 		 * Obtain, and verify the symbol table data.
328 		 */
329 		if ((cache[ndx].c_data == NULL) ||
330 		    (cache[ndx].c_data->d_buf == NULL)) {
331 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
332 			    file, cache[ndx].c_name);
333 			return (0);
334 		}
335 
336 		/*
337 		 * Establish the string table index.
338 		 */
339 		ndx = shdr->sh_link;
340 		shdr = cache[ndx].c_shdr;
341 
342 		/*
343 		 * Return symbol table information.
344 		 */
345 		if (symnum)
346 			*symnum = (shdr->sh_size / shdr->sh_entsize);
347 		if (symsec)
348 			*symsec = &cache[ndx];
349 	}
350 
351 	/*
352 	 * Validate the associated string table section.
353 	 */
354 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
355 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
356 		    file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
357 		return (0);
358 	}
359 
360 	if (strsec)
361 		*strsec = &cache[shdr->sh_link];
362 
363 	return (1);
364 }
365 
366 /*
367  * Lookup a symbol and set Sym accordingly.
368  *
369  * entry:
370  *	name - Name of symbol to lookup
371  *	cache - Cache of all section headers
372  *	shnum - # of sections in cache
373  *	sym - Address of pointer to receive symbol
374  *	target - NULL, or section to which the symbol must be associated.
375  *	symtab - Symbol table to search for symbol
376  *	file - Name of file
377  *
378  * exit:
379  *	If the symbol is found, *sym is set to reference it, and True is
380  *	returned. If target is non-NULL, the symbol must reference the given
381  *	section --- otherwise the section is not checked.
382  *
383  *	If no symbol is found, False is returned.
384  */
385 static int
symlookup(const char * name,Cache * cache,Word shnum,Sym ** sym,Cache * target,Cache * symtab,const char * file)386 symlookup(const char *name, Cache *cache, Word shnum, Sym **sym,
387     Cache *target, Cache *symtab, const char *file)
388 {
389 	Shdr	*shdr;
390 	Word	symn, cnt;
391 	Sym	*syms;
392 
393 	if (symtab == 0)
394 		return (0);
395 
396 	shdr = symtab->c_shdr;
397 
398 	/*
399 	 * Determine the symbol data and number.
400 	 */
401 	if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
402 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
403 		    file, symtab->c_name);
404 		return (0);
405 	}
406 	if (symtab->c_data == NULL)
407 		return (0);
408 
409 	/* LINTED */
410 	symn = (Word)(shdr->sh_size / shdr->sh_entsize);
411 	syms = (Sym *)symtab->c_data->d_buf;
412 
413 	/*
414 	 * Get the associated string table section.
415 	 */
416 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
417 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
418 		    file, symtab->c_name, EC_WORD(shdr->sh_link));
419 		return (0);
420 	}
421 
422 	/*
423 	 * Loop through the symbol table to find a match.
424 	 */
425 	*sym = NULL;
426 	for (cnt = 0; cnt < symn; syms++, cnt++) {
427 		const char	*symname;
428 
429 		symname = string(symtab, cnt, &cache[shdr->sh_link], file,
430 		    syms->st_name);
431 
432 		if (symname && (strcmp(name, symname) == 0) &&
433 		    ((target == NULL) || (target->c_ndx == syms->st_shndx))) {
434 			/*
435 			 * It is possible, though rare, for a local and
436 			 * global symbol of the same name to exist, each
437 			 * contributed by a different input object. If the
438 			 * symbol just found is local, remember it, but
439 			 * continue looking.
440 			 */
441 			*sym = syms;
442 			if (ELF_ST_BIND(syms->st_info) != STB_LOCAL)
443 				break;
444 		}
445 	}
446 
447 	return (*sym != NULL);
448 }
449 
450 /*
451  * Print section headers.
452  */
453 static void
sections(const char * file,Cache * cache,Word shnum,Ehdr * ehdr,uchar_t osabi)454 sections(const char *file, Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi)
455 {
456 	size_t	seccnt;
457 
458 	for (seccnt = 1; seccnt < shnum; seccnt++) {
459 		Cache		*_cache = &cache[seccnt];
460 		Shdr		*shdr = _cache->c_shdr;
461 		const char	*secname = _cache->c_name;
462 
463 		/*
464 		 * Although numerous section header entries can be zero, it's
465 		 * usually a sign of trouble if the type is zero.
466 		 */
467 		if (shdr->sh_type == 0) {
468 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHTYPE),
469 			    file, secname, EC_WORD(shdr->sh_type));
470 		}
471 
472 		if (!match(MATCH_F_ALL, secname, seccnt, shdr->sh_type))
473 			continue;
474 
475 		/*
476 		 * Identify any sections that are suspicious.  A .got section
477 		 * shouldn't exist in a relocatable object.
478 		 */
479 		if (ehdr->e_type == ET_REL) {
480 			if (strncmp(secname, MSG_ORIG(MSG_ELF_GOT),
481 			    MSG_ELF_GOT_SIZE) == 0) {
482 				(void) fprintf(stderr,
483 				    MSG_INTL(MSG_GOT_UNEXPECTED), file,
484 				    secname);
485 			}
486 		}
487 
488 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
489 		dbg_print(0, MSG_INTL(MSG_ELF_SHDR), EC_WORD(seccnt), secname);
490 		Elf_shdr(0, osabi, ehdr->e_machine, shdr);
491 	}
492 }
493 
494 /*
495  * Obtain a specified Phdr entry.
496  */
497 static Phdr *
getphdr(Word phnum,Word * type_arr,Word type_cnt,const char * file,Elf * elf)498 getphdr(Word phnum, Word *type_arr, Word type_cnt, const char *file, Elf *elf)
499 {
500 	Word	cnt, tcnt;
501 	Phdr	*phdr;
502 
503 	if ((phdr = elf_getphdr(elf)) == NULL) {
504 		failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
505 		return (NULL);
506 	}
507 
508 	for (cnt = 0; cnt < phnum; phdr++, cnt++) {
509 		for (tcnt = 0; tcnt < type_cnt; tcnt++) {
510 			if (phdr->p_type == type_arr[tcnt])
511 				return (phdr);
512 		}
513 	}
514 	return (NULL);
515 }
516 
517 /*
518  * Display the contents of GNU/amd64 .eh_frame and .eh_frame_hdr
519  * sections.
520  *
521  * entry:
522  *	cache - Cache of all section headers
523  *	shndx - Index of .eh_frame or .eh_frame_hdr section to be displayed
524  *	shnum - Total number of sections which exist
525  *	uphdr - NULL, or unwind program header associated with
526  *		the .eh_frame_hdr section.
527  *	ehdr - ELF header for file
528  *	eh_state - Data used across calls to this routine. The
529  *		caller should zero it before the first call, and
530  *		pass it on every call.
531  *	osabi - OSABI to use in displaying information
532  *	file - Name of file
533  *	flags - Command line option flags
534  */
535 static void
unwind_eh_frame(Cache * cache,Word shndx,Word shnum,Phdr * uphdr,Ehdr * ehdr,gnu_eh_state_t * eh_state,uchar_t osabi,const char * file,uint_t flags)536 unwind_eh_frame(Cache *cache, Word shndx, Word shnum, Phdr *uphdr, Ehdr *ehdr,
537     gnu_eh_state_t *eh_state, uchar_t osabi, const char *file, uint_t flags)
538 {
539 #if	defined(_ELF64)
540 #define	MSG_UNW_BINSRTAB2	MSG_UNW_BINSRTAB2_64
541 #define	MSG_UNW_BINSRTABENT	MSG_UNW_BINSRTABENT_64
542 #else
543 #define	MSG_UNW_BINSRTAB2	MSG_UNW_BINSRTAB2_32
544 #define	MSG_UNW_BINSRTABENT	MSG_UNW_BINSRTABENT_32
545 #endif
546 
547 	Cache			*_cache = &cache[shndx];
548 	Shdr			*shdr = _cache->c_shdr;
549 	uchar_t			*data = (uchar_t *)(_cache->c_data->d_buf);
550 	size_t			datasize = _cache->c_data->d_size;
551 	Conv_dwarf_ehe_buf_t	dwarf_ehe_buf;
552 	uint64_t		ndx, frame_ptr, fde_cnt, tabndx;
553 	uint_t			vers, frame_ptr_enc, fde_cnt_enc, table_enc;
554 	uint64_t		initloc, initloc0 = 0;
555 	uint64_t		gotaddr = 0;
556 	int			cnt;
557 
558 	for (cnt = 1; cnt < shnum; cnt++) {
559 		if (strncmp(cache[cnt].c_name, MSG_ORIG(MSG_ELF_GOT),
560 		    MSG_ELF_GOT_SIZE) == 0) {
561 			gotaddr = cache[cnt].c_shdr->sh_addr;
562 			break;
563 		}
564 	}
565 
566 	if ((data == NULL) || (datasize == 0)) {
567 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
568 		    file, _cache ->c_name);
569 		return;
570 	}
571 
572 	/*
573 	 * Is this a .eh_frame_hdr?
574 	 */
575 	if ((uphdr && (shdr->sh_addr == uphdr->p_vaddr)) ||
576 	    (strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRMHDR),
577 	    MSG_SCN_FRMHDR_SIZE) == 0)) {
578 		/*
579 		 * There can only be a single .eh_frame_hdr.
580 		 * Flag duplicates.
581 		 */
582 		if (++eh_state->hdr_cnt > 1)
583 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_MULTEHFRMHDR),
584 			    file, EC_WORD(shndx), _cache->c_name);
585 
586 		dbg_print(0, MSG_ORIG(MSG_UNW_FRMHDR));
587 		ndx = 0;
588 
589 		vers = data[ndx++];
590 		frame_ptr_enc = data[ndx++];
591 		fde_cnt_enc = data[ndx++];
592 		table_enc = data[ndx++];
593 
594 		dbg_print(0, MSG_ORIG(MSG_UNW_FRMVERS), vers);
595 
596 		switch (dwarf_ehe_extract(data, datasize, &ndx,
597 		    &frame_ptr, frame_ptr_enc, ehdr->e_ident, B_TRUE,
598 		    shdr->sh_addr, ndx, gotaddr)) {
599 		case DW_OVERFLOW:
600 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWOVRFLW),
601 			    file, _cache->c_name);
602 			return;
603 		case DW_BAD_ENCODING:
604 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWBADENC),
605 			    file, _cache->c_name, frame_ptr_enc);
606 			return;
607 		case DW_SUCCESS:
608 			break;
609 		}
610 		if (eh_state->hdr_cnt == 1) {
611 			eh_state->hdr_ndx = shndx;
612 			eh_state->frame_ptr = frame_ptr;
613 		}
614 
615 		dbg_print(0, MSG_ORIG(MSG_UNW_FRPTRENC),
616 		    conv_dwarf_ehe(frame_ptr_enc, &dwarf_ehe_buf),
617 		    EC_XWORD(frame_ptr));
618 
619 		switch (dwarf_ehe_extract(data, datasize, &ndx, &fde_cnt,
620 		    fde_cnt_enc, ehdr->e_ident, B_TRUE, shdr->sh_addr, ndx,
621 		    gotaddr)) {
622 		case DW_OVERFLOW:
623 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWOVRFLW),
624 			    file, _cache->c_name);
625 			return;
626 		case DW_BAD_ENCODING:
627 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWBADENC),
628 			    file, _cache->c_name, fde_cnt_enc);
629 			return;
630 		case DW_SUCCESS:
631 			break;
632 		}
633 
634 		dbg_print(0, MSG_ORIG(MSG_UNW_FDCNENC),
635 		    conv_dwarf_ehe(fde_cnt_enc, &dwarf_ehe_buf),
636 		    EC_XWORD(fde_cnt));
637 		dbg_print(0, MSG_ORIG(MSG_UNW_TABENC),
638 		    conv_dwarf_ehe(table_enc, &dwarf_ehe_buf));
639 		dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTAB1));
640 		dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTAB2));
641 
642 		for (tabndx = 0; tabndx < fde_cnt; tabndx++) {
643 			uint64_t table;
644 
645 			switch (dwarf_ehe_extract(data, datasize, &ndx,
646 			    &initloc, table_enc, ehdr->e_ident, B_TRUE,
647 			    shdr->sh_addr, ndx, gotaddr)) {
648 			case DW_OVERFLOW:
649 				(void) fprintf(stderr,
650 				    MSG_INTL(MSG_ERR_DWOVRFLW), file,
651 				    _cache->c_name);
652 				return;
653 			case DW_BAD_ENCODING:
654 				(void) fprintf(stderr,
655 				    MSG_INTL(MSG_ERR_DWBADENC), file,
656 				    _cache->c_name, table_enc);
657 				return;
658 			case DW_SUCCESS:
659 				break;
660 			}
661 			if ((tabndx != 0) && (initloc0 > initloc))
662 				(void) fprintf(stderr,
663 				    MSG_INTL(MSG_ERR_BADSORT), file,
664 				    _cache->c_name, EC_WORD(tabndx));
665 			switch (dwarf_ehe_extract(data, datasize, &ndx, &table,
666 			    table_enc, ehdr->e_ident, B_TRUE, shdr->sh_addr,
667 			    ndx, gotaddr)) {
668 			case DW_OVERFLOW:
669 				(void) fprintf(stderr,
670 				    MSG_INTL(MSG_ERR_DWOVRFLW), file,
671 				    _cache->c_name);
672 				return;
673 			case DW_BAD_ENCODING:
674 				(void) fprintf(stderr,
675 				    MSG_INTL(MSG_ERR_DWBADENC), file,
676 				    _cache->c_name, table_enc);
677 				return;
678 			case DW_SUCCESS:
679 				break;
680 			}
681 
682 			dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTABENT),
683 			    EC_XWORD(initloc),
684 			    EC_XWORD(table));
685 			initloc0 = initloc;
686 		}
687 	} else {		/* Display the .eh_frame section */
688 		eh_state->frame_cnt++;
689 		if (eh_state->frame_cnt == 1) {
690 			eh_state->frame_ndx = shndx;
691 			eh_state->frame_base = shdr->sh_addr;
692 		} else if ((eh_state->frame_cnt >  1) &&
693 		    (ehdr->e_type != ET_REL)) {
694 			Conv_inv_buf_t	inv_buf;
695 
696 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_MULTEHFRM),
697 			    file, EC_WORD(shndx), _cache->c_name,
698 			    conv_ehdr_type(osabi, ehdr->e_type, 0, &inv_buf));
699 		}
700 		dump_eh_frame(file, _cache->c_name, data, datasize,
701 		    shdr->sh_addr, ehdr->e_machine, ehdr->e_ident, gotaddr);
702 	}
703 
704 	/*
705 	 * If we've seen the .eh_frame_hdr and the first .eh_frame section,
706 	 * compare the header frame_ptr to the address of the actual frame
707 	 * section to ensure the link-editor got this right.  Note, this
708 	 * diagnostic is only produced when unwind information is explicitly
709 	 * asked for, as shared objects built with an older ld(1) may reveal
710 	 * this inconsistency.  Although an inconsistency, it doesn't seem to
711 	 * have any adverse effect on existing tools.
712 	 */
713 	if (((flags & FLG_MASK_SHOW) != FLG_MASK_SHOW) &&
714 	    (eh_state->hdr_cnt > 0) && (eh_state->frame_cnt > 0) &&
715 	    (eh_state->frame_ptr != eh_state->frame_base))
716 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADEHFRMPTR),
717 		    file, EC_WORD(eh_state->hdr_ndx),
718 		    cache[eh_state->hdr_ndx].c_name,
719 		    EC_XWORD(eh_state->frame_ptr),
720 		    EC_WORD(eh_state->frame_ndx),
721 		    cache[eh_state->frame_ndx].c_name,
722 		    EC_XWORD(eh_state->frame_base));
723 #undef MSG_UNW_BINSRTAB2
724 #undef MSG_UNW_BINSRTABENT
725 }
726 
727 /*
728  * Convert a self relative pointer into an address. A self relative
729  * pointer adds the address where the pointer resides to the offset
730  * contained in the pointer. The benefit is that the value of the
731  * pointer does not require relocation.
732  *
733  * entry:
734  *	base_addr - Address of the pointer.
735  *	delta - Offset relative to base_addr giving desired address
736  *
737  * exit:
738  *	The computed address is returned.
739  *
740  * note:
741  *	base_addr is an unsigned value, while ret_addr is signed. This routine
742  *	used explicit testing and casting to explicitly control type
743  *	conversion, and ensure that we handle the maximum possible range.
744  */
745 static Addr
srelptr(Addr base_addr,PTRDIFF_T delta)746 srelptr(Addr base_addr, PTRDIFF_T delta)
747 {
748 	if (delta < 0)
749 		return (base_addr - (Addr) (-delta));
750 
751 	return (base_addr + (Addr) delta);
752 }
753 
754 /*
755  * Byte swap a PTRDIFF_T value.
756  */
757 static PTRDIFF_T
swap_ptrdiff(PTRDIFF_T value)758 swap_ptrdiff(PTRDIFF_T value)
759 {
760 	PTRDIFF_T r;
761 	uchar_t	*dst = (uchar_t *)&r;
762 	uchar_t	*src = (uchar_t *)&value;
763 
764 	UL_ASSIGN_BSWAP_XWORD(dst, src);
765 	return (r);
766 }
767 
768 /*
769  * Display exception_range_entry items from the .exception_ranges section
770  * of a Sun C++ object.
771  */
772 static void
unwind_exception_ranges(Cache * _cache,const char * file,int do_swap)773 unwind_exception_ranges(Cache *_cache, const char *file, int do_swap)
774 {
775 	/*
776 	 * Translate a PTRDIFF_T self-relative address field of
777 	 * an exception_range_entry struct into an address.
778 	 *
779 	 * entry:
780 	 *	exc_addr - Address of base of exception_range_entry struct
781 	 *	cur_ent - Pointer to data in the struct to be translated
782 	 *
783 	 *	_f - Field of struct to be translated
784 	 */
785 #define	SRELPTR(_f) \
786 	srelptr(exc_addr + offsetof(exception_range_entry, _f), cur_ent->_f)
787 
788 #if	defined(_ELF64)
789 #define	MSG_EXR_TITLE	MSG_EXR_TITLE_64
790 #define	MSG_EXR_ENTRY	MSG_EXR_ENTRY_64
791 #else
792 #define	MSG_EXR_TITLE	MSG_EXR_TITLE_32
793 #define	MSG_EXR_ENTRY	MSG_EXR_ENTRY_32
794 #endif
795 
796 	exception_range_entry	scratch, *ent, *cur_ent = &scratch;
797 	char			index[MAXNDXSIZE];
798 	Word			i, nelts;
799 	Addr			addr, addr0 = 0, offset = 0;
800 	Addr			exc_addr = _cache->c_shdr->sh_addr;
801 
802 	dbg_print(0, MSG_INTL(MSG_EXR_TITLE));
803 	ent = (exception_range_entry *)(_cache->c_data->d_buf);
804 	nelts = _cache->c_data->d_size / sizeof (exception_range_entry);
805 
806 	for (i = 0; i < nelts; i++, ent++) {
807 		if (do_swap) {
808 			/*
809 			 * Copy byte swapped values into the scratch buffer.
810 			 * The reserved field is not used, so we skip it.
811 			 */
812 			scratch.ret_addr = swap_ptrdiff(ent->ret_addr);
813 			scratch.length = BSWAP_XWORD(ent->length);
814 			scratch.handler_addr = swap_ptrdiff(ent->handler_addr);
815 			scratch.type_block = swap_ptrdiff(ent->type_block);
816 		} else {
817 			cur_ent = ent;
818 		}
819 
820 		/*
821 		 * The table is required to be sorted by the address
822 		 * derived from ret_addr, to allow binary searching. Ensure
823 		 * that addresses grow monotonically.
824 		 */
825 		addr = SRELPTR(ret_addr);
826 		if ((i != 0) && (addr0 > addr))
827 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSORT),
828 			    file, _cache->c_name, EC_WORD(i));
829 
830 		(void) snprintf(index, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX),
831 		    EC_XWORD(i));
832 		dbg_print(0, MSG_INTL(MSG_EXR_ENTRY), index, EC_ADDR(offset),
833 		    EC_ADDR(addr), EC_ADDR(cur_ent->length),
834 		    EC_ADDR(SRELPTR(handler_addr)),
835 		    EC_ADDR(SRELPTR(type_block)));
836 
837 		addr0 = addr;
838 		exc_addr += sizeof (exception_range_entry);
839 		offset += sizeof (exception_range_entry);
840 	}
841 
842 #undef SRELPTR
843 #undef MSG_EXR_TITLE
844 #undef MSG_EXR_ENTRY
845 }
846 
847 /*
848  * Display information from unwind/exception sections:
849  *
850  * -	GNU/amd64 .eh_frame and .eh_frame_hdr
851  * -	Sun C++ .exception_ranges
852  *
853  */
854 static void
unwind(Cache * cache,Word shnum,Word phnum,Ehdr * ehdr,uchar_t osabi,const char * file,Elf * elf,uint_t flags)855 unwind(Cache *cache, Word shnum, Word phnum, Ehdr *ehdr, uchar_t osabi,
856     const char *file, Elf *elf, uint_t flags)
857 {
858 	static Word phdr_types[] = { PT_SUNW_UNWIND, PT_SUNW_EH_FRAME };
859 
860 	Word			cnt;
861 	Phdr			*uphdr = NULL;
862 	gnu_eh_state_t		eh_state;
863 
864 	/*
865 	 * Historical background: .eh_frame and .eh_frame_hdr sections
866 	 * come from the GNU compilers (particularly C++), and are used
867 	 * under all architectures. Their format is based on DWARF. When
868 	 * the amd64 ABI was defined, these sections were adopted wholesale
869 	 * from the existing practice.
870 	 *
871 	 * When amd64 support was added to Solaris, support for these
872 	 * sections was added, using the SHT_AMD64_UNWIND section type
873 	 * to identify them. At first, we ignored them in objects for
874 	 * non-amd64 targets, but later broadened our support to include
875 	 * other architectures in order to better support gcc-generated
876 	 * objects.
877 	 *
878 	 * .exception_ranges implement the same basic concepts, but
879 	 * were invented at Sun for the Sun C++ compiler.
880 	 *
881 	 * We match these sections by name, rather than section type,
882 	 * because they can come in as either SHT_AMD64_UNWIND, or as
883 	 * SHT_PROGBITS, and because the type isn't enough to determine
884 	 * how they should be interpreted.
885 	 */
886 	/* Find the program header for .eh_frame_hdr if present */
887 	if (phnum)
888 		uphdr = getphdr(phnum, phdr_types,
889 		    sizeof (phdr_types) / sizeof (*phdr_types), file, elf);
890 
891 	/*
892 	 * eh_state is used to retain data used by unwind_eh_frame()
893 	 * across calls.
894 	 */
895 	bzero(&eh_state, sizeof (eh_state));
896 
897 	for (cnt = 1; cnt < shnum; cnt++) {
898 		Cache		*_cache = &cache[cnt];
899 		Shdr		*shdr = _cache->c_shdr;
900 		int		is_exrange;
901 
902 		/*
903 		 * Skip sections of the wrong type. On amd64, they
904 		 * can be SHT_AMD64_UNWIND. On all platforms, they
905 		 * can be SHT_PROGBITS (including amd64, if using
906 		 * the GNU compilers).
907 		 *
908 		 * Skip anything other than these two types. The name
909 		 * test below will thin out the SHT_PROGBITS that don't apply.
910 		 */
911 		if ((shdr->sh_type != SHT_PROGBITS) &&
912 		    (shdr->sh_type != SHT_AMD64_UNWIND))
913 			continue;
914 
915 		/*
916 		 * Only sections with certain well known names are of interest.
917 		 * These are:
918 		 *
919 		 *	.eh_frame - amd64/GNU-compiler unwind sections
920 		 *	.eh_frame_hdr - Sorted table referencing .eh_frame
921 		 *	.exception_ranges - Sun C++ unwind sections
922 		 *
923 		 * We do a prefix comparison, allowing for naming conventions
924 		 * like .eh_frame.foo, hence the use of strncmp() rather than
925 		 * strcmp(). This means that we only really need to test for
926 		 * .eh_frame, as it's a prefix of .eh_frame_hdr.
927 		 */
928 		is_exrange =  strncmp(_cache->c_name,
929 		    MSG_ORIG(MSG_SCN_EXRANGE), MSG_SCN_EXRANGE_SIZE) == 0;
930 		if ((strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRM),
931 		    MSG_SCN_FRM_SIZE) != 0) && !is_exrange)
932 			continue;
933 
934 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
935 			continue;
936 
937 		if (_cache->c_data == NULL)
938 			continue;
939 
940 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
941 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_UNWIND), _cache->c_name);
942 
943 		if (is_exrange)
944 			unwind_exception_ranges(_cache, file,
945 			    _elf_sys_encoding() != ehdr->e_ident[EI_DATA]);
946 		else
947 			unwind_eh_frame(cache, cnt, shnum, uphdr, ehdr,
948 			    &eh_state, osabi, file, flags);
949 	}
950 }
951 
952 /*
953  * Initialize a symbol table state structure
954  *
955  * entry:
956  *	state - State structure to be initialized
957  *	cache - Cache of all section headers
958  *	shnum - # of sections in cache
959  *	secndx - Index of symbol table section
960  *	ehdr - ELF header for file
961  *	versym - Information about versym section
962  *	file - Name of file
963  *	flags - Command line option flags
964  */
965 static int
init_symtbl_state(SYMTBL_STATE * state,Cache * cache,Word shnum,Word secndx,Ehdr * ehdr,uchar_t osabi,VERSYM_STATE * versym,const char * file,uint_t flags)966 init_symtbl_state(SYMTBL_STATE *state, Cache *cache, Word shnum, Word secndx,
967     Ehdr *ehdr, uchar_t osabi, VERSYM_STATE *versym, const char *file,
968     uint_t flags)
969 {
970 	Shdr *shdr;
971 
972 	state->file = file;
973 	state->ehdr = ehdr;
974 	state->cache = cache;
975 	state->osabi = osabi;
976 	state->shnum = shnum;
977 	state->seccache = &cache[secndx];
978 	state->secndx = secndx;
979 	state->secname = state->seccache->c_name;
980 	state->flags = flags;
981 	state->shxndx.checked = 0;
982 	state->shxndx.data = NULL;
983 	state->shxndx.n = 0;
984 
985 	shdr = state->seccache->c_shdr;
986 
987 	/*
988 	 * Check the symbol data and per-item size.
989 	 */
990 	if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
991 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
992 		    file, state->secname);
993 		return (0);
994 	}
995 	if (state->seccache->c_data == NULL)
996 		return (0);
997 
998 	/* LINTED */
999 	state->symn = (Word)(shdr->sh_size / shdr->sh_entsize);
1000 	state->sym = (Sym *)state->seccache->c_data->d_buf;
1001 
1002 	/*
1003 	 * Check associated string table section.
1004 	 */
1005 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
1006 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1007 		    file, state->secname, EC_WORD(shdr->sh_link));
1008 		return (0);
1009 	}
1010 
1011 	/*
1012 	 * Determine if there is a associated Versym section
1013 	 * with this Symbol Table.
1014 	 */
1015 	if (versym && versym->cache &&
1016 	    (versym->cache->c_shdr->sh_link == state->secndx))
1017 		state->versym = versym;
1018 	else
1019 		state->versym = NULL;
1020 
1021 
1022 	return (1);
1023 }
1024 
1025 /*
1026  * Determine the extended section index used for symbol tables entries.
1027  */
1028 static void
symbols_getxindex(SYMTBL_STATE * state)1029 symbols_getxindex(SYMTBL_STATE *state)
1030 {
1031 	uint_t	symn;
1032 	Word	symcnt;
1033 
1034 	state->shxndx.checked = 1;   /* Note that we've been called */
1035 	for (symcnt = 1; symcnt < state->shnum; symcnt++) {
1036 		Cache	*_cache = &state->cache[symcnt];
1037 		Shdr	*shdr = _cache->c_shdr;
1038 
1039 		if ((shdr->sh_type != SHT_SYMTAB_SHNDX) ||
1040 		    (shdr->sh_link != state->secndx))
1041 			continue;
1042 
1043 		if ((shdr->sh_entsize) &&
1044 		    /* LINTED */
1045 		    ((symn = (uint_t)(shdr->sh_size / shdr->sh_entsize)) == 0))
1046 			continue;
1047 
1048 		if (_cache->c_data == NULL)
1049 			continue;
1050 
1051 		state->shxndx.data = _cache->c_data->d_buf;
1052 		state->shxndx.n = symn;
1053 		return;
1054 	}
1055 }
1056 
1057 /*
1058  * Produce a line of output for the given symbol
1059  *
1060  * entry:
1061  *	state - Symbol table state
1062  *	symndx - Index of symbol within the table
1063  *	info - Value of st_info (indicates local/global range)
1064  *	symndx_disp - Index to display. This may not be the same
1065  *		as symndx if the display is relative to the logical
1066  *		combination of the SUNW_ldynsym/dynsym tables.
1067  *	sym - Symbol to display
1068  */
1069 static void
output_symbol(SYMTBL_STATE * state,Word symndx,Word info,Word disp_symndx,Sym * sym)1070 output_symbol(SYMTBL_STATE *state, Word symndx, Word info, Word disp_symndx,
1071     Sym *sym)
1072 {
1073 	/*
1074 	 * Symbol types for which we check that the specified
1075 	 * address/size land inside the target section.
1076 	 */
1077 	static const int addr_symtype[] = {
1078 		0,			/* STT_NOTYPE */
1079 		1,			/* STT_OBJECT */
1080 		1,			/* STT_FUNC */
1081 		0,			/* STT_SECTION */
1082 		0,			/* STT_FILE */
1083 		1,			/* STT_COMMON */
1084 		0,			/* STT_TLS */
1085 		0,			/* 7 */
1086 		0,			/* 8 */
1087 		0,			/* 9 */
1088 		0,			/* 10 */
1089 		0,			/* 11 */
1090 		0,			/* 12 */
1091 		0,			/* STT_SPARC_REGISTER */
1092 		0,			/* 14 */
1093 		0,			/* 15 */
1094 	};
1095 #if STT_NUM != (STT_TLS + 1)
1096 #error "STT_NUM has grown. Update addr_symtype[]"
1097 #endif
1098 
1099 	char		index[MAXNDXSIZE];
1100 	const char	*symname, *sec;
1101 	Versym		verndx;
1102 	int		gnuver;
1103 	uchar_t		type;
1104 	Shdr		*tshdr;
1105 	Word		shndx;
1106 	Conv_inv_buf_t	inv_buf;
1107 
1108 	/* Ensure symbol index is in range */
1109 	if (symndx >= state->symn) {
1110 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSYMNDX),
1111 		    state->file, state->secname, EC_WORD(symndx));
1112 		return;
1113 	}
1114 
1115 	/*
1116 	 * If we are using extended symbol indexes, find the
1117 	 * corresponding SHN_SYMTAB_SHNDX table.
1118 	 */
1119 	if ((sym->st_shndx == SHN_XINDEX) && (state->shxndx.checked == 0))
1120 		symbols_getxindex(state);
1121 
1122 	/* LINTED */
1123 	symname = string(state->seccache, symndx,
1124 	    &state->cache[state->seccache->c_shdr->sh_link], state->file,
1125 	    sym->st_name);
1126 
1127 	tshdr = NULL;
1128 	sec = NULL;
1129 
1130 	if (state->ehdr->e_type == ET_CORE) {
1131 		sec = (char *)MSG_INTL(MSG_STR_UNKNOWN);
1132 	} else if (state->flags & FLG_CTL_FAKESHDR) {
1133 		/*
1134 		 * If we are using fake section headers derived from
1135 		 * the program headers, then the section indexes
1136 		 * in the symbols do not correspond to these headers.
1137 		 * The section names are not available, so all we can
1138 		 * do is to display them in numeric form.
1139 		 */
1140 		sec = conv_sym_shndx(state->osabi, state->ehdr->e_machine,
1141 		    sym->st_shndx, CONV_FMT_DECIMAL, &inv_buf);
1142 	} else if ((sym->st_shndx < SHN_LORESERVE) &&
1143 	    (sym->st_shndx < state->shnum)) {
1144 		shndx = sym->st_shndx;
1145 		tshdr = state->cache[shndx].c_shdr;
1146 		sec = state->cache[shndx].c_name;
1147 	} else if (sym->st_shndx == SHN_XINDEX) {
1148 		if (state->shxndx.data) {
1149 			Word	_shxndx;
1150 
1151 			if (symndx > state->shxndx.n) {
1152 				(void) fprintf(stderr,
1153 				    MSG_INTL(MSG_ERR_BADSYMXINDEX1),
1154 				    state->file, state->secname,
1155 				    EC_WORD(symndx));
1156 			} else if ((_shxndx =
1157 			    state->shxndx.data[symndx]) > state->shnum) {
1158 				(void) fprintf(stderr,
1159 				    MSG_INTL(MSG_ERR_BADSYMXINDEX2),
1160 				    state->file, state->secname,
1161 				    EC_WORD(symndx), EC_WORD(_shxndx));
1162 			} else {
1163 				shndx = _shxndx;
1164 				tshdr = state->cache[shndx].c_shdr;
1165 				sec = state->cache[shndx].c_name;
1166 			}
1167 		} else {
1168 			(void) fprintf(stderr,
1169 			    MSG_INTL(MSG_ERR_BADSYMXINDEX3),
1170 			    state->file, state->secname, EC_WORD(symndx));
1171 		}
1172 	} else if ((sym->st_shndx < SHN_LORESERVE) &&
1173 	    (sym->st_shndx >= state->shnum)) {
1174 		(void) fprintf(stderr,
1175 		    MSG_INTL(MSG_ERR_BADSYM5), state->file,
1176 		    state->secname, EC_WORD(symndx),
1177 		    demangle(symname, state->flags), sym->st_shndx);
1178 	}
1179 
1180 	/*
1181 	 * If versioning is available display the
1182 	 * version index. If not, then use 0.
1183 	 */
1184 	if (state->versym) {
1185 		Versym test_verndx;
1186 
1187 		verndx = test_verndx = state->versym->data[symndx];
1188 		gnuver = state->versym->gnu_full;
1189 
1190 		/*
1191 		 * Check to see if this is a defined symbol with a
1192 		 * version index that is outside the valid range for
1193 		 * the file. The interpretation of this depends on
1194 		 * the style of versioning used by the object.
1195 		 *
1196 		 * Versions >= VER_NDX_LORESERVE have special meanings,
1197 		 * and are exempt from this checking.
1198 		 *
1199 		 * GNU style version indexes use the top bit of the
1200 		 * 16-bit index value (0x8000) as the "hidden bit".
1201 		 * We must mask off this bit in order to compare
1202 		 * the version against the maximum value.
1203 		 */
1204 		if (gnuver)
1205 			test_verndx &= ~0x8000;
1206 
1207 		if ((test_verndx > state->versym->max_verndx) &&
1208 		    (verndx < VER_NDX_LORESERVE))
1209 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADVER),
1210 			    state->file, state->secname, EC_WORD(symndx),
1211 			    EC_HALF(test_verndx), state->versym->max_verndx);
1212 	} else {
1213 		verndx = 0;
1214 		gnuver = 0;
1215 	}
1216 
1217 	/*
1218 	 * Error checking for TLS.
1219 	 */
1220 	type = ELF_ST_TYPE(sym->st_info);
1221 	if (type == STT_TLS) {
1222 		if (tshdr &&
1223 		    (sym->st_shndx != SHN_UNDEF) &&
1224 		    ((tshdr->sh_flags & SHF_TLS) == 0)) {
1225 			(void) fprintf(stderr,
1226 			    MSG_INTL(MSG_ERR_BADSYM3), state->file,
1227 			    state->secname, EC_WORD(symndx),
1228 			    demangle(symname, state->flags));
1229 		}
1230 	} else if ((type != STT_SECTION) && sym->st_size &&
1231 	    tshdr && (tshdr->sh_flags & SHF_TLS)) {
1232 		(void) fprintf(stderr,
1233 		    MSG_INTL(MSG_ERR_BADSYM4), state->file,
1234 		    state->secname, EC_WORD(symndx),
1235 		    demangle(symname, state->flags));
1236 	}
1237 
1238 	/*
1239 	 * If a symbol with non-zero size has a type that
1240 	 * specifies an address, then make sure the location
1241 	 * it references is actually contained within the
1242 	 * section.  UNDEF symbols don't count in this case,
1243 	 * so we ignore them.
1244 	 *
1245 	 * The meaning of the st_value field in a symbol
1246 	 * depends on the type of object. For a relocatable
1247 	 * object, it is the offset within the section.
1248 	 * For sharable objects, it is the offset relative to
1249 	 * the base of the object, and for other types, it is
1250 	 * the virtual address. To get an offset within the
1251 	 * section for non-ET_REL files, we subtract the
1252 	 * base address of the section.
1253 	 */
1254 	if (addr_symtype[type] && (sym->st_size > 0) &&
1255 	    (sym->st_shndx != SHN_UNDEF) && ((sym->st_shndx < SHN_LORESERVE) ||
1256 	    (sym->st_shndx == SHN_XINDEX)) && (tshdr != NULL)) {
1257 		Word v = sym->st_value;
1258 			if (state->ehdr->e_type != ET_REL)
1259 				v -= tshdr->sh_addr;
1260 		if (((v + sym->st_size) > tshdr->sh_size)) {
1261 			(void) fprintf(stderr,
1262 			    MSG_INTL(MSG_ERR_BADSYM6), state->file,
1263 			    state->secname, EC_WORD(symndx),
1264 			    demangle(symname, state->flags),
1265 			    EC_WORD(shndx), EC_XWORD(tshdr->sh_size),
1266 			    EC_XWORD(sym->st_value), EC_XWORD(sym->st_size));
1267 		}
1268 	}
1269 
1270 	/*
1271 	 * A typical symbol table uses the sh_info field to indicate one greater
1272 	 * than the symbol table index of the last local symbol, STB_LOCAL.
1273 	 * Therefore, symbol indexes less than sh_info should have local
1274 	 * binding.  Symbol indexes greater than, or equal to sh_info, should
1275 	 * have global binding.  Note, we exclude UNDEF/NOTY symbols with zero
1276 	 * value and size, as these symbols may be the result of an mcs(1)
1277 	 * section deletion.
1278 	 */
1279 	if (info) {
1280 		uchar_t	bind = ELF_ST_BIND(sym->st_info);
1281 
1282 		if ((symndx < info) && (bind != STB_LOCAL)) {
1283 			(void) fprintf(stderr,
1284 			    MSG_INTL(MSG_ERR_BADSYM7), state->file,
1285 			    state->secname, EC_WORD(symndx),
1286 			    demangle(symname, state->flags), EC_XWORD(info));
1287 
1288 		} else if ((symndx >= info) && (bind == STB_LOCAL) &&
1289 		    ((sym->st_shndx != SHN_UNDEF) ||
1290 		    (ELF_ST_TYPE(sym->st_info) != STT_NOTYPE) ||
1291 		    (sym->st_size != 0) || (sym->st_value != 0))) {
1292 			(void) fprintf(stderr,
1293 			    MSG_INTL(MSG_ERR_BADSYM8), state->file,
1294 			    state->secname, EC_WORD(symndx),
1295 			    demangle(symname, state->flags), EC_XWORD(info));
1296 		}
1297 	}
1298 
1299 	(void) snprintf(index, MAXNDXSIZE,
1300 	    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(disp_symndx));
1301 	Elf_syms_table_entry(0, ELF_DBG_ELFDUMP, index, state->osabi,
1302 	    state->ehdr->e_machine, sym, verndx, gnuver, sec, symname);
1303 }
1304 
1305 /*
1306  * Process a SHT_SUNW_cap capabilities section.
1307  */
1308 static int
cap_section(const char * file,Cache * cache,Word shnum,Cache * ccache,uchar_t osabi,Ehdr * ehdr,uint_t flags)1309 cap_section(const char *file, Cache *cache, Word shnum, Cache *ccache,
1310     uchar_t osabi, Ehdr *ehdr, uint_t flags)
1311 {
1312 	SYMTBL_STATE	state;
1313 	Word		cnum, capnum, nulls, symcaps;
1314 	int		descapndx, objcap, title;
1315 	Cap		*cap = (Cap *)ccache->c_data->d_buf;
1316 	Shdr		*cishdr, *cshdr = ccache->c_shdr;
1317 	Cache		*cicache, *strcache;
1318 	Capinfo		*capinfo = NULL;
1319 	Word		capinfonum;
1320 	const char	*strs = NULL;
1321 	size_t		strs_size;
1322 
1323 	if ((cshdr->sh_entsize == 0) || (cshdr->sh_size == 0)) {
1324 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1325 		    file, ccache->c_name);
1326 		return (0);
1327 	}
1328 
1329 	/*
1330 	 * If this capabilities section is associated with symbols, then the
1331 	 * sh_link field points to the associated capabilities information
1332 	 * section.  The sh_link field of the capabilities information section
1333 	 * points to the associated symbol table.
1334 	 */
1335 	if (cshdr->sh_link) {
1336 		Cache	*scache;
1337 		Shdr	*sshdr;
1338 
1339 		/*
1340 		 * Validate that the sh_link field points to a capabilities
1341 		 * information section.
1342 		 */
1343 		if (cshdr->sh_link >= shnum) {
1344 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1345 			    file, ccache->c_name, EC_WORD(cshdr->sh_link));
1346 			return (0);
1347 		}
1348 
1349 		cicache = &cache[cshdr->sh_link];
1350 		cishdr = cicache->c_shdr;
1351 
1352 		if (cishdr->sh_type != SHT_SUNW_capinfo) {
1353 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAP),
1354 			    file, ccache->c_name, EC_WORD(cshdr->sh_link));
1355 			return (0);
1356 		}
1357 
1358 		capinfo = cicache->c_data->d_buf;
1359 		capinfonum = (Word)(cishdr->sh_size / cishdr->sh_entsize);
1360 
1361 		/*
1362 		 * Validate that the sh_link field of the capabilities
1363 		 * information section points to a valid symbol table.
1364 		 */
1365 		if ((cishdr->sh_link == 0) || (cishdr->sh_link >= shnum)) {
1366 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1367 			    file, cicache->c_name, EC_WORD(cishdr->sh_link));
1368 			return (0);
1369 		}
1370 		scache = &cache[cishdr->sh_link];
1371 		sshdr = scache->c_shdr;
1372 
1373 		if ((sshdr->sh_type != SHT_SYMTAB) &&
1374 		    (sshdr->sh_type != SHT_DYNSYM)) {
1375 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAPINFO1),
1376 			    file, cicache->c_name, EC_WORD(cishdr->sh_link));
1377 			return (0);
1378 		}
1379 
1380 		if (!init_symtbl_state(&state, cache, shnum,
1381 		    cishdr->sh_link, ehdr, osabi, NULL, file, flags))
1382 			return (0);
1383 	}
1384 
1385 	/*
1386 	 * If this capabilities section contains capability string entries,
1387 	 * then determine the associated string table.  Capabilities entries
1388 	 * that define names require that the capability section indicate
1389 	 * which string table to use via sh_info.
1390 	 */
1391 	if (cshdr->sh_info) {
1392 		Shdr	*strshdr;
1393 
1394 		/*
1395 		 * Validate that the sh_info field points to a string table.
1396 		 */
1397 		if (cshdr->sh_info >= shnum) {
1398 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1399 			    file, ccache->c_name, EC_WORD(cshdr->sh_info));
1400 			return (0);
1401 		}
1402 
1403 		strcache = &cache[cshdr->sh_info];
1404 		strshdr = strcache->c_shdr;
1405 
1406 		if (strshdr->sh_type != SHT_STRTAB) {
1407 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAP),
1408 			    file, ccache->c_name, EC_WORD(cshdr->sh_info));
1409 			return (0);
1410 		}
1411 		strs = (const char *)strcache->c_data->d_buf;
1412 		strs_size = strcache->c_data->d_size;
1413 	}
1414 
1415 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1416 	dbg_print(0, MSG_INTL(MSG_ELF_SCN_CAP), ccache->c_name);
1417 
1418 	capnum = (Word)(cshdr->sh_size / cshdr->sh_entsize);
1419 
1420 	nulls = symcaps = 0;
1421 	objcap = title = 1;
1422 	descapndx = -1;
1423 
1424 	/*
1425 	 * Traverse the capabilities section printing each capability group.
1426 	 * The first capabilities group defines any object capabilities.  Any
1427 	 * following groups define symbol capabilities.  In the case where no
1428 	 * object capabilities exist, but symbol capabilities do, a single
1429 	 * CA_SUNW_NULL terminator for the object capabilities exists.
1430 	 */
1431 	for (cnum = 0; cnum < capnum; cap++, cnum++) {
1432 		if (cap->c_tag == CA_SUNW_NULL) {
1433 			/*
1434 			 * A CA_SUNW_NULL tag terminates a capabilities group.
1435 			 * If the first capabilities tag is CA_SUNW_NULL, then
1436 			 * no object capabilities exist.
1437 			 */
1438 			if ((nulls++ == 0) && (cnum == 0))
1439 				objcap = 0;
1440 			title = 1;
1441 		} else {
1442 			if (title) {
1443 				if (nulls == 0) {
1444 					/*
1445 					 * If this capabilities group represents
1446 					 * the object capabilities (i.e., no
1447 					 * CA_SUNW_NULL tag has been processed
1448 					 * yet), then display an object
1449 					 * capabilities title.
1450 					 */
1451 					dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1452 					dbg_print(0,
1453 					    MSG_INTL(MSG_OBJ_CAP_TITLE));
1454 				} else {
1455 					/*
1456 					 * If this is a symbols capabilities
1457 					 * group (i.e., a CA_SUNW_NULL tag has
1458 					 * already be found that terminates
1459 					 * the object capabilities group), then
1460 					 * display a symbol capabilities title,
1461 					 * and retain this capabilities index
1462 					 * for later processing.
1463 					 */
1464 					dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1465 					dbg_print(0,
1466 					    MSG_INTL(MSG_SYM_CAP_TITLE));
1467 					descapndx = cnum;
1468 				}
1469 				Elf_cap_title(0);
1470 				title = 0;
1471 			}
1472 
1473 			/*
1474 			 * Print the capabilities data.
1475 			 *
1476 			 * Note that CA_SUNW_PLAT, CA_SUNW_MACH and CA_SUNW_ID
1477 			 * entries require a string table, which should have
1478 			 * already been established.
1479 			 */
1480 			if ((strs == NULL) && ((cap->c_tag == CA_SUNW_PLAT) ||
1481 			    (cap->c_tag == CA_SUNW_MACH) ||
1482 			    (cap->c_tag == CA_SUNW_ID))) {
1483 				(void) fprintf(stderr,
1484 				    MSG_INTL(MSG_WARN_INVCAP4), file,
1485 				    EC_WORD(elf_ndxscn(ccache->c_scn)),
1486 				    ccache->c_name, EC_WORD(cshdr->sh_info));
1487 			}
1488 			Elf_cap_entry(0, cap, cnum, strs, strs_size,
1489 			    ehdr->e_machine);
1490 		}
1491 
1492 		/*
1493 		 * If this CA_SUNW_NULL tag terminates a symbol capabilities
1494 		 * group, determine the associated symbols.
1495 		 */
1496 		if ((cap->c_tag == CA_SUNW_NULL) && (nulls > 1) &&
1497 		    (descapndx != -1)) {
1498 			Capinfo	*cip;
1499 			Word	inum;
1500 
1501 			symcaps++;
1502 
1503 			/*
1504 			 * Make sure we've discovered a SHT_SUNW_capinfo table.
1505 			 */
1506 			if ((cip = capinfo) == NULL) {
1507 				(void) fprintf(stderr,
1508 				    MSG_INTL(MSG_ERR_INVCAP), file,
1509 				    ccache->c_name, EC_WORD(cshdr->sh_link));
1510 				return (0);
1511 			}
1512 
1513 			/*
1514 			 * Determine what symbols reference this capabilities
1515 			 * group.
1516 			 */
1517 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1518 			dbg_print(0, MSG_INTL(MSG_CAPINFO_ENTRIES));
1519 			Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
1520 
1521 			for (inum = 1, cip++; inum < capinfonum;
1522 			    inum++, cip++) {
1523 				Word	gndx = (Word)ELF_C_GROUP(*cip);
1524 
1525 				if (gndx && (gndx == descapndx)) {
1526 					output_symbol(&state, inum, 0,
1527 					    inum, state.sym + inum);
1528 				}
1529 			}
1530 			descapndx = -1;
1531 			continue;
1532 		}
1533 
1534 		/*
1535 		 * An SF1_SUNW_ADDR32 software capability tag in a 32-bit
1536 		 * object is suspicious as it has no effect.
1537 		 */
1538 		if ((cap->c_tag == CA_SUNW_SF_1) &&
1539 		    (ehdr->e_ident[EI_CLASS] == ELFCLASS32) &&
1540 		    (cap->c_un.c_val & SF1_SUNW_ADDR32)) {
1541 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INADDR32SF1),
1542 			    file, ccache->c_name);
1543 		}
1544 	}
1545 
1546 	/*
1547 	 * If this is a dynamic object, with symbol capabilities, then a
1548 	 * .SUNW_capchain section should exist.  This section contains a chain
1549 	 * of symbol indexes for each capabilities family.  This is the list
1550 	 * that is searched by ld.so.1 to determine the best capabilities
1551 	 * candidate.
1552 	 *
1553 	 * Note, more than one capabilities lead symbol can point to the same
1554 	 * family chain.  For example, a weak/global pair of symbols can both
1555 	 * represent the same family of capabilities symbols.  Therefore, to
1556 	 * display all possible families we traverse the capabilities
1557 	 * information section looking for CAPINFO_SUNW_GLOB lead symbols.
1558 	 * From these we determine the associated capabilities chain to inspect.
1559 	 */
1560 	if (symcaps &&
1561 	    ((ehdr->e_type == ET_EXEC) || (ehdr->e_type == ET_DYN))) {
1562 		Capinfo		*cip;
1563 		Capchain	*chain;
1564 		Cache   	*chcache;
1565 		Shdr		*chshdr;
1566 		Word		chainnum, inum;
1567 
1568 		/*
1569 		 * Validate that the sh_info field of the capabilities
1570 		 * information section points to a capabilities chain section.
1571 		 */
1572 		if (cishdr->sh_info >= shnum) {
1573 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1574 			    file, cicache->c_name, EC_WORD(cishdr->sh_info));
1575 			return (0);
1576 		}
1577 
1578 		chcache = &cache[cishdr->sh_info];
1579 		chshdr = chcache->c_shdr;
1580 
1581 		if (chshdr->sh_type != SHT_SUNW_capchain) {
1582 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAPINFO2),
1583 			    file, cicache->c_name, EC_WORD(cishdr->sh_info));
1584 			return (0);
1585 		}
1586 
1587 		chainnum = (Word)(chshdr->sh_size / chshdr->sh_entsize);
1588 		chain = (Capchain *)chcache->c_data->d_buf;
1589 
1590 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1591 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_CAPCHAIN), chcache->c_name);
1592 
1593 		/*
1594 		 * Traverse the capabilities information section looking for
1595 		 * CAPINFO_SUNW_GLOB lead capabilities symbols.
1596 		 */
1597 		cip = capinfo;
1598 		for (inum = 1, cip++; inum < capinfonum; inum++, cip++) {
1599 			const char	*name;
1600 			Sym		*sym;
1601 			Word		sndx, cndx;
1602 			Word		gndx = (Word)ELF_C_GROUP(*cip);
1603 
1604 			if ((gndx == 0) || (gndx != CAPINFO_SUNW_GLOB))
1605 				continue;
1606 
1607 			/*
1608 			 * Determine the symbol that is associated with this
1609 			 * capability information entry, and use this to
1610 			 * identify this capability family.
1611 			 */
1612 			sym = (Sym *)(state.sym + inum);
1613 			name = string(cicache, inum, strcache, file,
1614 			    sym->st_name);
1615 
1616 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1617 			dbg_print(0, MSG_INTL(MSG_CAPCHAIN_TITLE), name);
1618 			dbg_print(0, MSG_INTL(MSG_CAPCHAIN_ENTRY));
1619 
1620 			cndx = (Word)ELF_C_SYM(*cip);
1621 
1622 			/*
1623 			 * Traverse this families chain and identify each
1624 			 * family member.
1625 			 */
1626 			for (;;) {
1627 				char	_chain[MAXNDXSIZE], _symndx[MAXNDXSIZE];
1628 
1629 				if (cndx >= chainnum) {
1630 					(void) fprintf(stderr,
1631 					    MSG_INTL(MSG_ERR_INVCAPINFO3), file,
1632 					    cicache->c_name, EC_WORD(inum),
1633 					    EC_WORD(cndx));
1634 					break;
1635 				}
1636 				if ((sndx = chain[cndx]) == 0)
1637 					break;
1638 
1639 				/*
1640 				 * Determine this entries symbol reference.
1641 				 */
1642 				if (sndx > state.symn) {
1643 					(void) fprintf(stderr,
1644 					    MSG_INTL(MSG_ERR_CHBADSYMNDX), file,
1645 					    EC_WORD(sndx), chcache->c_name,
1646 					    EC_WORD(cndx));
1647 					name = MSG_INTL(MSG_STR_UNKNOWN);
1648 				} else {
1649 					sym = (Sym *)(state.sym + sndx);
1650 					name = string(chcache, sndx,
1651 					    strcache, file, sym->st_name);
1652 				}
1653 
1654 				/*
1655 				 * Display the family member.
1656 				 */
1657 				(void) snprintf(_chain, MAXNDXSIZE,
1658 				    MSG_ORIG(MSG_FMT_INTEGER), cndx);
1659 				(void) snprintf(_symndx, MAXNDXSIZE,
1660 				    MSG_ORIG(MSG_FMT_INDEX2), EC_WORD(sndx));
1661 				dbg_print(0, MSG_ORIG(MSG_FMT_CHAIN_INFO),
1662 				    _chain, _symndx, demangle(name, flags));
1663 
1664 				cndx++;
1665 			}
1666 		}
1667 	}
1668 	return (objcap);
1669 }
1670 
1671 /*
1672  * Print the capabilities.
1673  *
1674  * A .SUNW_cap section can contain one or more, CA_SUNW_NULL terminated,
1675  * capabilities groups.  The first group defines the object capabilities.
1676  * This group defines the minimum capability requirements of the entire
1677  * object file.  If this is a dynamic object, this group should be associated
1678  * with a PT_SUNWCAP program header.
1679  *
1680  * Additional capabilities groups define the association of individual symbols
1681  * to specific capabilities.
1682  */
1683 static void
cap(const char * file,Cache * cache,Word shnum,Word phnum,Ehdr * ehdr,uchar_t osabi,Elf * elf,uint_t flags)1684 cap(const char *file, Cache *cache, Word shnum, Word phnum, Ehdr *ehdr,
1685     uchar_t osabi, Elf *elf, uint_t flags)
1686 {
1687 	Word		cnt;
1688 	Shdr		*cshdr = NULL;
1689 	Cache		*ccache;
1690 	Off		cphdr_off = 0;
1691 	Xword		cphdr_sz;
1692 
1693 	/*
1694 	 * Determine if a global capabilities header exists.
1695 	 */
1696 	if (phnum) {
1697 		Phdr	*phdr;
1698 
1699 		if ((phdr = elf_getphdr(elf)) == NULL) {
1700 			failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
1701 			return;
1702 		}
1703 
1704 		for (cnt = 0; cnt < phnum; phdr++, cnt++) {
1705 			if (phdr->p_type == PT_SUNWCAP) {
1706 				cphdr_off = phdr->p_offset;
1707 				cphdr_sz = phdr->p_filesz;
1708 				break;
1709 			}
1710 		}
1711 	}
1712 
1713 	/*
1714 	 * Determine if a capabilities section exists.
1715 	 */
1716 	for (cnt = 1; cnt < shnum; cnt++) {
1717 		Cache	*_cache = &cache[cnt];
1718 		Shdr	*shdr = _cache->c_shdr;
1719 
1720 		/*
1721 		 * Process any capabilities information.
1722 		 */
1723 		if (shdr->sh_type == SHT_SUNW_cap) {
1724 			if (cap_section(file, cache, shnum, _cache, osabi,
1725 			    ehdr, flags)) {
1726 				/*
1727 				 * If this section defined an object capability
1728 				 * group, retain the section information for
1729 				 * program header validation.
1730 				 */
1731 				ccache = _cache;
1732 				cshdr = shdr;
1733 			}
1734 			continue;
1735 		}
1736 	}
1737 
1738 	if ((cshdr == NULL) && (cphdr_off == 0))
1739 		return;
1740 
1741 	if (cphdr_off && (cshdr == NULL))
1742 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP1), file);
1743 
1744 	/*
1745 	 * If this object is an executable or shared object, and it provided
1746 	 * an object capabilities group, then the group should have an
1747 	 * accompanying PT_SUNWCAP program header.
1748 	 */
1749 	if (cshdr && ((ehdr->e_type == ET_EXEC) || (ehdr->e_type == ET_DYN))) {
1750 		if (cphdr_off == 0) {
1751 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP2),
1752 			    file, EC_WORD(elf_ndxscn(ccache->c_scn)),
1753 			    ccache->c_name);
1754 		} else if ((cphdr_off != cshdr->sh_offset) ||
1755 		    (cphdr_sz != cshdr->sh_size)) {
1756 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP3),
1757 			    file, EC_WORD(elf_ndxscn(ccache->c_scn)),
1758 			    ccache->c_name);
1759 		}
1760 	}
1761 }
1762 
1763 /*
1764  * Print the interpretor.
1765  */
1766 static void
interp(const char * file,Cache * cache,Word shnum,Word phnum,Elf * elf)1767 interp(const char *file, Cache *cache, Word shnum, Word phnum, Elf *elf)
1768 {
1769 	static Word phdr_types[] = { PT_INTERP };
1770 
1771 
1772 	Word	cnt;
1773 	Shdr	*ishdr = NULL;
1774 	Cache	*icache;
1775 	Off	iphdr_off = 0;
1776 	Xword	iphdr_fsz;
1777 
1778 	/*
1779 	 * Determine if an interp header exists.
1780 	 */
1781 	if (phnum) {
1782 		Phdr	*phdr;
1783 
1784 		phdr = getphdr(phnum, phdr_types,
1785 		    sizeof (phdr_types) / sizeof (*phdr_types), file, elf);
1786 		if (phdr != NULL) {
1787 			iphdr_off = phdr->p_offset;
1788 			iphdr_fsz = phdr->p_filesz;
1789 		}
1790 	}
1791 
1792 	if (iphdr_off == 0)
1793 		return;
1794 
1795 	/*
1796 	 * Determine if an interp section exists.
1797 	 */
1798 	for (cnt = 1; cnt < shnum; cnt++) {
1799 		Cache	*_cache = &cache[cnt];
1800 		Shdr	*shdr = _cache->c_shdr;
1801 
1802 		/*
1803 		 * Scan sections to find a section which contains the PT_INTERP
1804 		 * string.  The target section can't be in a NOBITS section.
1805 		 */
1806 		if ((shdr->sh_type == SHT_NOBITS) ||
1807 		    (iphdr_off < shdr->sh_offset) ||
1808 		    (iphdr_off + iphdr_fsz) > (shdr->sh_offset + shdr->sh_size))
1809 			continue;
1810 
1811 		icache = _cache;
1812 		ishdr = shdr;
1813 		break;
1814 	}
1815 
1816 	/*
1817 	 * Print the interpreter string based on the offset defined in the
1818 	 * program header, as this is the offset used by the kernel.
1819 	 */
1820 	if (ishdr && icache->c_data) {
1821 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1822 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_INTERP), icache->c_name);
1823 		dbg_print(0, MSG_ORIG(MSG_FMT_INDENT),
1824 		    (char *)icache->c_data->d_buf +
1825 		    (iphdr_off - ishdr->sh_offset));
1826 	} else
1827 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVINTERP1), file);
1828 
1829 	/*
1830 	 * If there are any inconsistences between the program header and
1831 	 * section information, flag them.
1832 	 */
1833 	if (ishdr && ((iphdr_off != ishdr->sh_offset) ||
1834 	    (iphdr_fsz != ishdr->sh_size))) {
1835 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVINTERP2), file,
1836 		    icache->c_name);
1837 	}
1838 }
1839 
1840 /*
1841  * Print the syminfo section.
1842  */
1843 static void
syminfo(Cache * cache,Word shnum,Ehdr * ehdr,uchar_t osabi,const char * file)1844 syminfo(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
1845 {
1846 	Shdr		*infoshdr;
1847 	Syminfo		*info;
1848 	Sym		*syms;
1849 	Dyn		*dyns;
1850 	Word		infonum, cnt, ndx, symnum, dynnum;
1851 	Cache		*infocache = NULL, *dyncache = NULL, *symsec, *strsec;
1852 	Boolean		*dynerr;
1853 
1854 	for (cnt = 1; cnt < shnum; cnt++) {
1855 		if (cache[cnt].c_shdr->sh_type == SHT_SUNW_syminfo) {
1856 			infocache = &cache[cnt];
1857 			break;
1858 		}
1859 	}
1860 	if (infocache == NULL)
1861 		return;
1862 
1863 	infoshdr = infocache->c_shdr;
1864 	if ((infoshdr->sh_entsize == 0) || (infoshdr->sh_size == 0)) {
1865 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1866 		    file, infocache->c_name);
1867 		return;
1868 	}
1869 	if (infocache->c_data == NULL)
1870 		return;
1871 
1872 	infonum = (Word)(infoshdr->sh_size / infoshdr->sh_entsize);
1873 	info = (Syminfo *)infocache->c_data->d_buf;
1874 
1875 	/*
1876 	 * If there is no associated dynamic section, determine if one
1877 	 * is needed, and if so issue a warning. If there is an
1878 	 * associated dynamic section, validate it and get the data buffer
1879 	 * for it.
1880 	 */
1881 	dyns = NULL;
1882 	dynnum = 0;
1883 	if (infoshdr->sh_info == 0) {
1884 		Syminfo	*_info = info + 1;
1885 
1886 		for (ndx = 1; ndx < infonum; ndx++, _info++) {
1887 			if ((_info->si_flags == 0) && (_info->si_boundto == 0))
1888 				continue;
1889 
1890 			if (_info->si_boundto < SYMINFO_BT_LOWRESERVE)
1891 				(void) fprintf(stderr,
1892 				    MSG_INTL(MSG_ERR_BADSHINFO), file,
1893 				    infocache->c_name,
1894 				    EC_WORD(infoshdr->sh_info));
1895 		}
1896 	} else if ((infoshdr->sh_info >= shnum) ||
1897 	    (cache[infoshdr->sh_info].c_shdr->sh_type != SHT_DYNAMIC)) {
1898 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHINFO),
1899 		    file, infocache->c_name, EC_WORD(infoshdr->sh_info));
1900 	} else {
1901 		dyncache = &cache[infoshdr->sh_info];
1902 		if ((dyncache->c_data == NULL) ||
1903 		    ((dyns = dyncache->c_data->d_buf) == NULL)) {
1904 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1905 			    file, dyncache->c_name);
1906 		}
1907 		if (dyns != NULL) {
1908 			dynnum = dyncache->c_shdr->sh_size /
1909 			    dyncache->c_shdr->sh_entsize;
1910 
1911 			/*
1912 			 * We validate the type of dynamic elements referenced
1913 			 * from the syminfo. This array is used report any
1914 			 * bad dynamic entries.
1915 			 */
1916 			if ((dynerr = calloc(dynnum, sizeof (*dynerr))) ==
1917 			    NULL) {
1918 				int err = errno;
1919 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
1920 				    file, strerror(err));
1921 				return;
1922 			}
1923 		}
1924 	}
1925 
1926 	/*
1927 	 * Get the data buffer for the associated symbol table and string table.
1928 	 */
1929 	if (stringtbl(cache, 1, cnt, shnum, file,
1930 	    &symnum, &symsec, &strsec) == 0)
1931 		return;
1932 
1933 	syms = symsec->c_data->d_buf;
1934 
1935 	/*
1936 	 * Loop through the syminfo entries.
1937 	 */
1938 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1939 	dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMINFO), infocache->c_name);
1940 	Elf_syminfo_title(0);
1941 
1942 	for (ndx = 1, info++; ndx < infonum; ndx++, info++) {
1943 		Sym 		*sym;
1944 		const char	*needed, *name;
1945 		Word		expect_dt;
1946 		Word		boundto = info->si_boundto;
1947 
1948 		if ((info->si_flags == 0) && (boundto == 0))
1949 			continue;
1950 
1951 		sym = &syms[ndx];
1952 		name = string(infocache, ndx, strsec, file, sym->st_name);
1953 
1954 		/* Is si_boundto set to one of the reserved values? */
1955 		if (boundto >= SYMINFO_BT_LOWRESERVE) {
1956 			Elf_syminfo_entry(0, ndx, info, name, NULL);
1957 			continue;
1958 		}
1959 
1960 		/*
1961 		 * si_boundto is referencing a dynamic section. If we don't
1962 		 * have one, an error was already issued above, so it suffices
1963 		 * to display an empty string. If we are out of bounds, then
1964 		 * report that and then display an empty string.
1965 		 */
1966 		if ((dyns == NULL) || (boundto >= dynnum)) {
1967 			if (dyns != NULL)
1968 				(void) fprintf(stderr,
1969 				    MSG_INTL(MSG_ERR_BADSIDYNNDX), file,
1970 				    infocache->c_ndx, infocache->c_name,
1971 				    EC_WORD(ndx), EC_WORD(dynnum - 1),
1972 				    EC_WORD(boundto));
1973 			Elf_syminfo_entry(0, ndx, info, name,
1974 			    MSG_ORIG(MSG_STR_EMPTY));
1975 			continue;
1976 		}
1977 
1978 		/*
1979 		 * The si_boundto reference expects a specific dynamic element
1980 		 * type at the given index. The dynamic element is always a
1981 		 * string that gives an object name. The specific type depends
1982 		 * on the si_flags present. Ensure that we've got the right
1983 		 * type.
1984 		 */
1985 		if (info->si_flags & SYMINFO_FLG_FILTER)
1986 			expect_dt = DT_SUNW_FILTER;
1987 		else if (info->si_flags & SYMINFO_FLG_AUXILIARY)
1988 			expect_dt = DT_SUNW_AUXILIARY;
1989 		else if (info->si_flags & (SYMINFO_FLG_DIRECT |
1990 		    SYMINFO_FLG_LAZYLOAD | SYMINFO_FLG_DIRECTBIND))
1991 			expect_dt = DT_NEEDED;
1992 		else
1993 			expect_dt = DT_NULL;   /* means we ignore the type */
1994 
1995 		if ((dyns[boundto].d_tag != expect_dt) &&
1996 		    (expect_dt != DT_NULL)) {
1997 			Conv_inv_buf_t	buf1, buf2;
1998 
1999 			/* Only complain about each dynamic element once */
2000 			if (!dynerr[boundto]) {
2001 				(void) fprintf(stderr,
2002 				    MSG_INTL(MSG_ERR_BADSIDYNTAG),
2003 				    file, infocache->c_ndx, infocache->c_name,
2004 				    EC_WORD(ndx), dyncache->c_ndx,
2005 				    dyncache->c_name, EC_WORD(boundto),
2006 				    conv_dyn_tag(expect_dt, osabi,
2007 				    ehdr->e_machine, CONV_FMT_ALT_CF, &buf1),
2008 				    conv_dyn_tag(dyns[boundto].d_tag, osabi,
2009 				    ehdr->e_machine, CONV_FMT_ALT_CF, &buf2));
2010 				dynerr[boundto] = TRUE;
2011 			}
2012 		}
2013 
2014 		/*
2015 		 * Whether or not the DT item we're pointing at is
2016 		 * of the right type, if it's a type we recognize as
2017 		 * providing a string, go ahead and show it. Otherwise
2018 		 * an empty string.
2019 		 */
2020 		switch (dyns[boundto].d_tag) {
2021 		case DT_NEEDED:
2022 		case DT_SONAME:
2023 		case DT_RPATH:
2024 		case DT_RUNPATH:
2025 		case DT_CONFIG:
2026 		case DT_DEPAUDIT:
2027 		case DT_USED:
2028 		case DT_AUDIT:
2029 		case DT_SUNW_AUXILIARY:
2030 		case DT_SUNW_FILTER:
2031 		case DT_FILTER:
2032 		case DT_AUXILIARY:
2033 			needed = string(infocache, boundto,
2034 			    strsec, file, dyns[boundto].d_un.d_val);
2035 			break;
2036 		default:
2037 			needed = MSG_ORIG(MSG_STR_EMPTY);
2038 		}
2039 		Elf_syminfo_entry(0, ndx, info, name, needed);
2040 	}
2041 	if (dyns != NULL)
2042 		free(dynerr);
2043 }
2044 
2045 /*
2046  * Print version definition section entries.
2047  */
2048 static void
version_def(Verdef * vdf,Word vdf_num,Cache * vcache,Cache * scache,const char * file)2049 version_def(Verdef *vdf, Word vdf_num, Cache *vcache, Cache *scache,
2050     const char *file)
2051 {
2052 	Word	cnt;
2053 	char	index[MAXNDXSIZE];
2054 
2055 	Elf_ver_def_title(0);
2056 
2057 	for (cnt = 1; cnt <= vdf_num; cnt++,
2058 	    vdf = (Verdef *)((uintptr_t)vdf + vdf->vd_next)) {
2059 		Conv_ver_flags_buf_t	ver_flags_buf;
2060 		const char		*name, *dep;
2061 		Half			vcnt = vdf->vd_cnt - 1;
2062 		Half			ndx = vdf->vd_ndx;
2063 		Verdaux	*vdap = (Verdaux *)((uintptr_t)vdf + vdf->vd_aux);
2064 
2065 		/*
2066 		 * Obtain the name and first dependency (if any).
2067 		 */
2068 		name = string(vcache, cnt, scache, file, vdap->vda_name);
2069 		vdap = (Verdaux *)((uintptr_t)vdap + vdap->vda_next);
2070 		if (vcnt)
2071 			dep = string(vcache, cnt, scache, file, vdap->vda_name);
2072 		else
2073 			dep = MSG_ORIG(MSG_STR_EMPTY);
2074 
2075 		(void) snprintf(index, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX),
2076 		    EC_XWORD(ndx));
2077 		Elf_ver_line_1(0, index, name, dep,
2078 		    conv_ver_flags(vdf->vd_flags, 0, &ver_flags_buf));
2079 
2080 		/*
2081 		 * Print any additional dependencies.
2082 		 */
2083 		if (vcnt) {
2084 			vdap = (Verdaux *)((uintptr_t)vdap + vdap->vda_next);
2085 			for (vcnt--; vcnt; vcnt--,
2086 			    vdap = (Verdaux *)((uintptr_t)vdap +
2087 			    vdap->vda_next)) {
2088 				dep = string(vcache, cnt, scache, file,
2089 				    vdap->vda_name);
2090 				Elf_ver_line_2(0, MSG_ORIG(MSG_STR_EMPTY), dep);
2091 			}
2092 		}
2093 	}
2094 }
2095 
2096 /*
2097  * Print version needed section entries.
2098  *
2099  * entry:
2100  *	vnd - Address of verneed data
2101  *	vnd_num - # of Verneed entries
2102  *	vcache - Cache of verneed section being processed
2103  *	scache - Cache of associated string table section
2104  *	file - Name of object being processed.
2105  *	versym - Information about versym section
2106  *
2107  * exit:
2108  *	The versions have been printed. If GNU style versioning
2109  *	is in effect, versym->max_verndx has been updated to
2110  *	contain the largest version index seen.
2111  *
2112  * note:
2113  * 	The versym section of an object that follows the original
2114  *	Solaris versioning rules only contains indexes into the verdef
2115  *	section. Symbols defined in other objects (UNDEF) are given
2116  *	a version of 0, indicating that they are not defined by
2117  *	this file, and the Verneed entries do not have associated version
2118  *	indexes. For these reasons, we do not display a version index
2119  *	for original-style Verneed sections.
2120  *
2121  *	The GNU versioning extensions alter this: Symbols defined in other
2122  *	objects receive a version index in the range above those defined
2123  *	by the Verdef section, and the vna_other field of the Vernaux
2124  *	structs inside the Verneed section contain the version index for
2125  *	that item. We therefore  display the index when showing the
2126  *	contents of a GNU style Verneed section. You should not
2127  *	necessarily expect these indexes to appear in sorted
2128  *	order --- it seems that the GNU ld assigns the versions as
2129  *	symbols are encountered during linking, and then the results
2130  *	are assembled into the Verneed section afterwards.
2131  */
2132 static void
version_need(Verneed * vnd,Word vnd_num,Cache * vcache,Cache * scache,const char * file,VERSYM_STATE * versym)2133 version_need(Verneed *vnd, Word vnd_num, Cache *vcache, Cache *scache,
2134     const char *file, VERSYM_STATE *versym)
2135 {
2136 	Word		cnt;
2137 	char		index[MAXNDXSIZE];
2138 	const char	*index_str;
2139 
2140 	Elf_ver_need_title(0, versym->gnu_needed);
2141 
2142 	for (cnt = 1; cnt <= vnd_num; cnt++,
2143 	    vnd = (Verneed *)((uintptr_t)vnd + vnd->vn_next)) {
2144 		Conv_ver_flags_buf_t	ver_flags_buf;
2145 		const char		*name, *dep;
2146 		Half			vcnt = vnd->vn_cnt;
2147 		Vernaux *vnap = (Vernaux *)((uintptr_t)vnd + vnd->vn_aux);
2148 
2149 		/*
2150 		 * Obtain the name of the needed file and the version name
2151 		 * within it that we're dependent on.  Note that the count
2152 		 * should be at least one, otherwise this is a pretty bogus
2153 		 * entry.
2154 		 */
2155 		name = string(vcache, cnt, scache, file, vnd->vn_file);
2156 		if (vcnt)
2157 			dep = string(vcache, cnt, scache, file, vnap->vna_name);
2158 		else
2159 			dep = MSG_INTL(MSG_STR_NULL);
2160 
2161 		if (vnap->vna_other == 0) {	/* Traditional form */
2162 			index_str = MSG_ORIG(MSG_STR_EMPTY);
2163 		} else {			/* GNU form */
2164 			index_str = index;
2165 			/* Format the version index value */
2166 			(void) snprintf(index, MAXNDXSIZE,
2167 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(vnap->vna_other));
2168 			if (vnap->vna_other > versym->max_verndx)
2169 				versym->max_verndx = vnap->vna_other;
2170 		}
2171 		Elf_ver_line_1(0, index_str, name, dep,
2172 		    conv_ver_flags(vnap->vna_flags, 0, &ver_flags_buf));
2173 
2174 		/*
2175 		 * Print any additional version dependencies.
2176 		 */
2177 		if (vcnt) {
2178 			vnap = (Vernaux *)((uintptr_t)vnap + vnap->vna_next);
2179 			for (vcnt--; vcnt; vcnt--,
2180 			    vnap = (Vernaux *)((uintptr_t)vnap +
2181 			    vnap->vna_next)) {
2182 				dep = string(vcache, cnt, scache, file,
2183 				    vnap->vna_name);
2184 				if (vnap->vna_other > 0) {
2185 					/* Format the next index value */
2186 					(void) snprintf(index, MAXNDXSIZE,
2187 					    MSG_ORIG(MSG_FMT_INDEX),
2188 					    EC_XWORD(vnap->vna_other));
2189 					Elf_ver_line_1(0, index,
2190 					    MSG_ORIG(MSG_STR_EMPTY), dep,
2191 					    conv_ver_flags(vnap->vna_flags,
2192 					    0, &ver_flags_buf));
2193 					if (vnap->vna_other >
2194 					    versym->max_verndx)
2195 						versym->max_verndx =
2196 						    vnap->vna_other;
2197 				} else {
2198 					Elf_ver_line_3(0,
2199 					    MSG_ORIG(MSG_STR_EMPTY), dep,
2200 					    conv_ver_flags(vnap->vna_flags,
2201 					    0, &ver_flags_buf));
2202 				}
2203 			}
2204 		}
2205 	}
2206 }
2207 
2208 /*
2209  * Examine the Verneed section for information related to GNU
2210  * style Versym indexing:
2211  *	- A non-zero vna_other field indicates that Versym indexes can
2212  *		reference Verneed records.
2213  *	- If the object uses GNU style Versym indexing, the
2214  *	  maximum index value is needed to detect bad Versym entries.
2215  *
2216  * entry:
2217  *	vnd - Address of verneed data
2218  *	vnd_num - # of Verneed entries
2219  *	versym - Information about versym section
2220  *
2221  * exit:
2222  *	If a non-zero vna_other field is seen, versym->gnu_needed is set.
2223  *
2224  *	versym->max_verndx has been updated to contain the largest
2225  *	version index seen.
2226  */
2227 static void
update_gnu_verndx(Verneed * vnd,Word vnd_num,VERSYM_STATE * versym)2228 update_gnu_verndx(Verneed *vnd, Word vnd_num, VERSYM_STATE *versym)
2229 {
2230 	Word		cnt;
2231 
2232 	for (cnt = 1; cnt <= vnd_num; cnt++,
2233 	    vnd = (Verneed *)((uintptr_t)vnd + vnd->vn_next)) {
2234 		Half	vcnt = vnd->vn_cnt;
2235 		Vernaux	*vnap = (Vernaux *)((uintptr_t)vnd + vnd->vn_aux);
2236 
2237 		/*
2238 		 * A non-zero value of vna_other indicates that this
2239 		 * object references VERNEED items from the VERSYM
2240 		 * array.
2241 		 */
2242 		if (vnap->vna_other != 0) {
2243 			versym->gnu_needed = 1;
2244 			if (vnap->vna_other > versym->max_verndx)
2245 				versym->max_verndx = vnap->vna_other;
2246 		}
2247 
2248 		/*
2249 		 * Check any additional version dependencies.
2250 		 */
2251 		if (vcnt) {
2252 			vnap = (Vernaux *)((uintptr_t)vnap + vnap->vna_next);
2253 			for (vcnt--; vcnt; vcnt--,
2254 			    vnap = (Vernaux *)((uintptr_t)vnap +
2255 			    vnap->vna_next)) {
2256 				if (vnap->vna_other == 0)
2257 					continue;
2258 
2259 				versym->gnu_needed = 1;
2260 				if (vnap->vna_other > versym->max_verndx)
2261 					versym->max_verndx = vnap->vna_other;
2262 			}
2263 		}
2264 	}
2265 }
2266 
2267 /*
2268  * Display version section information if the flags require it.
2269  * Return version information needed by other output.
2270  *
2271  * entry:
2272  *	cache - Cache of all section headers
2273  *	shnum - # of sections in cache
2274  *	file - Name of file
2275  *	flags - Command line option flags
2276  *	versym - VERSYM_STATE block to be filled in.
2277  */
2278 static void
versions(Cache * cache,Word shnum,const char * file,uint_t flags,VERSYM_STATE * versym)2279 versions(Cache *cache, Word shnum, const char *file, uint_t flags,
2280     VERSYM_STATE *versym)
2281 {
2282 	GElf_Word	cnt;
2283 	Cache		*verdef_cache = NULL, *verneed_cache = NULL;
2284 
2285 
2286 	/* Gather information about the version sections */
2287 	versym->max_verndx = 1;
2288 	for (cnt = 1; cnt < shnum; cnt++) {
2289 		Cache		*_cache = &cache[cnt];
2290 		Shdr		*shdr = _cache->c_shdr;
2291 		Dyn		*dyn;
2292 		ulong_t		numdyn;
2293 
2294 		switch (shdr->sh_type) {
2295 		case SHT_DYNAMIC:
2296 			/*
2297 			 * The GNU ld puts a DT_VERSYM entry in the dynamic
2298 			 * section so that the runtime linker can use it to
2299 			 * implement their versioning rules. They allow multiple
2300 			 * incompatible functions with the same name to exist
2301 			 * in different versions. The Solaris ld does not
2302 			 * support this mechanism, and as such, does not
2303 			 * produce DT_VERSYM. We use this fact to determine
2304 			 * which ld produced this object, and how to interpret
2305 			 * the version values.
2306 			 */
2307 			if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0) ||
2308 			    (_cache->c_data == NULL))
2309 				continue;
2310 			numdyn = shdr->sh_size / shdr->sh_entsize;
2311 			dyn = (Dyn *)_cache->c_data->d_buf;
2312 			for (; numdyn-- > 0; dyn++)
2313 				if (dyn->d_tag == DT_VERSYM) {
2314 					versym->gnu_full =
2315 					    versym->gnu_needed = 1;
2316 					break;
2317 				}
2318 			break;
2319 
2320 		case SHT_SUNW_versym:
2321 			/* Record data address for later symbol processing */
2322 			if (_cache->c_data != NULL) {
2323 				versym->cache = _cache;
2324 				versym->data = _cache->c_data->d_buf;
2325 				continue;
2326 			}
2327 			break;
2328 
2329 		case SHT_SUNW_verdef:
2330 		case SHT_SUNW_verneed:
2331 			/*
2332 			 * Ensure the data is non-NULL and the number
2333 			 * of items is non-zero. Otherwise, we don't
2334 			 * understand the section, and will not use it.
2335 			 */
2336 			if ((_cache->c_data == NULL) ||
2337 			    (_cache->c_data->d_buf == NULL)) {
2338 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2339 				    file, _cache->c_name);
2340 				continue;
2341 			}
2342 			if (shdr->sh_info == 0) {
2343 				(void) fprintf(stderr,
2344 				    MSG_INTL(MSG_ERR_BADSHINFO),
2345 				    file, _cache->c_name,
2346 				    EC_WORD(shdr->sh_info));
2347 				continue;
2348 			}
2349 
2350 			/* Make sure the string table index is in range */
2351 			if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
2352 				(void) fprintf(stderr,
2353 				    MSG_INTL(MSG_ERR_BADSHLINK), file,
2354 				    _cache->c_name, EC_WORD(shdr->sh_link));
2355 				continue;
2356 			}
2357 
2358 			/*
2359 			 * The section is usable. Save the cache entry.
2360 			 */
2361 			if (shdr->sh_type == SHT_SUNW_verdef) {
2362 				verdef_cache = _cache;
2363 				/*
2364 				 * Under Solaris rules, if there is a verdef
2365 				 * section, the max versym index is number
2366 				 * of version definitions it supplies.
2367 				 */
2368 				versym->max_verndx = shdr->sh_info;
2369 			} else {
2370 				verneed_cache = _cache;
2371 			}
2372 			break;
2373 		}
2374 	}
2375 
2376 	/*
2377 	 * If there is a Verneed section, examine it for information
2378 	 * related to GNU style versioning.
2379 	 */
2380 	if (verneed_cache != NULL)
2381 		update_gnu_verndx((Verneed *)verneed_cache->c_data->d_buf,
2382 		    verneed_cache->c_shdr->sh_info, versym);
2383 
2384 	/*
2385 	 * Now that all the information is available, display the
2386 	 * Verdef and Verneed section contents, if requested.
2387 	 */
2388 	if ((flags & FLG_SHOW_VERSIONS) == 0)
2389 		return;
2390 	if (verdef_cache != NULL) {
2391 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2392 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_VERDEF),
2393 		    verdef_cache->c_name);
2394 		version_def((Verdef *)verdef_cache->c_data->d_buf,
2395 		    verdef_cache->c_shdr->sh_info, verdef_cache,
2396 		    &cache[verdef_cache->c_shdr->sh_link], file);
2397 	}
2398 	if (verneed_cache != NULL) {
2399 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2400 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_VERNEED),
2401 		    verneed_cache->c_name);
2402 		/*
2403 		 * If GNU versioning applies to this object, version_need()
2404 		 * will update versym->max_verndx, and it is not
2405 		 * necessary to call update_gnu_verndx().
2406 		 */
2407 		version_need((Verneed *)verneed_cache->c_data->d_buf,
2408 		    verneed_cache->c_shdr->sh_info, verneed_cache,
2409 		    &cache[verneed_cache->c_shdr->sh_link], file, versym);
2410 	}
2411 }
2412 
2413 /*
2414  * Search for and process any symbol tables.
2415  */
2416 void
symbols(Cache * cache,Word shnum,Ehdr * ehdr,uchar_t osabi,VERSYM_STATE * versym,const char * file,uint_t flags)2417 symbols(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi,
2418     VERSYM_STATE *versym, const char *file, uint_t flags)
2419 {
2420 	SYMTBL_STATE state;
2421 	Cache *_cache;
2422 	Word secndx;
2423 
2424 	for (secndx = 1; secndx < shnum; secndx++) {
2425 		Word		symcnt;
2426 		Shdr		*shdr;
2427 
2428 		_cache = &cache[secndx];
2429 		shdr = _cache->c_shdr;
2430 
2431 		if ((shdr->sh_type != SHT_SYMTAB) &&
2432 		    (shdr->sh_type != SHT_DYNSYM) &&
2433 		    ((shdr->sh_type != SHT_SUNW_LDYNSYM) ||
2434 		    (osabi != ELFOSABI_SOLARIS)))
2435 			continue;
2436 		if (!match(MATCH_F_ALL, _cache->c_name, secndx, shdr->sh_type))
2437 			continue;
2438 
2439 		if (!init_symtbl_state(&state, cache, shnum, secndx, ehdr,
2440 		    osabi, versym, file, flags))
2441 			continue;
2442 		/*
2443 		 * Loop through the symbol tables entries.
2444 		 */
2445 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2446 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMTAB), state.secname);
2447 		Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
2448 
2449 		for (symcnt = 0; symcnt < state.symn; symcnt++)
2450 			output_symbol(&state, symcnt, shdr->sh_info, symcnt,
2451 			    state.sym + symcnt);
2452 	}
2453 }
2454 
2455 /*
2456  * Search for and process any SHT_SUNW_symsort or SHT_SUNW_tlssort sections.
2457  * These sections are always associated with the .SUNW_ldynsym./.dynsym pair.
2458  */
2459 static void
sunw_sort(Cache * cache,Word shnum,Ehdr * ehdr,uchar_t osabi,VERSYM_STATE * versym,const char * file,uint_t flags)2460 sunw_sort(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi,
2461     VERSYM_STATE *versym, const char *file, uint_t flags)
2462 {
2463 	SYMTBL_STATE	ldynsym_state,	dynsym_state;
2464 	Cache		*sortcache,	*symcache;
2465 	Shdr		*sortshdr,	*symshdr;
2466 	Word		sortsecndx,	symsecndx;
2467 	Word		ldynsym_cnt;
2468 	Word		*ndx;
2469 	Word		ndxn;
2470 	int		output_cnt = 0;
2471 	Conv_inv_buf_t	inv_buf;
2472 
2473 	for (sortsecndx = 1; sortsecndx < shnum; sortsecndx++) {
2474 
2475 		sortcache = &cache[sortsecndx];
2476 		sortshdr = sortcache->c_shdr;
2477 
2478 		if ((sortshdr->sh_type != SHT_SUNW_symsort) &&
2479 		    (sortshdr->sh_type != SHT_SUNW_tlssort))
2480 			continue;
2481 		if (!match(MATCH_F_ALL, sortcache->c_name, sortsecndx,
2482 		    sortshdr->sh_type))
2483 			continue;
2484 
2485 		/*
2486 		 * If the section references a SUNW_ldynsym, then we
2487 		 * expect to see the associated .dynsym immediately
2488 		 * following. If it references a .dynsym, there is no
2489 		 * SUNW_ldynsym. If it is any other type, then we don't
2490 		 * know what to do with it.
2491 		 */
2492 		if ((sortshdr->sh_link == 0) || (sortshdr->sh_link >= shnum)) {
2493 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
2494 			    file, sortcache->c_name,
2495 			    EC_WORD(sortshdr->sh_link));
2496 			continue;
2497 		}
2498 		symcache = &cache[sortshdr->sh_link];
2499 		symshdr = symcache->c_shdr;
2500 		symsecndx = sortshdr->sh_link;
2501 		ldynsym_cnt = 0;
2502 		switch (symshdr->sh_type) {
2503 		case SHT_SUNW_LDYNSYM:
2504 			if (!init_symtbl_state(&ldynsym_state, cache, shnum,
2505 			    symsecndx, ehdr, osabi, versym, file, flags))
2506 				continue;
2507 			ldynsym_cnt = ldynsym_state.symn;
2508 			/*
2509 			 * We know that the dynsym follows immediately
2510 			 * after the SUNW_ldynsym, and so, should be at
2511 			 * (sortshdr->sh_link + 1). However, elfdump is a
2512 			 * diagnostic tool, so we do the full paranoid
2513 			 * search instead.
2514 			 */
2515 			for (symsecndx = 1; symsecndx < shnum; symsecndx++) {
2516 				symcache = &cache[symsecndx];
2517 				symshdr = symcache->c_shdr;
2518 				if (symshdr->sh_type == SHT_DYNSYM)
2519 					break;
2520 			}
2521 			if (symsecndx >= shnum) {	/* Dynsym not found! */
2522 				(void) fprintf(stderr,
2523 				    MSG_INTL(MSG_ERR_NODYNSYM),
2524 				    file, sortcache->c_name);
2525 				continue;
2526 			}
2527 			/* Fallthrough to process associated dynsym */
2528 			/* FALLTHROUGH */
2529 		case SHT_DYNSYM:
2530 			if (!init_symtbl_state(&dynsym_state, cache, shnum,
2531 			    symsecndx, ehdr, osabi, versym, file, flags))
2532 				continue;
2533 			break;
2534 		default:
2535 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADNDXSEC),
2536 			    file, sortcache->c_name,
2537 			    conv_sec_type(osabi, ehdr->e_machine,
2538 			    symshdr->sh_type, 0, &inv_buf));
2539 			continue;
2540 		}
2541 
2542 		/*
2543 		 * Output header
2544 		 */
2545 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2546 		if (ldynsym_cnt > 0) {
2547 			dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMSORT2),
2548 			    sortcache->c_name, ldynsym_state.secname,
2549 			    dynsym_state.secname);
2550 			/*
2551 			 * The data for .SUNW_ldynsym and dynsym sections
2552 			 * is supposed to be adjacent with SUNW_ldynsym coming
2553 			 * first. Check, and issue a warning if it isn't so.
2554 			 */
2555 			if (((ldynsym_state.sym + ldynsym_state.symn)
2556 			    != dynsym_state.sym) &&
2557 			    ((flags & FLG_CTL_FAKESHDR) == 0))
2558 				(void) fprintf(stderr,
2559 				    MSG_INTL(MSG_ERR_LDYNNOTADJ), file,
2560 				    ldynsym_state.secname,
2561 				    dynsym_state.secname);
2562 		} else {
2563 			dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMSORT1),
2564 			    sortcache->c_name, dynsym_state.secname);
2565 		}
2566 		Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
2567 
2568 		/* If not first one, insert a line of white space */
2569 		if (output_cnt++ > 0)
2570 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2571 
2572 		/*
2573 		 * SUNW_dynsymsort and SUNW_dyntlssort are arrays of
2574 		 * symbol indices. Iterate over the array entries,
2575 		 * dispaying the referenced symbols.
2576 		 */
2577 		ndxn = sortshdr->sh_size / sortshdr->sh_entsize;
2578 		ndx = (Word *)sortcache->c_data->d_buf;
2579 		for (; ndxn-- > 0; ndx++) {
2580 			if (*ndx >= ldynsym_cnt) {
2581 				Word sec_ndx = *ndx - ldynsym_cnt;
2582 
2583 				output_symbol(&dynsym_state, sec_ndx, 0,
2584 				    *ndx, dynsym_state.sym + sec_ndx);
2585 			} else {
2586 				output_symbol(&ldynsym_state, *ndx, 0,
2587 				    *ndx, ldynsym_state.sym + *ndx);
2588 			}
2589 		}
2590 	}
2591 }
2592 
2593 /*
2594  * Search for and process any relocation sections.
2595  */
2596 static void
reloc(Cache * cache,Word shnum,Ehdr * ehdr,const char * file)2597 reloc(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
2598 {
2599 	Word	cnt;
2600 
2601 	for (cnt = 1; cnt < shnum; cnt++) {
2602 		Word		type, symnum;
2603 		Xword		relndx, relnum, relsize;
2604 		void		*rels;
2605 		Sym		*syms;
2606 		Cache		*symsec, *strsec;
2607 		Cache		*_cache = &cache[cnt];
2608 		Shdr		*shdr = _cache->c_shdr;
2609 		char		*relname = _cache->c_name;
2610 		Conv_inv_buf_t	inv_buf;
2611 
2612 		if (((type = shdr->sh_type) != SHT_RELA) &&
2613 		    (type != SHT_REL))
2614 			continue;
2615 		if (!match(MATCH_F_ALL, relname, cnt, type))
2616 			continue;
2617 
2618 		/*
2619 		 * Decide entry size.
2620 		 */
2621 		if (((relsize = shdr->sh_entsize) == 0) ||
2622 		    (relsize > shdr->sh_size)) {
2623 			if (type == SHT_RELA)
2624 				relsize = sizeof (Rela);
2625 			else
2626 				relsize = sizeof (Rel);
2627 		}
2628 
2629 		/*
2630 		 * Determine the number of relocations available.
2631 		 */
2632 		if (shdr->sh_size == 0) {
2633 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2634 			    file, relname);
2635 			continue;
2636 		}
2637 		if (_cache->c_data == NULL)
2638 			continue;
2639 
2640 		rels = _cache->c_data->d_buf;
2641 		relnum = shdr->sh_size / relsize;
2642 
2643 		/*
2644 		 * Get the data buffer for the associated symbol table and
2645 		 * string table.
2646 		 */
2647 		if (stringtbl(cache, 1, cnt, shnum, file,
2648 		    &symnum, &symsec, &strsec) == 0)
2649 			continue;
2650 
2651 		syms = symsec->c_data->d_buf;
2652 
2653 		/*
2654 		 * Loop through the relocation entries.
2655 		 */
2656 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2657 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_RELOC), _cache->c_name);
2658 		Elf_reloc_title(0, ELF_DBG_ELFDUMP, type);
2659 
2660 		for (relndx = 0; relndx < relnum; relndx++,
2661 		    rels = (void *)((char *)rels + relsize)) {
2662 			Half		mach = ehdr->e_machine;
2663 			char		section[BUFSIZ];
2664 			const char	*symname;
2665 			Word		symndx, reltype;
2666 			Rela		*rela;
2667 			Rel		*rel;
2668 
2669 			/*
2670 			 * Unravel the relocation and determine the symbol with
2671 			 * which this relocation is associated.
2672 			 */
2673 			if (type == SHT_RELA) {
2674 				rela = (Rela *)rels;
2675 				symndx = ELF_R_SYM(rela->r_info);
2676 				reltype = ELF_R_TYPE(rela->r_info, mach);
2677 			} else {
2678 				rel = (Rel *)rels;
2679 				symndx = ELF_R_SYM(rel->r_info);
2680 				reltype = ELF_R_TYPE(rel->r_info, mach);
2681 			}
2682 
2683 			symname = relsymname(cache, _cache, strsec, symndx,
2684 			    symnum, relndx, syms, section, BUFSIZ, file);
2685 
2686 			/*
2687 			 * A zero symbol index is only valid for a few
2688 			 * relocations.
2689 			 */
2690 			if (symndx == 0) {
2691 				int	badrel = 0;
2692 
2693 				if ((mach == EM_SPARC) ||
2694 				    (mach == EM_SPARC32PLUS) ||
2695 				    (mach == EM_SPARCV9)) {
2696 					if ((reltype != R_SPARC_NONE) &&
2697 					    (reltype != R_SPARC_REGISTER) &&
2698 					    (reltype != R_SPARC_RELATIVE))
2699 						badrel++;
2700 				} else if (mach == EM_386) {
2701 					if ((reltype != R_386_NONE) &&
2702 					    (reltype != R_386_RELATIVE))
2703 						badrel++;
2704 				} else if (mach == EM_AMD64) {
2705 					if ((reltype != R_AMD64_NONE) &&
2706 					    (reltype != R_AMD64_RELATIVE))
2707 						badrel++;
2708 				}
2709 
2710 				if (badrel) {
2711 					(void) fprintf(stderr,
2712 					    MSG_INTL(MSG_ERR_BADREL1), file,
2713 					    conv_reloc_type(mach, reltype,
2714 					    0, &inv_buf));
2715 				}
2716 			}
2717 
2718 			Elf_reloc_entry_1(0, ELF_DBG_ELFDUMP,
2719 			    MSG_ORIG(MSG_STR_EMPTY), ehdr->e_machine, type,
2720 			    rels, relname, symname, 0);
2721 		}
2722 	}
2723 }
2724 
2725 
2726 /*
2727  * This value controls which test dyn_test() performs.
2728  */
2729 typedef enum { DYN_TEST_ADDR, DYN_TEST_SIZE, DYN_TEST_ENTSIZE } dyn_test_t;
2730 
2731 /*
2732  * Used by dynamic() to compare the value of a dynamic element against
2733  * the starting address of the section it references.
2734  *
2735  * entry:
2736  *	test_type - Specify which dyn item is being tested.
2737  *	sh_type - SHT_* type value for required section.
2738  *	sec_cache - Cache entry for section, or NULL if the object lacks
2739  *		a section of this type.
2740  *	dyn - Dyn entry to be tested
2741  *	dynsec_cnt - # of dynamic section being examined. The first
2742  *		dynamic section is 1, the next is 2, and so on...
2743  *	ehdr - ELF header for file
2744  *	file - Name of file
2745  */
2746 static void
dyn_test(dyn_test_t test_type,Word sh_type,Cache * sec_cache,Dyn * dyn,Word dynsec_cnt,Ehdr * ehdr,uchar_t osabi,const char * file)2747 dyn_test(dyn_test_t test_type, Word sh_type, Cache *sec_cache, Dyn *dyn,
2748     Word dynsec_cnt, Ehdr *ehdr, uchar_t osabi, const char *file)
2749 {
2750 	Conv_inv_buf_t	buf1, buf2;
2751 
2752 	/*
2753 	 * These tests are based around the implicit assumption that
2754 	 * there is only one dynamic section in an object, and also only
2755 	 * one of the sections it references. We have therefore gathered
2756 	 * all of the necessary information to test this in a single pass
2757 	 * over the section headers, which is very efficient. We are not
2758 	 * aware of any case where more than one dynamic section would
2759 	 * be meaningful in an ELF object, so this is a reasonable solution.
2760 	 *
2761 	 * To test multiple dynamic sections correctly would be more
2762 	 * expensive in code and time. We would have to build a data structure
2763 	 * containing all the dynamic elements. Then, we would use the address
2764 	 * to locate the section it references and ensure the section is of
2765 	 * the right type and that the address in the dynamic element is
2766 	 * to the start of the section. Then, we could check the size and
2767 	 * entsize values against those same sections. This is O(n^2), and
2768 	 * also complicated.
2769 	 *
2770 	 * In the highly unlikely case that there is more than one dynamic
2771 	 * section, we only test the first one, and simply allow the values
2772 	 * of the subsequent one to be displayed unchallenged.
2773 	 */
2774 	if (dynsec_cnt != 1)
2775 		return;
2776 
2777 	/*
2778 	 * A DT_ item that references a section address should always find
2779 	 * the section in the file.
2780 	 */
2781 	if (sec_cache == NULL) {
2782 		const char *name;
2783 
2784 		/*
2785 		 * Supply section names instead of section types for
2786 		 * things that reference progbits so that the error
2787 		 * message will make more sense.
2788 		 */
2789 		switch (dyn->d_tag) {
2790 		case DT_INIT:
2791 			name = MSG_ORIG(MSG_ELF_INIT);
2792 			break;
2793 		case DT_FINI:
2794 			name = MSG_ORIG(MSG_ELF_FINI);
2795 			break;
2796 		default:
2797 			name = conv_sec_type(osabi, ehdr->e_machine,
2798 			    sh_type, 0, &buf1);
2799 			break;
2800 		}
2801 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_DYNNOBCKSEC), file,
2802 		    name, conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2803 		    CONV_FMT_ALT_CF, &buf2));
2804 		return;
2805 	}
2806 
2807 
2808 	switch (test_type) {
2809 	case DYN_TEST_ADDR:
2810 		/* The section address should match the DT_ item value */
2811 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_addr)
2812 			(void) fprintf(stderr,
2813 			    MSG_INTL(MSG_ERR_DYNBADADDR), file,
2814 			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2815 			    CONV_FMT_ALT_CF, &buf1), EC_ADDR(dyn->d_un.d_val),
2816 			    sec_cache->c_ndx, sec_cache->c_name,
2817 			    EC_ADDR(sec_cache->c_shdr->sh_addr));
2818 		break;
2819 
2820 	case DYN_TEST_SIZE:
2821 		/* The section size should match the DT_ item value */
2822 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_size)
2823 			(void) fprintf(stderr,
2824 			    MSG_INTL(MSG_ERR_DYNBADSIZE), file,
2825 			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2826 			    CONV_FMT_ALT_CF, &buf1), EC_XWORD(dyn->d_un.d_val),
2827 			    sec_cache->c_ndx, sec_cache->c_name,
2828 			    EC_XWORD(sec_cache->c_shdr->sh_size));
2829 		break;
2830 
2831 	case DYN_TEST_ENTSIZE:
2832 		/* The sh_entsize value should match the DT_ item value */
2833 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_entsize)
2834 			(void) fprintf(stderr,
2835 			    MSG_INTL(MSG_ERR_DYNBADENTSIZE), file,
2836 			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2837 			    CONV_FMT_ALT_CF, &buf1), EC_XWORD(dyn->d_un.d_val),
2838 			    sec_cache->c_ndx, sec_cache->c_name,
2839 			    EC_XWORD(sec_cache->c_shdr->sh_entsize));
2840 		break;
2841 	}
2842 }
2843 
2844 /*
2845  * There are some DT_ entries that have corresponding symbols
2846  * (e.g. DT_INIT and _init). It is expected that these items will
2847  * both have the same value if both are present. This routine
2848  * examines the well known symbol tables for such symbols and
2849  * issues warnings for any that don't match.
2850  *
2851  * entry:
2852  *	dyn - Dyn entry to be tested
2853  *	symname - Name of symbol that corresponds to dyn
2854  *	symtab_cache, dynsym_cache, ldynsym_cache - Symbol tables to check
2855  *	target_cache - Section the symname section is expected to be
2856  *		associated with.
2857  *	cache - Cache of all section headers
2858  *	shnum - # of sections in cache
2859  *	ehdr - ELF header for file
2860  *	osabi - OSABI to apply when interpreting object
2861  *	file - Name of file
2862  */
2863 static void
dyn_symtest(Dyn * dyn,const char * symname,Cache * symtab_cache,Cache * dynsym_cache,Cache * ldynsym_cache,Cache * target_cache,Cache * cache,Word shnum,Ehdr * ehdr,uchar_t osabi,const char * file)2864 dyn_symtest(Dyn *dyn, const char *symname, Cache *symtab_cache,
2865     Cache *dynsym_cache, Cache *ldynsym_cache, Cache *target_cache,
2866     Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
2867 {
2868 	Conv_inv_buf_t	buf;
2869 	int		i;
2870 	Sym		*sym;
2871 	Cache		*_cache;
2872 
2873 	for (i = 0; i < 3; i++) {
2874 		switch (i) {
2875 		case 0:
2876 			_cache = symtab_cache;
2877 			break;
2878 		case 1:
2879 			_cache = dynsym_cache;
2880 			break;
2881 		case 2:
2882 			_cache = ldynsym_cache;
2883 			break;
2884 		}
2885 
2886 		if ((_cache != NULL) &&
2887 		    symlookup(symname, cache, shnum, &sym, target_cache,
2888 		    _cache, file) && (sym->st_value != dyn->d_un.d_val))
2889 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DYNSYMVAL),
2890 			    file, _cache->c_name, conv_dyn_tag(dyn->d_tag,
2891 			    osabi, ehdr->e_machine, CONV_FMT_ALT_CF, &buf),
2892 			    symname, EC_ADDR(sym->st_value));
2893 	}
2894 }
2895 
2896 /*
2897  * Search for and process a .dynamic section.
2898  */
2899 static void
dynamic(Cache * cache,Word shnum,Ehdr * ehdr,uchar_t osabi,const char * file)2900 dynamic(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
2901 {
2902 	struct {
2903 		Cache	*symtab;
2904 		Cache	*dynstr;
2905 		Cache	*dynsym;
2906 		Cache	*hash;
2907 		Cache	*fini;
2908 		Cache	*fini_array;
2909 		Cache	*init;
2910 		Cache	*init_array;
2911 		Cache	*preinit_array;
2912 		Cache	*rel;
2913 		Cache	*rela;
2914 		Cache	*sunw_cap;
2915 		Cache	*sunw_capinfo;
2916 		Cache	*sunw_capchain;
2917 		Cache	*sunw_ldynsym;
2918 		Cache	*sunw_move;
2919 		Cache	*sunw_syminfo;
2920 		Cache	*sunw_symsort;
2921 		Cache	*sunw_tlssort;
2922 		Cache	*sunw_verdef;
2923 		Cache	*sunw_verneed;
2924 		Cache	*sunw_versym;
2925 	} sec;
2926 	Word	dynsec_ndx;
2927 	Word	dynsec_num;
2928 	int	dynsec_cnt;
2929 	Word	cnt;
2930 	int	osabi_solaris = osabi == ELFOSABI_SOLARIS;
2931 
2932 	/*
2933 	 * Make a pass over all the sections, gathering section information
2934 	 * we'll need below.
2935 	 */
2936 	dynsec_num = 0;
2937 	bzero(&sec, sizeof (sec));
2938 	for (cnt = 1; cnt < shnum; cnt++) {
2939 		Cache	*_cache = &cache[cnt];
2940 
2941 		switch (_cache->c_shdr->sh_type) {
2942 		case SHT_DYNAMIC:
2943 			if (dynsec_num == 0) {
2944 				dynsec_ndx = cnt;
2945 
2946 				/* Does it have a valid string table? */
2947 				(void) stringtbl(cache, 0, cnt, shnum, file,
2948 				    0, 0, &sec.dynstr);
2949 			}
2950 			dynsec_num++;
2951 			break;
2952 
2953 
2954 		case SHT_PROGBITS:
2955 			/*
2956 			 * We want to detect the .init and .fini sections,
2957 			 * if present. These are SHT_PROGBITS, so all we
2958 			 * have to go on is the section name. Normally comparing
2959 			 * names is a bad idea, but there are some special
2960 			 * names (i.e. .init/.fini/.interp) that are very
2961 			 * difficult to use in any other context, and for
2962 			 * these symbols, we do the heuristic match.
2963 			 */
2964 			if (strcmp(_cache->c_name,
2965 			    MSG_ORIG(MSG_ELF_INIT)) == 0) {
2966 				if (sec.init == NULL)
2967 					sec.init = _cache;
2968 			} else if (strcmp(_cache->c_name,
2969 			    MSG_ORIG(MSG_ELF_FINI)) == 0) {
2970 				if (sec.fini == NULL)
2971 					sec.fini = _cache;
2972 			}
2973 			break;
2974 
2975 		case SHT_REL:
2976 			/*
2977 			 * We want the SHT_REL section with the lowest
2978 			 * offset. The linker gathers them together,
2979 			 * and puts the address of the first one
2980 			 * into the DT_REL dynamic element.
2981 			 */
2982 			if ((sec.rel == NULL) ||
2983 			    (_cache->c_shdr->sh_offset <
2984 			    sec.rel->c_shdr->sh_offset))
2985 				sec.rel = _cache;
2986 			break;
2987 
2988 		case SHT_RELA:
2989 			/* RELA is handled just like RELA above */
2990 			if ((sec.rela == NULL) ||
2991 			    (_cache->c_shdr->sh_offset <
2992 			    sec.rela->c_shdr->sh_offset))
2993 				sec.rela = _cache;
2994 			break;
2995 
2996 		/*
2997 		 * The GRAB macro is used for the simple case in which
2998 		 * we simply grab the first section of the desired type.
2999 		 */
3000 #define	GRAB(_sec_type, _sec_field) \
3001 		case _sec_type: \
3002 			if (sec._sec_field == NULL) \
3003 				sec._sec_field = _cache; \
3004 				break
3005 		GRAB(SHT_SYMTAB,	symtab);
3006 		GRAB(SHT_DYNSYM,	dynsym);
3007 		GRAB(SHT_FINI_ARRAY,	fini_array);
3008 		GRAB(SHT_HASH,		hash);
3009 		GRAB(SHT_INIT_ARRAY,	init_array);
3010 		GRAB(SHT_SUNW_move,	sunw_move);
3011 		GRAB(SHT_PREINIT_ARRAY,	preinit_array);
3012 		GRAB(SHT_SUNW_cap,	sunw_cap);
3013 		GRAB(SHT_SUNW_capinfo,	sunw_capinfo);
3014 		GRAB(SHT_SUNW_capchain,	sunw_capchain);
3015 		GRAB(SHT_SUNW_LDYNSYM,	sunw_ldynsym);
3016 		GRAB(SHT_SUNW_syminfo,	sunw_syminfo);
3017 		GRAB(SHT_SUNW_symsort,	sunw_symsort);
3018 		GRAB(SHT_SUNW_tlssort,	sunw_tlssort);
3019 		GRAB(SHT_SUNW_verdef,	sunw_verdef);
3020 		GRAB(SHT_SUNW_verneed,	sunw_verneed);
3021 		GRAB(SHT_SUNW_versym,	sunw_versym);
3022 #undef GRAB
3023 		}
3024 	}
3025 
3026 	/*
3027 	 * If no dynamic section, return immediately. If more than one
3028 	 * dynamic section, then something odd is going on and an error
3029 	 * is in order, but then continue on and display them all.
3030 	 */
3031 	if (dynsec_num == 0)
3032 		return;
3033 	if (dynsec_num > 1)
3034 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MULTDYN),
3035 		    file, EC_WORD(dynsec_num));
3036 
3037 
3038 	dynsec_cnt = 0;
3039 	for (cnt = dynsec_ndx; (cnt < shnum) && (dynsec_cnt < dynsec_num);
3040 	    cnt++) {
3041 		Dyn	*dyn;
3042 		ulong_t	numdyn;
3043 		int	ndx, end_ndx;
3044 		Cache	*_cache = &cache[cnt], *strsec;
3045 		Shdr	*shdr = _cache->c_shdr;
3046 		int	dumped = 0;
3047 
3048 		if (shdr->sh_type != SHT_DYNAMIC)
3049 			continue;
3050 		dynsec_cnt++;
3051 
3052 		/*
3053 		 * Verify the associated string table section.
3054 		 */
3055 		if (stringtbl(cache, 0, cnt, shnum, file, 0, 0, &strsec) == 0)
3056 			continue;
3057 
3058 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
3059 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3060 			    file, _cache->c_name);
3061 			continue;
3062 		}
3063 		if (_cache->c_data == NULL)
3064 			continue;
3065 
3066 		numdyn = shdr->sh_size / shdr->sh_entsize;
3067 		dyn = (Dyn *)_cache->c_data->d_buf;
3068 
3069 		/*
3070 		 * We expect the REL/RELA entries to reference the reloc
3071 		 * section with the lowest address. However, this is
3072 		 * not true for dumped objects. Detect if this object has
3073 		 * been dumped so that we can skip the reloc address test
3074 		 * in that case.
3075 		 */
3076 		for (ndx = 0; ndx < numdyn; dyn++, ndx++) {
3077 			if (dyn->d_tag == DT_FLAGS_1) {
3078 				dumped = (dyn->d_un.d_val & DF_1_CONFALT) != 0;
3079 				break;
3080 			}
3081 		}
3082 		dyn = (Dyn *)_cache->c_data->d_buf;
3083 
3084 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3085 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_DYNAMIC), _cache->c_name);
3086 
3087 		Elf_dyn_title(0);
3088 
3089 		for (ndx = 0; ndx < numdyn; dyn++, ndx++) {
3090 			union {
3091 				Conv_inv_buf_t		inv;
3092 				Conv_dyn_flag_buf_t	flag;
3093 				Conv_dyn_flag1_buf_t	flag1;
3094 				Conv_dyn_posflag1_buf_t	posflag1;
3095 				Conv_dyn_feature1_buf_t	feature1;
3096 			} c_buf;
3097 			const char	*name = NULL;
3098 
3099 			/*
3100 			 * Print the information numerically, and if possible
3101 			 * as a string. If a string is available, name is
3102 			 * set to reference it.
3103 			 *
3104 			 * Also, take this opportunity to sanity check
3105 			 * the values of DT elements. In the code above,
3106 			 * we gathered information on sections that are
3107 			 * referenced by the dynamic section. Here, we
3108 			 * compare the attributes of those sections to
3109 			 * the DT_ items that reference them and report
3110 			 * on inconsistencies.
3111 			 *
3112 			 * Things not currently tested that could be improved
3113 			 * in later revisions include:
3114 			 *	- We don't check PLT or GOT related items
3115 			 *	- We don't handle computing the lengths of
3116 			 *		relocation arrays. To handle this
3117 			 *		requires examining data that spans
3118 			 *		across sections, in a contiguous span
3119 			 *		within a single segment.
3120 			 *	- DT_VERDEFNUM and DT_VERNEEDNUM can't be
3121 			 *		verified without parsing the sections.
3122 			 *	- We don't handle DT_SUNW_SYMSZ, which would
3123 			 *		be the sum of the lengths of .dynsym and
3124 			 *		.SUNW_ldynsym
3125 			 *	- DT_SUNW_STRPAD can't be verified other than
3126 			 *		to check that it's not larger than
3127 			 *		the string table.
3128 			 *	- Some items come in "all or none" clusters
3129 			 *		that give an address, element size,
3130 			 *		and data length in bytes. We don't
3131 			 *		verify that there are no missing items
3132 			 *		in such groups.
3133 			 */
3134 			switch (dyn->d_tag) {
3135 			case DT_NULL:
3136 				/*
3137 				 * Special case: DT_NULLs can come in groups
3138 				 * that we prefer to reduce to a single line.
3139 				 */
3140 				end_ndx = ndx;
3141 				while ((end_ndx < (numdyn - 1)) &&
3142 				    ((dyn + 1)->d_tag == DT_NULL)) {
3143 					dyn++;
3144 					end_ndx++;
3145 				}
3146 				Elf_dyn_null_entry(0, dyn, ndx, end_ndx);
3147 				ndx = end_ndx;
3148 				continue;
3149 
3150 			/*
3151 			 * String items all reference the dynstr. The string()
3152 			 * function does the necessary sanity checking.
3153 			 */
3154 			case DT_NEEDED:
3155 			case DT_SONAME:
3156 			case DT_FILTER:
3157 			case DT_AUXILIARY:
3158 			case DT_CONFIG:
3159 			case DT_RPATH:
3160 			case DT_RUNPATH:
3161 			case DT_USED:
3162 			case DT_DEPAUDIT:
3163 			case DT_AUDIT:
3164 				name = string(_cache, ndx, strsec,
3165 				    file, dyn->d_un.d_ptr);
3166 				break;
3167 
3168 			case DT_SUNW_AUXILIARY:
3169 			case DT_SUNW_FILTER:
3170 				if (osabi_solaris)
3171 					name = string(_cache, ndx, strsec,
3172 					    file, dyn->d_un.d_ptr);
3173 				break;
3174 
3175 			case DT_FLAGS:
3176 				name = conv_dyn_flag(dyn->d_un.d_val,
3177 				    0, &c_buf.flag);
3178 				break;
3179 			case DT_FLAGS_1:
3180 				name = conv_dyn_flag1(dyn->d_un.d_val, 0,
3181 				    &c_buf.flag1);
3182 				break;
3183 			case DT_POSFLAG_1:
3184 				name = conv_dyn_posflag1(dyn->d_un.d_val, 0,
3185 				    &c_buf.posflag1);
3186 				break;
3187 			case DT_FEATURE_1:
3188 				name = conv_dyn_feature1(dyn->d_un.d_val, 0,
3189 				    &c_buf.feature1);
3190 				break;
3191 			case DT_DEPRECATED_SPARC_REGISTER:
3192 				name = MSG_INTL(MSG_STR_DEPRECATED);
3193 				break;
3194 
3195 			case DT_SUNW_LDMACH:
3196 				if (!osabi_solaris)
3197 					break;
3198 				name = conv_ehdr_mach((Half)dyn->d_un.d_val,
3199 				    0, &c_buf.inv);
3200 				break;
3201 
3202 			/*
3203 			 * Cases below this point are strictly sanity checking,
3204 			 * and do not generate a name string. The TEST_ macros
3205 			 * are used to hide the boiler plate arguments neeeded
3206 			 * by dyn_test().
3207 			 */
3208 #define	TEST_ADDR(_sh_type, _sec_field) \
3209 				dyn_test(DYN_TEST_ADDR, _sh_type, \
3210 				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
3211 				    osabi, file)
3212 #define	TEST_SIZE(_sh_type, _sec_field) \
3213 				dyn_test(DYN_TEST_SIZE, _sh_type, \
3214 				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
3215 				    osabi, file)
3216 #define	TEST_ENTSIZE(_sh_type, _sec_field) \
3217 				dyn_test(DYN_TEST_ENTSIZE, _sh_type, \
3218 				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
3219 				    osabi, file)
3220 
3221 			case DT_FINI:
3222 				dyn_symtest(dyn, MSG_ORIG(MSG_SYM_FINI),
3223 				    sec.symtab, sec.dynsym, sec.sunw_ldynsym,
3224 				    sec.fini, cache, shnum, ehdr, osabi, file);
3225 				TEST_ADDR(SHT_PROGBITS, fini);
3226 				break;
3227 
3228 			case DT_FINI_ARRAY:
3229 				TEST_ADDR(SHT_FINI_ARRAY, fini_array);
3230 				break;
3231 
3232 			case DT_FINI_ARRAYSZ:
3233 				TEST_SIZE(SHT_FINI_ARRAY, fini_array);
3234 				break;
3235 
3236 			case DT_HASH:
3237 				TEST_ADDR(SHT_HASH, hash);
3238 				break;
3239 
3240 			case DT_INIT:
3241 				dyn_symtest(dyn, MSG_ORIG(MSG_SYM_INIT),
3242 				    sec.symtab, sec.dynsym, sec.sunw_ldynsym,
3243 				    sec.init, cache, shnum, ehdr, osabi, file);
3244 				TEST_ADDR(SHT_PROGBITS, init);
3245 				break;
3246 
3247 			case DT_INIT_ARRAY:
3248 				TEST_ADDR(SHT_INIT_ARRAY, init_array);
3249 				break;
3250 
3251 			case DT_INIT_ARRAYSZ:
3252 				TEST_SIZE(SHT_INIT_ARRAY, init_array);
3253 				break;
3254 
3255 			case DT_MOVEENT:
3256 				TEST_ENTSIZE(SHT_SUNW_move, sunw_move);
3257 				break;
3258 
3259 			case DT_MOVESZ:
3260 				TEST_SIZE(SHT_SUNW_move, sunw_move);
3261 				break;
3262 
3263 			case DT_MOVETAB:
3264 				TEST_ADDR(SHT_SUNW_move, sunw_move);
3265 				break;
3266 
3267 			case DT_PREINIT_ARRAY:
3268 				TEST_ADDR(SHT_PREINIT_ARRAY, preinit_array);
3269 				break;
3270 
3271 			case DT_PREINIT_ARRAYSZ:
3272 				TEST_SIZE(SHT_PREINIT_ARRAY, preinit_array);
3273 				break;
3274 
3275 			case DT_REL:
3276 				if (!dumped)
3277 					TEST_ADDR(SHT_REL, rel);
3278 				break;
3279 
3280 			case DT_RELENT:
3281 				TEST_ENTSIZE(SHT_REL, rel);
3282 				break;
3283 
3284 			case DT_RELA:
3285 				if (!dumped)
3286 					TEST_ADDR(SHT_RELA, rela);
3287 				break;
3288 
3289 			case DT_RELAENT:
3290 				TEST_ENTSIZE(SHT_RELA, rela);
3291 				break;
3292 
3293 			case DT_STRTAB:
3294 				TEST_ADDR(SHT_STRTAB, dynstr);
3295 				break;
3296 
3297 			case DT_STRSZ:
3298 				TEST_SIZE(SHT_STRTAB, dynstr);
3299 				break;
3300 
3301 			case DT_SUNW_CAP:
3302 				if (osabi_solaris)
3303 					TEST_ADDR(SHT_SUNW_cap, sunw_cap);
3304 				break;
3305 
3306 			case DT_SUNW_CAPINFO:
3307 				if (osabi_solaris)
3308 					TEST_ADDR(SHT_SUNW_capinfo,
3309 					    sunw_capinfo);
3310 				break;
3311 
3312 			case DT_SUNW_CAPCHAIN:
3313 				if (osabi_solaris)
3314 					TEST_ADDR(SHT_SUNW_capchain,
3315 					    sunw_capchain);
3316 				break;
3317 
3318 			case DT_SUNW_SYMTAB:
3319 				TEST_ADDR(SHT_SUNW_LDYNSYM, sunw_ldynsym);
3320 				break;
3321 
3322 			case DT_SYMENT:
3323 				TEST_ENTSIZE(SHT_DYNSYM, dynsym);
3324 				break;
3325 
3326 			case DT_SYMINENT:
3327 				TEST_ENTSIZE(SHT_SUNW_syminfo, sunw_syminfo);
3328 				break;
3329 
3330 			case DT_SYMINFO:
3331 				TEST_ADDR(SHT_SUNW_syminfo, sunw_syminfo);
3332 				break;
3333 
3334 			case DT_SYMINSZ:
3335 				TEST_SIZE(SHT_SUNW_syminfo, sunw_syminfo);
3336 				break;
3337 
3338 			case DT_SYMTAB:
3339 				TEST_ADDR(SHT_DYNSYM, dynsym);
3340 				break;
3341 
3342 			case DT_SUNW_SORTENT:
3343 				/*
3344 				 * This entry is related to both the symsort and
3345 				 * tlssort sections.
3346 				 */
3347 				if (osabi_solaris) {
3348 					int test_tls =
3349 					    (sec.sunw_tlssort != NULL);
3350 					int test_sym =
3351 					    (sec.sunw_symsort != NULL) ||
3352 					    !test_tls;
3353 					if (test_sym)
3354 						TEST_ENTSIZE(SHT_SUNW_symsort,
3355 						    sunw_symsort);
3356 					if (test_tls)
3357 						TEST_ENTSIZE(SHT_SUNW_tlssort,
3358 						    sunw_tlssort);
3359 				}
3360 				break;
3361 
3362 
3363 			case DT_SUNW_SYMSORT:
3364 				if (osabi_solaris)
3365 					TEST_ADDR(SHT_SUNW_symsort,
3366 					    sunw_symsort);
3367 				break;
3368 
3369 			case DT_SUNW_SYMSORTSZ:
3370 				if (osabi_solaris)
3371 					TEST_SIZE(SHT_SUNW_symsort,
3372 					    sunw_symsort);
3373 				break;
3374 
3375 			case DT_SUNW_TLSSORT:
3376 				if (osabi_solaris)
3377 					TEST_ADDR(SHT_SUNW_tlssort,
3378 					    sunw_tlssort);
3379 				break;
3380 
3381 			case DT_SUNW_TLSSORTSZ:
3382 				if (osabi_solaris)
3383 					TEST_SIZE(SHT_SUNW_tlssort,
3384 					    sunw_tlssort);
3385 				break;
3386 
3387 			case DT_VERDEF:
3388 				TEST_ADDR(SHT_SUNW_verdef, sunw_verdef);
3389 				break;
3390 
3391 			case DT_VERNEED:
3392 				TEST_ADDR(SHT_SUNW_verneed, sunw_verneed);
3393 				break;
3394 
3395 			case DT_VERSYM:
3396 				TEST_ADDR(SHT_SUNW_versym, sunw_versym);
3397 				break;
3398 #undef TEST_ADDR
3399 #undef TEST_SIZE
3400 #undef TEST_ENTSIZE
3401 			}
3402 
3403 			if (name == NULL)
3404 				name = MSG_ORIG(MSG_STR_EMPTY);
3405 			Elf_dyn_entry(0, dyn, ndx, name,
3406 			    osabi, ehdr->e_machine);
3407 		}
3408 	}
3409 }
3410 
3411 /*
3412  * Search for and process a MOVE section.
3413  */
3414 static void
move(Cache * cache,Word shnum,const char * file,uint_t flags)3415 move(Cache *cache, Word shnum, const char *file, uint_t flags)
3416 {
3417 	Word		cnt;
3418 	const char	*fmt = NULL;
3419 
3420 	for (cnt = 1; cnt < shnum; cnt++) {
3421 		Word	movenum, symnum, ndx;
3422 		Sym	*syms;
3423 		Cache	*_cache = &cache[cnt];
3424 		Shdr	*shdr = _cache->c_shdr;
3425 		Cache	*symsec, *strsec;
3426 		Move	*move;
3427 
3428 		if (shdr->sh_type != SHT_SUNW_move)
3429 			continue;
3430 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
3431 			continue;
3432 
3433 		/*
3434 		 * Determine the move data and number.
3435 		 */
3436 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
3437 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3438 			    file, _cache->c_name);
3439 			continue;
3440 		}
3441 		if (_cache->c_data == NULL)
3442 			continue;
3443 
3444 		move = (Move *)_cache->c_data->d_buf;
3445 		movenum = shdr->sh_size / shdr->sh_entsize;
3446 
3447 		/*
3448 		 * Get the data buffer for the associated symbol table and
3449 		 * string table.
3450 		 */
3451 		if (stringtbl(cache, 1, cnt, shnum, file,
3452 		    &symnum, &symsec, &strsec) == 0)
3453 			return;
3454 
3455 		syms = (Sym *)symsec->c_data->d_buf;
3456 
3457 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3458 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_MOVE), _cache->c_name);
3459 		dbg_print(0, MSG_INTL(MSG_MOVE_TITLE));
3460 
3461 		if (fmt == NULL)
3462 			fmt = MSG_INTL(MSG_MOVE_ENTRY);
3463 
3464 		for (ndx = 0; ndx < movenum; move++, ndx++) {
3465 			const char	*symname;
3466 			char		index[MAXNDXSIZE], section[BUFSIZ];
3467 			Word		symndx, shndx;
3468 			Sym		*sym;
3469 
3470 			/*
3471 			 * Check for null entries
3472 			 */
3473 			if ((move->m_info == 0) && (move->m_value == 0) &&
3474 			    (move->m_poffset == 0) && (move->m_repeat == 0) &&
3475 			    (move->m_stride == 0)) {
3476 				dbg_print(0, fmt, MSG_ORIG(MSG_STR_EMPTY),
3477 				    EC_XWORD(move->m_poffset), 0, 0, 0,
3478 				    EC_LWORD(0), MSG_ORIG(MSG_STR_EMPTY));
3479 				continue;
3480 			}
3481 			if (((symndx = ELF_M_SYM(move->m_info)) == 0) ||
3482 			    (symndx >= symnum)) {
3483 				(void) fprintf(stderr,
3484 				    MSG_INTL(MSG_ERR_BADMINFO), file,
3485 				    _cache->c_name, EC_XWORD(move->m_info));
3486 
3487 				(void) snprintf(index, MAXNDXSIZE,
3488 				    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(symndx));
3489 				dbg_print(0, fmt, index,
3490 				    EC_XWORD(move->m_poffset),
3491 				    ELF_M_SIZE(move->m_info), move->m_repeat,
3492 				    move->m_stride, move->m_value,
3493 				    MSG_INTL(MSG_STR_UNKNOWN));
3494 				continue;
3495 			}
3496 
3497 			symname = relsymname(cache, _cache, strsec,
3498 			    symndx, symnum, ndx, syms, section, BUFSIZ, file);
3499 			sym = (Sym *)(syms + symndx);
3500 
3501 			/*
3502 			 * Additional sanity check.
3503 			 */
3504 			shndx = sym->st_shndx;
3505 			if (!((shndx == SHN_COMMON) ||
3506 			    (((shndx >= 1) && (shndx <= shnum)) &&
3507 			    (cache[shndx].c_shdr)->sh_type == SHT_NOBITS))) {
3508 				(void) fprintf(stderr,
3509 				    MSG_INTL(MSG_ERR_BADSYM2), file,
3510 				    _cache->c_name, EC_WORD(symndx),
3511 				    demangle(symname, flags));
3512 			}
3513 
3514 			(void) snprintf(index, MAXNDXSIZE,
3515 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(symndx));
3516 			dbg_print(0, fmt, index, EC_XWORD(move->m_poffset),
3517 			    ELF_M_SIZE(move->m_info), move->m_repeat,
3518 			    move->m_stride, move->m_value,
3519 			    demangle(symname, flags));
3520 		}
3521 	}
3522 }
3523 
3524 /*
3525  * parse_note_t is used to track the state used by parse_note_entry()
3526  * between calls, and also to return the results of each call.
3527  */
3528 typedef struct {
3529 	/* pns_ fields track progress through the data */
3530 	const char	*pns_file;	/* File name */
3531 	Cache		*pns_cache;	/* Note section cache entry */
3532 	size_t		pns_size;	/* # unprocessed data bytes */
3533 	Word		*pns_data;	/* # to next unused data byte */
3534 
3535 	/* pn_ fields return the results for a single call */
3536 	Word		pn_namesz;	/* Value of note namesz field */
3537 	Word		pn_descsz;	/* Value of note descsz field */
3538 	Word		pn_type;	/* Value of note type field */
3539 	const char	*pn_name;	/* if (namesz > 0) ptr to name bytes */
3540 	const char	*pn_desc;	/* if (descsx > 0) ptr to data bytes */
3541 } parse_note_t;
3542 
3543 /*
3544  * Extract the various sub-parts of a note entry, and advance the
3545  * data pointer past it.
3546  *
3547  * entry:
3548  *	The state pns_ fields contain current values for the Note section
3549  *
3550  * exit:
3551  *	On success, True (1) is returned, the state pns_ fields have been
3552  *	advanced to point at the start of the next entry, and the information
3553  *	for the recovered note entry is found in the state pn_ fields.
3554  *
3555  *	On failure, False (0) is returned. The values contained in state
3556  *	are undefined.
3557  */
3558 static int
parse_note_entry(parse_note_t * state)3559 parse_note_entry(parse_note_t *state)
3560 {
3561 	size_t	pad, noteoff;
3562 
3563 	noteoff = (Word)state->pns_cache->c_data->d_size - state->pns_size;
3564 	/*
3565 	 * Make sure we can at least reference the 3 initial entries
3566 	 * (4-byte words) of the note information block.
3567 	 */
3568 	if (state->pns_size >= (sizeof (Word) * 3)) {
3569 		state->pns_size -= (sizeof (Word) * 3);
3570 	} else {
3571 		(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADDATASZ),
3572 		    state->pns_file, state->pns_cache->c_name,
3573 		    EC_WORD(noteoff));
3574 		return (0);
3575 	}
3576 
3577 	/*
3578 	 * Make sure any specified name string can be referenced.
3579 	 */
3580 	if ((state->pn_namesz = *state->pns_data++) != 0) {
3581 		if (state->pns_size >= state->pn_namesz) {
3582 			state->pns_size -= state->pn_namesz;
3583 		} else {
3584 			(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADNMSZ),
3585 			    state->pns_file, state->pns_cache->c_name,
3586 			    EC_WORD(noteoff), EC_WORD(state->pn_namesz));
3587 			return (0);
3588 		}
3589 	}
3590 
3591 	/*
3592 	 * Make sure any specified descriptor can be referenced.
3593 	 */
3594 	if ((state->pn_descsz = *state->pns_data++) != 0) {
3595 		/*
3596 		 * If namesz isn't a 4-byte multiple, account for any
3597 		 * padding that must exist before the descriptor.
3598 		 */
3599 		if ((pad = (state->pn_namesz & (sizeof (Word) - 1))) != 0) {
3600 			pad = sizeof (Word) - pad;
3601 			state->pns_size -= pad;
3602 		}
3603 		if (state->pns_size >= state->pn_descsz) {
3604 			state->pns_size -= state->pn_descsz;
3605 		} else {
3606 			(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADDESZ),
3607 			    state->pns_file, state->pns_cache->c_name,
3608 			    EC_WORD(noteoff), EC_WORD(state->pn_namesz));
3609 			return (0);
3610 		}
3611 	}
3612 
3613 	state->pn_type = *state->pns_data++;
3614 
3615 	/* Name */
3616 	if (state->pn_namesz) {
3617 		state->pn_name = (char *)state->pns_data;
3618 		pad = (state->pn_namesz +
3619 		    (sizeof (Word) - 1)) & ~(sizeof (Word) - 1);
3620 		/* LINTED */
3621 		state->pns_data = (Word *)(state->pn_name + pad);
3622 	}
3623 
3624 	/*
3625 	 * If multiple information blocks exist within a .note section
3626 	 * account for any padding that must exist before the next
3627 	 * information block.
3628 	 */
3629 	if ((pad = (state->pn_descsz & (sizeof (Word) - 1))) != 0) {
3630 		pad = sizeof (Word) - pad;
3631 		if (state->pns_size > pad)
3632 			state->pns_size -= pad;
3633 	}
3634 
3635 	/* Data */
3636 	if (state->pn_descsz) {
3637 		state->pn_desc = (const char *)state->pns_data;
3638 		/* LINTED */
3639 		state->pns_data = (Word *)(state->pn_desc +
3640 		    state->pn_descsz + pad);
3641 	}
3642 
3643 	return (1);
3644 }
3645 
3646 /*
3647  * Callback function for use with conv_str_to_c_literal() below.
3648  */
3649 /*ARGSUSED2*/
3650 static void
c_literal_cb(const void * ptr,size_t size,void * uvalue)3651 c_literal_cb(const void *ptr, size_t size, void *uvalue)
3652 {
3653 	(void) fwrite(ptr, size, 1, stdout);
3654 }
3655 
3656 /*
3657  * Traverse a note section analyzing each note information block.
3658  * The data buffers size is used to validate references before they are made,
3659  * and is decremented as each element is processed.
3660  */
3661 void
note_entry(Cache * cache,Word * data,size_t size,Ehdr * ehdr,const char * file)3662 note_entry(Cache *cache, Word *data, size_t size, Ehdr *ehdr, const char *file)
3663 {
3664 	int		cnt = 0;
3665 	int		is_corenote;
3666 	int		do_swap;
3667 	Conv_inv_buf_t	inv_buf;
3668 	parse_note_t	pnstate;
3669 
3670 	pnstate.pns_file = file;
3671 	pnstate.pns_cache = cache;
3672 	pnstate.pns_size = size;
3673 	pnstate.pns_data = data;
3674 	do_swap = _elf_sys_encoding() != ehdr->e_ident[EI_DATA];
3675 
3676 	/*
3677 	 * Print out a single `note' information block.
3678 	 */
3679 	while (pnstate.pns_size > 0) {
3680 
3681 		if (parse_note_entry(&pnstate) == 0)
3682 			return;
3683 
3684 		/*
3685 		 * Is this a Solaris core note? Such notes all have
3686 		 * the name "CORE".
3687 		 */
3688 		is_corenote = (ehdr->e_type == ET_CORE) &&
3689 		    (pnstate.pn_namesz == (MSG_STR_CORE_SIZE + 1)) &&
3690 		    (strncmp(MSG_ORIG(MSG_STR_CORE), pnstate.pn_name,
3691 		    MSG_STR_CORE_SIZE + 1) == 0);
3692 
3693 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3694 		dbg_print(0, MSG_INTL(MSG_FMT_NOTEENTNDX), EC_WORD(cnt));
3695 		cnt++;
3696 		dbg_print(0, MSG_ORIG(MSG_NOTE_NAMESZ),
3697 		    EC_WORD(pnstate.pn_namesz));
3698 		dbg_print(0, MSG_ORIG(MSG_NOTE_DESCSZ),
3699 		    EC_WORD(pnstate.pn_descsz));
3700 
3701 		if (is_corenote)
3702 			dbg_print(0, MSG_ORIG(MSG_NOTE_TYPE_STR),
3703 			    conv_cnote_type(pnstate.pn_type, 0, &inv_buf));
3704 		else
3705 			dbg_print(0, MSG_ORIG(MSG_NOTE_TYPE),
3706 			    EC_WORD(pnstate.pn_type));
3707 		if (pnstate.pn_namesz) {
3708 			dbg_print(0, MSG_ORIG(MSG_NOTE_NAME));
3709 			/*
3710 			 * The name string can contain embedded 'null'
3711 			 * bytes and/or unprintable characters. Also,
3712 			 * the final NULL is documented in the ELF ABI
3713 			 * as being included in the namesz. So, display
3714 			 * the name using C literal string notation, and
3715 			 * include the terminating NULL in the output.
3716 			 * We don't show surrounding double quotes, as
3717 			 * that implies the termination that we are showing
3718 			 * explicitly.
3719 			 */
3720 			(void) fwrite(MSG_ORIG(MSG_STR_8SP),
3721 			    MSG_STR_8SP_SIZE, 1, stdout);
3722 			conv_str_to_c_literal(pnstate.pn_name,
3723 			    pnstate.pn_namesz, c_literal_cb, NULL);
3724 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3725 		}
3726 
3727 		if (pnstate.pn_descsz) {
3728 			int		hexdump = 1;
3729 
3730 			/*
3731 			 * If this is a core note, let the corenote()
3732 			 * function handle it.
3733 			 */
3734 			if (is_corenote) {
3735 				/* We only issue the bad arch error once */
3736 				static int	badnote_done = 0;
3737 				corenote_ret_t	corenote_ret;
3738 
3739 				corenote_ret = corenote(ehdr->e_machine,
3740 				    do_swap, pnstate.pn_type, pnstate.pn_desc,
3741 				    pnstate.pn_descsz);
3742 				switch (corenote_ret) {
3743 				case CORENOTE_R_OK_DUMP:
3744 					hexdump = 1;
3745 					break;
3746 				case CORENOTE_R_OK:
3747 					hexdump = 0;
3748 					break;
3749 				case CORENOTE_R_BADDATA:
3750 					(void) fprintf(stderr,
3751 					    MSG_INTL(MSG_NOTE_BADCOREDATA),
3752 					    file);
3753 					break;
3754 				case CORENOTE_R_BADARCH:
3755 					if (badnote_done)
3756 						break;
3757 					(void) fprintf(stderr,
3758 					    MSG_INTL(MSG_NOTE_BADCOREARCH),
3759 					    file,
3760 					    conv_ehdr_mach(ehdr->e_machine,
3761 					    0, &inv_buf));
3762 					break;
3763 				case CORENOTE_R_BADTYPE:
3764 					(void) fprintf(stderr,
3765 					    MSG_INTL(MSG_NOTE_BADCORETYPE),
3766 					    file,
3767 					    EC_WORD(pnstate.pn_type));
3768 					break;
3769 
3770 				}
3771 			}
3772 
3773 			/*
3774 			 * The default thing when we don't understand
3775 			 * the note data is to display it as hex bytes.
3776 			 */
3777 			if (hexdump) {
3778 				dbg_print(0, MSG_ORIG(MSG_NOTE_DESC));
3779 				dump_hex_bytes(pnstate.pn_desc,
3780 				    pnstate.pn_descsz, 8, 4, 4);
3781 			}
3782 		}
3783 	}
3784 }
3785 
3786 /*
3787  * Search for and process .note sections.
3788  *
3789  * Returns the number of note sections seen.
3790  */
3791 static Word
note(Cache * cache,Word shnum,Ehdr * ehdr,const char * file)3792 note(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
3793 {
3794 	Word	cnt, note_cnt = 0;
3795 
3796 	/*
3797 	 * Otherwise look for any .note sections.
3798 	 */
3799 	for (cnt = 1; cnt < shnum; cnt++) {
3800 		Cache	*_cache = &cache[cnt];
3801 		Shdr	*shdr = _cache->c_shdr;
3802 
3803 		if (shdr->sh_type != SHT_NOTE)
3804 			continue;
3805 		note_cnt++;
3806 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
3807 			continue;
3808 
3809 		/*
3810 		 * As these sections are often hand rolled, make sure they're
3811 		 * properly aligned before proceeding, and issue an error
3812 		 * as necessary.
3813 		 *
3814 		 * Note that we will continue on to display the note even
3815 		 * if it has bad alignment. We can do this safely, because
3816 		 * libelf knows the alignment required for SHT_NOTE, and
3817 		 * takes steps to deliver a properly aligned buffer to us
3818 		 * even if the actual file is misaligned.
3819 		 */
3820 		if (shdr->sh_offset & (sizeof (Word) - 1))
3821 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADALIGN),
3822 			    file, _cache->c_name);
3823 
3824 		if (_cache->c_data == NULL)
3825 			continue;
3826 
3827 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3828 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_NOTE), _cache->c_name);
3829 		note_entry(_cache, (Word *)_cache->c_data->d_buf,
3830 		/* LINTED */
3831 		    (Word)_cache->c_data->d_size, ehdr, file);
3832 	}
3833 
3834 	return (note_cnt);
3835 }
3836 
3837 /*
3838  * The Linux Standard Base defines a special note named .note.ABI-tag
3839  * that is used to maintain Linux ABI information. Presence of this section
3840  * is a strong indication that the object should be considered to be
3841  * ELFOSABI_LINUX.
3842  *
3843  * This function returns True (1) if such a note is seen, and False (0)
3844  * otherwise.
3845  */
3846 static int
has_linux_abi_note(Cache * cache,Word shnum,const char * file)3847 has_linux_abi_note(Cache *cache, Word shnum, const char *file)
3848 {
3849 	Word	cnt;
3850 
3851 	for (cnt = 1; cnt < shnum; cnt++) {
3852 		parse_note_t	pnstate;
3853 		Cache		*_cache = &cache[cnt];
3854 		Shdr		*shdr = _cache->c_shdr;
3855 
3856 		/*
3857 		 * Section must be SHT_NOTE, must have the name
3858 		 * .note.ABI-tag, and must have data.
3859 		 */
3860 		if ((shdr->sh_type != SHT_NOTE) ||
3861 		    (strcmp(MSG_ORIG(MSG_STR_NOTEABITAG),
3862 		    _cache->c_name) != 0) || (_cache->c_data == NULL))
3863 			continue;
3864 
3865 		pnstate.pns_file = file;
3866 		pnstate.pns_cache = _cache;
3867 		pnstate.pns_size = _cache->c_data->d_size;
3868 		pnstate.pns_data = (Word *)_cache->c_data->d_buf;
3869 
3870 		while (pnstate.pns_size > 0) {
3871 			Word *w;
3872 
3873 			if (parse_note_entry(&pnstate) == 0)
3874 				break;
3875 
3876 			/*
3877 			 * The type must be 1, and the name must be "GNU".
3878 			 * The descsz must be at least 16 bytes.
3879 			 */
3880 			if ((pnstate.pn_type != 1) ||
3881 			    (pnstate.pn_namesz != (MSG_STR_GNU_SIZE + 1)) ||
3882 			    (strncmp(MSG_ORIG(MSG_STR_GNU), pnstate.pn_name,
3883 			    MSG_STR_CORE_SIZE + 1) != 0) ||
3884 			    (pnstate.pn_descsz < 16))
3885 				continue;
3886 
3887 			/*
3888 			 * desc contains 4 32-bit fields. Field 0 must be 0,
3889 			 * indicating Linux. The second, third, and fourth
3890 			 * fields represent the earliest Linux kernel
3891 			 * version compatible with this object.
3892 			 */
3893 			/*LINTED*/
3894 			w = (Word *) pnstate.pn_desc;
3895 			if (*w == 0)
3896 				return (1);
3897 		}
3898 	}
3899 
3900 	return (0);
3901 }
3902 
3903 /*
3904  * Determine an individual hash entry.  This may be the initial hash entry,
3905  * or an associated chain entry.
3906  */
3907 static void
hash_entry(Cache * refsec,Cache * strsec,const char * hsecname,Word hashndx,Word symndx,Word symn,Sym * syms,const char * file,ulong_t bkts,uint_t flags,int chain)3908 hash_entry(Cache *refsec, Cache *strsec, const char *hsecname, Word hashndx,
3909     Word symndx, Word symn, Sym *syms, const char *file, ulong_t bkts,
3910     uint_t flags, int chain)
3911 {
3912 	Sym		*sym;
3913 	const char	*symname, *str;
3914 	char		_bucket[MAXNDXSIZE], _symndx[MAXNDXSIZE];
3915 	ulong_t		nbkt, nhash;
3916 
3917 	if (symndx > symn) {
3918 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_HSBADSYMNDX), file,
3919 		    EC_WORD(symndx), EC_WORD(hashndx));
3920 		symname = MSG_INTL(MSG_STR_UNKNOWN);
3921 	} else {
3922 		sym = (Sym *)(syms + symndx);
3923 		symname = string(refsec, symndx, strsec, file, sym->st_name);
3924 	}
3925 
3926 	if (chain == 0) {
3927 		(void) snprintf(_bucket, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INTEGER),
3928 		    hashndx);
3929 		str = (const char *)_bucket;
3930 	} else
3931 		str = MSG_ORIG(MSG_STR_EMPTY);
3932 
3933 	(void) snprintf(_symndx, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX2),
3934 	    EC_WORD(symndx));
3935 	dbg_print(0, MSG_ORIG(MSG_FMT_HASH_INFO), str, _symndx,
3936 	    demangle(symname, flags));
3937 
3938 	/*
3939 	 * Determine if this string is in the correct bucket.
3940 	 */
3941 	nhash = elf_hash(symname);
3942 	nbkt = nhash % bkts;
3943 
3944 	if (nbkt != hashndx) {
3945 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADHASH), file,
3946 		    hsecname, symname, EC_WORD(hashndx), nbkt);
3947 	}
3948 }
3949 
3950 #define	MAXCOUNT	500
3951 
3952 static void
hash(Cache * cache,Word shnum,const char * file,uint_t flags)3953 hash(Cache *cache, Word shnum, const char *file, uint_t flags)
3954 {
3955 	static int	count[MAXCOUNT];
3956 	Word		cnt;
3957 	ulong_t		ndx, bkts;
3958 	char		number[MAXNDXSIZE];
3959 
3960 	for (cnt = 1; cnt < shnum; cnt++) {
3961 		uint_t		*hash, *chain;
3962 		Cache		*_cache = &cache[cnt];
3963 		Shdr		*sshdr, *hshdr = _cache->c_shdr;
3964 		char		*ssecname, *hsecname = _cache->c_name;
3965 		Sym		*syms;
3966 		Word		symn;
3967 
3968 		if (hshdr->sh_type != SHT_HASH)
3969 			continue;
3970 
3971 		/*
3972 		 * Determine the hash table data and size.
3973 		 */
3974 		if ((hshdr->sh_entsize == 0) || (hshdr->sh_size == 0)) {
3975 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3976 			    file, hsecname);
3977 			continue;
3978 		}
3979 		if (_cache->c_data == NULL)
3980 			continue;
3981 
3982 		hash = (uint_t *)_cache->c_data->d_buf;
3983 		bkts = *hash;
3984 		chain = hash + 2 + bkts;
3985 		hash += 2;
3986 
3987 		/*
3988 		 * Get the data buffer for the associated symbol table.
3989 		 */
3990 		if ((hshdr->sh_link == 0) || (hshdr->sh_link >= shnum)) {
3991 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
3992 			    file, hsecname, EC_WORD(hshdr->sh_link));
3993 			continue;
3994 		}
3995 
3996 		_cache = &cache[hshdr->sh_link];
3997 		ssecname = _cache->c_name;
3998 
3999 		if (_cache->c_data == NULL)
4000 			continue;
4001 
4002 		if ((syms = (Sym *)_cache->c_data->d_buf) == NULL) {
4003 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4004 			    file, ssecname);
4005 			continue;
4006 		}
4007 
4008 		sshdr = _cache->c_shdr;
4009 		/* LINTED */
4010 		symn = (Word)(sshdr->sh_size / sshdr->sh_entsize);
4011 
4012 		/*
4013 		 * Get the associated string table section.
4014 		 */
4015 		if ((sshdr->sh_link == 0) || (sshdr->sh_link >= shnum)) {
4016 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
4017 			    file, ssecname, EC_WORD(sshdr->sh_link));
4018 			continue;
4019 		}
4020 
4021 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4022 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_HASH), hsecname);
4023 		dbg_print(0, MSG_INTL(MSG_ELF_HASH_INFO));
4024 
4025 		/*
4026 		 * Loop through the hash buckets, printing the appropriate
4027 		 * symbols.
4028 		 */
4029 		for (ndx = 0; ndx < bkts; ndx++, hash++) {
4030 			Word	_ndx, _cnt;
4031 
4032 			if (*hash == 0) {
4033 				count[0]++;
4034 				continue;
4035 			}
4036 
4037 			hash_entry(_cache, &cache[sshdr->sh_link], hsecname,
4038 			    ndx, *hash, symn, syms, file, bkts, flags, 0);
4039 
4040 			/*
4041 			 * Determine if any other symbols are chained to this
4042 			 * bucket.
4043 			 */
4044 			_ndx = chain[*hash];
4045 			_cnt = 1;
4046 			while (_ndx) {
4047 				hash_entry(_cache, &cache[sshdr->sh_link],
4048 				    hsecname, ndx, _ndx, symn, syms, file,
4049 				    bkts, flags, 1);
4050 				_ndx = chain[_ndx];
4051 				_cnt++;
4052 			}
4053 
4054 			if (_cnt >= MAXCOUNT) {
4055 				(void) fprintf(stderr,
4056 				    MSG_INTL(MSG_HASH_OVERFLW), file,
4057 				    _cache->c_name, EC_WORD(ndx),
4058 				    EC_WORD(_cnt));
4059 			} else
4060 				count[_cnt]++;
4061 		}
4062 		break;
4063 	}
4064 
4065 	/*
4066 	 * Print out the count information.
4067 	 */
4068 	bkts = cnt = 0;
4069 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4070 
4071 	for (ndx = 0; ndx < MAXCOUNT; ndx++) {
4072 		Word	_cnt;
4073 
4074 		if ((_cnt = count[ndx]) == 0)
4075 			continue;
4076 
4077 		(void) snprintf(number, MAXNDXSIZE,
4078 		    MSG_ORIG(MSG_FMT_INTEGER), _cnt);
4079 		dbg_print(0, MSG_INTL(MSG_ELF_HASH_BKTS1), number,
4080 		    EC_WORD(ndx));
4081 		bkts += _cnt;
4082 		cnt += (Word)(ndx * _cnt);
4083 	}
4084 	if (cnt) {
4085 		(void) snprintf(number, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INTEGER),
4086 		    bkts);
4087 		dbg_print(0, MSG_INTL(MSG_ELF_HASH_BKTS2), number,
4088 		    EC_WORD(cnt));
4089 	}
4090 }
4091 
4092 static void
group(Cache * cache,Word shnum,const char * file,uint_t flags)4093 group(Cache *cache, Word shnum, const char *file, uint_t flags)
4094 {
4095 	Word	scnt;
4096 
4097 	for (scnt = 1; scnt < shnum; scnt++) {
4098 		Cache		*_cache = &cache[scnt];
4099 		Shdr		*shdr = _cache->c_shdr;
4100 		Word		*grpdata, gcnt, grpcnt, symnum, unknown;
4101 		Cache		*symsec, *strsec;
4102 		Sym		*syms, *sym;
4103 		char		flgstrbuf[MSG_GRP_COMDAT_SIZE + 10];
4104 		const char	*grpnam;
4105 
4106 		if (shdr->sh_type != SHT_GROUP)
4107 			continue;
4108 		if (!match(MATCH_F_ALL, _cache->c_name, scnt, shdr->sh_type))
4109 			continue;
4110 		if ((_cache->c_data == NULL) ||
4111 		    ((grpdata = (Word *)_cache->c_data->d_buf) == NULL))
4112 			continue;
4113 		grpcnt = shdr->sh_size / sizeof (Word);
4114 
4115 		/*
4116 		 * Get the data buffer for the associated symbol table and
4117 		 * string table.
4118 		 */
4119 		if (stringtbl(cache, 1, scnt, shnum, file,
4120 		    &symnum, &symsec, &strsec) == 0)
4121 			return;
4122 
4123 		syms = symsec->c_data->d_buf;
4124 
4125 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4126 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_GRP), _cache->c_name);
4127 		dbg_print(0, MSG_INTL(MSG_GRP_TITLE));
4128 
4129 		/*
4130 		 * The first element of the group defines the group.  The
4131 		 * associated symbol is defined by the sh_link field.
4132 		 */
4133 		if ((shdr->sh_info == SHN_UNDEF) || (shdr->sh_info > symnum)) {
4134 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHINFO),
4135 			    file, _cache->c_name, EC_WORD(shdr->sh_info));
4136 			return;
4137 		}
4138 
4139 		(void) strcpy(flgstrbuf, MSG_ORIG(MSG_STR_OSQBRKT));
4140 		if (grpdata[0] & GRP_COMDAT) {
4141 			(void) strcat(flgstrbuf, MSG_ORIG(MSG_GRP_COMDAT));
4142 		}
4143 		if ((unknown = (grpdata[0] & ~GRP_COMDAT)) != 0) {
4144 			size_t	len = strlen(flgstrbuf);
4145 
4146 			(void) snprintf(&flgstrbuf[len],
4147 			    (MSG_GRP_COMDAT_SIZE + 10 - len),
4148 			    MSG_ORIG(MSG_GRP_UNKNOWN), unknown);
4149 		}
4150 		(void) strcat(flgstrbuf, MSG_ORIG(MSG_STR_CSQBRKT));
4151 		sym = (Sym *)(syms + shdr->sh_info);
4152 
4153 		/*
4154 		 * The GNU assembler can use section symbols as the signature
4155 		 * symbol as described by this comment in the gold linker
4156 		 * (found via google):
4157 		 *
4158 		 *	It seems that some versions of gas will create a
4159 		 *	section group associated with a section symbol, and
4160 		 *	then fail to give a name to the section symbol.  In
4161 		 *	such a case, use the name of the section.
4162 		 *
4163 		 * In order to support such objects, we do the same.
4164 		 */
4165 		grpnam = string(_cache, 0, strsec, file, sym->st_name);
4166 		if (((sym->st_name == 0) || (*grpnam == '\0')) &&
4167 		    (ELF_ST_TYPE(sym->st_info) == STT_SECTION))
4168 			grpnam = cache[sym->st_shndx].c_name;
4169 
4170 		dbg_print(0, MSG_INTL(MSG_GRP_SIGNATURE), flgstrbuf,
4171 		    demangle(grpnam, flags));
4172 
4173 		for (gcnt = 1; gcnt < grpcnt; gcnt++) {
4174 			char		index[MAXNDXSIZE];
4175 			const char	*name;
4176 
4177 			(void) snprintf(index, MAXNDXSIZE,
4178 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(gcnt));
4179 
4180 			if (grpdata[gcnt] >= shnum)
4181 				name = MSG_INTL(MSG_GRP_INVALSCN);
4182 			else
4183 				name = cache[grpdata[gcnt]].c_name;
4184 
4185 			(void) printf(MSG_ORIG(MSG_GRP_ENTRY), index, name,
4186 			    EC_XWORD(grpdata[gcnt]));
4187 		}
4188 	}
4189 }
4190 
4191 static void
got(Cache * cache,Word shnum,Ehdr * ehdr,const char * file)4192 got(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
4193 {
4194 	Cache		*gotcache = NULL, *symtab = NULL;
4195 	Addr		gotbgn, gotend;
4196 	Shdr		*gotshdr;
4197 	Word		cnt, gotents, gotndx;
4198 	size_t		gentsize;
4199 	Got_info	*gottable;
4200 	char		*gotdata;
4201 	Sym		*gotsym;
4202 	Xword		gotsymaddr;
4203 	uint_t		sys_encoding;
4204 
4205 	/*
4206 	 * First, find the got.
4207 	 */
4208 	for (cnt = 1; cnt < shnum; cnt++) {
4209 		if (strncmp(cache[cnt].c_name, MSG_ORIG(MSG_ELF_GOT),
4210 		    MSG_ELF_GOT_SIZE) == 0) {
4211 			gotcache = &cache[cnt];
4212 			break;
4213 		}
4214 	}
4215 	if (gotcache == NULL)
4216 		return;
4217 
4218 	/*
4219 	 * A got section within a relocatable object is suspicious.
4220 	 */
4221 	if (ehdr->e_type == ET_REL) {
4222 		(void) fprintf(stderr, MSG_INTL(MSG_GOT_UNEXPECTED), file,
4223 		    gotcache->c_name);
4224 	}
4225 
4226 	gotshdr = gotcache->c_shdr;
4227 	if (gotshdr->sh_size == 0) {
4228 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4229 		    file, gotcache->c_name);
4230 		return;
4231 	}
4232 
4233 	gotbgn = gotshdr->sh_addr;
4234 	gotend = gotbgn + gotshdr->sh_size;
4235 
4236 	/*
4237 	 * Some architectures don't properly set the sh_entsize for the GOT
4238 	 * table.  If it's not set, default to a size of a pointer.
4239 	 */
4240 	if ((gentsize = gotshdr->sh_entsize) == 0)
4241 		gentsize = sizeof (Xword);
4242 
4243 	if (gotcache->c_data == NULL)
4244 		return;
4245 
4246 	/* LINTED */
4247 	gotents = (Word)(gotshdr->sh_size / gentsize);
4248 	gotdata = gotcache->c_data->d_buf;
4249 
4250 	if ((gottable = calloc(gotents, sizeof (Got_info))) == 0) {
4251 		int err = errno;
4252 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC), file,
4253 		    strerror(err));
4254 		return;
4255 	}
4256 
4257 	/*
4258 	 * Now we scan through all the sections looking for any relocations
4259 	 * that may be against the GOT.  Since these may not be isolated to a
4260 	 * .rel[a].got section we check them all.
4261 	 * While scanning sections save the symbol table entry (a symtab
4262 	 * overriding a dynsym) so that we can lookup _GLOBAL_OFFSET_TABLE_.
4263 	 */
4264 	for (cnt = 1; cnt < shnum; cnt++) {
4265 		Word		type, symnum;
4266 		Xword		relndx, relnum, relsize;
4267 		void		*rels;
4268 		Sym		*syms;
4269 		Cache		*symsec, *strsec;
4270 		Cache		*_cache = &cache[cnt];
4271 		Shdr		*shdr;
4272 
4273 		shdr = _cache->c_shdr;
4274 		type = shdr->sh_type;
4275 
4276 		if ((symtab == 0) && (type == SHT_DYNSYM)) {
4277 			symtab = _cache;
4278 			continue;
4279 		}
4280 		if (type == SHT_SYMTAB) {
4281 			symtab = _cache;
4282 			continue;
4283 		}
4284 		if ((type != SHT_RELA) && (type != SHT_REL))
4285 			continue;
4286 
4287 		/*
4288 		 * Decide entry size.
4289 		 */
4290 		if (((relsize = shdr->sh_entsize) == 0) ||
4291 		    (relsize > shdr->sh_size)) {
4292 			if (type == SHT_RELA)
4293 				relsize = sizeof (Rela);
4294 			else
4295 				relsize = sizeof (Rel);
4296 		}
4297 
4298 		/*
4299 		 * Determine the number of relocations available.
4300 		 */
4301 		if (shdr->sh_size == 0) {
4302 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4303 			    file, _cache->c_name);
4304 			continue;
4305 		}
4306 		if (_cache->c_data == NULL)
4307 			continue;
4308 
4309 		rels = _cache->c_data->d_buf;
4310 		relnum = shdr->sh_size / relsize;
4311 
4312 		/*
4313 		 * Get the data buffer for the associated symbol table and
4314 		 * string table.
4315 		 */
4316 		if (stringtbl(cache, 1, cnt, shnum, file,
4317 		    &symnum, &symsec, &strsec) == 0)
4318 			continue;
4319 
4320 		syms = symsec->c_data->d_buf;
4321 
4322 		/*
4323 		 * Loop through the relocation entries.
4324 		 */
4325 		for (relndx = 0; relndx < relnum; relndx++,
4326 		    rels = (void *)((char *)rels + relsize)) {
4327 			char		section[BUFSIZ];
4328 			Addr		offset;
4329 			Got_info	*gip;
4330 			Word		symndx, reltype;
4331 			Rela		*rela;
4332 			Rel		*rel;
4333 
4334 			/*
4335 			 * Unravel the relocation.
4336 			 */
4337 			if (type == SHT_RELA) {
4338 				rela = (Rela *)rels;
4339 				symndx = ELF_R_SYM(rela->r_info);
4340 				reltype = ELF_R_TYPE(rela->r_info,
4341 				    ehdr->e_machine);
4342 				offset = rela->r_offset;
4343 			} else {
4344 				rel = (Rel *)rels;
4345 				symndx = ELF_R_SYM(rel->r_info);
4346 				reltype = ELF_R_TYPE(rel->r_info,
4347 				    ehdr->e_machine);
4348 				offset = rel->r_offset;
4349 			}
4350 
4351 			/*
4352 			 * Only pay attention to relocations against the GOT.
4353 			 */
4354 			if ((offset < gotbgn) || (offset >= gotend))
4355 				continue;
4356 
4357 			/* LINTED */
4358 			gotndx = (Word)((offset - gotbgn) /
4359 			    gotshdr->sh_entsize);
4360 			gip = &gottable[gotndx];
4361 
4362 			if (gip->g_reltype != 0) {
4363 				(void) fprintf(stderr,
4364 				    MSG_INTL(MSG_GOT_MULTIPLE), file,
4365 				    EC_WORD(gotndx), EC_ADDR(offset));
4366 				continue;
4367 			}
4368 
4369 			if (symndx)
4370 				gip->g_symname = relsymname(cache, _cache,
4371 				    strsec, symndx, symnum, relndx, syms,
4372 				    section, BUFSIZ, file);
4373 			gip->g_reltype = reltype;
4374 			gip->g_rel = rels;
4375 		}
4376 	}
4377 
4378 	if (symlookup(MSG_ORIG(MSG_SYM_GOT), cache, shnum, &gotsym, NULL,
4379 	    symtab, file))
4380 		gotsymaddr = gotsym->st_value;
4381 	else
4382 		gotsymaddr = gotbgn;
4383 
4384 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4385 	dbg_print(0, MSG_INTL(MSG_ELF_SCN_GOT), gotcache->c_name);
4386 	Elf_got_title(0);
4387 
4388 	sys_encoding = _elf_sys_encoding();
4389 	for (gotndx = 0; gotndx < gotents; gotndx++) {
4390 		Got_info	*gip;
4391 		Sword		gindex;
4392 		Addr		gaddr;
4393 		Xword		gotentry;
4394 
4395 		gip = &gottable[gotndx];
4396 
4397 		gaddr = gotbgn + (gotndx * gentsize);
4398 		gindex = (Sword)(gaddr - gotsymaddr) / (Sword)gentsize;
4399 
4400 		if (gentsize == sizeof (Word))
4401 			/* LINTED */
4402 			gotentry = (Xword)(*((Word *)(gotdata) + gotndx));
4403 		else
4404 			/* LINTED */
4405 			gotentry = *((Xword *)(gotdata) + gotndx);
4406 
4407 		Elf_got_entry(0, gindex, gaddr, gotentry, ehdr->e_machine,
4408 		    ehdr->e_ident[EI_DATA], sys_encoding,
4409 		    gip->g_reltype, gip->g_rel, gip->g_symname);
4410 	}
4411 	free(gottable);
4412 }
4413 
4414 void
checksum(Elf * elf)4415 checksum(Elf *elf)
4416 {
4417 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4418 	dbg_print(0, MSG_INTL(MSG_STR_CHECKSUM), elf_checksum(elf));
4419 }
4420 
4421 /*
4422  * This variable is used by regular() to communicate the address of
4423  * the section header cache to sort_shdr_ndx_arr(). Unfortunately,
4424  * the qsort() interface does not include a userdata argument by which
4425  * such arbitrary data can be passed, so we are stuck using global data.
4426  */
4427 static Cache *sort_shdr_ndx_arr_cache;
4428 
4429 
4430 /*
4431  * Used with qsort() to sort the section indices so that they can be
4432  * used to access the section headers in order of increasing data offset.
4433  *
4434  * entry:
4435  *	sort_shdr_ndx_arr_cache - Contains address of
4436  *		section header cache.
4437  *	v1, v2 - Point at elements of sort_shdr_bits array to be compared.
4438  *
4439  * exit:
4440  *	Returns -1 (less than), 0 (equal) or 1 (greater than).
4441  */
4442 static int
sort_shdr_ndx_arr(const void * v1,const void * v2)4443 sort_shdr_ndx_arr(const void *v1, const void *v2)
4444 {
4445 	Cache	*cache1 = sort_shdr_ndx_arr_cache + *((size_t *)v1);
4446 	Cache	*cache2 = sort_shdr_ndx_arr_cache + *((size_t *)v2);
4447 
4448 	if (cache1->c_shdr->sh_offset < cache2->c_shdr->sh_offset)
4449 		return (-1);
4450 
4451 	if (cache1->c_shdr->sh_offset > cache2->c_shdr->sh_offset)
4452 		return (1);
4453 
4454 	return (0);
4455 }
4456 
4457 
4458 static int
shdr_cache(const char * file,Elf * elf,Ehdr * ehdr,size_t shstrndx,size_t shnum,Cache ** cache_ret,Word flags)4459 shdr_cache(const char *file, Elf *elf, Ehdr *ehdr, size_t shstrndx,
4460     size_t shnum, Cache **cache_ret, Word flags)
4461 {
4462 	Elf_Scn		*scn;
4463 	Elf_Data	*data;
4464 	size_t		ndx;
4465 	Shdr		*nameshdr;
4466 	char		*names = NULL;
4467 	Cache		*cache, *_cache;
4468 	size_t		*shdr_ndx_arr, shdr_ndx_arr_cnt;
4469 
4470 
4471 	/*
4472 	 * Obtain the .shstrtab data buffer to provide the required section
4473 	 * name strings.
4474 	 */
4475 	if (shstrndx == SHN_UNDEF) {
4476 		/*
4477 		 * It is rare, but legal, for an object to lack a
4478 		 * header string table section.
4479 		 */
4480 		names = NULL;
4481 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOSHSTRSEC), file);
4482 	} else if ((scn = elf_getscn(elf, shstrndx)) == NULL) {
4483 		failure(file, MSG_ORIG(MSG_ELF_GETSCN));
4484 		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SHDR),
4485 		    EC_XWORD(shstrndx));
4486 
4487 	} else if ((data = elf_getdata(scn, NULL)) == NULL) {
4488 		failure(file, MSG_ORIG(MSG_ELF_GETDATA));
4489 		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_DATA),
4490 		    EC_XWORD(shstrndx));
4491 
4492 	} else if ((nameshdr = elf_getshdr(scn)) == NULL) {
4493 		failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
4494 		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN),
4495 		    EC_WORD(elf_ndxscn(scn)));
4496 
4497 	} else if ((names = data->d_buf) == NULL)
4498 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_SHSTRNULL), file);
4499 
4500 	/*
4501 	 * Allocate a cache to maintain a descriptor for each section.
4502 	 */
4503 	if ((*cache_ret = cache = malloc(shnum * sizeof (Cache))) == NULL) {
4504 		int err = errno;
4505 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
4506 		    file, strerror(err));
4507 		return (0);
4508 	}
4509 
4510 	*cache = cache_init;
4511 	_cache = cache;
4512 	_cache++;
4513 
4514 	/*
4515 	 * Allocate an array that will hold the section index for
4516 	 * each section that has data in the ELF file:
4517 	 *
4518 	 *	- Is not a NOBITS section
4519 	 *	- Data has non-zero length
4520 	 *
4521 	 * Note that shnum is an upper bound on the size required. It
4522 	 * is likely that we won't use a few of these array elements.
4523 	 * Allocating a modest amount of extra memory in this case means
4524 	 * that we can avoid an extra loop to count the number of needed
4525 	 * items, and can fill this array immediately in the first loop
4526 	 * below.
4527 	 */
4528 	if ((shdr_ndx_arr = malloc(shnum * sizeof (*shdr_ndx_arr))) == NULL) {
4529 		int err = errno;
4530 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
4531 		    file, strerror(err));
4532 		return (0);
4533 	}
4534 	shdr_ndx_arr_cnt = 0;
4535 
4536 	/*
4537 	 * Traverse the sections of the file.  This gathering of data is
4538 	 * carried out in two passes.  First, the section headers are captured
4539 	 * and the section header names are evaluated.  A verification pass is
4540 	 * then carried out over the section information.  Files have been
4541 	 * known to exhibit overlapping (and hence erroneous) section header
4542 	 * information.
4543 	 *
4544 	 * Finally, the data for each section is obtained.  This processing is
4545 	 * carried out after section verification because should any section
4546 	 * header overlap occur, and a file needs translating (ie. xlate'ing
4547 	 * information from a non-native architecture file), then the process
4548 	 * of translation can corrupt the section header information.  Of
4549 	 * course, if there is any section overlap, the data related to the
4550 	 * sections is going to be compromised.  However, it is the translation
4551 	 * of this data that has caused problems with elfdump()'s ability to
4552 	 * extract the data.
4553 	 */
4554 	for (ndx = 1, scn = NULL; scn = elf_nextscn(elf, scn);
4555 	    ndx++, _cache++) {
4556 		char	scnndxnm[100];
4557 
4558 		_cache->c_ndx = ndx;
4559 		_cache->c_scn = scn;
4560 
4561 		if ((_cache->c_shdr = elf_getshdr(scn)) == NULL) {
4562 			failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
4563 			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN),
4564 			    EC_WORD(elf_ndxscn(scn)));
4565 		}
4566 
4567 		/*
4568 		 * If this section has data in the file, include it in
4569 		 * the array of sections to check for address overlap.
4570 		 */
4571 		if ((_cache->c_shdr->sh_size != 0) &&
4572 		    (_cache->c_shdr->sh_type != SHT_NOBITS))
4573 			shdr_ndx_arr[shdr_ndx_arr_cnt++] = ndx;
4574 
4575 		/*
4576 		 * If a shstrtab exists, assign the section name.
4577 		 */
4578 		if (names && _cache->c_shdr) {
4579 			if (_cache->c_shdr->sh_name &&
4580 			    /* LINTED */
4581 			    (nameshdr->sh_size > _cache->c_shdr->sh_name)) {
4582 				const char	*symname;
4583 				char		*secname;
4584 
4585 				secname = names + _cache->c_shdr->sh_name;
4586 
4587 				/*
4588 				 * A SUN naming convention employs a "%" within
4589 				 * a section name to indicate a section/symbol
4590 				 * name.  This originated from the compilers
4591 				 * -xF option, that places functions into their
4592 				 * own sections.  This convention (which has no
4593 				 * formal standard) has also been followed for
4594 				 * COMDAT sections.  To demangle the symbol
4595 				 * name, the name must be separated from the
4596 				 * section name.
4597 				 */
4598 				if (((flags & FLG_CTL_DEMANGLE) == 0) ||
4599 				    ((symname = strchr(secname, '%')) == NULL))
4600 					_cache->c_name = secname;
4601 				else {
4602 					size_t	secsz = ++symname - secname;
4603 					size_t	strsz;
4604 
4605 					symname = demangle(symname, flags);
4606 					strsz = secsz + strlen(symname) + 1;
4607 
4608 					if ((_cache->c_name =
4609 					    malloc(strsz)) == NULL) {
4610 						int err = errno;
4611 						(void) fprintf(stderr,
4612 						    MSG_INTL(MSG_ERR_MALLOC),
4613 						    file, strerror(err));
4614 						return (0);
4615 					}
4616 					(void) snprintf(_cache->c_name, strsz,
4617 					    MSG_ORIG(MSG_FMT_SECSYM),
4618 					    EC_WORD(secsz), secname, symname);
4619 				}
4620 
4621 				continue;
4622 			}
4623 
4624 			/*
4625 			 * Generate an error if the section name index is zero
4626 			 * or exceeds the shstrtab data.  Fall through to
4627 			 * fabricate a section name.
4628 			 */
4629 			if ((_cache->c_shdr->sh_name == 0) ||
4630 			    /* LINTED */
4631 			    (nameshdr->sh_size <= _cache->c_shdr->sh_name)) {
4632 				(void) fprintf(stderr,
4633 				    MSG_INTL(MSG_ERR_BADSHNAME), file,
4634 				    EC_WORD(ndx),
4635 				    EC_XWORD(_cache->c_shdr->sh_name));
4636 			}
4637 		}
4638 
4639 		/*
4640 		 * If there exists no shstrtab data, or a section header has no
4641 		 * name (an invalid index of 0), then compose a name for the
4642 		 * section.
4643 		 */
4644 		(void) snprintf(scnndxnm, sizeof (scnndxnm),
4645 		    MSG_INTL(MSG_FMT_SCNNDX), ndx);
4646 
4647 		if ((_cache->c_name = malloc(strlen(scnndxnm) + 1)) == NULL) {
4648 			int err = errno;
4649 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
4650 			    file, strerror(err));
4651 			return (0);
4652 		}
4653 		(void) strcpy(_cache->c_name, scnndxnm);
4654 	}
4655 
4656 	/*
4657 	 * Having collected all the sections, validate their address range.
4658 	 * Cases have existed where the section information has been invalid.
4659 	 * This can lead to all sorts of other, hard to diagnose errors, as
4660 	 * each section is processed individually (ie. with elf_getdata()).
4661 	 * Here, we carry out some address comparisons to catch a family of
4662 	 * overlapping memory issues we have observed (likely, there are others
4663 	 * that we have yet to discover).
4664 	 *
4665 	 * Note, should any memory overlap occur, obtaining any additional
4666 	 * data from the file is questionable.  However, it might still be
4667 	 * possible to inspect the ELF header, Programs headers, or individual
4668 	 * sections, so rather than bailing on an error condition, continue
4669 	 * processing to see if any data can be salvaged.
4670 	 */
4671 	if (shdr_ndx_arr_cnt > 1) {
4672 		sort_shdr_ndx_arr_cache = cache;
4673 		qsort(shdr_ndx_arr, shdr_ndx_arr_cnt,
4674 		    sizeof (*shdr_ndx_arr), sort_shdr_ndx_arr);
4675 	}
4676 	for (ndx = 0; ndx < shdr_ndx_arr_cnt; ndx++) {
4677 		Cache	*_cache = cache + shdr_ndx_arr[ndx];
4678 		Shdr	*shdr = _cache->c_shdr;
4679 		Off	bgn1, bgn = shdr->sh_offset;
4680 		Off	end1, end = shdr->sh_offset + shdr->sh_size;
4681 		size_t	ndx1;
4682 
4683 		/*
4684 		 * Check the section against all following ones, reporting
4685 		 * any overlaps. Since we've sorted the sections by offset,
4686 		 * we can stop after the first comparison that fails. There
4687 		 * are no overlaps in a properly formed ELF file, in which
4688 		 * case this algorithm runs in O(n) time. This will degenerate
4689 		 * to O(n^2) for a completely broken file. Such a file is
4690 		 * (1) highly unlikely, and (2) unusable, so it is reasonable
4691 		 * for the analysis to take longer.
4692 		 */
4693 		for (ndx1 = ndx + 1; ndx1 < shdr_ndx_arr_cnt; ndx1++) {
4694 			Cache	*_cache1 = cache + shdr_ndx_arr[ndx1];
4695 			Shdr	*shdr1 = _cache1->c_shdr;
4696 
4697 			bgn1 = shdr1->sh_offset;
4698 			end1 = shdr1->sh_offset + shdr1->sh_size;
4699 
4700 			if (((bgn1 <= bgn) && (end1 > bgn)) ||
4701 			    ((bgn1 < end) && (end1 >= end))) {
4702 				(void) fprintf(stderr,
4703 				    MSG_INTL(MSG_ERR_SECMEMOVER), file,
4704 				    EC_WORD(elf_ndxscn(_cache->c_scn)),
4705 				    _cache->c_name, EC_OFF(bgn), EC_OFF(end),
4706 				    EC_WORD(elf_ndxscn(_cache1->c_scn)),
4707 				    _cache1->c_name, EC_OFF(bgn1),
4708 				    EC_OFF(end1));
4709 			} else {	/* No overlap, so can stop */
4710 				break;
4711 			}
4712 		}
4713 
4714 		/*
4715 		 * In addition to checking for sections overlapping
4716 		 * each other (done above), we should also make sure
4717 		 * the section doesn't overlap the section header array.
4718 		 */
4719 		bgn1 = ehdr->e_shoff;
4720 		end1 = ehdr->e_shoff + (ehdr->e_shentsize * ehdr->e_shnum);
4721 
4722 		if (((bgn1 <= bgn) && (end1 > bgn)) ||
4723 		    ((bgn1 < end) && (end1 >= end))) {
4724 			(void) fprintf(stderr,
4725 			    MSG_INTL(MSG_ERR_SHDRMEMOVER), file, EC_OFF(bgn1),
4726 			    EC_OFF(end1),
4727 			    EC_WORD(elf_ndxscn(_cache->c_scn)),
4728 			    _cache->c_name, EC_OFF(bgn), EC_OFF(end));
4729 		}
4730 	}
4731 
4732 	/*
4733 	 * Obtain the data for each section.
4734 	 */
4735 	for (ndx = 1; ndx < shnum; ndx++) {
4736 		Cache	*_cache = &cache[ndx];
4737 		Elf_Scn	*scn = _cache->c_scn;
4738 
4739 		if ((_cache->c_data = elf_getdata(scn, NULL)) == NULL) {
4740 			failure(file, MSG_ORIG(MSG_ELF_GETDATA));
4741 			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCNDATA),
4742 			    EC_WORD(elf_ndxscn(scn)));
4743 		}
4744 
4745 		/*
4746 		 * If a string table, verify that it has NULL first and
4747 		 * final bytes.
4748 		 */
4749 		if ((_cache->c_shdr->sh_type == SHT_STRTAB) &&
4750 		    (_cache->c_data->d_buf != NULL) &&
4751 		    (_cache->c_data->d_size > 0)) {
4752 			const char *s = _cache->c_data->d_buf;
4753 
4754 			if ((*s != '\0') ||
4755 			    (*(s + _cache->c_data->d_size - 1) != '\0'))
4756 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALSTR),
4757 				    file, _cache->c_name);
4758 		}
4759 	}
4760 
4761 	return (1);
4762 }
4763 
4764 
4765 
4766 /*
4767  * Generate a cache of section headers and related information
4768  * for use by the rest of elfdump. If requested (or the file
4769  * contains no section headers), we generate a fake set of
4770  * headers from the information accessible from the program headers.
4771  * Otherwise, we use the real section headers contained in the file.
4772  */
4773 static int
create_cache(const char * file,int fd,Elf * elf,Ehdr * ehdr,Cache ** cache,size_t shstrndx,size_t * shnum,uint_t * flags)4774 create_cache(const char *file, int fd, Elf *elf, Ehdr *ehdr, Cache **cache,
4775     size_t shstrndx, size_t *shnum, uint_t *flags)
4776 {
4777 	/*
4778 	 * If there are no section headers, then resort to synthesizing
4779 	 * section headers from the program headers. This is normally
4780 	 * only done by explicit request, but in this case there's no
4781 	 * reason not to go ahead, since the alternative is simply to quit.
4782 	 */
4783 	if ((*shnum <= 1) && ((*flags & FLG_CTL_FAKESHDR) == 0)) {
4784 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOSHDR), file);
4785 		*flags |= FLG_CTL_FAKESHDR;
4786 	}
4787 
4788 	if (*flags & FLG_CTL_FAKESHDR) {
4789 		if (fake_shdr_cache(file, fd, elf, ehdr, cache, shnum) == 0)
4790 			return (0);
4791 	} else {
4792 		if (shdr_cache(file, elf, ehdr, shstrndx, *shnum,
4793 		    cache, *flags) == 0)
4794 			return (0);
4795 	}
4796 
4797 	return (1);
4798 }
4799 
4800 int
regular(const char * file,int fd,Elf * elf,uint_t flags,const char * wname,int wfd,uchar_t osabi)4801 regular(const char *file, int fd, Elf *elf, uint_t flags,
4802     const char *wname, int wfd, uchar_t osabi)
4803 {
4804 	enum { CACHE_NEEDED, CACHE_OK, CACHE_FAIL} cache_state = CACHE_NEEDED;
4805 	Elf_Scn		*scn;
4806 	Ehdr		*ehdr;
4807 	size_t		ndx, shstrndx, shnum, phnum;
4808 	Shdr		*shdr;
4809 	Cache		*cache;
4810 	VERSYM_STATE	versym = { 0 };
4811 	int		ret = 0;
4812 	int		addr_align;
4813 
4814 	if ((ehdr = elf_getehdr(elf)) == NULL) {
4815 		failure(file, MSG_ORIG(MSG_ELF_GETEHDR));
4816 		return (ret);
4817 	}
4818 
4819 	if (elf_getshdrnum(elf, &shnum) == -1) {
4820 		failure(file, MSG_ORIG(MSG_ELF_GETSHDRNUM));
4821 		return (ret);
4822 	}
4823 
4824 	if (elf_getshdrstrndx(elf, &shstrndx) == -1) {
4825 		failure(file, MSG_ORIG(MSG_ELF_GETSHDRSTRNDX));
4826 		return (ret);
4827 	}
4828 
4829 	if (elf_getphdrnum(elf, &phnum) == -1) {
4830 		failure(file, MSG_ORIG(MSG_ELF_GETPHDRNUM));
4831 		return (ret);
4832 	}
4833 	/*
4834 	 * If the user requested section headers derived from the
4835 	 * program headers (-P option) and this file doesn't have
4836 	 * any program headers (i.e. ET_REL), then we can't do it.
4837 	 */
4838 	if ((phnum == 0) && (flags & FLG_CTL_FAKESHDR)) {
4839 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_PNEEDSPH), file);
4840 		return (ret);
4841 	}
4842 
4843 
4844 	if ((scn = elf_getscn(elf, 0)) != NULL) {
4845 		if ((shdr = elf_getshdr(scn)) == NULL) {
4846 			failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
4847 			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN), 0);
4848 			return (ret);
4849 		}
4850 	} else
4851 		shdr = NULL;
4852 
4853 	/*
4854 	 * Print the elf header.
4855 	 */
4856 	if (flags & FLG_SHOW_EHDR)
4857 		Elf_ehdr(0, ehdr, shdr);
4858 
4859 	/*
4860 	 * If the section headers or program headers have inadequate
4861 	 * alignment for the class of object, print a warning. libelf
4862 	 * can handle such files, but programs that use them can crash
4863 	 * when they dereference unaligned items.
4864 	 *
4865 	 * Note that the AMD64 ABI, although it is a 64-bit architecture,
4866 	 * allows access to data types smaller than 128-bits to be on
4867 	 * word alignment.
4868 	 */
4869 	if (ehdr->e_machine == EM_AMD64)
4870 		addr_align = sizeof (Word);
4871 	else
4872 		addr_align = sizeof (Addr);
4873 
4874 	if (ehdr->e_phoff & (addr_align - 1))
4875 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADPHDRALIGN), file);
4876 	if (ehdr->e_shoff & (addr_align - 1))
4877 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHDRALIGN), file);
4878 
4879 
4880 	/*
4881 	 * Determine the Operating System ABI (osabi) we will use to
4882 	 * interpret the object.
4883 	 */
4884 	if (flags & FLG_CTL_OSABI) {
4885 		/*
4886 		 * If the user explicitly specifies '-O none', we need
4887 		 * to display a completely generic view of the file.
4888 		 * However, libconv is written to assume that ELFOSABI_NONE
4889 		 * is equivalent to ELFOSABI_SOLARIS. To get the desired
4890 		 * effect, we use an osabi that libconv has no knowledge of.
4891 		 */
4892 		if (osabi == ELFOSABI_NONE)
4893 			osabi = ELFOSABI_UNKNOWN4;
4894 	} else {
4895 		/* Determine osabi from file */
4896 		osabi = ehdr->e_ident[EI_OSABI];
4897 		if (osabi == ELFOSABI_NONE) {
4898 			/*
4899 			 * Chicken/Egg scenario:
4900 			 *
4901 			 * Ideally, we wait to create the section header cache
4902 			 * until after the program headers are printed. If we
4903 			 * only output program headers, we can skip building
4904 			 * the cache entirely.
4905 			 *
4906 			 * Proper interpretation of program headers requires
4907 			 * the osabi, which is supposed to be in the ELF header.
4908 			 * However, many systems (Solaris and Linux included)
4909 			 * have a history of setting the osabi to the generic
4910 			 * SysV ABI (ELFOSABI_NONE). We assume ELFOSABI_SOLARIS
4911 			 * in such cases, but would like to check the object
4912 			 * to see if it has a Linux .note.ABI-tag section,
4913 			 * which implies ELFOSABI_LINUX. This requires a
4914 			 * section header cache.
4915 			 *
4916 			 * To break the cycle, we create section headers now
4917 			 * if osabi is ELFOSABI_NONE, and later otherwise.
4918 			 * If it succeeds, we use them, if not, we defer
4919 			 * exiting until after the program headers are out.
4920 			 */
4921 			if (create_cache(file, fd, elf, ehdr, &cache,
4922 			    shstrndx, &shnum, &flags) == 0) {
4923 				cache_state = CACHE_FAIL;
4924 			} else {
4925 				cache_state = CACHE_OK;
4926 				if (has_linux_abi_note(cache, shnum, file)) {
4927 					Conv_inv_buf_t	ibuf1, ibuf2;
4928 
4929 					(void) fprintf(stderr,
4930 					    MSG_INTL(MSG_INFO_LINUXOSABI), file,
4931 					    conv_ehdr_osabi(osabi, 0, &ibuf1),
4932 					    conv_ehdr_osabi(ELFOSABI_LINUX,
4933 					    0, &ibuf2));
4934 					osabi = ELFOSABI_LINUX;
4935 				}
4936 			}
4937 		}
4938 		/*
4939 		 * We treat ELFOSABI_NONE identically to ELFOSABI_SOLARIS.
4940 		 * Mapping NONE to SOLARIS simplifies the required test.
4941 		 */
4942 		if (osabi == ELFOSABI_NONE)
4943 			osabi = ELFOSABI_SOLARIS;
4944 	}
4945 
4946 	/*
4947 	 * Print the program headers.
4948 	 */
4949 	if ((flags & FLG_SHOW_PHDR) && (phnum != 0)) {
4950 		Phdr	*phdr;
4951 
4952 		if ((phdr = elf_getphdr(elf)) == NULL) {
4953 			failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
4954 			return (ret);
4955 		}
4956 
4957 		for (ndx = 0; ndx < phnum; phdr++, ndx++) {
4958 			if (!match(MATCH_F_PHDR| MATCH_F_NDX | MATCH_F_TYPE,
4959 			    NULL, ndx, phdr->p_type))
4960 				continue;
4961 
4962 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4963 			dbg_print(0, MSG_INTL(MSG_ELF_PHDR), EC_WORD(ndx));
4964 			Elf_phdr(0, osabi, ehdr->e_machine, phdr);
4965 		}
4966 	}
4967 
4968 	/*
4969 	 * If we have flag bits set that explicitly require a show or calc
4970 	 * operation, but none of them require the section headers, then
4971 	 * we are done and can return now.
4972 	 */
4973 	if (((flags & (FLG_MASK_SHOW | FLG_MASK_CALC)) != 0) &&
4974 	    ((flags & (FLG_MASK_SHOW_SHDR | FLG_MASK_CALC_SHDR)) == 0))
4975 		return (ret);
4976 
4977 	/*
4978 	 * Everything from this point on requires section headers.
4979 	 * If we have no section headers, there is no reason to continue.
4980 	 *
4981 	 * If we tried above to create the section header cache and failed,
4982 	 * it is time to exit. Otherwise, create it if needed.
4983 	 */
4984 	switch (cache_state) {
4985 	case CACHE_NEEDED:
4986 		if (create_cache(file, fd, elf, ehdr, &cache, shstrndx,
4987 		    &shnum, &flags) == 0)
4988 			return (ret);
4989 		break;
4990 	case CACHE_OK:
4991 		break;
4992 	case CACHE_FAIL:
4993 		return (ret);
4994 	}
4995 	if (shnum <= 1)
4996 		goto done;
4997 
4998 	/*
4999 	 * If -w was specified, find and write out the section(s) data.
5000 	 */
5001 	if (wfd) {
5002 		for (ndx = 1; ndx < shnum; ndx++) {
5003 			Cache	*_cache = &cache[ndx];
5004 
5005 			if (match(MATCH_F_STRICT | MATCH_F_ALL, _cache->c_name,
5006 			    ndx, _cache->c_shdr->sh_type) &&
5007 			    _cache->c_data && _cache->c_data->d_buf) {
5008 				if (write(wfd, _cache->c_data->d_buf,
5009 				    _cache->c_data->d_size) !=
5010 				    _cache->c_data->d_size) {
5011 					int err = errno;
5012 					(void) fprintf(stderr,
5013 					    MSG_INTL(MSG_ERR_WRITE), wname,
5014 					    strerror(err));
5015 					/*
5016 					 * Return an exit status of 1, because
5017 					 * the failure is not related to the
5018 					 * ELF file, but by system resources.
5019 					 */
5020 					ret = 1;
5021 					goto done;
5022 				}
5023 			}
5024 		}
5025 	}
5026 
5027 	/*
5028 	 * If we have no flag bits set that explicitly require a show or calc
5029 	 * operation, but match options (-I, -N, -T) were used, then run
5030 	 * through the section headers and see if we can't deduce show flags
5031 	 * from the match options given.
5032 	 *
5033 	 * We don't do this if -w was specified, because (-I, -N, -T) used
5034 	 * with -w in lieu of some other option is supposed to be quiet.
5035 	 */
5036 	if ((wfd == 0) && (flags & FLG_CTL_MATCH) &&
5037 	    ((flags & (FLG_MASK_SHOW | FLG_MASK_CALC)) == 0)) {
5038 		for (ndx = 1; ndx < shnum; ndx++) {
5039 			Cache	*_cache = &cache[ndx];
5040 
5041 			if (!match(MATCH_F_STRICT | MATCH_F_ALL, _cache->c_name,
5042 			    ndx, _cache->c_shdr->sh_type))
5043 				continue;
5044 
5045 			switch (_cache->c_shdr->sh_type) {
5046 			case SHT_PROGBITS:
5047 				/*
5048 				 * Heuristic time: It is usually bad form
5049 				 * to assume the meaning/format of a PROGBITS
5050 				 * section based on its name. However, there
5051 				 * are ABI mandated exceptions. Check for
5052 				 * these special names.
5053 				 */
5054 
5055 				/* The ELF ABI specifies .interp and .got */
5056 				if (strcmp(_cache->c_name,
5057 				    MSG_ORIG(MSG_ELF_INTERP)) == 0) {
5058 					flags |= FLG_SHOW_INTERP;
5059 					break;
5060 				}
5061 				if (strcmp(_cache->c_name,
5062 				    MSG_ORIG(MSG_ELF_GOT)) == 0) {
5063 					flags |= FLG_SHOW_GOT;
5064 					break;
5065 				}
5066 				/*
5067 				 * The GNU compilers, and amd64 ABI, define
5068 				 * .eh_frame and .eh_frame_hdr. The Sun
5069 				 * C++ ABI defines .exception_ranges.
5070 				 */
5071 				if ((strncmp(_cache->c_name,
5072 				    MSG_ORIG(MSG_SCN_FRM),
5073 				    MSG_SCN_FRM_SIZE) == 0) ||
5074 				    (strncmp(_cache->c_name,
5075 				    MSG_ORIG(MSG_SCN_EXRANGE),
5076 				    MSG_SCN_EXRANGE_SIZE) == 0)) {
5077 					flags |= FLG_SHOW_UNWIND;
5078 					break;
5079 				}
5080 				break;
5081 
5082 			case SHT_SYMTAB:
5083 			case SHT_DYNSYM:
5084 			case SHT_SUNW_LDYNSYM:
5085 			case SHT_SUNW_versym:
5086 			case SHT_SYMTAB_SHNDX:
5087 				flags |= FLG_SHOW_SYMBOLS;
5088 				break;
5089 
5090 			case SHT_RELA:
5091 			case SHT_REL:
5092 				flags |= FLG_SHOW_RELOC;
5093 				break;
5094 
5095 			case SHT_HASH:
5096 				flags |= FLG_SHOW_HASH;
5097 				break;
5098 
5099 			case SHT_DYNAMIC:
5100 				flags |= FLG_SHOW_DYNAMIC;
5101 				break;
5102 
5103 			case SHT_NOTE:
5104 				flags |= FLG_SHOW_NOTE;
5105 				break;
5106 
5107 			case SHT_GROUP:
5108 				flags |= FLG_SHOW_GROUP;
5109 				break;
5110 
5111 			case SHT_SUNW_symsort:
5112 			case SHT_SUNW_tlssort:
5113 				flags |= FLG_SHOW_SORT;
5114 				break;
5115 
5116 			case SHT_SUNW_cap:
5117 				flags |= FLG_SHOW_CAP;
5118 				break;
5119 
5120 			case SHT_SUNW_move:
5121 				flags |= FLG_SHOW_MOVE;
5122 				break;
5123 
5124 			case SHT_SUNW_syminfo:
5125 				flags |= FLG_SHOW_SYMINFO;
5126 				break;
5127 
5128 			case SHT_SUNW_verdef:
5129 			case SHT_SUNW_verneed:
5130 				flags |= FLG_SHOW_VERSIONS;
5131 				break;
5132 
5133 			case SHT_AMD64_UNWIND:
5134 				flags |= FLG_SHOW_UNWIND;
5135 				break;
5136 			}
5137 		}
5138 	}
5139 
5140 
5141 	if (flags & FLG_SHOW_SHDR)
5142 		sections(file, cache, shnum, ehdr, osabi);
5143 
5144 	if (flags & FLG_SHOW_INTERP)
5145 		interp(file, cache, shnum, phnum, elf);
5146 
5147 	if ((osabi == ELFOSABI_SOLARIS) || (osabi == ELFOSABI_LINUX))
5148 		versions(cache, shnum, file, flags, &versym);
5149 
5150 	if (flags & FLG_SHOW_SYMBOLS)
5151 		symbols(cache, shnum, ehdr, osabi, &versym, file, flags);
5152 
5153 	if ((flags & FLG_SHOW_SORT) && (osabi == ELFOSABI_SOLARIS))
5154 		sunw_sort(cache, shnum, ehdr, osabi, &versym, file, flags);
5155 
5156 	if (flags & FLG_SHOW_HASH)
5157 		hash(cache, shnum, file, flags);
5158 
5159 	if (flags & FLG_SHOW_GOT)
5160 		got(cache, shnum, ehdr, file);
5161 
5162 	if (flags & FLG_SHOW_GROUP)
5163 		group(cache, shnum, file, flags);
5164 
5165 	if (flags & FLG_SHOW_SYMINFO)
5166 		syminfo(cache, shnum, ehdr, osabi, file);
5167 
5168 	if (flags & FLG_SHOW_RELOC)
5169 		reloc(cache, shnum, ehdr, file);
5170 
5171 	if (flags & FLG_SHOW_DYNAMIC)
5172 		dynamic(cache, shnum, ehdr, osabi, file);
5173 
5174 	if (flags & FLG_SHOW_NOTE) {
5175 		Word	note_cnt;
5176 		size_t	note_shnum;
5177 		Cache	*note_cache;
5178 
5179 		note_cnt = note(cache, shnum, ehdr, file);
5180 
5181 		/*
5182 		 * Solaris core files have section headers, but these
5183 		 * headers do not include SHT_NOTE sections that reference
5184 		 * the core note sections. This means that note() won't
5185 		 * find the core notes. Fake section headers (-P option)
5186 		 * recover these sections, but it is inconvenient to require
5187 		 * users to specify -P in this situation. If the following
5188 		 * are all true:
5189 		 *
5190 		 *	- No note sections were found
5191 		 *	- This is a core file
5192 		 *	- We are not already using fake section headers
5193 		 *
5194 		 * then we will automatically generate fake section headers
5195 		 * and then process them in a second call to note().
5196 		 */
5197 		if ((note_cnt == 0) && (ehdr->e_type == ET_CORE) &&
5198 		    !(flags & FLG_CTL_FAKESHDR) &&
5199 		    (fake_shdr_cache(file, fd, elf, ehdr,
5200 		    &note_cache, &note_shnum) != 0)) {
5201 			(void) note(note_cache, note_shnum, ehdr, file);
5202 			fake_shdr_cache_free(note_cache, note_shnum);
5203 		}
5204 	}
5205 
5206 	if ((flags & FLG_SHOW_MOVE) && (osabi == ELFOSABI_SOLARIS))
5207 		move(cache, shnum, file, flags);
5208 
5209 	if (flags & FLG_CALC_CHECKSUM)
5210 		checksum(elf);
5211 
5212 	if ((flags & FLG_SHOW_CAP) && (osabi == ELFOSABI_SOLARIS))
5213 		cap(file, cache, shnum, phnum, ehdr, osabi, elf, flags);
5214 
5215 	if ((flags & FLG_SHOW_UNWIND) &&
5216 	    ((osabi == ELFOSABI_SOLARIS) || (osabi == ELFOSABI_LINUX)))
5217 		unwind(cache, shnum, phnum, ehdr, osabi, file, elf, flags);
5218 
5219 
5220 	/* Release the memory used to cache section headers */
5221 done:
5222 	if (flags & FLG_CTL_FAKESHDR)
5223 		fake_shdr_cache_free(cache, shnum);
5224 	else
5225 		free(cache);
5226 
5227 	return (ret);
5228 }
5229