1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22/*
23 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
24 * Use is subject to license terms.
25 */
26
27/*
28 * Copyright (c) 2015, Joyent, Inc. All rights reserved.
29 */
30
31/*
32 * Dump an elf file.
33 */
34#include	<stddef.h>
35#include	<sys/elf_386.h>
36#include	<sys/elf_amd64.h>
37#include	<sys/elf_SPARC.h>
38#include	<_libelf.h>
39#include	<dwarf.h>
40#include	<stdio.h>
41#include	<unistd.h>
42#include	<errno.h>
43#include	<strings.h>
44#include	<debug.h>
45#include	<conv.h>
46#include	<msg.h>
47#include	<_elfdump.h>
48
49
50/*
51 * VERSYM_STATE is used to maintain information about the VERSYM section
52 * in the object being analyzed. It is filled in by versions(), and used
53 * by init_symtbl_state() when displaying symbol information.
54 *
55 * There are three forms of symbol versioning known to us:
56 *
57 * 1) The original form, introduced with Solaris 2.5, in which
58 *	the Versym contains indexes to Verdef records, and the
59 *	Versym values for UNDEF symbols resolved by other objects
60 *	are all set to 0.
61 * 2) The GNU form, which is backward compatible with the original
62 *	Solaris form, but which adds several extensions:
63 *	- The Versym also contains indexes to Verneed records, recording
64 *		which object/version contributed the external symbol at
65 *		link time. These indexes start with the next value following
66 *		the final Verdef index. The index is written to the previously
67 *		reserved vna_other field of the ELF Vernaux structure.
68 *	- The top bit of the Versym value is no longer part of the index,
69 *		but is used as a "hidden bit" to prevent binding to the symbol.
70 *	- Multiple implementations of a given symbol, contained in varying
71 *		versions are allowed, using special assembler pseudo ops,
72 *		and encoded in the symbol name using '@' characters.
73 * 3) Modified Solaris form, in which we adopt the first GNU extension
74 *	(Versym indexes to Verneed records), but not the others.
75 *
76 * elfdump can handle any of these cases. The presence of a DT_VERSYM
77 * dynamic element indicates a full GNU object. An object that lacks
78 * a DT_VERSYM entry, but which has non-zero vna_other fields in the Vernaux
79 * structures is a modified Solaris object. An object that has neither of
80 * these uses the original form.
81 *
82 * max_verndx contains the largest version index that can appear
83 * in a Versym entry. This can never be less than 1: In the case where
84 * there is no verdef/verneed sections, the [0] index is reserved
85 * for local symbols, and the [1] index for globals. If the original
86 * Solaris versioning rules are in effect and there is a verdef section,
87 * then max_verndex is the number of defined versions. If one of the
88 * other versioning forms is in effect, then:
89 *	1) If there is no verneed section, it is the same as for
90 *		original Solaris versioning.
91 *	2) If there is a verneed section, the vna_other field of the
92 *		Vernaux structs contain versions, and max_verndx is the
93 *		largest such index.
94 *
95 * If gnu_full is True, the object uses the full GNU form of versioning.
96 * The value of the gnu_full field is based on the presence of
97 * a DT_VERSYM entry in the dynamic section: GNU ld produces these, and
98 * Solaris ld does not.
99 *
100 * The gnu_needed field is True if the Versym contains indexes to
101 * Verneed records, as indicated by non-zero vna_other fields in the Verneed
102 * section. If gnu_full is True, then gnu_needed will always be true.
103 * However, gnu_needed can be true without gnu_full. This is the modified
104 * Solaris form.
105 */
106typedef struct {
107	Cache	*cache;		/* Pointer to cache entry for VERSYM */
108	Versym	*data;		/* Pointer to versym array */
109	int	gnu_full;	/* True if object uses GNU versioning rules */
110	int	gnu_needed;	/* True if object uses VERSYM indexes for */
111				/*	VERNEED (subset of gnu_full) */
112	int	max_verndx;	/* largest versym index value */
113} VERSYM_STATE;
114
115/*
116 * SYMTBL_STATE is used to maintain information about a single symbol
117 * table section, for use by the routines that display symbol information.
118 */
119typedef struct {
120	const char	*file;		/* Name of file */
121	Ehdr		*ehdr;		/* ELF header for file */
122	Cache		*cache;		/* Cache of all section headers */
123	uchar_t		osabi;		/* OSABI to use */
124	Word		shnum;		/* # of sections in cache */
125	Cache		*seccache;	/* Cache of symbol table section hdr */
126	Word		secndx;		/* Index of symbol table section hdr */
127	const char	*secname;	/* Name of section */
128	uint_t		flags;		/* Command line option flags */
129	struct {			/* Extended section index data */
130		int	checked;	/* TRUE if already checked for shxndx */
131		Word	*data;		/* NULL, or extended section index */
132					/*	used for symbol table entries */
133		uint_t	n;		/* # items in shxndx.data */
134	} shxndx;
135	VERSYM_STATE	*versym;	/* NULL, or associated VERSYM section */
136	Sym 		*sym;		/* Array of symbols */
137	Word		symn;		/* # of symbols */
138} SYMTBL_STATE;
139
140/*
141 * A variable of this type is used to track information related to
142 * .eh_frame and .eh_frame_hdr sections across calls to unwind_eh_frame().
143 */
144typedef struct {
145	Word		frame_cnt;	/* # .eh_frame sections seen */
146	Word		frame_ndx;	/* Section index of 1st .eh_frame */
147	Word		hdr_cnt;	/* # .eh_frame_hdr sections seen */
148	Word		hdr_ndx;	/* Section index of 1st .eh_frame_hdr */
149	uint64_t	frame_ptr;	/* Value of FramePtr field from first */
150					/*	.eh_frame_hdr section */
151	uint64_t	frame_base;	/* Data addr of 1st .eh_frame  */
152} gnu_eh_state_t;
153
154/*
155 * C++ .exception_ranges entries make use of the signed ptrdiff_t
156 * type to record self-relative pointer values. We need a type
157 * for this that is matched to the ELFCLASS being processed.
158 */
159#if	defined(_ELF64)
160	typedef int64_t PTRDIFF_T;
161#else
162	typedef int32_t PTRDIFF_T;
163#endif
164
165/*
166 * The Sun C++ ABI uses this struct to define each .exception_ranges
167 * entry. From the ABI:
168 *
169 * The field ret_addr is a self relative pointer to the start of the address
170 * range. The name was chosen because in the current implementation the range
171 * typically starts at the return address for a call site.
172 *
173 * The field length is the difference, in bytes, between the pc of the last
174 * instruction covered by the exception range and the first. When only a
175 * single call site is represented without optimization, this will equal zero.
176 *
177 * The field handler_addr is a relative pointer which stores the difference
178 * between the start of the exception range and the address of all code to
179 * catch exceptions and perform the cleanup for stack unwinding.
180 *
181 * The field type_block is a relative pointer which stores the difference
182 * between the start of the exception range and the address of an array used
183 * for storing a list of the types of exceptions which can be caught within
184 * the exception range.
185 */
186typedef struct {
187	PTRDIFF_T	ret_addr;
188	Xword		length;
189	PTRDIFF_T	handler_addr;
190	PTRDIFF_T	type_block;
191	Xword		reserved;
192} exception_range_entry;
193
194/*
195 * Focal point for verifying symbol names.
196 */
197static const char *
198string(Cache *refsec, Word ndx, Cache *strsec, const char *file, Word name)
199{
200	/*
201	 * If an error in this routine is due to a property of the string
202	 * section, as opposed to a bad offset into the section (a property of
203	 * the referencing section), then we will detect the same error on
204	 * every call involving those sections. We use these static variables
205	 * to retain the information needed to only issue each such error once.
206	 */
207	static Cache	*last_refsec;	/* Last referencing section seen */
208	static int	strsec_err;	/* True if error issued */
209
210	const char	*strs;
211	Word		strn;
212
213	if ((strsec->c_data == NULL) || (strsec->c_data->d_buf == NULL))
214		return (NULL);
215
216	strs = (char *)strsec->c_data->d_buf;
217	strn = strsec->c_data->d_size;
218
219	/*
220	 * We only print a diagnostic regarding a bad string table once per
221	 * input section being processed. If the refsec has changed, reset
222	 * our retained error state.
223	 */
224	if (last_refsec != refsec) {
225		last_refsec = refsec;
226		strsec_err = 0;
227	}
228
229	/* Verify that strsec really is a string table */
230	if (strsec->c_shdr->sh_type != SHT_STRTAB) {
231		if (!strsec_err) {
232			(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOTSTRTAB),
233			    file, strsec->c_ndx, refsec->c_ndx);
234			strsec_err = 1;
235		}
236		return (MSG_INTL(MSG_STR_UNKNOWN));
237	}
238
239	/*
240	 * Is the string table offset within range of the available strings?
241	 */
242	if (name >= strn) {
243		/*
244		 * Do we have a empty string table?
245		 */
246		if (strs == NULL) {
247			if (!strsec_err) {
248				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
249				    file, strsec->c_name);
250				strsec_err = 1;
251			}
252		} else {
253			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSTOFF),
254			    file, refsec->c_name, EC_WORD(ndx), strsec->c_name,
255			    EC_WORD(name), EC_WORD(strn - 1));
256		}
257
258		/*
259		 * Return the empty string so that the calling function can
260		 * continue it's output diagnostics.
261		 */
262		return (MSG_INTL(MSG_STR_UNKNOWN));
263	}
264	return (strs + name);
265}
266
267/*
268 * Relocations can reference section symbols and standard symbols.  If the
269 * former, establish the section name.
270 */
271static const char *
272relsymname(Cache *cache, Cache *csec, Cache *strsec, Word symndx, Word symnum,
273    Word relndx, Sym *syms, char *secstr, size_t secsz, const char *file)
274{
275	Sym		*sym;
276	const char	*name;
277
278	if (symndx >= symnum) {
279		(void) fprintf(stderr, MSG_INTL(MSG_ERR_RELBADSYMNDX),
280		    file, EC_WORD(symndx), EC_WORD(relndx));
281		return (MSG_INTL(MSG_STR_UNKNOWN));
282	}
283
284	sym = (Sym *)(syms + symndx);
285	name = string(csec, symndx, strsec, file, sym->st_name);
286
287	/*
288	 * If the symbol represents a section offset construct an appropriate
289	 * string.  Note, although section symbol table entries typically have
290	 * a NULL name pointer, entries do exist that point into the string
291	 * table to their own NULL strings.
292	 */
293	if ((ELF_ST_TYPE(sym->st_info) == STT_SECTION) &&
294	    ((sym->st_name == 0) || (*name == '\0'))) {
295		(void) snprintf(secstr, secsz, MSG_INTL(MSG_STR_SECTION),
296		    cache[sym->st_shndx].c_name);
297		return ((const char *)secstr);
298	}
299
300	return (name);
301}
302
303/*
304 * Focal point for establishing a string table section.  Data such as the
305 * dynamic information simply points to a string table.  Data such as
306 * relocations, reference a symbol table, which in turn is associated with a
307 * string table.
308 */
309static int
310stringtbl(Cache *cache, int symtab, Word ndx, Word shnum, const char *file,
311    Word *symnum, Cache **symsec, Cache **strsec)
312{
313	Shdr	*shdr = cache[ndx].c_shdr;
314
315	/*
316	 * If symtab is non-zero, the ndx we are called with represents a
317	 * shdr which links to a symbol table (which then links to a string
318	 * table)
319	 */
320	if (symtab != 0) {
321		/*
322		 * Validate the symbol table linkage.
323		 */
324		if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
325			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
326			    file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
327			return (0);
328		}
329
330		/*
331		 * Establish the symbol table index.
332		 */
333		ndx = shdr->sh_link;
334		shdr = cache[ndx].c_shdr;
335
336		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
337			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
338			    file, cache[ndx].c_name);
339			return (0);
340		}
341
342		/*
343		 * Obtain, and verify the symbol table data.
344		 */
345		if ((cache[ndx].c_data == NULL) ||
346		    (cache[ndx].c_data->d_buf == NULL)) {
347			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
348			    file, cache[ndx].c_name);
349			return (0);
350		}
351
352		/*
353		 * Return symbol table information.
354		 */
355		if (symnum)
356			*symnum = (shdr->sh_size / shdr->sh_entsize);
357		if (symsec)
358			*symsec = &cache[ndx];
359	}
360
361	/*
362	 * Validate the string table linkage.
363	 */
364	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
365		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
366		    file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
367		return (0);
368	}
369
370	if (strsec)
371		*strsec = &cache[shdr->sh_link];
372
373	return (1);
374}
375
376/*
377 * Lookup a symbol and set Sym accordingly.
378 *
379 * entry:
380 *	name - Name of symbol to lookup
381 *	cache - Cache of all section headers
382 *	shnum - # of sections in cache
383 *	sym - Address of pointer to receive symbol
384 *	target - NULL, or section to which the symbol must be associated.
385 *	symtab - Symbol table to search for symbol
386 *	file - Name of file
387 *
388 * exit:
389 *	If the symbol is found, *sym is set to reference it, and True is
390 *	returned. If target is non-NULL, the symbol must reference the given
391 *	section --- otherwise the section is not checked.
392 *
393 *	If no symbol is found, False is returned.
394 */
395static int
396symlookup(const char *name, Cache *cache, Word shnum, Sym **sym,
397    Cache *target, Cache *symtab, const char *file)
398{
399	Shdr	*shdr;
400	Word	symn, cnt;
401	Sym	*syms;
402
403	if (symtab == 0)
404		return (0);
405
406	shdr = symtab->c_shdr;
407
408	/*
409	 * Determine the symbol data and number.
410	 */
411	if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
412		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
413		    file, symtab->c_name);
414		return (0);
415	}
416	if ((symtab->c_data == NULL) || (symtab->c_data->d_buf == NULL))
417		return (0);
418
419	/* LINTED */
420	symn = (Word)(shdr->sh_size / shdr->sh_entsize);
421	syms = (Sym *)symtab->c_data->d_buf;
422
423	/*
424	 * Get the associated string table section.
425	 */
426	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
427		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
428		    file, symtab->c_name, EC_WORD(shdr->sh_link));
429		return (0);
430	}
431
432	/*
433	 * Loop through the symbol table to find a match.
434	 */
435	*sym = NULL;
436	for (cnt = 0; cnt < symn; syms++, cnt++) {
437		const char	*symname;
438
439		symname = string(symtab, cnt, &cache[shdr->sh_link], file,
440		    syms->st_name);
441
442		if (symname && (strcmp(name, symname) == 0) &&
443		    ((target == NULL) || (target->c_ndx == syms->st_shndx))) {
444			/*
445			 * It is possible, though rare, for a local and
446			 * global symbol of the same name to exist, each
447			 * contributed by a different input object. If the
448			 * symbol just found is local, remember it, but
449			 * continue looking.
450			 */
451			*sym = syms;
452			if (ELF_ST_BIND(syms->st_info) != STB_LOCAL)
453				break;
454		}
455	}
456
457	return (*sym != NULL);
458}
459
460/*
461 * Print section headers.
462 */
463static void
464sections(const char *file, Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi)
465{
466	size_t	seccnt;
467
468	for (seccnt = 1; seccnt < shnum; seccnt++) {
469		Cache		*_cache = &cache[seccnt];
470		Shdr		*shdr = _cache->c_shdr;
471		const char	*secname = _cache->c_name;
472
473		/*
474		 * Although numerous section header entries can be zero, it's
475		 * usually a sign of trouble if the type is zero.
476		 */
477		if (shdr->sh_type == 0) {
478			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHTYPE),
479			    file, secname, EC_WORD(shdr->sh_type));
480		}
481
482		if (!match(MATCH_F_ALL, secname, seccnt, shdr->sh_type))
483			continue;
484
485		/*
486		 * Identify any sections that are suspicious.  A .got section
487		 * shouldn't exist in a relocatable object.
488		 */
489		if (ehdr->e_type == ET_REL) {
490			if (strncmp(secname, MSG_ORIG(MSG_ELF_GOT),
491			    MSG_ELF_GOT_SIZE) == 0) {
492				(void) fprintf(stderr,
493				    MSG_INTL(MSG_GOT_UNEXPECTED), file,
494				    secname);
495			}
496		}
497
498		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
499		dbg_print(0, MSG_INTL(MSG_ELF_SHDR), EC_WORD(seccnt), secname);
500		Elf_shdr(0, osabi, ehdr->e_machine, shdr);
501	}
502}
503
504/*
505 * Obtain a specified Phdr entry.
506 */
507static Phdr *
508getphdr(Word phnum, Word *type_arr, Word type_cnt, const char *file, Elf *elf)
509{
510	Word	cnt, tcnt;
511	Phdr	*phdr;
512
513	if ((phdr = elf_getphdr(elf)) == NULL) {
514		failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
515		return (NULL);
516	}
517
518	for (cnt = 0; cnt < phnum; phdr++, cnt++) {
519		for (tcnt = 0; tcnt < type_cnt; tcnt++) {
520			if (phdr->p_type == type_arr[tcnt])
521				return (phdr);
522		}
523	}
524	return (NULL);
525}
526
527/*
528 * Display the contents of GNU/amd64 .eh_frame and .eh_frame_hdr
529 * sections.
530 *
531 * entry:
532 *	cache - Cache of all section headers
533 *	shndx - Index of .eh_frame or .eh_frame_hdr section to be displayed
534 *	shnum - Total number of sections which exist
535 *	uphdr - NULL, or unwind program header associated with
536 *		the .eh_frame_hdr section.
537 *	ehdr - ELF header for file
538 *	eh_state - Data used across calls to this routine. The
539 *		caller should zero it before the first call, and
540 *		pass it on every call.
541 *	osabi - OSABI to use in displaying information
542 *	file - Name of file
543 *	flags - Command line option flags
544 */
545static void
546unwind_eh_frame(Cache *cache, Word shndx, Word shnum, Phdr *uphdr, Ehdr *ehdr,
547    gnu_eh_state_t *eh_state, uchar_t osabi, const char *file, uint_t flags)
548{
549#if	defined(_ELF64)
550#define	MSG_UNW_BINSRTAB2	MSG_UNW_BINSRTAB2_64
551#define	MSG_UNW_BINSRTABENT	MSG_UNW_BINSRTABENT_64
552#else
553#define	MSG_UNW_BINSRTAB2	MSG_UNW_BINSRTAB2_32
554#define	MSG_UNW_BINSRTABENT	MSG_UNW_BINSRTABENT_32
555#endif
556
557	Cache			*_cache = &cache[shndx];
558	Shdr			*shdr = _cache->c_shdr;
559	uchar_t			*data = (uchar_t *)(_cache->c_data->d_buf);
560	size_t			datasize = _cache->c_data->d_size;
561	Conv_dwarf_ehe_buf_t	dwarf_ehe_buf;
562	uint64_t		ndx, frame_ptr, fde_cnt, tabndx;
563	uint_t			vers, frame_ptr_enc, fde_cnt_enc, table_enc;
564	uint64_t		initloc, initloc0 = 0;
565	uint64_t		gotaddr = 0;
566	int			cnt;
567
568	for (cnt = 1; cnt < shnum; cnt++) {
569		if (strncmp(cache[cnt].c_name, MSG_ORIG(MSG_ELF_GOT),
570		    MSG_ELF_GOT_SIZE) == 0) {
571			gotaddr = cache[cnt].c_shdr->sh_addr;
572			break;
573		}
574	}
575
576	if ((data == NULL) || (datasize == 0)) {
577		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
578		    file, _cache ->c_name);
579		return;
580	}
581
582	/*
583	 * Is this a .eh_frame_hdr?
584	 */
585	if ((uphdr && (shdr->sh_addr == uphdr->p_vaddr)) ||
586	    (strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRMHDR),
587	    MSG_SCN_FRMHDR_SIZE) == 0)) {
588		/*
589		 * There can only be a single .eh_frame_hdr.
590		 * Flag duplicates.
591		 */
592		if (++eh_state->hdr_cnt > 1)
593			(void) fprintf(stderr, MSG_INTL(MSG_ERR_MULTEHFRMHDR),
594			    file, EC_WORD(shndx), _cache->c_name);
595
596		dbg_print(0, MSG_ORIG(MSG_UNW_FRMHDR));
597		ndx = 0;
598
599		vers = data[ndx++];
600		frame_ptr_enc = data[ndx++];
601		fde_cnt_enc = data[ndx++];
602		table_enc = data[ndx++];
603
604		dbg_print(0, MSG_ORIG(MSG_UNW_FRMVERS), vers);
605
606		switch (dwarf_ehe_extract(data, datasize, &ndx,
607		    &frame_ptr, frame_ptr_enc, ehdr->e_ident, B_TRUE,
608		    shdr->sh_addr, ndx, gotaddr)) {
609		case DW_OVERFLOW:
610			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWOVRFLW),
611			    file, _cache->c_name);
612			return;
613		case DW_BAD_ENCODING:
614			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWBADENC),
615			    file, _cache->c_name, frame_ptr_enc);
616			return;
617		case DW_SUCCESS:
618			break;
619		}
620		if (eh_state->hdr_cnt == 1) {
621			eh_state->hdr_ndx = shndx;
622			eh_state->frame_ptr = frame_ptr;
623		}
624
625		dbg_print(0, MSG_ORIG(MSG_UNW_FRPTRENC),
626		    conv_dwarf_ehe(frame_ptr_enc, &dwarf_ehe_buf),
627		    EC_XWORD(frame_ptr));
628
629		switch (dwarf_ehe_extract(data, datasize, &ndx, &fde_cnt,
630		    fde_cnt_enc, ehdr->e_ident, B_TRUE, shdr->sh_addr, ndx,
631		    gotaddr)) {
632		case DW_OVERFLOW:
633			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWOVRFLW),
634			    file, _cache->c_name);
635			return;
636		case DW_BAD_ENCODING:
637			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWBADENC),
638			    file, _cache->c_name, fde_cnt_enc);
639			return;
640		case DW_SUCCESS:
641			break;
642		}
643
644		dbg_print(0, MSG_ORIG(MSG_UNW_FDCNENC),
645		    conv_dwarf_ehe(fde_cnt_enc, &dwarf_ehe_buf),
646		    EC_XWORD(fde_cnt));
647		dbg_print(0, MSG_ORIG(MSG_UNW_TABENC),
648		    conv_dwarf_ehe(table_enc, &dwarf_ehe_buf));
649		dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTAB1));
650		dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTAB2));
651
652		for (tabndx = 0; tabndx < fde_cnt; tabndx++) {
653			uint64_t table;
654
655			switch (dwarf_ehe_extract(data, datasize, &ndx,
656			    &initloc, table_enc, ehdr->e_ident, B_TRUE,
657			    shdr->sh_addr, ndx, gotaddr)) {
658			case DW_OVERFLOW:
659				(void) fprintf(stderr,
660				    MSG_INTL(MSG_ERR_DWOVRFLW), file,
661				    _cache->c_name);
662				return;
663			case DW_BAD_ENCODING:
664				(void) fprintf(stderr,
665				    MSG_INTL(MSG_ERR_DWBADENC), file,
666				    _cache->c_name, table_enc);
667				return;
668			case DW_SUCCESS:
669				break;
670			}
671			if ((tabndx != 0) && (initloc0 > initloc))
672				(void) fprintf(stderr,
673				    MSG_INTL(MSG_ERR_BADSORT), file,
674				    _cache->c_name, EC_WORD(tabndx));
675			switch (dwarf_ehe_extract(data, datasize, &ndx, &table,
676			    table_enc, ehdr->e_ident, B_TRUE, shdr->sh_addr,
677			    ndx, gotaddr)) {
678			case DW_OVERFLOW:
679				(void) fprintf(stderr,
680				    MSG_INTL(MSG_ERR_DWOVRFLW), file,
681				    _cache->c_name);
682				return;
683			case DW_BAD_ENCODING:
684				(void) fprintf(stderr,
685				    MSG_INTL(MSG_ERR_DWBADENC), file,
686				    _cache->c_name, table_enc);
687				return;
688			case DW_SUCCESS:
689				break;
690			}
691
692			dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTABENT),
693			    EC_XWORD(initloc),
694			    EC_XWORD(table));
695			initloc0 = initloc;
696		}
697	} else {		/* Display the .eh_frame section */
698		eh_state->frame_cnt++;
699		if (eh_state->frame_cnt == 1) {
700			eh_state->frame_ndx = shndx;
701			eh_state->frame_base = shdr->sh_addr;
702		} else if ((eh_state->frame_cnt >  1) &&
703		    (ehdr->e_type != ET_REL)) {
704			Conv_inv_buf_t	inv_buf;
705
706			(void) fprintf(stderr, MSG_INTL(MSG_WARN_MULTEHFRM),
707			    file, EC_WORD(shndx), _cache->c_name,
708			    conv_ehdr_type(osabi, ehdr->e_type, 0, &inv_buf));
709		}
710		dump_eh_frame(file, _cache->c_name, data, datasize,
711		    shdr->sh_addr, ehdr->e_machine, ehdr->e_ident, gotaddr);
712	}
713
714	/*
715	 * If we've seen the .eh_frame_hdr and the first .eh_frame section,
716	 * compare the header frame_ptr to the address of the actual frame
717	 * section to ensure the link-editor got this right.  Note, this
718	 * diagnostic is only produced when unwind information is explicitly
719	 * asked for, as shared objects built with an older ld(1) may reveal
720	 * this inconsistency.  Although an inconsistency, it doesn't seem to
721	 * have any adverse effect on existing tools.
722	 */
723	if (((flags & FLG_MASK_SHOW) != FLG_MASK_SHOW) &&
724	    (eh_state->hdr_cnt > 0) && (eh_state->frame_cnt > 0) &&
725	    (eh_state->frame_ptr != eh_state->frame_base))
726		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADEHFRMPTR),
727		    file, EC_WORD(eh_state->hdr_ndx),
728		    cache[eh_state->hdr_ndx].c_name,
729		    EC_XWORD(eh_state->frame_ptr),
730		    EC_WORD(eh_state->frame_ndx),
731		    cache[eh_state->frame_ndx].c_name,
732		    EC_XWORD(eh_state->frame_base));
733#undef MSG_UNW_BINSRTAB2
734#undef MSG_UNW_BINSRTABENT
735}
736
737/*
738 * Convert a self relative pointer into an address. A self relative
739 * pointer adds the address where the pointer resides to the offset
740 * contained in the pointer. The benefit is that the value of the
741 * pointer does not require relocation.
742 *
743 * entry:
744 *	base_addr - Address of the pointer.
745 *	delta - Offset relative to base_addr giving desired address
746 *
747 * exit:
748 *	The computed address is returned.
749 *
750 * note:
751 *	base_addr is an unsigned value, while ret_addr is signed. This routine
752 *	used explicit testing and casting to explicitly control type
753 *	conversion, and ensure that we handle the maximum possible range.
754 */
755static Addr
756srelptr(Addr base_addr, PTRDIFF_T delta)
757{
758	if (delta < 0)
759		return (base_addr - (Addr) (-delta));
760
761	return (base_addr + (Addr) delta);
762}
763
764/*
765 * Byte swap a PTRDIFF_T value.
766 */
767static PTRDIFF_T
768swap_ptrdiff(PTRDIFF_T value)
769{
770	PTRDIFF_T r;
771	uchar_t	*dst = (uchar_t *)&r;
772	uchar_t	*src = (uchar_t *)&value;
773
774	UL_ASSIGN_BSWAP_XWORD(dst, src);
775	return (r);
776}
777
778/*
779 * Display exception_range_entry items from the .exception_ranges section
780 * of a Sun C++ object.
781 */
782static void
783unwind_exception_ranges(Cache *_cache, const char *file, int do_swap)
784{
785	/*
786	 * Translate a PTRDIFF_T self-relative address field of
787	 * an exception_range_entry struct into an address.
788	 *
789	 * entry:
790	 *	exc_addr - Address of base of exception_range_entry struct
791	 *	cur_ent - Pointer to data in the struct to be translated
792	 *
793	 *	_f - Field of struct to be translated
794	 */
795#define	SRELPTR(_f) \
796	srelptr(exc_addr + offsetof(exception_range_entry, _f), cur_ent->_f)
797
798#if	defined(_ELF64)
799#define	MSG_EXR_TITLE	MSG_EXR_TITLE_64
800#define	MSG_EXR_ENTRY	MSG_EXR_ENTRY_64
801#else
802#define	MSG_EXR_TITLE	MSG_EXR_TITLE_32
803#define	MSG_EXR_ENTRY	MSG_EXR_ENTRY_32
804#endif
805
806	exception_range_entry	scratch, *ent, *cur_ent = &scratch;
807	char			index[MAXNDXSIZE];
808	Word			i, nelts;
809	Addr			addr, addr0 = 0, offset = 0;
810	Addr			exc_addr = _cache->c_shdr->sh_addr;
811
812	dbg_print(0, MSG_INTL(MSG_EXR_TITLE));
813	ent = (exception_range_entry *)(_cache->c_data->d_buf);
814	nelts = _cache->c_data->d_size / sizeof (exception_range_entry);
815
816	for (i = 0; i < nelts; i++, ent++) {
817		if (do_swap) {
818			/*
819			 * Copy byte swapped values into the scratch buffer.
820			 * The reserved field is not used, so we skip it.
821			 */
822			scratch.ret_addr = swap_ptrdiff(ent->ret_addr);
823			scratch.length = BSWAP_XWORD(ent->length);
824			scratch.handler_addr = swap_ptrdiff(ent->handler_addr);
825			scratch.type_block = swap_ptrdiff(ent->type_block);
826		} else {
827			cur_ent = ent;
828		}
829
830		/*
831		 * The table is required to be sorted by the address
832		 * derived from ret_addr, to allow binary searching. Ensure
833		 * that addresses grow monotonically.
834		 */
835		addr = SRELPTR(ret_addr);
836		if ((i != 0) && (addr0 > addr))
837			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSORT),
838			    file, _cache->c_name, EC_WORD(i));
839
840		(void) snprintf(index, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX),
841		    EC_XWORD(i));
842		dbg_print(0, MSG_INTL(MSG_EXR_ENTRY), index, EC_ADDR(offset),
843		    EC_ADDR(addr), EC_ADDR(cur_ent->length),
844		    EC_ADDR(SRELPTR(handler_addr)),
845		    EC_ADDR(SRELPTR(type_block)));
846
847		addr0 = addr;
848		exc_addr += sizeof (exception_range_entry);
849		offset += sizeof (exception_range_entry);
850	}
851
852#undef SRELPTR
853#undef MSG_EXR_TITLE
854#undef MSG_EXR_ENTRY
855}
856
857/*
858 * Display information from unwind/exception sections:
859 *
860 * -	GNU/amd64 .eh_frame and .eh_frame_hdr
861 * -	Sun C++ .exception_ranges
862 *
863 */
864static void
865unwind(Cache *cache, Word shnum, Word phnum, Ehdr *ehdr, uchar_t osabi,
866    const char *file, Elf *elf, uint_t flags)
867{
868	static Word phdr_types[] = { PT_SUNW_UNWIND, PT_SUNW_EH_FRAME };
869
870	Word			cnt;
871	Phdr			*uphdr = NULL;
872	gnu_eh_state_t		eh_state;
873
874	/*
875	 * Historical background: .eh_frame and .eh_frame_hdr sections
876	 * come from the GNU compilers (particularly C++), and are used
877	 * under all architectures. Their format is based on DWARF. When
878	 * the amd64 ABI was defined, these sections were adopted wholesale
879	 * from the existing practice.
880	 *
881	 * When amd64 support was added to Solaris, support for these
882	 * sections was added, using the SHT_AMD64_UNWIND section type
883	 * to identify them. At first, we ignored them in objects for
884	 * non-amd64 targets, but later broadened our support to include
885	 * other architectures in order to better support gcc-generated
886	 * objects.
887	 *
888	 * .exception_ranges implement the same basic concepts, but
889	 * were invented at Sun for the Sun C++ compiler.
890	 *
891	 * We match these sections by name, rather than section type,
892	 * because they can come in as either SHT_AMD64_UNWIND, or as
893	 * SHT_PROGBITS, and because the type isn't enough to determine
894	 * how they should be interpreted.
895	 */
896	/* Find the program header for .eh_frame_hdr if present */
897	if (phnum)
898		uphdr = getphdr(phnum, phdr_types,
899		    sizeof (phdr_types) / sizeof (*phdr_types), file, elf);
900
901	/*
902	 * eh_state is used to retain data used by unwind_eh_frame()
903	 * across calls.
904	 */
905	bzero(&eh_state, sizeof (eh_state));
906
907	for (cnt = 1; cnt < shnum; cnt++) {
908		Cache		*_cache = &cache[cnt];
909		Shdr		*shdr = _cache->c_shdr;
910		int		is_exrange;
911
912		/*
913		 * Skip sections of the wrong type. On amd64, they
914		 * can be SHT_AMD64_UNWIND. On all platforms, they
915		 * can be SHT_PROGBITS (including amd64, if using
916		 * the GNU compilers).
917		 *
918		 * Skip anything other than these two types. The name
919		 * test below will thin out the SHT_PROGBITS that don't apply.
920		 */
921		if ((shdr->sh_type != SHT_PROGBITS) &&
922		    (shdr->sh_type != SHT_AMD64_UNWIND))
923			continue;
924
925		/*
926		 * Only sections with certain well known names are of interest.
927		 * These are:
928		 *
929		 *	.eh_frame - amd64/GNU-compiler unwind sections
930		 *	.eh_frame_hdr - Sorted table referencing .eh_frame
931		 *	.exception_ranges - Sun C++ unwind sections
932		 *
933		 * We do a prefix comparison, allowing for naming conventions
934		 * like .eh_frame.foo, hence the use of strncmp() rather than
935		 * strcmp(). This means that we only really need to test for
936		 * .eh_frame, as it's a prefix of .eh_frame_hdr.
937		 */
938		is_exrange =  strncmp(_cache->c_name,
939		    MSG_ORIG(MSG_SCN_EXRANGE), MSG_SCN_EXRANGE_SIZE) == 0;
940		if ((strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRM),
941		    MSG_SCN_FRM_SIZE) != 0) && !is_exrange)
942			continue;
943
944		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
945			continue;
946
947		if ((_cache->c_data == NULL) || (_cache->c_data->d_buf == NULL))
948			continue;
949
950		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
951		dbg_print(0, MSG_INTL(MSG_ELF_SCN_UNWIND), _cache->c_name);
952
953		if (is_exrange)
954			unwind_exception_ranges(_cache, file,
955			    _elf_sys_encoding() != ehdr->e_ident[EI_DATA]);
956		else
957			unwind_eh_frame(cache, cnt, shnum, uphdr, ehdr,
958			    &eh_state, osabi, file, flags);
959	}
960}
961
962/*
963 * Initialize a symbol table state structure
964 *
965 * entry:
966 *	state - State structure to be initialized
967 *	cache - Cache of all section headers
968 *	shnum - # of sections in cache
969 *	secndx - Index of symbol table section
970 *	ehdr - ELF header for file
971 *	versym - Information about versym section
972 *	file - Name of file
973 *	flags - Command line option flags
974 */
975static int
976init_symtbl_state(SYMTBL_STATE *state, Cache *cache, Word shnum, Word secndx,
977    Ehdr *ehdr, uchar_t osabi, VERSYM_STATE *versym, const char *file,
978    uint_t flags)
979{
980	Shdr *shdr;
981
982	state->file = file;
983	state->ehdr = ehdr;
984	state->cache = cache;
985	state->osabi = osabi;
986	state->shnum = shnum;
987	state->seccache = &cache[secndx];
988	state->secndx = secndx;
989	state->secname = state->seccache->c_name;
990	state->flags = flags;
991	state->shxndx.checked = 0;
992	state->shxndx.data = NULL;
993	state->shxndx.n = 0;
994
995	shdr = state->seccache->c_shdr;
996
997	/*
998	 * Check the symbol data and per-item size.
999	 */
1000	if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
1001		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1002		    file, state->secname);
1003		return (0);
1004	}
1005	if ((state->seccache->c_data == NULL) ||
1006	    (state->seccache->c_data->d_buf == NULL))
1007		return (0);
1008
1009	/* LINTED */
1010	state->symn = (Word)(shdr->sh_size / shdr->sh_entsize);
1011	state->sym = (Sym *)state->seccache->c_data->d_buf;
1012
1013	/*
1014	 * Check associated string table section.
1015	 */
1016	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
1017		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1018		    file, state->secname, EC_WORD(shdr->sh_link));
1019		return (0);
1020	}
1021
1022	/*
1023	 * Determine if there is a associated Versym section
1024	 * with this Symbol Table.
1025	 */
1026	if (versym && versym->cache &&
1027	    (versym->cache->c_shdr->sh_link == state->secndx))
1028		state->versym = versym;
1029	else
1030		state->versym = NULL;
1031
1032
1033	return (1);
1034}
1035
1036/*
1037 * Determine the extended section index used for symbol tables entries.
1038 */
1039static void
1040symbols_getxindex(SYMTBL_STATE *state)
1041{
1042	uint_t	symn;
1043	Word	symcnt;
1044
1045	state->shxndx.checked = 1;   /* Note that we've been called */
1046	for (symcnt = 1; symcnt < state->shnum; symcnt++) {
1047		Cache	*_cache = &state->cache[symcnt];
1048		Shdr	*shdr = _cache->c_shdr;
1049
1050		if ((shdr->sh_type != SHT_SYMTAB_SHNDX) ||
1051		    (shdr->sh_link != state->secndx))
1052			continue;
1053
1054		if ((shdr->sh_entsize) &&
1055		    /* LINTED */
1056		    ((symn = (uint_t)(shdr->sh_size / shdr->sh_entsize)) == 0))
1057			continue;
1058
1059		if ((_cache->c_data == NULL) || (_cache->c_data->d_buf == NULL))
1060			continue;
1061
1062		state->shxndx.data = _cache->c_data->d_buf;
1063		state->shxndx.n = symn;
1064		return;
1065	}
1066}
1067
1068/*
1069 * Produce a line of output for the given symbol
1070 *
1071 * entry:
1072 *	state - Symbol table state
1073 *	symndx - Index of symbol within the table
1074 *	info - Value of st_info (indicates local/global range)
1075 *	symndx_disp - Index to display. This may not be the same
1076 *		as symndx if the display is relative to the logical
1077 *		combination of the SUNW_ldynsym/dynsym tables.
1078 *	sym - Symbol to display
1079 */
1080static void
1081output_symbol(SYMTBL_STATE *state, Word symndx, Word info, Word disp_symndx,
1082    Sym *sym)
1083{
1084	/*
1085	 * Symbol types for which we check that the specified
1086	 * address/size land inside the target section.
1087	 */
1088	static const int addr_symtype[] = {
1089		0,			/* STT_NOTYPE */
1090		1,			/* STT_OBJECT */
1091		1,			/* STT_FUNC */
1092		0,			/* STT_SECTION */
1093		0,			/* STT_FILE */
1094		1,			/* STT_COMMON */
1095		0,			/* STT_TLS */
1096		0,			/* 7 */
1097		0,			/* 8 */
1098		0,			/* 9 */
1099		0,			/* 10 */
1100		0,			/* 11 */
1101		0,			/* 12 */
1102		0,			/* STT_SPARC_REGISTER */
1103		0,			/* 14 */
1104		0,			/* 15 */
1105	};
1106#if STT_NUM != (STT_TLS + 1)
1107#error "STT_NUM has grown. Update addr_symtype[]"
1108#endif
1109
1110	char		index[MAXNDXSIZE];
1111	const char	*symname, *sec;
1112	Versym		verndx;
1113	int		gnuver;
1114	uchar_t		type;
1115	Shdr		*tshdr;
1116	Word		shndx;
1117	Conv_inv_buf_t	inv_buf;
1118
1119	/* Ensure symbol index is in range */
1120	if (symndx >= state->symn) {
1121		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSYMNDX),
1122		    state->file, state->secname, EC_WORD(symndx));
1123		return;
1124	}
1125
1126	/*
1127	 * If we are using extended symbol indexes, find the
1128	 * corresponding SHN_SYMTAB_SHNDX table.
1129	 */
1130	if ((sym->st_shndx == SHN_XINDEX) && (state->shxndx.checked == 0))
1131		symbols_getxindex(state);
1132
1133	/* LINTED */
1134	symname = string(state->seccache, symndx,
1135	    &state->cache[state->seccache->c_shdr->sh_link], state->file,
1136	    sym->st_name);
1137
1138	tshdr = NULL;
1139	sec = NULL;
1140
1141	if (state->ehdr->e_type == ET_CORE) {
1142		sec = (char *)MSG_INTL(MSG_STR_UNKNOWN);
1143	} else if (state->flags & FLG_CTL_FAKESHDR) {
1144		/*
1145		 * If we are using fake section headers derived from
1146		 * the program headers, then the section indexes
1147		 * in the symbols do not correspond to these headers.
1148		 * The section names are not available, so all we can
1149		 * do is to display them in numeric form.
1150		 */
1151		sec = conv_sym_shndx(state->osabi, state->ehdr->e_machine,
1152		    sym->st_shndx, CONV_FMT_DECIMAL, &inv_buf);
1153	} else if ((sym->st_shndx < SHN_LORESERVE) &&
1154	    (sym->st_shndx < state->shnum)) {
1155		shndx = sym->st_shndx;
1156		tshdr = state->cache[shndx].c_shdr;
1157		sec = state->cache[shndx].c_name;
1158	} else if (sym->st_shndx == SHN_XINDEX) {
1159		if (state->shxndx.data) {
1160			Word	_shxndx;
1161
1162			if (symndx > state->shxndx.n) {
1163				(void) fprintf(stderr,
1164				    MSG_INTL(MSG_ERR_BADSYMXINDEX1),
1165				    state->file, state->secname,
1166				    EC_WORD(symndx));
1167			} else if ((_shxndx =
1168			    state->shxndx.data[symndx]) > state->shnum) {
1169				(void) fprintf(stderr,
1170				    MSG_INTL(MSG_ERR_BADSYMXINDEX2),
1171				    state->file, state->secname,
1172				    EC_WORD(symndx), EC_WORD(_shxndx));
1173			} else {
1174				shndx = _shxndx;
1175				tshdr = state->cache[shndx].c_shdr;
1176				sec = state->cache[shndx].c_name;
1177			}
1178		} else {
1179			(void) fprintf(stderr,
1180			    MSG_INTL(MSG_ERR_BADSYMXINDEX3),
1181			    state->file, state->secname, EC_WORD(symndx));
1182		}
1183	} else if ((sym->st_shndx < SHN_LORESERVE) &&
1184	    (sym->st_shndx >= state->shnum)) {
1185		(void) fprintf(stderr,
1186		    MSG_INTL(MSG_ERR_BADSYM5), state->file,
1187		    state->secname, EC_WORD(symndx),
1188		    demangle(symname, state->flags), sym->st_shndx);
1189	}
1190
1191	/*
1192	 * If versioning is available display the
1193	 * version index. If not, then use 0.
1194	 */
1195	if (state->versym) {
1196		Versym test_verndx;
1197
1198		verndx = test_verndx = state->versym->data[symndx];
1199		gnuver = state->versym->gnu_full;
1200
1201		/*
1202		 * Check to see if this is a defined symbol with a
1203		 * version index that is outside the valid range for
1204		 * the file. The interpretation of this depends on
1205		 * the style of versioning used by the object.
1206		 *
1207		 * Versions >= VER_NDX_LORESERVE have special meanings,
1208		 * and are exempt from this checking.
1209		 *
1210		 * GNU style version indexes use the top bit of the
1211		 * 16-bit index value (0x8000) as the "hidden bit".
1212		 * We must mask off this bit in order to compare
1213		 * the version against the maximum value.
1214		 */
1215		if (gnuver)
1216			test_verndx &= ~0x8000;
1217
1218		if ((test_verndx > state->versym->max_verndx) &&
1219		    (verndx < VER_NDX_LORESERVE))
1220			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADVER),
1221			    state->file, state->secname, EC_WORD(symndx),
1222			    EC_HALF(test_verndx), state->versym->max_verndx);
1223	} else {
1224		verndx = 0;
1225		gnuver = 0;
1226	}
1227
1228	/*
1229	 * Error checking for TLS.
1230	 */
1231	type = ELF_ST_TYPE(sym->st_info);
1232	if (type == STT_TLS) {
1233		if (tshdr &&
1234		    (sym->st_shndx != SHN_UNDEF) &&
1235		    ((tshdr->sh_flags & SHF_TLS) == 0)) {
1236			(void) fprintf(stderr,
1237			    MSG_INTL(MSG_ERR_BADSYM3), state->file,
1238			    state->secname, EC_WORD(symndx),
1239			    demangle(symname, state->flags));
1240		}
1241	} else if ((type != STT_SECTION) && sym->st_size &&
1242	    tshdr && (tshdr->sh_flags & SHF_TLS)) {
1243		(void) fprintf(stderr,
1244		    MSG_INTL(MSG_ERR_BADSYM4), state->file,
1245		    state->secname, EC_WORD(symndx),
1246		    demangle(symname, state->flags));
1247	}
1248
1249	/*
1250	 * If a symbol with non-zero size has a type that
1251	 * specifies an address, then make sure the location
1252	 * it references is actually contained within the
1253	 * section.  UNDEF symbols don't count in this case,
1254	 * so we ignore them.
1255	 *
1256	 * The meaning of the st_value field in a symbol
1257	 * depends on the type of object. For a relocatable
1258	 * object, it is the offset within the section.
1259	 * For sharable objects, it is the offset relative to
1260	 * the base of the object, and for other types, it is
1261	 * the virtual address. To get an offset within the
1262	 * section for non-ET_REL files, we subtract the
1263	 * base address of the section.
1264	 */
1265	if (addr_symtype[type] && (sym->st_size > 0) &&
1266	    (sym->st_shndx != SHN_UNDEF) && ((sym->st_shndx < SHN_LORESERVE) ||
1267	    (sym->st_shndx == SHN_XINDEX)) && (tshdr != NULL)) {
1268		Word v = sym->st_value;
1269			if (state->ehdr->e_type != ET_REL)
1270				v -= tshdr->sh_addr;
1271		if (((v + sym->st_size) > tshdr->sh_size)) {
1272			(void) fprintf(stderr,
1273			    MSG_INTL(MSG_ERR_BADSYM6), state->file,
1274			    state->secname, EC_WORD(symndx),
1275			    demangle(symname, state->flags),
1276			    EC_WORD(shndx), EC_XWORD(tshdr->sh_size),
1277			    EC_XWORD(sym->st_value), EC_XWORD(sym->st_size));
1278		}
1279	}
1280
1281	/*
1282	 * A typical symbol table uses the sh_info field to indicate one greater
1283	 * than the symbol table index of the last local symbol, STB_LOCAL.
1284	 * Therefore, symbol indexes less than sh_info should have local
1285	 * binding.  Symbol indexes greater than, or equal to sh_info, should
1286	 * have global binding.  Note, we exclude UNDEF/NOTY symbols with zero
1287	 * value and size, as these symbols may be the result of an mcs(1)
1288	 * section deletion.
1289	 */
1290	if (info) {
1291		uchar_t	bind = ELF_ST_BIND(sym->st_info);
1292
1293		if ((symndx < info) && (bind != STB_LOCAL)) {
1294			(void) fprintf(stderr,
1295			    MSG_INTL(MSG_ERR_BADSYM7), state->file,
1296			    state->secname, EC_WORD(symndx),
1297			    demangle(symname, state->flags), EC_XWORD(info));
1298
1299		} else if ((symndx >= info) && (bind == STB_LOCAL) &&
1300		    ((sym->st_shndx != SHN_UNDEF) ||
1301		    (ELF_ST_TYPE(sym->st_info) != STT_NOTYPE) ||
1302		    (sym->st_size != 0) || (sym->st_value != 0))) {
1303			(void) fprintf(stderr,
1304			    MSG_INTL(MSG_ERR_BADSYM8), state->file,
1305			    state->secname, EC_WORD(symndx),
1306			    demangle(symname, state->flags), EC_XWORD(info));
1307		}
1308	}
1309
1310	(void) snprintf(index, MAXNDXSIZE,
1311	    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(disp_symndx));
1312	Elf_syms_table_entry(0, ELF_DBG_ELFDUMP, index, state->osabi,
1313	    state->ehdr->e_machine, sym, verndx, gnuver, sec, symname);
1314}
1315
1316/*
1317 * Process a SHT_SUNW_cap capabilities section.
1318 */
1319static int
1320cap_section(const char *file, Cache *cache, Word shnum, Cache *ccache,
1321    uchar_t osabi, Ehdr *ehdr, uint_t flags)
1322{
1323	SYMTBL_STATE	state;
1324	Word		cnum, capnum, nulls, symcaps;
1325	int		descapndx, objcap, title;
1326	Cap		*cap = (Cap *)ccache->c_data->d_buf;
1327	Shdr		*cishdr, *cshdr = ccache->c_shdr;
1328	Cache		*cicache, *strcache;
1329	Capinfo		*capinfo = NULL;
1330	Word		capinfonum;
1331	const char	*strs = NULL;
1332	size_t		strs_size;
1333
1334	if ((cshdr->sh_entsize == 0) || (cshdr->sh_size == 0)) {
1335		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1336		    file, ccache->c_name);
1337		return (0);
1338	}
1339
1340	/*
1341	 * If this capabilities section is associated with symbols, then the
1342	 * sh_link field points to the associated capabilities information
1343	 * section.  The sh_link field of the capabilities information section
1344	 * points to the associated symbol table.
1345	 */
1346	if (cshdr->sh_link) {
1347		Cache	*scache;
1348		Shdr	*sshdr;
1349
1350		/*
1351		 * Validate that the sh_link field points to a capabilities
1352		 * information section.
1353		 */
1354		if (cshdr->sh_link >= shnum) {
1355			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1356			    file, ccache->c_name, EC_WORD(cshdr->sh_link));
1357			return (0);
1358		}
1359
1360		cicache = &cache[cshdr->sh_link];
1361		cishdr = cicache->c_shdr;
1362
1363		if (cishdr->sh_type != SHT_SUNW_capinfo) {
1364			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAP),
1365			    file, ccache->c_name, EC_WORD(cshdr->sh_link));
1366			return (0);
1367		}
1368
1369		capinfo = cicache->c_data->d_buf;
1370		capinfonum = (Word)(cishdr->sh_size / cishdr->sh_entsize);
1371
1372		/*
1373		 * Validate that the sh_link field of the capabilities
1374		 * information section points to a valid symbol table.
1375		 */
1376		if ((cishdr->sh_link == 0) || (cishdr->sh_link >= shnum)) {
1377			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1378			    file, cicache->c_name, EC_WORD(cishdr->sh_link));
1379			return (0);
1380		}
1381		scache = &cache[cishdr->sh_link];
1382		sshdr = scache->c_shdr;
1383
1384		if ((sshdr->sh_type != SHT_SYMTAB) &&
1385		    (sshdr->sh_type != SHT_DYNSYM)) {
1386			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAPINFO1),
1387			    file, cicache->c_name, EC_WORD(cishdr->sh_link));
1388			return (0);
1389		}
1390
1391		if (!init_symtbl_state(&state, cache, shnum,
1392		    cishdr->sh_link, ehdr, osabi, NULL, file, flags))
1393			return (0);
1394	}
1395
1396	/*
1397	 * If this capabilities section contains capability string entries,
1398	 * then determine the associated string table.  Capabilities entries
1399	 * that define names require that the capability section indicate
1400	 * which string table to use via sh_info.
1401	 */
1402	if (cshdr->sh_info) {
1403		Shdr	*strshdr;
1404
1405		/*
1406		 * Validate that the sh_info field points to a string table.
1407		 */
1408		if (cshdr->sh_info >= shnum) {
1409			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1410			    file, ccache->c_name, EC_WORD(cshdr->sh_info));
1411			return (0);
1412		}
1413
1414		strcache = &cache[cshdr->sh_info];
1415		strshdr = strcache->c_shdr;
1416
1417		if (strshdr->sh_type != SHT_STRTAB) {
1418			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAP),
1419			    file, ccache->c_name, EC_WORD(cshdr->sh_info));
1420			return (0);
1421		}
1422		strs = (const char *)strcache->c_data->d_buf;
1423		strs_size = strcache->c_data->d_size;
1424	}
1425
1426	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1427	dbg_print(0, MSG_INTL(MSG_ELF_SCN_CAP), ccache->c_name);
1428
1429	capnum = (Word)(cshdr->sh_size / cshdr->sh_entsize);
1430
1431	nulls = symcaps = 0;
1432	objcap = title = 1;
1433	descapndx = -1;
1434
1435	/*
1436	 * Traverse the capabilities section printing each capability group.
1437	 * The first capabilities group defines any object capabilities.  Any
1438	 * following groups define symbol capabilities.  In the case where no
1439	 * object capabilities exist, but symbol capabilities do, a single
1440	 * CA_SUNW_NULL terminator for the object capabilities exists.
1441	 */
1442	for (cnum = 0; cnum < capnum; cap++, cnum++) {
1443		if (cap->c_tag == CA_SUNW_NULL) {
1444			/*
1445			 * A CA_SUNW_NULL tag terminates a capabilities group.
1446			 * If the first capabilities tag is CA_SUNW_NULL, then
1447			 * no object capabilities exist.
1448			 */
1449			if ((nulls++ == 0) && (cnum == 0))
1450				objcap = 0;
1451			title = 1;
1452		} else {
1453			if (title) {
1454				if (nulls == 0) {
1455					/*
1456					 * If this capabilities group represents
1457					 * the object capabilities (i.e., no
1458					 * CA_SUNW_NULL tag has been processed
1459					 * yet), then display an object
1460					 * capabilities title.
1461					 */
1462					dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1463					dbg_print(0,
1464					    MSG_INTL(MSG_OBJ_CAP_TITLE));
1465				} else {
1466					/*
1467					 * If this is a symbols capabilities
1468					 * group (i.e., a CA_SUNW_NULL tag has
1469					 * already be found that terminates
1470					 * the object capabilities group), then
1471					 * display a symbol capabilities title,
1472					 * and retain this capabilities index
1473					 * for later processing.
1474					 */
1475					dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1476					dbg_print(0,
1477					    MSG_INTL(MSG_SYM_CAP_TITLE));
1478					descapndx = cnum;
1479				}
1480				Elf_cap_title(0);
1481				title = 0;
1482			}
1483
1484			/*
1485			 * Print the capabilities data.
1486			 *
1487			 * Note that CA_SUNW_PLAT, CA_SUNW_MACH and CA_SUNW_ID
1488			 * entries require a string table, which should have
1489			 * already been established.
1490			 */
1491			if ((strs == NULL) && ((cap->c_tag == CA_SUNW_PLAT) ||
1492			    (cap->c_tag == CA_SUNW_MACH) ||
1493			    (cap->c_tag == CA_SUNW_ID))) {
1494				(void) fprintf(stderr,
1495				    MSG_INTL(MSG_WARN_INVCAP4), file,
1496				    EC_WORD(elf_ndxscn(ccache->c_scn)),
1497				    ccache->c_name, EC_WORD(cshdr->sh_info));
1498			}
1499			Elf_cap_entry(0, cap, cnum, strs, strs_size,
1500			    ehdr->e_machine);
1501		}
1502
1503		/*
1504		 * If this CA_SUNW_NULL tag terminates a symbol capabilities
1505		 * group, determine the associated symbols.
1506		 */
1507		if ((cap->c_tag == CA_SUNW_NULL) && (nulls > 1) &&
1508		    (descapndx != -1)) {
1509			Capinfo	*cip;
1510			Word	inum;
1511
1512			symcaps++;
1513
1514			/*
1515			 * Make sure we've discovered a SHT_SUNW_capinfo table.
1516			 */
1517			if ((cip = capinfo) == NULL) {
1518				(void) fprintf(stderr,
1519				    MSG_INTL(MSG_ERR_INVCAP), file,
1520				    ccache->c_name, EC_WORD(cshdr->sh_link));
1521				return (0);
1522			}
1523
1524			/*
1525			 * Determine what symbols reference this capabilities
1526			 * group.
1527			 */
1528			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1529			dbg_print(0, MSG_INTL(MSG_CAPINFO_ENTRIES));
1530			Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
1531
1532			for (inum = 1, cip++; inum < capinfonum;
1533			    inum++, cip++) {
1534				Word	gndx = (Word)ELF_C_GROUP(*cip);
1535
1536				if (gndx && (gndx == descapndx)) {
1537					output_symbol(&state, inum, 0,
1538					    inum, state.sym + inum);
1539				}
1540			}
1541			descapndx = -1;
1542			continue;
1543		}
1544
1545		/*
1546		 * An SF1_SUNW_ADDR32 software capability tag in a 32-bit
1547		 * object is suspicious as it has no effect.
1548		 */
1549		if ((cap->c_tag == CA_SUNW_SF_1) &&
1550		    (ehdr->e_ident[EI_CLASS] == ELFCLASS32) &&
1551		    (cap->c_un.c_val & SF1_SUNW_ADDR32)) {
1552			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INADDR32SF1),
1553			    file, ccache->c_name);
1554		}
1555	}
1556
1557	/*
1558	 * If this is a dynamic object, with symbol capabilities, then a
1559	 * .SUNW_capchain section should exist.  This section contains a chain
1560	 * of symbol indexes for each capabilities family.  This is the list
1561	 * that is searched by ld.so.1 to determine the best capabilities
1562	 * candidate.
1563	 *
1564	 * Note, more than one capabilities lead symbol can point to the same
1565	 * family chain.  For example, a weak/global pair of symbols can both
1566	 * represent the same family of capabilities symbols.  Therefore, to
1567	 * display all possible families we traverse the capabilities
1568	 * information section looking for CAPINFO_SUNW_GLOB lead symbols.
1569	 * From these we determine the associated capabilities chain to inspect.
1570	 */
1571	if (symcaps &&
1572	    ((ehdr->e_type == ET_EXEC) || (ehdr->e_type == ET_DYN))) {
1573		Capinfo		*cip;
1574		Capchain	*chain;
1575		Cache   	*chcache;
1576		Shdr		*chshdr;
1577		Word		chainnum, inum;
1578
1579		/*
1580		 * Validate that the sh_info field of the capabilities
1581		 * information section points to a capabilities chain section.
1582		 */
1583		if (cishdr->sh_info >= shnum) {
1584			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1585			    file, cicache->c_name, EC_WORD(cishdr->sh_info));
1586			return (0);
1587		}
1588
1589		chcache = &cache[cishdr->sh_info];
1590		chshdr = chcache->c_shdr;
1591
1592		if (chshdr->sh_type != SHT_SUNW_capchain) {
1593			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAPINFO2),
1594			    file, cicache->c_name, EC_WORD(cishdr->sh_info));
1595			return (0);
1596		}
1597
1598		chainnum = (Word)(chshdr->sh_size / chshdr->sh_entsize);
1599		chain = (Capchain *)chcache->c_data->d_buf;
1600
1601		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1602		dbg_print(0, MSG_INTL(MSG_ELF_SCN_CAPCHAIN), chcache->c_name);
1603
1604		/*
1605		 * Traverse the capabilities information section looking for
1606		 * CAPINFO_SUNW_GLOB lead capabilities symbols.
1607		 */
1608		cip = capinfo;
1609		for (inum = 1, cip++; inum < capinfonum; inum++, cip++) {
1610			const char	*name;
1611			Sym		*sym;
1612			Word		sndx, cndx;
1613			Word		gndx = (Word)ELF_C_GROUP(*cip);
1614
1615			if ((gndx == 0) || (gndx != CAPINFO_SUNW_GLOB))
1616				continue;
1617
1618			/*
1619			 * Determine the symbol that is associated with this
1620			 * capability information entry, and use this to
1621			 * identify this capability family.
1622			 */
1623			sym = (Sym *)(state.sym + inum);
1624			name = string(cicache, inum, strcache, file,
1625			    sym->st_name);
1626
1627			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1628			dbg_print(0, MSG_INTL(MSG_CAPCHAIN_TITLE), name);
1629			dbg_print(0, MSG_INTL(MSG_CAPCHAIN_ENTRY));
1630
1631			cndx = (Word)ELF_C_SYM(*cip);
1632
1633			/*
1634			 * Traverse this families chain and identify each
1635			 * family member.
1636			 */
1637			for (;;) {
1638				char	_chain[MAXNDXSIZE], _symndx[MAXNDXSIZE];
1639
1640				if (cndx >= chainnum) {
1641					(void) fprintf(stderr,
1642					    MSG_INTL(MSG_ERR_INVCAPINFO3), file,
1643					    cicache->c_name, EC_WORD(inum),
1644					    EC_WORD(cndx));
1645					break;
1646				}
1647				if ((sndx = chain[cndx]) == 0)
1648					break;
1649
1650				/*
1651				 * Determine this entries symbol reference.
1652				 */
1653				if (sndx > state.symn) {
1654					(void) fprintf(stderr,
1655					    MSG_INTL(MSG_ERR_CHBADSYMNDX), file,
1656					    EC_WORD(sndx), chcache->c_name,
1657					    EC_WORD(cndx));
1658					name = MSG_INTL(MSG_STR_UNKNOWN);
1659				} else {
1660					sym = (Sym *)(state.sym + sndx);
1661					name = string(chcache, sndx,
1662					    strcache, file, sym->st_name);
1663				}
1664
1665				/*
1666				 * Display the family member.
1667				 */
1668				(void) snprintf(_chain, MAXNDXSIZE,
1669				    MSG_ORIG(MSG_FMT_INTEGER), cndx);
1670				(void) snprintf(_symndx, MAXNDXSIZE,
1671				    MSG_ORIG(MSG_FMT_INDEX2), EC_WORD(sndx));
1672				dbg_print(0, MSG_ORIG(MSG_FMT_CHAIN_INFO),
1673				    _chain, _symndx, demangle(name, flags));
1674
1675				cndx++;
1676			}
1677		}
1678	}
1679	return (objcap);
1680}
1681
1682/*
1683 * Print the capabilities.
1684 *
1685 * A .SUNW_cap section can contain one or more, CA_SUNW_NULL terminated,
1686 * capabilities groups.  The first group defines the object capabilities.
1687 * This group defines the minimum capability requirements of the entire
1688 * object file.  If this is a dynamic object, this group should be associated
1689 * with a PT_SUNWCAP program header.
1690 *
1691 * Additional capabilities groups define the association of individual symbols
1692 * to specific capabilities.
1693 */
1694static void
1695cap(const char *file, Cache *cache, Word shnum, Word phnum, Ehdr *ehdr,
1696    uchar_t osabi, Elf *elf, uint_t flags)
1697{
1698	Word		cnt;
1699	Shdr		*cshdr = NULL;
1700	Cache		*ccache;
1701	Off		cphdr_off = 0;
1702	Xword		cphdr_sz;
1703
1704	/*
1705	 * Determine if a global capabilities header exists.
1706	 */
1707	if (phnum) {
1708		Phdr	*phdr;
1709
1710		if ((phdr = elf_getphdr(elf)) == NULL) {
1711			failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
1712			return;
1713		}
1714
1715		for (cnt = 0; cnt < phnum; phdr++, cnt++) {
1716			if (phdr->p_type == PT_SUNWCAP) {
1717				cphdr_off = phdr->p_offset;
1718				cphdr_sz = phdr->p_filesz;
1719				break;
1720			}
1721		}
1722	}
1723
1724	/*
1725	 * Determine if a capabilities section exists.
1726	 */
1727	for (cnt = 1; cnt < shnum; cnt++) {
1728		Cache	*_cache = &cache[cnt];
1729		Shdr	*shdr = _cache->c_shdr;
1730
1731		/*
1732		 * Process any capabilities information.
1733		 */
1734		if (shdr->sh_type == SHT_SUNW_cap) {
1735			if (cap_section(file, cache, shnum, _cache, osabi,
1736			    ehdr, flags)) {
1737				/*
1738				 * If this section defined an object capability
1739				 * group, retain the section information for
1740				 * program header validation.
1741				 */
1742				ccache = _cache;
1743				cshdr = shdr;
1744			}
1745			continue;
1746		}
1747	}
1748
1749	if ((cshdr == NULL) && (cphdr_off == 0))
1750		return;
1751
1752	if (cphdr_off && (cshdr == NULL))
1753		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP1), file);
1754
1755	/*
1756	 * If this object is an executable or shared object, and it provided
1757	 * an object capabilities group, then the group should have an
1758	 * accompanying PT_SUNWCAP program header.
1759	 */
1760	if (cshdr && ((ehdr->e_type == ET_EXEC) || (ehdr->e_type == ET_DYN))) {
1761		if (cphdr_off == 0) {
1762			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP2),
1763			    file, EC_WORD(elf_ndxscn(ccache->c_scn)),
1764			    ccache->c_name);
1765		} else if ((cphdr_off != cshdr->sh_offset) ||
1766		    (cphdr_sz != cshdr->sh_size)) {
1767			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP3),
1768			    file, EC_WORD(elf_ndxscn(ccache->c_scn)),
1769			    ccache->c_name);
1770		}
1771	}
1772}
1773
1774/*
1775 * Print the interpretor.
1776 */
1777static void
1778interp(const char *file, Cache *cache, Word shnum, Word phnum, Elf *elf)
1779{
1780	static Word phdr_types[] = { PT_INTERP };
1781
1782
1783	Word	cnt;
1784	Shdr	*ishdr = NULL;
1785	Cache	*icache = NULL;
1786	Off	iphdr_off = 0;
1787	Xword	iphdr_fsz;
1788
1789	/*
1790	 * Determine if an interp header exists.
1791	 */
1792	if (phnum) {
1793		Phdr	*phdr;
1794
1795		phdr = getphdr(phnum, phdr_types,
1796		    sizeof (phdr_types) / sizeof (*phdr_types), file, elf);
1797		if (phdr != NULL) {
1798			iphdr_off = phdr->p_offset;
1799			iphdr_fsz = phdr->p_filesz;
1800		}
1801	}
1802
1803	if (iphdr_off == 0)
1804		return;
1805
1806	/*
1807	 * Determine if an interp section exists.
1808	 */
1809	for (cnt = 1; cnt < shnum; cnt++) {
1810		Cache	*_cache = &cache[cnt];
1811		Shdr	*shdr = _cache->c_shdr;
1812
1813		/*
1814		 * Scan sections to find a section which contains the PT_INTERP
1815		 * string.  The target section can't be in a NOBITS section.
1816		 */
1817		if ((shdr->sh_type == SHT_NOBITS) ||
1818		    (iphdr_off < shdr->sh_offset) ||
1819		    (iphdr_off + iphdr_fsz) > (shdr->sh_offset + shdr->sh_size))
1820			continue;
1821
1822		icache = _cache;
1823		ishdr = shdr;
1824		break;
1825	}
1826
1827	/*
1828	 * Print the interpreter string based on the offset defined in the
1829	 * program header, as this is the offset used by the kernel.
1830	 */
1831	if ((ishdr != NULL) &&
1832	    (icache != NULL) &&
1833	    (icache->c_data != NULL) &&
1834	    (icache->c_data->d_buf != NULL) &&
1835	    (icache->c_data->d_size > 0)) {
1836		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1837		dbg_print(0, MSG_INTL(MSG_ELF_SCN_INTERP), icache->c_name);
1838		dbg_print(0, MSG_ORIG(MSG_FMT_INDENT),
1839		    (char *)icache->c_data->d_buf +
1840		    (iphdr_off - ishdr->sh_offset));
1841	} else
1842		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVINTERP1), file);
1843
1844	/*
1845	 * If there are any inconsistences between the program header and
1846	 * section information, flag them.
1847	 */
1848	if (ishdr && ((iphdr_off != ishdr->sh_offset) ||
1849	    (iphdr_fsz != ishdr->sh_size))) {
1850		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVINTERP2), file,
1851		    icache->c_name);
1852	}
1853}
1854
1855/*
1856 * Print the syminfo section.
1857 */
1858static void
1859syminfo(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
1860{
1861	Shdr		*infoshdr;
1862	Syminfo		*info;
1863	Sym		*syms;
1864	Dyn		*dyns;
1865	Word		infonum, cnt, ndx, symnum, dynnum;
1866	Cache		*infocache = NULL, *dyncache = NULL, *symsec, *strsec;
1867	Boolean		*dynerr;
1868
1869	for (cnt = 1; cnt < shnum; cnt++) {
1870		if (cache[cnt].c_shdr->sh_type == SHT_SUNW_syminfo) {
1871			infocache = &cache[cnt];
1872			break;
1873		}
1874	}
1875	if (infocache == NULL)
1876		return;
1877
1878	infoshdr = infocache->c_shdr;
1879	if ((infoshdr->sh_entsize == 0) || (infoshdr->sh_size == 0)) {
1880		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1881		    file, infocache->c_name);
1882		return;
1883	}
1884	if ((infocache->c_data == NULL) || (infocache->c_data->d_buf == NULL))
1885		return;
1886
1887	infonum = (Word)(infoshdr->sh_size / infoshdr->sh_entsize);
1888	info = (Syminfo *)infocache->c_data->d_buf;
1889
1890	/*
1891	 * If there is no associated dynamic section, determine if one
1892	 * is needed, and if so issue a warning. If there is an
1893	 * associated dynamic section, validate it and get the data buffer
1894	 * for it.
1895	 */
1896	dyns = NULL;
1897	dynnum = 0;
1898	if (infoshdr->sh_info == 0) {
1899		Syminfo	*_info = info + 1;
1900
1901		for (ndx = 1; ndx < infonum; ndx++, _info++) {
1902			if ((_info->si_flags == 0) && (_info->si_boundto == 0))
1903				continue;
1904
1905			if (_info->si_boundto < SYMINFO_BT_LOWRESERVE)
1906				(void) fprintf(stderr,
1907				    MSG_INTL(MSG_ERR_BADSHINFO), file,
1908				    infocache->c_name,
1909				    EC_WORD(infoshdr->sh_info));
1910		}
1911	} else if ((infoshdr->sh_info >= shnum) ||
1912	    (cache[infoshdr->sh_info].c_shdr->sh_type != SHT_DYNAMIC)) {
1913		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHINFO),
1914		    file, infocache->c_name, EC_WORD(infoshdr->sh_info));
1915	} else {
1916		dyncache = &cache[infoshdr->sh_info];
1917		if ((dyncache->c_data == NULL) ||
1918		    ((dyns = dyncache->c_data->d_buf) == NULL)) {
1919			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1920			    file, dyncache->c_name);
1921		}
1922		if (dyns != NULL) {
1923			if ((dyncache->c_shdr->sh_entsize == 0) ||
1924			    (dyncache->c_shdr->sh_size == 0)) {
1925				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1926				    file, dyncache->c_name);
1927				return;
1928			}
1929
1930			dynnum = dyncache->c_shdr->sh_size /
1931			    dyncache->c_shdr->sh_entsize;
1932
1933			/*
1934			 * We validate the type of dynamic elements referenced
1935			 * from the syminfo. This array is used report any
1936			 * bad dynamic entries.
1937			 */
1938			if ((dynerr = calloc(dynnum, sizeof (*dynerr))) ==
1939			    NULL) {
1940				int err = errno;
1941				(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
1942				    file, strerror(err));
1943				return;
1944			}
1945		}
1946	}
1947
1948	/*
1949	 * Get the data buffer for the associated symbol table and string table.
1950	 */
1951	if (stringtbl(cache, 1, cnt, shnum, file,
1952	    &symnum, &symsec, &strsec) == 0)
1953		return;
1954
1955	syms = symsec->c_data->d_buf;
1956
1957	/*
1958	 * Loop through the syminfo entries.
1959	 */
1960	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1961	dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMINFO), infocache->c_name);
1962	Elf_syminfo_title(0);
1963
1964	for (ndx = 1, info++; ndx < infonum; ndx++, info++) {
1965		Sym 		*sym;
1966		const char	*needed, *name;
1967		Word		expect_dt;
1968		Word		boundto = info->si_boundto;
1969
1970		if ((info->si_flags == 0) && (boundto == 0))
1971			continue;
1972
1973		sym = &syms[ndx];
1974		name = string(infocache, ndx, strsec, file, sym->st_name);
1975
1976		/* Is si_boundto set to one of the reserved values? */
1977		if (boundto >= SYMINFO_BT_LOWRESERVE) {
1978			Elf_syminfo_entry(0, ndx, info, name, NULL);
1979			continue;
1980		}
1981
1982		/*
1983		 * si_boundto is referencing a dynamic section. If we don't
1984		 * have one, an error was already issued above, so it suffices
1985		 * to display an empty string. If we are out of bounds, then
1986		 * report that and then display an empty string.
1987		 */
1988		if ((dyns == NULL) || (boundto >= dynnum)) {
1989			if (dyns != NULL)
1990				(void) fprintf(stderr,
1991				    MSG_INTL(MSG_ERR_BADSIDYNNDX), file,
1992				    infocache->c_ndx, infocache->c_name,
1993				    EC_WORD(ndx), EC_WORD(dynnum - 1),
1994				    EC_WORD(boundto));
1995			Elf_syminfo_entry(0, ndx, info, name,
1996			    MSG_ORIG(MSG_STR_EMPTY));
1997			continue;
1998		}
1999
2000		/*
2001		 * The si_boundto reference expects a specific dynamic element
2002		 * type at the given index. The dynamic element is always a
2003		 * string that gives an object name. The specific type depends
2004		 * on the si_flags present. Ensure that we've got the right
2005		 * type.
2006		 */
2007		if (info->si_flags & SYMINFO_FLG_FILTER)
2008			expect_dt = DT_SUNW_FILTER;
2009		else if (info->si_flags & SYMINFO_FLG_AUXILIARY)
2010			expect_dt = DT_SUNW_AUXILIARY;
2011		else if (info->si_flags & (SYMINFO_FLG_DIRECT |
2012		    SYMINFO_FLG_LAZYLOAD | SYMINFO_FLG_DIRECTBIND))
2013			expect_dt = DT_NEEDED;
2014		else
2015			expect_dt = DT_NULL;   /* means we ignore the type */
2016
2017		if ((dyns[boundto].d_tag != expect_dt) &&
2018		    (expect_dt != DT_NULL)) {
2019			Conv_inv_buf_t	buf1, buf2;
2020
2021			/* Only complain about each dynamic element once */
2022			if (!dynerr[boundto]) {
2023				(void) fprintf(stderr,
2024				    MSG_INTL(MSG_ERR_BADSIDYNTAG),
2025				    file, infocache->c_ndx, infocache->c_name,
2026				    EC_WORD(ndx), dyncache->c_ndx,
2027				    dyncache->c_name, EC_WORD(boundto),
2028				    conv_dyn_tag(expect_dt, osabi,
2029				    ehdr->e_machine, CONV_FMT_ALT_CF, &buf1),
2030				    conv_dyn_tag(dyns[boundto].d_tag, osabi,
2031				    ehdr->e_machine, CONV_FMT_ALT_CF, &buf2));
2032				dynerr[boundto] = TRUE;
2033			}
2034		}
2035
2036		/*
2037		 * Whether or not the DT item we're pointing at is
2038		 * of the right type, if it's a type we recognize as
2039		 * providing a string, go ahead and show it. Otherwise
2040		 * an empty string.
2041		 */
2042		switch (dyns[boundto].d_tag) {
2043		case DT_NEEDED:
2044		case DT_SONAME:
2045		case DT_RPATH:
2046		case DT_RUNPATH:
2047		case DT_CONFIG:
2048		case DT_DEPAUDIT:
2049		case DT_USED:
2050		case DT_AUDIT:
2051		case DT_SUNW_AUXILIARY:
2052		case DT_SUNW_FILTER:
2053		case DT_FILTER:
2054		case DT_AUXILIARY:
2055			needed = string(infocache, boundto,
2056			    strsec, file, dyns[boundto].d_un.d_val);
2057			break;
2058		default:
2059			needed = MSG_ORIG(MSG_STR_EMPTY);
2060		}
2061		Elf_syminfo_entry(0, ndx, info, name, needed);
2062	}
2063	if (dyns != NULL)
2064		free(dynerr);
2065}
2066
2067/*
2068 * Print version definition section entries.
2069 */
2070static void
2071version_def(Verdef *vdf, Word vdf_num, Cache *vcache, Cache *scache,
2072    const char *file)
2073{
2074	Word	cnt;
2075	char	index[MAXNDXSIZE];
2076
2077	Elf_ver_def_title(0);
2078
2079	for (cnt = 1; cnt <= vdf_num; cnt++,
2080	    vdf = (Verdef *)((uintptr_t)vdf + vdf->vd_next)) {
2081		Conv_ver_flags_buf_t	ver_flags_buf;
2082		const char		*name, *dep;
2083		Half			vcnt = vdf->vd_cnt - 1;
2084		Half			ndx = vdf->vd_ndx;
2085		Verdaux	*vdap = (Verdaux *)((uintptr_t)vdf + vdf->vd_aux);
2086
2087		/*
2088		 * Obtain the name and first dependency (if any).
2089		 */
2090		name = string(vcache, cnt, scache, file, vdap->vda_name);
2091		vdap = (Verdaux *)((uintptr_t)vdap + vdap->vda_next);
2092		if (vcnt)
2093			dep = string(vcache, cnt, scache, file, vdap->vda_name);
2094		else
2095			dep = MSG_ORIG(MSG_STR_EMPTY);
2096
2097		(void) snprintf(index, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX),
2098		    EC_XWORD(ndx));
2099		Elf_ver_line_1(0, index, name, dep,
2100		    conv_ver_flags(vdf->vd_flags, 0, &ver_flags_buf));
2101
2102		/*
2103		 * Print any additional dependencies.
2104		 */
2105		if (vcnt) {
2106			vdap = (Verdaux *)((uintptr_t)vdap + vdap->vda_next);
2107			for (vcnt--; vcnt; vcnt--,
2108			    vdap = (Verdaux *)((uintptr_t)vdap +
2109			    vdap->vda_next)) {
2110				dep = string(vcache, cnt, scache, file,
2111				    vdap->vda_name);
2112				Elf_ver_line_2(0, MSG_ORIG(MSG_STR_EMPTY), dep);
2113			}
2114		}
2115	}
2116}
2117
2118/*
2119 * Print version needed section entries.
2120 *
2121 * entry:
2122 *	vnd - Address of verneed data
2123 *	vnd_num - # of Verneed entries
2124 *	vcache - Cache of verneed section being processed
2125 *	scache - Cache of associated string table section
2126 *	file - Name of object being processed.
2127 *	versym - Information about versym section
2128 *
2129 * exit:
2130 *	The versions have been printed. If GNU style versioning
2131 *	is in effect, versym->max_verndx has been updated to
2132 *	contain the largest version index seen.
2133 *
2134 * note:
2135 * 	The versym section of an object that follows the original
2136 *	Solaris versioning rules only contains indexes into the verdef
2137 *	section. Symbols defined in other objects (UNDEF) are given
2138 *	a version of 0, indicating that they are not defined by
2139 *	this file, and the Verneed entries do not have associated version
2140 *	indexes. For these reasons, we do not display a version index
2141 *	for original-style Verneed sections.
2142 *
2143 *	The GNU versioning extensions alter this: Symbols defined in other
2144 *	objects receive a version index in the range above those defined
2145 *	by the Verdef section, and the vna_other field of the Vernaux
2146 *	structs inside the Verneed section contain the version index for
2147 *	that item. We therefore  display the index when showing the
2148 *	contents of a GNU style Verneed section. You should not
2149 *	necessarily expect these indexes to appear in sorted
2150 *	order --- it seems that the GNU ld assigns the versions as
2151 *	symbols are encountered during linking, and then the results
2152 *	are assembled into the Verneed section afterwards.
2153 */
2154static void
2155version_need(Verneed *vnd, Word vnd_num, Cache *vcache, Cache *scache,
2156    const char *file, VERSYM_STATE *versym)
2157{
2158	Word		cnt;
2159	char		index[MAXNDXSIZE];
2160	const char	*index_str;
2161
2162	Elf_ver_need_title(0, versym->gnu_needed);
2163
2164	for (cnt = 1; cnt <= vnd_num; cnt++,
2165	    vnd = (Verneed *)((uintptr_t)vnd + vnd->vn_next)) {
2166		Conv_ver_flags_buf_t	ver_flags_buf;
2167		const char		*name, *dep;
2168		Half			vcnt = vnd->vn_cnt;
2169		Vernaux *vnap = (Vernaux *)((uintptr_t)vnd + vnd->vn_aux);
2170
2171		/*
2172		 * Obtain the name of the needed file and the version name
2173		 * within it that we're dependent on.  Note that the count
2174		 * should be at least one, otherwise this is a pretty bogus
2175		 * entry.
2176		 */
2177		name = string(vcache, cnt, scache, file, vnd->vn_file);
2178		if (vcnt)
2179			dep = string(vcache, cnt, scache, file, vnap->vna_name);
2180		else
2181			dep = MSG_INTL(MSG_STR_NULL);
2182
2183		if (vnap->vna_other == 0) {	/* Traditional form */
2184			index_str = MSG_ORIG(MSG_STR_EMPTY);
2185		} else {			/* GNU form */
2186			index_str = index;
2187			/* Format the version index value */
2188			(void) snprintf(index, MAXNDXSIZE,
2189			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(vnap->vna_other));
2190			if (vnap->vna_other > versym->max_verndx)
2191				versym->max_verndx = vnap->vna_other;
2192		}
2193		Elf_ver_line_1(0, index_str, name, dep,
2194		    conv_ver_flags(vnap->vna_flags, 0, &ver_flags_buf));
2195
2196		/*
2197		 * Print any additional version dependencies.
2198		 */
2199		if (vcnt) {
2200			vnap = (Vernaux *)((uintptr_t)vnap + vnap->vna_next);
2201			for (vcnt--; vcnt; vcnt--,
2202			    vnap = (Vernaux *)((uintptr_t)vnap +
2203			    vnap->vna_next)) {
2204				dep = string(vcache, cnt, scache, file,
2205				    vnap->vna_name);
2206				if (vnap->vna_other > 0) {
2207					/* Format the next index value */
2208					(void) snprintf(index, MAXNDXSIZE,
2209					    MSG_ORIG(MSG_FMT_INDEX),
2210					    EC_XWORD(vnap->vna_other));
2211					Elf_ver_line_1(0, index,
2212					    MSG_ORIG(MSG_STR_EMPTY), dep,
2213					    conv_ver_flags(vnap->vna_flags,
2214					    0, &ver_flags_buf));
2215					if (vnap->vna_other >
2216					    versym->max_verndx)
2217						versym->max_verndx =
2218						    vnap->vna_other;
2219				} else {
2220					Elf_ver_line_3(0,
2221					    MSG_ORIG(MSG_STR_EMPTY), dep,
2222					    conv_ver_flags(vnap->vna_flags,
2223					    0, &ver_flags_buf));
2224				}
2225			}
2226		}
2227	}
2228}
2229
2230/*
2231 * Examine the Verneed section for information related to GNU
2232 * style Versym indexing:
2233 *	- A non-zero vna_other field indicates that Versym indexes can
2234 *		reference Verneed records.
2235 *	- If the object uses GNU style Versym indexing, the
2236 *	  maximum index value is needed to detect bad Versym entries.
2237 *
2238 * entry:
2239 *	vnd - Address of verneed data
2240 *	vnd_num - # of Verneed entries
2241 *	versym - Information about versym section
2242 *
2243 * exit:
2244 *	If a non-zero vna_other field is seen, versym->gnu_needed is set.
2245 *
2246 *	versym->max_verndx has been updated to contain the largest
2247 *	version index seen.
2248 */
2249static void
2250update_gnu_verndx(Verneed *vnd, Word vnd_num, VERSYM_STATE *versym)
2251{
2252	Word		cnt;
2253
2254	for (cnt = 1; cnt <= vnd_num; cnt++,
2255	    vnd = (Verneed *)((uintptr_t)vnd + vnd->vn_next)) {
2256		Half	vcnt = vnd->vn_cnt;
2257		Vernaux	*vnap = (Vernaux *)((uintptr_t)vnd + vnd->vn_aux);
2258
2259		/*
2260		 * A non-zero value of vna_other indicates that this
2261		 * object references VERNEED items from the VERSYM
2262		 * array.
2263		 */
2264		if (vnap->vna_other != 0) {
2265			versym->gnu_needed = 1;
2266			if (vnap->vna_other > versym->max_verndx)
2267				versym->max_verndx = vnap->vna_other;
2268		}
2269
2270		/*
2271		 * Check any additional version dependencies.
2272		 */
2273		if (vcnt) {
2274			vnap = (Vernaux *)((uintptr_t)vnap + vnap->vna_next);
2275			for (vcnt--; vcnt; vcnt--,
2276			    vnap = (Vernaux *)((uintptr_t)vnap +
2277			    vnap->vna_next)) {
2278				if (vnap->vna_other == 0)
2279					continue;
2280
2281				versym->gnu_needed = 1;
2282				if (vnap->vna_other > versym->max_verndx)
2283					versym->max_verndx = vnap->vna_other;
2284			}
2285		}
2286	}
2287}
2288
2289/*
2290 * Display version section information if the flags require it.
2291 * Return version information needed by other output.
2292 *
2293 * entry:
2294 *	cache - Cache of all section headers
2295 *	shnum - # of sections in cache
2296 *	file - Name of file
2297 *	flags - Command line option flags
2298 *	versym - VERSYM_STATE block to be filled in.
2299 */
2300static void
2301versions(Cache *cache, Word shnum, const char *file, uint_t flags,
2302    VERSYM_STATE *versym)
2303{
2304	GElf_Word	cnt;
2305	Cache		*verdef_cache = NULL, *verneed_cache = NULL;
2306
2307
2308	/* Gather information about the version sections */
2309	versym->max_verndx = 1;
2310	for (cnt = 1; cnt < shnum; cnt++) {
2311		Cache		*_cache = &cache[cnt];
2312		Shdr		*shdr = _cache->c_shdr;
2313		Dyn		*dyn;
2314		ulong_t		numdyn;
2315
2316		switch (shdr->sh_type) {
2317		case SHT_DYNAMIC:
2318			/*
2319			 * The GNU ld puts a DT_VERSYM entry in the dynamic
2320			 * section so that the runtime linker can use it to
2321			 * implement their versioning rules. They allow multiple
2322			 * incompatible functions with the same name to exist
2323			 * in different versions. The Solaris ld does not
2324			 * support this mechanism, and as such, does not
2325			 * produce DT_VERSYM. We use this fact to determine
2326			 * which ld produced this object, and how to interpret
2327			 * the version values.
2328			 */
2329			if ((shdr->sh_entsize == 0) ||
2330			    (shdr->sh_size == 0) ||
2331			    (_cache->c_data == NULL) ||
2332			    (_cache->c_data->d_buf == NULL))
2333				continue;
2334			numdyn = shdr->sh_size / shdr->sh_entsize;
2335			dyn = (Dyn *)_cache->c_data->d_buf;
2336			for (; numdyn-- > 0; dyn++)
2337				if (dyn->d_tag == DT_VERSYM) {
2338					versym->gnu_full =
2339					    versym->gnu_needed = 1;
2340					break;
2341				}
2342			break;
2343
2344		case SHT_SUNW_versym:
2345			/* Record data address for later symbol processing */
2346			if (_cache->c_data != NULL) {
2347				versym->cache = _cache;
2348				versym->data = _cache->c_data->d_buf;
2349				continue;
2350			}
2351			break;
2352
2353		case SHT_SUNW_verdef:
2354		case SHT_SUNW_verneed:
2355			/*
2356			 * Ensure the data is non-NULL and the number
2357			 * of items is non-zero. Otherwise, we don't
2358			 * understand the section, and will not use it.
2359			 */
2360			if ((_cache->c_data == NULL) ||
2361			    (_cache->c_data->d_buf == NULL)) {
2362				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2363				    file, _cache->c_name);
2364				continue;
2365			}
2366			if (shdr->sh_info == 0) {
2367				(void) fprintf(stderr,
2368				    MSG_INTL(MSG_ERR_BADSHINFO),
2369				    file, _cache->c_name,
2370				    EC_WORD(shdr->sh_info));
2371				continue;
2372			}
2373
2374			/* Make sure the string table index is in range */
2375			if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
2376				(void) fprintf(stderr,
2377				    MSG_INTL(MSG_ERR_BADSHLINK), file,
2378				    _cache->c_name, EC_WORD(shdr->sh_link));
2379				continue;
2380			}
2381
2382			/*
2383			 * The section is usable. Save the cache entry.
2384			 */
2385			if (shdr->sh_type == SHT_SUNW_verdef) {
2386				verdef_cache = _cache;
2387				/*
2388				 * Under Solaris rules, if there is a verdef
2389				 * section, the max versym index is number
2390				 * of version definitions it supplies.
2391				 */
2392				versym->max_verndx = shdr->sh_info;
2393			} else {
2394				verneed_cache = _cache;
2395			}
2396			break;
2397		}
2398	}
2399
2400	/*
2401	 * If there is a Verneed section, examine it for information
2402	 * related to GNU style versioning.
2403	 */
2404	if (verneed_cache != NULL)
2405		update_gnu_verndx((Verneed *)verneed_cache->c_data->d_buf,
2406		    verneed_cache->c_shdr->sh_info, versym);
2407
2408	/*
2409	 * Now that all the information is available, display the
2410	 * Verdef and Verneed section contents, if requested.
2411	 */
2412	if ((flags & FLG_SHOW_VERSIONS) == 0)
2413		return;
2414	if (verdef_cache != NULL) {
2415		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2416		dbg_print(0, MSG_INTL(MSG_ELF_SCN_VERDEF),
2417		    verdef_cache->c_name);
2418		version_def((Verdef *)verdef_cache->c_data->d_buf,
2419		    verdef_cache->c_shdr->sh_info, verdef_cache,
2420		    &cache[verdef_cache->c_shdr->sh_link], file);
2421	}
2422	if (verneed_cache != NULL) {
2423		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2424		dbg_print(0, MSG_INTL(MSG_ELF_SCN_VERNEED),
2425		    verneed_cache->c_name);
2426		/*
2427		 * If GNU versioning applies to this object, version_need()
2428		 * will update versym->max_verndx, and it is not
2429		 * necessary to call update_gnu_verndx().
2430		 */
2431		version_need((Verneed *)verneed_cache->c_data->d_buf,
2432		    verneed_cache->c_shdr->sh_info, verneed_cache,
2433		    &cache[verneed_cache->c_shdr->sh_link], file, versym);
2434	}
2435}
2436
2437/*
2438 * Search for and process any symbol tables.
2439 */
2440void
2441symbols(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi,
2442    VERSYM_STATE *versym, const char *file, uint_t flags)
2443{
2444	SYMTBL_STATE state;
2445	Cache *_cache;
2446	Word secndx;
2447
2448	for (secndx = 1; secndx < shnum; secndx++) {
2449		Word		symcnt;
2450		Shdr		*shdr;
2451
2452		_cache = &cache[secndx];
2453		shdr = _cache->c_shdr;
2454
2455		if ((shdr->sh_type != SHT_SYMTAB) &&
2456		    (shdr->sh_type != SHT_DYNSYM) &&
2457		    ((shdr->sh_type != SHT_SUNW_LDYNSYM) ||
2458		    (osabi != ELFOSABI_SOLARIS)))
2459			continue;
2460		if (!match(MATCH_F_ALL, _cache->c_name, secndx, shdr->sh_type))
2461			continue;
2462
2463		if (!init_symtbl_state(&state, cache, shnum, secndx, ehdr,
2464		    osabi, versym, file, flags))
2465			continue;
2466		/*
2467		 * Loop through the symbol tables entries.
2468		 */
2469		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2470		dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMTAB), state.secname);
2471		Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
2472
2473		for (symcnt = 0; symcnt < state.symn; symcnt++)
2474			output_symbol(&state, symcnt, shdr->sh_info, symcnt,
2475			    state.sym + symcnt);
2476	}
2477}
2478
2479/*
2480 * Search for and process any SHT_SUNW_symsort or SHT_SUNW_tlssort sections.
2481 * These sections are always associated with the .SUNW_ldynsym./.dynsym pair.
2482 */
2483static void
2484sunw_sort(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi,
2485    VERSYM_STATE *versym, const char *file, uint_t flags)
2486{
2487	SYMTBL_STATE	ldynsym_state,	dynsym_state;
2488	Cache		*sortcache,	*symcache;
2489	Shdr		*sortshdr,	*symshdr;
2490	Word		sortsecndx,	symsecndx;
2491	Word		ldynsym_cnt;
2492	Word		*ndx;
2493	Word		ndxn;
2494	int		output_cnt = 0;
2495	Conv_inv_buf_t	inv_buf;
2496
2497	for (sortsecndx = 1; sortsecndx < shnum; sortsecndx++) {
2498
2499		sortcache = &cache[sortsecndx];
2500		sortshdr = sortcache->c_shdr;
2501
2502		if ((sortshdr->sh_type != SHT_SUNW_symsort) &&
2503		    (sortshdr->sh_type != SHT_SUNW_tlssort))
2504			continue;
2505		if (!match(MATCH_F_ALL, sortcache->c_name, sortsecndx,
2506		    sortshdr->sh_type))
2507			continue;
2508
2509		/*
2510		 * If the section references a SUNW_ldynsym, then we
2511		 * expect to see the associated .dynsym immediately
2512		 * following. If it references a .dynsym, there is no
2513		 * SUNW_ldynsym. If it is any other type, then we don't
2514		 * know what to do with it.
2515		 */
2516		if ((sortshdr->sh_link == 0) || (sortshdr->sh_link >= shnum)) {
2517			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
2518			    file, sortcache->c_name,
2519			    EC_WORD(sortshdr->sh_link));
2520			continue;
2521		}
2522		symcache = &cache[sortshdr->sh_link];
2523		symshdr = symcache->c_shdr;
2524		symsecndx = sortshdr->sh_link;
2525		ldynsym_cnt = 0;
2526		switch (symshdr->sh_type) {
2527		case SHT_SUNW_LDYNSYM:
2528			if (!init_symtbl_state(&ldynsym_state, cache, shnum,
2529			    symsecndx, ehdr, osabi, versym, file, flags))
2530				continue;
2531			ldynsym_cnt = ldynsym_state.symn;
2532			/*
2533			 * We know that the dynsym follows immediately
2534			 * after the SUNW_ldynsym, and so, should be at
2535			 * (sortshdr->sh_link + 1). However, elfdump is a
2536			 * diagnostic tool, so we do the full paranoid
2537			 * search instead.
2538			 */
2539			for (symsecndx = 1; symsecndx < shnum; symsecndx++) {
2540				symcache = &cache[symsecndx];
2541				symshdr = symcache->c_shdr;
2542				if (symshdr->sh_type == SHT_DYNSYM)
2543					break;
2544			}
2545			if (symsecndx >= shnum) {	/* Dynsym not found! */
2546				(void) fprintf(stderr,
2547				    MSG_INTL(MSG_ERR_NODYNSYM),
2548				    file, sortcache->c_name);
2549				continue;
2550			}
2551			/* Fallthrough to process associated dynsym */
2552			/* FALLTHROUGH */
2553		case SHT_DYNSYM:
2554			if (!init_symtbl_state(&dynsym_state, cache, shnum,
2555			    symsecndx, ehdr, osabi, versym, file, flags))
2556				continue;
2557			break;
2558		default:
2559			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADNDXSEC),
2560			    file, sortcache->c_name,
2561			    conv_sec_type(osabi, ehdr->e_machine,
2562			    symshdr->sh_type, 0, &inv_buf));
2563			continue;
2564		}
2565
2566		/*
2567		 * Output header
2568		 */
2569		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2570		if (ldynsym_cnt > 0) {
2571			dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMSORT2),
2572			    sortcache->c_name, ldynsym_state.secname,
2573			    dynsym_state.secname);
2574			/*
2575			 * The data for .SUNW_ldynsym and dynsym sections
2576			 * is supposed to be adjacent with SUNW_ldynsym coming
2577			 * first. Check, and issue a warning if it isn't so.
2578			 */
2579			if (((ldynsym_state.sym + ldynsym_state.symn)
2580			    != dynsym_state.sym) &&
2581			    ((flags & FLG_CTL_FAKESHDR) == 0))
2582				(void) fprintf(stderr,
2583				    MSG_INTL(MSG_ERR_LDYNNOTADJ), file,
2584				    ldynsym_state.secname,
2585				    dynsym_state.secname);
2586		} else {
2587			dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMSORT1),
2588			    sortcache->c_name, dynsym_state.secname);
2589		}
2590		Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
2591
2592		/* If not first one, insert a line of white space */
2593		if (output_cnt++ > 0)
2594			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2595
2596		/*
2597		 * SUNW_dynsymsort and SUNW_dyntlssort are arrays of
2598		 * symbol indices. Iterate over the array entries,
2599		 * dispaying the referenced symbols.
2600		 */
2601		ndxn = sortshdr->sh_size / sortshdr->sh_entsize;
2602		ndx = (Word *)sortcache->c_data->d_buf;
2603		for (; ndxn-- > 0; ndx++) {
2604			if (*ndx >= ldynsym_cnt) {
2605				Word sec_ndx = *ndx - ldynsym_cnt;
2606
2607				output_symbol(&dynsym_state, sec_ndx, 0,
2608				    *ndx, dynsym_state.sym + sec_ndx);
2609			} else {
2610				output_symbol(&ldynsym_state, *ndx, 0,
2611				    *ndx, ldynsym_state.sym + *ndx);
2612			}
2613		}
2614	}
2615}
2616
2617/*
2618 * Search for and process any relocation sections.
2619 */
2620static void
2621reloc(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
2622{
2623	Word	cnt;
2624
2625	for (cnt = 1; cnt < shnum; cnt++) {
2626		Word		type, symnum;
2627		Xword		relndx, relnum, relsize;
2628		void		*rels;
2629		Sym		*syms;
2630		Cache		*symsec, *strsec;
2631		Cache		*_cache = &cache[cnt];
2632		Shdr		*shdr = _cache->c_shdr;
2633		char		*relname = _cache->c_name;
2634		Conv_inv_buf_t	inv_buf;
2635
2636		if (((type = shdr->sh_type) != SHT_RELA) &&
2637		    (type != SHT_REL))
2638			continue;
2639		if (!match(MATCH_F_ALL, relname, cnt, type))
2640			continue;
2641
2642		/*
2643		 * Decide entry size.
2644		 */
2645		if (((relsize = shdr->sh_entsize) == 0) ||
2646		    (relsize > shdr->sh_size)) {
2647			if (type == SHT_RELA)
2648				relsize = sizeof (Rela);
2649			else
2650				relsize = sizeof (Rel);
2651		}
2652
2653		/*
2654		 * Determine the number of relocations available.
2655		 */
2656		if (shdr->sh_size == 0) {
2657			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2658			    file, relname);
2659			continue;
2660		}
2661		if ((_cache->c_data == NULL) || (_cache->c_data->d_buf == NULL))
2662			continue;
2663
2664		rels = _cache->c_data->d_buf;
2665		relnum = shdr->sh_size / relsize;
2666
2667		/*
2668		 * Get the data buffer for the associated symbol table and
2669		 * string table.
2670		 */
2671		if (stringtbl(cache, 1, cnt, shnum, file,
2672		    &symnum, &symsec, &strsec) == 0)
2673			continue;
2674
2675		syms = symsec->c_data->d_buf;
2676
2677		/*
2678		 * Loop through the relocation entries.
2679		 */
2680		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2681		dbg_print(0, MSG_INTL(MSG_ELF_SCN_RELOC), _cache->c_name);
2682		Elf_reloc_title(0, ELF_DBG_ELFDUMP, type);
2683
2684		for (relndx = 0; relndx < relnum; relndx++,
2685		    rels = (void *)((char *)rels + relsize)) {
2686			Half		mach = ehdr->e_machine;
2687			char		section[BUFSIZ];
2688			const char	*symname;
2689			Word		symndx, reltype;
2690			Rela		*rela;
2691			Rel		*rel;
2692
2693			/*
2694			 * Unravel the relocation and determine the symbol with
2695			 * which this relocation is associated.
2696			 */
2697			if (type == SHT_RELA) {
2698				rela = (Rela *)rels;
2699				symndx = ELF_R_SYM(rela->r_info);
2700				reltype = ELF_R_TYPE(rela->r_info, mach);
2701			} else {
2702				rel = (Rel *)rels;
2703				symndx = ELF_R_SYM(rel->r_info);
2704				reltype = ELF_R_TYPE(rel->r_info, mach);
2705			}
2706
2707			symname = relsymname(cache, _cache, strsec, symndx,
2708			    symnum, relndx, syms, section, BUFSIZ, file);
2709
2710			/*
2711			 * A zero symbol index is only valid for a few
2712			 * relocations.
2713			 */
2714			if (symndx == 0) {
2715				int	badrel = 0;
2716
2717				if ((mach == EM_SPARC) ||
2718				    (mach == EM_SPARC32PLUS) ||
2719				    (mach == EM_SPARCV9)) {
2720					if ((reltype != R_SPARC_NONE) &&
2721					    (reltype != R_SPARC_REGISTER) &&
2722					    (reltype != R_SPARC_RELATIVE))
2723						badrel++;
2724				} else if (mach == EM_386) {
2725					if ((reltype != R_386_NONE) &&
2726					    (reltype != R_386_RELATIVE))
2727						badrel++;
2728				} else if (mach == EM_AMD64) {
2729					if ((reltype != R_AMD64_NONE) &&
2730					    (reltype != R_AMD64_RELATIVE))
2731						badrel++;
2732				}
2733
2734				if (badrel) {
2735					(void) fprintf(stderr,
2736					    MSG_INTL(MSG_ERR_BADREL1), file,
2737					    conv_reloc_type(mach, reltype,
2738					    0, &inv_buf));
2739				}
2740			}
2741
2742			Elf_reloc_entry_1(0, ELF_DBG_ELFDUMP,
2743			    MSG_ORIG(MSG_STR_EMPTY), ehdr->e_machine, type,
2744			    rels, relname, symname, 0);
2745		}
2746	}
2747}
2748
2749
2750/*
2751 * This value controls which test dyn_test() performs.
2752 */
2753typedef enum { DYN_TEST_ADDR, DYN_TEST_SIZE, DYN_TEST_ENTSIZE } dyn_test_t;
2754
2755/*
2756 * Used by dynamic() to compare the value of a dynamic element against
2757 * the starting address of the section it references.
2758 *
2759 * entry:
2760 *	test_type - Specify which dyn item is being tested.
2761 *	sh_type - SHT_* type value for required section.
2762 *	sec_cache - Cache entry for section, or NULL if the object lacks
2763 *		a section of this type.
2764 *	dyn - Dyn entry to be tested
2765 *	dynsec_cnt - # of dynamic section being examined. The first
2766 *		dynamic section is 1, the next is 2, and so on...
2767 *	ehdr - ELF header for file
2768 *	file - Name of file
2769 */
2770static void
2771dyn_test(dyn_test_t test_type, Word sh_type, Cache *sec_cache, Dyn *dyn,
2772    Word dynsec_cnt, Ehdr *ehdr, uchar_t osabi, const char *file)
2773{
2774	Conv_inv_buf_t	buf1, buf2;
2775
2776	/*
2777	 * These tests are based around the implicit assumption that
2778	 * there is only one dynamic section in an object, and also only
2779	 * one of the sections it references. We have therefore gathered
2780	 * all of the necessary information to test this in a single pass
2781	 * over the section headers, which is very efficient. We are not
2782	 * aware of any case where more than one dynamic section would
2783	 * be meaningful in an ELF object, so this is a reasonable solution.
2784	 *
2785	 * To test multiple dynamic sections correctly would be more
2786	 * expensive in code and time. We would have to build a data structure
2787	 * containing all the dynamic elements. Then, we would use the address
2788	 * to locate the section it references and ensure the section is of
2789	 * the right type and that the address in the dynamic element is
2790	 * to the start of the section. Then, we could check the size and
2791	 * entsize values against those same sections. This is O(n^2), and
2792	 * also complicated.
2793	 *
2794	 * In the highly unlikely case that there is more than one dynamic
2795	 * section, we only test the first one, and simply allow the values
2796	 * of the subsequent one to be displayed unchallenged.
2797	 */
2798	if (dynsec_cnt != 1)
2799		return;
2800
2801	/*
2802	 * A DT_ item that references a section address should always find
2803	 * the section in the file.
2804	 */
2805	if (sec_cache == NULL) {
2806		const char *name;
2807
2808		/*
2809		 * Supply section names instead of section types for
2810		 * things that reference progbits so that the error
2811		 * message will make more sense.
2812		 */
2813		switch (dyn->d_tag) {
2814		case DT_INIT:
2815			name = MSG_ORIG(MSG_ELF_INIT);
2816			break;
2817		case DT_FINI:
2818			name = MSG_ORIG(MSG_ELF_FINI);
2819			break;
2820		default:
2821			name = conv_sec_type(osabi, ehdr->e_machine,
2822			    sh_type, 0, &buf1);
2823			break;
2824		}
2825		(void) fprintf(stderr, MSG_INTL(MSG_ERR_DYNNOBCKSEC), file,
2826		    name, conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2827		    CONV_FMT_ALT_CF, &buf2));
2828		return;
2829	}
2830
2831
2832	switch (test_type) {
2833	case DYN_TEST_ADDR:
2834		/* The section address should match the DT_ item value */
2835		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_addr)
2836			(void) fprintf(stderr,
2837			    MSG_INTL(MSG_ERR_DYNBADADDR), file,
2838			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2839			    CONV_FMT_ALT_CF, &buf1), EC_ADDR(dyn->d_un.d_val),
2840			    sec_cache->c_ndx, sec_cache->c_name,
2841			    EC_ADDR(sec_cache->c_shdr->sh_addr));
2842		break;
2843
2844	case DYN_TEST_SIZE:
2845		/* The section size should match the DT_ item value */
2846		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_size)
2847			(void) fprintf(stderr,
2848			    MSG_INTL(MSG_ERR_DYNBADSIZE), file,
2849			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2850			    CONV_FMT_ALT_CF, &buf1), EC_XWORD(dyn->d_un.d_val),
2851			    sec_cache->c_ndx, sec_cache->c_name,
2852			    EC_XWORD(sec_cache->c_shdr->sh_size));
2853		break;
2854
2855	case DYN_TEST_ENTSIZE:
2856		/* The sh_entsize value should match the DT_ item value */
2857		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_entsize)
2858			(void) fprintf(stderr,
2859			    MSG_INTL(MSG_ERR_DYNBADENTSIZE), file,
2860			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2861			    CONV_FMT_ALT_CF, &buf1), EC_XWORD(dyn->d_un.d_val),
2862			    sec_cache->c_ndx, sec_cache->c_name,
2863			    EC_XWORD(sec_cache->c_shdr->sh_entsize));
2864		break;
2865	}
2866}
2867
2868/*
2869 * There are some DT_ entries that have corresponding symbols
2870 * (e.g. DT_INIT and _init). It is expected that these items will
2871 * both have the same value if both are present. This routine
2872 * examines the well known symbol tables for such symbols and
2873 * issues warnings for any that don't match.
2874 *
2875 * entry:
2876 *	dyn - Dyn entry to be tested
2877 *	symname - Name of symbol that corresponds to dyn
2878 *	symtab_cache, dynsym_cache, ldynsym_cache - Symbol tables to check
2879 *	target_cache - Section the symname section is expected to be
2880 *		associated with.
2881 *	cache - Cache of all section headers
2882 *	shnum - # of sections in cache
2883 *	ehdr - ELF header for file
2884 *	osabi - OSABI to apply when interpreting object
2885 *	file - Name of file
2886 */
2887static void
2888dyn_symtest(Dyn *dyn, const char *symname, Cache *symtab_cache,
2889    Cache *dynsym_cache, Cache *ldynsym_cache, Cache *target_cache,
2890    Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
2891{
2892	Conv_inv_buf_t	buf;
2893	int		i;
2894	Sym		*sym;
2895	Cache		*_cache;
2896
2897	for (i = 0; i < 3; i++) {
2898		switch (i) {
2899		case 0:
2900			_cache = symtab_cache;
2901			break;
2902		case 1:
2903			_cache = dynsym_cache;
2904			break;
2905		case 2:
2906			_cache = ldynsym_cache;
2907			break;
2908		}
2909
2910		if ((_cache != NULL) &&
2911		    symlookup(symname, cache, shnum, &sym, target_cache,
2912		    _cache, file) && (sym->st_value != dyn->d_un.d_val))
2913			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DYNSYMVAL),
2914			    file, _cache->c_name, conv_dyn_tag(dyn->d_tag,
2915			    osabi, ehdr->e_machine, CONV_FMT_ALT_CF, &buf),
2916			    symname, EC_ADDR(sym->st_value));
2917	}
2918}
2919
2920/*
2921 * Search for and process a .dynamic section.
2922 */
2923static void
2924dynamic(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
2925{
2926	struct {
2927		Cache	*symtab;
2928		Cache	*dynstr;
2929		Cache	*dynsym;
2930		Cache	*hash;
2931		Cache	*fini;
2932		Cache	*fini_array;
2933		Cache	*init;
2934		Cache	*init_array;
2935		Cache	*preinit_array;
2936		Cache	*rel;
2937		Cache	*rela;
2938		Cache	*sunw_cap;
2939		Cache	*sunw_capinfo;
2940		Cache	*sunw_capchain;
2941		Cache	*sunw_ldynsym;
2942		Cache	*sunw_move;
2943		Cache	*sunw_syminfo;
2944		Cache	*sunw_symsort;
2945		Cache	*sunw_tlssort;
2946		Cache	*sunw_verdef;
2947		Cache	*sunw_verneed;
2948		Cache	*sunw_versym;
2949	} sec;
2950	Word	dynsec_ndx;
2951	Word	dynsec_num;
2952	int	dynsec_cnt;
2953	Word	cnt;
2954	int	osabi_solaris = osabi == ELFOSABI_SOLARIS;
2955
2956	/*
2957	 * Make a pass over all the sections, gathering section information
2958	 * we'll need below.
2959	 */
2960	dynsec_num = 0;
2961	bzero(&sec, sizeof (sec));
2962	for (cnt = 1; cnt < shnum; cnt++) {
2963		Cache	*_cache = &cache[cnt];
2964
2965		switch (_cache->c_shdr->sh_type) {
2966		case SHT_DYNAMIC:
2967			if (dynsec_num == 0) {
2968				dynsec_ndx = cnt;
2969
2970				/* Does it have a valid string table? */
2971				(void) stringtbl(cache, 0, cnt, shnum, file,
2972				    0, 0, &sec.dynstr);
2973			}
2974			dynsec_num++;
2975			break;
2976
2977
2978		case SHT_PROGBITS:
2979			/*
2980			 * We want to detect the .init and .fini sections,
2981			 * if present. These are SHT_PROGBITS, so all we
2982			 * have to go on is the section name. Normally comparing
2983			 * names is a bad idea, but there are some special
2984			 * names (i.e. .init/.fini/.interp) that are very
2985			 * difficult to use in any other context, and for
2986			 * these symbols, we do the heuristic match.
2987			 */
2988			if (strcmp(_cache->c_name,
2989			    MSG_ORIG(MSG_ELF_INIT)) == 0) {
2990				if (sec.init == NULL)
2991					sec.init = _cache;
2992			} else if (strcmp(_cache->c_name,
2993			    MSG_ORIG(MSG_ELF_FINI)) == 0) {
2994				if (sec.fini == NULL)
2995					sec.fini = _cache;
2996			}
2997			break;
2998
2999		case SHT_REL:
3000			/*
3001			 * We want the SHT_REL section with the lowest
3002			 * offset. The linker gathers them together,
3003			 * and puts the address of the first one
3004			 * into the DT_REL dynamic element.
3005			 */
3006			if ((sec.rel == NULL) ||
3007			    (_cache->c_shdr->sh_offset <
3008			    sec.rel->c_shdr->sh_offset))
3009				sec.rel = _cache;
3010			break;
3011
3012		case SHT_RELA:
3013			/* RELA is handled just like RELA above */
3014			if ((sec.rela == NULL) ||
3015			    (_cache->c_shdr->sh_offset <
3016			    sec.rela->c_shdr->sh_offset))
3017				sec.rela = _cache;
3018			break;
3019
3020		/*
3021		 * The GRAB macro is used for the simple case in which
3022		 * we simply grab the first section of the desired type.
3023		 */
3024#define	GRAB(_sec_type, _sec_field) \
3025		case _sec_type: \
3026			if (sec._sec_field == NULL) \
3027				sec._sec_field = _cache; \
3028				break
3029		GRAB(SHT_SYMTAB,	symtab);
3030		GRAB(SHT_DYNSYM,	dynsym);
3031		GRAB(SHT_FINI_ARRAY,	fini_array);
3032		GRAB(SHT_HASH,		hash);
3033		GRAB(SHT_INIT_ARRAY,	init_array);
3034		GRAB(SHT_SUNW_move,	sunw_move);
3035		GRAB(SHT_PREINIT_ARRAY,	preinit_array);
3036		GRAB(SHT_SUNW_cap,	sunw_cap);
3037		GRAB(SHT_SUNW_capinfo,	sunw_capinfo);
3038		GRAB(SHT_SUNW_capchain,	sunw_capchain);
3039		GRAB(SHT_SUNW_LDYNSYM,	sunw_ldynsym);
3040		GRAB(SHT_SUNW_syminfo,	sunw_syminfo);
3041		GRAB(SHT_SUNW_symsort,	sunw_symsort);
3042		GRAB(SHT_SUNW_tlssort,	sunw_tlssort);
3043		GRAB(SHT_SUNW_verdef,	sunw_verdef);
3044		GRAB(SHT_SUNW_verneed,	sunw_verneed);
3045		GRAB(SHT_SUNW_versym,	sunw_versym);
3046#undef GRAB
3047		}
3048	}
3049
3050	/*
3051	 * If no dynamic section, return immediately. If more than one
3052	 * dynamic section, then something odd is going on and an error
3053	 * is in order, but then continue on and display them all.
3054	 */
3055	if (dynsec_num == 0)
3056		return;
3057	if (dynsec_num > 1)
3058		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MULTDYN),
3059		    file, EC_WORD(dynsec_num));
3060
3061
3062	dynsec_cnt = 0;
3063	for (cnt = dynsec_ndx; (cnt < shnum) && (dynsec_cnt < dynsec_num);
3064	    cnt++) {
3065		Dyn	*dyn;
3066		ulong_t	numdyn;
3067		int	ndx, end_ndx;
3068		Cache	*_cache = &cache[cnt], *strsec;
3069		Shdr	*shdr = _cache->c_shdr;
3070		int	dumped = 0;
3071
3072		if (shdr->sh_type != SHT_DYNAMIC)
3073			continue;
3074		dynsec_cnt++;
3075
3076		/*
3077		 * Verify the associated string table section.
3078		 */
3079		if (stringtbl(cache, 0, cnt, shnum, file, 0, 0, &strsec) == 0)
3080			continue;
3081
3082		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
3083			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3084			    file, _cache->c_name);
3085			continue;
3086		}
3087		if ((_cache->c_data == NULL) || (_cache->c_data->d_buf == NULL))
3088			continue;
3089
3090		numdyn = shdr->sh_size / shdr->sh_entsize;
3091		dyn = (Dyn *)_cache->c_data->d_buf;
3092
3093		/*
3094		 * We expect the REL/RELA entries to reference the reloc
3095		 * section with the lowest address. However, this is
3096		 * not true for dumped objects. Detect if this object has
3097		 * been dumped so that we can skip the reloc address test
3098		 * in that case.
3099		 */
3100		for (ndx = 0; ndx < numdyn; dyn++, ndx++) {
3101			if (dyn->d_tag == DT_FLAGS_1) {
3102				dumped = (dyn->d_un.d_val & DF_1_CONFALT) != 0;
3103				break;
3104			}
3105		}
3106		dyn = (Dyn *)_cache->c_data->d_buf;
3107
3108		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3109		dbg_print(0, MSG_INTL(MSG_ELF_SCN_DYNAMIC), _cache->c_name);
3110
3111		Elf_dyn_title(0);
3112
3113		for (ndx = 0; ndx < numdyn; dyn++, ndx++) {
3114			union {
3115				Conv_inv_buf_t		inv;
3116				Conv_dyn_flag_buf_t	flag;
3117				Conv_dyn_flag1_buf_t	flag1;
3118				Conv_dyn_posflag1_buf_t	posflag1;
3119				Conv_dyn_feature1_buf_t	feature1;
3120			} c_buf;
3121			const char	*name = NULL;
3122
3123			/*
3124			 * Print the information numerically, and if possible
3125			 * as a string. If a string is available, name is
3126			 * set to reference it.
3127			 *
3128			 * Also, take this opportunity to sanity check
3129			 * the values of DT elements. In the code above,
3130			 * we gathered information on sections that are
3131			 * referenced by the dynamic section. Here, we
3132			 * compare the attributes of those sections to
3133			 * the DT_ items that reference them and report
3134			 * on inconsistencies.
3135			 *
3136			 * Things not currently tested that could be improved
3137			 * in later revisions include:
3138			 *	- We don't check PLT or GOT related items
3139			 *	- We don't handle computing the lengths of
3140			 *		relocation arrays. To handle this
3141			 *		requires examining data that spans
3142			 *		across sections, in a contiguous span
3143			 *		within a single segment.
3144			 *	- DT_VERDEFNUM and DT_VERNEEDNUM can't be
3145			 *		verified without parsing the sections.
3146			 *	- We don't handle DT_SUNW_SYMSZ, which would
3147			 *		be the sum of the lengths of .dynsym and
3148			 *		.SUNW_ldynsym
3149			 *	- DT_SUNW_STRPAD can't be verified other than
3150			 *		to check that it's not larger than
3151			 *		the string table.
3152			 *	- Some items come in "all or none" clusters
3153			 *		that give an address, element size,
3154			 *		and data length in bytes. We don't
3155			 *		verify that there are no missing items
3156			 *		in such groups.
3157			 */
3158			switch (dyn->d_tag) {
3159			case DT_NULL:
3160				/*
3161				 * Special case: DT_NULLs can come in groups
3162				 * that we prefer to reduce to a single line.
3163				 */
3164				end_ndx = ndx;
3165				while ((end_ndx < (numdyn - 1)) &&
3166				    ((dyn + 1)->d_tag == DT_NULL)) {
3167					dyn++;
3168					end_ndx++;
3169				}
3170				Elf_dyn_null_entry(0, dyn, ndx, end_ndx);
3171				ndx = end_ndx;
3172				continue;
3173
3174			/*
3175			 * String items all reference the dynstr. The string()
3176			 * function does the necessary sanity checking.
3177			 */
3178			case DT_NEEDED:
3179			case DT_SONAME:
3180			case DT_FILTER:
3181			case DT_AUXILIARY:
3182			case DT_CONFIG:
3183			case DT_RPATH:
3184			case DT_RUNPATH:
3185			case DT_USED:
3186			case DT_DEPAUDIT:
3187			case DT_AUDIT:
3188				name = string(_cache, ndx, strsec,
3189				    file, dyn->d_un.d_ptr);
3190				break;
3191
3192			case DT_SUNW_AUXILIARY:
3193			case DT_SUNW_FILTER:
3194				if (osabi_solaris)
3195					name = string(_cache, ndx, strsec,
3196					    file, dyn->d_un.d_ptr);
3197				break;
3198
3199			case DT_FLAGS:
3200				name = conv_dyn_flag(dyn->d_un.d_val,
3201				    0, &c_buf.flag);
3202				break;
3203			case DT_FLAGS_1:
3204				name = conv_dyn_flag1(dyn->d_un.d_val, 0,
3205				    &c_buf.flag1);
3206				break;
3207			case DT_POSFLAG_1:
3208				name = conv_dyn_posflag1(dyn->d_un.d_val, 0,
3209				    &c_buf.posflag1);
3210				break;
3211			case DT_FEATURE_1:
3212				name = conv_dyn_feature1(dyn->d_un.d_val, 0,
3213				    &c_buf.feature1);
3214				break;
3215			case DT_DEPRECATED_SPARC_REGISTER:
3216				name = MSG_INTL(MSG_STR_DEPRECATED);
3217				break;
3218
3219			case DT_SUNW_LDMACH:
3220				if (!osabi_solaris)
3221					break;
3222				name = conv_ehdr_mach((Half)dyn->d_un.d_val,
3223				    0, &c_buf.inv);
3224				break;
3225
3226			/*
3227			 * Cases below this point are strictly sanity checking,
3228			 * and do not generate a name string. The TEST_ macros
3229			 * are used to hide the boiler plate arguments neeeded
3230			 * by dyn_test().
3231			 */
3232#define	TEST_ADDR(_sh_type, _sec_field) \
3233				dyn_test(DYN_TEST_ADDR, _sh_type, \
3234				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
3235				    osabi, file)
3236#define	TEST_SIZE(_sh_type, _sec_field) \
3237				dyn_test(DYN_TEST_SIZE, _sh_type, \
3238				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
3239				    osabi, file)
3240#define	TEST_ENTSIZE(_sh_type, _sec_field) \
3241				dyn_test(DYN_TEST_ENTSIZE, _sh_type, \
3242				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
3243				    osabi, file)
3244
3245			case DT_FINI:
3246				dyn_symtest(dyn, MSG_ORIG(MSG_SYM_FINI),
3247				    sec.symtab, sec.dynsym, sec.sunw_ldynsym,
3248				    sec.fini, cache, shnum, ehdr, osabi, file);
3249				TEST_ADDR(SHT_PROGBITS, fini);
3250				break;
3251
3252			case DT_FINI_ARRAY:
3253				TEST_ADDR(SHT_FINI_ARRAY, fini_array);
3254				break;
3255
3256			case DT_FINI_ARRAYSZ:
3257				TEST_SIZE(SHT_FINI_ARRAY, fini_array);
3258				break;
3259
3260			case DT_HASH:
3261				TEST_ADDR(SHT_HASH, hash);
3262				break;
3263
3264			case DT_INIT:
3265				dyn_symtest(dyn, MSG_ORIG(MSG_SYM_INIT),
3266				    sec.symtab, sec.dynsym, sec.sunw_ldynsym,
3267				    sec.init, cache, shnum, ehdr, osabi, file);
3268				TEST_ADDR(SHT_PROGBITS, init);
3269				break;
3270
3271			case DT_INIT_ARRAY:
3272				TEST_ADDR(SHT_INIT_ARRAY, init_array);
3273				break;
3274
3275			case DT_INIT_ARRAYSZ:
3276				TEST_SIZE(SHT_INIT_ARRAY, init_array);
3277				break;
3278
3279			case DT_MOVEENT:
3280				TEST_ENTSIZE(SHT_SUNW_move, sunw_move);
3281				break;
3282
3283			case DT_MOVESZ:
3284				TEST_SIZE(SHT_SUNW_move, sunw_move);
3285				break;
3286
3287			case DT_MOVETAB:
3288				TEST_ADDR(SHT_SUNW_move, sunw_move);
3289				break;
3290
3291			case DT_PREINIT_ARRAY:
3292				TEST_ADDR(SHT_PREINIT_ARRAY, preinit_array);
3293				break;
3294
3295			case DT_PREINIT_ARRAYSZ:
3296				TEST_SIZE(SHT_PREINIT_ARRAY, preinit_array);
3297				break;
3298
3299			case DT_REL:
3300				if (!dumped)
3301					TEST_ADDR(SHT_REL, rel);
3302				break;
3303
3304			case DT_RELENT:
3305				TEST_ENTSIZE(SHT_REL, rel);
3306				break;
3307
3308			case DT_RELA:
3309				if (!dumped)
3310					TEST_ADDR(SHT_RELA, rela);
3311				break;
3312
3313			case DT_RELAENT:
3314				TEST_ENTSIZE(SHT_RELA, rela);
3315				break;
3316
3317			case DT_STRTAB:
3318				TEST_ADDR(SHT_STRTAB, dynstr);
3319				break;
3320
3321			case DT_STRSZ:
3322				TEST_SIZE(SHT_STRTAB, dynstr);
3323				break;
3324
3325			case DT_SUNW_CAP:
3326				if (osabi_solaris)
3327					TEST_ADDR(SHT_SUNW_cap, sunw_cap);
3328				break;
3329
3330			case DT_SUNW_CAPINFO:
3331				if (osabi_solaris)
3332					TEST_ADDR(SHT_SUNW_capinfo,
3333					    sunw_capinfo);
3334				break;
3335
3336			case DT_SUNW_CAPCHAIN:
3337				if (osabi_solaris)
3338					TEST_ADDR(SHT_SUNW_capchain,
3339					    sunw_capchain);
3340				break;
3341
3342			case DT_SUNW_SYMTAB:
3343				TEST_ADDR(SHT_SUNW_LDYNSYM, sunw_ldynsym);
3344				break;
3345
3346			case DT_SYMENT:
3347				TEST_ENTSIZE(SHT_DYNSYM, dynsym);
3348				break;
3349
3350			case DT_SYMINENT:
3351				TEST_ENTSIZE(SHT_SUNW_syminfo, sunw_syminfo);
3352				break;
3353
3354			case DT_SYMINFO:
3355				TEST_ADDR(SHT_SUNW_syminfo, sunw_syminfo);
3356				break;
3357
3358			case DT_SYMINSZ:
3359				TEST_SIZE(SHT_SUNW_syminfo, sunw_syminfo);
3360				break;
3361
3362			case DT_SYMTAB:
3363				TEST_ADDR(SHT_DYNSYM, dynsym);
3364				break;
3365
3366			case DT_SUNW_SORTENT:
3367				/*
3368				 * This entry is related to both the symsort and
3369				 * tlssort sections.
3370				 */
3371				if (osabi_solaris) {
3372					int test_tls =
3373					    (sec.sunw_tlssort != NULL);
3374					int test_sym =
3375					    (sec.sunw_symsort != NULL) ||
3376					    !test_tls;
3377					if (test_sym)
3378						TEST_ENTSIZE(SHT_SUNW_symsort,
3379						    sunw_symsort);
3380					if (test_tls)
3381						TEST_ENTSIZE(SHT_SUNW_tlssort,
3382						    sunw_tlssort);
3383				}
3384				break;
3385
3386
3387			case DT_SUNW_SYMSORT:
3388				if (osabi_solaris)
3389					TEST_ADDR(SHT_SUNW_symsort,
3390					    sunw_symsort);
3391				break;
3392
3393			case DT_SUNW_SYMSORTSZ:
3394				if (osabi_solaris)
3395					TEST_SIZE(SHT_SUNW_symsort,
3396					    sunw_symsort);
3397				break;
3398
3399			case DT_SUNW_TLSSORT:
3400				if (osabi_solaris)
3401					TEST_ADDR(SHT_SUNW_tlssort,
3402					    sunw_tlssort);
3403				break;
3404
3405			case DT_SUNW_TLSSORTSZ:
3406				if (osabi_solaris)
3407					TEST_SIZE(SHT_SUNW_tlssort,
3408					    sunw_tlssort);
3409				break;
3410
3411			case DT_VERDEF:
3412				TEST_ADDR(SHT_SUNW_verdef, sunw_verdef);
3413				break;
3414
3415			case DT_VERNEED:
3416				TEST_ADDR(SHT_SUNW_verneed, sunw_verneed);
3417				break;
3418
3419			case DT_VERSYM:
3420				TEST_ADDR(SHT_SUNW_versym, sunw_versym);
3421				break;
3422#undef TEST_ADDR
3423#undef TEST_SIZE
3424#undef TEST_ENTSIZE
3425			}
3426
3427			if (name == NULL)
3428				name = MSG_ORIG(MSG_STR_EMPTY);
3429			Elf_dyn_entry(0, dyn, ndx, name,
3430			    osabi, ehdr->e_machine);
3431		}
3432	}
3433}
3434
3435/*
3436 * Search for and process a MOVE section.
3437 */
3438static void
3439move(Cache *cache, Word shnum, const char *file, uint_t flags)
3440{
3441	Word		cnt;
3442	const char	*fmt = NULL;
3443
3444	for (cnt = 1; cnt < shnum; cnt++) {
3445		Word	movenum, symnum, ndx;
3446		Sym	*syms;
3447		Cache	*_cache = &cache[cnt];
3448		Shdr	*shdr = _cache->c_shdr;
3449		Cache	*symsec, *strsec;
3450		Move	*move;
3451
3452		if (shdr->sh_type != SHT_SUNW_move)
3453			continue;
3454		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
3455			continue;
3456
3457		/*
3458		 * Determine the move data and number.
3459		 */
3460		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
3461			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3462			    file, _cache->c_name);
3463			continue;
3464		}
3465		if ((_cache->c_data == NULL) || (_cache->c_data->d_buf == NULL))
3466			continue;
3467
3468		move = (Move *)_cache->c_data->d_buf;
3469		movenum = shdr->sh_size / shdr->sh_entsize;
3470
3471		/*
3472		 * Get the data buffer for the associated symbol table and
3473		 * string table.
3474		 */
3475		if (stringtbl(cache, 1, cnt, shnum, file,
3476		    &symnum, &symsec, &strsec) == 0)
3477			return;
3478
3479		syms = (Sym *)symsec->c_data->d_buf;
3480
3481		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3482		dbg_print(0, MSG_INTL(MSG_ELF_SCN_MOVE), _cache->c_name);
3483		dbg_print(0, MSG_INTL(MSG_MOVE_TITLE));
3484
3485		if (fmt == NULL)
3486			fmt = MSG_INTL(MSG_MOVE_ENTRY);
3487
3488		for (ndx = 0; ndx < movenum; move++, ndx++) {
3489			const char	*symname;
3490			char		index[MAXNDXSIZE], section[BUFSIZ];
3491			Word		symndx, shndx;
3492			Sym		*sym;
3493
3494			/*
3495			 * Check for null entries
3496			 */
3497			if ((move->m_info == 0) && (move->m_value == 0) &&
3498			    (move->m_poffset == 0) && (move->m_repeat == 0) &&
3499			    (move->m_stride == 0)) {
3500				dbg_print(0, fmt, MSG_ORIG(MSG_STR_EMPTY),
3501				    EC_XWORD(move->m_poffset), 0, 0, 0,
3502				    EC_LWORD(0), MSG_ORIG(MSG_STR_EMPTY));
3503				continue;
3504			}
3505			if (((symndx = ELF_M_SYM(move->m_info)) == 0) ||
3506			    (symndx >= symnum)) {
3507				(void) fprintf(stderr,
3508				    MSG_INTL(MSG_ERR_BADMINFO), file,
3509				    _cache->c_name, EC_XWORD(move->m_info));
3510
3511				(void) snprintf(index, MAXNDXSIZE,
3512				    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(symndx));
3513				dbg_print(0, fmt, index,
3514				    EC_XWORD(move->m_poffset),
3515				    ELF_M_SIZE(move->m_info), move->m_repeat,
3516				    move->m_stride, move->m_value,
3517				    MSG_INTL(MSG_STR_UNKNOWN));
3518				continue;
3519			}
3520
3521			symname = relsymname(cache, _cache, strsec,
3522			    symndx, symnum, ndx, syms, section, BUFSIZ, file);
3523			sym = (Sym *)(syms + symndx);
3524
3525			/*
3526			 * Additional sanity check.
3527			 */
3528			shndx = sym->st_shndx;
3529			if (!((shndx == SHN_COMMON) ||
3530			    (((shndx >= 1) && (shndx <= shnum)) &&
3531			    (cache[shndx].c_shdr)->sh_type == SHT_NOBITS))) {
3532				(void) fprintf(stderr,
3533				    MSG_INTL(MSG_ERR_BADSYM2), file,
3534				    _cache->c_name, EC_WORD(symndx),
3535				    demangle(symname, flags));
3536			}
3537
3538			(void) snprintf(index, MAXNDXSIZE,
3539			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(symndx));
3540			dbg_print(0, fmt, index, EC_XWORD(move->m_poffset),
3541			    ELF_M_SIZE(move->m_info), move->m_repeat,
3542			    move->m_stride, move->m_value,
3543			    demangle(symname, flags));
3544		}
3545	}
3546}
3547
3548/*
3549 * parse_note_t is used to track the state used by parse_note_entry()
3550 * between calls, and also to return the results of each call.
3551 */
3552typedef struct {
3553	/* pns_ fields track progress through the data */
3554	const char	*pns_file;	/* File name */
3555	Cache		*pns_cache;	/* Note section cache entry */
3556	size_t		pns_size;	/* # unprocessed data bytes */
3557	Word		*pns_data;	/* # to next unused data byte */
3558
3559	/* pn_ fields return the results for a single call */
3560	Word		pn_namesz;	/* Value of note namesz field */
3561	Word		pn_descsz;	/* Value of note descsz field */
3562	Word		pn_type;	/* Value of note type field */
3563	const char	*pn_name;	/* if (namesz > 0) ptr to name bytes */
3564	const char	*pn_desc;	/* if (descsx > 0) ptr to data bytes */
3565} parse_note_t;
3566
3567/*
3568 * Extract the various sub-parts of a note entry, and advance the
3569 * data pointer past it.
3570 *
3571 * entry:
3572 *	The state pns_ fields contain current values for the Note section
3573 *
3574 * exit:
3575 *	On success, True (1) is returned, the state pns_ fields have been
3576 *	advanced to point at the start of the next entry, and the information
3577 *	for the recovered note entry is found in the state pn_ fields.
3578 *
3579 *	On failure, False (0) is returned. The values contained in state
3580 *	are undefined.
3581 */
3582static int
3583parse_note_entry(parse_note_t *state)
3584{
3585	size_t	pad, noteoff;
3586
3587	noteoff = (Word)state->pns_cache->c_data->d_size - state->pns_size;
3588	/*
3589	 * Make sure we can at least reference the 3 initial entries
3590	 * (4-byte words) of the note information block.
3591	 */
3592	if (state->pns_size >= (sizeof (Word) * 3)) {
3593		state->pns_size -= (sizeof (Word) * 3);
3594	} else {
3595		(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADDATASZ),
3596		    state->pns_file, state->pns_cache->c_name,
3597		    EC_WORD(noteoff));
3598		return (0);
3599	}
3600
3601	/*
3602	 * Make sure any specified name string can be referenced.
3603	 */
3604	if ((state->pn_namesz = *state->pns_data++) != 0) {
3605		if (state->pns_size >= state->pn_namesz) {
3606			state->pns_size -= state->pn_namesz;
3607		} else {
3608			(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADNMSZ),
3609			    state->pns_file, state->pns_cache->c_name,
3610			    EC_WORD(noteoff), EC_WORD(state->pn_namesz));
3611			return (0);
3612		}
3613	}
3614
3615	/*
3616	 * Make sure any specified descriptor can be referenced.
3617	 */
3618	if ((state->pn_descsz = *state->pns_data++) != 0) {
3619		/*
3620		 * If namesz isn't a 4-byte multiple, account for any
3621		 * padding that must exist before the descriptor.
3622		 */
3623		if ((pad = (state->pn_namesz & (sizeof (Word) - 1))) != 0) {
3624			pad = sizeof (Word) - pad;
3625			state->pns_size -= pad;
3626		}
3627		if (state->pns_size >= state->pn_descsz) {
3628			state->pns_size -= state->pn_descsz;
3629		} else {
3630			(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADDESZ),
3631			    state->pns_file, state->pns_cache->c_name,
3632			    EC_WORD(noteoff), EC_WORD(state->pn_namesz));
3633			return (0);
3634		}
3635	}
3636
3637	state->pn_type = *state->pns_data++;
3638
3639	/* Name */
3640	if (state->pn_namesz) {
3641		state->pn_name = (char *)state->pns_data;
3642		pad = (state->pn_namesz +
3643		    (sizeof (Word) - 1)) & ~(sizeof (Word) - 1);
3644		/* LINTED */
3645		state->pns_data = (Word *)(state->pn_name + pad);
3646	}
3647
3648	/*
3649	 * If multiple information blocks exist within a .note section
3650	 * account for any padding that must exist before the next
3651	 * information block.
3652	 */
3653	if ((pad = (state->pn_descsz & (sizeof (Word) - 1))) != 0) {
3654		pad = sizeof (Word) - pad;
3655		if (state->pns_size > pad)
3656			state->pns_size -= pad;
3657	}
3658
3659	/* Data */
3660	if (state->pn_descsz) {
3661		state->pn_desc = (const char *)state->pns_data;
3662		/* LINTED */
3663		state->pns_data = (Word *)(state->pn_desc +
3664		    state->pn_descsz + pad);
3665	}
3666
3667	return (1);
3668}
3669
3670/*
3671 * Callback function for use with conv_str_to_c_literal() below.
3672 */
3673/*ARGSUSED2*/
3674static void
3675c_literal_cb(const void *ptr, size_t size, void *uvalue)
3676{
3677	(void) fwrite(ptr, size, 1, stdout);
3678}
3679
3680/*
3681 * Traverse a note section analyzing each note information block.
3682 * The data buffers size is used to validate references before they are made,
3683 * and is decremented as each element is processed.
3684 */
3685void
3686note_entry(Cache *cache, Word *data, size_t size, Ehdr *ehdr, const char *file)
3687{
3688	int		cnt = 0;
3689	int		is_corenote;
3690	int		do_swap;
3691	Conv_inv_buf_t	inv_buf;
3692	parse_note_t	pnstate;
3693
3694	pnstate.pns_file = file;
3695	pnstate.pns_cache = cache;
3696	pnstate.pns_size = size;
3697	pnstate.pns_data = data;
3698	do_swap = _elf_sys_encoding() != ehdr->e_ident[EI_DATA];
3699
3700	/*
3701	 * Print out a single `note' information block.
3702	 */
3703	while (pnstate.pns_size > 0) {
3704
3705		if (parse_note_entry(&pnstate) == 0)
3706			return;
3707
3708		/*
3709		 * Is this a Solaris core note? Such notes all have
3710		 * the name "CORE".
3711		 */
3712		is_corenote = (ehdr->e_type == ET_CORE) &&
3713		    (pnstate.pn_namesz == (MSG_STR_CORE_SIZE + 1)) &&
3714		    (strncmp(MSG_ORIG(MSG_STR_CORE), pnstate.pn_name,
3715		    MSG_STR_CORE_SIZE + 1) == 0);
3716
3717		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3718		dbg_print(0, MSG_INTL(MSG_FMT_NOTEENTNDX), EC_WORD(cnt));
3719		cnt++;
3720		dbg_print(0, MSG_ORIG(MSG_NOTE_NAMESZ),
3721		    EC_WORD(pnstate.pn_namesz));
3722		dbg_print(0, MSG_ORIG(MSG_NOTE_DESCSZ),
3723		    EC_WORD(pnstate.pn_descsz));
3724
3725		if (is_corenote)
3726			dbg_print(0, MSG_ORIG(MSG_NOTE_TYPE_STR),
3727			    conv_cnote_type(pnstate.pn_type, 0, &inv_buf));
3728		else
3729			dbg_print(0, MSG_ORIG(MSG_NOTE_TYPE),
3730			    EC_WORD(pnstate.pn_type));
3731		if (pnstate.pn_namesz) {
3732			dbg_print(0, MSG_ORIG(MSG_NOTE_NAME));
3733			/*
3734			 * The name string can contain embedded 'null'
3735			 * bytes and/or unprintable characters. Also,
3736			 * the final NULL is documented in the ELF ABI
3737			 * as being included in the namesz. So, display
3738			 * the name using C literal string notation, and
3739			 * include the terminating NULL in the output.
3740			 * We don't show surrounding double quotes, as
3741			 * that implies the termination that we are showing
3742			 * explicitly.
3743			 */
3744			(void) fwrite(MSG_ORIG(MSG_STR_8SP),
3745			    MSG_STR_8SP_SIZE, 1, stdout);
3746			conv_str_to_c_literal(pnstate.pn_name,
3747			    pnstate.pn_namesz, c_literal_cb, NULL);
3748			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3749		}
3750
3751		if (pnstate.pn_descsz) {
3752			int		hexdump = 1;
3753
3754			/*
3755			 * If this is a core note, let the corenote()
3756			 * function handle it.
3757			 */
3758			if (is_corenote) {
3759				/* We only issue the bad arch error once */
3760				static int	badnote_done = 0;
3761				corenote_ret_t	corenote_ret;
3762
3763				corenote_ret = corenote(ehdr->e_machine,
3764				    do_swap, pnstate.pn_type, pnstate.pn_desc,
3765				    pnstate.pn_descsz);
3766				switch (corenote_ret) {
3767				case CORENOTE_R_OK_DUMP:
3768					hexdump = 1;
3769					break;
3770				case CORENOTE_R_OK:
3771					hexdump = 0;
3772					break;
3773				case CORENOTE_R_BADDATA:
3774					(void) fprintf(stderr,
3775					    MSG_INTL(MSG_NOTE_BADCOREDATA),
3776					    file);
3777					break;
3778				case CORENOTE_R_BADARCH:
3779					if (badnote_done)
3780						break;
3781					(void) fprintf(stderr,
3782					    MSG_INTL(MSG_NOTE_BADCOREARCH),
3783					    file,
3784					    conv_ehdr_mach(ehdr->e_machine,
3785					    0, &inv_buf));
3786					break;
3787				case CORENOTE_R_BADTYPE:
3788					(void) fprintf(stderr,
3789					    MSG_INTL(MSG_NOTE_BADCORETYPE),
3790					    file,
3791					    EC_WORD(pnstate.pn_type));
3792					break;
3793
3794				}
3795			}
3796
3797			/*
3798			 * The default thing when we don't understand
3799			 * the note data is to display it as hex bytes.
3800			 */
3801			if (hexdump) {
3802				dbg_print(0, MSG_ORIG(MSG_NOTE_DESC));
3803				dump_hex_bytes(pnstate.pn_desc,
3804				    pnstate.pn_descsz, 8, 4, 4);
3805			}
3806		}
3807	}
3808}
3809
3810/*
3811 * Search for and process .note sections.
3812 *
3813 * Returns the number of note sections seen.
3814 */
3815static Word
3816note(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
3817{
3818	Word	cnt, note_cnt = 0;
3819
3820	/*
3821	 * Otherwise look for any .note sections.
3822	 */
3823	for (cnt = 1; cnt < shnum; cnt++) {
3824		Cache	*_cache = &cache[cnt];
3825		Shdr	*shdr = _cache->c_shdr;
3826
3827		if (shdr->sh_type != SHT_NOTE)
3828			continue;
3829		note_cnt++;
3830		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
3831			continue;
3832
3833		/*
3834		 * As these sections are often hand rolled, make sure they're
3835		 * properly aligned before proceeding, and issue an error
3836		 * as necessary.
3837		 *
3838		 * Note that we will continue on to display the note even
3839		 * if it has bad alignment. We can do this safely, because
3840		 * libelf knows the alignment required for SHT_NOTE, and
3841		 * takes steps to deliver a properly aligned buffer to us
3842		 * even if the actual file is misaligned.
3843		 */
3844		if (shdr->sh_offset & (sizeof (Word) - 1))
3845			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADALIGN),
3846			    file, _cache->c_name);
3847
3848		if ((_cache->c_data == NULL) || (_cache->c_data->d_buf == NULL))
3849			continue;
3850
3851		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3852		dbg_print(0, MSG_INTL(MSG_ELF_SCN_NOTE), _cache->c_name);
3853		note_entry(_cache, (Word *)_cache->c_data->d_buf,
3854		/* LINTED */
3855		    (Word)_cache->c_data->d_size, ehdr, file);
3856	}
3857
3858	return (note_cnt);
3859}
3860
3861/*
3862 * The Linux Standard Base defines a special note named .note.ABI-tag
3863 * that is used to maintain Linux ABI information. Presence of this section
3864 * is a strong indication that the object should be considered to be
3865 * ELFOSABI_LINUX.
3866 *
3867 * This function returns True (1) if such a note is seen, and False (0)
3868 * otherwise.
3869 */
3870static int
3871has_linux_abi_note(Cache *cache, Word shnum, const char *file)
3872{
3873	Word	cnt;
3874
3875	for (cnt = 1; cnt < shnum; cnt++) {
3876		parse_note_t	pnstate;
3877		Cache		*_cache = &cache[cnt];
3878		Shdr		*shdr = _cache->c_shdr;
3879
3880		/*
3881		 * Section must be SHT_NOTE, must have the name
3882		 * .note.ABI-tag, and must have data.
3883		 */
3884		if ((shdr->sh_type != SHT_NOTE) ||
3885		    (strcmp(MSG_ORIG(MSG_STR_NOTEABITAG),
3886		    _cache->c_name) != 0) ||
3887		    (_cache->c_data == NULL) ||
3888		    (_cache->c_data->d_buf == NULL))
3889			continue;
3890
3891		pnstate.pns_file = file;
3892		pnstate.pns_cache = _cache;
3893		pnstate.pns_size = _cache->c_data->d_size;
3894		pnstate.pns_data = (Word *)_cache->c_data->d_buf;
3895
3896		while (pnstate.pns_size > 0) {
3897			Word *w;
3898
3899			if (parse_note_entry(&pnstate) == 0)
3900				break;
3901
3902			/*
3903			 * The type must be 1, and the name must be "GNU".
3904			 * The descsz must be at least 16 bytes.
3905			 */
3906			if ((pnstate.pn_type != 1) ||
3907			    (pnstate.pn_namesz != (MSG_STR_GNU_SIZE + 1)) ||
3908			    (strncmp(MSG_ORIG(MSG_STR_GNU), pnstate.pn_name,
3909			    MSG_STR_CORE_SIZE + 1) != 0) ||
3910			    (pnstate.pn_descsz < 16))
3911				continue;
3912
3913			/*
3914			 * desc contains 4 32-bit fields. Field 0 must be 0,
3915			 * indicating Linux. The second, third, and fourth
3916			 * fields represent the earliest Linux kernel
3917			 * version compatible with this object.
3918			 */
3919			/*LINTED*/
3920			w = (Word *) pnstate.pn_desc;
3921			if (*w == 0)
3922				return (1);
3923		}
3924	}
3925
3926	return (0);
3927}
3928
3929/*
3930 * Determine an individual hash entry.  This may be the initial hash entry,
3931 * or an associated chain entry.
3932 */
3933static void
3934hash_entry(Cache *refsec, Cache *strsec, const char *hsecname, Word hashndx,
3935    Word symndx, Word symn, Sym *syms, const char *file, ulong_t bkts,
3936    uint_t flags, int chain)
3937{
3938	Sym		*sym;
3939	const char	*symname, *str;
3940	char		_bucket[MAXNDXSIZE], _symndx[MAXNDXSIZE];
3941	ulong_t		nbkt, nhash;
3942
3943	if (symndx > symn) {
3944		(void) fprintf(stderr, MSG_INTL(MSG_ERR_HSBADSYMNDX), file,
3945		    EC_WORD(symndx), EC_WORD(hashndx));
3946		symname = MSG_INTL(MSG_STR_UNKNOWN);
3947	} else {
3948		sym = (Sym *)(syms + symndx);
3949		symname = string(refsec, symndx, strsec, file, sym->st_name);
3950	}
3951
3952	if (chain == 0) {
3953		(void) snprintf(_bucket, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INTEGER),
3954		    hashndx);
3955		str = (const char *)_bucket;
3956	} else
3957		str = MSG_ORIG(MSG_STR_EMPTY);
3958
3959	(void) snprintf(_symndx, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX2),
3960	    EC_WORD(symndx));
3961	dbg_print(0, MSG_ORIG(MSG_FMT_HASH_INFO), str, _symndx,
3962	    demangle(symname, flags));
3963
3964	/*
3965	 * Determine if this string is in the correct bucket.
3966	 */
3967	nhash = elf_hash(symname);
3968	nbkt = nhash % bkts;
3969
3970	if (nbkt != hashndx) {
3971		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADHASH), file,
3972		    hsecname, symname, EC_WORD(hashndx), nbkt);
3973	}
3974}
3975
3976#define	MAXCOUNT	500
3977
3978static void
3979hash(Cache *cache, Word shnum, const char *file, uint_t flags)
3980{
3981	static int	count[MAXCOUNT];
3982	Word		cnt;
3983	Word		ndx, bkts, nchain;
3984	char		number[MAXNDXSIZE];
3985
3986	for (cnt = 1; cnt < shnum; cnt++) {
3987		Word		*hash, *chain;
3988		Cache		*_cache = &cache[cnt];
3989		Shdr		*sshdr, *hshdr = _cache->c_shdr;
3990		char		*ssecname, *hsecname = _cache->c_name;
3991		Sym		*syms;
3992		Word		symn;
3993
3994		if (hshdr->sh_type != SHT_HASH)
3995			continue;
3996
3997		/*
3998		 * Check the hash table data and size.
3999		 */
4000		if ((hshdr->sh_entsize == 0) || (hshdr->sh_size == 0)) {
4001			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4002			    file, hsecname);
4003			continue;
4004		}
4005		if ((_cache->c_data == NULL) ||
4006		    (_cache->c_data->d_buf == NULL)) {
4007			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4008			    file, hsecname);
4009			continue;
4010		}
4011
4012		hash = (Word *)_cache->c_data->d_buf;
4013		bkts = *hash++;
4014		nchain = *hash++;
4015		chain = hash + bkts;
4016
4017		/*
4018		 * The section holds the sizes in addition to the buckets and
4019		 * chains.
4020		 */
4021		if (_cache->c_data->d_size <
4022		    (bkts + nchain + 2) * sizeof (uint_t)) {
4023			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4024			    file, hsecname);
4025			continue;
4026		}
4027
4028		/*
4029		 * Get the data buffer for the associated symbol table.
4030		 */
4031		if ((hshdr->sh_link == 0) || (hshdr->sh_link >= shnum)) {
4032			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
4033			    file, hsecname, EC_WORD(hshdr->sh_link));
4034			continue;
4035		}
4036
4037		_cache = &cache[hshdr->sh_link];
4038		ssecname = _cache->c_name;
4039
4040		if ((_cache->c_data == NULL) || (_cache->c_data->d_buf == NULL))
4041			continue;
4042
4043		if ((syms = (Sym *)_cache->c_data->d_buf) == NULL) {
4044			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4045			    file, ssecname);
4046			continue;
4047		}
4048
4049		sshdr = _cache->c_shdr;
4050
4051		if ((sshdr->sh_entsize == 0) || (sshdr->sh_size == 0)) {
4052			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4053			    file, ssecname);
4054			continue;
4055		}
4056
4057		/* LINTED */
4058		symn = (Word)(sshdr->sh_size / sshdr->sh_entsize);
4059
4060		/*
4061		 * Check that there is a chain for each symbol.
4062		 */
4063		if (symn > nchain) {
4064			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4065			    file, ssecname);
4066			continue;
4067		}
4068
4069		/*
4070		 * Get the associated string table section.
4071		 */
4072		if ((sshdr->sh_link == 0) || (sshdr->sh_link >= shnum)) {
4073			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
4074			    file, ssecname, EC_WORD(sshdr->sh_link));
4075			continue;
4076		}
4077
4078		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4079		dbg_print(0, MSG_INTL(MSG_ELF_SCN_HASH), hsecname);
4080		dbg_print(0, MSG_INTL(MSG_ELF_HASH_INFO));
4081
4082		/*
4083		 * Loop through the hash buckets, printing the appropriate
4084		 * symbols.
4085		 */
4086		for (ndx = 0; ndx < bkts; ndx++, hash++) {
4087			Word	_ndx, _cnt;
4088
4089			if (*hash == 0) {
4090				count[0]++;
4091				continue;
4092			}
4093
4094			/*
4095			 * Each hash bucket must contain to a valid chain index.
4096			 * Because the symbol table is checked to be the same
4097			 * length as the chain array, this also implicitly
4098			 * checks those bounds.
4099			 */
4100			if (*hash > nchain) {
4101				(void) fprintf(stderr,
4102				    MSG_INTL(MSG_ERR_BADCHAINIDX), file,
4103				    ssecname, EC_WORD(*hash), EC_WORD(ndx),
4104				    EC_WORD(nchain));
4105				continue;
4106			}
4107
4108			hash_entry(_cache, &cache[sshdr->sh_link], hsecname,
4109			    ndx, *hash, symn, syms, file, bkts, flags, 0);
4110
4111			/*
4112			 * Determine if any other symbols are chained to this
4113			 * bucket.
4114			 */
4115			_ndx = chain[*hash];
4116			_cnt = 1;
4117			while (_ndx) {
4118				if (_ndx > nchain) {
4119					(void) fprintf(stderr,
4120					    MSG_INTL(MSG_ERR_BADCHAINIDX), file,
4121					    ssecname, EC_WORD(_ndx),
4122					    EC_WORD(ndx), EC_WORD(nchain));
4123					break;
4124				}
4125				hash_entry(_cache, &cache[sshdr->sh_link],
4126				    hsecname, ndx, _ndx, symn, syms, file,
4127				    bkts, flags, 1);
4128				_ndx = chain[_ndx];
4129				_cnt++;
4130			}
4131
4132			if (_cnt >= MAXCOUNT) {
4133				(void) fprintf(stderr,
4134				    MSG_INTL(MSG_HASH_OVERFLW), file,
4135				    _cache->c_name, EC_WORD(ndx),
4136				    EC_WORD(_cnt));
4137			} else
4138				count[_cnt]++;
4139		}
4140		break;
4141	}
4142
4143	/*
4144	 * Print out the count information.
4145	 */
4146	bkts = cnt = 0;
4147	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4148
4149	for (ndx = 0; ndx < MAXCOUNT; ndx++) {
4150		Word	_cnt;
4151
4152		if ((_cnt = count[ndx]) == 0)
4153			continue;
4154
4155		(void) snprintf(number, MAXNDXSIZE,
4156		    MSG_ORIG(MSG_FMT_INTEGER), _cnt);
4157		dbg_print(0, MSG_INTL(MSG_ELF_HASH_BKTS1), number,
4158		    EC_WORD(ndx));
4159		bkts += _cnt;
4160		cnt += (Word)(ndx * _cnt);
4161	}
4162	if (cnt) {
4163		(void) snprintf(number, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INTEGER),
4164		    bkts);
4165		dbg_print(0, MSG_INTL(MSG_ELF_HASH_BKTS2), number,
4166		    EC_WORD(cnt));
4167	}
4168}
4169
4170static void
4171group(Cache *cache, Word shnum, const char *file, uint_t flags)
4172{
4173	Word	scnt;
4174
4175	for (scnt = 1; scnt < shnum; scnt++) {
4176		Cache		*_cache = &cache[scnt];
4177		Shdr		*shdr = _cache->c_shdr;
4178		Word		*grpdata, gcnt, grpcnt, symnum, unknown;
4179		Cache		*symsec, *strsec;
4180		Sym		*syms, *sym;
4181		char		flgstrbuf[MSG_GRP_COMDAT_SIZE + 10];
4182		const char	*grpnam;
4183
4184		if (shdr->sh_type != SHT_GROUP)
4185			continue;
4186		if (!match(MATCH_F_ALL, _cache->c_name, scnt, shdr->sh_type))
4187			continue;
4188		if ((_cache->c_data == NULL) ||
4189		    ((grpdata = (Word *)_cache->c_data->d_buf) == NULL))
4190			continue;
4191		grpcnt = shdr->sh_size / sizeof (Word);
4192
4193		/*
4194		 * Get the data buffer for the associated symbol table and
4195		 * string table.
4196		 */
4197		if (stringtbl(cache, 1, scnt, shnum, file,
4198		    &symnum, &symsec, &strsec) == 0)
4199			return;
4200
4201		syms = symsec->c_data->d_buf;
4202
4203		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4204		dbg_print(0, MSG_INTL(MSG_ELF_SCN_GRP), _cache->c_name);
4205		dbg_print(0, MSG_INTL(MSG_GRP_TITLE));
4206
4207		/*
4208		 * The first element of the group defines the group.  The
4209		 * associated symbol is defined by the sh_link field.
4210		 */
4211		if ((shdr->sh_info == SHN_UNDEF) || (shdr->sh_info > symnum)) {
4212			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHINFO),
4213			    file, _cache->c_name, EC_WORD(shdr->sh_info));
4214			return;
4215		}
4216
4217		(void) strcpy(flgstrbuf, MSG_ORIG(MSG_STR_OSQBRKT));
4218		if (grpdata[0] & GRP_COMDAT) {
4219			(void) strcat(flgstrbuf, MSG_ORIG(MSG_GRP_COMDAT));
4220		}
4221		if ((unknown = (grpdata[0] & ~GRP_COMDAT)) != 0) {
4222			size_t	len = strlen(flgstrbuf);
4223
4224			(void) snprintf(&flgstrbuf[len],
4225			    (MSG_GRP_COMDAT_SIZE + 10 - len),
4226			    MSG_ORIG(MSG_GRP_UNKNOWN), unknown);
4227		}
4228		(void) strcat(flgstrbuf, MSG_ORIG(MSG_STR_CSQBRKT));
4229		sym = (Sym *)(syms + shdr->sh_info);
4230
4231		/*
4232		 * The GNU assembler can use section symbols as the signature
4233		 * symbol as described by this comment in the gold linker
4234		 * (found via google):
4235		 *
4236		 *	It seems that some versions of gas will create a
4237		 *	section group associated with a section symbol, and
4238		 *	then fail to give a name to the section symbol.  In
4239		 *	such a case, use the name of the section.
4240		 *
4241		 * In order to support such objects, we do the same.
4242		 */
4243		grpnam = string(_cache, 0, strsec, file, sym->st_name);
4244		if (((sym->st_name == 0) || (*grpnam == '\0')) &&
4245		    (ELF_ST_TYPE(sym->st_info) == STT_SECTION))
4246			grpnam = cache[sym->st_shndx].c_name;
4247
4248		dbg_print(0, MSG_INTL(MSG_GRP_SIGNATURE), flgstrbuf,
4249		    demangle(grpnam, flags));
4250
4251		for (gcnt = 1; gcnt < grpcnt; gcnt++) {
4252			char		index[MAXNDXSIZE];
4253			const char	*name;
4254
4255			(void) snprintf(index, MAXNDXSIZE,
4256			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(gcnt));
4257
4258			if (grpdata[gcnt] >= shnum)
4259				name = MSG_INTL(MSG_GRP_INVALSCN);
4260			else
4261				name = cache[grpdata[gcnt]].c_name;
4262
4263			(void) printf(MSG_ORIG(MSG_GRP_ENTRY), index, name,
4264			    EC_XWORD(grpdata[gcnt]));
4265		}
4266	}
4267}
4268
4269static void
4270got(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
4271{
4272	Cache		*gotcache = NULL, *symtab = NULL;
4273	Addr		gotbgn, gotend;
4274	Shdr		*gotshdr;
4275	Word		cnt, gotents, gotndx;
4276	size_t		gentsize;
4277	Got_info	*gottable;
4278	char		*gotdata;
4279	Sym		*gotsym;
4280	Xword		gotsymaddr;
4281	uint_t		sys_encoding;
4282
4283	/*
4284	 * First, find the got.
4285	 */
4286	for (cnt = 1; cnt < shnum; cnt++) {
4287		if (strncmp(cache[cnt].c_name, MSG_ORIG(MSG_ELF_GOT),
4288		    MSG_ELF_GOT_SIZE) == 0) {
4289			gotcache = &cache[cnt];
4290			break;
4291		}
4292	}
4293	if (gotcache == NULL)
4294		return;
4295
4296	/*
4297	 * A got section within a relocatable object is suspicious.
4298	 */
4299	if (ehdr->e_type == ET_REL) {
4300		(void) fprintf(stderr, MSG_INTL(MSG_GOT_UNEXPECTED), file,
4301		    gotcache->c_name);
4302	}
4303
4304	gotshdr = gotcache->c_shdr;
4305	if (gotshdr->sh_size == 0) {
4306		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4307		    file, gotcache->c_name);
4308		return;
4309	}
4310
4311	gotbgn = gotshdr->sh_addr;
4312	gotend = gotbgn + gotshdr->sh_size;
4313
4314	/*
4315	 * Some architectures don't properly set the sh_entsize for the GOT
4316	 * table.  If it's not set, default to a size of a pointer.
4317	 */
4318	if ((gentsize = gotshdr->sh_entsize) == 0)
4319		gentsize = sizeof (Xword);
4320
4321	if ((gotcache->c_data == NULL) || (gotcache->c_data->d_buf == NULL))
4322		return;
4323
4324	/* LINTED */
4325	gotents = (Word)(gotshdr->sh_size / gentsize);
4326	gotdata = gotcache->c_data->d_buf;
4327
4328	if ((gottable = calloc(gotents, sizeof (Got_info))) == 0) {
4329		int err = errno;
4330		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC), file,
4331		    strerror(err));
4332		return;
4333	}
4334
4335	/*
4336	 * Now we scan through all the sections looking for any relocations
4337	 * that may be against the GOT.  Since these may not be isolated to a
4338	 * .rel[a].got section we check them all.
4339	 * While scanning sections save the symbol table entry (a symtab
4340	 * overriding a dynsym) so that we can lookup _GLOBAL_OFFSET_TABLE_.
4341	 */
4342	for (cnt = 1; cnt < shnum; cnt++) {
4343		Word		type, symnum;
4344		Xword		relndx, relnum, relsize;
4345		void		*rels;
4346		Sym		*syms;
4347		Cache		*symsec, *strsec;
4348		Cache		*_cache = &cache[cnt];
4349		Shdr		*shdr;
4350
4351		shdr = _cache->c_shdr;
4352		type = shdr->sh_type;
4353
4354		if ((symtab == 0) && (type == SHT_DYNSYM)) {
4355			symtab = _cache;
4356			continue;
4357		}
4358		if (type == SHT_SYMTAB) {
4359			symtab = _cache;
4360			continue;
4361		}
4362		if ((type != SHT_RELA) && (type != SHT_REL))
4363			continue;
4364
4365		/*
4366		 * Decide entry size.
4367		 */
4368		if (((relsize = shdr->sh_entsize) == 0) ||
4369		    (relsize > shdr->sh_size)) {
4370			if (type == SHT_RELA)
4371				relsize = sizeof (Rela);
4372			else
4373				relsize = sizeof (Rel);
4374		}
4375
4376		/*
4377		 * Determine the number of relocations available.
4378		 */
4379		if (shdr->sh_size == 0) {
4380			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4381			    file, _cache->c_name);
4382			continue;
4383		}
4384		if ((_cache->c_data == NULL) || (_cache->c_data->d_buf == NULL))
4385			continue;
4386
4387		rels = _cache->c_data->d_buf;
4388		relnum = shdr->sh_size / relsize;
4389
4390		/*
4391		 * Get the data buffer for the associated symbol table and
4392		 * string table.
4393		 */
4394		if (stringtbl(cache, 1, cnt, shnum, file,
4395		    &symnum, &symsec, &strsec) == 0)
4396			continue;
4397
4398		syms = symsec->c_data->d_buf;
4399
4400		/*
4401		 * Loop through the relocation entries.
4402		 */
4403		for (relndx = 0; relndx < relnum; relndx++,
4404		    rels = (void *)((char *)rels + relsize)) {
4405			char		section[BUFSIZ];
4406			Addr		offset;
4407			Got_info	*gip;
4408			Word		symndx, reltype;
4409			Rela		*rela;
4410			Rel		*rel;
4411
4412			/*
4413			 * Unravel the relocation.
4414			 */
4415			if (type == SHT_RELA) {
4416				rela = (Rela *)rels;
4417				symndx = ELF_R_SYM(rela->r_info);
4418				reltype = ELF_R_TYPE(rela->r_info,
4419				    ehdr->e_machine);
4420				offset = rela->r_offset;
4421			} else {
4422				rel = (Rel *)rels;
4423				symndx = ELF_R_SYM(rel->r_info);
4424				reltype = ELF_R_TYPE(rel->r_info,
4425				    ehdr->e_machine);
4426				offset = rel->r_offset;
4427			}
4428
4429			/*
4430			 * Only pay attention to relocations against the GOT.
4431			 */
4432			if ((offset < gotbgn) || (offset >= gotend))
4433				continue;
4434
4435			if ((gotshdr->sh_entsize == 0) ||
4436			    (gotshdr->sh_size == 0)) {
4437				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4438				    file, gotcache->c_name);
4439				continue;
4440			}
4441
4442			/* LINTED */
4443			gotndx = (Word)((offset - gotbgn) /
4444			    gotshdr->sh_entsize);
4445			gip = &gottable[gotndx];
4446
4447			if (gip->g_reltype != 0) {
4448				(void) fprintf(stderr,
4449				    MSG_INTL(MSG_GOT_MULTIPLE), file,
4450				    EC_WORD(gotndx), EC_ADDR(offset));
4451				continue;
4452			}
4453
4454			if (symndx)
4455				gip->g_symname = relsymname(cache, _cache,
4456				    strsec, symndx, symnum, relndx, syms,
4457				    section, BUFSIZ, file);
4458			gip->g_reltype = reltype;
4459			gip->g_rel = rels;
4460		}
4461	}
4462
4463	if (symlookup(MSG_ORIG(MSG_SYM_GOT), cache, shnum, &gotsym, NULL,
4464	    symtab, file))
4465		gotsymaddr = gotsym->st_value;
4466	else
4467		gotsymaddr = gotbgn;
4468
4469	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4470	dbg_print(0, MSG_INTL(MSG_ELF_SCN_GOT), gotcache->c_name);
4471	Elf_got_title(0);
4472
4473	sys_encoding = _elf_sys_encoding();
4474	for (gotndx = 0; gotndx < gotents; gotndx++) {
4475		Got_info	*gip;
4476		Sword		gindex;
4477		Addr		gaddr;
4478		Xword		gotentry;
4479
4480		gip = &gottable[gotndx];
4481
4482		gaddr = gotbgn + (gotndx * gentsize);
4483		gindex = (Sword)(gaddr - gotsymaddr) / (Sword)gentsize;
4484
4485		if (gentsize == sizeof (Word))
4486			/* LINTED */
4487			gotentry = (Xword)(*((Word *)(gotdata) + gotndx));
4488		else
4489			/* LINTED */
4490			gotentry = *((Xword *)(gotdata) + gotndx);
4491
4492		Elf_got_entry(0, gindex, gaddr, gotentry, ehdr->e_machine,
4493		    ehdr->e_ident[EI_DATA], sys_encoding,
4494		    gip->g_reltype, gip->g_rel, gip->g_symname);
4495	}
4496	free(gottable);
4497}
4498
4499void
4500checksum(Elf *elf)
4501{
4502	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4503	dbg_print(0, MSG_INTL(MSG_STR_CHECKSUM), elf_checksum(elf));
4504}
4505
4506/*
4507 * This variable is used by regular() to communicate the address of
4508 * the section header cache to sort_shdr_ndx_arr(). Unfortunately,
4509 * the qsort() interface does not include a userdata argument by which
4510 * such arbitrary data can be passed, so we are stuck using global data.
4511 */
4512static Cache *sort_shdr_ndx_arr_cache;
4513
4514
4515/*
4516 * Used with qsort() to sort the section indices so that they can be
4517 * used to access the section headers in order of increasing data offset.
4518 *
4519 * entry:
4520 *	sort_shdr_ndx_arr_cache - Contains address of
4521 *		section header cache.
4522 *	v1, v2 - Point at elements of sort_shdr_bits array to be compared.
4523 *
4524 * exit:
4525 *	Returns -1 (less than), 0 (equal) or 1 (greater than).
4526 */
4527static int
4528sort_shdr_ndx_arr(const void *v1, const void *v2)
4529{
4530	Cache	*cache1 = sort_shdr_ndx_arr_cache + *((size_t *)v1);
4531	Cache	*cache2 = sort_shdr_ndx_arr_cache + *((size_t *)v2);
4532
4533	if (cache1->c_shdr->sh_offset < cache2->c_shdr->sh_offset)
4534		return (-1);
4535
4536	if (cache1->c_shdr->sh_offset > cache2->c_shdr->sh_offset)
4537		return (1);
4538
4539	return (0);
4540}
4541
4542
4543static int
4544shdr_cache(const char *file, Elf *elf, Ehdr *ehdr, size_t shstrndx,
4545    size_t shnum, Cache **cache_ret, Word flags)
4546{
4547	Elf_Scn		*scn;
4548	Elf_Data	*data;
4549	size_t		ndx;
4550	Shdr		*nameshdr;
4551	char		*names = NULL;
4552	Cache		*cache, *_cache;
4553	size_t		*shdr_ndx_arr, shdr_ndx_arr_cnt;
4554
4555
4556	/*
4557	 * Obtain the .shstrtab data buffer to provide the required section
4558	 * name strings.
4559	 */
4560	if (shstrndx == SHN_UNDEF) {
4561		/*
4562		 * It is rare, but legal, for an object to lack a
4563		 * header string table section.
4564		 */
4565		names = NULL;
4566		(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOSHSTRSEC), file);
4567	} else if ((scn = elf_getscn(elf, shstrndx)) == NULL) {
4568		failure(file, MSG_ORIG(MSG_ELF_GETSCN));
4569		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SHDR),
4570		    EC_XWORD(shstrndx));
4571
4572	} else if ((data = elf_getdata(scn, NULL)) == NULL) {
4573		failure(file, MSG_ORIG(MSG_ELF_GETDATA));
4574		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_DATA),
4575		    EC_XWORD(shstrndx));
4576
4577	} else if ((nameshdr = elf_getshdr(scn)) == NULL) {
4578		failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
4579		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN),
4580		    EC_WORD(elf_ndxscn(scn)));
4581
4582	} else if ((names = data->d_buf) == NULL)
4583		(void) fprintf(stderr, MSG_INTL(MSG_ERR_SHSTRNULL), file);
4584
4585	/*
4586	 * Allocate a cache to maintain a descriptor for each section.
4587	 */
4588	if ((*cache_ret = cache = malloc(shnum * sizeof (Cache))) == NULL) {
4589		int err = errno;
4590		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
4591		    file, strerror(err));
4592		return (0);
4593	}
4594
4595	*cache = cache_init;
4596	_cache = cache;
4597	_cache++;
4598
4599	/*
4600	 * Allocate an array that will hold the section index for
4601	 * each section that has data in the ELF file:
4602	 *
4603	 *	- Is not a NOBITS section
4604	 *	- Data has non-zero length
4605	 *
4606	 * Note that shnum is an upper bound on the size required. It
4607	 * is likely that we won't use a few of these array elements.
4608	 * Allocating a modest amount of extra memory in this case means
4609	 * that we can avoid an extra loop to count the number of needed
4610	 * items, and can fill this array immediately in the first loop
4611	 * below.
4612	 */
4613	if ((shdr_ndx_arr = malloc(shnum * sizeof (*shdr_ndx_arr))) == NULL) {
4614		int err = errno;
4615		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
4616		    file, strerror(err));
4617		return (0);
4618	}
4619	shdr_ndx_arr_cnt = 0;
4620
4621	/*
4622	 * Traverse the sections of the file.  This gathering of data is
4623	 * carried out in two passes.  First, the section headers are captured
4624	 * and the section header names are evaluated.  A verification pass is
4625	 * then carried out over the section information.  Files have been
4626	 * known to exhibit overlapping (and hence erroneous) section header
4627	 * information.
4628	 *
4629	 * Finally, the data for each section is obtained.  This processing is
4630	 * carried out after section verification because should any section
4631	 * header overlap occur, and a file needs translating (ie. xlate'ing
4632	 * information from a non-native architecture file), then the process
4633	 * of translation can corrupt the section header information.  Of
4634	 * course, if there is any section overlap, the data related to the
4635	 * sections is going to be compromised.  However, it is the translation
4636	 * of this data that has caused problems with elfdump()'s ability to
4637	 * extract the data.
4638	 */
4639	for (ndx = 1, scn = NULL; scn = elf_nextscn(elf, scn);
4640	    ndx++, _cache++) {
4641		char	scnndxnm[100];
4642
4643		_cache->c_ndx = ndx;
4644		_cache->c_scn = scn;
4645
4646		if ((_cache->c_shdr = elf_getshdr(scn)) == NULL) {
4647			failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
4648			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN),
4649			    EC_WORD(elf_ndxscn(scn)));
4650		}
4651
4652		/*
4653		 * If this section has data in the file, include it in
4654		 * the array of sections to check for address overlap.
4655		 */
4656		if ((_cache->c_shdr->sh_size != 0) &&
4657		    (_cache->c_shdr->sh_type != SHT_NOBITS))
4658			shdr_ndx_arr[shdr_ndx_arr_cnt++] = ndx;
4659
4660		/*
4661		 * If a shstrtab exists, assign the section name.
4662		 */
4663		if (names && _cache->c_shdr) {
4664			if (_cache->c_shdr->sh_name &&
4665			    /* LINTED */
4666			    (nameshdr->sh_size > _cache->c_shdr->sh_name)) {
4667				const char	*symname;
4668				char		*secname;
4669
4670				secname = names + _cache->c_shdr->sh_name;
4671
4672				/*
4673				 * A SUN naming convention employs a "%" within
4674				 * a section name to indicate a section/symbol
4675				 * name.  This originated from the compilers
4676				 * -xF option, that places functions into their
4677				 * own sections.  This convention (which has no
4678				 * formal standard) has also been followed for
4679				 * COMDAT sections.  To demangle the symbol
4680				 * name, the name must be separated from the
4681				 * section name.
4682				 */
4683				if (((flags & FLG_CTL_DEMANGLE) == 0) ||
4684				    ((symname = strchr(secname, '%')) == NULL))
4685					_cache->c_name = secname;
4686				else {
4687					size_t	secsz = ++symname - secname;
4688					size_t	strsz;
4689
4690					symname = demangle(symname, flags);
4691					strsz = secsz + strlen(symname) + 1;
4692
4693					if ((_cache->c_name =
4694					    malloc(strsz)) == NULL) {
4695						int err = errno;
4696						(void) fprintf(stderr,
4697						    MSG_INTL(MSG_ERR_MALLOC),
4698						    file, strerror(err));
4699						return (0);
4700					}
4701					(void) snprintf(_cache->c_name, strsz,
4702					    MSG_ORIG(MSG_FMT_SECSYM),
4703					    EC_WORD(secsz), secname, symname);
4704				}
4705
4706				continue;
4707			}
4708
4709			/*
4710			 * Generate an error if the section name index is zero
4711			 * or exceeds the shstrtab data.  Fall through to
4712			 * fabricate a section name.
4713			 */
4714			if ((_cache->c_shdr->sh_name == 0) ||
4715			    /* LINTED */
4716			    (nameshdr->sh_size <= _cache->c_shdr->sh_name)) {
4717				(void) fprintf(stderr,
4718				    MSG_INTL(MSG_ERR_BADSHNAME), file,
4719				    EC_WORD(ndx),
4720				    EC_XWORD(_cache->c_shdr->sh_name));
4721			}
4722		}
4723
4724		/*
4725		 * If there exists no shstrtab data, or a section header has no
4726		 * name (an invalid index of 0), then compose a name for the
4727		 * section.
4728		 */
4729		(void) snprintf(scnndxnm, sizeof (scnndxnm),
4730		    MSG_INTL(MSG_FMT_SCNNDX), ndx);
4731
4732		if ((_cache->c_name = malloc(strlen(scnndxnm) + 1)) == NULL) {
4733			int err = errno;
4734			(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
4735			    file, strerror(err));
4736			return (0);
4737		}
4738		(void) strcpy(_cache->c_name, scnndxnm);
4739	}
4740
4741	/*
4742	 * Having collected all the sections, validate their address range.
4743	 * Cases have existed where the section information has been invalid.
4744	 * This can lead to all sorts of other, hard to diagnose errors, as
4745	 * each section is processed individually (ie. with elf_getdata()).
4746	 * Here, we carry out some address comparisons to catch a family of
4747	 * overlapping memory issues we have observed (likely, there are others
4748	 * that we have yet to discover).
4749	 *
4750	 * Note, should any memory overlap occur, obtaining any additional
4751	 * data from the file is questionable.  However, it might still be
4752	 * possible to inspect the ELF header, Programs headers, or individual
4753	 * sections, so rather than bailing on an error condition, continue
4754	 * processing to see if any data can be salvaged.
4755	 */
4756	if (shdr_ndx_arr_cnt > 1) {
4757		sort_shdr_ndx_arr_cache = cache;
4758		qsort(shdr_ndx_arr, shdr_ndx_arr_cnt,
4759		    sizeof (*shdr_ndx_arr), sort_shdr_ndx_arr);
4760	}
4761	for (ndx = 0; ndx < shdr_ndx_arr_cnt; ndx++) {
4762		Cache	*_cache = cache + shdr_ndx_arr[ndx];
4763		Shdr	*shdr = _cache->c_shdr;
4764		Off	bgn1, bgn = shdr->sh_offset;
4765		Off	end1, end = shdr->sh_offset + shdr->sh_size;
4766		size_t	ndx1;
4767
4768		/*
4769		 * Check the section against all following ones, reporting
4770		 * any overlaps. Since we've sorted the sections by offset,
4771		 * we can stop after the first comparison that fails. There
4772		 * are no overlaps in a properly formed ELF file, in which
4773		 * case this algorithm runs in O(n) time. This will degenerate
4774		 * to O(n^2) for a completely broken file. Such a file is
4775		 * (1) highly unlikely, and (2) unusable, so it is reasonable
4776		 * for the analysis to take longer.
4777		 */
4778		for (ndx1 = ndx + 1; ndx1 < shdr_ndx_arr_cnt; ndx1++) {
4779			Cache	*_cache1 = cache + shdr_ndx_arr[ndx1];
4780			Shdr	*shdr1 = _cache1->c_shdr;
4781
4782			bgn1 = shdr1->sh_offset;
4783			end1 = shdr1->sh_offset + shdr1->sh_size;
4784
4785			if (((bgn1 <= bgn) && (end1 > bgn)) ||
4786			    ((bgn1 < end) && (end1 >= end))) {
4787				(void) fprintf(stderr,
4788				    MSG_INTL(MSG_ERR_SECMEMOVER), file,
4789				    EC_WORD(elf_ndxscn(_cache->c_scn)),
4790				    _cache->c_name, EC_OFF(bgn), EC_OFF(end),
4791				    EC_WORD(elf_ndxscn(_cache1->c_scn)),
4792				    _cache1->c_name, EC_OFF(bgn1),
4793				    EC_OFF(end1));
4794			} else {	/* No overlap, so can stop */
4795				break;
4796			}
4797		}
4798
4799		/*
4800		 * In addition to checking for sections overlapping
4801		 * each other (done above), we should also make sure
4802		 * the section doesn't overlap the section header array.
4803		 */
4804		bgn1 = ehdr->e_shoff;
4805		end1 = ehdr->e_shoff + (ehdr->e_shentsize * ehdr->e_shnum);
4806
4807		if (((bgn1 <= bgn) && (end1 > bgn)) ||
4808		    ((bgn1 < end) && (end1 >= end))) {
4809			(void) fprintf(stderr,
4810			    MSG_INTL(MSG_ERR_SHDRMEMOVER), file, EC_OFF(bgn1),
4811			    EC_OFF(end1),
4812			    EC_WORD(elf_ndxscn(_cache->c_scn)),
4813			    _cache->c_name, EC_OFF(bgn), EC_OFF(end));
4814		}
4815	}
4816
4817	/*
4818	 * Obtain the data for each section.
4819	 */
4820	for (ndx = 1; ndx < shnum; ndx++) {
4821		Cache	*_cache = &cache[ndx];
4822		Elf_Scn	*scn = _cache->c_scn;
4823
4824		if ((_cache->c_data = elf_getdata(scn, NULL)) == NULL) {
4825			failure(file, MSG_ORIG(MSG_ELF_GETDATA));
4826			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCNDATA),
4827			    EC_WORD(elf_ndxscn(scn)));
4828		}
4829
4830		/*
4831		 * If a string table, verify that it has NULL first and
4832		 * final bytes.
4833		 */
4834		if ((_cache->c_shdr->sh_type == SHT_STRTAB) &&
4835		    (_cache->c_data != NULL) &&
4836		    (_cache->c_data->d_buf != NULL) &&
4837		    (_cache->c_data->d_size > 0)) {
4838			const char *s = _cache->c_data->d_buf;
4839
4840			if ((*s != '\0') ||
4841			    (*(s + _cache->c_data->d_size - 1) != '\0'))
4842				(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALSTR),
4843				    file, _cache->c_name);
4844		}
4845	}
4846
4847	return (1);
4848}
4849
4850
4851
4852/*
4853 * Generate a cache of section headers and related information
4854 * for use by the rest of elfdump. If requested (or the file
4855 * contains no section headers), we generate a fake set of
4856 * headers from the information accessible from the program headers.
4857 * Otherwise, we use the real section headers contained in the file.
4858 */
4859static int
4860create_cache(const char *file, int fd, Elf *elf, Ehdr *ehdr, Cache **cache,
4861    size_t shstrndx, size_t *shnum, uint_t *flags)
4862{
4863	/*
4864	 * If there are no section headers, then resort to synthesizing
4865	 * section headers from the program headers. This is normally
4866	 * only done by explicit request, but in this case there's no
4867	 * reason not to go ahead, since the alternative is simply to quit.
4868	 */
4869	if ((*shnum <= 1) && ((*flags & FLG_CTL_FAKESHDR) == 0)) {
4870		(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOSHDR), file);
4871		*flags |= FLG_CTL_FAKESHDR;
4872	}
4873
4874	if (*flags & FLG_CTL_FAKESHDR) {
4875		if (fake_shdr_cache(file, fd, elf, ehdr, cache, shnum) == 0)
4876			return (0);
4877	} else {
4878		if (shdr_cache(file, elf, ehdr, shstrndx, *shnum,
4879		    cache, *flags) == 0)
4880			return (0);
4881	}
4882
4883	return (1);
4884}
4885
4886int
4887regular(const char *file, int fd, Elf *elf, uint_t flags,
4888    const char *wname, int wfd, uchar_t osabi)
4889{
4890	enum { CACHE_NEEDED, CACHE_OK, CACHE_FAIL} cache_state = CACHE_NEEDED;
4891	Elf_Scn		*scn;
4892	Ehdr		*ehdr;
4893	size_t		ndx, shstrndx, shnum, phnum;
4894	Shdr		*shdr;
4895	Cache		*cache;
4896	VERSYM_STATE	versym = { 0 };
4897	int		ret = 0;
4898	int		addr_align;
4899
4900	if ((ehdr = elf_getehdr(elf)) == NULL) {
4901		failure(file, MSG_ORIG(MSG_ELF_GETEHDR));
4902		return (ret);
4903	}
4904
4905	if (elf_getshdrnum(elf, &shnum) == -1) {
4906		failure(file, MSG_ORIG(MSG_ELF_GETSHDRNUM));
4907		return (ret);
4908	}
4909
4910	if (elf_getshdrstrndx(elf, &shstrndx) == -1) {
4911		failure(file, MSG_ORIG(MSG_ELF_GETSHDRSTRNDX));
4912		return (ret);
4913	}
4914
4915	if (elf_getphdrnum(elf, &phnum) == -1) {
4916		failure(file, MSG_ORIG(MSG_ELF_GETPHDRNUM));
4917		return (ret);
4918	}
4919	/*
4920	 * If the user requested section headers derived from the
4921	 * program headers (-P option) and this file doesn't have
4922	 * any program headers (i.e. ET_REL), then we can't do it.
4923	 */
4924	if ((phnum == 0) && (flags & FLG_CTL_FAKESHDR)) {
4925		(void) fprintf(stderr, MSG_INTL(MSG_ERR_PNEEDSPH), file);
4926		return (ret);
4927	}
4928
4929
4930	if ((scn = elf_getscn(elf, 0)) != NULL) {
4931		if ((shdr = elf_getshdr(scn)) == NULL) {
4932			failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
4933			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN), 0);
4934			return (ret);
4935		}
4936	} else
4937		shdr = NULL;
4938
4939	/*
4940	 * Print the elf header.
4941	 */
4942	if (flags & FLG_SHOW_EHDR)
4943		Elf_ehdr(0, ehdr, shdr);
4944
4945	/*
4946	 * If the section headers or program headers have inadequate
4947	 * alignment for the class of object, print a warning. libelf
4948	 * can handle such files, but programs that use them can crash
4949	 * when they dereference unaligned items.
4950	 *
4951	 * Note that the AMD64 ABI, although it is a 64-bit architecture,
4952	 * allows access to data types smaller than 128-bits to be on
4953	 * word alignment.
4954	 */
4955	if (ehdr->e_machine == EM_AMD64)
4956		addr_align = sizeof (Word);
4957	else
4958		addr_align = sizeof (Addr);
4959
4960	if (ehdr->e_phoff & (addr_align - 1))
4961		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADPHDRALIGN), file);
4962	if (ehdr->e_shoff & (addr_align - 1))
4963		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHDRALIGN), file);
4964
4965
4966	/*
4967	 * Determine the Operating System ABI (osabi) we will use to
4968	 * interpret the object.
4969	 */
4970	if (flags & FLG_CTL_OSABI) {
4971		/*
4972		 * If the user explicitly specifies '-O none', we need
4973		 * to display a completely generic view of the file.
4974		 * However, libconv is written to assume that ELFOSABI_NONE
4975		 * is equivalent to ELFOSABI_SOLARIS. To get the desired
4976		 * effect, we use an osabi that libconv has no knowledge of.
4977		 */
4978		if (osabi == ELFOSABI_NONE)
4979			osabi = ELFOSABI_UNKNOWN4;
4980	} else {
4981		/* Determine osabi from file */
4982		osabi = ehdr->e_ident[EI_OSABI];
4983		if (osabi == ELFOSABI_NONE) {
4984			/*
4985			 * Chicken/Egg scenario:
4986			 *
4987			 * Ideally, we wait to create the section header cache
4988			 * until after the program headers are printed. If we
4989			 * only output program headers, we can skip building
4990			 * the cache entirely.
4991			 *
4992			 * Proper interpretation of program headers requires
4993			 * the osabi, which is supposed to be in the ELF header.
4994			 * However, many systems (Solaris and Linux included)
4995			 * have a history of setting the osabi to the generic
4996			 * SysV ABI (ELFOSABI_NONE). We assume ELFOSABI_SOLARIS
4997			 * in such cases, but would like to check the object
4998			 * to see if it has a Linux .note.ABI-tag section,
4999			 * which implies ELFOSABI_LINUX. This requires a
5000			 * section header cache.
5001			 *
5002			 * To break the cycle, we create section headers now
5003			 * if osabi is ELFOSABI_NONE, and later otherwise.
5004			 * If it succeeds, we use them, if not, we defer
5005			 * exiting until after the program headers are out.
5006			 */
5007			if (create_cache(file, fd, elf, ehdr, &cache,
5008			    shstrndx, &shnum, &flags) == 0) {
5009				cache_state = CACHE_FAIL;
5010			} else {
5011				cache_state = CACHE_OK;
5012				if (has_linux_abi_note(cache, shnum, file)) {
5013					Conv_inv_buf_t	ibuf1, ibuf2;
5014
5015					(void) fprintf(stderr,
5016					    MSG_INTL(MSG_INFO_LINUXOSABI), file,
5017					    conv_ehdr_osabi(osabi, 0, &ibuf1),
5018					    conv_ehdr_osabi(ELFOSABI_LINUX,
5019					    0, &ibuf2));
5020					osabi = ELFOSABI_LINUX;
5021				}
5022			}
5023		}
5024		/*
5025		 * We treat ELFOSABI_NONE identically to ELFOSABI_SOLARIS.
5026		 * Mapping NONE to SOLARIS simplifies the required test.
5027		 */
5028		if (osabi == ELFOSABI_NONE)
5029			osabi = ELFOSABI_SOLARIS;
5030	}
5031
5032	/*
5033	 * Print the program headers.
5034	 */
5035	if ((flags & FLG_SHOW_PHDR) && (phnum != 0)) {
5036		Phdr	*phdr;
5037
5038		if ((phdr = elf_getphdr(elf)) == NULL) {
5039			failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
5040			return (ret);
5041		}
5042
5043		for (ndx = 0; ndx < phnum; phdr++, ndx++) {
5044			if (!match(MATCH_F_PHDR| MATCH_F_NDX | MATCH_F_TYPE,
5045			    NULL, ndx, phdr->p_type))
5046				continue;
5047
5048			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
5049			dbg_print(0, MSG_INTL(MSG_ELF_PHDR), EC_WORD(ndx));
5050			Elf_phdr(0, osabi, ehdr->e_machine, phdr);
5051		}
5052	}
5053
5054	/*
5055	 * If we have flag bits set that explicitly require a show or calc
5056	 * operation, but none of them require the section headers, then
5057	 * we are done and can return now.
5058	 */
5059	if (((flags & (FLG_MASK_SHOW | FLG_MASK_CALC)) != 0) &&
5060	    ((flags & (FLG_MASK_SHOW_SHDR | FLG_MASK_CALC_SHDR)) == 0))
5061		return (ret);
5062
5063	/*
5064	 * Everything from this point on requires section headers.
5065	 * If we have no section headers, there is no reason to continue.
5066	 *
5067	 * If we tried above to create the section header cache and failed,
5068	 * it is time to exit. Otherwise, create it if needed.
5069	 */
5070	switch (cache_state) {
5071	case CACHE_NEEDED:
5072		if (create_cache(file, fd, elf, ehdr, &cache, shstrndx,
5073		    &shnum, &flags) == 0)
5074			return (ret);
5075		break;
5076	case CACHE_OK:
5077		break;
5078	case CACHE_FAIL:
5079		return (ret);
5080	}
5081	if (shnum <= 1)
5082		goto done;
5083
5084	/*
5085	 * If -w was specified, find and write out the section(s) data.
5086	 */
5087	if (wfd) {
5088		for (ndx = 1; ndx < shnum; ndx++) {
5089			Cache	*_cache = &cache[ndx];
5090
5091			if (match(MATCH_F_STRICT | MATCH_F_ALL, _cache->c_name,
5092			    ndx, _cache->c_shdr->sh_type) &&
5093			    _cache->c_data && _cache->c_data->d_buf) {
5094				if (write(wfd, _cache->c_data->d_buf,
5095				    _cache->c_data->d_size) !=
5096				    _cache->c_data->d_size) {
5097					int err = errno;
5098					(void) fprintf(stderr,
5099					    MSG_INTL(MSG_ERR_WRITE), wname,
5100					    strerror(err));
5101					/*
5102					 * Return an exit status of 1, because
5103					 * the failure is not related to the
5104					 * ELF file, but by system resources.
5105					 */
5106					ret = 1;
5107					goto done;
5108				}
5109			}
5110		}
5111	}
5112
5113	/*
5114	 * If we have no flag bits set that explicitly require a show or calc
5115	 * operation, but match options (-I, -N, -T) were used, then run
5116	 * through the section headers and see if we can't deduce show flags
5117	 * from the match options given.
5118	 *
5119	 * We don't do this if -w was specified, because (-I, -N, -T) used
5120	 * with -w in lieu of some other option is supposed to be quiet.
5121	 */
5122	if ((wfd == 0) && (flags & FLG_CTL_MATCH) &&
5123	    ((flags & (FLG_MASK_SHOW | FLG_MASK_CALC)) == 0)) {
5124		for (ndx = 1; ndx < shnum; ndx++) {
5125			Cache	*_cache = &cache[ndx];
5126
5127			if (!match(MATCH_F_STRICT | MATCH_F_ALL, _cache->c_name,
5128			    ndx, _cache->c_shdr->sh_type))
5129				continue;
5130
5131			switch (_cache->c_shdr->sh_type) {
5132			case SHT_PROGBITS:
5133				/*
5134				 * Heuristic time: It is usually bad form
5135				 * to assume the meaning/format of a PROGBITS
5136				 * section based on its name. However, there
5137				 * are ABI mandated exceptions. Check for
5138				 * these special names.
5139				 */
5140
5141				/* The ELF ABI specifies .interp and .got */
5142				if (strcmp(_cache->c_name,
5143				    MSG_ORIG(MSG_ELF_INTERP)) == 0) {
5144					flags |= FLG_SHOW_INTERP;
5145					break;
5146				}
5147				if (strcmp(_cache->c_name,
5148				    MSG_ORIG(MSG_ELF_GOT)) == 0) {
5149					flags |= FLG_SHOW_GOT;
5150					break;
5151				}
5152				/*
5153				 * The GNU compilers, and amd64 ABI, define
5154				 * .eh_frame and .eh_frame_hdr. The Sun
5155				 * C++ ABI defines .exception_ranges.
5156				 */
5157				if ((strncmp(_cache->c_name,
5158				    MSG_ORIG(MSG_SCN_FRM),
5159				    MSG_SCN_FRM_SIZE) == 0) ||
5160				    (strncmp(_cache->c_name,
5161				    MSG_ORIG(MSG_SCN_EXRANGE),
5162				    MSG_SCN_EXRANGE_SIZE) == 0)) {
5163					flags |= FLG_SHOW_UNWIND;
5164					break;
5165				}
5166				break;
5167
5168			case SHT_SYMTAB:
5169			case SHT_DYNSYM:
5170			case SHT_SUNW_LDYNSYM:
5171			case SHT_SUNW_versym:
5172			case SHT_SYMTAB_SHNDX:
5173				flags |= FLG_SHOW_SYMBOLS;
5174				break;
5175
5176			case SHT_RELA:
5177			case SHT_REL:
5178				flags |= FLG_SHOW_RELOC;
5179				break;
5180
5181			case SHT_HASH:
5182				flags |= FLG_SHOW_HASH;
5183				break;
5184
5185			case SHT_DYNAMIC:
5186				flags |= FLG_SHOW_DYNAMIC;
5187				break;
5188
5189			case SHT_NOTE:
5190				flags |= FLG_SHOW_NOTE;
5191				break;
5192
5193			case SHT_GROUP:
5194				flags |= FLG_SHOW_GROUP;
5195				break;
5196
5197			case SHT_SUNW_symsort:
5198			case SHT_SUNW_tlssort:
5199				flags |= FLG_SHOW_SORT;
5200				break;
5201
5202			case SHT_SUNW_cap:
5203				flags |= FLG_SHOW_CAP;
5204				break;
5205
5206			case SHT_SUNW_move:
5207				flags |= FLG_SHOW_MOVE;
5208				break;
5209
5210			case SHT_SUNW_syminfo:
5211				flags |= FLG_SHOW_SYMINFO;
5212				break;
5213
5214			case SHT_SUNW_verdef:
5215			case SHT_SUNW_verneed:
5216				flags |= FLG_SHOW_VERSIONS;
5217				break;
5218
5219			case SHT_AMD64_UNWIND:
5220				flags |= FLG_SHOW_UNWIND;
5221				break;
5222			}
5223		}
5224	}
5225
5226
5227	if (flags & FLG_SHOW_SHDR)
5228		sections(file, cache, shnum, ehdr, osabi);
5229
5230	if (flags & FLG_SHOW_INTERP)
5231		interp(file, cache, shnum, phnum, elf);
5232
5233	if ((osabi == ELFOSABI_SOLARIS) || (osabi == ELFOSABI_LINUX))
5234		versions(cache, shnum, file, flags, &versym);
5235
5236	if (flags & FLG_SHOW_SYMBOLS)
5237		symbols(cache, shnum, ehdr, osabi, &versym, file, flags);
5238
5239	if ((flags & FLG_SHOW_SORT) && (osabi == ELFOSABI_SOLARIS))
5240		sunw_sort(cache, shnum, ehdr, osabi, &versym, file, flags);
5241
5242	if (flags & FLG_SHOW_HASH)
5243		hash(cache, shnum, file, flags);
5244
5245	if (flags & FLG_SHOW_GOT)
5246		got(cache, shnum, ehdr, file);
5247
5248	if (flags & FLG_SHOW_GROUP)
5249		group(cache, shnum, file, flags);
5250
5251	if (flags & FLG_SHOW_SYMINFO)
5252		syminfo(cache, shnum, ehdr, osabi, file);
5253
5254	if (flags & FLG_SHOW_RELOC)
5255		reloc(cache, shnum, ehdr, file);
5256
5257	if (flags & FLG_SHOW_DYNAMIC)
5258		dynamic(cache, shnum, ehdr, osabi, file);
5259
5260	if (flags & FLG_SHOW_NOTE) {
5261		Word	note_cnt;
5262		size_t	note_shnum;
5263		Cache	*note_cache;
5264
5265		note_cnt = note(cache, shnum, ehdr, file);
5266
5267		/*
5268		 * Solaris core files have section headers, but these
5269		 * headers do not include SHT_NOTE sections that reference
5270		 * the core note sections. This means that note() won't
5271		 * find the core notes. Fake section headers (-P option)
5272		 * recover these sections, but it is inconvenient to require
5273		 * users to specify -P in this situation. If the following
5274		 * are all true:
5275		 *
5276		 *	- No note sections were found
5277		 *	- This is a core file
5278		 *	- We are not already using fake section headers
5279		 *
5280		 * then we will automatically generate fake section headers
5281		 * and then process them in a second call to note().
5282		 */
5283		if ((note_cnt == 0) && (ehdr->e_type == ET_CORE) &&
5284		    !(flags & FLG_CTL_FAKESHDR) &&
5285		    (fake_shdr_cache(file, fd, elf, ehdr,
5286		    &note_cache, &note_shnum) != 0)) {
5287			(void) note(note_cache, note_shnum, ehdr, file);
5288			fake_shdr_cache_free(note_cache, note_shnum);
5289		}
5290	}
5291
5292	if ((flags & FLG_SHOW_MOVE) && (osabi == ELFOSABI_SOLARIS))
5293		move(cache, shnum, file, flags);
5294
5295	if (flags & FLG_CALC_CHECKSUM)
5296		checksum(elf);
5297
5298	if ((flags & FLG_SHOW_CAP) && (osabi == ELFOSABI_SOLARIS))
5299		cap(file, cache, shnum, phnum, ehdr, osabi, elf, flags);
5300
5301	if ((flags & FLG_SHOW_UNWIND) &&
5302	    ((osabi == ELFOSABI_SOLARIS) || (osabi == ELFOSABI_LINUX)))
5303		unwind(cache, shnum, phnum, ehdr, osabi, file, elf, flags);
5304
5305
5306	/* Release the memory used to cache section headers */
5307done:
5308	if (flags & FLG_CTL_FAKESHDR)
5309		fake_shdr_cache_free(cache, shnum);
5310	else
5311		free(cache);
5312
5313	return (ret);
5314}
5315