1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  * Copyright (c) 2015, Joyent, Inc. All rights reserved.
29  */
30 
31 /*
32  * Dump an elf file.
33  */
34 #include	<stddef.h>
35 #include	<sys/elf_386.h>
36 #include	<sys/elf_amd64.h>
37 #include	<sys/elf_SPARC.h>
38 #include	<_libelf.h>
39 #include	<dwarf.h>
40 #include	<stdio.h>
41 #include	<unistd.h>
42 #include	<errno.h>
43 #include	<strings.h>
44 #include	<debug.h>
45 #include	<conv.h>
46 #include	<msg.h>
47 #include	<_elfdump.h>
48 
49 
50 /*
51  * VERSYM_STATE is used to maintain information about the VERSYM section
52  * in the object being analyzed. It is filled in by versions(), and used
53  * by init_symtbl_state() when displaying symbol information.
54  *
55  * There are three forms of symbol versioning known to us:
56  *
57  * 1) The original form, introduced with Solaris 2.5, in which
58  *	the Versym contains indexes to Verdef records, and the
59  *	Versym values for UNDEF symbols resolved by other objects
60  *	are all set to 0.
61  * 2) The GNU form, which is backward compatible with the original
62  *	Solaris form, but which adds several extensions:
63  *	- The Versym also contains indexes to Verneed records, recording
64  *		which object/version contributed the external symbol at
65  *		link time. These indexes start with the next value following
66  *		the final Verdef index. The index is written to the previously
67  *		reserved vna_other field of the ELF Vernaux structure.
68  *	- The top bit of the Versym value is no longer part of the index,
69  *		but is used as a "hidden bit" to prevent binding to the symbol.
70  *	- Multiple implementations of a given symbol, contained in varying
71  *		versions are allowed, using special assembler pseudo ops,
72  *		and encoded in the symbol name using '@' characters.
73  * 3) Modified Solaris form, in which we adopt the first GNU extension
74  *	(Versym indexes to Verneed records), but not the others.
75  *
76  * elfdump can handle any of these cases. The presence of a DT_VERSYM
77  * dynamic element indicates a full GNU object. An object that lacks
78  * a DT_VERSYM entry, but which has non-zero vna_other fields in the Vernaux
79  * structures is a modified Solaris object. An object that has neither of
80  * these uses the original form.
81  *
82  * max_verndx contains the largest version index that can appear
83  * in a Versym entry. This can never be less than 1: In the case where
84  * there is no verdef/verneed sections, the [0] index is reserved
85  * for local symbols, and the [1] index for globals. If the original
86  * Solaris versioning rules are in effect and there is a verdef section,
87  * then max_verndex is the number of defined versions. If one of the
88  * other versioning forms is in effect, then:
89  *	1) If there is no verneed section, it is the same as for
90  *		original Solaris versioning.
91  *	2) If there is a verneed section, the vna_other field of the
92  *		Vernaux structs contain versions, and max_verndx is the
93  *		largest such index.
94  *
95  * If gnu_full is True, the object uses the full GNU form of versioning.
96  * The value of the gnu_full field is based on the presence of
97  * a DT_VERSYM entry in the dynamic section: GNU ld produces these, and
98  * Solaris ld does not.
99  *
100  * The gnu_needed field is True if the Versym contains indexes to
101  * Verneed records, as indicated by non-zero vna_other fields in the Verneed
102  * section. If gnu_full is True, then gnu_needed will always be true.
103  * However, gnu_needed can be true without gnu_full. This is the modified
104  * Solaris form.
105  */
106 typedef struct {
107 	Cache	*cache;		/* Pointer to cache entry for VERSYM */
108 	Versym	*data;		/* Pointer to versym array */
109 	int	gnu_full;	/* True if object uses GNU versioning rules */
110 	int	gnu_needed;	/* True if object uses VERSYM indexes for */
111 				/*	VERNEED (subset of gnu_full) */
112 	int	max_verndx;	/* largest versym index value */
113 } VERSYM_STATE;
114 
115 /*
116  * SYMTBL_STATE is used to maintain information about a single symbol
117  * table section, for use by the routines that display symbol information.
118  */
119 typedef struct {
120 	const char	*file;		/* Name of file */
121 	Ehdr		*ehdr;		/* ELF header for file */
122 	Cache		*cache;		/* Cache of all section headers */
123 	uchar_t		osabi;		/* OSABI to use */
124 	Word		shnum;		/* # of sections in cache */
125 	Cache		*seccache;	/* Cache of symbol table section hdr */
126 	Word		secndx;		/* Index of symbol table section hdr */
127 	const char	*secname;	/* Name of section */
128 	uint_t		flags;		/* Command line option flags */
129 	struct {			/* Extended section index data */
130 		int	checked;	/* TRUE if already checked for shxndx */
131 		Word	*data;		/* NULL, or extended section index */
132 					/*	used for symbol table entries */
133 		uint_t	n;		/* # items in shxndx.data */
134 	} shxndx;
135 	VERSYM_STATE	*versym;	/* NULL, or associated VERSYM section */
136 	Sym 		*sym;		/* Array of symbols */
137 	Word		symn;		/* # of symbols */
138 } SYMTBL_STATE;
139 
140 /*
141  * A variable of this type is used to track information related to
142  * .eh_frame and .eh_frame_hdr sections across calls to unwind_eh_frame().
143  */
144 typedef struct {
145 	Word		frame_cnt;	/* # .eh_frame sections seen */
146 	Word		frame_ndx;	/* Section index of 1st .eh_frame */
147 	Word		hdr_cnt;	/* # .eh_frame_hdr sections seen */
148 	Word		hdr_ndx;	/* Section index of 1st .eh_frame_hdr */
149 	uint64_t	frame_ptr;	/* Value of FramePtr field from first */
150 					/*	.eh_frame_hdr section */
151 	uint64_t	frame_base;	/* Data addr of 1st .eh_frame  */
152 } gnu_eh_state_t;
153 
154 /*
155  * C++ .exception_ranges entries make use of the signed ptrdiff_t
156  * type to record self-relative pointer values. We need a type
157  * for this that is matched to the ELFCLASS being processed.
158  */
159 #if	defined(_ELF64)
160 	typedef int64_t PTRDIFF_T;
161 #else
162 	typedef int32_t PTRDIFF_T;
163 #endif
164 
165 /*
166  * The Sun C++ ABI uses this struct to define each .exception_ranges
167  * entry. From the ABI:
168  *
169  * The field ret_addr is a self relative pointer to the start of the address
170  * range. The name was chosen because in the current implementation the range
171  * typically starts at the return address for a call site.
172  *
173  * The field length is the difference, in bytes, between the pc of the last
174  * instruction covered by the exception range and the first. When only a
175  * single call site is represented without optimization, this will equal zero.
176  *
177  * The field handler_addr is a relative pointer which stores the difference
178  * between the start of the exception range and the address of all code to
179  * catch exceptions and perform the cleanup for stack unwinding.
180  *
181  * The field type_block is a relative pointer which stores the difference
182  * between the start of the exception range and the address of an array used
183  * for storing a list of the types of exceptions which can be caught within
184  * the exception range.
185  */
186 typedef struct {
187 	PTRDIFF_T	ret_addr;
188 	Xword		length;
189 	PTRDIFF_T	handler_addr;
190 	PTRDIFF_T	type_block;
191 	Xword		reserved;
192 } exception_range_entry;
193 
194 /*
195  * Focal point for verifying symbol names.
196  */
197 static const char *
string(Cache * refsec,Word ndx,Cache * strsec,const char * file,Word name)198 string(Cache *refsec, Word ndx, Cache *strsec, const char *file, Word name)
199 {
200 	/*
201 	 * If an error in this routine is due to a property of the string
202 	 * section, as opposed to a bad offset into the section (a property of
203 	 * the referencing section), then we will detect the same error on
204 	 * every call involving those sections. We use these static variables
205 	 * to retain the information needed to only issue each such error once.
206 	 */
207 	static Cache	*last_refsec;	/* Last referencing section seen */
208 	static int	strsec_err;	/* True if error issued */
209 
210 	const char	*strs;
211 	Word		strn;
212 
213 	if ((strsec->c_data == NULL) || (strsec->c_data->d_buf == NULL))
214 		return (NULL);
215 
216 	strs = (char *)strsec->c_data->d_buf;
217 	strn = strsec->c_data->d_size;
218 
219 	/*
220 	 * We only print a diagnostic regarding a bad string table once per
221 	 * input section being processed. If the refsec has changed, reset
222 	 * our retained error state.
223 	 */
224 	if (last_refsec != refsec) {
225 		last_refsec = refsec;
226 		strsec_err = 0;
227 	}
228 
229 	/* Verify that strsec really is a string table */
230 	if (strsec->c_shdr->sh_type != SHT_STRTAB) {
231 		if (!strsec_err) {
232 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOTSTRTAB),
233 			    file, strsec->c_ndx, refsec->c_ndx);
234 			strsec_err = 1;
235 		}
236 		return (MSG_INTL(MSG_STR_UNKNOWN));
237 	}
238 
239 	/*
240 	 * Is the string table offset within range of the available strings?
241 	 */
242 	if (name >= strn) {
243 		/*
244 		 * Do we have a empty string table?
245 		 */
246 		if (strs == NULL) {
247 			if (!strsec_err) {
248 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
249 				    file, strsec->c_name);
250 				strsec_err = 1;
251 			}
252 		} else {
253 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSTOFF),
254 			    file, refsec->c_name, EC_WORD(ndx), strsec->c_name,
255 			    EC_WORD(name), EC_WORD(strn - 1));
256 		}
257 
258 		/*
259 		 * Return the empty string so that the calling function can
260 		 * continue it's output diagnostics.
261 		 */
262 		return (MSG_INTL(MSG_STR_UNKNOWN));
263 	}
264 	return (strs + name);
265 }
266 
267 /*
268  * Relocations can reference section symbols and standard symbols.  If the
269  * former, establish the section name.
270  */
271 static const char *
relsymname(Cache * cache,Cache * csec,Cache * strsec,Word symndx,Word symnum,Word relndx,Sym * syms,char * secstr,size_t secsz,const char * file)272 relsymname(Cache *cache, Cache *csec, Cache *strsec, Word symndx, Word symnum,
273     Word relndx, Sym *syms, char *secstr, size_t secsz, const char *file)
274 {
275 	Sym		*sym;
276 	const char	*name;
277 
278 	if (symndx >= symnum) {
279 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_RELBADSYMNDX),
280 		    file, EC_WORD(symndx), EC_WORD(relndx));
281 		return (MSG_INTL(MSG_STR_UNKNOWN));
282 	}
283 
284 	sym = (Sym *)(syms + symndx);
285 	name = string(csec, symndx, strsec, file, sym->st_name);
286 
287 	/*
288 	 * If the symbol represents a section offset construct an appropriate
289 	 * string.  Note, although section symbol table entries typically have
290 	 * a NULL name pointer, entries do exist that point into the string
291 	 * table to their own NULL strings.
292 	 */
293 	if ((ELF_ST_TYPE(sym->st_info) == STT_SECTION) &&
294 	    ((sym->st_name == 0) || (*name == '\0'))) {
295 		(void) snprintf(secstr, secsz, MSG_INTL(MSG_STR_SECTION),
296 		    cache[sym->st_shndx].c_name);
297 		return ((const char *)secstr);
298 	}
299 
300 	return (name);
301 }
302 
303 /*
304  * Focal point for establishing a string table section.  Data such as the
305  * dynamic information simply points to a string table.  Data such as
306  * relocations, reference a symbol table, which in turn is associated with a
307  * string table.
308  */
309 static int
stringtbl(Cache * cache,int symtab,Word ndx,Word shnum,const char * file,Word * symnum,Cache ** symsec,Cache ** strsec)310 stringtbl(Cache *cache, int symtab, Word ndx, Word shnum, const char *file,
311     Word *symnum, Cache **symsec, Cache **strsec)
312 {
313 	Shdr	*shdr = cache[ndx].c_shdr;
314 
315 	/*
316 	 * If symtab is non-zero, the ndx we are called with represents a
317 	 * shdr which links to a symbol table (which then links to a string
318 	 * table)
319 	 */
320 	if (symtab != 0) {
321 		/*
322 		 * Validate the symbol table linkage.
323 		 */
324 		if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
325 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
326 			    file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
327 			return (0);
328 		}
329 
330 		/*
331 		 * Establish the symbol table index.
332 		 */
333 		ndx = shdr->sh_link;
334 		shdr = cache[ndx].c_shdr;
335 
336 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
337 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
338 			    file, cache[ndx].c_name);
339 			return (0);
340 		}
341 
342 		/*
343 		 * Obtain, and verify the symbol table data.
344 		 */
345 		if ((cache[ndx].c_data == NULL) ||
346 		    (cache[ndx].c_data->d_buf == NULL)) {
347 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
348 			    file, cache[ndx].c_name);
349 			return (0);
350 		}
351 
352 		/*
353 		 * Return symbol table information.
354 		 */
355 		if (symnum)
356 			*symnum = (shdr->sh_size / shdr->sh_entsize);
357 		if (symsec)
358 			*symsec = &cache[ndx];
359 	}
360 
361 	/*
362 	 * Validate the string table linkage.
363 	 */
364 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
365 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
366 		    file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
367 		return (0);
368 	}
369 
370 	if (strsec)
371 		*strsec = &cache[shdr->sh_link];
372 
373 	return (1);
374 }
375 
376 /*
377  * Lookup a symbol and set Sym accordingly.
378  *
379  * entry:
380  *	name - Name of symbol to lookup
381  *	cache - Cache of all section headers
382  *	shnum - # of sections in cache
383  *	sym - Address of pointer to receive symbol
384  *	target - NULL, or section to which the symbol must be associated.
385  *	symtab - Symbol table to search for symbol
386  *	file - Name of file
387  *
388  * exit:
389  *	If the symbol is found, *sym is set to reference it, and True is
390  *	returned. If target is non-NULL, the symbol must reference the given
391  *	section --- otherwise the section is not checked.
392  *
393  *	If no symbol is found, False is returned.
394  */
395 static int
symlookup(const char * name,Cache * cache,Word shnum,Sym ** sym,Cache * target,Cache * symtab,const char * file)396 symlookup(const char *name, Cache *cache, Word shnum, Sym **sym,
397     Cache *target, Cache *symtab, const char *file)
398 {
399 	Shdr	*shdr;
400 	Word	symn, cnt;
401 	Sym	*syms;
402 
403 	if (symtab == 0)
404 		return (0);
405 
406 	shdr = symtab->c_shdr;
407 
408 	/*
409 	 * Determine the symbol data and number.
410 	 */
411 	if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
412 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
413 		    file, symtab->c_name);
414 		return (0);
415 	}
416 	if ((symtab->c_data == NULL) || (symtab->c_data->d_buf == NULL))
417 		return (0);
418 
419 	/* LINTED */
420 	symn = (Word)(shdr->sh_size / shdr->sh_entsize);
421 	syms = (Sym *)symtab->c_data->d_buf;
422 
423 	/*
424 	 * Get the associated string table section.
425 	 */
426 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
427 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
428 		    file, symtab->c_name, EC_WORD(shdr->sh_link));
429 		return (0);
430 	}
431 
432 	/*
433 	 * Loop through the symbol table to find a match.
434 	 */
435 	*sym = NULL;
436 	for (cnt = 0; cnt < symn; syms++, cnt++) {
437 		const char	*symname;
438 
439 		symname = string(symtab, cnt, &cache[shdr->sh_link], file,
440 		    syms->st_name);
441 
442 		if (symname && (strcmp(name, symname) == 0) &&
443 		    ((target == NULL) || (target->c_ndx == syms->st_shndx))) {
444 			/*
445 			 * It is possible, though rare, for a local and
446 			 * global symbol of the same name to exist, each
447 			 * contributed by a different input object. If the
448 			 * symbol just found is local, remember it, but
449 			 * continue looking.
450 			 */
451 			*sym = syms;
452 			if (ELF_ST_BIND(syms->st_info) != STB_LOCAL)
453 				break;
454 		}
455 	}
456 
457 	return (*sym != NULL);
458 }
459 
460 /*
461  * Print section headers.
462  */
463 static void
sections(const char * file,Cache * cache,Word shnum,Ehdr * ehdr,uchar_t osabi)464 sections(const char *file, Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi)
465 {
466 	size_t	seccnt;
467 
468 	for (seccnt = 1; seccnt < shnum; seccnt++) {
469 		Cache		*_cache = &cache[seccnt];
470 		Shdr		*shdr = _cache->c_shdr;
471 		const char	*secname = _cache->c_name;
472 
473 		/*
474 		 * Although numerous section header entries can be zero, it's
475 		 * usually a sign of trouble if the type is zero.
476 		 */
477 		if (shdr->sh_type == 0) {
478 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHTYPE),
479 			    file, secname, EC_WORD(shdr->sh_type));
480 		}
481 
482 		if (!match(MATCH_F_ALL, secname, seccnt, shdr->sh_type))
483 			continue;
484 
485 		/*
486 		 * Identify any sections that are suspicious.  A .got section
487 		 * shouldn't exist in a relocatable object.
488 		 */
489 		if (ehdr->e_type == ET_REL) {
490 			if (strncmp(secname, MSG_ORIG(MSG_ELF_GOT),
491 			    MSG_ELF_GOT_SIZE) == 0) {
492 				(void) fprintf(stderr,
493 				    MSG_INTL(MSG_GOT_UNEXPECTED), file,
494 				    secname);
495 			}
496 		}
497 
498 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
499 		dbg_print(0, MSG_INTL(MSG_ELF_SHDR), EC_WORD(seccnt), secname);
500 		Elf_shdr(0, osabi, ehdr->e_machine, shdr);
501 	}
502 }
503 
504 /*
505  * Obtain a specified Phdr entry.
506  */
507 static Phdr *
getphdr(Word phnum,Word * type_arr,Word type_cnt,const char * file,Elf * elf)508 getphdr(Word phnum, Word *type_arr, Word type_cnt, const char *file, Elf *elf)
509 {
510 	Word	cnt, tcnt;
511 	Phdr	*phdr;
512 
513 	if ((phdr = elf_getphdr(elf)) == NULL) {
514 		failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
515 		return (NULL);
516 	}
517 
518 	for (cnt = 0; cnt < phnum; phdr++, cnt++) {
519 		for (tcnt = 0; tcnt < type_cnt; tcnt++) {
520 			if (phdr->p_type == type_arr[tcnt])
521 				return (phdr);
522 		}
523 	}
524 	return (NULL);
525 }
526 
527 /*
528  * Display the contents of GNU/amd64 .eh_frame and .eh_frame_hdr
529  * sections.
530  *
531  * entry:
532  *	cache - Cache of all section headers
533  *	shndx - Index of .eh_frame or .eh_frame_hdr section to be displayed
534  *	shnum - Total number of sections which exist
535  *	uphdr - NULL, or unwind program header associated with
536  *		the .eh_frame_hdr section.
537  *	ehdr - ELF header for file
538  *	eh_state - Data used across calls to this routine. The
539  *		caller should zero it before the first call, and
540  *		pass it on every call.
541  *	osabi - OSABI to use in displaying information
542  *	file - Name of file
543  *	flags - Command line option flags
544  */
545 static void
unwind_eh_frame(Cache * cache,Word shndx,Word shnum,Phdr * uphdr,Ehdr * ehdr,gnu_eh_state_t * eh_state,uchar_t osabi,const char * file,uint_t flags)546 unwind_eh_frame(Cache *cache, Word shndx, Word shnum, Phdr *uphdr, Ehdr *ehdr,
547     gnu_eh_state_t *eh_state, uchar_t osabi, const char *file, uint_t flags)
548 {
549 #if	defined(_ELF64)
550 #define	MSG_UNW_BINSRTAB2	MSG_UNW_BINSRTAB2_64
551 #define	MSG_UNW_BINSRTABENT	MSG_UNW_BINSRTABENT_64
552 #else
553 #define	MSG_UNW_BINSRTAB2	MSG_UNW_BINSRTAB2_32
554 #define	MSG_UNW_BINSRTABENT	MSG_UNW_BINSRTABENT_32
555 #endif
556 
557 	Cache			*_cache = &cache[shndx];
558 	Shdr			*shdr = _cache->c_shdr;
559 	uchar_t			*data = (uchar_t *)(_cache->c_data->d_buf);
560 	size_t			datasize = _cache->c_data->d_size;
561 	Conv_dwarf_ehe_buf_t	dwarf_ehe_buf;
562 	uint64_t		ndx, frame_ptr, fde_cnt, tabndx;
563 	uint_t			vers, frame_ptr_enc, fde_cnt_enc, table_enc;
564 	uint64_t		initloc, initloc0 = 0;
565 	uint64_t		gotaddr = 0;
566 	int			cnt;
567 
568 	for (cnt = 1; cnt < shnum; cnt++) {
569 		if (strncmp(cache[cnt].c_name, MSG_ORIG(MSG_ELF_GOT),
570 		    MSG_ELF_GOT_SIZE) == 0) {
571 			gotaddr = cache[cnt].c_shdr->sh_addr;
572 			break;
573 		}
574 	}
575 
576 	if ((data == NULL) || (datasize == 0)) {
577 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
578 		    file, _cache ->c_name);
579 		return;
580 	}
581 
582 	/*
583 	 * Is this a .eh_frame_hdr?
584 	 */
585 	if ((uphdr && (shdr->sh_addr == uphdr->p_vaddr)) ||
586 	    (strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRMHDR),
587 	    MSG_SCN_FRMHDR_SIZE) == 0)) {
588 		/*
589 		 * There can only be a single .eh_frame_hdr.
590 		 * Flag duplicates.
591 		 */
592 		if (++eh_state->hdr_cnt > 1)
593 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_MULTEHFRMHDR),
594 			    file, EC_WORD(shndx), _cache->c_name);
595 
596 		dbg_print(0, MSG_ORIG(MSG_UNW_FRMHDR));
597 		ndx = 0;
598 
599 		vers = data[ndx++];
600 		frame_ptr_enc = data[ndx++];
601 		fde_cnt_enc = data[ndx++];
602 		table_enc = data[ndx++];
603 
604 		dbg_print(0, MSG_ORIG(MSG_UNW_FRMVERS), vers);
605 
606 		switch (dwarf_ehe_extract(data, datasize, &ndx,
607 		    &frame_ptr, frame_ptr_enc, ehdr->e_ident, B_TRUE,
608 		    shdr->sh_addr, ndx, gotaddr)) {
609 		case DW_OVERFLOW:
610 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWOVRFLW),
611 			    file, _cache->c_name);
612 			return;
613 		case DW_BAD_ENCODING:
614 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWBADENC),
615 			    file, _cache->c_name, frame_ptr_enc);
616 			return;
617 		case DW_SUCCESS:
618 			break;
619 		}
620 		if (eh_state->hdr_cnt == 1) {
621 			eh_state->hdr_ndx = shndx;
622 			eh_state->frame_ptr = frame_ptr;
623 		}
624 
625 		dbg_print(0, MSG_ORIG(MSG_UNW_FRPTRENC),
626 		    conv_dwarf_ehe(frame_ptr_enc, &dwarf_ehe_buf),
627 		    EC_XWORD(frame_ptr));
628 
629 		switch (dwarf_ehe_extract(data, datasize, &ndx, &fde_cnt,
630 		    fde_cnt_enc, ehdr->e_ident, B_TRUE, shdr->sh_addr, ndx,
631 		    gotaddr)) {
632 		case DW_OVERFLOW:
633 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWOVRFLW),
634 			    file, _cache->c_name);
635 			return;
636 		case DW_BAD_ENCODING:
637 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWBADENC),
638 			    file, _cache->c_name, fde_cnt_enc);
639 			return;
640 		case DW_SUCCESS:
641 			break;
642 		}
643 
644 		dbg_print(0, MSG_ORIG(MSG_UNW_FDCNENC),
645 		    conv_dwarf_ehe(fde_cnt_enc, &dwarf_ehe_buf),
646 		    EC_XWORD(fde_cnt));
647 		dbg_print(0, MSG_ORIG(MSG_UNW_TABENC),
648 		    conv_dwarf_ehe(table_enc, &dwarf_ehe_buf));
649 		dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTAB1));
650 		dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTAB2));
651 
652 		for (tabndx = 0; tabndx < fde_cnt; tabndx++) {
653 			uint64_t table;
654 
655 			switch (dwarf_ehe_extract(data, datasize, &ndx,
656 			    &initloc, table_enc, ehdr->e_ident, B_TRUE,
657 			    shdr->sh_addr, ndx, gotaddr)) {
658 			case DW_OVERFLOW:
659 				(void) fprintf(stderr,
660 				    MSG_INTL(MSG_ERR_DWOVRFLW), file,
661 				    _cache->c_name);
662 				return;
663 			case DW_BAD_ENCODING:
664 				(void) fprintf(stderr,
665 				    MSG_INTL(MSG_ERR_DWBADENC), file,
666 				    _cache->c_name, table_enc);
667 				return;
668 			case DW_SUCCESS:
669 				break;
670 			}
671 			if ((tabndx != 0) && (initloc0 > initloc))
672 				(void) fprintf(stderr,
673 				    MSG_INTL(MSG_ERR_BADSORT), file,
674 				    _cache->c_name, EC_WORD(tabndx));
675 			switch (dwarf_ehe_extract(data, datasize, &ndx, &table,
676 			    table_enc, ehdr->e_ident, B_TRUE, shdr->sh_addr,
677 			    ndx, gotaddr)) {
678 			case DW_OVERFLOW:
679 				(void) fprintf(stderr,
680 				    MSG_INTL(MSG_ERR_DWOVRFLW), file,
681 				    _cache->c_name);
682 				return;
683 			case DW_BAD_ENCODING:
684 				(void) fprintf(stderr,
685 				    MSG_INTL(MSG_ERR_DWBADENC), file,
686 				    _cache->c_name, table_enc);
687 				return;
688 			case DW_SUCCESS:
689 				break;
690 			}
691 
692 			dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTABENT),
693 			    EC_XWORD(initloc),
694 			    EC_XWORD(table));
695 			initloc0 = initloc;
696 		}
697 	} else {		/* Display the .eh_frame section */
698 		eh_state->frame_cnt++;
699 		if (eh_state->frame_cnt == 1) {
700 			eh_state->frame_ndx = shndx;
701 			eh_state->frame_base = shdr->sh_addr;
702 		} else if ((eh_state->frame_cnt >  1) &&
703 		    (ehdr->e_type != ET_REL)) {
704 			Conv_inv_buf_t	inv_buf;
705 
706 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_MULTEHFRM),
707 			    file, EC_WORD(shndx), _cache->c_name,
708 			    conv_ehdr_type(osabi, ehdr->e_type, 0, &inv_buf));
709 		}
710 		dump_eh_frame(file, _cache->c_name, data, datasize,
711 		    shdr->sh_addr, ehdr->e_machine, ehdr->e_ident, gotaddr);
712 	}
713 
714 	/*
715 	 * If we've seen the .eh_frame_hdr and the first .eh_frame section,
716 	 * compare the header frame_ptr to the address of the actual frame
717 	 * section to ensure the link-editor got this right.  Note, this
718 	 * diagnostic is only produced when unwind information is explicitly
719 	 * asked for, as shared objects built with an older ld(1) may reveal
720 	 * this inconsistency.  Although an inconsistency, it doesn't seem to
721 	 * have any adverse effect on existing tools.
722 	 */
723 	if (((flags & FLG_MASK_SHOW) != FLG_MASK_SHOW) &&
724 	    (eh_state->hdr_cnt > 0) && (eh_state->frame_cnt > 0) &&
725 	    (eh_state->frame_ptr != eh_state->frame_base))
726 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADEHFRMPTR),
727 		    file, EC_WORD(eh_state->hdr_ndx),
728 		    cache[eh_state->hdr_ndx].c_name,
729 		    EC_XWORD(eh_state->frame_ptr),
730 		    EC_WORD(eh_state->frame_ndx),
731 		    cache[eh_state->frame_ndx].c_name,
732 		    EC_XWORD(eh_state->frame_base));
733 #undef MSG_UNW_BINSRTAB2
734 #undef MSG_UNW_BINSRTABENT
735 }
736 
737 /*
738  * Convert a self relative pointer into an address. A self relative
739  * pointer adds the address where the pointer resides to the offset
740  * contained in the pointer. The benefit is that the value of the
741  * pointer does not require relocation.
742  *
743  * entry:
744  *	base_addr - Address of the pointer.
745  *	delta - Offset relative to base_addr giving desired address
746  *
747  * exit:
748  *	The computed address is returned.
749  *
750  * note:
751  *	base_addr is an unsigned value, while ret_addr is signed. This routine
752  *	used explicit testing and casting to explicitly control type
753  *	conversion, and ensure that we handle the maximum possible range.
754  */
755 static Addr
srelptr(Addr base_addr,PTRDIFF_T delta)756 srelptr(Addr base_addr, PTRDIFF_T delta)
757 {
758 	if (delta < 0)
759 		return (base_addr - (Addr) (-delta));
760 
761 	return (base_addr + (Addr) delta);
762 }
763 
764 /*
765  * Byte swap a PTRDIFF_T value.
766  */
767 static PTRDIFF_T
swap_ptrdiff(PTRDIFF_T value)768 swap_ptrdiff(PTRDIFF_T value)
769 {
770 	PTRDIFF_T r;
771 	uchar_t	*dst = (uchar_t *)&r;
772 	uchar_t	*src = (uchar_t *)&value;
773 
774 	UL_ASSIGN_BSWAP_XWORD(dst, src);
775 	return (r);
776 }
777 
778 /*
779  * Display exception_range_entry items from the .exception_ranges section
780  * of a Sun C++ object.
781  */
782 static void
unwind_exception_ranges(Cache * _cache,const char * file,int do_swap)783 unwind_exception_ranges(Cache *_cache, const char *file, int do_swap)
784 {
785 	/*
786 	 * Translate a PTRDIFF_T self-relative address field of
787 	 * an exception_range_entry struct into an address.
788 	 *
789 	 * entry:
790 	 *	exc_addr - Address of base of exception_range_entry struct
791 	 *	cur_ent - Pointer to data in the struct to be translated
792 	 *
793 	 *	_f - Field of struct to be translated
794 	 */
795 #define	SRELPTR(_f) \
796 	srelptr(exc_addr + offsetof(exception_range_entry, _f), cur_ent->_f)
797 
798 #if	defined(_ELF64)
799 #define	MSG_EXR_TITLE	MSG_EXR_TITLE_64
800 #define	MSG_EXR_ENTRY	MSG_EXR_ENTRY_64
801 #else
802 #define	MSG_EXR_TITLE	MSG_EXR_TITLE_32
803 #define	MSG_EXR_ENTRY	MSG_EXR_ENTRY_32
804 #endif
805 
806 	exception_range_entry	scratch, *ent, *cur_ent = &scratch;
807 	char			index[MAXNDXSIZE];
808 	Word			i, nelts;
809 	Addr			addr, addr0 = 0, offset = 0;
810 	Addr			exc_addr = _cache->c_shdr->sh_addr;
811 
812 	dbg_print(0, MSG_INTL(MSG_EXR_TITLE));
813 	ent = (exception_range_entry *)(_cache->c_data->d_buf);
814 	nelts = _cache->c_data->d_size / sizeof (exception_range_entry);
815 
816 	for (i = 0; i < nelts; i++, ent++) {
817 		if (do_swap) {
818 			/*
819 			 * Copy byte swapped values into the scratch buffer.
820 			 * The reserved field is not used, so we skip it.
821 			 */
822 			scratch.ret_addr = swap_ptrdiff(ent->ret_addr);
823 			scratch.length = BSWAP_XWORD(ent->length);
824 			scratch.handler_addr = swap_ptrdiff(ent->handler_addr);
825 			scratch.type_block = swap_ptrdiff(ent->type_block);
826 		} else {
827 			cur_ent = ent;
828 		}
829 
830 		/*
831 		 * The table is required to be sorted by the address
832 		 * derived from ret_addr, to allow binary searching. Ensure
833 		 * that addresses grow monotonically.
834 		 */
835 		addr = SRELPTR(ret_addr);
836 		if ((i != 0) && (addr0 > addr))
837 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSORT),
838 			    file, _cache->c_name, EC_WORD(i));
839 
840 		(void) snprintf(index, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX),
841 		    EC_XWORD(i));
842 		dbg_print(0, MSG_INTL(MSG_EXR_ENTRY), index, EC_ADDR(offset),
843 		    EC_ADDR(addr), EC_ADDR(cur_ent->length),
844 		    EC_ADDR(SRELPTR(handler_addr)),
845 		    EC_ADDR(SRELPTR(type_block)));
846 
847 		addr0 = addr;
848 		exc_addr += sizeof (exception_range_entry);
849 		offset += sizeof (exception_range_entry);
850 	}
851 
852 #undef SRELPTR
853 #undef MSG_EXR_TITLE
854 #undef MSG_EXR_ENTRY
855 }
856 
857 /*
858  * Display information from unwind/exception sections:
859  *
860  * -	GNU/amd64 .eh_frame and .eh_frame_hdr
861  * -	Sun C++ .exception_ranges
862  *
863  */
864 static void
unwind(Cache * cache,Word shnum,Word phnum,Ehdr * ehdr,uchar_t osabi,const char * file,Elf * elf,uint_t flags)865 unwind(Cache *cache, Word shnum, Word phnum, Ehdr *ehdr, uchar_t osabi,
866     const char *file, Elf *elf, uint_t flags)
867 {
868 	static Word phdr_types[] = { PT_SUNW_UNWIND, PT_SUNW_EH_FRAME };
869 
870 	Word			cnt;
871 	Phdr			*uphdr = NULL;
872 	gnu_eh_state_t		eh_state;
873 
874 	/*
875 	 * Historical background: .eh_frame and .eh_frame_hdr sections
876 	 * come from the GNU compilers (particularly C++), and are used
877 	 * under all architectures. Their format is based on DWARF. When
878 	 * the amd64 ABI was defined, these sections were adopted wholesale
879 	 * from the existing practice.
880 	 *
881 	 * When amd64 support was added to Solaris, support for these
882 	 * sections was added, using the SHT_AMD64_UNWIND section type
883 	 * to identify them. At first, we ignored them in objects for
884 	 * non-amd64 targets, but later broadened our support to include
885 	 * other architectures in order to better support gcc-generated
886 	 * objects.
887 	 *
888 	 * .exception_ranges implement the same basic concepts, but
889 	 * were invented at Sun for the Sun C++ compiler.
890 	 *
891 	 * We match these sections by name, rather than section type,
892 	 * because they can come in as either SHT_AMD64_UNWIND, or as
893 	 * SHT_PROGBITS, and because the type isn't enough to determine
894 	 * how they should be interpreted.
895 	 */
896 	/* Find the program header for .eh_frame_hdr if present */
897 	if (phnum)
898 		uphdr = getphdr(phnum, phdr_types,
899 		    sizeof (phdr_types) / sizeof (*phdr_types), file, elf);
900 
901 	/*
902 	 * eh_state is used to retain data used by unwind_eh_frame()
903 	 * across calls.
904 	 */
905 	bzero(&eh_state, sizeof (eh_state));
906 
907 	for (cnt = 1; cnt < shnum; cnt++) {
908 		Cache		*_cache = &cache[cnt];
909 		Shdr		*shdr = _cache->c_shdr;
910 		int		is_exrange;
911 
912 		/*
913 		 * Skip sections of the wrong type. On amd64, they
914 		 * can be SHT_AMD64_UNWIND. On all platforms, they
915 		 * can be SHT_PROGBITS (including amd64, if using
916 		 * the GNU compilers).
917 		 *
918 		 * Skip anything other than these two types. The name
919 		 * test below will thin out the SHT_PROGBITS that don't apply.
920 		 */
921 		if ((shdr->sh_type != SHT_PROGBITS) &&
922 		    (shdr->sh_type != SHT_AMD64_UNWIND))
923 			continue;
924 
925 		/*
926 		 * Only sections with certain well known names are of interest.
927 		 * These are:
928 		 *
929 		 *	.eh_frame - amd64/GNU-compiler unwind sections
930 		 *	.eh_frame_hdr - Sorted table referencing .eh_frame
931 		 *	.exception_ranges - Sun C++ unwind sections
932 		 *
933 		 * We do a prefix comparison, allowing for naming conventions
934 		 * like .eh_frame.foo, hence the use of strncmp() rather than
935 		 * strcmp(). This means that we only really need to test for
936 		 * .eh_frame, as it's a prefix of .eh_frame_hdr.
937 		 */
938 		is_exrange =  strncmp(_cache->c_name,
939 		    MSG_ORIG(MSG_SCN_EXRANGE), MSG_SCN_EXRANGE_SIZE) == 0;
940 		if ((strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRM),
941 		    MSG_SCN_FRM_SIZE) != 0) && !is_exrange)
942 			continue;
943 
944 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
945 			continue;
946 
947 		if ((_cache->c_data == NULL) || (_cache->c_data->d_buf == NULL))
948 			continue;
949 
950 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
951 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_UNWIND), _cache->c_name);
952 
953 		if (is_exrange)
954 			unwind_exception_ranges(_cache, file,
955 			    _elf_sys_encoding() != ehdr->e_ident[EI_DATA]);
956 		else
957 			unwind_eh_frame(cache, cnt, shnum, uphdr, ehdr,
958 			    &eh_state, osabi, file, flags);
959 	}
960 }
961 
962 /*
963  * Initialize a symbol table state structure
964  *
965  * entry:
966  *	state - State structure to be initialized
967  *	cache - Cache of all section headers
968  *	shnum - # of sections in cache
969  *	secndx - Index of symbol table section
970  *	ehdr - ELF header for file
971  *	versym - Information about versym section
972  *	file - Name of file
973  *	flags - Command line option flags
974  */
975 static int
init_symtbl_state(SYMTBL_STATE * state,Cache * cache,Word shnum,Word secndx,Ehdr * ehdr,uchar_t osabi,VERSYM_STATE * versym,const char * file,uint_t flags)976 init_symtbl_state(SYMTBL_STATE *state, Cache *cache, Word shnum, Word secndx,
977     Ehdr *ehdr, uchar_t osabi, VERSYM_STATE *versym, const char *file,
978     uint_t flags)
979 {
980 	Shdr *shdr;
981 
982 	state->file = file;
983 	state->ehdr = ehdr;
984 	state->cache = cache;
985 	state->osabi = osabi;
986 	state->shnum = shnum;
987 	state->seccache = &cache[secndx];
988 	state->secndx = secndx;
989 	state->secname = state->seccache->c_name;
990 	state->flags = flags;
991 	state->shxndx.checked = 0;
992 	state->shxndx.data = NULL;
993 	state->shxndx.n = 0;
994 
995 	shdr = state->seccache->c_shdr;
996 
997 	/*
998 	 * Check the symbol data and per-item size.
999 	 */
1000 	if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
1001 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1002 		    file, state->secname);
1003 		return (0);
1004 	}
1005 	if ((state->seccache->c_data == NULL) ||
1006 	    (state->seccache->c_data->d_buf == NULL))
1007 		return (0);
1008 
1009 	/* LINTED */
1010 	state->symn = (Word)(shdr->sh_size / shdr->sh_entsize);
1011 	state->sym = (Sym *)state->seccache->c_data->d_buf;
1012 
1013 	/*
1014 	 * Check associated string table section.
1015 	 */
1016 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
1017 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1018 		    file, state->secname, EC_WORD(shdr->sh_link));
1019 		return (0);
1020 	}
1021 
1022 	/*
1023 	 * Determine if there is a associated Versym section
1024 	 * with this Symbol Table.
1025 	 */
1026 	if (versym && versym->cache &&
1027 	    (versym->cache->c_shdr->sh_link == state->secndx))
1028 		state->versym = versym;
1029 	else
1030 		state->versym = NULL;
1031 
1032 
1033 	return (1);
1034 }
1035 
1036 /*
1037  * Determine the extended section index used for symbol tables entries.
1038  */
1039 static void
symbols_getxindex(SYMTBL_STATE * state)1040 symbols_getxindex(SYMTBL_STATE *state)
1041 {
1042 	uint_t	symn;
1043 	Word	symcnt;
1044 
1045 	state->shxndx.checked = 1;   /* Note that we've been called */
1046 	for (symcnt = 1; symcnt < state->shnum; symcnt++) {
1047 		Cache	*_cache = &state->cache[symcnt];
1048 		Shdr	*shdr = _cache->c_shdr;
1049 
1050 		if ((shdr->sh_type != SHT_SYMTAB_SHNDX) ||
1051 		    (shdr->sh_link != state->secndx))
1052 			continue;
1053 
1054 		if ((shdr->sh_entsize) &&
1055 		    /* LINTED */
1056 		    ((symn = (uint_t)(shdr->sh_size / shdr->sh_entsize)) == 0))
1057 			continue;
1058 
1059 		if ((_cache->c_data == NULL) || (_cache->c_data->d_buf == NULL))
1060 			continue;
1061 
1062 		state->shxndx.data = _cache->c_data->d_buf;
1063 		state->shxndx.n = symn;
1064 		return;
1065 	}
1066 }
1067 
1068 /*
1069  * Produce a line of output for the given symbol
1070  *
1071  * entry:
1072  *	state - Symbol table state
1073  *	symndx - Index of symbol within the table
1074  *	info - Value of st_info (indicates local/global range)
1075  *	symndx_disp - Index to display. This may not be the same
1076  *		as symndx if the display is relative to the logical
1077  *		combination of the SUNW_ldynsym/dynsym tables.
1078  *	sym - Symbol to display
1079  */
1080 static void
output_symbol(SYMTBL_STATE * state,Word symndx,Word info,Word disp_symndx,Sym * sym)1081 output_symbol(SYMTBL_STATE *state, Word symndx, Word info, Word disp_symndx,
1082     Sym *sym)
1083 {
1084 	/*
1085 	 * Symbol types for which we check that the specified
1086 	 * address/size land inside the target section.
1087 	 */
1088 	static const int addr_symtype[] = {
1089 		0,			/* STT_NOTYPE */
1090 		1,			/* STT_OBJECT */
1091 		1,			/* STT_FUNC */
1092 		0,			/* STT_SECTION */
1093 		0,			/* STT_FILE */
1094 		1,			/* STT_COMMON */
1095 		0,			/* STT_TLS */
1096 		0,			/* 7 */
1097 		0,			/* 8 */
1098 		0,			/* 9 */
1099 		0,			/* 10 */
1100 		0,			/* 11 */
1101 		0,			/* 12 */
1102 		0,			/* STT_SPARC_REGISTER */
1103 		0,			/* 14 */
1104 		0,			/* 15 */
1105 	};
1106 #if STT_NUM != (STT_TLS + 1)
1107 #error "STT_NUM has grown. Update addr_symtype[]"
1108 #endif
1109 
1110 	char		index[MAXNDXSIZE];
1111 	const char	*symname, *sec;
1112 	Versym		verndx;
1113 	int		gnuver;
1114 	uchar_t		type;
1115 	Shdr		*tshdr;
1116 	Word		shndx;
1117 	Conv_inv_buf_t	inv_buf;
1118 
1119 	/* Ensure symbol index is in range */
1120 	if (symndx >= state->symn) {
1121 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSYMNDX),
1122 		    state->file, state->secname, EC_WORD(symndx));
1123 		return;
1124 	}
1125 
1126 	/*
1127 	 * If we are using extended symbol indexes, find the
1128 	 * corresponding SHN_SYMTAB_SHNDX table.
1129 	 */
1130 	if ((sym->st_shndx == SHN_XINDEX) && (state->shxndx.checked == 0))
1131 		symbols_getxindex(state);
1132 
1133 	/* LINTED */
1134 	symname = string(state->seccache, symndx,
1135 	    &state->cache[state->seccache->c_shdr->sh_link], state->file,
1136 	    sym->st_name);
1137 
1138 	tshdr = NULL;
1139 	sec = NULL;
1140 
1141 	if (state->ehdr->e_type == ET_CORE) {
1142 		sec = (char *)MSG_INTL(MSG_STR_UNKNOWN);
1143 	} else if (state->flags & FLG_CTL_FAKESHDR) {
1144 		/*
1145 		 * If we are using fake section headers derived from
1146 		 * the program headers, then the section indexes
1147 		 * in the symbols do not correspond to these headers.
1148 		 * The section names are not available, so all we can
1149 		 * do is to display them in numeric form.
1150 		 */
1151 		sec = conv_sym_shndx(state->osabi, state->ehdr->e_machine,
1152 		    sym->st_shndx, CONV_FMT_DECIMAL, &inv_buf);
1153 	} else if ((sym->st_shndx < SHN_LORESERVE) &&
1154 	    (sym->st_shndx < state->shnum)) {
1155 		shndx = sym->st_shndx;
1156 		tshdr = state->cache[shndx].c_shdr;
1157 		sec = state->cache[shndx].c_name;
1158 	} else if (sym->st_shndx == SHN_XINDEX) {
1159 		if (state->shxndx.data) {
1160 			Word	_shxndx;
1161 
1162 			if (symndx > state->shxndx.n) {
1163 				(void) fprintf(stderr,
1164 				    MSG_INTL(MSG_ERR_BADSYMXINDEX1),
1165 				    state->file, state->secname,
1166 				    EC_WORD(symndx));
1167 			} else if ((_shxndx =
1168 			    state->shxndx.data[symndx]) > state->shnum) {
1169 				(void) fprintf(stderr,
1170 				    MSG_INTL(MSG_ERR_BADSYMXINDEX2),
1171 				    state->file, state->secname,
1172 				    EC_WORD(symndx), EC_WORD(_shxndx));
1173 			} else {
1174 				shndx = _shxndx;
1175 				tshdr = state->cache[shndx].c_shdr;
1176 				sec = state->cache[shndx].c_name;
1177 			}
1178 		} else {
1179 			(void) fprintf(stderr,
1180 			    MSG_INTL(MSG_ERR_BADSYMXINDEX3),
1181 			    state->file, state->secname, EC_WORD(symndx));
1182 		}
1183 	} else if ((sym->st_shndx < SHN_LORESERVE) &&
1184 	    (sym->st_shndx >= state->shnum)) {
1185 		(void) fprintf(stderr,
1186 		    MSG_INTL(MSG_ERR_BADSYM5), state->file,
1187 		    state->secname, EC_WORD(symndx),
1188 		    demangle(symname, state->flags), sym->st_shndx);
1189 	}
1190 
1191 	/*
1192 	 * If versioning is available display the
1193 	 * version index. If not, then use 0.
1194 	 */
1195 	if (state->versym) {
1196 		Versym test_verndx;
1197 
1198 		verndx = test_verndx = state->versym->data[symndx];
1199 		gnuver = state->versym->gnu_full;
1200 
1201 		/*
1202 		 * Check to see if this is a defined symbol with a
1203 		 * version index that is outside the valid range for
1204 		 * the file. The interpretation of this depends on
1205 		 * the style of versioning used by the object.
1206 		 *
1207 		 * Versions >= VER_NDX_LORESERVE have special meanings,
1208 		 * and are exempt from this checking.
1209 		 *
1210 		 * GNU style version indexes use the top bit of the
1211 		 * 16-bit index value (0x8000) as the "hidden bit".
1212 		 * We must mask off this bit in order to compare
1213 		 * the version against the maximum value.
1214 		 */
1215 		if (gnuver)
1216 			test_verndx &= ~0x8000;
1217 
1218 		if ((test_verndx > state->versym->max_verndx) &&
1219 		    (verndx < VER_NDX_LORESERVE))
1220 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADVER),
1221 			    state->file, state->secname, EC_WORD(symndx),
1222 			    EC_HALF(test_verndx), state->versym->max_verndx);
1223 	} else {
1224 		verndx = 0;
1225 		gnuver = 0;
1226 	}
1227 
1228 	/*
1229 	 * Error checking for TLS.
1230 	 */
1231 	type = ELF_ST_TYPE(sym->st_info);
1232 	if (type == STT_TLS) {
1233 		if (tshdr &&
1234 		    (sym->st_shndx != SHN_UNDEF) &&
1235 		    ((tshdr->sh_flags & SHF_TLS) == 0)) {
1236 			(void) fprintf(stderr,
1237 			    MSG_INTL(MSG_ERR_BADSYM3), state->file,
1238 			    state->secname, EC_WORD(symndx),
1239 			    demangle(symname, state->flags));
1240 		}
1241 	} else if ((type != STT_SECTION) && sym->st_size &&
1242 	    tshdr && (tshdr->sh_flags & SHF_TLS)) {
1243 		(void) fprintf(stderr,
1244 		    MSG_INTL(MSG_ERR_BADSYM4), state->file,
1245 		    state->secname, EC_WORD(symndx),
1246 		    demangle(symname, state->flags));
1247 	}
1248 
1249 	/*
1250 	 * If a symbol with non-zero size has a type that
1251 	 * specifies an address, then make sure the location
1252 	 * it references is actually contained within the
1253 	 * section.  UNDEF symbols don't count in this case,
1254 	 * so we ignore them.
1255 	 *
1256 	 * The meaning of the st_value field in a symbol
1257 	 * depends on the type of object. For a relocatable
1258 	 * object, it is the offset within the section.
1259 	 * For sharable objects, it is the offset relative to
1260 	 * the base of the object, and for other types, it is
1261 	 * the virtual address. To get an offset within the
1262 	 * section for non-ET_REL files, we subtract the
1263 	 * base address of the section.
1264 	 */
1265 	if (addr_symtype[type] && (sym->st_size > 0) &&
1266 	    (sym->st_shndx != SHN_UNDEF) && ((sym->st_shndx < SHN_LORESERVE) ||
1267 	    (sym->st_shndx == SHN_XINDEX)) && (tshdr != NULL)) {
1268 		Word v = sym->st_value;
1269 			if (state->ehdr->e_type != ET_REL)
1270 				v -= tshdr->sh_addr;
1271 		if (((v + sym->st_size) > tshdr->sh_size)) {
1272 			(void) fprintf(stderr,
1273 			    MSG_INTL(MSG_ERR_BADSYM6), state->file,
1274 			    state->secname, EC_WORD(symndx),
1275 			    demangle(symname, state->flags),
1276 			    EC_WORD(shndx), EC_XWORD(tshdr->sh_size),
1277 			    EC_XWORD(sym->st_value), EC_XWORD(sym->st_size));
1278 		}
1279 	}
1280 
1281 	/*
1282 	 * A typical symbol table uses the sh_info field to indicate one greater
1283 	 * than the symbol table index of the last local symbol, STB_LOCAL.
1284 	 * Therefore, symbol indexes less than sh_info should have local
1285 	 * binding.  Symbol indexes greater than, or equal to sh_info, should
1286 	 * have global binding.  Note, we exclude UNDEF/NOTY symbols with zero
1287 	 * value and size, as these symbols may be the result of an mcs(1)
1288 	 * section deletion.
1289 	 */
1290 	if (info) {
1291 		uchar_t	bind = ELF_ST_BIND(sym->st_info);
1292 
1293 		if ((symndx < info) && (bind != STB_LOCAL)) {
1294 			(void) fprintf(stderr,
1295 			    MSG_INTL(MSG_ERR_BADSYM7), state->file,
1296 			    state->secname, EC_WORD(symndx),
1297 			    demangle(symname, state->flags), EC_XWORD(info));
1298 
1299 		} else if ((symndx >= info) && (bind == STB_LOCAL) &&
1300 		    ((sym->st_shndx != SHN_UNDEF) ||
1301 		    (ELF_ST_TYPE(sym->st_info) != STT_NOTYPE) ||
1302 		    (sym->st_size != 0) || (sym->st_value != 0))) {
1303 			(void) fprintf(stderr,
1304 			    MSG_INTL(MSG_ERR_BADSYM8), state->file,
1305 			    state->secname, EC_WORD(symndx),
1306 			    demangle(symname, state->flags), EC_XWORD(info));
1307 		}
1308 	}
1309 
1310 	(void) snprintf(index, MAXNDXSIZE,
1311 	    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(disp_symndx));
1312 	Elf_syms_table_entry(0, ELF_DBG_ELFDUMP, index, state->osabi,
1313 	    state->ehdr->e_machine, sym, verndx, gnuver, sec, symname);
1314 }
1315 
1316 /*
1317  * Process a SHT_SUNW_cap capabilities section.
1318  */
1319 static int
cap_section(const char * file,Cache * cache,Word shnum,Cache * ccache,uchar_t osabi,Ehdr * ehdr,uint_t flags)1320 cap_section(const char *file, Cache *cache, Word shnum, Cache *ccache,
1321     uchar_t osabi, Ehdr *ehdr, uint_t flags)
1322 {
1323 	SYMTBL_STATE	state;
1324 	Word		cnum, capnum, nulls, symcaps;
1325 	int		descapndx, objcap, title;
1326 	Cap		*cap = (Cap *)ccache->c_data->d_buf;
1327 	Shdr		*cishdr, *cshdr = ccache->c_shdr;
1328 	Cache		*cicache, *strcache;
1329 	Capinfo		*capinfo = NULL;
1330 	Word		capinfonum;
1331 	const char	*strs = NULL;
1332 	size_t		strs_size;
1333 
1334 	if ((cshdr->sh_entsize == 0) || (cshdr->sh_size == 0)) {
1335 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1336 		    file, ccache->c_name);
1337 		return (0);
1338 	}
1339 
1340 	/*
1341 	 * If this capabilities section is associated with symbols, then the
1342 	 * sh_link field points to the associated capabilities information
1343 	 * section.  The sh_link field of the capabilities information section
1344 	 * points to the associated symbol table.
1345 	 */
1346 	if (cshdr->sh_link) {
1347 		Cache	*scache;
1348 		Shdr	*sshdr;
1349 
1350 		/*
1351 		 * Validate that the sh_link field points to a capabilities
1352 		 * information section.
1353 		 */
1354 		if (cshdr->sh_link >= shnum) {
1355 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1356 			    file, ccache->c_name, EC_WORD(cshdr->sh_link));
1357 			return (0);
1358 		}
1359 
1360 		cicache = &cache[cshdr->sh_link];
1361 		cishdr = cicache->c_shdr;
1362 
1363 		if (cishdr->sh_type != SHT_SUNW_capinfo) {
1364 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAP),
1365 			    file, ccache->c_name, EC_WORD(cshdr->sh_link));
1366 			return (0);
1367 		}
1368 
1369 		capinfo = cicache->c_data->d_buf;
1370 		capinfonum = (Word)(cishdr->sh_size / cishdr->sh_entsize);
1371 
1372 		/*
1373 		 * Validate that the sh_link field of the capabilities
1374 		 * information section points to a valid symbol table.
1375 		 */
1376 		if ((cishdr->sh_link == 0) || (cishdr->sh_link >= shnum)) {
1377 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1378 			    file, cicache->c_name, EC_WORD(cishdr->sh_link));
1379 			return (0);
1380 		}
1381 		scache = &cache[cishdr->sh_link];
1382 		sshdr = scache->c_shdr;
1383 
1384 		if ((sshdr->sh_type != SHT_SYMTAB) &&
1385 		    (sshdr->sh_type != SHT_DYNSYM)) {
1386 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAPINFO1),
1387 			    file, cicache->c_name, EC_WORD(cishdr->sh_link));
1388 			return (0);
1389 		}
1390 
1391 		if (!init_symtbl_state(&state, cache, shnum,
1392 		    cishdr->sh_link, ehdr, osabi, NULL, file, flags))
1393 			return (0);
1394 	}
1395 
1396 	/*
1397 	 * If this capabilities section contains capability string entries,
1398 	 * then determine the associated string table.  Capabilities entries
1399 	 * that define names require that the capability section indicate
1400 	 * which string table to use via sh_info.
1401 	 */
1402 	if (cshdr->sh_info) {
1403 		Shdr	*strshdr;
1404 
1405 		/*
1406 		 * Validate that the sh_info field points to a string table.
1407 		 */
1408 		if (cshdr->sh_info >= shnum) {
1409 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1410 			    file, ccache->c_name, EC_WORD(cshdr->sh_info));
1411 			return (0);
1412 		}
1413 
1414 		strcache = &cache[cshdr->sh_info];
1415 		strshdr = strcache->c_shdr;
1416 
1417 		if (strshdr->sh_type != SHT_STRTAB) {
1418 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAP),
1419 			    file, ccache->c_name, EC_WORD(cshdr->sh_info));
1420 			return (0);
1421 		}
1422 		strs = (const char *)strcache->c_data->d_buf;
1423 		strs_size = strcache->c_data->d_size;
1424 	}
1425 
1426 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1427 	dbg_print(0, MSG_INTL(MSG_ELF_SCN_CAP), ccache->c_name);
1428 
1429 	capnum = (Word)(cshdr->sh_size / cshdr->sh_entsize);
1430 
1431 	nulls = symcaps = 0;
1432 	objcap = title = 1;
1433 	descapndx = -1;
1434 
1435 	/*
1436 	 * Traverse the capabilities section printing each capability group.
1437 	 * The first capabilities group defines any object capabilities.  Any
1438 	 * following groups define symbol capabilities.  In the case where no
1439 	 * object capabilities exist, but symbol capabilities do, a single
1440 	 * CA_SUNW_NULL terminator for the object capabilities exists.
1441 	 */
1442 	for (cnum = 0; cnum < capnum; cap++, cnum++) {
1443 		if (cap->c_tag == CA_SUNW_NULL) {
1444 			/*
1445 			 * A CA_SUNW_NULL tag terminates a capabilities group.
1446 			 * If the first capabilities tag is CA_SUNW_NULL, then
1447 			 * no object capabilities exist.
1448 			 */
1449 			if ((nulls++ == 0) && (cnum == 0))
1450 				objcap = 0;
1451 			title = 1;
1452 		} else {
1453 			if (title) {
1454 				if (nulls == 0) {
1455 					/*
1456 					 * If this capabilities group represents
1457 					 * the object capabilities (i.e., no
1458 					 * CA_SUNW_NULL tag has been processed
1459 					 * yet), then display an object
1460 					 * capabilities title.
1461 					 */
1462 					dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1463 					dbg_print(0,
1464 					    MSG_INTL(MSG_OBJ_CAP_TITLE));
1465 				} else {
1466 					/*
1467 					 * If this is a symbols capabilities
1468 					 * group (i.e., a CA_SUNW_NULL tag has
1469 					 * already be found that terminates
1470 					 * the object capabilities group), then
1471 					 * display a symbol capabilities title,
1472 					 * and retain this capabilities index
1473 					 * for later processing.
1474 					 */
1475 					dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1476 					dbg_print(0,
1477 					    MSG_INTL(MSG_SYM_CAP_TITLE));
1478 					descapndx = cnum;
1479 				}
1480 				Elf_cap_title(0);
1481 				title = 0;
1482 			}
1483 
1484 			/*
1485 			 * Print the capabilities data.
1486 			 *
1487 			 * Note that CA_SUNW_PLAT, CA_SUNW_MACH and CA_SUNW_ID
1488 			 * entries require a string table, which should have
1489 			 * already been established.
1490 			 */
1491 			if ((strs == NULL) && ((cap->c_tag == CA_SUNW_PLAT) ||
1492 			    (cap->c_tag == CA_SUNW_MACH) ||
1493 			    (cap->c_tag == CA_SUNW_ID))) {
1494 				(void) fprintf(stderr,
1495 				    MSG_INTL(MSG_WARN_INVCAP4), file,
1496 				    EC_WORD(elf_ndxscn(ccache->c_scn)),
1497 				    ccache->c_name, EC_WORD(cshdr->sh_info));
1498 			}
1499 			Elf_cap_entry(0, cap, cnum, strs, strs_size,
1500 			    ehdr->e_machine);
1501 		}
1502 
1503 		/*
1504 		 * If this CA_SUNW_NULL tag terminates a symbol capabilities
1505 		 * group, determine the associated symbols.
1506 		 */
1507 		if ((cap->c_tag == CA_SUNW_NULL) && (nulls > 1) &&
1508 		    (descapndx != -1)) {
1509 			Capinfo	*cip;
1510 			Word	inum;
1511 
1512 			symcaps++;
1513 
1514 			/*
1515 			 * Make sure we've discovered a SHT_SUNW_capinfo table.
1516 			 */
1517 			if ((cip = capinfo) == NULL) {
1518 				(void) fprintf(stderr,
1519 				    MSG_INTL(MSG_ERR_INVCAP), file,
1520 				    ccache->c_name, EC_WORD(cshdr->sh_link));
1521 				return (0);
1522 			}
1523 
1524 			/*
1525 			 * Determine what symbols reference this capabilities
1526 			 * group.
1527 			 */
1528 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1529 			dbg_print(0, MSG_INTL(MSG_CAPINFO_ENTRIES));
1530 			Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
1531 
1532 			for (inum = 1, cip++; inum < capinfonum;
1533 			    inum++, cip++) {
1534 				Word	gndx = (Word)ELF_C_GROUP(*cip);
1535 
1536 				if (gndx && (gndx == descapndx)) {
1537 					output_symbol(&state, inum, 0,
1538 					    inum, state.sym + inum);
1539 				}
1540 			}
1541 			descapndx = -1;
1542 			continue;
1543 		}
1544 
1545 		/*
1546 		 * An SF1_SUNW_ADDR32 software capability tag in a 32-bit
1547 		 * object is suspicious as it has no effect.
1548 		 */
1549 		if ((cap->c_tag == CA_SUNW_SF_1) &&
1550 		    (ehdr->e_ident[EI_CLASS] == ELFCLASS32) &&
1551 		    (cap->c_un.c_val & SF1_SUNW_ADDR32)) {
1552 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INADDR32SF1),
1553 			    file, ccache->c_name);
1554 		}
1555 	}
1556 
1557 	/*
1558 	 * If this is a dynamic object, with symbol capabilities, then a
1559 	 * .SUNW_capchain section should exist.  This section contains a chain
1560 	 * of symbol indexes for each capabilities family.  This is the list
1561 	 * that is searched by ld.so.1 to determine the best capabilities
1562 	 * candidate.
1563 	 *
1564 	 * Note, more than one capabilities lead symbol can point to the same
1565 	 * family chain.  For example, a weak/global pair of symbols can both
1566 	 * represent the same family of capabilities symbols.  Therefore, to
1567 	 * display all possible families we traverse the capabilities
1568 	 * information section looking for CAPINFO_SUNW_GLOB lead symbols.
1569 	 * From these we determine the associated capabilities chain to inspect.
1570 	 */
1571 	if (symcaps &&
1572 	    ((ehdr->e_type == ET_EXEC) || (ehdr->e_type == ET_DYN))) {
1573 		Capinfo		*cip;
1574 		Capchain	*chain;
1575 		Cache   	*chcache;
1576 		Shdr		*chshdr;
1577 		Word		chainnum, inum;
1578 
1579 		/*
1580 		 * Validate that the sh_info field of the capabilities
1581 		 * information section points to a capabilities chain section.
1582 		 */
1583 		if (cishdr->sh_info >= shnum) {
1584 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1585 			    file, cicache->c_name, EC_WORD(cishdr->sh_info));
1586 			return (0);
1587 		}
1588 
1589 		chcache = &cache[cishdr->sh_info];
1590 		chshdr = chcache->c_shdr;
1591 
1592 		if (chshdr->sh_type != SHT_SUNW_capchain) {
1593 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAPINFO2),
1594 			    file, cicache->c_name, EC_WORD(cishdr->sh_info));
1595 			return (0);
1596 		}
1597 
1598 		chainnum = (Word)(chshdr->sh_size / chshdr->sh_entsize);
1599 		chain = (Capchain *)chcache->c_data->d_buf;
1600 
1601 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1602 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_CAPCHAIN), chcache->c_name);
1603 
1604 		/*
1605 		 * Traverse the capabilities information section looking for
1606 		 * CAPINFO_SUNW_GLOB lead capabilities symbols.
1607 		 */
1608 		cip = capinfo;
1609 		for (inum = 1, cip++; inum < capinfonum; inum++, cip++) {
1610 			const char	*name;
1611 			Sym		*sym;
1612 			Word		sndx, cndx;
1613 			Word		gndx = (Word)ELF_C_GROUP(*cip);
1614 
1615 			if ((gndx == 0) || (gndx != CAPINFO_SUNW_GLOB))
1616 				continue;
1617 
1618 			/*
1619 			 * Determine the symbol that is associated with this
1620 			 * capability information entry, and use this to
1621 			 * identify this capability family.
1622 			 */
1623 			sym = (Sym *)(state.sym + inum);
1624 			name = string(cicache, inum, strcache, file,
1625 			    sym->st_name);
1626 
1627 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1628 			dbg_print(0, MSG_INTL(MSG_CAPCHAIN_TITLE), name);
1629 			dbg_print(0, MSG_INTL(MSG_CAPCHAIN_ENTRY));
1630 
1631 			cndx = (Word)ELF_C_SYM(*cip);
1632 
1633 			/*
1634 			 * Traverse this families chain and identify each
1635 			 * family member.
1636 			 */
1637 			for (;;) {
1638 				char	_chain[MAXNDXSIZE], _symndx[MAXNDXSIZE];
1639 
1640 				if (cndx >= chainnum) {
1641 					(void) fprintf(stderr,
1642 					    MSG_INTL(MSG_ERR_INVCAPINFO3), file,
1643 					    cicache->c_name, EC_WORD(inum),
1644 					    EC_WORD(cndx));
1645 					break;
1646 				}
1647 				if ((sndx = chain[cndx]) == 0)
1648 					break;
1649 
1650 				/*
1651 				 * Determine this entries symbol reference.
1652 				 */
1653 				if (sndx > state.symn) {
1654 					(void) fprintf(stderr,
1655 					    MSG_INTL(MSG_ERR_CHBADSYMNDX), file,
1656 					    EC_WORD(sndx), chcache->c_name,
1657 					    EC_WORD(cndx));
1658 					name = MSG_INTL(MSG_STR_UNKNOWN);
1659 				} else {
1660 					sym = (Sym *)(state.sym + sndx);
1661 					name = string(chcache, sndx,
1662 					    strcache, file, sym->st_name);
1663 				}
1664 
1665 				/*
1666 				 * Display the family member.
1667 				 */
1668 				(void) snprintf(_chain, MAXNDXSIZE,
1669 				    MSG_ORIG(MSG_FMT_INTEGER), cndx);
1670 				(void) snprintf(_symndx, MAXNDXSIZE,
1671 				    MSG_ORIG(MSG_FMT_INDEX2), EC_WORD(sndx));
1672 				dbg_print(0, MSG_ORIG(MSG_FMT_CHAIN_INFO),
1673 				    _chain, _symndx, demangle(name, flags));
1674 
1675 				cndx++;
1676 			}
1677 		}
1678 	}
1679 	return (objcap);
1680 }
1681 
1682 /*
1683  * Print the capabilities.
1684  *
1685  * A .SUNW_cap section can contain one or more, CA_SUNW_NULL terminated,
1686  * capabilities groups.  The first group defines the object capabilities.
1687  * This group defines the minimum capability requirements of the entire
1688  * object file.  If this is a dynamic object, this group should be associated
1689  * with a PT_SUNWCAP program header.
1690  *
1691  * Additional capabilities groups define the association of individual symbols
1692  * to specific capabilities.
1693  */
1694 static void
cap(const char * file,Cache * cache,Word shnum,Word phnum,Ehdr * ehdr,uchar_t osabi,Elf * elf,uint_t flags)1695 cap(const char *file, Cache *cache, Word shnum, Word phnum, Ehdr *ehdr,
1696     uchar_t osabi, Elf *elf, uint_t flags)
1697 {
1698 	Word		cnt;
1699 	Shdr		*cshdr = NULL;
1700 	Cache		*ccache;
1701 	Off		cphdr_off = 0;
1702 	Xword		cphdr_sz;
1703 
1704 	/*
1705 	 * Determine if a global capabilities header exists.
1706 	 */
1707 	if (phnum) {
1708 		Phdr	*phdr;
1709 
1710 		if ((phdr = elf_getphdr(elf)) == NULL) {
1711 			failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
1712 			return;
1713 		}
1714 
1715 		for (cnt = 0; cnt < phnum; phdr++, cnt++) {
1716 			if (phdr->p_type == PT_SUNWCAP) {
1717 				cphdr_off = phdr->p_offset;
1718 				cphdr_sz = phdr->p_filesz;
1719 				break;
1720 			}
1721 		}
1722 	}
1723 
1724 	/*
1725 	 * Determine if a capabilities section exists.
1726 	 */
1727 	for (cnt = 1; cnt < shnum; cnt++) {
1728 		Cache	*_cache = &cache[cnt];
1729 		Shdr	*shdr = _cache->c_shdr;
1730 
1731 		/*
1732 		 * Process any capabilities information.
1733 		 */
1734 		if (shdr->sh_type == SHT_SUNW_cap) {
1735 			if (cap_section(file, cache, shnum, _cache, osabi,
1736 			    ehdr, flags)) {
1737 				/*
1738 				 * If this section defined an object capability
1739 				 * group, retain the section information for
1740 				 * program header validation.
1741 				 */
1742 				ccache = _cache;
1743 				cshdr = shdr;
1744 			}
1745 			continue;
1746 		}
1747 	}
1748 
1749 	if ((cshdr == NULL) && (cphdr_off == 0))
1750 		return;
1751 
1752 	if (cphdr_off && (cshdr == NULL))
1753 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP1), file);
1754 
1755 	/*
1756 	 * If this object is an executable or shared object, and it provided
1757 	 * an object capabilities group, then the group should have an
1758 	 * accompanying PT_SUNWCAP program header.
1759 	 */
1760 	if (cshdr && ((ehdr->e_type == ET_EXEC) || (ehdr->e_type == ET_DYN))) {
1761 		if (cphdr_off == 0) {
1762 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP2),
1763 			    file, EC_WORD(elf_ndxscn(ccache->c_scn)),
1764 			    ccache->c_name);
1765 		} else if ((cphdr_off != cshdr->sh_offset) ||
1766 		    (cphdr_sz != cshdr->sh_size)) {
1767 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP3),
1768 			    file, EC_WORD(elf_ndxscn(ccache->c_scn)),
1769 			    ccache->c_name);
1770 		}
1771 	}
1772 }
1773 
1774 /*
1775  * Print the interpretor.
1776  */
1777 static void
interp(const char * file,Cache * cache,Word shnum,Word phnum,Elf * elf)1778 interp(const char *file, Cache *cache, Word shnum, Word phnum, Elf *elf)
1779 {
1780 	static Word phdr_types[] = { PT_INTERP };
1781 
1782 
1783 	Word	cnt;
1784 	Shdr	*ishdr = NULL;
1785 	Cache	*icache = NULL;
1786 	Off	iphdr_off = 0;
1787 	Xword	iphdr_fsz;
1788 
1789 	/*
1790 	 * Determine if an interp header exists.
1791 	 */
1792 	if (phnum) {
1793 		Phdr	*phdr;
1794 
1795 		phdr = getphdr(phnum, phdr_types,
1796 		    sizeof (phdr_types) / sizeof (*phdr_types), file, elf);
1797 		if (phdr != NULL) {
1798 			iphdr_off = phdr->p_offset;
1799 			iphdr_fsz = phdr->p_filesz;
1800 		}
1801 	}
1802 
1803 	if (iphdr_off == 0)
1804 		return;
1805 
1806 	/*
1807 	 * Determine if an interp section exists.
1808 	 */
1809 	for (cnt = 1; cnt < shnum; cnt++) {
1810 		Cache	*_cache = &cache[cnt];
1811 		Shdr	*shdr = _cache->c_shdr;
1812 
1813 		/*
1814 		 * Scan sections to find a section which contains the PT_INTERP
1815 		 * string.  The target section can't be in a NOBITS section.
1816 		 */
1817 		if ((shdr->sh_type == SHT_NOBITS) ||
1818 		    (iphdr_off < shdr->sh_offset) ||
1819 		    (iphdr_off + iphdr_fsz) > (shdr->sh_offset + shdr->sh_size))
1820 			continue;
1821 
1822 		icache = _cache;
1823 		ishdr = shdr;
1824 		break;
1825 	}
1826 
1827 	/*
1828 	 * Print the interpreter string based on the offset defined in the
1829 	 * program header, as this is the offset used by the kernel.
1830 	 */
1831 	if ((ishdr != NULL) &&
1832 	    (icache != NULL) &&
1833 	    (icache->c_data != NULL) &&
1834 	    (icache->c_data->d_buf != NULL) &&
1835 	    (icache->c_data->d_size > 0)) {
1836 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1837 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_INTERP), icache->c_name);
1838 		dbg_print(0, MSG_ORIG(MSG_FMT_INDENT),
1839 		    (char *)icache->c_data->d_buf +
1840 		    (iphdr_off - ishdr->sh_offset));
1841 	} else
1842 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVINTERP1), file);
1843 
1844 	/*
1845 	 * If there are any inconsistences between the program header and
1846 	 * section information, flag them.
1847 	 */
1848 	if (ishdr && ((iphdr_off != ishdr->sh_offset) ||
1849 	    (iphdr_fsz != ishdr->sh_size))) {
1850 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVINTERP2), file,
1851 		    icache->c_name);
1852 	}
1853 }
1854 
1855 /*
1856  * Print the syminfo section.
1857  */
1858 static void
syminfo(Cache * cache,Word shnum,Ehdr * ehdr,uchar_t osabi,const char * file)1859 syminfo(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
1860 {
1861 	Shdr		*infoshdr;
1862 	Syminfo		*info;
1863 	Sym		*syms;
1864 	Dyn		*dyns;
1865 	Word		infonum, cnt, ndx, symnum, dynnum;
1866 	Cache		*infocache = NULL, *dyncache = NULL, *symsec, *strsec;
1867 	Boolean		*dynerr;
1868 
1869 	for (cnt = 1; cnt < shnum; cnt++) {
1870 		if (cache[cnt].c_shdr->sh_type == SHT_SUNW_syminfo) {
1871 			infocache = &cache[cnt];
1872 			break;
1873 		}
1874 	}
1875 	if (infocache == NULL)
1876 		return;
1877 
1878 	infoshdr = infocache->c_shdr;
1879 	if ((infoshdr->sh_entsize == 0) || (infoshdr->sh_size == 0)) {
1880 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1881 		    file, infocache->c_name);
1882 		return;
1883 	}
1884 	if ((infocache->c_data == NULL) || (infocache->c_data->d_buf == NULL))
1885 		return;
1886 
1887 	infonum = (Word)(infoshdr->sh_size / infoshdr->sh_entsize);
1888 	info = (Syminfo *)infocache->c_data->d_buf;
1889 
1890 	/*
1891 	 * If there is no associated dynamic section, determine if one
1892 	 * is needed, and if so issue a warning. If there is an
1893 	 * associated dynamic section, validate it and get the data buffer
1894 	 * for it.
1895 	 */
1896 	dyns = NULL;
1897 	dynnum = 0;
1898 	if (infoshdr->sh_info == 0) {
1899 		Syminfo	*_info = info + 1;
1900 
1901 		for (ndx = 1; ndx < infonum; ndx++, _info++) {
1902 			if ((_info->si_flags == 0) && (_info->si_boundto == 0))
1903 				continue;
1904 
1905 			if (_info->si_boundto < SYMINFO_BT_LOWRESERVE)
1906 				(void) fprintf(stderr,
1907 				    MSG_INTL(MSG_ERR_BADSHINFO), file,
1908 				    infocache->c_name,
1909 				    EC_WORD(infoshdr->sh_info));
1910 		}
1911 	} else if ((infoshdr->sh_info >= shnum) ||
1912 	    (cache[infoshdr->sh_info].c_shdr->sh_type != SHT_DYNAMIC)) {
1913 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHINFO),
1914 		    file, infocache->c_name, EC_WORD(infoshdr->sh_info));
1915 	} else {
1916 		dyncache = &cache[infoshdr->sh_info];
1917 		if ((dyncache->c_data == NULL) ||
1918 		    ((dyns = dyncache->c_data->d_buf) == NULL)) {
1919 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1920 			    file, dyncache->c_name);
1921 		}
1922 		if (dyns != NULL) {
1923 			if ((dyncache->c_shdr->sh_entsize == 0) ||
1924 			    (dyncache->c_shdr->sh_size == 0)) {
1925 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1926 				    file, dyncache->c_name);
1927 				return;
1928 			}
1929 
1930 			dynnum = dyncache->c_shdr->sh_size /
1931 			    dyncache->c_shdr->sh_entsize;
1932 
1933 			/*
1934 			 * We validate the type of dynamic elements referenced
1935 			 * from the syminfo. This array is used report any
1936 			 * bad dynamic entries.
1937 			 */
1938 			if ((dynerr = calloc(dynnum, sizeof (*dynerr))) ==
1939 			    NULL) {
1940 				int err = errno;
1941 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
1942 				    file, strerror(err));
1943 				return;
1944 			}
1945 		}
1946 	}
1947 
1948 	/*
1949 	 * Get the data buffer for the associated symbol table and string table.
1950 	 */
1951 	if (stringtbl(cache, 1, cnt, shnum, file,
1952 	    &symnum, &symsec, &strsec) == 0)
1953 		return;
1954 
1955 	syms = symsec->c_data->d_buf;
1956 
1957 	/*
1958 	 * Loop through the syminfo entries.
1959 	 */
1960 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1961 	dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMINFO), infocache->c_name);
1962 	Elf_syminfo_title(0);
1963 
1964 	for (ndx = 1, info++; ndx < infonum; ndx++, info++) {
1965 		Sym 		*sym;
1966 		const char	*needed, *name;
1967 		Word		expect_dt;
1968 		Word		boundto = info->si_boundto;
1969 
1970 		if ((info->si_flags == 0) && (boundto == 0))
1971 			continue;
1972 
1973 		sym = &syms[ndx];
1974 		name = string(infocache, ndx, strsec, file, sym->st_name);
1975 
1976 		/* Is si_boundto set to one of the reserved values? */
1977 		if (boundto >= SYMINFO_BT_LOWRESERVE) {
1978 			Elf_syminfo_entry(0, ndx, info, name, NULL);
1979 			continue;
1980 		}
1981 
1982 		/*
1983 		 * si_boundto is referencing a dynamic section. If we don't
1984 		 * have one, an error was already issued above, so it suffices
1985 		 * to display an empty string. If we are out of bounds, then
1986 		 * report that and then display an empty string.
1987 		 */
1988 		if ((dyns == NULL) || (boundto >= dynnum)) {
1989 			if (dyns != NULL)
1990 				(void) fprintf(stderr,
1991 				    MSG_INTL(MSG_ERR_BADSIDYNNDX), file,
1992 				    infocache->c_ndx, infocache->c_name,
1993 				    EC_WORD(ndx), EC_WORD(dynnum - 1),
1994 				    EC_WORD(boundto));
1995 			Elf_syminfo_entry(0, ndx, info, name,
1996 			    MSG_ORIG(MSG_STR_EMPTY));
1997 			continue;
1998 		}
1999 
2000 		/*
2001 		 * The si_boundto reference expects a specific dynamic element
2002 		 * type at the given index. The dynamic element is always a
2003 		 * string that gives an object name. The specific type depends
2004 		 * on the si_flags present. Ensure that we've got the right
2005 		 * type.
2006 		 */
2007 		if (info->si_flags & SYMINFO_FLG_FILTER)
2008 			expect_dt = DT_SUNW_FILTER;
2009 		else if (info->si_flags & SYMINFO_FLG_AUXILIARY)
2010 			expect_dt = DT_SUNW_AUXILIARY;
2011 		else if (info->si_flags & (SYMINFO_FLG_DIRECT |
2012 		    SYMINFO_FLG_LAZYLOAD | SYMINFO_FLG_DIRECTBIND))
2013 			expect_dt = DT_NEEDED;
2014 		else
2015 			expect_dt = DT_NULL;   /* means we ignore the type */
2016 
2017 		if ((dyns[boundto].d_tag != expect_dt) &&
2018 		    (expect_dt != DT_NULL)) {
2019 			Conv_inv_buf_t	buf1, buf2;
2020 
2021 			/* Only complain about each dynamic element once */
2022 			if (!dynerr[boundto]) {
2023 				(void) fprintf(stderr,
2024 				    MSG_INTL(MSG_ERR_BADSIDYNTAG),
2025 				    file, infocache->c_ndx, infocache->c_name,
2026 				    EC_WORD(ndx), dyncache->c_ndx,
2027 				    dyncache->c_name, EC_WORD(boundto),
2028 				    conv_dyn_tag(expect_dt, osabi,
2029 				    ehdr->e_machine, CONV_FMT_ALT_CF, &buf1),
2030 				    conv_dyn_tag(dyns[boundto].d_tag, osabi,
2031 				    ehdr->e_machine, CONV_FMT_ALT_CF, &buf2));
2032 				dynerr[boundto] = TRUE;
2033 			}
2034 		}
2035 
2036 		/*
2037 		 * Whether or not the DT item we're pointing at is
2038 		 * of the right type, if it's a type we recognize as
2039 		 * providing a string, go ahead and show it. Otherwise
2040 		 * an empty string.
2041 		 */
2042 		switch (dyns[boundto].d_tag) {
2043 		case DT_NEEDED:
2044 		case DT_SONAME:
2045 		case DT_RPATH:
2046 		case DT_RUNPATH:
2047 		case DT_CONFIG:
2048 		case DT_DEPAUDIT:
2049 		case DT_USED:
2050 		case DT_AUDIT:
2051 		case DT_SUNW_AUXILIARY:
2052 		case DT_SUNW_FILTER:
2053 		case DT_FILTER:
2054 		case DT_AUXILIARY:
2055 			needed = string(infocache, boundto,
2056 			    strsec, file, dyns[boundto].d_un.d_val);
2057 			break;
2058 		default:
2059 			needed = MSG_ORIG(MSG_STR_EMPTY);
2060 		}
2061 		Elf_syminfo_entry(0, ndx, info, name, needed);
2062 	}
2063 	if (dyns != NULL)
2064 		free(dynerr);
2065 }
2066 
2067 /*
2068  * Print version definition section entries.
2069  */
2070 static void
version_def(Verdef * vdf,Word vdf_num,Cache * vcache,Cache * scache,const char * file)2071 version_def(Verdef *vdf, Word vdf_num, Cache *vcache, Cache *scache,
2072     const char *file)
2073 {
2074 	Word	cnt;
2075 	char	index[MAXNDXSIZE];
2076 
2077 	Elf_ver_def_title(0);
2078 
2079 	for (cnt = 1; cnt <= vdf_num; cnt++,
2080 	    vdf = (Verdef *)((uintptr_t)vdf + vdf->vd_next)) {
2081 		Conv_ver_flags_buf_t	ver_flags_buf;
2082 		const char		*name, *dep;
2083 		Half			vcnt = vdf->vd_cnt - 1;
2084 		Half			ndx = vdf->vd_ndx;
2085 		Verdaux	*vdap = (Verdaux *)((uintptr_t)vdf + vdf->vd_aux);
2086 
2087 		/*
2088 		 * Obtain the name and first dependency (if any).
2089 		 */
2090 		name = string(vcache, cnt, scache, file, vdap->vda_name);
2091 		vdap = (Verdaux *)((uintptr_t)vdap + vdap->vda_next);
2092 		if (vcnt)
2093 			dep = string(vcache, cnt, scache, file, vdap->vda_name);
2094 		else
2095 			dep = MSG_ORIG(MSG_STR_EMPTY);
2096 
2097 		(void) snprintf(index, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX),
2098 		    EC_XWORD(ndx));
2099 		Elf_ver_line_1(0, index, name, dep,
2100 		    conv_ver_flags(vdf->vd_flags, 0, &ver_flags_buf));
2101 
2102 		/*
2103 		 * Print any additional dependencies.
2104 		 */
2105 		if (vcnt) {
2106 			vdap = (Verdaux *)((uintptr_t)vdap + vdap->vda_next);
2107 			for (vcnt--; vcnt; vcnt--,
2108 			    vdap = (Verdaux *)((uintptr_t)vdap +
2109 			    vdap->vda_next)) {
2110 				dep = string(vcache, cnt, scache, file,
2111 				    vdap->vda_name);
2112 				Elf_ver_line_2(0, MSG_ORIG(MSG_STR_EMPTY), dep);
2113 			}
2114 		}
2115 	}
2116 }
2117 
2118 /*
2119  * Print version needed section entries.
2120  *
2121  * entry:
2122  *	vnd - Address of verneed data
2123  *	vnd_num - # of Verneed entries
2124  *	vcache - Cache of verneed section being processed
2125  *	scache - Cache of associated string table section
2126  *	file - Name of object being processed.
2127  *	versym - Information about versym section
2128  *
2129  * exit:
2130  *	The versions have been printed. If GNU style versioning
2131  *	is in effect, versym->max_verndx has been updated to
2132  *	contain the largest version index seen.
2133  *
2134  * note:
2135  * 	The versym section of an object that follows the original
2136  *	Solaris versioning rules only contains indexes into the verdef
2137  *	section. Symbols defined in other objects (UNDEF) are given
2138  *	a version of 0, indicating that they are not defined by
2139  *	this file, and the Verneed entries do not have associated version
2140  *	indexes. For these reasons, we do not display a version index
2141  *	for original-style Verneed sections.
2142  *
2143  *	The GNU versioning extensions alter this: Symbols defined in other
2144  *	objects receive a version index in the range above those defined
2145  *	by the Verdef section, and the vna_other field of the Vernaux
2146  *	structs inside the Verneed section contain the version index for
2147  *	that item. We therefore  display the index when showing the
2148  *	contents of a GNU style Verneed section. You should not
2149  *	necessarily expect these indexes to appear in sorted
2150  *	order --- it seems that the GNU ld assigns the versions as
2151  *	symbols are encountered during linking, and then the results
2152  *	are assembled into the Verneed section afterwards.
2153  */
2154 static void
version_need(Verneed * vnd,Word vnd_num,Cache * vcache,Cache * scache,const char * file,VERSYM_STATE * versym)2155 version_need(Verneed *vnd, Word vnd_num, Cache *vcache, Cache *scache,
2156     const char *file, VERSYM_STATE *versym)
2157 {
2158 	Word		cnt;
2159 	char		index[MAXNDXSIZE];
2160 	const char	*index_str;
2161 
2162 	Elf_ver_need_title(0, versym->gnu_needed);
2163 
2164 	for (cnt = 1; cnt <= vnd_num; cnt++,
2165 	    vnd = (Verneed *)((uintptr_t)vnd + vnd->vn_next)) {
2166 		Conv_ver_flags_buf_t	ver_flags_buf;
2167 		const char		*name, *dep;
2168 		Half			vcnt = vnd->vn_cnt;
2169 		Vernaux *vnap = (Vernaux *)((uintptr_t)vnd + vnd->vn_aux);
2170 
2171 		/*
2172 		 * Obtain the name of the needed file and the version name
2173 		 * within it that we're dependent on.  Note that the count
2174 		 * should be at least one, otherwise this is a pretty bogus
2175 		 * entry.
2176 		 */
2177 		name = string(vcache, cnt, scache, file, vnd->vn_file);
2178 		if (vcnt)
2179 			dep = string(vcache, cnt, scache, file, vnap->vna_name);
2180 		else
2181 			dep = MSG_INTL(MSG_STR_NULL);
2182 
2183 		if (vnap->vna_other == 0) {	/* Traditional form */
2184 			index_str = MSG_ORIG(MSG_STR_EMPTY);
2185 		} else {			/* GNU form */
2186 			index_str = index;
2187 			/* Format the version index value */
2188 			(void) snprintf(index, MAXNDXSIZE,
2189 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(vnap->vna_other));
2190 			if (vnap->vna_other > versym->max_verndx)
2191 				versym->max_verndx = vnap->vna_other;
2192 		}
2193 		Elf_ver_line_1(0, index_str, name, dep,
2194 		    conv_ver_flags(vnap->vna_flags, 0, &ver_flags_buf));
2195 
2196 		/*
2197 		 * Print any additional version dependencies.
2198 		 */
2199 		if (vcnt) {
2200 			vnap = (Vernaux *)((uintptr_t)vnap + vnap->vna_next);
2201 			for (vcnt--; vcnt; vcnt--,
2202 			    vnap = (Vernaux *)((uintptr_t)vnap +
2203 			    vnap->vna_next)) {
2204 				dep = string(vcache, cnt, scache, file,
2205 				    vnap->vna_name);
2206 				if (vnap->vna_other > 0) {
2207 					/* Format the next index value */
2208 					(void) snprintf(index, MAXNDXSIZE,
2209 					    MSG_ORIG(MSG_FMT_INDEX),
2210 					    EC_XWORD(vnap->vna_other));
2211 					Elf_ver_line_1(0, index,
2212 					    MSG_ORIG(MSG_STR_EMPTY), dep,
2213 					    conv_ver_flags(vnap->vna_flags,
2214 					    0, &ver_flags_buf));
2215 					if (vnap->vna_other >
2216 					    versym->max_verndx)
2217 						versym->max_verndx =
2218 						    vnap->vna_other;
2219 				} else {
2220 					Elf_ver_line_3(0,
2221 					    MSG_ORIG(MSG_STR_EMPTY), dep,
2222 					    conv_ver_flags(vnap->vna_flags,
2223 					    0, &ver_flags_buf));
2224 				}
2225 			}
2226 		}
2227 	}
2228 }
2229 
2230 /*
2231  * Examine the Verneed section for information related to GNU
2232  * style Versym indexing:
2233  *	- A non-zero vna_other field indicates that Versym indexes can
2234  *		reference Verneed records.
2235  *	- If the object uses GNU style Versym indexing, the
2236  *	  maximum index value is needed to detect bad Versym entries.
2237  *
2238  * entry:
2239  *	vnd - Address of verneed data
2240  *	vnd_num - # of Verneed entries
2241  *	versym - Information about versym section
2242  *
2243  * exit:
2244  *	If a non-zero vna_other field is seen, versym->gnu_needed is set.
2245  *
2246  *	versym->max_verndx has been updated to contain the largest
2247  *	version index seen.
2248  */
2249 static void
update_gnu_verndx(Verneed * vnd,Word vnd_num,VERSYM_STATE * versym)2250 update_gnu_verndx(Verneed *vnd, Word vnd_num, VERSYM_STATE *versym)
2251 {
2252 	Word		cnt;
2253 
2254 	for (cnt = 1; cnt <= vnd_num; cnt++,
2255 	    vnd = (Verneed *)((uintptr_t)vnd + vnd->vn_next)) {
2256 		Half	vcnt = vnd->vn_cnt;
2257 		Vernaux	*vnap = (Vernaux *)((uintptr_t)vnd + vnd->vn_aux);
2258 
2259 		/*
2260 		 * A non-zero value of vna_other indicates that this
2261 		 * object references VERNEED items from the VERSYM
2262 		 * array.
2263 		 */
2264 		if (vnap->vna_other != 0) {
2265 			versym->gnu_needed = 1;
2266 			if (vnap->vna_other > versym->max_verndx)
2267 				versym->max_verndx = vnap->vna_other;
2268 		}
2269 
2270 		/*
2271 		 * Check any additional version dependencies.
2272 		 */
2273 		if (vcnt) {
2274 			vnap = (Vernaux *)((uintptr_t)vnap + vnap->vna_next);
2275 			for (vcnt--; vcnt; vcnt--,
2276 			    vnap = (Vernaux *)((uintptr_t)vnap +
2277 			    vnap->vna_next)) {
2278 				if (vnap->vna_other == 0)
2279 					continue;
2280 
2281 				versym->gnu_needed = 1;
2282 				if (vnap->vna_other > versym->max_verndx)
2283 					versym->max_verndx = vnap->vna_other;
2284 			}
2285 		}
2286 	}
2287 }
2288 
2289 /*
2290  * Display version section information if the flags require it.
2291  * Return version information needed by other output.
2292  *
2293  * entry:
2294  *	cache - Cache of all section headers
2295  *	shnum - # of sections in cache
2296  *	file - Name of file
2297  *	flags - Command line option flags
2298  *	versym - VERSYM_STATE block to be filled in.
2299  */
2300 static void
versions(Cache * cache,Word shnum,const char * file,uint_t flags,VERSYM_STATE * versym)2301 versions(Cache *cache, Word shnum, const char *file, uint_t flags,
2302     VERSYM_STATE *versym)
2303 {
2304 	GElf_Word	cnt;
2305 	Cache		*verdef_cache = NULL, *verneed_cache = NULL;
2306 
2307 
2308 	/* Gather information about the version sections */
2309 	versym->max_verndx = 1;
2310 	for (cnt = 1; cnt < shnum; cnt++) {
2311 		Cache		*_cache = &cache[cnt];
2312 		Shdr		*shdr = _cache->c_shdr;
2313 		Dyn		*dyn;
2314 		ulong_t		numdyn;
2315 
2316 		switch (shdr->sh_type) {
2317 		case SHT_DYNAMIC:
2318 			/*
2319 			 * The GNU ld puts a DT_VERSYM entry in the dynamic
2320 			 * section so that the runtime linker can use it to
2321 			 * implement their versioning rules. They allow multiple
2322 			 * incompatible functions with the same name to exist
2323 			 * in different versions. The Solaris ld does not
2324 			 * support this mechanism, and as such, does not
2325 			 * produce DT_VERSYM. We use this fact to determine
2326 			 * which ld produced this object, and how to interpret
2327 			 * the version values.
2328 			 */
2329 			if ((shdr->sh_entsize == 0) ||
2330 			    (shdr->sh_size == 0) ||
2331 			    (_cache->c_data == NULL) ||
2332 			    (_cache->c_data->d_buf == NULL))
2333 				continue;
2334 			numdyn = shdr->sh_size / shdr->sh_entsize;
2335 			dyn = (Dyn *)_cache->c_data->d_buf;
2336 			for (; numdyn-- > 0; dyn++)
2337 				if (dyn->d_tag == DT_VERSYM) {
2338 					versym->gnu_full =
2339 					    versym->gnu_needed = 1;
2340 					break;
2341 				}
2342 			break;
2343 
2344 		case SHT_SUNW_versym:
2345 			/* Record data address for later symbol processing */
2346 			if (_cache->c_data != NULL) {
2347 				versym->cache = _cache;
2348 				versym->data = _cache->c_data->d_buf;
2349 				continue;
2350 			}
2351 			break;
2352 
2353 		case SHT_SUNW_verdef:
2354 		case SHT_SUNW_verneed:
2355 			/*
2356 			 * Ensure the data is non-NULL and the number
2357 			 * of items is non-zero. Otherwise, we don't
2358 			 * understand the section, and will not use it.
2359 			 */
2360 			if ((_cache->c_data == NULL) ||
2361 			    (_cache->c_data->d_buf == NULL)) {
2362 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2363 				    file, _cache->c_name);
2364 				continue;
2365 			}
2366 			if (shdr->sh_info == 0) {
2367 				(void) fprintf(stderr,
2368 				    MSG_INTL(MSG_ERR_BADSHINFO),
2369 				    file, _cache->c_name,
2370 				    EC_WORD(shdr->sh_info));
2371 				continue;
2372 			}
2373 
2374 			/* Make sure the string table index is in range */
2375 			if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
2376 				(void) fprintf(stderr,
2377 				    MSG_INTL(MSG_ERR_BADSHLINK), file,
2378 				    _cache->c_name, EC_WORD(shdr->sh_link));
2379 				continue;
2380 			}
2381 
2382 			/*
2383 			 * The section is usable. Save the cache entry.
2384 			 */
2385 			if (shdr->sh_type == SHT_SUNW_verdef) {
2386 				verdef_cache = _cache;
2387 				/*
2388 				 * Under Solaris rules, if there is a verdef
2389 				 * section, the max versym index is number
2390 				 * of version definitions it supplies.
2391 				 */
2392 				versym->max_verndx = shdr->sh_info;
2393 			} else {
2394 				verneed_cache = _cache;
2395 			}
2396 			break;
2397 		}
2398 	}
2399 
2400 	/*
2401 	 * If there is a Verneed section, examine it for information
2402 	 * related to GNU style versioning.
2403 	 */
2404 	if (verneed_cache != NULL)
2405 		update_gnu_verndx((Verneed *)verneed_cache->c_data->d_buf,
2406 		    verneed_cache->c_shdr->sh_info, versym);
2407 
2408 	/*
2409 	 * Now that all the information is available, display the
2410 	 * Verdef and Verneed section contents, if requested.
2411 	 */
2412 	if ((flags & FLG_SHOW_VERSIONS) == 0)
2413 		return;
2414 	if (verdef_cache != NULL) {
2415 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2416 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_VERDEF),
2417 		    verdef_cache->c_name);
2418 		version_def((Verdef *)verdef_cache->c_data->d_buf,
2419 		    verdef_cache->c_shdr->sh_info, verdef_cache,
2420 		    &cache[verdef_cache->c_shdr->sh_link], file);
2421 	}
2422 	if (verneed_cache != NULL) {
2423 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2424 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_VERNEED),
2425 		    verneed_cache->c_name);
2426 		/*
2427 		 * If GNU versioning applies to this object, version_need()
2428 		 * will update versym->max_verndx, and it is not
2429 		 * necessary to call update_gnu_verndx().
2430 		 */
2431 		version_need((Verneed *)verneed_cache->c_data->d_buf,
2432 		    verneed_cache->c_shdr->sh_info, verneed_cache,
2433 		    &cache[verneed_cache->c_shdr->sh_link], file, versym);
2434 	}
2435 }
2436 
2437 /*
2438  * Search for and process any symbol tables.
2439  */
2440 void
symbols(Cache * cache,Word shnum,Ehdr * ehdr,uchar_t osabi,VERSYM_STATE * versym,const char * file,uint_t flags)2441 symbols(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi,
2442     VERSYM_STATE *versym, const char *file, uint_t flags)
2443 {
2444 	SYMTBL_STATE state;
2445 	Cache *_cache;
2446 	Word secndx;
2447 
2448 	for (secndx = 1; secndx < shnum; secndx++) {
2449 		Word		symcnt;
2450 		Shdr		*shdr;
2451 
2452 		_cache = &cache[secndx];
2453 		shdr = _cache->c_shdr;
2454 
2455 		if ((shdr->sh_type != SHT_SYMTAB) &&
2456 		    (shdr->sh_type != SHT_DYNSYM) &&
2457 		    ((shdr->sh_type != SHT_SUNW_LDYNSYM) ||
2458 		    (osabi != ELFOSABI_SOLARIS)))
2459 			continue;
2460 		if (!match(MATCH_F_ALL, _cache->c_name, secndx, shdr->sh_type))
2461 			continue;
2462 
2463 		if (!init_symtbl_state(&state, cache, shnum, secndx, ehdr,
2464 		    osabi, versym, file, flags))
2465 			continue;
2466 		/*
2467 		 * Loop through the symbol tables entries.
2468 		 */
2469 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2470 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMTAB), state.secname);
2471 		Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
2472 
2473 		for (symcnt = 0; symcnt < state.symn; symcnt++)
2474 			output_symbol(&state, symcnt, shdr->sh_info, symcnt,
2475 			    state.sym + symcnt);
2476 	}
2477 }
2478 
2479 /*
2480  * Search for and process any SHT_SUNW_symsort or SHT_SUNW_tlssort sections.
2481  * These sections are always associated with the .SUNW_ldynsym./.dynsym pair.
2482  */
2483 static void
sunw_sort(Cache * cache,Word shnum,Ehdr * ehdr,uchar_t osabi,VERSYM_STATE * versym,const char * file,uint_t flags)2484 sunw_sort(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi,
2485     VERSYM_STATE *versym, const char *file, uint_t flags)
2486 {
2487 	SYMTBL_STATE	ldynsym_state,	dynsym_state;
2488 	Cache		*sortcache,	*symcache;
2489 	Shdr		*sortshdr,	*symshdr;
2490 	Word		sortsecndx,	symsecndx;
2491 	Word		ldynsym_cnt;
2492 	Word		*ndx;
2493 	Word		ndxn;
2494 	int		output_cnt = 0;
2495 	Conv_inv_buf_t	inv_buf;
2496 
2497 	for (sortsecndx = 1; sortsecndx < shnum; sortsecndx++) {
2498 
2499 		sortcache = &cache[sortsecndx];
2500 		sortshdr = sortcache->c_shdr;
2501 
2502 		if ((sortshdr->sh_type != SHT_SUNW_symsort) &&
2503 		    (sortshdr->sh_type != SHT_SUNW_tlssort))
2504 			continue;
2505 		if (!match(MATCH_F_ALL, sortcache->c_name, sortsecndx,
2506 		    sortshdr->sh_type))
2507 			continue;
2508 
2509 		/*
2510 		 * If the section references a SUNW_ldynsym, then we
2511 		 * expect to see the associated .dynsym immediately
2512 		 * following. If it references a .dynsym, there is no
2513 		 * SUNW_ldynsym. If it is any other type, then we don't
2514 		 * know what to do with it.
2515 		 */
2516 		if ((sortshdr->sh_link == 0) || (sortshdr->sh_link >= shnum)) {
2517 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
2518 			    file, sortcache->c_name,
2519 			    EC_WORD(sortshdr->sh_link));
2520 			continue;
2521 		}
2522 		symcache = &cache[sortshdr->sh_link];
2523 		symshdr = symcache->c_shdr;
2524 		symsecndx = sortshdr->sh_link;
2525 		ldynsym_cnt = 0;
2526 		switch (symshdr->sh_type) {
2527 		case SHT_SUNW_LDYNSYM:
2528 			if (!init_symtbl_state(&ldynsym_state, cache, shnum,
2529 			    symsecndx, ehdr, osabi, versym, file, flags))
2530 				continue;
2531 			ldynsym_cnt = ldynsym_state.symn;
2532 			/*
2533 			 * We know that the dynsym follows immediately
2534 			 * after the SUNW_ldynsym, and so, should be at
2535 			 * (sortshdr->sh_link + 1). However, elfdump is a
2536 			 * diagnostic tool, so we do the full paranoid
2537 			 * search instead.
2538 			 */
2539 			for (symsecndx = 1; symsecndx < shnum; symsecndx++) {
2540 				symcache = &cache[symsecndx];
2541 				symshdr = symcache->c_shdr;
2542 				if (symshdr->sh_type == SHT_DYNSYM)
2543 					break;
2544 			}
2545 			if (symsecndx >= shnum) {	/* Dynsym not found! */
2546 				(void) fprintf(stderr,
2547 				    MSG_INTL(MSG_ERR_NODYNSYM),
2548 				    file, sortcache->c_name);
2549 				continue;
2550 			}
2551 			/* Fallthrough to process associated dynsym */
2552 			/* FALLTHROUGH */
2553 		case SHT_DYNSYM:
2554 			if (!init_symtbl_state(&dynsym_state, cache, shnum,
2555 			    symsecndx, ehdr, osabi, versym, file, flags))
2556 				continue;
2557 			break;
2558 		default:
2559 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADNDXSEC),
2560 			    file, sortcache->c_name,
2561 			    conv_sec_type(osabi, ehdr->e_machine,
2562 			    symshdr->sh_type, 0, &inv_buf));
2563 			continue;
2564 		}
2565 
2566 		/*
2567 		 * Output header
2568 		 */
2569 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2570 		if (ldynsym_cnt > 0) {
2571 			dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMSORT2),
2572 			    sortcache->c_name, ldynsym_state.secname,
2573 			    dynsym_state.secname);
2574 			/*
2575 			 * The data for .SUNW_ldynsym and dynsym sections
2576 			 * is supposed to be adjacent with SUNW_ldynsym coming
2577 			 * first. Check, and issue a warning if it isn't so.
2578 			 */
2579 			if (((ldynsym_state.sym + ldynsym_state.symn)
2580 			    != dynsym_state.sym) &&
2581 			    ((flags & FLG_CTL_FAKESHDR) == 0))
2582 				(void) fprintf(stderr,
2583 				    MSG_INTL(MSG_ERR_LDYNNOTADJ), file,
2584 				    ldynsym_state.secname,
2585 				    dynsym_state.secname);
2586 		} else {
2587 			dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMSORT1),
2588 			    sortcache->c_name, dynsym_state.secname);
2589 		}
2590 		Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
2591 
2592 		/* If not first one, insert a line of white space */
2593 		if (output_cnt++ > 0)
2594 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2595 
2596 		/*
2597 		 * SUNW_dynsymsort and SUNW_dyntlssort are arrays of
2598 		 * symbol indices. Iterate over the array entries,
2599 		 * dispaying the referenced symbols.
2600 		 */
2601 		ndxn = sortshdr->sh_size / sortshdr->sh_entsize;
2602 		ndx = (Word *)sortcache->c_data->d_buf;
2603 		for (; ndxn-- > 0; ndx++) {
2604 			if (*ndx >= ldynsym_cnt) {
2605 				Word sec_ndx = *ndx - ldynsym_cnt;
2606 
2607 				output_symbol(&dynsym_state, sec_ndx, 0,
2608 				    *ndx, dynsym_state.sym + sec_ndx);
2609 			} else {
2610 				output_symbol(&ldynsym_state, *ndx, 0,
2611 				    *ndx, ldynsym_state.sym + *ndx);
2612 			}
2613 		}
2614 	}
2615 }
2616 
2617 /*
2618  * Search for and process any relocation sections.
2619  */
2620 static void
reloc(Cache * cache,Word shnum,Ehdr * ehdr,const char * file)2621 reloc(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
2622 {
2623 	Word	cnt;
2624 
2625 	for (cnt = 1; cnt < shnum; cnt++) {
2626 		Word		type, symnum;
2627 		Xword		relndx, relnum, relsize;
2628 		void		*rels;
2629 		Sym		*syms;
2630 		Cache		*symsec, *strsec;
2631 		Cache		*_cache = &cache[cnt];
2632 		Shdr		*shdr = _cache->c_shdr;
2633 		char		*relname = _cache->c_name;
2634 		Conv_inv_buf_t	inv_buf;
2635 
2636 		if (((type = shdr->sh_type) != SHT_RELA) &&
2637 		    (type != SHT_REL))
2638 			continue;
2639 		if (!match(MATCH_F_ALL, relname, cnt, type))
2640 			continue;
2641 
2642 		/*
2643 		 * Decide entry size.
2644 		 */
2645 		if (((relsize = shdr->sh_entsize) == 0) ||
2646 		    (relsize > shdr->sh_size)) {
2647 			if (type == SHT_RELA)
2648 				relsize = sizeof (Rela);
2649 			else
2650 				relsize = sizeof (Rel);
2651 		}
2652 
2653 		/*
2654 		 * Determine the number of relocations available.
2655 		 */
2656 		if (shdr->sh_size == 0) {
2657 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2658 			    file, relname);
2659 			continue;
2660 		}
2661 		if ((_cache->c_data == NULL) || (_cache->c_data->d_buf == NULL))
2662 			continue;
2663 
2664 		rels = _cache->c_data->d_buf;
2665 		relnum = shdr->sh_size / relsize;
2666 
2667 		/*
2668 		 * Get the data buffer for the associated symbol table and
2669 		 * string table.
2670 		 */
2671 		if (stringtbl(cache, 1, cnt, shnum, file,
2672 		    &symnum, &symsec, &strsec) == 0)
2673 			continue;
2674 
2675 		syms = symsec->c_data->d_buf;
2676 
2677 		/*
2678 		 * Loop through the relocation entries.
2679 		 */
2680 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2681 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_RELOC), _cache->c_name);
2682 		Elf_reloc_title(0, ELF_DBG_ELFDUMP, type);
2683 
2684 		for (relndx = 0; relndx < relnum; relndx++,
2685 		    rels = (void *)((char *)rels + relsize)) {
2686 			Half		mach = ehdr->e_machine;
2687 			char		section[BUFSIZ];
2688 			const char	*symname;
2689 			Word		symndx, reltype;
2690 			Rela		*rela;
2691 			Rel		*rel;
2692 
2693 			/*
2694 			 * Unravel the relocation and determine the symbol with
2695 			 * which this relocation is associated.
2696 			 */
2697 			if (type == SHT_RELA) {
2698 				rela = (Rela *)rels;
2699 				symndx = ELF_R_SYM(rela->r_info);
2700 				reltype = ELF_R_TYPE(rela->r_info, mach);
2701 			} else {
2702 				rel = (Rel *)rels;
2703 				symndx = ELF_R_SYM(rel->r_info);
2704 				reltype = ELF_R_TYPE(rel->r_info, mach);
2705 			}
2706 
2707 			symname = relsymname(cache, _cache, strsec, symndx,
2708 			    symnum, relndx, syms, section, BUFSIZ, file);
2709 
2710 			/*
2711 			 * A zero symbol index is only valid for a few
2712 			 * relocations.
2713 			 */
2714 			if (symndx == 0) {
2715 				int	badrel = 0;
2716 
2717 				if ((mach == EM_SPARC) ||
2718 				    (mach == EM_SPARC32PLUS) ||
2719 				    (mach == EM_SPARCV9)) {
2720 					if ((reltype != R_SPARC_NONE) &&
2721 					    (reltype != R_SPARC_REGISTER) &&
2722 					    (reltype != R_SPARC_RELATIVE))
2723 						badrel++;
2724 				} else if (mach == EM_386) {
2725 					if ((reltype != R_386_NONE) &&
2726 					    (reltype != R_386_RELATIVE))
2727 						badrel++;
2728 				} else if (mach == EM_AMD64) {
2729 					if ((reltype != R_AMD64_NONE) &&
2730 					    (reltype != R_AMD64_RELATIVE))
2731 						badrel++;
2732 				}
2733 
2734 				if (badrel) {
2735 					(void) fprintf(stderr,
2736 					    MSG_INTL(MSG_ERR_BADREL1), file,
2737 					    conv_reloc_type(mach, reltype,
2738 					    0, &inv_buf));
2739 				}
2740 			}
2741 
2742 			Elf_reloc_entry_1(0, ELF_DBG_ELFDUMP,
2743 			    MSG_ORIG(MSG_STR_EMPTY), ehdr->e_machine, type,
2744 			    rels, relname, symname, 0);
2745 		}
2746 	}
2747 }
2748 
2749 
2750 /*
2751  * This value controls which test dyn_test() performs.
2752  */
2753 typedef enum { DYN_TEST_ADDR, DYN_TEST_SIZE, DYN_TEST_ENTSIZE } dyn_test_t;
2754 
2755 /*
2756  * Used by dynamic() to compare the value of a dynamic element against
2757  * the starting address of the section it references.
2758  *
2759  * entry:
2760  *	test_type - Specify which dyn item is being tested.
2761  *	sh_type - SHT_* type value for required section.
2762  *	sec_cache - Cache entry for section, or NULL if the object lacks
2763  *		a section of this type.
2764  *	dyn - Dyn entry to be tested
2765  *	dynsec_cnt - # of dynamic section being examined. The first
2766  *		dynamic section is 1, the next is 2, and so on...
2767  *	ehdr - ELF header for file
2768  *	file - Name of file
2769  */
2770 static void
dyn_test(dyn_test_t test_type,Word sh_type,Cache * sec_cache,Dyn * dyn,Word dynsec_cnt,Ehdr * ehdr,uchar_t osabi,const char * file)2771 dyn_test(dyn_test_t test_type, Word sh_type, Cache *sec_cache, Dyn *dyn,
2772     Word dynsec_cnt, Ehdr *ehdr, uchar_t osabi, const char *file)
2773 {
2774 	Conv_inv_buf_t	buf1, buf2;
2775 
2776 	/*
2777 	 * These tests are based around the implicit assumption that
2778 	 * there is only one dynamic section in an object, and also only
2779 	 * one of the sections it references. We have therefore gathered
2780 	 * all of the necessary information to test this in a single pass
2781 	 * over the section headers, which is very efficient. We are not
2782 	 * aware of any case where more than one dynamic section would
2783 	 * be meaningful in an ELF object, so this is a reasonable solution.
2784 	 *
2785 	 * To test multiple dynamic sections correctly would be more
2786 	 * expensive in code and time. We would have to build a data structure
2787 	 * containing all the dynamic elements. Then, we would use the address
2788 	 * to locate the section it references and ensure the section is of
2789 	 * the right type and that the address in the dynamic element is
2790 	 * to the start of the section. Then, we could check the size and
2791 	 * entsize values against those same sections. This is O(n^2), and
2792 	 * also complicated.
2793 	 *
2794 	 * In the highly unlikely case that there is more than one dynamic
2795 	 * section, we only test the first one, and simply allow the values
2796 	 * of the subsequent one to be displayed unchallenged.
2797 	 */
2798 	if (dynsec_cnt != 1)
2799 		return;
2800 
2801 	/*
2802 	 * A DT_ item that references a section address should always find
2803 	 * the section in the file.
2804 	 */
2805 	if (sec_cache == NULL) {
2806 		const char *name;
2807 
2808 		/*
2809 		 * Supply section names instead of section types for
2810 		 * things that reference progbits so that the error
2811 		 * message will make more sense.
2812 		 */
2813 		switch (dyn->d_tag) {
2814 		case DT_INIT:
2815 			name = MSG_ORIG(MSG_ELF_INIT);
2816 			break;
2817 		case DT_FINI:
2818 			name = MSG_ORIG(MSG_ELF_FINI);
2819 			break;
2820 		default:
2821 			name = conv_sec_type(osabi, ehdr->e_machine,
2822 			    sh_type, 0, &buf1);
2823 			break;
2824 		}
2825 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_DYNNOBCKSEC), file,
2826 		    name, conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2827 		    CONV_FMT_ALT_CF, &buf2));
2828 		return;
2829 	}
2830 
2831 
2832 	switch (test_type) {
2833 	case DYN_TEST_ADDR:
2834 		/* The section address should match the DT_ item value */
2835 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_addr)
2836 			(void) fprintf(stderr,
2837 			    MSG_INTL(MSG_ERR_DYNBADADDR), file,
2838 			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2839 			    CONV_FMT_ALT_CF, &buf1), EC_ADDR(dyn->d_un.d_val),
2840 			    sec_cache->c_ndx, sec_cache->c_name,
2841 			    EC_ADDR(sec_cache->c_shdr->sh_addr));
2842 		break;
2843 
2844 	case DYN_TEST_SIZE:
2845 		/* The section size should match the DT_ item value */
2846 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_size)
2847 			(void) fprintf(stderr,
2848 			    MSG_INTL(MSG_ERR_DYNBADSIZE), file,
2849 			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2850 			    CONV_FMT_ALT_CF, &buf1), EC_XWORD(dyn->d_un.d_val),
2851 			    sec_cache->c_ndx, sec_cache->c_name,
2852 			    EC_XWORD(sec_cache->c_shdr->sh_size));
2853 		break;
2854 
2855 	case DYN_TEST_ENTSIZE:
2856 		/* The sh_entsize value should match the DT_ item value */
2857 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_entsize)
2858 			(void) fprintf(stderr,
2859 			    MSG_INTL(MSG_ERR_DYNBADENTSIZE), file,
2860 			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2861 			    CONV_FMT_ALT_CF, &buf1), EC_XWORD(dyn->d_un.d_val),
2862 			    sec_cache->c_ndx, sec_cache->c_name,
2863 			    EC_XWORD(sec_cache->c_shdr->sh_entsize));
2864 		break;
2865 	}
2866 }
2867 
2868 /*
2869  * There are some DT_ entries that have corresponding symbols
2870  * (e.g. DT_INIT and _init). It is expected that these items will
2871  * both have the same value if both are present. This routine
2872  * examines the well known symbol tables for such symbols and
2873  * issues warnings for any that don't match.
2874  *
2875  * entry:
2876  *	dyn - Dyn entry to be tested
2877  *	symname - Name of symbol that corresponds to dyn
2878  *	symtab_cache, dynsym_cache, ldynsym_cache - Symbol tables to check
2879  *	target_cache - Section the symname section is expected to be
2880  *		associated with.
2881  *	cache - Cache of all section headers
2882  *	shnum - # of sections in cache
2883  *	ehdr - ELF header for file
2884  *	osabi - OSABI to apply when interpreting object
2885  *	file - Name of file
2886  */
2887 static void
dyn_symtest(Dyn * dyn,const char * symname,Cache * symtab_cache,Cache * dynsym_cache,Cache * ldynsym_cache,Cache * target_cache,Cache * cache,Word shnum,Ehdr * ehdr,uchar_t osabi,const char * file)2888 dyn_symtest(Dyn *dyn, const char *symname, Cache *symtab_cache,
2889     Cache *dynsym_cache, Cache *ldynsym_cache, Cache *target_cache,
2890     Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
2891 {
2892 	Conv_inv_buf_t	buf;
2893 	int		i;
2894 	Sym		*sym;
2895 	Cache		*_cache;
2896 
2897 	for (i = 0; i < 3; i++) {
2898 		switch (i) {
2899 		case 0:
2900 			_cache = symtab_cache;
2901 			break;
2902 		case 1:
2903 			_cache = dynsym_cache;
2904 			break;
2905 		case 2:
2906 			_cache = ldynsym_cache;
2907 			break;
2908 		}
2909 
2910 		if ((_cache != NULL) &&
2911 		    symlookup(symname, cache, shnum, &sym, target_cache,
2912 		    _cache, file) && (sym->st_value != dyn->d_un.d_val))
2913 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DYNSYMVAL),
2914 			    file, _cache->c_name, conv_dyn_tag(dyn->d_tag,
2915 			    osabi, ehdr->e_machine, CONV_FMT_ALT_CF, &buf),
2916 			    symname, EC_ADDR(sym->st_value));
2917 	}
2918 }
2919 
2920 /*
2921  * Search for and process a .dynamic section.
2922  */
2923 static void
dynamic(Cache * cache,Word shnum,Ehdr * ehdr,uchar_t osabi,const char * file)2924 dynamic(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
2925 {
2926 	struct {
2927 		Cache	*symtab;
2928 		Cache	*dynstr;
2929 		Cache	*dynsym;
2930 		Cache	*hash;
2931 		Cache	*fini;
2932 		Cache	*fini_array;
2933 		Cache	*init;
2934 		Cache	*init_array;
2935 		Cache	*preinit_array;
2936 		Cache	*rel;
2937 		Cache	*rela;
2938 		Cache	*sunw_cap;
2939 		Cache	*sunw_capinfo;
2940 		Cache	*sunw_capchain;
2941 		Cache	*sunw_ldynsym;
2942 		Cache	*sunw_move;
2943 		Cache	*sunw_syminfo;
2944 		Cache	*sunw_symsort;
2945 		Cache	*sunw_tlssort;
2946 		Cache	*sunw_verdef;
2947 		Cache	*sunw_verneed;
2948 		Cache	*sunw_versym;
2949 	} sec;
2950 	Word	dynsec_ndx;
2951 	Word	dynsec_num;
2952 	int	dynsec_cnt;
2953 	Word	cnt;
2954 	int	osabi_solaris = osabi == ELFOSABI_SOLARIS;
2955 
2956 	/*
2957 	 * Make a pass over all the sections, gathering section information
2958 	 * we'll need below.
2959 	 */
2960 	dynsec_num = 0;
2961 	bzero(&sec, sizeof (sec));
2962 	for (cnt = 1; cnt < shnum; cnt++) {
2963 		Cache	*_cache = &cache[cnt];
2964 
2965 		switch (_cache->c_shdr->sh_type) {
2966 		case SHT_DYNAMIC:
2967 			if (dynsec_num == 0) {
2968 				dynsec_ndx = cnt;
2969 
2970 				/* Does it have a valid string table? */
2971 				(void) stringtbl(cache, 0, cnt, shnum, file,
2972 				    0, 0, &sec.dynstr);
2973 			}
2974 			dynsec_num++;
2975 			break;
2976 
2977 
2978 		case SHT_PROGBITS:
2979 			/*
2980 			 * We want to detect the .init and .fini sections,
2981 			 * if present. These are SHT_PROGBITS, so all we
2982 			 * have to go on is the section name. Normally comparing
2983 			 * names is a bad idea, but there are some special
2984 			 * names (i.e. .init/.fini/.interp) that are very
2985 			 * difficult to use in any other context, and for
2986 			 * these symbols, we do the heuristic match.
2987 			 */
2988 			if (strcmp(_cache->c_name,
2989 			    MSG_ORIG(MSG_ELF_INIT)) == 0) {
2990 				if (sec.init == NULL)
2991 					sec.init = _cache;
2992 			} else if (strcmp(_cache->c_name,
2993 			    MSG_ORIG(MSG_ELF_FINI)) == 0) {
2994 				if (sec.fini == NULL)
2995 					sec.fini = _cache;
2996 			}
2997 			break;
2998 
2999 		case SHT_REL:
3000 			/*
3001 			 * We want the SHT_REL section with the lowest
3002 			 * offset. The linker gathers them together,
3003 			 * and puts the address of the first one
3004 			 * into the DT_REL dynamic element.
3005 			 */
3006 			if ((sec.rel == NULL) ||
3007 			    (_cache->c_shdr->sh_offset <
3008 			    sec.rel->c_shdr->sh_offset))
3009 				sec.rel = _cache;
3010 			break;
3011 
3012 		case SHT_RELA:
3013 			/* RELA is handled just like RELA above */
3014 			if ((sec.rela == NULL) ||
3015 			    (_cache->c_shdr->sh_offset <
3016 			    sec.rela->c_shdr->sh_offset))
3017 				sec.rela = _cache;
3018 			break;
3019 
3020 		/*
3021 		 * The GRAB macro is used for the simple case in which
3022 		 * we simply grab the first section of the desired type.
3023 		 */
3024 #define	GRAB(_sec_type, _sec_field) \
3025 		case _sec_type: \
3026 			if (sec._sec_field == NULL) \
3027 				sec._sec_field = _cache; \
3028 				break
3029 		GRAB(SHT_SYMTAB,	symtab);
3030 		GRAB(SHT_DYNSYM,	dynsym);
3031 		GRAB(SHT_FINI_ARRAY,	fini_array);
3032 		GRAB(SHT_HASH,		hash);
3033 		GRAB(SHT_INIT_ARRAY,	init_array);
3034 		GRAB(SHT_SUNW_move,	sunw_move);
3035 		GRAB(SHT_PREINIT_ARRAY,	preinit_array);
3036 		GRAB(SHT_SUNW_cap,	sunw_cap);
3037 		GRAB(SHT_SUNW_capinfo,	sunw_capinfo);
3038 		GRAB(SHT_SUNW_capchain,	sunw_capchain);
3039 		GRAB(SHT_SUNW_LDYNSYM,	sunw_ldynsym);
3040 		GRAB(SHT_SUNW_syminfo,	sunw_syminfo);
3041 		GRAB(SHT_SUNW_symsort,	sunw_symsort);
3042 		GRAB(SHT_SUNW_tlssort,	sunw_tlssort);
3043 		GRAB(SHT_SUNW_verdef,	sunw_verdef);
3044 		GRAB(SHT_SUNW_verneed,	sunw_verneed);
3045 		GRAB(SHT_SUNW_versym,	sunw_versym);
3046 #undef GRAB
3047 		}
3048 	}
3049 
3050 	/*
3051 	 * If no dynamic section, return immediately. If more than one
3052 	 * dynamic section, then something odd is going on and an error
3053 	 * is in order, but then continue on and display them all.
3054 	 */
3055 	if (dynsec_num == 0)
3056 		return;
3057 	if (dynsec_num > 1)
3058 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MULTDYN),
3059 		    file, EC_WORD(dynsec_num));
3060 
3061 
3062 	dynsec_cnt = 0;
3063 	for (cnt = dynsec_ndx; (cnt < shnum) && (dynsec_cnt < dynsec_num);
3064 	    cnt++) {
3065 		Dyn	*dyn;
3066 		ulong_t	numdyn;
3067 		int	ndx, end_ndx;
3068 		Cache	*_cache = &cache[cnt], *strsec;
3069 		Shdr	*shdr = _cache->c_shdr;
3070 		int	dumped = 0;
3071 
3072 		if (shdr->sh_type != SHT_DYNAMIC)
3073 			continue;
3074 		dynsec_cnt++;
3075 
3076 		/*
3077 		 * Verify the associated string table section.
3078 		 */
3079 		if (stringtbl(cache, 0, cnt, shnum, file, 0, 0, &strsec) == 0)
3080 			continue;
3081 
3082 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
3083 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3084 			    file, _cache->c_name);
3085 			continue;
3086 		}
3087 		if ((_cache->c_data == NULL) || (_cache->c_data->d_buf == NULL))
3088 			continue;
3089 
3090 		numdyn = shdr->sh_size / shdr->sh_entsize;
3091 		dyn = (Dyn *)_cache->c_data->d_buf;
3092 
3093 		/*
3094 		 * We expect the REL/RELA entries to reference the reloc
3095 		 * section with the lowest address. However, this is
3096 		 * not true for dumped objects. Detect if this object has
3097 		 * been dumped so that we can skip the reloc address test
3098 		 * in that case.
3099 		 */
3100 		for (ndx = 0; ndx < numdyn; dyn++, ndx++) {
3101 			if (dyn->d_tag == DT_FLAGS_1) {
3102 				dumped = (dyn->d_un.d_val & DF_1_CONFALT) != 0;
3103 				break;
3104 			}
3105 		}
3106 		dyn = (Dyn *)_cache->c_data->d_buf;
3107 
3108 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3109 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_DYNAMIC), _cache->c_name);
3110 
3111 		Elf_dyn_title(0);
3112 
3113 		for (ndx = 0; ndx < numdyn; dyn++, ndx++) {
3114 			union {
3115 				Conv_inv_buf_t		inv;
3116 				Conv_dyn_flag_buf_t	flag;
3117 				Conv_dyn_flag1_buf_t	flag1;
3118 				Conv_dyn_posflag1_buf_t	posflag1;
3119 				Conv_dyn_feature1_buf_t	feature1;
3120 			} c_buf;
3121 			const char	*name = NULL;
3122 
3123 			/*
3124 			 * Print the information numerically, and if possible
3125 			 * as a string. If a string is available, name is
3126 			 * set to reference it.
3127 			 *
3128 			 * Also, take this opportunity to sanity check
3129 			 * the values of DT elements. In the code above,
3130 			 * we gathered information on sections that are
3131 			 * referenced by the dynamic section. Here, we
3132 			 * compare the attributes of those sections to
3133 			 * the DT_ items that reference them and report
3134 			 * on inconsistencies.
3135 			 *
3136 			 * Things not currently tested that could be improved
3137 			 * in later revisions include:
3138 			 *	- We don't check PLT or GOT related items
3139 			 *	- We don't handle computing the lengths of
3140 			 *		relocation arrays. To handle this
3141 			 *		requires examining data that spans
3142 			 *		across sections, in a contiguous span
3143 			 *		within a single segment.
3144 			 *	- DT_VERDEFNUM and DT_VERNEEDNUM can't be
3145 			 *		verified without parsing the sections.
3146 			 *	- We don't handle DT_SUNW_SYMSZ, which would
3147 			 *		be the sum of the lengths of .dynsym and
3148 			 *		.SUNW_ldynsym
3149 			 *	- DT_SUNW_STRPAD can't be verified other than
3150 			 *		to check that it's not larger than
3151 			 *		the string table.
3152 			 *	- Some items come in "all or none" clusters
3153 			 *		that give an address, element size,
3154 			 *		and data length in bytes. We don't
3155 			 *		verify that there are no missing items
3156 			 *		in such groups.
3157 			 */
3158 			switch (dyn->d_tag) {
3159 			case DT_NULL:
3160 				/*
3161 				 * Special case: DT_NULLs can come in groups
3162 				 * that we prefer to reduce to a single line.
3163 				 */
3164 				end_ndx = ndx;
3165 				while ((end_ndx < (numdyn - 1)) &&
3166 				    ((dyn + 1)->d_tag == DT_NULL)) {
3167 					dyn++;
3168 					end_ndx++;
3169 				}
3170 				Elf_dyn_null_entry(0, dyn, ndx, end_ndx);
3171 				ndx = end_ndx;
3172 				continue;
3173 
3174 			/*
3175 			 * String items all reference the dynstr. The string()
3176 			 * function does the necessary sanity checking.
3177 			 */
3178 			case DT_NEEDED:
3179 			case DT_SONAME:
3180 			case DT_FILTER:
3181 			case DT_AUXILIARY:
3182 			case DT_CONFIG:
3183 			case DT_RPATH:
3184 			case DT_RUNPATH:
3185 			case DT_USED:
3186 			case DT_DEPAUDIT:
3187 			case DT_AUDIT:
3188 				name = string(_cache, ndx, strsec,
3189 				    file, dyn->d_un.d_ptr);
3190 				break;
3191 
3192 			case DT_SUNW_AUXILIARY:
3193 			case DT_SUNW_FILTER:
3194 				if (osabi_solaris)
3195 					name = string(_cache, ndx, strsec,
3196 					    file, dyn->d_un.d_ptr);
3197 				break;
3198 
3199 			case DT_FLAGS:
3200 				name = conv_dyn_flag(dyn->d_un.d_val,
3201 				    0, &c_buf.flag);
3202 				break;
3203 			case DT_FLAGS_1:
3204 				name = conv_dyn_flag1(dyn->d_un.d_val, 0,
3205 				    &c_buf.flag1);
3206 				break;
3207 			case DT_POSFLAG_1:
3208 				name = conv_dyn_posflag1(dyn->d_un.d_val, 0,
3209 				    &c_buf.posflag1);
3210 				break;
3211 			case DT_FEATURE_1:
3212 				name = conv_dyn_feature1(dyn->d_un.d_val, 0,
3213 				    &c_buf.feature1);
3214 				break;
3215 			case DT_DEPRECATED_SPARC_REGISTER:
3216 				name = MSG_INTL(MSG_STR_DEPRECATED);
3217 				break;
3218 
3219 			case DT_SUNW_LDMACH:
3220 				if (!osabi_solaris)
3221 					break;
3222 				name = conv_ehdr_mach((Half)dyn->d_un.d_val,
3223 				    0, &c_buf.inv);
3224 				break;
3225 
3226 			/*
3227 			 * Cases below this point are strictly sanity checking,
3228 			 * and do not generate a name string. The TEST_ macros
3229 			 * are used to hide the boiler plate arguments neeeded
3230 			 * by dyn_test().
3231 			 */
3232 #define	TEST_ADDR(_sh_type, _sec_field) \
3233 				dyn_test(DYN_TEST_ADDR, _sh_type, \
3234 				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
3235 				    osabi, file)
3236 #define	TEST_SIZE(_sh_type, _sec_field) \
3237 				dyn_test(DYN_TEST_SIZE, _sh_type, \
3238 				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
3239 				    osabi, file)
3240 #define	TEST_ENTSIZE(_sh_type, _sec_field) \
3241 				dyn_test(DYN_TEST_ENTSIZE, _sh_type, \
3242 				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
3243 				    osabi, file)
3244 
3245 			case DT_FINI:
3246 				dyn_symtest(dyn, MSG_ORIG(MSG_SYM_FINI),
3247 				    sec.symtab, sec.dynsym, sec.sunw_ldynsym,
3248 				    sec.fini, cache, shnum, ehdr, osabi, file);
3249 				TEST_ADDR(SHT_PROGBITS, fini);
3250 				break;
3251 
3252 			case DT_FINI_ARRAY:
3253 				TEST_ADDR(SHT_FINI_ARRAY, fini_array);
3254 				break;
3255 
3256 			case DT_FINI_ARRAYSZ:
3257 				TEST_SIZE(SHT_FINI_ARRAY, fini_array);
3258 				break;
3259 
3260 			case DT_HASH:
3261 				TEST_ADDR(SHT_HASH, hash);
3262 				break;
3263 
3264 			case DT_INIT:
3265 				dyn_symtest(dyn, MSG_ORIG(MSG_SYM_INIT),
3266 				    sec.symtab, sec.dynsym, sec.sunw_ldynsym,
3267 				    sec.init, cache, shnum, ehdr, osabi, file);
3268 				TEST_ADDR(SHT_PROGBITS, init);
3269 				break;
3270 
3271 			case DT_INIT_ARRAY:
3272 				TEST_ADDR(SHT_INIT_ARRAY, init_array);
3273 				break;
3274 
3275 			case DT_INIT_ARRAYSZ:
3276 				TEST_SIZE(SHT_INIT_ARRAY, init_array);
3277 				break;
3278 
3279 			case DT_MOVEENT:
3280 				TEST_ENTSIZE(SHT_SUNW_move, sunw_move);
3281 				break;
3282 
3283 			case DT_MOVESZ:
3284 				TEST_SIZE(SHT_SUNW_move, sunw_move);
3285 				break;
3286 
3287 			case DT_MOVETAB:
3288 				TEST_ADDR(SHT_SUNW_move, sunw_move);
3289 				break;
3290 
3291 			case DT_PREINIT_ARRAY:
3292 				TEST_ADDR(SHT_PREINIT_ARRAY, preinit_array);
3293 				break;
3294 
3295 			case DT_PREINIT_ARRAYSZ:
3296 				TEST_SIZE(SHT_PREINIT_ARRAY, preinit_array);
3297 				break;
3298 
3299 			case DT_REL:
3300 				if (!dumped)
3301 					TEST_ADDR(SHT_REL, rel);
3302 				break;
3303 
3304 			case DT_RELENT:
3305 				TEST_ENTSIZE(SHT_REL, rel);
3306 				break;
3307 
3308 			case DT_RELA:
3309 				if (!dumped)
3310 					TEST_ADDR(SHT_RELA, rela);
3311 				break;
3312 
3313 			case DT_RELAENT:
3314 				TEST_ENTSIZE(SHT_RELA, rela);
3315 				break;
3316 
3317 			case DT_STRTAB:
3318 				TEST_ADDR(SHT_STRTAB, dynstr);
3319 				break;
3320 
3321 			case DT_STRSZ:
3322 				TEST_SIZE(SHT_STRTAB, dynstr);
3323 				break;
3324 
3325 			case DT_SUNW_CAP:
3326 				if (osabi_solaris)
3327 					TEST_ADDR(SHT_SUNW_cap, sunw_cap);
3328 				break;
3329 
3330 			case DT_SUNW_CAPINFO:
3331 				if (osabi_solaris)
3332 					TEST_ADDR(SHT_SUNW_capinfo,
3333 					    sunw_capinfo);
3334 				break;
3335 
3336 			case DT_SUNW_CAPCHAIN:
3337 				if (osabi_solaris)
3338 					TEST_ADDR(SHT_SUNW_capchain,
3339 					    sunw_capchain);
3340 				break;
3341 
3342 			case DT_SUNW_SYMTAB:
3343 				TEST_ADDR(SHT_SUNW_LDYNSYM, sunw_ldynsym);
3344 				break;
3345 
3346 			case DT_SYMENT:
3347 				TEST_ENTSIZE(SHT_DYNSYM, dynsym);
3348 				break;
3349 
3350 			case DT_SYMINENT:
3351 				TEST_ENTSIZE(SHT_SUNW_syminfo, sunw_syminfo);
3352 				break;
3353 
3354 			case DT_SYMINFO:
3355 				TEST_ADDR(SHT_SUNW_syminfo, sunw_syminfo);
3356 				break;
3357 
3358 			case DT_SYMINSZ:
3359 				TEST_SIZE(SHT_SUNW_syminfo, sunw_syminfo);
3360 				break;
3361 
3362 			case DT_SYMTAB:
3363 				TEST_ADDR(SHT_DYNSYM, dynsym);
3364 				break;
3365 
3366 			case DT_SUNW_SORTENT:
3367 				/*
3368 				 * This entry is related to both the symsort and
3369 				 * tlssort sections.
3370 				 */
3371 				if (osabi_solaris) {
3372 					int test_tls =
3373 					    (sec.sunw_tlssort != NULL);
3374 					int test_sym =
3375 					    (sec.sunw_symsort != NULL) ||
3376 					    !test_tls;
3377 					if (test_sym)
3378 						TEST_ENTSIZE(SHT_SUNW_symsort,
3379 						    sunw_symsort);
3380 					if (test_tls)
3381 						TEST_ENTSIZE(SHT_SUNW_tlssort,
3382 						    sunw_tlssort);
3383 				}
3384 				break;
3385 
3386