1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  * Copyright (c) 2015, Joyent, Inc. All rights reserved.
29  */
30 
31 /*
32  * Dump an elf file.
33  */
34 #include	<stddef.h>
35 #include	<sys/elf_386.h>
36 #include	<sys/elf_amd64.h>
37 #include	<sys/elf_SPARC.h>
38 #include	<_libelf.h>
39 #include	<dwarf.h>
40 #include	<stdio.h>
41 #include	<unistd.h>
42 #include	<errno.h>
43 #include	<strings.h>
44 #include	<debug.h>
45 #include	<conv.h>
46 #include	<msg.h>
47 #include	<_elfdump.h>
48 
49 
50 /*
51  * VERSYM_STATE is used to maintain information about the VERSYM section
52  * in the object being analyzed. It is filled in by versions(), and used
53  * by init_symtbl_state() when displaying symbol information.
54  *
55  * There are three forms of symbol versioning known to us:
56  *
57  * 1) The original form, introduced with Solaris 2.5, in which
58  *	the Versym contains indexes to Verdef records, and the
59  *	Versym values for UNDEF symbols resolved by other objects
60  *	are all set to 0.
61  * 2) The GNU form, which is backward compatible with the original
62  *	Solaris form, but which adds several extensions:
63  *	- The Versym also contains indexes to Verneed records, recording
64  *		which object/version contributed the external symbol at
65  *		link time. These indexes start with the next value following
66  *		the final Verdef index. The index is written to the previously
67  *		reserved vna_other field of the ELF Vernaux structure.
68  *	- The top bit of the Versym value is no longer part of the index,
69  *		but is used as a "hidden bit" to prevent binding to the symbol.
70  *	- Multiple implementations of a given symbol, contained in varying
71  *		versions are allowed, using special assembler pseudo ops,
72  *		and encoded in the symbol name using '@' characters.
73  * 3) Modified Solaris form, in which we adopt the first GNU extension
74  *	(Versym indexes to Verneed records), but not the others.
75  *
76  * elfdump can handle any of these cases. The presence of a DT_VERSYM
77  * dynamic element indicates a full GNU object. An object that lacks
78  * a DT_VERSYM entry, but which has non-zero vna_other fields in the Vernaux
79  * structures is a modified Solaris object. An object that has neither of
80  * these uses the original form.
81  *
82  * max_verndx contains the largest version index that can appear
83  * in a Versym entry. This can never be less than 1: In the case where
84  * there is no verdef/verneed sections, the [0] index is reserved
85  * for local symbols, and the [1] index for globals. If the original
86  * Solaris versioning rules are in effect and there is a verdef section,
87  * then max_verndex is the number of defined versions. If one of the
88  * other versioning forms is in effect, then:
89  *	1) If there is no verneed section, it is the same as for
90  *		original Solaris versioning.
91  *	2) If there is a verneed section, the vna_other field of the
92  *		Vernaux structs contain versions, and max_verndx is the
93  *		largest such index.
94  *
95  * If gnu_full is True, the object uses the full GNU form of versioning.
96  * The value of the gnu_full field is based on the presence of
97  * a DT_VERSYM entry in the dynamic section: GNU ld produces these, and
98  * Solaris ld does not.
99  *
100  * The gnu_needed field is True if the Versym contains indexes to
101  * Verneed records, as indicated by non-zero vna_other fields in the Verneed
102  * section. If gnu_full is True, then gnu_needed will always be true.
103  * However, gnu_needed can be true without gnu_full. This is the modified
104  * Solaris form.
105  */
106 typedef struct {
107 	Cache	*cache;		/* Pointer to cache entry for VERSYM */
108 	Versym	*data;		/* Pointer to versym array */
109 	int	gnu_full;	/* True if object uses GNU versioning rules */
110 	int	gnu_needed;	/* True if object uses VERSYM indexes for */
111 				/*	VERNEED (subset of gnu_full) */
112 	int	max_verndx;	/* largest versym index value */
113 } VERSYM_STATE;
114 
115 /*
116  * SYMTBL_STATE is used to maintain information about a single symbol
117  * table section, for use by the routines that display symbol information.
118  */
119 typedef struct {
120 	const char	*file;		/* Name of file */
121 	Ehdr		*ehdr;		/* ELF header for file */
122 	Cache		*cache;		/* Cache of all section headers */
123 	uchar_t		osabi;		/* OSABI to use */
124 	Word		shnum;		/* # of sections in cache */
125 	Cache		*seccache;	/* Cache of symbol table section hdr */
126 	Word		secndx;		/* Index of symbol table section hdr */
127 	const char	*secname;	/* Name of section */
128 	uint_t		flags;		/* Command line option flags */
129 	struct {			/* Extended section index data */
130 		int	checked;	/* TRUE if already checked for shxndx */
131 		Word	*data;		/* NULL, or extended section index */
132 					/*	used for symbol table entries */
133 		uint_t	n;		/* # items in shxndx.data */
134 	} shxndx;
135 	VERSYM_STATE	*versym;	/* NULL, or associated VERSYM section */
136 	Sym 		*sym;		/* Array of symbols */
137 	Word		symn;		/* # of symbols */
138 } SYMTBL_STATE;
139 
140 /*
141  * A variable of this type is used to track information related to
142  * .eh_frame and .eh_frame_hdr sections across calls to unwind_eh_frame().
143  */
144 typedef struct {
145 	Word		frame_cnt;	/* # .eh_frame sections seen */
146 	Word		frame_ndx;	/* Section index of 1st .eh_frame */
147 	Word		hdr_cnt;	/* # .eh_frame_hdr sections seen */
148 	Word		hdr_ndx;	/* Section index of 1st .eh_frame_hdr */
149 	uint64_t	frame_ptr;	/* Value of FramePtr field from first */
150 					/*	.eh_frame_hdr section */
151 	uint64_t	frame_base;	/* Data addr of 1st .eh_frame  */
152 } gnu_eh_state_t;
153 
154 /*
155  * C++ .exception_ranges entries make use of the signed ptrdiff_t
156  * type to record self-relative pointer values. We need a type
157  * for this that is matched to the ELFCLASS being processed.
158  */
159 #if	defined(_ELF64)
160 	typedef int64_t PTRDIFF_T;
161 #else
162 	typedef int32_t PTRDIFF_T;
163 #endif
164 
165 /*
166  * The Sun C++ ABI uses this struct to define each .exception_ranges
167  * entry. From the ABI:
168  *
169  * The field ret_addr is a self relative pointer to the start of the address
170  * range. The name was chosen because in the current implementation the range
171  * typically starts at the return address for a call site.
172  *
173  * The field length is the difference, in bytes, between the pc of the last
174  * instruction covered by the exception range and the first. When only a
175  * single call site is represented without optimization, this will equal zero.
176  *
177  * The field handler_addr is a relative pointer which stores the difference
178  * between the start of the exception range and the address of all code to
179  * catch exceptions and perform the cleanup for stack unwinding.
180  *
181  * The field type_block is a relative pointer which stores the difference
182  * between the start of the exception range and the address of an array used
183  * for storing a list of the types of exceptions which can be caught within
184  * the exception range.
185  */
186 typedef struct {
187 	PTRDIFF_T	ret_addr;
188 	Xword		length;
189 	PTRDIFF_T	handler_addr;
190 	PTRDIFF_T	type_block;
191 	Xword		reserved;
192 } exception_range_entry;
193 
194 /*
195  * Focal point for verifying symbol names.
196  */
197 static const char *
198 string(Cache *refsec, Word ndx, Cache *strsec, const char *file, Word name)
199 {
200 	/*
201 	 * If an error in this routine is due to a property of the string
202 	 * section, as opposed to a bad offset into the section (a property of
203 	 * the referencing section), then we will detect the same error on
204 	 * every call involving those sections. We use these static variables
205 	 * to retain the information needed to only issue each such error once.
206 	 */
207 	static Cache	*last_refsec;	/* Last referencing section seen */
208 	static int	strsec_err;	/* True if error issued */
209 
210 	const char	*strs;
211 	Word		strn;
212 
213 	if (strsec->c_data == NULL)
214 		return (NULL);
215 
216 	strs = (char *)strsec->c_data->d_buf;
217 	strn = strsec->c_data->d_size;
218 
219 	/*
220 	 * We only print a diagnostic regarding a bad string table once per
221 	 * input section being processed. If the refsec has changed, reset
222 	 * our retained error state.
223 	 */
224 	if (last_refsec != refsec) {
225 		last_refsec = refsec;
226 		strsec_err = 0;
227 	}
228 
229 	/* Verify that strsec really is a string table */
230 	if (strsec->c_shdr->sh_type != SHT_STRTAB) {
231 		if (!strsec_err) {
232 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOTSTRTAB),
233 			    file, strsec->c_ndx, refsec->c_ndx);
234 			strsec_err = 1;
235 		}
236 		return (MSG_INTL(MSG_STR_UNKNOWN));
237 	}
238 
239 	/*
240 	 * Is the string table offset within range of the available strings?
241 	 */
242 	if (name >= strn) {
243 		/*
244 		 * Do we have a empty string table?
245 		 */
246 		if (strs == NULL) {
247 			if (!strsec_err) {
248 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
249 				    file, strsec->c_name);
250 				strsec_err = 1;
251 			}
252 		} else {
253 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSTOFF),
254 			    file, refsec->c_name, EC_WORD(ndx), strsec->c_name,
255 			    EC_WORD(name), EC_WORD(strn - 1));
256 		}
257 
258 		/*
259 		 * Return the empty string so that the calling function can
260 		 * continue it's output diagnostics.
261 		 */
262 		return (MSG_INTL(MSG_STR_UNKNOWN));
263 	}
264 	return (strs + name);
265 }
266 
267 /*
268  * Relocations can reference section symbols and standard symbols.  If the
269  * former, establish the section name.
270  */
271 static const char *
272 relsymname(Cache *cache, Cache *csec, Cache *strsec, Word symndx, Word symnum,
273     Word relndx, Sym *syms, char *secstr, size_t secsz, const char *file)
274 {
275 	Sym		*sym;
276 	const char	*name;
277 
278 	if (symndx >= symnum) {
279 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_RELBADSYMNDX),
280 		    file, EC_WORD(symndx), EC_WORD(relndx));
281 		return (MSG_INTL(MSG_STR_UNKNOWN));
282 	}
283 
284 	sym = (Sym *)(syms + symndx);
285 	name = string(csec, symndx, strsec, file, sym->st_name);
286 
287 	/*
288 	 * If the symbol represents a section offset construct an appropriate
289 	 * string.  Note, although section symbol table entries typically have
290 	 * a NULL name pointer, entries do exist that point into the string
291 	 * table to their own NULL strings.
292 	 */
293 	if ((ELF_ST_TYPE(sym->st_info) == STT_SECTION) &&
294 	    ((sym->st_name == 0) || (*name == '\0'))) {
295 		(void) snprintf(secstr, secsz, MSG_INTL(MSG_STR_SECTION),
296 		    cache[sym->st_shndx].c_name);
297 		return ((const char *)secstr);
298 	}
299 
300 	return (name);
301 }
302 
303 /*
304  * Focal point for establishing a string table section.  Data such as the
305  * dynamic information simply points to a string table.  Data such as
306  * relocations, reference a symbol table, which in turn is associated with a
307  * string table.
308  */
309 static int
310 stringtbl(Cache *cache, int symtab, Word ndx, Word shnum, const char *file,
311     Word *symnum, Cache **symsec, Cache **strsec)
312 {
313 	Shdr	*shdr = cache[ndx].c_shdr;
314 
315 	if (symtab) {
316 		/*
317 		 * Validate the symbol table section.
318 		 */
319 		if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
320 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
321 			    file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
322 			return (0);
323 		}
324 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
325 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
326 			    file, cache[ndx].c_name);
327 			return (0);
328 		}
329 
330 		/*
331 		 * Obtain, and verify the symbol table data.
332 		 */
333 		if ((cache[ndx].c_data == NULL) ||
334 		    (cache[ndx].c_data->d_buf == NULL)) {
335 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
336 			    file, cache[ndx].c_name);
337 			return (0);
338 		}
339 
340 		/*
341 		 * Establish the string table index.
342 		 */
343 		ndx = shdr->sh_link;
344 		shdr = cache[ndx].c_shdr;
345 
346 		/*
347 		 * Return symbol table information.
348 		 */
349 		if (symnum)
350 			*symnum = (shdr->sh_size / shdr->sh_entsize);
351 		if (symsec)
352 			*symsec = &cache[ndx];
353 	}
354 
355 	/*
356 	 * Validate the associated string table section.
357 	 */
358 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
359 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
360 		    file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
361 		return (0);
362 	}
363 
364 	if (strsec)
365 		*strsec = &cache[shdr->sh_link];
366 
367 	return (1);
368 }
369 
370 /*
371  * Lookup a symbol and set Sym accordingly.
372  *
373  * entry:
374  *	name - Name of symbol to lookup
375  *	cache - Cache of all section headers
376  *	shnum - # of sections in cache
377  *	sym - Address of pointer to receive symbol
378  *	target - NULL, or section to which the symbol must be associated.
379  *	symtab - Symbol table to search for symbol
380  *	file - Name of file
381  *
382  * exit:
383  *	If the symbol is found, *sym is set to reference it, and True is
384  *	returned. If target is non-NULL, the symbol must reference the given
385  *	section --- otherwise the section is not checked.
386  *
387  *	If no symbol is found, False is returned.
388  */
389 static int
390 symlookup(const char *name, Cache *cache, Word shnum, Sym **sym,
391     Cache *target, Cache *symtab, const char *file)
392 {
393 	Shdr	*shdr;
394 	Word	symn, cnt;
395 	Sym	*syms;
396 
397 	if (symtab == 0)
398 		return (0);
399 
400 	shdr = symtab->c_shdr;
401 
402 	/*
403 	 * Determine the symbol data and number.
404 	 */
405 	if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
406 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
407 		    file, symtab->c_name);
408 		return (0);
409 	}
410 	if (symtab->c_data == NULL)
411 		return (0);
412 
413 	/* LINTED */
414 	symn = (Word)(shdr->sh_size / shdr->sh_entsize);
415 	syms = (Sym *)symtab->c_data->d_buf;
416 
417 	/*
418 	 * Get the associated string table section.
419 	 */
420 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
421 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
422 		    file, symtab->c_name, EC_WORD(shdr->sh_link));
423 		return (0);
424 	}
425 
426 	/*
427 	 * Loop through the symbol table to find a match.
428 	 */
429 	*sym = NULL;
430 	for (cnt = 0; cnt < symn; syms++, cnt++) {
431 		const char	*symname;
432 
433 		symname = string(symtab, cnt, &cache[shdr->sh_link], file,
434 		    syms->st_name);
435 
436 		if (symname && (strcmp(name, symname) == 0) &&
437 		    ((target == NULL) || (target->c_ndx == syms->st_shndx))) {
438 			/*
439 			 * It is possible, though rare, for a local and
440 			 * global symbol of the same name to exist, each
441 			 * contributed by a different input object. If the
442 			 * symbol just found is local, remember it, but
443 			 * continue looking.
444 			 */
445 			*sym = syms;
446 			if (ELF_ST_BIND(syms->st_info) != STB_LOCAL)
447 				break;
448 		}
449 	}
450 
451 	return (*sym != NULL);
452 }
453 
454 /*
455  * Print section headers.
456  */
457 static void
458 sections(const char *file, Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi)
459 {
460 	size_t	seccnt;
461 
462 	for (seccnt = 1; seccnt < shnum; seccnt++) {
463 		Cache		*_cache = &cache[seccnt];
464 		Shdr		*shdr = _cache->c_shdr;
465 		const char	*secname = _cache->c_name;
466 
467 		/*
468 		 * Although numerous section header entries can be zero, it's
469 		 * usually a sign of trouble if the type is zero.
470 		 */
471 		if (shdr->sh_type == 0) {
472 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHTYPE),
473 			    file, secname, EC_WORD(shdr->sh_type));
474 		}
475 
476 		if (!match(MATCH_F_ALL, secname, seccnt, shdr->sh_type))
477 			continue;
478 
479 		/*
480 		 * Identify any sections that are suspicious.  A .got section
481 		 * shouldn't exist in a relocatable object.
482 		 */
483 		if (ehdr->e_type == ET_REL) {
484 			if (strncmp(secname, MSG_ORIG(MSG_ELF_GOT),
485 			    MSG_ELF_GOT_SIZE) == 0) {
486 				(void) fprintf(stderr,
487 				    MSG_INTL(MSG_GOT_UNEXPECTED), file,
488 				    secname);
489 			}
490 		}
491 
492 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
493 		dbg_print(0, MSG_INTL(MSG_ELF_SHDR), EC_WORD(seccnt), secname);
494 		Elf_shdr(0, osabi, ehdr->e_machine, shdr);
495 	}
496 }
497 
498 /*
499  * Obtain a specified Phdr entry.
500  */
501 static Phdr *
502 getphdr(Word phnum, Word *type_arr, Word type_cnt, const char *file, Elf *elf)
503 {
504 	Word	cnt, tcnt;
505 	Phdr	*phdr;
506 
507 	if ((phdr = elf_getphdr(elf)) == NULL) {
508 		failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
509 		return (NULL);
510 	}
511 
512 	for (cnt = 0; cnt < phnum; phdr++, cnt++) {
513 		for (tcnt = 0; tcnt < type_cnt; tcnt++) {
514 			if (phdr->p_type == type_arr[tcnt])
515 				return (phdr);
516 		}
517 	}
518 	return (NULL);
519 }
520 
521 /*
522  * Display the contents of GNU/amd64 .eh_frame and .eh_frame_hdr
523  * sections.
524  *
525  * entry:
526  *	cache - Cache of all section headers
527  *	shndx - Index of .eh_frame or .eh_frame_hdr section to be displayed
528  *	shnum - Total number of sections which exist
529  *	uphdr - NULL, or unwind program header associated with
530  *		the .eh_frame_hdr section.
531  *	ehdr - ELF header for file
532  *	eh_state - Data used across calls to this routine. The
533  *		caller should zero it before the first call, and
534  *		pass it on every call.
535  *	osabi - OSABI to use in displaying information
536  *	file - Name of file
537  *	flags - Command line option flags
538  */
539 static void
540 unwind_eh_frame(Cache *cache, Word shndx, Word shnum, Phdr *uphdr, Ehdr *ehdr,
541     gnu_eh_state_t *eh_state, uchar_t osabi, const char *file, uint_t flags)
542 {
543 #if	defined(_ELF64)
544 #define	MSG_UNW_BINSRTAB2	MSG_UNW_BINSRTAB2_64
545 #define	MSG_UNW_BINSRTABENT	MSG_UNW_BINSRTABENT_64
546 #else
547 #define	MSG_UNW_BINSRTAB2	MSG_UNW_BINSRTAB2_32
548 #define	MSG_UNW_BINSRTABENT	MSG_UNW_BINSRTABENT_32
549 #endif
550 
551 	Cache			*_cache = &cache[shndx];
552 	Shdr			*shdr = _cache->c_shdr;
553 	uchar_t			*data = (uchar_t *)(_cache->c_data->d_buf);
554 	size_t			datasize = _cache->c_data->d_size;
555 	Conv_dwarf_ehe_buf_t	dwarf_ehe_buf;
556 	uint64_t		ndx, frame_ptr, fde_cnt, tabndx;
557 	uint_t			vers, frame_ptr_enc, fde_cnt_enc, table_enc;
558 	uint64_t		initloc, initloc0 = 0;
559 	uint64_t		gotaddr = 0;
560 	int			cnt;
561 
562 	for (cnt = 1; cnt < shnum; cnt++) {
563 		if (strncmp(cache[cnt].c_name, MSG_ORIG(MSG_ELF_GOT),
564 		    MSG_ELF_GOT_SIZE) == 0) {
565 			gotaddr = cache[cnt].c_shdr->sh_addr;
566 			break;
567 		}
568 	}
569 
570 	if ((data == NULL) || (datasize == 0)) {
571 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
572 		    file, _cache ->c_name);
573 		return;
574 	}
575 
576 	/*
577 	 * Is this a .eh_frame_hdr?
578 	 */
579 	if ((uphdr && (shdr->sh_addr == uphdr->p_vaddr)) ||
580 	    (strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRMHDR),
581 	    MSG_SCN_FRMHDR_SIZE) == 0)) {
582 		/*
583 		 * There can only be a single .eh_frame_hdr.
584 		 * Flag duplicates.
585 		 */
586 		if (++eh_state->hdr_cnt > 1)
587 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_MULTEHFRMHDR),
588 			    file, EC_WORD(shndx), _cache->c_name);
589 
590 		dbg_print(0, MSG_ORIG(MSG_UNW_FRMHDR));
591 		ndx = 0;
592 
593 		vers = data[ndx++];
594 		frame_ptr_enc = data[ndx++];
595 		fde_cnt_enc = data[ndx++];
596 		table_enc = data[ndx++];
597 
598 		dbg_print(0, MSG_ORIG(MSG_UNW_FRMVERS), vers);
599 
600 		switch (dwarf_ehe_extract(data, datasize, &ndx,
601 		    &frame_ptr, frame_ptr_enc, ehdr->e_ident, B_TRUE,
602 		    shdr->sh_addr, ndx, gotaddr)) {
603 		case DW_OVERFLOW:
604 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWOVRFLW),
605 			    file, _cache->c_name);
606 			return;
607 		case DW_BAD_ENCODING:
608 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWBADENC),
609 			    file, _cache->c_name, frame_ptr_enc);
610 			return;
611 		case DW_SUCCESS:
612 			break;
613 		}
614 		if (eh_state->hdr_cnt == 1) {
615 			eh_state->hdr_ndx = shndx;
616 			eh_state->frame_ptr = frame_ptr;
617 		}
618 
619 		dbg_print(0, MSG_ORIG(MSG_UNW_FRPTRENC),
620 		    conv_dwarf_ehe(frame_ptr_enc, &dwarf_ehe_buf),
621 		    EC_XWORD(frame_ptr));
622 
623 		switch (dwarf_ehe_extract(data, datasize, &ndx, &fde_cnt,
624 		    fde_cnt_enc, ehdr->e_ident, B_TRUE, shdr->sh_addr, ndx,
625 		    gotaddr)) {
626 		case DW_OVERFLOW:
627 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWOVRFLW),
628 			    file, _cache->c_name);
629 			return;
630 		case DW_BAD_ENCODING:
631 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DWBADENC),
632 			    file, _cache->c_name, fde_cnt_enc);
633 			return;
634 		case DW_SUCCESS:
635 			break;
636 		}
637 
638 		dbg_print(0, MSG_ORIG(MSG_UNW_FDCNENC),
639 		    conv_dwarf_ehe(fde_cnt_enc, &dwarf_ehe_buf),
640 		    EC_XWORD(fde_cnt));
641 		dbg_print(0, MSG_ORIG(MSG_UNW_TABENC),
642 		    conv_dwarf_ehe(table_enc, &dwarf_ehe_buf));
643 		dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTAB1));
644 		dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTAB2));
645 
646 		for (tabndx = 0; tabndx < fde_cnt; tabndx++) {
647 			uint64_t table;
648 
649 			switch (dwarf_ehe_extract(data, datasize, &ndx,
650 			    &initloc, table_enc, ehdr->e_ident, B_TRUE,
651 			    shdr->sh_addr, ndx, gotaddr)) {
652 			case DW_OVERFLOW:
653 				(void) fprintf(stderr,
654 				    MSG_INTL(MSG_ERR_DWOVRFLW), file,
655 				    _cache->c_name);
656 				return;
657 			case DW_BAD_ENCODING:
658 				(void) fprintf(stderr,
659 				    MSG_INTL(MSG_ERR_DWBADENC), file,
660 				    _cache->c_name, table_enc);
661 				return;
662 			case DW_SUCCESS:
663 				break;
664 			}
665 			if ((tabndx != 0) && (initloc0 > initloc))
666 				(void) fprintf(stderr,
667 				    MSG_INTL(MSG_ERR_BADSORT), file,
668 				    _cache->c_name, EC_WORD(tabndx));
669 			switch (dwarf_ehe_extract(data, datasize, &ndx, &table,
670 			    table_enc, ehdr->e_ident, B_TRUE, shdr->sh_addr,
671 			    ndx, gotaddr)) {
672 			case DW_OVERFLOW:
673 				(void) fprintf(stderr,
674 				    MSG_INTL(MSG_ERR_DWOVRFLW), file,
675 				    _cache->c_name);
676 				return;
677 			case DW_BAD_ENCODING:
678 				(void) fprintf(stderr,
679 				    MSG_INTL(MSG_ERR_DWBADENC), file,
680 				    _cache->c_name, table_enc);
681 				return;
682 			case DW_SUCCESS:
683 				break;
684 			}
685 
686 			dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTABENT),
687 			    EC_XWORD(initloc),
688 			    EC_XWORD(table));
689 			initloc0 = initloc;
690 		}
691 	} else {		/* Display the .eh_frame section */
692 		eh_state->frame_cnt++;
693 		if (eh_state->frame_cnt == 1) {
694 			eh_state->frame_ndx = shndx;
695 			eh_state->frame_base = shdr->sh_addr;
696 		} else if ((eh_state->frame_cnt >  1) &&
697 		    (ehdr->e_type != ET_REL)) {
698 			Conv_inv_buf_t	inv_buf;
699 
700 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_MULTEHFRM),
701 			    file, EC_WORD(shndx), _cache->c_name,
702 			    conv_ehdr_type(osabi, ehdr->e_type, 0, &inv_buf));
703 		}
704 		dump_eh_frame(file, _cache->c_name, data, datasize,
705 		    shdr->sh_addr, ehdr->e_machine, ehdr->e_ident, gotaddr);
706 	}
707 
708 	/*
709 	 * If we've seen the .eh_frame_hdr and the first .eh_frame section,
710 	 * compare the header frame_ptr to the address of the actual frame
711 	 * section to ensure the link-editor got this right.  Note, this
712 	 * diagnostic is only produced when unwind information is explicitly
713 	 * asked for, as shared objects built with an older ld(1) may reveal
714 	 * this inconsistency.  Although an inconsistency, it doesn't seem to
715 	 * have any adverse effect on existing tools.
716 	 */
717 	if (((flags & FLG_MASK_SHOW) != FLG_MASK_SHOW) &&
718 	    (eh_state->hdr_cnt > 0) && (eh_state->frame_cnt > 0) &&
719 	    (eh_state->frame_ptr != eh_state->frame_base))
720 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADEHFRMPTR),
721 		    file, EC_WORD(eh_state->hdr_ndx),
722 		    cache[eh_state->hdr_ndx].c_name,
723 		    EC_XWORD(eh_state->frame_ptr),
724 		    EC_WORD(eh_state->frame_ndx),
725 		    cache[eh_state->frame_ndx].c_name,
726 		    EC_XWORD(eh_state->frame_base));
727 #undef MSG_UNW_BINSRTAB2
728 #undef MSG_UNW_BINSRTABENT
729 }
730 
731 /*
732  * Convert a self relative pointer into an address. A self relative
733  * pointer adds the address where the pointer resides to the offset
734  * contained in the pointer. The benefit is that the value of the
735  * pointer does not require relocation.
736  *
737  * entry:
738  *	base_addr - Address of the pointer.
739  *	delta - Offset relative to base_addr giving desired address
740  *
741  * exit:
742  *	The computed address is returned.
743  *
744  * note:
745  *	base_addr is an unsigned value, while ret_addr is signed. This routine
746  *	used explicit testing and casting to explicitly control type
747  *	conversion, and ensure that we handle the maximum possible range.
748  */
749 static Addr
750 srelptr(Addr base_addr, PTRDIFF_T delta)
751 {
752 	if (delta < 0)
753 		return (base_addr - (Addr) (-delta));
754 
755 	return (base_addr + (Addr) delta);
756 }
757 
758 /*
759  * Byte swap a PTRDIFF_T value.
760  */
761 static PTRDIFF_T
762 swap_ptrdiff(PTRDIFF_T value)
763 {
764 	PTRDIFF_T r;
765 	uchar_t	*dst = (uchar_t *)&r;
766 	uchar_t	*src = (uchar_t *)&value;
767 
768 	UL_ASSIGN_BSWAP_XWORD(dst, src);
769 	return (r);
770 }
771 
772 /*
773  * Display exception_range_entry items from the .exception_ranges section
774  * of a Sun C++ object.
775  */
776 static void
777 unwind_exception_ranges(Cache *_cache, const char *file, int do_swap)
778 {
779 	/*
780 	 * Translate a PTRDIFF_T self-relative address field of
781 	 * an exception_range_entry struct into an address.
782 	 *
783 	 * entry:
784 	 *	exc_addr - Address of base of exception_range_entry struct
785 	 *	cur_ent - Pointer to data in the struct to be translated
786 	 *
787 	 *	_f - Field of struct to be translated
788 	 */
789 #define	SRELPTR(_f) \
790 	srelptr(exc_addr + offsetof(exception_range_entry, _f), cur_ent->_f)
791 
792 #if	defined(_ELF64)
793 #define	MSG_EXR_TITLE	MSG_EXR_TITLE_64
794 #define	MSG_EXR_ENTRY	MSG_EXR_ENTRY_64
795 #else
796 #define	MSG_EXR_TITLE	MSG_EXR_TITLE_32
797 #define	MSG_EXR_ENTRY	MSG_EXR_ENTRY_32
798 #endif
799 
800 	exception_range_entry	scratch, *ent, *cur_ent = &scratch;
801 	char			index[MAXNDXSIZE];
802 	Word			i, nelts;
803 	Addr			addr, addr0 = 0, offset = 0;
804 	Addr			exc_addr = _cache->c_shdr->sh_addr;
805 
806 	dbg_print(0, MSG_INTL(MSG_EXR_TITLE));
807 	ent = (exception_range_entry *)(_cache->c_data->d_buf);
808 	nelts = _cache->c_data->d_size / sizeof (exception_range_entry);
809 
810 	for (i = 0; i < nelts; i++, ent++) {
811 		if (do_swap) {
812 			/*
813 			 * Copy byte swapped values into the scratch buffer.
814 			 * The reserved field is not used, so we skip it.
815 			 */
816 			scratch.ret_addr = swap_ptrdiff(ent->ret_addr);
817 			scratch.length = BSWAP_XWORD(ent->length);
818 			scratch.handler_addr = swap_ptrdiff(ent->handler_addr);
819 			scratch.type_block = swap_ptrdiff(ent->type_block);
820 		} else {
821 			cur_ent = ent;
822 		}
823 
824 		/*
825 		 * The table is required to be sorted by the address
826 		 * derived from ret_addr, to allow binary searching. Ensure
827 		 * that addresses grow monotonically.
828 		 */
829 		addr = SRELPTR(ret_addr);
830 		if ((i != 0) && (addr0 > addr))
831 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSORT),
832 			    file, _cache->c_name, EC_WORD(i));
833 
834 		(void) snprintf(index, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX),
835 		    EC_XWORD(i));
836 		dbg_print(0, MSG_INTL(MSG_EXR_ENTRY), index, EC_ADDR(offset),
837 		    EC_ADDR(addr), EC_ADDR(cur_ent->length),
838 		    EC_ADDR(SRELPTR(handler_addr)),
839 		    EC_ADDR(SRELPTR(type_block)));
840 
841 		addr0 = addr;
842 		exc_addr += sizeof (exception_range_entry);
843 		offset += sizeof (exception_range_entry);
844 	}
845 
846 #undef SRELPTR
847 #undef MSG_EXR_TITLE
848 #undef MSG_EXR_ENTRY
849 }
850 
851 /*
852  * Display information from unwind/exception sections:
853  *
854  * -	GNU/amd64 .eh_frame and .eh_frame_hdr
855  * -	Sun C++ .exception_ranges
856  *
857  */
858 static void
859 unwind(Cache *cache, Word shnum, Word phnum, Ehdr *ehdr, uchar_t osabi,
860     const char *file, Elf *elf, uint_t flags)
861 {
862 	static Word phdr_types[] = { PT_SUNW_UNWIND, PT_SUNW_EH_FRAME };
863 
864 	Word			cnt;
865 	Phdr			*uphdr = NULL;
866 	gnu_eh_state_t		eh_state;
867 
868 	/*
869 	 * Historical background: .eh_frame and .eh_frame_hdr sections
870 	 * come from the GNU compilers (particularly C++), and are used
871 	 * under all architectures. Their format is based on DWARF. When
872 	 * the amd64 ABI was defined, these sections were adopted wholesale
873 	 * from the existing practice.
874 	 *
875 	 * When amd64 support was added to Solaris, support for these
876 	 * sections was added, using the SHT_AMD64_UNWIND section type
877 	 * to identify them. At first, we ignored them in objects for
878 	 * non-amd64 targets, but later broadened our support to include
879 	 * other architectures in order to better support gcc-generated
880 	 * objects.
881 	 *
882 	 * .exception_ranges implement the same basic concepts, but
883 	 * were invented at Sun for the Sun C++ compiler.
884 	 *
885 	 * We match these sections by name, rather than section type,
886 	 * because they can come in as either SHT_AMD64_UNWIND, or as
887 	 * SHT_PROGBITS, and because the type isn't enough to determine
888 	 * how they should be interpreted.
889 	 */
890 	/* Find the program header for .eh_frame_hdr if present */
891 	if (phnum)
892 		uphdr = getphdr(phnum, phdr_types,
893 		    sizeof (phdr_types) / sizeof (*phdr_types), file, elf);
894 
895 	/*
896 	 * eh_state is used to retain data used by unwind_eh_frame()
897 	 * across calls.
898 	 */
899 	bzero(&eh_state, sizeof (eh_state));
900 
901 	for (cnt = 1; cnt < shnum; cnt++) {
902 		Cache		*_cache = &cache[cnt];
903 		Shdr		*shdr = _cache->c_shdr;
904 		int		is_exrange;
905 
906 		/*
907 		 * Skip sections of the wrong type. On amd64, they
908 		 * can be SHT_AMD64_UNWIND. On all platforms, they
909 		 * can be SHT_PROGBITS (including amd64, if using
910 		 * the GNU compilers).
911 		 *
912 		 * Skip anything other than these two types. The name
913 		 * test below will thin out the SHT_PROGBITS that don't apply.
914 		 */
915 		if ((shdr->sh_type != SHT_PROGBITS) &&
916 		    (shdr->sh_type != SHT_AMD64_UNWIND))
917 			continue;
918 
919 		/*
920 		 * Only sections with certain well known names are of interest.
921 		 * These are:
922 		 *
923 		 *	.eh_frame - amd64/GNU-compiler unwind sections
924 		 *	.eh_frame_hdr - Sorted table referencing .eh_frame
925 		 *	.exception_ranges - Sun C++ unwind sections
926 		 *
927 		 * We do a prefix comparison, allowing for naming conventions
928 		 * like .eh_frame.foo, hence the use of strncmp() rather than
929 		 * strcmp(). This means that we only really need to test for
930 		 * .eh_frame, as it's a prefix of .eh_frame_hdr.
931 		 */
932 		is_exrange =  strncmp(_cache->c_name,
933 		    MSG_ORIG(MSG_SCN_EXRANGE), MSG_SCN_EXRANGE_SIZE) == 0;
934 		if ((strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRM),
935 		    MSG_SCN_FRM_SIZE) != 0) && !is_exrange)
936 			continue;
937 
938 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
939 			continue;
940 
941 		if (_cache->c_data == NULL)
942 			continue;
943 
944 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
945 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_UNWIND), _cache->c_name);
946 
947 		if (is_exrange)
948 			unwind_exception_ranges(_cache, file,
949 			    _elf_sys_encoding() != ehdr->e_ident[EI_DATA]);
950 		else
951 			unwind_eh_frame(cache, cnt, shnum, uphdr, ehdr,
952 			    &eh_state, osabi, file, flags);
953 	}
954 }
955 
956 /*
957  * Initialize a symbol table state structure
958  *
959  * entry:
960  *	state - State structure to be initialized
961  *	cache - Cache of all section headers
962  *	shnum - # of sections in cache
963  *	secndx - Index of symbol table section
964  *	ehdr - ELF header for file
965  *	versym - Information about versym section
966  *	file - Name of file
967  *	flags - Command line option flags
968  */
969 static int
970 init_symtbl_state(SYMTBL_STATE *state, Cache *cache, Word shnum, Word secndx,
971     Ehdr *ehdr, uchar_t osabi, VERSYM_STATE *versym, const char *file,
972     uint_t flags)
973 {
974 	Shdr *shdr;
975 
976 	state->file = file;
977 	state->ehdr = ehdr;
978 	state->cache = cache;
979 	state->osabi = osabi;
980 	state->shnum = shnum;
981 	state->seccache = &cache[secndx];
982 	state->secndx = secndx;
983 	state->secname = state->seccache->c_name;
984 	state->flags = flags;
985 	state->shxndx.checked = 0;
986 	state->shxndx.data = NULL;
987 	state->shxndx.n = 0;
988 
989 	shdr = state->seccache->c_shdr;
990 
991 	/*
992 	 * Check the symbol data and per-item size.
993 	 */
994 	if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
995 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
996 		    file, state->secname);
997 		return (0);
998 	}
999 	if (state->seccache->c_data == NULL)
1000 		return (0);
1001 
1002 	/* LINTED */
1003 	state->symn = (Word)(shdr->sh_size / shdr->sh_entsize);
1004 	state->sym = (Sym *)state->seccache->c_data->d_buf;
1005 
1006 	/*
1007 	 * Check associated string table section.
1008 	 */
1009 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
1010 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1011 		    file, state->secname, EC_WORD(shdr->sh_link));
1012 		return (0);
1013 	}
1014 
1015 	/*
1016 	 * Determine if there is a associated Versym section
1017 	 * with this Symbol Table.
1018 	 */
1019 	if (versym && versym->cache &&
1020 	    (versym->cache->c_shdr->sh_link == state->secndx))
1021 		state->versym = versym;
1022 	else
1023 		state->versym = NULL;
1024 
1025 
1026 	return (1);
1027 }
1028 
1029 /*
1030  * Determine the extended section index used for symbol tables entries.
1031  */
1032 static void
1033 symbols_getxindex(SYMTBL_STATE *state)
1034 {
1035 	uint_t	symn;
1036 	Word	symcnt;
1037 
1038 	state->shxndx.checked = 1;   /* Note that we've been called */
1039 	for (symcnt = 1; symcnt < state->shnum; symcnt++) {
1040 		Cache	*_cache = &state->cache[symcnt];
1041 		Shdr	*shdr = _cache->c_shdr;
1042 
1043 		if ((shdr->sh_type != SHT_SYMTAB_SHNDX) ||
1044 		    (shdr->sh_link != state->secndx))
1045 			continue;
1046 
1047 		if ((shdr->sh_entsize) &&
1048 		    /* LINTED */
1049 		    ((symn = (uint_t)(shdr->sh_size / shdr->sh_entsize)) == 0))
1050 			continue;
1051 
1052 		if (_cache->c_data == NULL)
1053 			continue;
1054 
1055 		state->shxndx.data = _cache->c_data->d_buf;
1056 		state->shxndx.n = symn;
1057 		return;
1058 	}
1059 }
1060 
1061 /*
1062  * Produce a line of output for the given symbol
1063  *
1064  * entry:
1065  *	state - Symbol table state
1066  *	symndx - Index of symbol within the table
1067  *	info - Value of st_info (indicates local/global range)
1068  *	symndx_disp - Index to display. This may not be the same
1069  *		as symndx if the display is relative to the logical
1070  *		combination of the SUNW_ldynsym/dynsym tables.
1071  *	sym - Symbol to display
1072  */
1073 static void
1074 output_symbol(SYMTBL_STATE *state, Word symndx, Word info, Word disp_symndx,
1075     Sym *sym)
1076 {
1077 	/*
1078 	 * Symbol types for which we check that the specified
1079 	 * address/size land inside the target section.
1080 	 */
1081 	static const int addr_symtype[] = {
1082 		0,			/* STT_NOTYPE */
1083 		1,			/* STT_OBJECT */
1084 		1,			/* STT_FUNC */
1085 		0,			/* STT_SECTION */
1086 		0,			/* STT_FILE */
1087 		1,			/* STT_COMMON */
1088 		0,			/* STT_TLS */
1089 		0,			/* 7 */
1090 		0,			/* 8 */
1091 		0,			/* 9 */
1092 		0,			/* 10 */
1093 		0,			/* 11 */
1094 		0,			/* 12 */
1095 		0,			/* STT_SPARC_REGISTER */
1096 		0,			/* 14 */
1097 		0,			/* 15 */
1098 	};
1099 #if STT_NUM != (STT_TLS + 1)
1100 #error "STT_NUM has grown. Update addr_symtype[]"
1101 #endif
1102 
1103 	char		index[MAXNDXSIZE];
1104 	const char	*symname, *sec;
1105 	Versym		verndx;
1106 	int		gnuver;
1107 	uchar_t		type;
1108 	Shdr		*tshdr;
1109 	Word		shndx;
1110 	Conv_inv_buf_t	inv_buf;
1111 
1112 	/* Ensure symbol index is in range */
1113 	if (symndx >= state->symn) {
1114 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSYMNDX),
1115 		    state->file, state->secname, EC_WORD(symndx));
1116 		return;
1117 	}
1118 
1119 	/*
1120 	 * If we are using extended symbol indexes, find the
1121 	 * corresponding SHN_SYMTAB_SHNDX table.
1122 	 */
1123 	if ((sym->st_shndx == SHN_XINDEX) && (state->shxndx.checked == 0))
1124 		symbols_getxindex(state);
1125 
1126 	/* LINTED */
1127 	symname = string(state->seccache, symndx,
1128 	    &state->cache[state->seccache->c_shdr->sh_link], state->file,
1129 	    sym->st_name);
1130 
1131 	tshdr = NULL;
1132 	sec = NULL;
1133 
1134 	if (state->ehdr->e_type == ET_CORE) {
1135 		sec = (char *)MSG_INTL(MSG_STR_UNKNOWN);
1136 	} else if (state->flags & FLG_CTL_FAKESHDR) {
1137 		/*
1138 		 * If we are using fake section headers derived from
1139 		 * the program headers, then the section indexes
1140 		 * in the symbols do not correspond to these headers.
1141 		 * The section names are not available, so all we can
1142 		 * do is to display them in numeric form.
1143 		 */
1144 		sec = conv_sym_shndx(state->osabi, state->ehdr->e_machine,
1145 		    sym->st_shndx, CONV_FMT_DECIMAL, &inv_buf);
1146 	} else if ((sym->st_shndx < SHN_LORESERVE) &&
1147 	    (sym->st_shndx < state->shnum)) {
1148 		shndx = sym->st_shndx;
1149 		tshdr = state->cache[shndx].c_shdr;
1150 		sec = state->cache[shndx].c_name;
1151 	} else if (sym->st_shndx == SHN_XINDEX) {
1152 		if (state->shxndx.data) {
1153 			Word	_shxndx;
1154 
1155 			if (symndx > state->shxndx.n) {
1156 				(void) fprintf(stderr,
1157 				    MSG_INTL(MSG_ERR_BADSYMXINDEX1),
1158 				    state->file, state->secname,
1159 				    EC_WORD(symndx));
1160 			} else if ((_shxndx =
1161 			    state->shxndx.data[symndx]) > state->shnum) {
1162 				(void) fprintf(stderr,
1163 				    MSG_INTL(MSG_ERR_BADSYMXINDEX2),
1164 				    state->file, state->secname,
1165 				    EC_WORD(symndx), EC_WORD(_shxndx));
1166 			} else {
1167 				shndx = _shxndx;
1168 				tshdr = state->cache[shndx].c_shdr;
1169 				sec = state->cache[shndx].c_name;
1170 			}
1171 		} else {
1172 			(void) fprintf(stderr,
1173 			    MSG_INTL(MSG_ERR_BADSYMXINDEX3),
1174 			    state->file, state->secname, EC_WORD(symndx));
1175 		}
1176 	} else if ((sym->st_shndx < SHN_LORESERVE) &&
1177 	    (sym->st_shndx >= state->shnum)) {
1178 		(void) fprintf(stderr,
1179 		    MSG_INTL(MSG_ERR_BADSYM5), state->file,
1180 		    state->secname, EC_WORD(symndx),
1181 		    demangle(symname, state->flags), sym->st_shndx);
1182 	}
1183 
1184 	/*
1185 	 * If versioning is available display the
1186 	 * version index. If not, then use 0.
1187 	 */
1188 	if (state->versym) {
1189 		Versym test_verndx;
1190 
1191 		verndx = test_verndx = state->versym->data[symndx];
1192 		gnuver = state->versym->gnu_full;
1193 
1194 		/*
1195 		 * Check to see if this is a defined symbol with a
1196 		 * version index that is outside the valid range for
1197 		 * the file. The interpretation of this depends on
1198 		 * the style of versioning used by the object.
1199 		 *
1200 		 * Versions >= VER_NDX_LORESERVE have special meanings,
1201 		 * and are exempt from this checking.
1202 		 *
1203 		 * GNU style version indexes use the top bit of the
1204 		 * 16-bit index value (0x8000) as the "hidden bit".
1205 		 * We must mask off this bit in order to compare
1206 		 * the version against the maximum value.
1207 		 */
1208 		if (gnuver)
1209 			test_verndx &= ~0x8000;
1210 
1211 		if ((test_verndx > state->versym->max_verndx) &&
1212 		    (verndx < VER_NDX_LORESERVE))
1213 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADVER),
1214 			    state->file, state->secname, EC_WORD(symndx),
1215 			    EC_HALF(test_verndx), state->versym->max_verndx);
1216 	} else {
1217 		verndx = 0;
1218 		gnuver = 0;
1219 	}
1220 
1221 	/*
1222 	 * Error checking for TLS.
1223 	 */
1224 	type = ELF_ST_TYPE(sym->st_info);
1225 	if (type == STT_TLS) {
1226 		if (tshdr &&
1227 		    (sym->st_shndx != SHN_UNDEF) &&
1228 		    ((tshdr->sh_flags & SHF_TLS) == 0)) {
1229 			(void) fprintf(stderr,
1230 			    MSG_INTL(MSG_ERR_BADSYM3), state->file,
1231 			    state->secname, EC_WORD(symndx),
1232 			    demangle(symname, state->flags));
1233 		}
1234 	} else if ((type != STT_SECTION) && sym->st_size &&
1235 	    tshdr && (tshdr->sh_flags & SHF_TLS)) {
1236 		(void) fprintf(stderr,
1237 		    MSG_INTL(MSG_ERR_BADSYM4), state->file,
1238 		    state->secname, EC_WORD(symndx),
1239 		    demangle(symname, state->flags));
1240 	}
1241 
1242 	/*
1243 	 * If a symbol with non-zero size has a type that
1244 	 * specifies an address, then make sure the location
1245 	 * it references is actually contained within the
1246 	 * section.  UNDEF symbols don't count in this case,
1247 	 * so we ignore them.
1248 	 *
1249 	 * The meaning of the st_value field in a symbol
1250 	 * depends on the type of object. For a relocatable
1251 	 * object, it is the offset within the section.
1252 	 * For sharable objects, it is the offset relative to
1253 	 * the base of the object, and for other types, it is
1254 	 * the virtual address. To get an offset within the
1255 	 * section for non-ET_REL files, we subtract the
1256 	 * base address of the section.
1257 	 */
1258 	if (addr_symtype[type] && (sym->st_size > 0) &&
1259 	    (sym->st_shndx != SHN_UNDEF) && ((sym->st_shndx < SHN_LORESERVE) ||
1260 	    (sym->st_shndx == SHN_XINDEX)) && (tshdr != NULL)) {
1261 		Word v = sym->st_value;
1262 			if (state->ehdr->e_type != ET_REL)
1263 				v -= tshdr->sh_addr;
1264 		if (((v + sym->st_size) > tshdr->sh_size)) {
1265 			(void) fprintf(stderr,
1266 			    MSG_INTL(MSG_ERR_BADSYM6), state->file,
1267 			    state->secname, EC_WORD(symndx),
1268 			    demangle(symname, state->flags),
1269 			    EC_WORD(shndx), EC_XWORD(tshdr->sh_size),
1270 			    EC_XWORD(sym->st_value), EC_XWORD(sym->st_size));
1271 		}
1272 	}
1273 
1274 	/*
1275 	 * A typical symbol table uses the sh_info field to indicate one greater
1276 	 * than the symbol table index of the last local symbol, STB_LOCAL.
1277 	 * Therefore, symbol indexes less than sh_info should have local
1278 	 * binding.  Symbol indexes greater than, or equal to sh_info, should
1279 	 * have global binding.  Note, we exclude UNDEF/NOTY symbols with zero
1280 	 * value and size, as these symbols may be the result of an mcs(1)
1281 	 * section deletion.
1282 	 */
1283 	if (info) {
1284 		uchar_t	bind = ELF_ST_BIND(sym->st_info);
1285 
1286 		if ((symndx < info) && (bind != STB_LOCAL)) {
1287 			(void) fprintf(stderr,
1288 			    MSG_INTL(MSG_ERR_BADSYM7), state->file,
1289 			    state->secname, EC_WORD(symndx),
1290 			    demangle(symname, state->flags), EC_XWORD(info));
1291 
1292 		} else if ((symndx >= info) && (bind == STB_LOCAL) &&
1293 		    ((sym->st_shndx != SHN_UNDEF) ||
1294 		    (ELF_ST_TYPE(sym->st_info) != STT_NOTYPE) ||
1295 		    (sym->st_size != 0) || (sym->st_value != 0))) {
1296 			(void) fprintf(stderr,
1297 			    MSG_INTL(MSG_ERR_BADSYM8), state->file,
1298 			    state->secname, EC_WORD(symndx),
1299 			    demangle(symname, state->flags), EC_XWORD(info));
1300 		}
1301 	}
1302 
1303 	(void) snprintf(index, MAXNDXSIZE,
1304 	    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(disp_symndx));
1305 	Elf_syms_table_entry(0, ELF_DBG_ELFDUMP, index, state->osabi,
1306 	    state->ehdr->e_machine, sym, verndx, gnuver, sec, symname);
1307 }
1308 
1309 /*
1310  * Process a SHT_SUNW_cap capabilities section.
1311  */
1312 static int
1313 cap_section(const char *file, Cache *cache, Word shnum, Cache *ccache,
1314     uchar_t osabi, Ehdr *ehdr, uint_t flags)
1315 {
1316 	SYMTBL_STATE	state;
1317 	Word		cnum, capnum, nulls, symcaps;
1318 	int		descapndx, objcap, title;
1319 	Cap		*cap = (Cap *)ccache->c_data->d_buf;
1320 	Shdr		*cishdr, *cshdr = ccache->c_shdr;
1321 	Cache		*cicache, *strcache;
1322 	Capinfo		*capinfo = NULL;
1323 	Word		capinfonum;
1324 	const char	*strs = NULL;
1325 	size_t		strs_size;
1326 
1327 	if ((cshdr->sh_entsize == 0) || (cshdr->sh_size == 0)) {
1328 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1329 		    file, ccache->c_name);
1330 		return (0);
1331 	}
1332 
1333 	/*
1334 	 * If this capabilities section is associated with symbols, then the
1335 	 * sh_link field points to the associated capabilities information
1336 	 * section.  The sh_link field of the capabilities information section
1337 	 * points to the associated symbol table.
1338 	 */
1339 	if (cshdr->sh_link) {
1340 		Cache	*scache;
1341 		Shdr	*sshdr;
1342 
1343 		/*
1344 		 * Validate that the sh_link field points to a capabilities
1345 		 * information section.
1346 		 */
1347 		if (cshdr->sh_link >= shnum) {
1348 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1349 			    file, ccache->c_name, EC_WORD(cshdr->sh_link));
1350 			return (0);
1351 		}
1352 
1353 		cicache = &cache[cshdr->sh_link];
1354 		cishdr = cicache->c_shdr;
1355 
1356 		if (cishdr->sh_type != SHT_SUNW_capinfo) {
1357 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAP),
1358 			    file, ccache->c_name, EC_WORD(cshdr->sh_link));
1359 			return (0);
1360 		}
1361 
1362 		capinfo = cicache->c_data->d_buf;
1363 		capinfonum = (Word)(cishdr->sh_size / cishdr->sh_entsize);
1364 
1365 		/*
1366 		 * Validate that the sh_link field of the capabilities
1367 		 * information section points to a valid symbol table.
1368 		 */
1369 		if ((cishdr->sh_link == 0) || (cishdr->sh_link >= shnum)) {
1370 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1371 			    file, cicache->c_name, EC_WORD(cishdr->sh_link));
1372 			return (0);
1373 		}
1374 		scache = &cache[cishdr->sh_link];
1375 		sshdr = scache->c_shdr;
1376 
1377 		if ((sshdr->sh_type != SHT_SYMTAB) &&
1378 		    (sshdr->sh_type != SHT_DYNSYM)) {
1379 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAPINFO1),
1380 			    file, cicache->c_name, EC_WORD(cishdr->sh_link));
1381 			return (0);
1382 		}
1383 
1384 		if (!init_symtbl_state(&state, cache, shnum,
1385 		    cishdr->sh_link, ehdr, osabi, NULL, file, flags))
1386 			return (0);
1387 	}
1388 
1389 	/*
1390 	 * If this capabilities section contains capability string entries,
1391 	 * then determine the associated string table.  Capabilities entries
1392 	 * that define names require that the capability section indicate
1393 	 * which string table to use via sh_info.
1394 	 */
1395 	if (cshdr->sh_info) {
1396 		Shdr	*strshdr;
1397 
1398 		/*
1399 		 * Validate that the sh_info field points to a string table.
1400 		 */
1401 		if (cshdr->sh_info >= shnum) {
1402 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1403 			    file, ccache->c_name, EC_WORD(cshdr->sh_info));
1404 			return (0);
1405 		}
1406 
1407 		strcache = &cache[cshdr->sh_info];
1408 		strshdr = strcache->c_shdr;
1409 
1410 		if (strshdr->sh_type != SHT_STRTAB) {
1411 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAP),
1412 			    file, ccache->c_name, EC_WORD(cshdr->sh_info));
1413 			return (0);
1414 		}
1415 		strs = (const char *)strcache->c_data->d_buf;
1416 		strs_size = strcache->c_data->d_size;
1417 	}
1418 
1419 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1420 	dbg_print(0, MSG_INTL(MSG_ELF_SCN_CAP), ccache->c_name);
1421 
1422 	capnum = (Word)(cshdr->sh_size / cshdr->sh_entsize);
1423 
1424 	nulls = symcaps = 0;
1425 	objcap = title = 1;
1426 	descapndx = -1;
1427 
1428 	/*
1429 	 * Traverse the capabilities section printing each capability group.
1430 	 * The first capabilities group defines any object capabilities.  Any
1431 	 * following groups define symbol capabilities.  In the case where no
1432 	 * object capabilities exist, but symbol capabilities do, a single
1433 	 * CA_SUNW_NULL terminator for the object capabilities exists.
1434 	 */
1435 	for (cnum = 0; cnum < capnum; cap++, cnum++) {
1436 		if (cap->c_tag == CA_SUNW_NULL) {
1437 			/*
1438 			 * A CA_SUNW_NULL tag terminates a capabilities group.
1439 			 * If the first capabilities tag is CA_SUNW_NULL, then
1440 			 * no object capabilities exist.
1441 			 */
1442 			if ((nulls++ == 0) && (cnum == 0))
1443 				objcap = 0;
1444 			title = 1;
1445 		} else {
1446 			if (title) {
1447 				if (nulls == 0) {
1448 					/*
1449 					 * If this capabilities group represents
1450 					 * the object capabilities (i.e., no
1451 					 * CA_SUNW_NULL tag has been processed
1452 					 * yet), then display an object
1453 					 * capabilities title.
1454 					 */
1455 					dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1456 					dbg_print(0,
1457 					    MSG_INTL(MSG_OBJ_CAP_TITLE));
1458 				} else {
1459 					/*
1460 					 * If this is a symbols capabilities
1461 					 * group (i.e., a CA_SUNW_NULL tag has
1462 					 * already be found that terminates
1463 					 * the object capabilities group), then
1464 					 * display a symbol capabilities title,
1465 					 * and retain this capabilities index
1466 					 * for later processing.
1467 					 */
1468 					dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1469 					dbg_print(0,
1470 					    MSG_INTL(MSG_SYM_CAP_TITLE));
1471 					descapndx = cnum;
1472 				}
1473 				Elf_cap_title(0);
1474 				title = 0;
1475 			}
1476 
1477 			/*
1478 			 * Print the capabilities data.
1479 			 *
1480 			 * Note that CA_SUNW_PLAT, CA_SUNW_MACH and CA_SUNW_ID
1481 			 * entries require a string table, which should have
1482 			 * already been established.
1483 			 */
1484 			if ((strs == NULL) && ((cap->c_tag == CA_SUNW_PLAT) ||
1485 			    (cap->c_tag == CA_SUNW_MACH) ||
1486 			    (cap->c_tag == CA_SUNW_ID))) {
1487 				(void) fprintf(stderr,
1488 				    MSG_INTL(MSG_WARN_INVCAP4), file,
1489 				    EC_WORD(elf_ndxscn(ccache->c_scn)),
1490 				    ccache->c_name, EC_WORD(cshdr->sh_info));
1491 			}
1492 			Elf_cap_entry(0, cap, cnum, strs, strs_size,
1493 			    ehdr->e_machine);
1494 		}
1495 
1496 		/*
1497 		 * If this CA_SUNW_NULL tag terminates a symbol capabilities
1498 		 * group, determine the associated symbols.
1499 		 */
1500 		if ((cap->c_tag == CA_SUNW_NULL) && (nulls > 1) &&
1501 		    (descapndx != -1)) {
1502 			Capinfo	*cip;
1503 			Word	inum;
1504 
1505 			symcaps++;
1506 
1507 			/*
1508 			 * Make sure we've discovered a SHT_SUNW_capinfo table.
1509 			 */
1510 			if ((cip = capinfo) == NULL) {
1511 				(void) fprintf(stderr,
1512 				    MSG_INTL(MSG_ERR_INVCAP), file,
1513 				    ccache->c_name, EC_WORD(cshdr->sh_link));
1514 				return (0);
1515 			}
1516 
1517 			/*
1518 			 * Determine what symbols reference this capabilities
1519 			 * group.
1520 			 */
1521 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1522 			dbg_print(0, MSG_INTL(MSG_CAPINFO_ENTRIES));
1523 			Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
1524 
1525 			for (inum = 1, cip++; inum < capinfonum;
1526 			    inum++, cip++) {
1527 				Word	gndx = (Word)ELF_C_GROUP(*cip);
1528 
1529 				if (gndx && (gndx == descapndx)) {
1530 					output_symbol(&state, inum, 0,
1531 					    inum, state.sym + inum);
1532 				}
1533 			}
1534 			descapndx = -1;
1535 			continue;
1536 		}
1537 
1538 		/*
1539 		 * An SF1_SUNW_ADDR32 software capability tag in a 32-bit
1540 		 * object is suspicious as it has no effect.
1541 		 */
1542 		if ((cap->c_tag == CA_SUNW_SF_1) &&
1543 		    (ehdr->e_ident[EI_CLASS] == ELFCLASS32) &&
1544 		    (cap->c_un.c_val & SF1_SUNW_ADDR32)) {
1545 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INADDR32SF1),
1546 			    file, ccache->c_name);
1547 		}
1548 	}
1549 
1550 	/*
1551 	 * If this is a dynamic object, with symbol capabilities, then a
1552 	 * .SUNW_capchain section should exist.  This section contains a chain
1553 	 * of symbol indexes for each capabilities family.  This is the list
1554 	 * that is searched by ld.so.1 to determine the best capabilities
1555 	 * candidate.
1556 	 *
1557 	 * Note, more than one capabilities lead symbol can point to the same
1558 	 * family chain.  For example, a weak/global pair of symbols can both
1559 	 * represent the same family of capabilities symbols.  Therefore, to
1560 	 * display all possible families we traverse the capabilities
1561 	 * information section looking for CAPINFO_SUNW_GLOB lead symbols.
1562 	 * From these we determine the associated capabilities chain to inspect.
1563 	 */
1564 	if (symcaps &&
1565 	    ((ehdr->e_type == ET_EXEC) || (ehdr->e_type == ET_DYN))) {
1566 		Capinfo		*cip;
1567 		Capchain	*chain;
1568 		Cache   	*chcache;
1569 		Shdr		*chshdr;
1570 		Word		chainnum, inum;
1571 
1572 		/*
1573 		 * Validate that the sh_info field of the capabilities
1574 		 * information section points to a capabilities chain section.
1575 		 */
1576 		if (cishdr->sh_info >= shnum) {
1577 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1578 			    file, cicache->c_name, EC_WORD(cishdr->sh_info));
1579 			return (0);
1580 		}
1581 
1582 		chcache = &cache[cishdr->sh_info];
1583 		chshdr = chcache->c_shdr;
1584 
1585 		if (chshdr->sh_type != SHT_SUNW_capchain) {
1586 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_INVCAPINFO2),
1587 			    file, cicache->c_name, EC_WORD(cishdr->sh_info));
1588 			return (0);
1589 		}
1590 
1591 		chainnum = (Word)(chshdr->sh_size / chshdr->sh_entsize);
1592 		chain = (Capchain *)chcache->c_data->d_buf;
1593 
1594 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1595 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_CAPCHAIN), chcache->c_name);
1596 
1597 		/*
1598 		 * Traverse the capabilities information section looking for
1599 		 * CAPINFO_SUNW_GLOB lead capabilities symbols.
1600 		 */
1601 		cip = capinfo;
1602 		for (inum = 1, cip++; inum < capinfonum; inum++, cip++) {
1603 			const char	*name;
1604 			Sym		*sym;
1605 			Word		sndx, cndx;
1606 			Word		gndx = (Word)ELF_C_GROUP(*cip);
1607 
1608 			if ((gndx == 0) || (gndx != CAPINFO_SUNW_GLOB))
1609 				continue;
1610 
1611 			/*
1612 			 * Determine the symbol that is associated with this
1613 			 * capability information entry, and use this to
1614 			 * identify this capability family.
1615 			 */
1616 			sym = (Sym *)(state.sym + inum);
1617 			name = string(cicache, inum, strcache, file,
1618 			    sym->st_name);
1619 
1620 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1621 			dbg_print(0, MSG_INTL(MSG_CAPCHAIN_TITLE), name);
1622 			dbg_print(0, MSG_INTL(MSG_CAPCHAIN_ENTRY));
1623 
1624 			cndx = (Word)ELF_C_SYM(*cip);
1625 
1626 			/*
1627 			 * Traverse this families chain and identify each
1628 			 * family member.
1629 			 */
1630 			for (;;) {
1631 				char	_chain[MAXNDXSIZE], _symndx[MAXNDXSIZE];
1632 
1633 				if (cndx >= chainnum) {
1634 					(void) fprintf(stderr,
1635 					    MSG_INTL(MSG_ERR_INVCAPINFO3), file,
1636 					    cicache->c_name, EC_WORD(inum),
1637 					    EC_WORD(cndx));
1638 					break;
1639 				}
1640 				if ((sndx = chain[cndx]) == 0)
1641 					break;
1642 
1643 				/*
1644 				 * Determine this entries symbol reference.
1645 				 */
1646 				if (sndx > state.symn) {
1647 					(void) fprintf(stderr,
1648 					    MSG_INTL(MSG_ERR_CHBADSYMNDX), file,
1649 					    EC_WORD(sndx), chcache->c_name,
1650 					    EC_WORD(cndx));
1651 					name = MSG_INTL(MSG_STR_UNKNOWN);
1652 				} else {
1653 					sym = (Sym *)(state.sym + sndx);
1654 					name = string(chcache, sndx,
1655 					    strcache, file, sym->st_name);
1656 				}
1657 
1658 				/*
1659 				 * Display the family member.
1660 				 */
1661 				(void) snprintf(_chain, MAXNDXSIZE,
1662 				    MSG_ORIG(MSG_FMT_INTEGER), cndx);
1663 				(void) snprintf(_symndx, MAXNDXSIZE,
1664 				    MSG_ORIG(MSG_FMT_INDEX2), EC_WORD(sndx));
1665 				dbg_print(0, MSG_ORIG(MSG_FMT_CHAIN_INFO),
1666 				    _chain, _symndx, demangle(name, flags));
1667 
1668 				cndx++;
1669 			}
1670 		}
1671 	}
1672 	return (objcap);
1673 }
1674 
1675 /*
1676  * Print the capabilities.
1677  *
1678  * A .SUNW_cap section can contain one or more, CA_SUNW_NULL terminated,
1679  * capabilities groups.  The first group defines the object capabilities.
1680  * This group defines the minimum capability requirements of the entire
1681  * object file.  If this is a dynamic object, this group should be associated
1682  * with a PT_SUNWCAP program header.
1683  *
1684  * Additional capabilities groups define the association of individual symbols
1685  * to specific capabilities.
1686  */
1687 static void
1688 cap(const char *file, Cache *cache, Word shnum, Word phnum, Ehdr *ehdr,
1689     uchar_t osabi, Elf *elf, uint_t flags)
1690 {
1691 	Word		cnt;
1692 	Shdr		*cshdr = NULL;
1693 	Cache		*ccache;
1694 	Off		cphdr_off = 0;
1695 	Xword		cphdr_sz;
1696 
1697 	/*
1698 	 * Determine if a global capabilities header exists.
1699 	 */
1700 	if (phnum) {
1701 		Phdr	*phdr;
1702 
1703 		if ((phdr = elf_getphdr(elf)) == NULL) {
1704 			failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
1705 			return;
1706 		}
1707 
1708 		for (cnt = 0; cnt < phnum; phdr++, cnt++) {
1709 			if (phdr->p_type == PT_SUNWCAP) {
1710 				cphdr_off = phdr->p_offset;
1711 				cphdr_sz = phdr->p_filesz;
1712 				break;
1713 			}
1714 		}
1715 	}
1716 
1717 	/*
1718 	 * Determine if a capabilities section exists.
1719 	 */
1720 	for (cnt = 1; cnt < shnum; cnt++) {
1721 		Cache	*_cache = &cache[cnt];
1722 		Shdr	*shdr = _cache->c_shdr;
1723 
1724 		/*
1725 		 * Process any capabilities information.
1726 		 */
1727 		if (shdr->sh_type == SHT_SUNW_cap) {
1728 			if (cap_section(file, cache, shnum, _cache, osabi,
1729 			    ehdr, flags)) {
1730 				/*
1731 				 * If this section defined an object capability
1732 				 * group, retain the section information for
1733 				 * program header validation.
1734 				 */
1735 				ccache = _cache;
1736 				cshdr = shdr;
1737 			}
1738 			continue;
1739 		}
1740 	}
1741 
1742 	if ((cshdr == NULL) && (cphdr_off == 0))
1743 		return;
1744 
1745 	if (cphdr_off && (cshdr == NULL))
1746 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP1), file);
1747 
1748 	/*
1749 	 * If this object is an executable or shared object, and it provided
1750 	 * an object capabilities group, then the group should have an
1751 	 * accompanying PT_SUNWCAP program header.
1752 	 */
1753 	if (cshdr && ((ehdr->e_type == ET_EXEC) || (ehdr->e_type == ET_DYN))) {
1754 		if (cphdr_off == 0) {
1755 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP2),
1756 			    file, EC_WORD(elf_ndxscn(ccache->c_scn)),
1757 			    ccache->c_name);
1758 		} else if ((cphdr_off != cshdr->sh_offset) ||
1759 		    (cphdr_sz != cshdr->sh_size)) {
1760 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP3),
1761 			    file, EC_WORD(elf_ndxscn(ccache->c_scn)),
1762 			    ccache->c_name);
1763 		}
1764 	}
1765 }
1766 
1767 /*
1768  * Print the interpretor.
1769  */
1770 static void
1771 interp(const char *file, Cache *cache, Word shnum, Word phnum, Elf *elf)
1772 {
1773 	static Word phdr_types[] = { PT_INTERP };
1774 
1775 
1776 	Word	cnt;
1777 	Shdr	*ishdr = NULL;
1778 	Cache	*icache = NULL;
1779 	Off	iphdr_off = 0;
1780 	Xword	iphdr_fsz;
1781 
1782 	/*
1783 	 * Determine if an interp header exists.
1784 	 */
1785 	if (phnum) {
1786 		Phdr	*phdr;
1787 
1788 		phdr = getphdr(phnum, phdr_types,
1789 		    sizeof (phdr_types) / sizeof (*phdr_types), file, elf);
1790 		if (phdr != NULL) {
1791 			iphdr_off = phdr->p_offset;
1792 			iphdr_fsz = phdr->p_filesz;
1793 		}
1794 	}
1795 
1796 	if (iphdr_off == 0)
1797 		return;
1798 
1799 	/*
1800 	 * Determine if an interp section exists.
1801 	 */
1802 	for (cnt = 1; cnt < shnum; cnt++) {
1803 		Cache	*_cache = &cache[cnt];
1804 		Shdr	*shdr = _cache->c_shdr;
1805 
1806 		/*
1807 		 * Scan sections to find a section which contains the PT_INTERP
1808 		 * string.  The target section can't be in a NOBITS section.
1809 		 */
1810 		if ((shdr->sh_type == SHT_NOBITS) ||
1811 		    (iphdr_off < shdr->sh_offset) ||
1812 		    (iphdr_off + iphdr_fsz) > (shdr->sh_offset + shdr->sh_size))
1813 			continue;
1814 
1815 		icache = _cache;
1816 		ishdr = shdr;
1817 		break;
1818 	}
1819 
1820 	/*
1821 	 * Print the interpreter string based on the offset defined in the
1822 	 * program header, as this is the offset used by the kernel.
1823 	 */
1824 	if ((ishdr != NULL) &&
1825 	    (icache != NULL) &&
1826 	    (icache->c_data != NULL) &&
1827 	    (icache->c_data->d_buf != NULL) &&
1828 	    (icache->c_data->d_size > 0)) {
1829 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1830 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_INTERP), icache->c_name);
1831 		dbg_print(0, MSG_ORIG(MSG_FMT_INDENT),
1832 		    (char *)icache->c_data->d_buf +
1833 		    (iphdr_off - ishdr->sh_offset));
1834 	} else
1835 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVINTERP1), file);
1836 
1837 	/*
1838 	 * If there are any inconsistences between the program header and
1839 	 * section information, flag them.
1840 	 */
1841 	if (ishdr && ((iphdr_off != ishdr->sh_offset) ||
1842 	    (iphdr_fsz != ishdr->sh_size))) {
1843 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVINTERP2), file,
1844 		    icache->c_name);
1845 	}
1846 }
1847 
1848 /*
1849  * Print the syminfo section.
1850  */
1851 static void
1852 syminfo(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
1853 {
1854 	Shdr		*infoshdr;
1855 	Syminfo		*info;
1856 	Sym		*syms;
1857 	Dyn		*dyns;
1858 	Word		infonum, cnt, ndx, symnum, dynnum;
1859 	Cache		*infocache = NULL, *dyncache = NULL, *symsec, *strsec;
1860 	Boolean		*dynerr;
1861 
1862 	for (cnt = 1; cnt < shnum; cnt++) {
1863 		if (cache[cnt].c_shdr->sh_type == SHT_SUNW_syminfo) {
1864 			infocache = &cache[cnt];
1865 			break;
1866 		}
1867 	}
1868 	if (infocache == NULL)
1869 		return;
1870 
1871 	infoshdr = infocache->c_shdr;
1872 	if ((infoshdr->sh_entsize == 0) || (infoshdr->sh_size == 0)) {
1873 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1874 		    file, infocache->c_name);
1875 		return;
1876 	}
1877 	if (infocache->c_data == NULL)
1878 		return;
1879 
1880 	infonum = (Word)(infoshdr->sh_size / infoshdr->sh_entsize);
1881 	info = (Syminfo *)infocache->c_data->d_buf;
1882 
1883 	/*
1884 	 * If there is no associated dynamic section, determine if one
1885 	 * is needed, and if so issue a warning. If there is an
1886 	 * associated dynamic section, validate it and get the data buffer
1887 	 * for it.
1888 	 */
1889 	dyns = NULL;
1890 	dynnum = 0;
1891 	if (infoshdr->sh_info == 0) {
1892 		Syminfo	*_info = info + 1;
1893 
1894 		for (ndx = 1; ndx < infonum; ndx++, _info++) {
1895 			if ((_info->si_flags == 0) && (_info->si_boundto == 0))
1896 				continue;
1897 
1898 			if (_info->si_boundto < SYMINFO_BT_LOWRESERVE)
1899 				(void) fprintf(stderr,
1900 				    MSG_INTL(MSG_ERR_BADSHINFO), file,
1901 				    infocache->c_name,
1902 				    EC_WORD(infoshdr->sh_info));
1903 		}
1904 	} else if ((infoshdr->sh_info >= shnum) ||
1905 	    (cache[infoshdr->sh_info].c_shdr->sh_type != SHT_DYNAMIC)) {
1906 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHINFO),
1907 		    file, infocache->c_name, EC_WORD(infoshdr->sh_info));
1908 	} else {
1909 		dyncache = &cache[infoshdr->sh_info];
1910 		if ((dyncache->c_data == NULL) ||
1911 		    ((dyns = dyncache->c_data->d_buf) == NULL)) {
1912 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1913 			    file, dyncache->c_name);
1914 		}
1915 		if (dyns != NULL) {
1916 			dynnum = dyncache->c_shdr->sh_size /
1917 			    dyncache->c_shdr->sh_entsize;
1918 
1919 			/*
1920 			 * We validate the type of dynamic elements referenced
1921 			 * from the syminfo. This array is used report any
1922 			 * bad dynamic entries.
1923 			 */
1924 			if ((dynerr = calloc(dynnum, sizeof (*dynerr))) ==
1925 			    NULL) {
1926 				int err = errno;
1927 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
1928 				    file, strerror(err));
1929 				return;
1930 			}
1931 		}
1932 	}
1933 
1934 	/*
1935 	 * Get the data buffer for the associated symbol table and string table.
1936 	 */
1937 	if (stringtbl(cache, 1, cnt, shnum, file,
1938 	    &symnum, &symsec, &strsec) == 0)
1939 		return;
1940 
1941 	syms = symsec->c_data->d_buf;
1942 
1943 	/*
1944 	 * Loop through the syminfo entries.
1945 	 */
1946 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1947 	dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMINFO), infocache->c_name);
1948 	Elf_syminfo_title(0);
1949 
1950 	for (ndx = 1, info++; ndx < infonum; ndx++, info++) {
1951 		Sym 		*sym;
1952 		const char	*needed, *name;
1953 		Word		expect_dt;
1954 		Word		boundto = info->si_boundto;
1955 
1956 		if ((info->si_flags == 0) && (boundto == 0))
1957 			continue;
1958 
1959 		sym = &syms[ndx];
1960 		name = string(infocache, ndx, strsec, file, sym->st_name);
1961 
1962 		/* Is si_boundto set to one of the reserved values? */
1963 		if (boundto >= SYMINFO_BT_LOWRESERVE) {
1964 			Elf_syminfo_entry(0, ndx, info, name, NULL);
1965 			continue;
1966 		}
1967 
1968 		/*
1969 		 * si_boundto is referencing a dynamic section. If we don't
1970 		 * have one, an error was already issued above, so it suffices
1971 		 * to display an empty string. If we are out of bounds, then
1972 		 * report that and then display an empty string.
1973 		 */
1974 		if ((dyns == NULL) || (boundto >= dynnum)) {
1975 			if (dyns != NULL)
1976 				(void) fprintf(stderr,
1977 				    MSG_INTL(MSG_ERR_BADSIDYNNDX), file,
1978 				    infocache->c_ndx, infocache->c_name,
1979 				    EC_WORD(ndx), EC_WORD(dynnum - 1),
1980 				    EC_WORD(boundto));
1981 			Elf_syminfo_entry(0, ndx, info, name,
1982 			    MSG_ORIG(MSG_STR_EMPTY));
1983 			continue;
1984 		}
1985 
1986 		/*
1987 		 * The si_boundto reference expects a specific dynamic element
1988 		 * type at the given index. The dynamic element is always a
1989 		 * string that gives an object name. The specific type depends
1990 		 * on the si_flags present. Ensure that we've got the right
1991 		 * type.
1992 		 */
1993 		if (info->si_flags & SYMINFO_FLG_FILTER)
1994 			expect_dt = DT_SUNW_FILTER;
1995 		else if (info->si_flags & SYMINFO_FLG_AUXILIARY)
1996 			expect_dt = DT_SUNW_AUXILIARY;
1997 		else if (info->si_flags & (SYMINFO_FLG_DIRECT |
1998 		    SYMINFO_FLG_LAZYLOAD | SYMINFO_FLG_DIRECTBIND))
1999 			expect_dt = DT_NEEDED;
2000 		else
2001 			expect_dt = DT_NULL;   /* means we ignore the type */
2002 
2003 		if ((dyns[boundto].d_tag != expect_dt) &&
2004 		    (expect_dt != DT_NULL)) {
2005 			Conv_inv_buf_t	buf1, buf2;
2006 
2007 			/* Only complain about each dynamic element once */
2008 			if (!dynerr[boundto]) {
2009 				(void) fprintf(stderr,
2010 				    MSG_INTL(MSG_ERR_BADSIDYNTAG),
2011 				    file, infocache->c_ndx, infocache->c_name,
2012 				    EC_WORD(ndx), dyncache->c_ndx,
2013 				    dyncache->c_name, EC_WORD(boundto),
2014 				    conv_dyn_tag(expect_dt, osabi,
2015 				    ehdr->e_machine, CONV_FMT_ALT_CF, &buf1),
2016 				    conv_dyn_tag(dyns[boundto].d_tag, osabi,
2017 				    ehdr->e_machine, CONV_FMT_ALT_CF, &buf2));
2018 				dynerr[boundto] = TRUE;
2019 			}
2020 		}
2021 
2022 		/*
2023 		 * Whether or not the DT item we're pointing at is
2024 		 * of the right type, if it's a type we recognize as
2025 		 * providing a string, go ahead and show it. Otherwise
2026 		 * an empty string.
2027 		 */
2028 		switch (dyns[boundto].d_tag) {
2029 		case DT_NEEDED:
2030 		case DT_SONAME:
2031 		case DT_RPATH:
2032 		case DT_RUNPATH:
2033 		case DT_CONFIG:
2034 		case DT_DEPAUDIT:
2035 		case DT_USED:
2036 		case DT_AUDIT:
2037 		case DT_SUNW_AUXILIARY:
2038 		case DT_SUNW_FILTER:
2039 		case DT_FILTER:
2040 		case DT_AUXILIARY:
2041 			needed = string(infocache, boundto,
2042 			    strsec, file, dyns[boundto].d_un.d_val);
2043 			break;
2044 		default:
2045 			needed = MSG_ORIG(MSG_STR_EMPTY);
2046 		}
2047 		Elf_syminfo_entry(0, ndx, info, name, needed);
2048 	}
2049 	if (dyns != NULL)
2050 		free(dynerr);
2051 }
2052 
2053 /*
2054  * Print version definition section entries.
2055  */
2056 static void
2057 version_def(Verdef *vdf, Word vdf_num, Cache *vcache, Cache *scache,
2058     const char *file)
2059 {
2060 	Word	cnt;
2061 	char	index[MAXNDXSIZE];
2062 
2063 	Elf_ver_def_title(0);
2064 
2065 	for (cnt = 1; cnt <= vdf_num; cnt++,
2066 	    vdf = (Verdef *)((uintptr_t)vdf + vdf->vd_next)) {
2067 		Conv_ver_flags_buf_t	ver_flags_buf;
2068 		const char		*name, *dep;
2069 		Half			vcnt = vdf->vd_cnt - 1;
2070 		Half			ndx = vdf->vd_ndx;
2071 		Verdaux	*vdap = (Verdaux *)((uintptr_t)vdf + vdf->vd_aux);
2072 
2073 		/*
2074 		 * Obtain the name and first dependency (if any).
2075 		 */
2076 		name = string(vcache, cnt, scache, file, vdap->vda_name);
2077 		vdap = (Verdaux *)((uintptr_t)vdap + vdap->vda_next);
2078 		if (vcnt)
2079 			dep = string(vcache, cnt, scache, file, vdap->vda_name);
2080 		else
2081 			dep = MSG_ORIG(MSG_STR_EMPTY);
2082 
2083 		(void) snprintf(index, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX),
2084 		    EC_XWORD(ndx));
2085 		Elf_ver_line_1(0, index, name, dep,
2086 		    conv_ver_flags(vdf->vd_flags, 0, &ver_flags_buf));
2087 
2088 		/*
2089 		 * Print any additional dependencies.
2090 		 */
2091 		if (vcnt) {
2092 			vdap = (Verdaux *)((uintptr_t)vdap + vdap->vda_next);
2093 			for (vcnt--; vcnt; vcnt--,
2094 			    vdap = (Verdaux *)((uintptr_t)vdap +
2095 			    vdap->vda_next)) {
2096 				dep = string(vcache, cnt, scache, file,
2097 				    vdap->vda_name);
2098 				Elf_ver_line_2(0, MSG_ORIG(MSG_STR_EMPTY), dep);
2099 			}
2100 		}
2101 	}
2102 }
2103 
2104 /*
2105  * Print version needed section entries.
2106  *
2107  * entry:
2108  *	vnd - Address of verneed data
2109  *	vnd_num - # of Verneed entries
2110  *	vcache - Cache of verneed section being processed
2111  *	scache - Cache of associated string table section
2112  *	file - Name of object being processed.
2113  *	versym - Information about versym section
2114  *
2115  * exit:
2116  *	The versions have been printed. If GNU style versioning
2117  *	is in effect, versym->max_verndx has been updated to
2118  *	contain the largest version index seen.
2119  *
2120  * note:
2121  * 	The versym section of an object that follows the original
2122  *	Solaris versioning rules only contains indexes into the verdef
2123  *	section. Symbols defined in other objects (UNDEF) are given
2124  *	a version of 0, indicating that they are not defined by
2125  *	this file, and the Verneed entries do not have associated version
2126  *	indexes. For these reasons, we do not display a version index
2127  *	for original-style Verneed sections.
2128  *
2129  *	The GNU versioning extensions alter this: Symbols defined in other
2130  *	objects receive a version index in the range above those defined
2131  *	by the Verdef section, and the vna_other field of the Vernaux
2132  *	structs inside the Verneed section contain the version index for
2133  *	that item. We therefore  display the index when showing the
2134  *	contents of a GNU style Verneed section. You should not
2135  *	necessarily expect these indexes to appear in sorted
2136  *	order --- it seems that the GNU ld assigns the versions as
2137  *	symbols are encountered during linking, and then the results
2138  *	are assembled into the Verneed section afterwards.
2139  */
2140 static void
2141 version_need(Verneed *vnd, Word vnd_num, Cache *vcache, Cache *scache,
2142     const char *file, VERSYM_STATE *versym)
2143 {
2144 	Word		cnt;
2145 	char		index[MAXNDXSIZE];
2146 	const char	*index_str;
2147 
2148 	Elf_ver_need_title(0, versym->gnu_needed);
2149 
2150 	for (cnt = 1; cnt <= vnd_num; cnt++,
2151 	    vnd = (Verneed *)((uintptr_t)vnd + vnd->vn_next)) {
2152 		Conv_ver_flags_buf_t	ver_flags_buf;
2153 		const char		*name, *dep;
2154 		Half			vcnt = vnd->vn_cnt;
2155 		Vernaux *vnap = (Vernaux *)((uintptr_t)vnd + vnd->vn_aux);
2156 
2157 		/*
2158 		 * Obtain the name of the needed file and the version name
2159 		 * within it that we're dependent on.  Note that the count
2160 		 * should be at least one, otherwise this is a pretty bogus
2161 		 * entry.
2162 		 */
2163 		name = string(vcache, cnt, scache, file, vnd->vn_file);
2164 		if (vcnt)
2165 			dep = string(vcache, cnt, scache, file, vnap->vna_name);
2166 		else
2167 			dep = MSG_INTL(MSG_STR_NULL);
2168 
2169 		if (vnap->vna_other == 0) {	/* Traditional form */
2170 			index_str = MSG_ORIG(MSG_STR_EMPTY);
2171 		} else {			/* GNU form */
2172 			index_str = index;
2173 			/* Format the version index value */
2174 			(void) snprintf(index, MAXNDXSIZE,
2175 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(vnap->vna_other));
2176 			if (vnap->vna_other > versym->max_verndx)
2177 				versym->max_verndx = vnap->vna_other;
2178 		}
2179 		Elf_ver_line_1(0, index_str, name, dep,
2180 		    conv_ver_flags(vnap->vna_flags, 0, &ver_flags_buf));
2181 
2182 		/*
2183 		 * Print any additional version dependencies.
2184 		 */
2185 		if (vcnt) {
2186 			vnap = (Vernaux *)((uintptr_t)vnap + vnap->vna_next);
2187 			for (vcnt--; vcnt; vcnt--,
2188 			    vnap = (Vernaux *)((uintptr_t)vnap +
2189 			    vnap->vna_next)) {
2190 				dep = string(vcache, cnt, scache, file,
2191 				    vnap->vna_name);
2192 				if (vnap->vna_other > 0) {
2193 					/* Format the next index value */
2194 					(void) snprintf(index, MAXNDXSIZE,
2195 					    MSG_ORIG(MSG_FMT_INDEX),
2196 					    EC_XWORD(vnap->vna_other));
2197 					Elf_ver_line_1(0, index,
2198 					    MSG_ORIG(MSG_STR_EMPTY), dep,
2199 					    conv_ver_flags(vnap->vna_flags,
2200 					    0, &ver_flags_buf));
2201 					if (vnap->vna_other >
2202 					    versym->max_verndx)
2203 						versym->max_verndx =
2204 						    vnap->vna_other;
2205 				} else {
2206 					Elf_ver_line_3(0,
2207 					    MSG_ORIG(MSG_STR_EMPTY), dep,
2208 					    conv_ver_flags(vnap->vna_flags,
2209 					    0, &ver_flags_buf));
2210 				}
2211 			}
2212 		}
2213 	}
2214 }
2215 
2216 /*
2217  * Examine the Verneed section for information related to GNU
2218  * style Versym indexing:
2219  *	- A non-zero vna_other field indicates that Versym indexes can
2220  *		reference Verneed records.
2221  *	- If the object uses GNU style Versym indexing, the
2222  *	  maximum index value is needed to detect bad Versym entries.
2223  *
2224  * entry:
2225  *	vnd - Address of verneed data
2226  *	vnd_num - # of Verneed entries
2227  *	versym - Information about versym section
2228  *
2229  * exit:
2230  *	If a non-zero vna_other field is seen, versym->gnu_needed is set.
2231  *
2232  *	versym->max_verndx has been updated to contain the largest
2233  *	version index seen.
2234  */
2235 static void
2236 update_gnu_verndx(Verneed *vnd, Word vnd_num, VERSYM_STATE *versym)
2237 {
2238 	Word		cnt;
2239 
2240 	for (cnt = 1; cnt <= vnd_num; cnt++,
2241 	    vnd = (Verneed *)((uintptr_t)vnd + vnd->vn_next)) {
2242 		Half	vcnt = vnd->vn_cnt;
2243 		Vernaux	*vnap = (Vernaux *)((uintptr_t)vnd + vnd->vn_aux);
2244 
2245 		/*
2246 		 * A non-zero value of vna_other indicates that this
2247 		 * object references VERNEED items from the VERSYM
2248 		 * array.
2249 		 */
2250 		if (vnap->vna_other != 0) {
2251 			versym->gnu_needed = 1;
2252 			if (vnap->vna_other > versym->max_verndx)
2253 				versym->max_verndx = vnap->vna_other;
2254 		}
2255 
2256 		/*
2257 		 * Check any additional version dependencies.
2258 		 */
2259 		if (vcnt) {
2260 			vnap = (Vernaux *)((uintptr_t)vnap + vnap->vna_next);
2261 			for (vcnt--; vcnt; vcnt--,
2262 			    vnap = (Vernaux *)((uintptr_t)vnap +
2263 			    vnap->vna_next)) {
2264 				if (vnap->vna_other == 0)
2265 					continue;
2266 
2267 				versym->gnu_needed = 1;
2268 				if (vnap->vna_other > versym->max_verndx)
2269 					versym->max_verndx = vnap->vna_other;
2270 			}
2271 		}
2272 	}
2273 }
2274 
2275 /*
2276  * Display version section information if the flags require it.
2277  * Return version information needed by other output.
2278  *
2279  * entry:
2280  *	cache - Cache of all section headers
2281  *	shnum - # of sections in cache
2282  *	file - Name of file
2283  *	flags - Command line option flags
2284  *	versym - VERSYM_STATE block to be filled in.
2285  */
2286 static void
2287 versions(Cache *cache, Word shnum, const char *file, uint_t flags,
2288     VERSYM_STATE *versym)
2289 {
2290 	GElf_Word	cnt;
2291 	Cache		*verdef_cache = NULL, *verneed_cache = NULL;
2292 
2293 
2294 	/* Gather information about the version sections */
2295 	versym->max_verndx = 1;
2296 	for (cnt = 1; cnt < shnum; cnt++) {
2297 		Cache		*_cache = &cache[cnt];
2298 		Shdr		*shdr = _cache->c_shdr;
2299 		Dyn		*dyn;
2300 		ulong_t		numdyn;
2301 
2302 		switch (shdr->sh_type) {
2303 		case SHT_DYNAMIC:
2304 			/*
2305 			 * The GNU ld puts a DT_VERSYM entry in the dynamic
2306 			 * section so that the runtime linker can use it to
2307 			 * implement their versioning rules. They allow multiple
2308 			 * incompatible functions with the same name to exist
2309 			 * in different versions. The Solaris ld does not
2310 			 * support this mechanism, and as such, does not
2311 			 * produce DT_VERSYM. We use this fact to determine
2312 			 * which ld produced this object, and how to interpret
2313 			 * the version values.
2314 			 */
2315 			if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0) ||
2316 			    (_cache->c_data == NULL))
2317 				continue;
2318 			numdyn = shdr->sh_size / shdr->sh_entsize;
2319 			dyn = (Dyn *)_cache->c_data->d_buf;
2320 			for (; numdyn-- > 0; dyn++)
2321 				if (dyn->d_tag == DT_VERSYM) {
2322 					versym->gnu_full =
2323 					    versym->gnu_needed = 1;
2324 					break;
2325 				}
2326 			break;
2327 
2328 		case SHT_SUNW_versym:
2329 			/* Record data address for later symbol processing */
2330 			if (_cache->c_data != NULL) {
2331 				versym->cache = _cache;
2332 				versym->data = _cache->c_data->d_buf;
2333 				continue;
2334 			}
2335 			break;
2336 
2337 		case SHT_SUNW_verdef:
2338 		case SHT_SUNW_verneed:
2339 			/*
2340 			 * Ensure the data is non-NULL and the number
2341 			 * of items is non-zero. Otherwise, we don't
2342 			 * understand the section, and will not use it.
2343 			 */
2344 			if ((_cache->c_data == NULL) ||
2345 			    (_cache->c_data->d_buf == NULL)) {
2346 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2347 				    file, _cache->c_name);
2348 				continue;
2349 			}
2350 			if (shdr->sh_info == 0) {
2351 				(void) fprintf(stderr,
2352 				    MSG_INTL(MSG_ERR_BADSHINFO),
2353 				    file, _cache->c_name,
2354 				    EC_WORD(shdr->sh_info));
2355 				continue;
2356 			}
2357 
2358 			/* Make sure the string table index is in range */
2359 			if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
2360 				(void) fprintf(stderr,
2361 				    MSG_INTL(MSG_ERR_BADSHLINK), file,
2362 				    _cache->c_name, EC_WORD(shdr->sh_link));
2363 				continue;
2364 			}
2365 
2366 			/*
2367 			 * The section is usable. Save the cache entry.
2368 			 */
2369 			if (shdr->sh_type == SHT_SUNW_verdef) {
2370 				verdef_cache = _cache;
2371 				/*
2372 				 * Under Solaris rules, if there is a verdef
2373 				 * section, the max versym index is number
2374 				 * of version definitions it supplies.
2375 				 */
2376 				versym->max_verndx = shdr->sh_info;
2377 			} else {
2378 				verneed_cache = _cache;
2379 			}
2380 			break;
2381 		}
2382 	}
2383 
2384 	/*
2385 	 * If there is a Verneed section, examine it for information
2386 	 * related to GNU style versioning.
2387 	 */
2388 	if (verneed_cache != NULL)
2389 		update_gnu_verndx((Verneed *)verneed_cache->c_data->d_buf,
2390 		    verneed_cache->c_shdr->sh_info, versym);
2391 
2392 	/*
2393 	 * Now that all the information is available, display the
2394 	 * Verdef and Verneed section contents, if requested.
2395 	 */
2396 	if ((flags & FLG_SHOW_VERSIONS) == 0)
2397 		return;
2398 	if (verdef_cache != NULL) {
2399 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2400 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_VERDEF),
2401 		    verdef_cache->c_name);
2402 		version_def((Verdef *)verdef_cache->c_data->d_buf,
2403 		    verdef_cache->c_shdr->sh_info, verdef_cache,
2404 		    &cache[verdef_cache->c_shdr->sh_link], file);
2405 	}
2406 	if (verneed_cache != NULL) {
2407 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2408 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_VERNEED),
2409 		    verneed_cache->c_name);
2410 		/*
2411 		 * If GNU versioning applies to this object, version_need()
2412 		 * will update versym->max_verndx, and it is not
2413 		 * necessary to call update_gnu_verndx().
2414 		 */
2415 		version_need((Verneed *)verneed_cache->c_data->d_buf,
2416 		    verneed_cache->c_shdr->sh_info, verneed_cache,
2417 		    &cache[verneed_cache->c_shdr->sh_link], file, versym);
2418 	}
2419 }
2420 
2421 /*
2422  * Search for and process any symbol tables.
2423  */
2424 void
2425 symbols(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi,
2426     VERSYM_STATE *versym, const char *file, uint_t flags)
2427 {
2428 	SYMTBL_STATE state;
2429 	Cache *_cache;
2430 	Word secndx;
2431 
2432 	for (secndx = 1; secndx < shnum; secndx++) {
2433 		Word		symcnt;
2434 		Shdr		*shdr;
2435 
2436 		_cache = &cache[secndx];
2437 		shdr = _cache->c_shdr;
2438 
2439 		if ((shdr->sh_type != SHT_SYMTAB) &&
2440 		    (shdr->sh_type != SHT_DYNSYM) &&
2441 		    ((shdr->sh_type != SHT_SUNW_LDYNSYM) ||
2442 		    (osabi != ELFOSABI_SOLARIS)))
2443 			continue;
2444 		if (!match(MATCH_F_ALL, _cache->c_name, secndx, shdr->sh_type))
2445 			continue;
2446 
2447 		if (!init_symtbl_state(&state, cache, shnum, secndx, ehdr,
2448 		    osabi, versym, file, flags))
2449 			continue;
2450 		/*
2451 		 * Loop through the symbol tables entries.
2452 		 */
2453 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2454 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMTAB), state.secname);
2455 		Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
2456 
2457 		for (symcnt = 0; symcnt < state.symn; symcnt++)
2458 			output_symbol(&state, symcnt, shdr->sh_info, symcnt,
2459 			    state.sym + symcnt);
2460 	}
2461 }
2462 
2463 /*
2464  * Search for and process any SHT_SUNW_symsort or SHT_SUNW_tlssort sections.
2465  * These sections are always associated with the .SUNW_ldynsym./.dynsym pair.
2466  */
2467 static void
2468 sunw_sort(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi,
2469     VERSYM_STATE *versym, const char *file, uint_t flags)
2470 {
2471 	SYMTBL_STATE	ldynsym_state,	dynsym_state;
2472 	Cache		*sortcache,	*symcache;
2473 	Shdr		*sortshdr,	*symshdr;
2474 	Word		sortsecndx,	symsecndx;
2475 	Word		ldynsym_cnt;
2476 	Word		*ndx;
2477 	Word		ndxn;
2478 	int		output_cnt = 0;
2479 	Conv_inv_buf_t	inv_buf;
2480 
2481 	for (sortsecndx = 1; sortsecndx < shnum; sortsecndx++) {
2482 
2483 		sortcache = &cache[sortsecndx];
2484 		sortshdr = sortcache->c_shdr;
2485 
2486 		if ((sortshdr->sh_type != SHT_SUNW_symsort) &&
2487 		    (sortshdr->sh_type != SHT_SUNW_tlssort))
2488 			continue;
2489 		if (!match(MATCH_F_ALL, sortcache->c_name, sortsecndx,
2490 		    sortshdr->sh_type))
2491 			continue;
2492 
2493 		/*
2494 		 * If the section references a SUNW_ldynsym, then we
2495 		 * expect to see the associated .dynsym immediately
2496 		 * following. If it references a .dynsym, there is no
2497 		 * SUNW_ldynsym. If it is any other type, then we don't
2498 		 * know what to do with it.
2499 		 */
2500 		if ((sortshdr->sh_link == 0) || (sortshdr->sh_link >= shnum)) {
2501 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
2502 			    file, sortcache->c_name,
2503 			    EC_WORD(sortshdr->sh_link));
2504 			continue;
2505 		}
2506 		symcache = &cache[sortshdr->sh_link];
2507 		symshdr = symcache->c_shdr;
2508 		symsecndx = sortshdr->sh_link;
2509 		ldynsym_cnt = 0;
2510 		switch (symshdr->sh_type) {
2511 		case SHT_SUNW_LDYNSYM:
2512 			if (!init_symtbl_state(&ldynsym_state, cache, shnum,
2513 			    symsecndx, ehdr, osabi, versym, file, flags))
2514 				continue;
2515 			ldynsym_cnt = ldynsym_state.symn;
2516 			/*
2517 			 * We know that the dynsym follows immediately
2518 			 * after the SUNW_ldynsym, and so, should be at
2519 			 * (sortshdr->sh_link + 1). However, elfdump is a
2520 			 * diagnostic tool, so we do the full paranoid
2521 			 * search instead.
2522 			 */
2523 			for (symsecndx = 1; symsecndx < shnum; symsecndx++) {
2524 				symcache = &cache[symsecndx];
2525 				symshdr = symcache->c_shdr;
2526 				if (symshdr->sh_type == SHT_DYNSYM)
2527 					break;
2528 			}
2529 			if (symsecndx >= shnum) {	/* Dynsym not found! */
2530 				(void) fprintf(stderr,
2531 				    MSG_INTL(MSG_ERR_NODYNSYM),
2532 				    file, sortcache->c_name);
2533 				continue;
2534 			}
2535 			/* Fallthrough to process associated dynsym */
2536 			/* FALLTHROUGH */
2537 		case SHT_DYNSYM:
2538 			if (!init_symtbl_state(&dynsym_state, cache, shnum,
2539 			    symsecndx, ehdr, osabi, versym, file, flags))
2540 				continue;
2541 			break;
2542 		default:
2543 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADNDXSEC),
2544 			    file, sortcache->c_name,
2545 			    conv_sec_type(osabi, ehdr->e_machine,
2546 			    symshdr->sh_type, 0, &inv_buf));
2547 			continue;
2548 		}
2549 
2550 		/*
2551 		 * Output header
2552 		 */
2553 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2554 		if (ldynsym_cnt > 0) {
2555 			dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMSORT2),
2556 			    sortcache->c_name, ldynsym_state.secname,
2557 			    dynsym_state.secname);
2558 			/*
2559 			 * The data for .SUNW_ldynsym and dynsym sections
2560 			 * is supposed to be adjacent with SUNW_ldynsym coming
2561 			 * first. Check, and issue a warning if it isn't so.
2562 			 */
2563 			if (((ldynsym_state.sym + ldynsym_state.symn)
2564 			    != dynsym_state.sym) &&
2565 			    ((flags & FLG_CTL_FAKESHDR) == 0))
2566 				(void) fprintf(stderr,
2567 				    MSG_INTL(MSG_ERR_LDYNNOTADJ), file,
2568 				    ldynsym_state.secname,
2569 				    dynsym_state.secname);
2570 		} else {
2571 			dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMSORT1),
2572 			    sortcache->c_name, dynsym_state.secname);
2573 		}
2574 		Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
2575 
2576 		/* If not first one, insert a line of white space */
2577 		if (output_cnt++ > 0)
2578 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2579 
2580 		/*
2581 		 * SUNW_dynsymsort and SUNW_dyntlssort are arrays of
2582 		 * symbol indices. Iterate over the array entries,
2583 		 * dispaying the referenced symbols.
2584 		 */
2585 		ndxn = sortshdr->sh_size / sortshdr->sh_entsize;
2586 		ndx = (Word *)sortcache->c_data->d_buf;
2587 		for (; ndxn-- > 0; ndx++) {
2588 			if (*ndx >= ldynsym_cnt) {
2589 				Word sec_ndx = *ndx - ldynsym_cnt;
2590 
2591 				output_symbol(&dynsym_state, sec_ndx, 0,
2592 				    *ndx, dynsym_state.sym + sec_ndx);
2593 			} else {
2594 				output_symbol(&ldynsym_state, *ndx, 0,
2595 				    *ndx, ldynsym_state.sym + *ndx);
2596 			}
2597 		}
2598 	}
2599 }
2600 
2601 /*
2602  * Search for and process any relocation sections.
2603  */
2604 static void
2605 reloc(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
2606 {
2607 	Word	cnt;
2608 
2609 	for (cnt = 1; cnt < shnum; cnt++) {
2610 		Word		type, symnum;
2611 		Xword		relndx, relnum, relsize;
2612 		void		*rels;
2613 		Sym		*syms;
2614 		Cache		*symsec, *strsec;
2615 		Cache		*_cache = &cache[cnt];
2616 		Shdr		*shdr = _cache->c_shdr;
2617 		char		*relname = _cache->c_name;
2618 		Conv_inv_buf_t	inv_buf;
2619 
2620 		if (((type = shdr->sh_type) != SHT_RELA) &&
2621 		    (type != SHT_REL))
2622 			continue;
2623 		if (!match(MATCH_F_ALL, relname, cnt, type))
2624 			continue;
2625 
2626 		/*
2627 		 * Decide entry size.
2628 		 */
2629 		if (((relsize = shdr->sh_entsize) == 0) ||
2630 		    (relsize > shdr->sh_size)) {
2631 			if (type == SHT_RELA)
2632 				relsize = sizeof (Rela);
2633 			else
2634 				relsize = sizeof (Rel);
2635 		}
2636 
2637 		/*
2638 		 * Determine the number of relocations available.
2639 		 */
2640 		if (shdr->sh_size == 0) {
2641 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2642 			    file, relname);
2643 			continue;
2644 		}
2645 		if (_cache->c_data == NULL)
2646 			continue;
2647 
2648 		rels = _cache->c_data->d_buf;
2649 		relnum = shdr->sh_size / relsize;
2650 
2651 		/*
2652 		 * Get the data buffer for the associated symbol table and
2653 		 * string table.
2654 		 */
2655 		if (stringtbl(cache, 1, cnt, shnum, file,
2656 		    &symnum, &symsec, &strsec) == 0)
2657 			continue;
2658 
2659 		syms = symsec->c_data->d_buf;
2660 
2661 		/*
2662 		 * Loop through the relocation entries.
2663 		 */
2664 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2665 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_RELOC), _cache->c_name);
2666 		Elf_reloc_title(0, ELF_DBG_ELFDUMP, type);
2667 
2668 		for (relndx = 0; relndx < relnum; relndx++,
2669 		    rels = (void *)((char *)rels + relsize)) {
2670 			Half		mach = ehdr->e_machine;
2671 			char		section[BUFSIZ];
2672 			const char	*symname;
2673 			Word		symndx, reltype;
2674 			Rela		*rela;
2675 			Rel		*rel;
2676 
2677 			/*
2678 			 * Unravel the relocation and determine the symbol with
2679 			 * which this relocation is associated.
2680 			 */
2681 			if (type == SHT_RELA) {
2682 				rela = (Rela *)rels;
2683 				symndx = ELF_R_SYM(rela->r_info);
2684 				reltype = ELF_R_TYPE(rela->r_info, mach);
2685 			} else {
2686 				rel = (Rel *)rels;
2687 				symndx = ELF_R_SYM(rel->r_info);
2688 				reltype = ELF_R_TYPE(rel->r_info, mach);
2689 			}
2690 
2691 			symname = relsymname(cache, _cache, strsec, symndx,
2692 			    symnum, relndx, syms, section, BUFSIZ, file);
2693 
2694 			/*
2695 			 * A zero symbol index is only valid for a few
2696 			 * relocations.
2697 			 */
2698 			if (symndx == 0) {
2699 				int	badrel = 0;
2700 
2701 				if ((mach == EM_SPARC) ||
2702 				    (mach == EM_SPARC32PLUS) ||
2703 				    (mach == EM_SPARCV9)) {
2704 					if ((reltype != R_SPARC_NONE) &&
2705 					    (reltype != R_SPARC_REGISTER) &&
2706 					    (reltype != R_SPARC_RELATIVE))
2707 						badrel++;
2708 				} else if (mach == EM_386) {
2709 					if ((reltype != R_386_NONE) &&
2710 					    (reltype != R_386_RELATIVE))
2711 						badrel++;
2712 				} else if (mach == EM_AMD64) {
2713 					if ((reltype != R_AMD64_NONE) &&
2714 					    (reltype != R_AMD64_RELATIVE))
2715 						badrel++;
2716 				}
2717 
2718 				if (badrel) {
2719 					(void) fprintf(stderr,
2720 					    MSG_INTL(MSG_ERR_BADREL1), file,
2721 					    conv_reloc_type(mach, reltype,
2722 					    0, &inv_buf));
2723 				}
2724 			}
2725 
2726 			Elf_reloc_entry_1(0, ELF_DBG_ELFDUMP,
2727 			    MSG_ORIG(MSG_STR_EMPTY), ehdr->e_machine, type,
2728 			    rels, relname, symname, 0);
2729 		}
2730 	}
2731 }
2732 
2733 
2734 /*
2735  * This value controls which test dyn_test() performs.
2736  */
2737 typedef enum { DYN_TEST_ADDR, DYN_TEST_SIZE, DYN_TEST_ENTSIZE } dyn_test_t;
2738 
2739 /*
2740  * Used by dynamic() to compare the value of a dynamic element against
2741  * the starting address of the section it references.
2742  *
2743  * entry:
2744  *	test_type - Specify which dyn item is being tested.
2745  *	sh_type - SHT_* type value for required section.
2746  *	sec_cache - Cache entry for section, or NULL if the object lacks
2747  *		a section of this type.
2748  *	dyn - Dyn entry to be tested
2749  *	dynsec_cnt - # of dynamic section being examined. The first
2750  *		dynamic section is 1, the next is 2, and so on...
2751  *	ehdr - ELF header for file
2752  *	file - Name of file
2753  */
2754 static void
2755 dyn_test(dyn_test_t test_type, Word sh_type, Cache *sec_cache, Dyn *dyn,
2756     Word dynsec_cnt, Ehdr *ehdr, uchar_t osabi, const char *file)
2757 {
2758 	Conv_inv_buf_t	buf1, buf2;
2759 
2760 	/*
2761 	 * These tests are based around the implicit assumption that
2762 	 * there is only one dynamic section in an object, and also only
2763 	 * one of the sections it references. We have therefore gathered
2764 	 * all of the necessary information to test this in a single pass
2765 	 * over the section headers, which is very efficient. We are not
2766 	 * aware of any case where more than one dynamic section would
2767 	 * be meaningful in an ELF object, so this is a reasonable solution.
2768 	 *
2769 	 * To test multiple dynamic sections correctly would be more
2770 	 * expensive in code and time. We would have to build a data structure
2771 	 * containing all the dynamic elements. Then, we would use the address
2772 	 * to locate the section it references and ensure the section is of
2773 	 * the right type and that the address in the dynamic element is
2774 	 * to the start of the section. Then, we could check the size and
2775 	 * entsize values against those same sections. This is O(n^2), and
2776 	 * also complicated.
2777 	 *
2778 	 * In the highly unlikely case that there is more than one dynamic
2779 	 * section, we only test the first one, and simply allow the values
2780 	 * of the subsequent one to be displayed unchallenged.
2781 	 */
2782 	if (dynsec_cnt != 1)
2783 		return;
2784 
2785 	/*
2786 	 * A DT_ item that references a section address should always find
2787 	 * the section in the file.
2788 	 */
2789 	if (sec_cache == NULL) {
2790 		const char *name;
2791 
2792 		/*
2793 		 * Supply section names instead of section types for
2794 		 * things that reference progbits so that the error
2795 		 * message will make more sense.
2796 		 */
2797 		switch (dyn->d_tag) {
2798 		case DT_INIT:
2799 			name = MSG_ORIG(MSG_ELF_INIT);
2800 			break;
2801 		case DT_FINI:
2802 			name = MSG_ORIG(MSG_ELF_FINI);
2803 			break;
2804 		default:
2805 			name = conv_sec_type(osabi, ehdr->e_machine,
2806 			    sh_type, 0, &buf1);
2807 			break;
2808 		}
2809 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_DYNNOBCKSEC), file,
2810 		    name, conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2811 		    CONV_FMT_ALT_CF, &buf2));
2812 		return;
2813 	}
2814 
2815 
2816 	switch (test_type) {
2817 	case DYN_TEST_ADDR:
2818 		/* The section address should match the DT_ item value */
2819 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_addr)
2820 			(void) fprintf(stderr,
2821 			    MSG_INTL(MSG_ERR_DYNBADADDR), file,
2822 			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2823 			    CONV_FMT_ALT_CF, &buf1), EC_ADDR(dyn->d_un.d_val),
2824 			    sec_cache->c_ndx, sec_cache->c_name,
2825 			    EC_ADDR(sec_cache->c_shdr->sh_addr));
2826 		break;
2827 
2828 	case DYN_TEST_SIZE:
2829 		/* The section size should match the DT_ item value */
2830 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_size)
2831 			(void) fprintf(stderr,
2832 			    MSG_INTL(MSG_ERR_DYNBADSIZE), file,
2833 			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2834 			    CONV_FMT_ALT_CF, &buf1), EC_XWORD(dyn->d_un.d_val),
2835 			    sec_cache->c_ndx, sec_cache->c_name,
2836 			    EC_XWORD(sec_cache->c_shdr->sh_size));
2837 		break;
2838 
2839 	case DYN_TEST_ENTSIZE:
2840 		/* The sh_entsize value should match the DT_ item value */
2841 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_entsize)
2842 			(void) fprintf(stderr,
2843 			    MSG_INTL(MSG_ERR_DYNBADENTSIZE), file,
2844 			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2845 			    CONV_FMT_ALT_CF, &buf1), EC_XWORD(dyn->d_un.d_val),
2846 			    sec_cache->c_ndx, sec_cache->c_name,
2847 			    EC_XWORD(sec_cache->c_shdr->sh_entsize));
2848 		break;
2849 	}
2850 }
2851 
2852 /*
2853  * There are some DT_ entries that have corresponding symbols
2854  * (e.g. DT_INIT and _init). It is expected that these items will
2855  * both have the same value if both are present. This routine
2856  * examines the well known symbol tables for such symbols and
2857  * issues warnings for any that don't match.
2858  *
2859  * entry:
2860  *	dyn - Dyn entry to be tested
2861  *	symname - Name of symbol that corresponds to dyn
2862  *	symtab_cache, dynsym_cache, ldynsym_cache - Symbol tables to check
2863  *	target_cache - Section the symname section is expected to be
2864  *		associated with.
2865  *	cache - Cache of all section headers
2866  *	shnum - # of sections in cache
2867  *	ehdr - ELF header for file
2868  *	osabi - OSABI to apply when interpreting object
2869  *	file - Name of file
2870  */
2871 static void
2872 dyn_symtest(Dyn *dyn, const char *symname, Cache *symtab_cache,
2873     Cache *dynsym_cache, Cache *ldynsym_cache, Cache *target_cache,
2874     Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
2875 {
2876 	Conv_inv_buf_t	buf;
2877 	int		i;
2878 	Sym		*sym;
2879 	Cache		*_cache;
2880 
2881 	for (i = 0; i < 3; i++) {
2882 		switch (i) {
2883 		case 0:
2884 			_cache = symtab_cache;
2885 			break;
2886 		case 1:
2887 			_cache = dynsym_cache;
2888 			break;
2889 		case 2:
2890 			_cache = ldynsym_cache;
2891 			break;
2892 		}
2893 
2894 		if ((_cache != NULL) &&
2895 		    symlookup(symname, cache, shnum, &sym, target_cache,
2896 		    _cache, file) && (sym->st_value != dyn->d_un.d_val))
2897 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DYNSYMVAL),
2898 			    file, _cache->c_name, conv_dyn_tag(dyn->d_tag,
2899 			    osabi, ehdr->e_machine, CONV_FMT_ALT_CF, &buf),
2900 			    symname, EC_ADDR(sym->st_value));
2901 	}
2902 }
2903 
2904 /*
2905  * Search for and process a .dynamic section.
2906  */
2907 static void
2908 dynamic(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
2909 {
2910 	struct {
2911 		Cache	*symtab;
2912 		Cache	*dynstr;
2913 		Cache	*dynsym;
2914 		Cache	*hash;
2915 		Cache	*fini;
2916 		Cache	*fini_array;
2917 		Cache	*init;
2918 		Cache	*init_array;
2919 		Cache	*preinit_array;
2920 		Cache	*rel;
2921 		Cache	*rela;
2922 		Cache	*sunw_cap;
2923 		Cache	*sunw_capinfo;
2924 		Cache	*sunw_capchain;
2925 		Cache	*sunw_ldynsym;
2926 		Cache	*sunw_move;
2927 		Cache	*sunw_syminfo;
2928 		Cache	*sunw_symsort;
2929 		Cache	*sunw_tlssort;
2930 		Cache	*sunw_verdef;
2931 		Cache	*sunw_verneed;
2932 		Cache	*sunw_versym;
2933 	} sec;
2934 	Word	dynsec_ndx;
2935 	Word	dynsec_num;
2936 	int	dynsec_cnt;
2937 	Word	cnt;
2938 	int	osabi_solaris = osabi == ELFOSABI_SOLARIS;
2939 
2940 	/*
2941 	 * Make a pass over all the sections, gathering section information
2942 	 * we'll need below.
2943 	 */
2944 	dynsec_num = 0;
2945 	bzero(&sec, sizeof (sec));
2946 	for (cnt = 1; cnt < shnum; cnt++) {
2947 		Cache	*_cache = &cache[cnt];
2948 
2949 		switch (_cache->c_shdr->sh_type) {
2950 		case SHT_DYNAMIC:
2951 			if (dynsec_num == 0) {
2952 				dynsec_ndx = cnt;
2953 
2954 				/* Does it have a valid string table? */
2955 				(void) stringtbl(cache, 0, cnt, shnum, file,
2956 				    0, 0, &sec.dynstr);
2957 			}
2958 			dynsec_num++;
2959 			break;
2960 
2961 
2962 		case SHT_PROGBITS:
2963 			/*
2964 			 * We want to detect the .init and .fini sections,
2965 			 * if present. These are SHT_PROGBITS, so all we
2966 			 * have to go on is the section name. Normally comparing
2967 			 * names is a bad idea, but there are some special
2968 			 * names (i.e. .init/.fini/.interp) that are very
2969 			 * difficult to use in any other context, and for
2970 			 * these symbols, we do the heuristic match.
2971 			 */
2972 			if (strcmp(_cache->c_name,
2973 			    MSG_ORIG(MSG_ELF_INIT)) == 0) {
2974 				if (sec.init == NULL)
2975 					sec.init = _cache;
2976 			} else if (strcmp(_cache->c_name,
2977 			    MSG_ORIG(MSG_ELF_FINI)) == 0) {
2978 				if (sec.fini == NULL)
2979 					sec.fini = _cache;
2980 			}
2981 			break;
2982 
2983 		case SHT_REL:
2984 			/*
2985 			 * We want the SHT_REL section with the lowest
2986 			 * offset. The linker gathers them together,
2987 			 * and puts the address of the first one
2988 			 * into the DT_REL dynamic element.
2989 			 */
2990 			if ((sec.rel == NULL) ||
2991 			    (_cache->c_shdr->sh_offset <
2992 			    sec.rel->c_shdr->sh_offset))
2993 				sec.rel = _cache;
2994 			break;
2995 
2996 		case SHT_RELA:
2997 			/* RELA is handled just like RELA above */
2998 			if ((sec.rela == NULL) ||
2999 			    (_cache->c_shdr->sh_offset <
3000 			    sec.rela->c_shdr->sh_offset))
3001 				sec.rela = _cache;
3002 			break;
3003 
3004 		/*
3005 		 * The GRAB macro is used for the simple case in which
3006 		 * we simply grab the first section of the desired type.
3007 		 */
3008 #define	GRAB(_sec_type, _sec_field) \
3009 		case _sec_type: \
3010 			if (sec._sec_field == NULL) \
3011 				sec._sec_field = _cache; \
3012 				break
3013 		GRAB(SHT_SYMTAB,	symtab);
3014 		GRAB(SHT_DYNSYM,	dynsym);
3015 		GRAB(SHT_FINI_ARRAY,	fini_array);
3016 		GRAB(SHT_HASH,		hash);
3017 		GRAB(SHT_INIT_ARRAY,	init_array);
3018 		GRAB(SHT_SUNW_move,	sunw_move);
3019 		GRAB(SHT_PREINIT_ARRAY,	preinit_array);
3020 		GRAB(SHT_SUNW_cap,	sunw_cap);
3021 		GRAB(SHT_SUNW_capinfo,	sunw_capinfo);
3022 		GRAB(SHT_SUNW_capchain,	sunw_capchain);
3023 		GRAB(SHT_SUNW_LDYNSYM,	sunw_ldynsym);
3024 		GRAB(SHT_SUNW_syminfo,	sunw_syminfo);
3025 		GRAB(SHT_SUNW_symsort,	sunw_symsort);
3026 		GRAB(SHT_SUNW_tlssort,	sunw_tlssort);
3027 		GRAB(SHT_SUNW_verdef,	sunw_verdef);
3028 		GRAB(SHT_SUNW_verneed,	sunw_verneed);
3029 		GRAB(SHT_SUNW_versym,	sunw_versym);
3030 #undef GRAB
3031 		}
3032 	}
3033 
3034 	/*
3035 	 * If no dynamic section, return immediately. If more than one
3036 	 * dynamic section, then something odd is going on and an error
3037 	 * is in order, but then continue on and display them all.
3038 	 */
3039 	if (dynsec_num == 0)
3040 		return;
3041 	if (dynsec_num > 1)
3042 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MULTDYN),
3043 		    file, EC_WORD(dynsec_num));
3044 
3045 
3046 	dynsec_cnt = 0;
3047 	for (cnt = dynsec_ndx; (cnt < shnum) && (dynsec_cnt < dynsec_num);
3048 	    cnt++) {
3049 		Dyn	*dyn;
3050 		ulong_t	numdyn;
3051 		int	ndx, end_ndx;
3052 		Cache	*_cache = &cache[cnt], *strsec;
3053 		Shdr	*shdr = _cache->c_shdr;
3054 		int	dumped = 0;
3055 
3056 		if (shdr->sh_type != SHT_DYNAMIC)
3057 			continue;
3058 		dynsec_cnt++;
3059 
3060 		/*
3061 		 * Verify the associated string table section.
3062 		 */
3063 		if (stringtbl(cache, 0, cnt, shnum, file, 0, 0, &strsec) == 0)
3064 			continue;
3065 
3066 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
3067 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3068 			    file, _cache->c_name);
3069 			continue;
3070 		}
3071 		if (_cache->c_data == NULL)
3072 			continue;
3073 
3074 		numdyn = shdr->sh_size / shdr->sh_entsize;
3075 		dyn = (Dyn *)_cache->c_data->d_buf;
3076 
3077 		/*
3078 		 * We expect the REL/RELA entries to reference the reloc
3079 		 * section with the lowest address. However, this is
3080 		 * not true for dumped objects. Detect if this object has
3081 		 * been dumped so that we can skip the reloc address test
3082 		 * in that case.
3083 		 */
3084 		for (ndx = 0; ndx < numdyn; dyn++, ndx++) {
3085 			if (dyn->d_tag == DT_FLAGS_1) {
3086 				dumped = (dyn->d_un.d_val & DF_1_CONFALT) != 0;
3087 				break;
3088 			}
3089 		}
3090 		dyn = (Dyn *)_cache->c_data->d_buf;
3091 
3092 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3093 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_DYNAMIC), _cache->c_name);
3094 
3095 		Elf_dyn_title(0);
3096 
3097 		for (ndx = 0; ndx < numdyn; dyn++, ndx++) {
3098 			union {
3099 				Conv_inv_buf_t		inv;
3100 				Conv_dyn_flag_buf_t	flag;
3101 				Conv_dyn_flag1_buf_t	flag1;
3102 				Conv_dyn_posflag1_buf_t	posflag1;
3103 				Conv_dyn_feature1_buf_t	feature1;
3104 			} c_buf;
3105 			const char	*name = NULL;
3106 
3107 			/*
3108 			 * Print the information numerically, and if possible
3109 			 * as a string. If a string is available, name is
3110 			 * set to reference it.
3111 			 *
3112 			 * Also, take this opportunity to sanity check
3113 			 * the values of DT elements. In the code above,
3114 			 * we gathered information on sections that are
3115 			 * referenced by the dynamic section. Here, we
3116 			 * compare the attributes of those sections to
3117 			 * the DT_ items that reference them and report
3118 			 * on inconsistencies.
3119 			 *
3120 			 * Things not currently tested that could be improved
3121 			 * in later revisions include:
3122 			 *	- We don't check PLT or GOT related items
3123 			 *	- We don't handle computing the lengths of
3124 			 *		relocation arrays. To handle this
3125 			 *		requires examining data that spans
3126 			 *		across sections, in a contiguous span
3127 			 *		within a single segment.
3128 			 *	- DT_VERDEFNUM and DT_VERNEEDNUM can't be
3129 			 *		verified without parsing the sections.
3130 			 *	- We don't handle DT_SUNW_SYMSZ, which would
3131 			 *		be the sum of the lengths of .dynsym and
3132 			 *		.SUNW_ldynsym
3133 			 *	- DT_SUNW_STRPAD can't be verified other than
3134 			 *		to check that it's not larger than
3135 			 *		the string table.
3136 			 *	- Some items come in "all or none" clusters
3137 			 *		that give an address, element size,
3138 			 *		and data length in bytes. We don't
3139 			 *		verify that there are no missing items
3140 			 *		in such groups.
3141 			 */
3142 			switch (dyn->d_tag) {
3143 			case DT_NULL:
3144 				/*
3145 				 * Special case: DT_NULLs can come in groups
3146 				 * that we prefer to reduce to a single line.
3147 				 */
3148 				end_ndx = ndx;
3149 				while ((end_ndx < (numdyn - 1)) &&
3150 				    ((dyn + 1)->d_tag == DT_NULL)) {
3151 					dyn++;
3152 					end_ndx++;
3153 				}
3154 				Elf_dyn_null_entry(0, dyn, ndx, end_ndx);
3155 				ndx = end_ndx;
3156 				continue;
3157 
3158 			/*
3159 			 * String items all reference the dynstr. The string()
3160 			 * function does the necessary sanity checking.
3161 			 */
3162 			case DT_NEEDED:
3163 			case DT_SONAME:
3164 			case DT_FILTER:
3165 			case DT_AUXILIARY:
3166 			case DT_CONFIG:
3167 			case DT_RPATH:
3168 			case DT_RUNPATH:
3169 			case DT_USED:
3170 			case DT_DEPAUDIT:
3171 			case DT_AUDIT:
3172 				name = string(_cache, ndx, strsec,
3173 				    file, dyn->d_un.d_ptr);
3174 				break;
3175 
3176 			case DT_SUNW_AUXILIARY:
3177 			case DT_SUNW_FILTER:
3178 				if (osabi_solaris)
3179 					name = string(_cache, ndx, strsec,
3180 					    file, dyn->d_un.d_ptr);
3181 				break;
3182 
3183 			case DT_FLAGS:
3184 				name = conv_dyn_flag(dyn->d_un.d_val,
3185 				    0, &c_buf.flag);
3186 				break;
3187 			case DT_FLAGS_1:
3188 				name = conv_dyn_flag1(dyn->d_un.d_val, 0,
3189 				    &c_buf.flag1);
3190 				break;
3191 			case DT_POSFLAG_1:
3192 				name = conv_dyn_posflag1(dyn->d_un.d_val, 0,
3193 				    &c_buf.posflag1);
3194 				break;
3195 			case DT_FEATURE_1:
3196 				name = conv_dyn_feature1(dyn->d_un.d_val, 0,
3197 				    &c_buf.feature1);
3198 				break;
3199 			case DT_DEPRECATED_SPARC_REGISTER:
3200 				name = MSG_INTL(MSG_STR_DEPRECATED);
3201 				break;
3202 
3203 			case DT_SUNW_LDMACH:
3204 				if (!osabi_solaris)
3205 					break;
3206 				name = conv_ehdr_mach((Half)dyn->d_un.d_val,
3207 				    0, &c_buf.inv);
3208 				break;
3209 
3210 			/*
3211 			 * Cases below this point are strictly sanity checking,
3212 			 * and do not generate a name string. The TEST_ macros
3213 			 * are used to hide the boiler plate arguments neeeded
3214 			 * by dyn_test().
3215 			 */
3216 #define	TEST_ADDR(_sh_type, _sec_field) \
3217 				dyn_test(DYN_TEST_ADDR, _sh_type, \
3218 				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
3219 				    osabi, file)
3220 #define	TEST_SIZE(_sh_type, _sec_field) \
3221 				dyn_test(DYN_TEST_SIZE, _sh_type, \
3222 				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
3223 				    osabi, file)
3224 #define	TEST_ENTSIZE(_sh_type, _sec_field) \
3225 				dyn_test(DYN_TEST_ENTSIZE, _sh_type, \
3226 				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
3227 				    osabi, file)
3228 
3229 			case DT_FINI:
3230 				dyn_symtest(dyn, MSG_ORIG(MSG_SYM_FINI),
3231 				    sec.symtab, sec.dynsym, sec.sunw_ldynsym,
3232 				    sec.fini, cache, shnum, ehdr, osabi, file);
3233 				TEST_ADDR(SHT_PROGBITS, fini);
3234 				break;
3235 
3236 			case DT_FINI_ARRAY:
3237 				TEST_ADDR(SHT_FINI_ARRAY, fini_array);
3238 				break;
3239 
3240 			case DT_FINI_ARRAYSZ:
3241 				TEST_SIZE(SHT_FINI_ARRAY, fini_array);
3242 				break;
3243 
3244 			case DT_HASH:
3245 				TEST_ADDR(SHT_HASH, hash);
3246 				break;
3247 
3248 			case DT_INIT:
3249 				dyn_symtest(dyn, MSG_ORIG(MSG_SYM_INIT),
3250 				    sec.symtab, sec.dynsym, sec.sunw_ldynsym,
3251 				    sec.init, cache, shnum, ehdr, osabi, file);
3252 				TEST_ADDR(SHT_PROGBITS, init);
3253 				break;
3254 
3255 			case DT_INIT_ARRAY:
3256 				TEST_ADDR(SHT_INIT_ARRAY, init_array);
3257 				break;
3258 
3259 			case DT_INIT_ARRAYSZ:
3260 				TEST_SIZE(SHT_INIT_ARRAY, init_array);
3261 				break;
3262 
3263 			case DT_MOVEENT:
3264 				TEST_ENTSIZE(SHT_SUNW_move, sunw_move);
3265 				break;
3266 
3267 			case DT_MOVESZ:
3268 				TEST_SIZE(SHT_SUNW_move, sunw_move);
3269 				break;
3270 
3271 			case DT_MOVETAB:
3272 				TEST_ADDR(SHT_SUNW_move, sunw_move);
3273 				break;
3274 
3275 			case DT_PREINIT_ARRAY:
3276 				TEST_ADDR(SHT_PREINIT_ARRAY, preinit_array);
3277 				break;
3278 
3279 			case DT_PREINIT_ARRAYSZ:
3280 				TEST_SIZE(SHT_PREINIT_ARRAY, preinit_array);
3281 				break;
3282 
3283 			case DT_REL:
3284 				if (!dumped)
3285 					TEST_ADDR(SHT_REL, rel);
3286 				break;
3287 
3288 			case DT_RELENT:
3289 				TEST_ENTSIZE(SHT_REL, rel);
3290 				break;
3291 
3292 			case DT_RELA:
3293 				if (!dumped)
3294 					TEST_ADDR(SHT_RELA, rela);
3295 				break;
3296 
3297 			case DT_RELAENT:
3298 				TEST_ENTSIZE(SHT_RELA, rela);
3299 				break;
3300 
3301 			case DT_STRTAB:
3302 				TEST_ADDR(SHT_STRTAB, dynstr);
3303 				break;
3304 
3305 			case DT_STRSZ:
3306 				TEST_SIZE(SHT_STRTAB, dynstr);
3307 				break;
3308 
3309 			case DT_SUNW_CAP:
3310 				if (osabi_solaris)
3311 					TEST_ADDR(SHT_SUNW_cap, sunw_cap);
3312 				break;
3313 
3314 			case DT_SUNW_CAPINFO:
3315 				if (osabi_solaris)
3316 					TEST_ADDR(SHT_SUNW_capinfo,
3317 					    sunw_capinfo);
3318 				break;
3319 
3320 			case DT_SUNW_CAPCHAIN:
3321 				if (osabi_solaris)
3322 					TEST_ADDR(SHT_SUNW_capchain,
3323 					    sunw_capchain);
3324 				break;
3325 
3326 			case DT_SUNW_SYMTAB:
3327 				TEST_ADDR(SHT_SUNW_LDYNSYM, sunw_ldynsym);
3328 				break;
3329 
3330 			case DT_SYMENT:
3331 				TEST_ENTSIZE(SHT_DYNSYM, dynsym);
3332 				break;
3333 
3334 			case DT_SYMINENT:
3335 				TEST_ENTSIZE(SHT_SUNW_syminfo, sunw_syminfo);
3336 				break;
3337 
3338 			case DT_SYMINFO:
3339 				TEST_ADDR(SHT_SUNW_syminfo, sunw_syminfo);
3340 				break;
3341 
3342 			case DT_SYMINSZ:
3343 				TEST_SIZE(SHT_SUNW_syminfo, sunw_syminfo);
3344 				break;
3345 
3346 			case DT_SYMTAB:
3347 				TEST_ADDR(SHT_DYNSYM, dynsym);
3348 				break;
3349 
3350 			case DT_SUNW_SORTENT:
3351 				/*
3352 				 * This entry is related to both the symsort and
3353 				 * tlssort sections.
3354 				 */
3355 				if (osabi_solaris) {
3356 					int test_tls =
3357 					    (sec.sunw_tlssort != NULL);
3358 					int test_sym =
3359 					    (sec.sunw_symsort != NULL) ||
3360 					    !test_tls;
3361 					if (test_sym)
3362 						TEST_ENTSIZE(SHT_SUNW_symsort,
3363 						    sunw_symsort);
3364 					if (test_tls)
3365 						TEST_ENTSIZE(SHT_SUNW_tlssort,
3366 						    sunw_tlssort);
3367 				}
3368 				break;
3369 
3370 
3371 			case DT_SUNW_SYMSORT:
3372 				if (osabi_solaris)
3373 					TEST_ADDR(SHT_SUNW_symsort,
3374 					    sunw_symsort);
3375 				break;
3376 
3377 			case DT_SUNW_SYMSORTSZ:
3378 				if (osabi_solaris)
3379 					TEST_SIZE(SHT_SUNW_symsort,
3380 					    sunw_symsort);
3381 				break;
3382 
3383 			case DT_SUNW_TLSSORT:
3384 				if (osabi_solaris)
3385 					TEST_ADDR(SHT_SUNW_tlssort,
3386 					    sunw_tlssort);
3387 				break;
3388 
3389 			case DT_SUNW_TLSSORTSZ:
3390 				if (osabi_solaris)
3391 					TEST_SIZE(SHT_SUNW_tlssort,
3392 					    sunw_tlssort);
3393 				break;
3394 
3395 			case DT_VERDEF:
3396 				TEST_ADDR(SHT_SUNW_verdef, sunw_verdef);
3397 				break;
3398 
3399 			case DT_VERNEED:
3400 				TEST_ADDR(SHT_SUNW_verneed, sunw_verneed);
3401 				break;
3402 
3403 			case DT_VERSYM:
3404 				TEST_ADDR(SHT_SUNW_versym, sunw_versym);
3405 				break;
3406 #undef TEST_ADDR
3407 #undef TEST_SIZE
3408 #undef TEST_ENTSIZE
3409 			}
3410 
3411 			if (name == NULL)
3412 				name = MSG_ORIG(MSG_STR_EMPTY);
3413 			Elf_dyn_entry(0, dyn, ndx, name,
3414 			    osabi, ehdr->e_machine);
3415 		}
3416 	}
3417 }
3418 
3419 /*
3420  * Search for and process a MOVE section.
3421  */
3422 static void
3423 move(Cache *cache, Word shnum, const char *file, uint_t flags)
3424 {
3425 	Word		cnt;
3426 	const char	*fmt = NULL;
3427 
3428 	for (cnt = 1; cnt < shnum; cnt++) {
3429 		Word	movenum, symnum, ndx;
3430 		Sym	*syms;
3431 		Cache	*_cache = &cache[cnt];
3432 		Shdr	*shdr = _cache->c_shdr;
3433 		Cache	*symsec, *strsec;
3434 		Move	*move;
3435 
3436 		if (shdr->sh_type != SHT_SUNW_move)
3437 			continue;
3438 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
3439 			continue;
3440 
3441 		/*
3442 		 * Determine the move data and number.
3443 		 */
3444 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
3445 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3446 			    file, _cache->c_name);
3447 			continue;
3448 		}
3449 		if (_cache->c_data == NULL)
3450 			continue;
3451 
3452 		move = (Move *)_cache->c_data->d_buf;
3453 		movenum = shdr->sh_size / shdr->sh_entsize;
3454 
3455 		/*
3456 		 * Get the data buffer for the associated symbol table and
3457 		 * string table.
3458 		 */
3459 		if (stringtbl(cache, 1, cnt, shnum, file,
3460 		    &symnum, &symsec, &strsec) == 0)
3461 			return;
3462 
3463 		syms = (Sym *)symsec->c_data->d_buf;
3464 
3465 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3466 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_MOVE), _cache->c_name);
3467 		dbg_print(0, MSG_INTL(MSG_MOVE_TITLE));
3468 
3469 		if (fmt == NULL)
3470 			fmt = MSG_INTL(MSG_MOVE_ENTRY);
3471 
3472 		for (ndx = 0; ndx < movenum; move++, ndx++) {
3473 			const char	*symname;
3474 			char		index[MAXNDXSIZE], section[BUFSIZ];
3475 			Word		symndx, shndx;
3476 			Sym		*sym;
3477 
3478 			/*
3479 			 * Check for null entries
3480 			 */
3481 			if ((move->m_info == 0) && (move->m_value == 0) &&
3482 			    (move->m_poffset == 0) && (move->m_repeat == 0) &&
3483 			    (move->m_stride == 0)) {
3484 				dbg_print(0, fmt, MSG_ORIG(MSG_STR_EMPTY),
3485 				    EC_XWORD(move->m_poffset), 0, 0, 0,
3486 				    EC_LWORD(0), MSG_ORIG(MSG_STR_EMPTY));
3487 				continue;
3488 			}
3489 			if (((symndx = ELF_M_SYM(move->m_info)) == 0) ||
3490 			    (symndx >= symnum)) {
3491 				(void) fprintf(stderr,
3492 				    MSG_INTL(MSG_ERR_BADMINFO), file,
3493 				    _cache->c_name, EC_XWORD(move->m_info));
3494 
3495 				(void) snprintf(index, MAXNDXSIZE,
3496 				    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(symndx));
3497 				dbg_print(0, fmt, index,
3498 				    EC_XWORD(move->m_poffset),
3499 				    ELF_M_SIZE(move->m_info), move->m_repeat,
3500 				    move->m_stride, move->m_value,
3501 				    MSG_INTL(MSG_STR_UNKNOWN));
3502 				continue;
3503 			}
3504 
3505 			symname = relsymname(cache, _cache, strsec,
3506 			    symndx, symnum, ndx, syms, section, BUFSIZ, file);
3507 			sym = (Sym *)(syms + symndx);
3508 
3509 			/*
3510 			 * Additional sanity check.
3511 			 */
3512 			shndx = sym->st_shndx;
3513 			if (!((shndx == SHN_COMMON) ||
3514 			    (((shndx >= 1) && (shndx <= shnum)) &&
3515 			    (cache[shndx].c_shdr)->sh_type == SHT_NOBITS))) {
3516 				(void) fprintf(stderr,
3517 				    MSG_INTL(MSG_ERR_BADSYM2), file,
3518 				    _cache->c_name, EC_WORD(symndx),
3519 				    demangle(symname, flags));
3520 			}
3521 
3522 			(void) snprintf(index, MAXNDXSIZE,
3523 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(symndx));
3524 			dbg_print(0, fmt, index, EC_XWORD(move->m_poffset),
3525 			    ELF_M_SIZE(move->m_info), move->m_repeat,
3526 			    move->m_stride, move->m_value,
3527 			    demangle(symname, flags));
3528 		}
3529 	}
3530 }
3531 
3532 /*
3533  * parse_note_t is used to track the state used by parse_note_entry()
3534  * between calls, and also to return the results of each call.
3535  */
3536 typedef struct {
3537 	/* pns_ fields track progress through the data */
3538 	const char	*pns_file;	/* File name */
3539 	Cache		*pns_cache;	/* Note section cache entry */
3540 	size_t		pns_size;	/* # unprocessed data bytes */
3541 	Word		*pns_data;	/* # to next unused data byte */
3542 
3543 	/* pn_ fields return the results for a single call */
3544 	Word		pn_namesz;	/* Value of note namesz field */
3545 	Word		pn_descsz;	/* Value of note descsz field */
3546 	Word		pn_type;	/* Value of note type field */
3547 	const char	*pn_name;	/* if (namesz > 0) ptr to name bytes */
3548 	const char	*pn_desc;	/* if (descsx > 0) ptr to data bytes */
3549 } parse_note_t;
3550 
3551 /*
3552  * Extract the various sub-parts of a note entry, and advance the
3553  * data pointer past it.
3554  *
3555  * entry:
3556  *	The state pns_ fields contain current values for the Note section
3557  *
3558  * exit:
3559  *	On success, True (1) is returned, the state pns_ fields have been
3560  *	advanced to point at the start of the next entry, and the information
3561  *	for the recovered note entry is found in the state pn_ fields.
3562  *
3563  *	On failure, False (0) is returned. The values contained in state
3564  *	are undefined.
3565  */
3566 static int
3567 parse_note_entry(parse_note_t *state)
3568 {
3569 	size_t	pad, noteoff;
3570 
3571 	noteoff = (Word)state->pns_cache->c_data->d_size - state->pns_size;
3572 	/*
3573 	 * Make sure we can at least reference the 3 initial entries
3574 	 * (4-byte words) of the note information block.
3575 	 */
3576 	if (state->pns_size >= (sizeof (Word) * 3)) {
3577 		state->pns_size -= (sizeof (Word) * 3);
3578 	} else {
3579 		(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADDATASZ),
3580 		    state->pns_file, state->pns_cache->c_name,
3581 		    EC_WORD(noteoff));
3582 		return (0);
3583 	}
3584 
3585 	/*
3586 	 * Make sure any specified name string can be referenced.
3587 	 */
3588 	if ((state->pn_namesz = *state->pns_data++) != 0) {
3589 		if (state->pns_size >= state->pn_namesz) {
3590 			state->pns_size -= state->pn_namesz;
3591 		} else {
3592 			(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADNMSZ),
3593 			    state->pns_file, state->pns_cache->c_name,
3594 			    EC_WORD(noteoff), EC_WORD(state->pn_namesz));
3595 			return (0);
3596 		}
3597 	}
3598 
3599 	/*
3600 	 * Make sure any specified descriptor can be referenced.
3601 	 */
3602 	if ((state->pn_descsz = *state->pns_data++) != 0) {
3603 		/*
3604 		 * If namesz isn't a 4-byte multiple, account for any
3605 		 * padding that must exist before the descriptor.
3606 		 */
3607 		if ((pad = (state->pn_namesz & (sizeof (Word) - 1))) != 0) {
3608 			pad = sizeof (Word) - pad;
3609 			state->pns_size -= pad;
3610 		}
3611 		if (state->pns_size >= state->pn_descsz) {
3612 			state->pns_size -= state->pn_descsz;
3613 		} else {
3614 			(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADDESZ),
3615 			    state->pns_file, state->pns_cache->c_name,
3616 			    EC_WORD(noteoff), EC_WORD(state->pn_namesz));
3617 			return (0);
3618 		}
3619 	}
3620 
3621 	state->pn_type = *state->pns_data++;
3622 
3623 	/* Name */
3624 	if (state->pn_namesz) {
3625 		state->pn_name = (char *)state->pns_data;
3626 		pad = (state->pn_namesz +
3627 		    (sizeof (Word) - 1)) & ~(sizeof (Word) - 1);
3628 		/* LINTED */
3629 		state->pns_data = (Word *)(state->pn_name + pad);
3630 	}
3631 
3632 	/*
3633 	 * If multiple information blocks exist within a .note section
3634 	 * account for any padding that must exist before the next
3635 	 * information block.
3636 	 */
3637 	if ((pad = (state->pn_descsz & (sizeof (Word) - 1))) != 0) {
3638 		pad = sizeof (Word) - pad;
3639 		if (state->pns_size > pad)
3640 			state->pns_size -= pad;
3641 	}
3642 
3643 	/* Data */
3644 	if (state->pn_descsz) {
3645 		state->pn_desc = (const char *)state->pns_data;
3646 		/* LINTED */
3647 		state->pns_data = (Word *)(state->pn_desc +
3648 		    state->pn_descsz + pad);
3649 	}
3650 
3651 	return (1);
3652 }
3653 
3654 /*
3655  * Callback function for use with conv_str_to_c_literal() below.
3656  */
3657 /*ARGSUSED2*/
3658 static void
3659 c_literal_cb(const void *ptr, size_t size, void *uvalue)
3660 {
3661 	(void) fwrite(ptr, size, 1, stdout);
3662 }
3663 
3664 /*
3665  * Traverse a note section analyzing each note information block.
3666  * The data buffers size is used to validate references before they are made,
3667  * and is decremented as each element is processed.
3668  */
3669 void
3670 note_entry(Cache *cache, Word *data, size_t size, Ehdr *ehdr, const char *file)
3671 {
3672 	int		cnt = 0;
3673 	int		is_corenote;
3674 	int		do_swap;
3675 	Conv_inv_buf_t	inv_buf;
3676 	parse_note_t	pnstate;
3677 
3678 	pnstate.pns_file = file;
3679 	pnstate.pns_cache = cache;
3680 	pnstate.pns_size = size;
3681 	pnstate.pns_data = data;
3682 	do_swap = _elf_sys_encoding() != ehdr->e_ident[EI_DATA];
3683 
3684 	/*
3685 	 * Print out a single `note' information block.
3686 	 */
3687 	while (pnstate.pns_size > 0) {
3688 
3689 		if (parse_note_entry(&pnstate) == 0)
3690 			return;
3691 
3692 		/*
3693 		 * Is this a Solaris core note? Such notes all have
3694 		 * the name "CORE".
3695 		 */
3696 		is_corenote = (ehdr->e_type == ET_CORE) &&
3697 		    (pnstate.pn_namesz == (MSG_STR_CORE_SIZE + 1)) &&
3698 		    (strncmp(MSG_ORIG(MSG_STR_CORE), pnstate.pn_name,
3699 		    MSG_STR_CORE_SIZE + 1) == 0);
3700 
3701 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3702 		dbg_print(0, MSG_INTL(MSG_FMT_NOTEENTNDX), EC_WORD(cnt));
3703 		cnt++;
3704 		dbg_print(0, MSG_ORIG(MSG_NOTE_NAMESZ),
3705 		    EC_WORD(pnstate.pn_namesz));
3706 		dbg_print(0, MSG_ORIG(MSG_NOTE_DESCSZ),
3707 		    EC_WORD(pnstate.pn_descsz));
3708 
3709 		if (is_corenote)
3710 			dbg_print(0, MSG_ORIG(MSG_NOTE_TYPE_STR),
3711 			    conv_cnote_type(pnstate.pn_type, 0, &inv_buf));
3712 		else
3713 			dbg_print(0, MSG_ORIG(MSG_NOTE_TYPE),
3714 			    EC_WORD(pnstate.pn_type));
3715 		if (pnstate.pn_namesz) {
3716 			dbg_print(0, MSG_ORIG(MSG_NOTE_NAME));
3717 			/*
3718 			 * The name string can contain embedded 'null'
3719 			 * bytes and/or unprintable characters. Also,
3720 			 * the final NULL is documented in the ELF ABI
3721 			 * as being included in the namesz. So, display
3722 			 * the name using C literal string notation, and
3723 			 * include the terminating NULL in the output.
3724 			 * We don't show surrounding double quotes, as
3725 			 * that implies the termination that we are showing
3726 			 * explicitly.
3727 			 */
3728 			(void) fwrite(MSG_ORIG(MSG_STR_8SP),
3729 			    MSG_STR_8SP_SIZE, 1, stdout);
3730 			conv_str_to_c_literal(pnstate.pn_name,
3731 			    pnstate.pn_namesz, c_literal_cb, NULL);
3732 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3733 		}
3734 
3735 		if (pnstate.pn_descsz) {
3736 			int		hexdump = 1;
3737 
3738 			/*
3739 			 * If this is a core note, let the corenote()
3740 			 * function handle it.
3741 			 */
3742 			if (is_corenote) {
3743 				/* We only issue the bad arch error once */
3744 				static int	badnote_done = 0;
3745 				corenote_ret_t	corenote_ret;
3746 
3747 				corenote_ret = corenote(ehdr->e_machine,
3748 				    do_swap, pnstate.pn_type, pnstate.pn_desc,
3749 				    pnstate.pn_descsz);
3750 				switch (corenote_ret) {
3751 				case CORENOTE_R_OK_DUMP:
3752 					hexdump = 1;
3753 					break;
3754 				case CORENOTE_R_OK:
3755 					hexdump = 0;
3756 					break;
3757 				case CORENOTE_R_BADDATA:
3758 					(void) fprintf(stderr,
3759 					    MSG_INTL(MSG_NOTE_BADCOREDATA),
3760 					    file);
3761 					break;
3762 				case CORENOTE_R_BADARCH:
3763 					if (badnote_done)
3764 						break;
3765 					(void) fprintf(stderr,
3766 					    MSG_INTL(MSG_NOTE_BADCOREARCH),
3767 					    file,
3768 					    conv_ehdr_mach(ehdr->e_machine,
3769 					    0, &inv_buf));
3770 					break;
3771 				case CORENOTE_R_BADTYPE:
3772 					(void) fprintf(stderr,
3773 					    MSG_INTL(MSG_NOTE_BADCORETYPE),
3774 					    file,
3775 					    EC_WORD(pnstate.pn_type));
3776 					break;
3777 
3778 				}
3779 			}
3780 
3781 			/*
3782 			 * The default thing when we don't understand
3783 			 * the note data is to display it as hex bytes.
3784 			 */
3785 			if (hexdump) {
3786 				dbg_print(0, MSG_ORIG(MSG_NOTE_DESC));
3787 				dump_hex_bytes(pnstate.pn_desc,
3788 				    pnstate.pn_descsz, 8, 4, 4);
3789 			}
3790 		}
3791 	}
3792 }
3793 
3794 /*
3795  * Search for and process .note sections.
3796  *
3797  * Returns the number of note sections seen.
3798  */
3799 static Word
3800 note(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
3801 {
3802 	Word	cnt, note_cnt = 0;
3803 
3804 	/*
3805 	 * Otherwise look for any .note sections.
3806 	 */
3807 	for (cnt = 1; cnt < shnum; cnt++) {
3808 		Cache	*_cache = &cache[cnt];
3809 		Shdr	*shdr = _cache->c_shdr;
3810 
3811 		if (shdr->sh_type != SHT_NOTE)
3812 			continue;
3813 		note_cnt++;
3814 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
3815 			continue;
3816 
3817 		/*
3818 		 * As these sections are often hand rolled, make sure they're
3819 		 * properly aligned before proceeding, and issue an error
3820 		 * as necessary.
3821 		 *
3822 		 * Note that we will continue on to display the note even
3823 		 * if it has bad alignment. We can do this safely, because
3824 		 * libelf knows the alignment required for SHT_NOTE, and
3825 		 * takes steps to deliver a properly aligned buffer to us
3826 		 * even if the actual file is misaligned.
3827 		 */
3828 		if (shdr->sh_offset & (sizeof (Word) - 1))
3829 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADALIGN),
3830 			    file, _cache->c_name);
3831 
3832 		if (_cache->c_data == NULL)
3833 			continue;
3834 
3835 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3836 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_NOTE), _cache->c_name);
3837 		note_entry(_cache, (Word *)_cache->c_data->d_buf,
3838 		/* LINTED */
3839 		    (Word)_cache->c_data->d_size, ehdr, file);
3840 	}
3841 
3842 	return (note_cnt);
3843 }
3844 
3845 /*
3846  * The Linux Standard Base defines a special note named .note.ABI-tag
3847  * that is used to maintain Linux ABI information. Presence of this section
3848  * is a strong indication that the object should be considered to be
3849  * ELFOSABI_LINUX.
3850  *
3851  * This function returns True (1) if such a note is seen, and False (0)
3852  * otherwise.
3853  */
3854 static int
3855 has_linux_abi_note(Cache *cache, Word shnum, const char *file)
3856 {
3857 	Word	cnt;
3858 
3859 	for (cnt = 1; cnt < shnum; cnt++) {
3860 		parse_note_t	pnstate;
3861 		Cache		*_cache = &cache[cnt];
3862 		Shdr		*shdr = _cache->c_shdr;
3863 
3864 		/*
3865 		 * Section must be SHT_NOTE, must have the name
3866 		 * .note.ABI-tag, and must have data.
3867 		 */
3868 		if ((shdr->sh_type != SHT_NOTE) ||
3869 		    (strcmp(MSG_ORIG(MSG_STR_NOTEABITAG),
3870 		    _cache->c_name) != 0) || (_cache->c_data == NULL))
3871 			continue;
3872 
3873 		pnstate.pns_file = file;
3874 		pnstate.pns_cache = _cache;
3875 		pnstate.pns_size = _cache->c_data->d_size;
3876 		pnstate.pns_data = (Word *)_cache->c_data->d_buf;
3877 
3878 		while (pnstate.pns_size > 0) {
3879 			Word *w;
3880 
3881 			if (parse_note_entry(&pnstate) == 0)
3882 				break;
3883 
3884 			/*
3885 			 * The type must be 1, and the name must be "GNU".
3886 			 * The descsz must be at least 16 bytes.
3887 			 */
3888 			if ((pnstate.pn_type != 1) ||
3889 			    (pnstate.pn_namesz != (MSG_STR_GNU_SIZE + 1)) ||
3890 			    (strncmp(MSG_ORIG(MSG_STR_GNU), pnstate.pn_name,
3891 			    MSG_STR_CORE_SIZE + 1) != 0) ||
3892 			    (pnstate.pn_descsz < 16))
3893 				continue;
3894 
3895 			/*
3896 			 * desc contains 4 32-bit fields. Field 0 must be 0,
3897 			 * indicating Linux. The second, third, and fourth
3898 			 * fields represent the earliest Linux kernel
3899 			 * version compatible with this object.
3900 			 */
3901 			/*LINTED*/
3902 			w = (Word *) pnstate.pn_desc;
3903 			if (*w == 0)
3904 				return (1);
3905 		}
3906 	}
3907 
3908 	return (0);
3909 }
3910 
3911 /*
3912  * Determine an individual hash entry.  This may be the initial hash entry,
3913  * or an associated chain entry.
3914  */
3915 static void
3916 hash_entry(Cache *refsec, Cache *strsec, const char *hsecname, Word hashndx,
3917     Word symndx, Word symn, Sym *syms, const char *file, ulong_t bkts,
3918     uint_t flags, int chain)
3919 {
3920 	Sym		*sym;
3921 	const char	*symname, *str;
3922 	char		_bucket[MAXNDXSIZE], _symndx[MAXNDXSIZE];
3923 	ulong_t		nbkt, nhash;
3924 
3925 	if (symndx > symn) {
3926 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_HSBADSYMNDX), file,
3927 		    EC_WORD(symndx), EC_WORD(hashndx));
3928 		symname = MSG_INTL(MSG_STR_UNKNOWN);
3929 	} else {
3930 		sym = (Sym *)(syms + symndx);
3931 		symname = string(refsec, symndx, strsec, file, sym->st_name);
3932 	}
3933 
3934 	if (chain == 0) {
3935 		(void) snprintf(_bucket, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INTEGER),
3936 		    hashndx);
3937 		str = (const char *)_bucket;
3938 	} else
3939 		str = MSG_ORIG(MSG_STR_EMPTY);
3940 
3941 	(void) snprintf(_symndx, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX2),
3942 	    EC_WORD(symndx));
3943 	dbg_print(0, MSG_ORIG(MSG_FMT_HASH_INFO), str, _symndx,
3944 	    demangle(symname, flags));
3945 
3946 	/*
3947 	 * Determine if this string is in the correct bucket.
3948 	 */
3949 	nhash = elf_hash(symname);
3950 	nbkt = nhash % bkts;
3951 
3952 	if (nbkt != hashndx) {
3953 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADHASH), file,
3954 		    hsecname, symname, EC_WORD(hashndx), nbkt);
3955 	}
3956 }
3957 
3958 #define	MAXCOUNT	500
3959 
3960 static void
3961 hash(Cache *cache, Word shnum, const char *file, uint_t flags)
3962 {
3963 	static int	count[MAXCOUNT];
3964 	Word		cnt;
3965 	ulong_t		ndx, bkts;
3966 	char		number[MAXNDXSIZE];
3967 
3968 	for (cnt = 1; cnt < shnum; cnt++) {
3969 		uint_t		*hash, *chain;
3970 		Cache		*_cache = &cache[cnt];
3971 		Shdr		*sshdr, *hshdr = _cache->c_shdr;
3972 		char		*ssecname, *hsecname = _cache->c_name;
3973 		Sym		*syms;
3974 		Word		symn;
3975 
3976 		if (hshdr->sh_type != SHT_HASH)
3977 			continue;
3978 
3979 		/*
3980 		 * Determine the hash table data and size.
3981 		 */
3982 		if ((hshdr->sh_entsize == 0) || (hshdr->sh_size == 0)) {
3983 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3984 			    file, hsecname);
3985 			continue;
3986 		}
3987 		if (_cache->c_data == NULL)
3988 			continue;
3989 
3990 		hash = (uint_t *)_cache->c_data->d_buf;
3991 		bkts = *hash;
3992 		chain = hash + 2 + bkts;
3993 		hash += 2;
3994 
3995 		/*
3996 		 * Get the data buffer for the associated symbol table.
3997 		 */
3998 		if ((hshdr->sh_link == 0) || (hshdr->sh_link >= shnum)) {
3999 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
4000 			    file, hsecname, EC_WORD(hshdr->sh_link));
4001 			continue;
4002 		}
4003 
4004 		_cache = &cache[hshdr->sh_link];
4005 		ssecname = _cache->c_name;
4006 
4007 		if (_cache->c_data == NULL)
4008 			continue;
4009 
4010 		if ((syms = (Sym *)_cache->c_data->d_buf) == NULL) {
4011 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4012 			    file, ssecname);
4013 			continue;
4014 		}
4015 
4016 		sshdr = _cache->c_shdr;
4017 		/* LINTED */
4018 		symn = (Word)(sshdr->sh_size / sshdr->sh_entsize);
4019 
4020 		/*
4021 		 * Get the associated string table section.
4022 		 */
4023 		if ((sshdr->sh_link == 0) || (sshdr->sh_link >= shnum)) {
4024 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
4025 			    file, ssecname, EC_WORD(sshdr->sh_link));
4026 			continue;
4027 		}
4028 
4029 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4030 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_HASH), hsecname);
4031 		dbg_print(0, MSG_INTL(MSG_ELF_HASH_INFO));
4032 
4033 		/*
4034 		 * Loop through the hash buckets, printing the appropriate
4035 		 * symbols.
4036 		 */
4037 		for (ndx = 0; ndx < bkts; ndx++, hash++) {
4038 			Word	_ndx, _cnt;
4039 
4040 			if (*hash == 0) {
4041 				count[0]++;
4042 				continue;
4043 			}
4044 
4045 			hash_entry(_cache, &cache[sshdr->sh_link], hsecname,
4046 			    ndx, *hash, symn, syms, file, bkts, flags, 0);
4047 
4048 			/*
4049 			 * Determine if any other symbols are chained to this
4050 			 * bucket.
4051 			 */
4052 			_ndx = chain[*hash];
4053 			_cnt = 1;
4054 			while (_ndx) {
4055 				hash_entry(_cache, &cache[sshdr->sh_link],
4056 				    hsecname, ndx, _ndx, symn, syms, file,
4057 				    bkts, flags, 1);
4058 				_ndx = chain[_ndx];
4059 				_cnt++;
4060 			}
4061 
4062 			if (_cnt >= MAXCOUNT) {
4063 				(void) fprintf(stderr,
4064 				    MSG_INTL(MSG_HASH_OVERFLW), file,
4065 				    _cache->c_name, EC_WORD(ndx),
4066 				    EC_WORD(_cnt));
4067 			} else
4068 				count[_cnt]++;
4069 		}
4070 		break;
4071 	}
4072 
4073 	/*
4074 	 * Print out the count information.
4075 	 */
4076 	bkts = cnt = 0;
4077 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4078 
4079 	for (ndx = 0; ndx < MAXCOUNT; ndx++) {
4080 		Word	_cnt;
4081 
4082 		if ((_cnt = count[ndx]) == 0)
4083 			continue;
4084 
4085 		(void) snprintf(number, MAXNDXSIZE,
4086 		    MSG_ORIG(MSG_FMT_INTEGER), _cnt);
4087 		dbg_print(0, MSG_INTL(MSG_ELF_HASH_BKTS1), number,
4088 		    EC_WORD(ndx));
4089 		bkts += _cnt;
4090 		cnt += (Word)(ndx * _cnt);
4091 	}
4092 	if (cnt) {
4093 		(void) snprintf(number, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INTEGER),
4094 		    bkts);
4095 		dbg_print(0, MSG_INTL(MSG_ELF_HASH_BKTS2), number,
4096 		    EC_WORD(cnt));
4097 	}
4098 }
4099 
4100 static void
4101 group(Cache *cache, Word shnum, const char *file, uint_t flags)
4102 {
4103 	Word	scnt;
4104 
4105 	for (scnt = 1; scnt < shnum; scnt++) {
4106 		Cache		*_cache = &cache[scnt];
4107 		Shdr		*shdr = _cache->c_shdr;
4108 		Word		*grpdata, gcnt, grpcnt, symnum, unknown;
4109 		Cache		*symsec, *strsec;
4110 		Sym		*syms, *sym;
4111 		char		flgstrbuf[MSG_GRP_COMDAT_SIZE + 10];
4112 		const char	*grpnam;
4113 
4114 		if (shdr->sh_type != SHT_GROUP)
4115 			continue;
4116 		if (!match(MATCH_F_ALL, _cache->c_name, scnt, shdr->sh_type))
4117 			continue;
4118 		if ((_cache->c_data == NULL) ||
4119 		    ((grpdata = (Word *)_cache->c_data->d_buf) == NULL))
4120 			continue;
4121 		grpcnt = shdr->sh_size / sizeof (Word);
4122 
4123 		/*
4124 		 * Get the data buffer for the associated symbol table and
4125 		 * string table.
4126 		 */
4127 		if (stringtbl(cache, 1, scnt, shnum, file,
4128 		    &symnum, &symsec, &strsec) == 0)
4129 			return;
4130 
4131 		syms = symsec->c_data->d_buf;
4132 
4133 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4134 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_GRP), _cache->c_name);
4135 		dbg_print(0, MSG_INTL(MSG_GRP_TITLE));
4136 
4137 		/*
4138 		 * The first element of the group defines the group.  The
4139 		 * associated symbol is defined by the sh_link field.
4140 		 */
4141 		if ((shdr->sh_info == SHN_UNDEF) || (shdr->sh_info > symnum)) {
4142 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHINFO),
4143 			    file, _cache->c_name, EC_WORD(shdr->sh_info));
4144 			return;
4145 		}
4146 
4147 		(void) strcpy(flgstrbuf, MSG_ORIG(MSG_STR_OSQBRKT));
4148 		if (grpdata[0] & GRP_COMDAT) {
4149 			(void) strcat(flgstrbuf, MSG_ORIG(MSG_GRP_COMDAT));
4150 		}
4151 		if ((unknown = (grpdata[0] & ~GRP_COMDAT)) != 0) {
4152 			size_t	len = strlen(flgstrbuf);
4153 
4154 			(void) snprintf(&flgstrbuf[len],
4155 			    (MSG_GRP_COMDAT_SIZE + 10 - len),
4156 			    MSG_ORIG(MSG_GRP_UNKNOWN), unknown);
4157 		}
4158 		(void) strcat(flgstrbuf, MSG_ORIG(MSG_STR_CSQBRKT));
4159 		sym = (Sym *)(syms + shdr->sh_info);
4160 
4161 		/*
4162 		 * The GNU assembler can use section symbols as the signature
4163 		 * symbol as described by this comment in the gold linker
4164 		 * (found via google):
4165 		 *
4166 		 *	It seems that some versions of gas will create a
4167 		 *	section group associated with a section symbol, and
4168 		 *	then fail to give a name to the section symbol.  In
4169 		 *	such a case, use the name of the section.
4170 		 *
4171 		 * In order to support such objects, we do the same.
4172 		 */
4173 		grpnam = string(_cache, 0, strsec, file, sym->st_name);
4174 		if (((sym->st_name == 0) || (*grpnam == '\0')) &&
4175 		    (ELF_ST_TYPE(sym->st_info) == STT_SECTION))
4176 			grpnam = cache[sym->st_shndx].c_name;
4177 
4178 		dbg_print(0, MSG_INTL(MSG_GRP_SIGNATURE), flgstrbuf,
4179 		    demangle(grpnam, flags));
4180 
4181 		for (gcnt = 1; gcnt < grpcnt; gcnt++) {
4182 			char		index[MAXNDXSIZE];
4183 			const char	*name;
4184 
4185 			(void) snprintf(index, MAXNDXSIZE,
4186 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(gcnt));
4187 
4188 			if (grpdata[gcnt] >= shnum)
4189 				name = MSG_INTL(MSG_GRP_INVALSCN);
4190 			else
4191 				name = cache[grpdata[gcnt]].c_name;
4192 
4193 			(void) printf(MSG_ORIG(MSG_GRP_ENTRY), index, name,
4194 			    EC_XWORD(grpdata[gcnt]));
4195 		}
4196 	}
4197 }
4198 
4199 static void
4200 got(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
4201 {
4202 	Cache		*gotcache = NULL, *symtab = NULL;
4203 	Addr		gotbgn, gotend;
4204 	Shdr		*gotshdr;
4205 	Word		cnt, gotents, gotndx;
4206 	size_t		gentsize;
4207 	Got_info	*gottable;
4208 	char		*gotdata;
4209 	Sym		*gotsym;
4210 	Xword		gotsymaddr;
4211 	uint_t		sys_encoding;
4212 
4213 	/*
4214 	 * First, find the got.
4215 	 */
4216 	for (cnt = 1; cnt < shnum; cnt++) {
4217 		if (strncmp(cache[cnt].c_name, MSG_ORIG(MSG_ELF_GOT),
4218 		    MSG_ELF_GOT_SIZE) == 0) {
4219 			gotcache = &cache[cnt];
4220 			break;
4221 		}
4222 	}
4223 	if (gotcache == NULL)
4224 		return;
4225 
4226 	/*
4227 	 * A got section within a relocatable object is suspicious.
4228 	 */
4229 	if (ehdr->e_type == ET_REL) {
4230 		(void) fprintf(stderr, MSG_INTL(MSG_GOT_UNEXPECTED), file,
4231 		    gotcache->c_name);
4232 	}
4233 
4234 	gotshdr = gotcache->c_shdr;
4235 	if (gotshdr->sh_size == 0) {
4236 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4237 		    file, gotcache->c_name);
4238 		return;
4239 	}
4240 
4241 	gotbgn = gotshdr->sh_addr;
4242 	gotend = gotbgn + gotshdr->sh_size;
4243 
4244 	/*
4245 	 * Some architectures don't properly set the sh_entsize for the GOT
4246 	 * table.  If it's not set, default to a size of a pointer.
4247 	 */
4248 	if ((gentsize = gotshdr->sh_entsize) == 0)
4249 		gentsize = sizeof (Xword);
4250 
4251 	if (gotcache->c_data == NULL)
4252 		return;
4253 
4254 	/* LINTED */
4255 	gotents = (Word)(gotshdr->sh_size / gentsize);
4256 	gotdata = gotcache->c_data->d_buf;
4257 
4258 	if ((gottable = calloc(gotents, sizeof (Got_info))) == 0) {
4259 		int err = errno;
4260 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC), file,
4261 		    strerror(err));
4262 		return;
4263 	}
4264 
4265 	/*
4266 	 * Now we scan through all the sections looking for any relocations
4267 	 * that may be against the GOT.  Since these may not be isolated to a
4268 	 * .rel[a].got section we check them all.
4269 	 * While scanning sections save the symbol table entry (a symtab
4270 	 * overriding a dynsym) so that we can lookup _GLOBAL_OFFSET_TABLE_.
4271 	 */
4272 	for (cnt = 1; cnt < shnum; cnt++) {
4273 		Word		type, symnum;
4274 		Xword		relndx, relnum, relsize;
4275 		void		*rels;
4276 		Sym		*syms;
4277 		Cache		*symsec, *strsec;
4278 		Cache		*_cache = &cache[cnt];
4279 		Shdr		*shdr;
4280 
4281 		shdr = _cache->c_shdr;
4282 		type = shdr->sh_type;
4283 
4284 		if ((symtab == 0) && (type == SHT_DYNSYM)) {
4285 			symtab = _cache;
4286 			continue;
4287 		}
4288 		if (type == SHT_SYMTAB) {
4289 			symtab = _cache;
4290 			continue;
4291 		}
4292 		if ((type != SHT_RELA) && (type != SHT_REL))
4293 			continue;
4294 
4295 		/*
4296 		 * Decide entry size.
4297 		 */
4298 		if (((relsize = shdr->sh_entsize) == 0) ||
4299 		    (relsize > shdr->sh_size)) {
4300 			if (type == SHT_RELA)
4301 				relsize = sizeof (Rela);
4302 			else
4303 				relsize = sizeof (Rel);
4304 		}
4305 
4306 		/*
4307 		 * Determine the number of relocations available.
4308 		 */
4309 		if (shdr->sh_size == 0) {
4310 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
4311 			    file, _cache->c_name);
4312 			continue;
4313 		}
4314 		if (_cache->c_data == NULL)
4315 			continue;
4316 
4317 		rels = _cache->c_data->d_buf;
4318 		relnum = shdr->sh_size / relsize;
4319 
4320 		/*
4321 		 * Get the data buffer for the associated symbol table and
4322 		 * string table.
4323 		 */
4324 		if (stringtbl(cache, 1, cnt, shnum, file,
4325 		    &symnum, &symsec, &strsec) == 0)
4326 			continue;
4327 
4328 		syms = symsec->c_data->d_buf;
4329 
4330 		/*
4331 		 * Loop through the relocation entries.
4332 		 */
4333 		for (relndx = 0; relndx < relnum; relndx++,
4334 		    rels = (void *)((char *)rels + relsize)) {
4335 			char		section[BUFSIZ];
4336 			Addr		offset;
4337 			Got_info	*gip;
4338 			Word		symndx, reltype;
4339 			Rela		*rela;
4340 			Rel		*rel;
4341 
4342 			/*
4343 			 * Unravel the relocation.
4344 			 */
4345 			if (type == SHT_RELA) {
4346 				rela = (Rela *)rels;
4347 				symndx = ELF_R_SYM(rela->r_info);
4348 				reltype = ELF_R_TYPE(rela->r_info,
4349 				    ehdr->e_machine);
4350 				offset = rela->r_offset;
4351 			} else {
4352 				rel = (Rel *)rels;
4353 				symndx = ELF_R_SYM(rel->r_info);
4354 				reltype = ELF_R_TYPE(rel->r_info,
4355 				    ehdr->e_machine);
4356 				offset = rel->r_offset;
4357 			}
4358 
4359 			/*
4360 			 * Only pay attention to relocations against the GOT.
4361 			 */
4362 			if ((offset < gotbgn) || (offset >= gotend))
4363 				continue;
4364 
4365 			/* LINTED */
4366 			gotndx = (Word)((offset - gotbgn) /
4367 			    gotshdr->sh_entsize);
4368 			gip = &gottable[gotndx];
4369 
4370 			if (gip->g_reltype != 0) {
4371 				(void) fprintf(stderr,
4372 				    MSG_INTL(MSG_GOT_MULTIPLE), file,
4373 				    EC_WORD(gotndx), EC_ADDR(offset));
4374 				continue;
4375 			}
4376 
4377 			if (symndx)
4378 				gip->g_symname = relsymname(cache, _cache,
4379 				    strsec, symndx, symnum, relndx, syms,
4380 				    section, BUFSIZ, file);
4381 			gip->g_reltype = reltype;
4382 			gip->g_rel = rels;
4383 		}
4384 	}
4385 
4386 	if (symlookup(MSG_ORIG(MSG_SYM_GOT), cache, shnum, &gotsym, NULL,
4387 	    symtab, file))
4388 		gotsymaddr = gotsym->st_value;
4389 	else
4390 		gotsymaddr = gotbgn;
4391 
4392 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4393 	dbg_print(0, MSG_INTL(MSG_ELF_SCN_GOT), gotcache->c_name);
4394 	Elf_got_title(0);
4395 
4396 	sys_encoding = _elf_sys_encoding();
4397 	for (gotndx = 0; gotndx < gotents; gotndx++) {
4398 		Got_info	*gip;
4399 		Sword		gindex;
4400 		Addr		gaddr;
4401 		Xword		gotentry;
4402 
4403 		gip = &gottable[gotndx];
4404 
4405 		gaddr = gotbgn + (gotndx * gentsize);
4406 		gindex = (Sword)(gaddr - gotsymaddr) / (Sword)gentsize;
4407 
4408 		if (gentsize == sizeof (Word))
4409 			/* LINTED */
4410 			gotentry = (Xword)(*((Word *)(gotdata) + gotndx));
4411 		else
4412 			/* LINTED */
4413 			gotentry = *((Xword *)(gotdata) + gotndx);
4414 
4415 		Elf_got_entry(0, gindex, gaddr, gotentry, ehdr->e_machine,
4416 		    ehdr->e_ident[EI_DATA], sys_encoding,
4417 		    gip->g_reltype, gip->g_rel, gip->g_symname);
4418 	}
4419 	free(gottable);
4420 }
4421 
4422 void
4423 checksum(Elf *elf)
4424 {
4425 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4426 	dbg_print(0, MSG_INTL(MSG_STR_CHECKSUM), elf_checksum(elf));
4427 }
4428 
4429 /*
4430  * This variable is used by regular() to communicate the address of
4431  * the section header cache to sort_shdr_ndx_arr(). Unfortunately,
4432  * the qsort() interface does not include a userdata argument by which
4433  * such arbitrary data can be passed, so we are stuck using global data.
4434  */
4435 static Cache *sort_shdr_ndx_arr_cache;
4436 
4437 
4438 /*
4439  * Used with qsort() to sort the section indices so that they can be
4440  * used to access the section headers in order of increasing data offset.
4441  *
4442  * entry:
4443  *	sort_shdr_ndx_arr_cache - Contains address of
4444  *		section header cache.
4445  *	v1, v2 - Point at elements of sort_shdr_bits array to be compared.
4446  *
4447  * exit:
4448  *	Returns -1 (less than), 0 (equal) or 1 (greater than).
4449  */
4450 static int
4451 sort_shdr_ndx_arr(const void *v1, const void *v2)
4452 {
4453 	Cache	*cache1 = sort_shdr_ndx_arr_cache + *((size_t *)v1);
4454 	Cache	*cache2 = sort_shdr_ndx_arr_cache + *((size_t *)v2);
4455 
4456 	if (cache1->c_shdr->sh_offset < cache2->c_shdr->sh_offset)
4457 		return (-1);
4458 
4459 	if (cache1->c_shdr->sh_offset > cache2->c_shdr->sh_offset)
4460 		return (1);
4461 
4462 	return (0);
4463 }
4464 
4465 
4466 static int
4467 shdr_cache(const char *file, Elf *elf, Ehdr *ehdr, size_t shstrndx,
4468     size_t shnum, Cache **cache_ret, Word flags)
4469 {
4470 	Elf_Scn		*scn;
4471 	Elf_Data	*data;
4472 	size_t		ndx;
4473 	Shdr		*nameshdr;
4474 	char		*names = NULL;
4475 	Cache		*cache, *_cache;
4476 	size_t		*shdr_ndx_arr, shdr_ndx_arr_cnt;
4477 
4478 
4479 	/*
4480 	 * Obtain the .shstrtab data buffer to provide the required section
4481 	 * name strings.
4482 	 */
4483 	if (shstrndx == SHN_UNDEF) {
4484 		/*
4485 		 * It is rare, but legal, for an object to lack a
4486 		 * header string table section.
4487 		 */
4488 		names = NULL;
4489 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOSHSTRSEC), file);
4490 	} else if ((scn = elf_getscn(elf, shstrndx)) == NULL) {
4491 		failure(file, MSG_ORIG(MSG_ELF_GETSCN));
4492 		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SHDR),
4493 		    EC_XWORD(shstrndx));
4494 
4495 	} else if ((data = elf_getdata(scn, NULL)) == NULL) {
4496 		failure(file, MSG_ORIG(MSG_ELF_GETDATA));
4497 		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_DATA),
4498 		    EC_XWORD(shstrndx));
4499 
4500 	} else if ((nameshdr = elf_getshdr(scn)) == NULL) {
4501 		failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
4502 		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN),
4503 		    EC_WORD(elf_ndxscn(scn)));
4504 
4505 	} else if ((names = data->d_buf) == NULL)
4506 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_SHSTRNULL), file);
4507 
4508 	/*
4509 	 * Allocate a cache to maintain a descriptor for each section.
4510 	 */
4511 	if ((*cache_ret = cache = malloc(shnum * sizeof (Cache))) == NULL) {
4512 		int err = errno;
4513 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
4514 		    file, strerror(err));
4515 		return (0);
4516 	}
4517 
4518 	*cache = cache_init;
4519 	_cache = cache;
4520 	_cache++;
4521 
4522 	/*
4523 	 * Allocate an array that will hold the section index for
4524 	 * each section that has data in the ELF file:
4525 	 *
4526 	 *	- Is not a NOBITS section
4527 	 *	- Data has non-zero length
4528 	 *
4529 	 * Note that shnum is an upper bound on the size required. It
4530 	 * is likely that we won't use a few of these array elements.
4531 	 * Allocating a modest amount of extra memory in this case means
4532 	 * that we can avoid an extra loop to count the number of needed
4533 	 * items, and can fill this array immediately in the first loop
4534 	 * below.
4535 	 */
4536 	if ((shdr_ndx_arr = malloc(shnum * sizeof (*shdr_ndx_arr))) == NULL) {
4537 		int err = errno;
4538 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
4539 		    file, strerror(err));
4540 		return (0);
4541 	}
4542 	shdr_ndx_arr_cnt = 0;
4543 
4544 	/*
4545 	 * Traverse the sections of the file.  This gathering of data is
4546 	 * carried out in two passes.  First, the section headers are captured
4547 	 * and the section header names are evaluated.  A verification pass is
4548 	 * then carried out over the section information.  Files have been
4549 	 * known to exhibit overlapping (and hence erroneous) section header
4550 	 * information.
4551 	 *
4552 	 * Finally, the data for each section is obtained.  This processing is
4553 	 * carried out after section verification because should any section
4554 	 * header overlap occur, and a file needs translating (ie. xlate'ing
4555 	 * information from a non-native architecture file), then the process
4556 	 * of translation can corrupt the section header information.  Of
4557 	 * course, if there is any section overlap, the data related to the
4558 	 * sections is going to be compromised.  However, it is the translation
4559 	 * of this data that has caused problems with elfdump()'s ability to
4560 	 * extract the data.
4561 	 */
4562 	for (ndx = 1, scn = NULL; scn = elf_nextscn(elf, scn);
4563 	    ndx++, _cache++) {
4564 		char	scnndxnm[100];
4565 
4566 		_cache->c_ndx = ndx;
4567 		_cache->c_scn = scn;
4568 
4569 		if ((_cache->c_shdr = elf_getshdr(scn)) == NULL) {
4570 			failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
4571 			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN),
4572 			    EC_WORD(elf_ndxscn(scn)));
4573 		}
4574 
4575 		/*
4576 		 * If this section has data in the file, include it in
4577 		 * the array of sections to check for address overlap.
4578 		 */
4579 		if ((_cache->c_shdr->sh_size != 0) &&
4580 		    (_cache->c_shdr->sh_type != SHT_NOBITS))
4581 			shdr_ndx_arr[shdr_ndx_arr_cnt++] = ndx;
4582 
4583 		/*
4584 		 * If a shstrtab exists, assign the section name.
4585 		 */
4586 		if (names && _cache->c_shdr) {
4587 			if (_cache->c_shdr->sh_name &&
4588 			    /* LINTED */
4589 			    (nameshdr->sh_size > _cache->c_shdr->sh_name)) {
4590 				const char	*symname;
4591 				char		*secname;
4592 
4593 				secname = names + _cache->c_shdr->sh_name;
4594 
4595 				/*
4596 				 * A SUN naming convention employs a "%" within
4597 				 * a section name to indicate a section/symbol
4598 				 * name.  This originated from the compilers
4599 				 * -xF option, that places functions into their
4600 				 * own sections.  This convention (which has no
4601 				 * formal standard) has also been followed for
4602 				 * COMDAT sections.  To demangle the symbol
4603 				 * name, the name must be separated from the
4604 				 * section name.
4605 				 */
4606 				if (((flags & FLG_CTL_DEMANGLE) == 0) ||
4607 				    ((symname = strchr(secname, '%')) == NULL))
4608 					_cache->c_name = secname;
4609 				else {
4610 					size_t	secsz = ++symname - secname;
4611 					size_t	strsz;
4612 
4613 					symname = demangle(symname, flags);
4614 					strsz = secsz + strlen(symname) + 1;
4615 
4616 					if ((_cache->c_name =
4617 					    malloc(strsz)) == NULL) {
4618 						int err = errno;
4619 						(void) fprintf(stderr,
4620 						    MSG_INTL(MSG_ERR_MALLOC),
4621 						    file, strerror(err));
4622 						return (0);
4623 					}
4624 					(void) snprintf(_cache->c_name, strsz,
4625 					    MSG_ORIG(MSG_FMT_SECSYM),
4626 					    EC_WORD(secsz), secname, symname);
4627 				}
4628 
4629 				continue;
4630 			}
4631 
4632 			/*
4633 			 * Generate an error if the section name index is zero
4634 			 * or exceeds the shstrtab data.  Fall through to
4635 			 * fabricate a section name.
4636 			 */
4637 			if ((_cache->c_shdr->sh_name == 0) ||
4638 			    /* LINTED */
4639 			    (nameshdr->sh_size <= _cache->c_shdr->sh_name)) {
4640 				(void) fprintf(stderr,
4641 				    MSG_INTL(MSG_ERR_BADSHNAME), file,
4642 				    EC_WORD(ndx),
4643 				    EC_XWORD(_cache->c_shdr->sh_name));
4644 			}
4645 		}
4646 
4647 		/*
4648 		 * If there exists no shstrtab data, or a section header has no
4649 		 * name (an invalid index of 0), then compose a name for the
4650 		 * section.
4651 		 */
4652 		(void) snprintf(scnndxnm, sizeof (scnndxnm),
4653 		    MSG_INTL(MSG_FMT_SCNNDX), ndx);
4654 
4655 		if ((_cache->c_name = malloc(strlen(scnndxnm) + 1)) == NULL) {
4656 			int err = errno;
4657 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
4658 			    file, strerror(err));
4659 			return (0);
4660 		}
4661 		(void) strcpy(_cache->c_name, scnndxnm);
4662 	}
4663 
4664 	/*
4665 	 * Having collected all the sections, validate their address range.
4666 	 * Cases have existed where the section information has been invalid.
4667 	 * This can lead to all sorts of other, hard to diagnose errors, as
4668 	 * each section is processed individually (ie. with elf_getdata()).
4669 	 * Here, we carry out some address comparisons to catch a family of
4670 	 * overlapping memory issues we have observed (likely, there are others
4671 	 * that we have yet to discover).
4672 	 *
4673 	 * Note, should any memory overlap occur, obtaining any additional
4674 	 * data from the file is questionable.  However, it might still be
4675 	 * possible to inspect the ELF header, Programs headers, or individual
4676 	 * sections, so rather than bailing on an error condition, continue
4677 	 * processing to see if any data can be salvaged.
4678 	 */
4679 	if (shdr_ndx_arr_cnt > 1) {
4680 		sort_shdr_ndx_arr_cache = cache;
4681 		qsort(shdr_ndx_arr, shdr_ndx_arr_cnt,
4682 		    sizeof (*shdr_ndx_arr), sort_shdr_ndx_arr);
4683 	}
4684 	for (ndx = 0; ndx < shdr_ndx_arr_cnt; ndx++) {
4685 		Cache	*_cache = cache + shdr_ndx_arr[ndx];
4686 		Shdr	*shdr = _cache->c_shdr;
4687 		Off	bgn1, bgn = shdr->sh_offset;
4688 		Off	end1, end = shdr->sh_offset + shdr->sh_size;
4689 		size_t	ndx1;
4690 
4691 		/*
4692 		 * Check the section against all following ones, reporting
4693 		 * any overlaps. Since we've sorted the sections by offset,
4694 		 * we can stop after the first comparison that fails. There
4695 		 * are no overlaps in a properly formed ELF file, in which
4696 		 * case this algorithm runs in O(n) time. This will degenerate
4697 		 * to O(n^2) for a completely broken file. Such a file is
4698 		 * (1) highly unlikely, and (2) unusable, so it is reasonable
4699 		 * for the analysis to take longer.
4700 		 */
4701 		for (ndx1 = ndx + 1; ndx1 < shdr_ndx_arr_cnt; ndx1++) {
4702 			Cache	*_cache1 = cache + shdr_ndx_arr[ndx1];
4703 			Shdr	*shdr1 = _cache1->c_shdr;
4704 
4705 			bgn1 = shdr1->sh_offset;
4706 			end1 = shdr1->sh_offset + shdr1->sh_size;
4707 
4708 			if (((bgn1 <= bgn) && (end1 > bgn)) ||
4709 			    ((bgn1 < end) && (end1 >= end))) {
4710 				(void) fprintf(stderr,
4711 				    MSG_INTL(MSG_ERR_SECMEMOVER), file,
4712 				    EC_WORD(elf_ndxscn(_cache->c_scn)),
4713 				    _cache->c_name, EC_OFF(bgn), EC_OFF(end),
4714 				    EC_WORD(elf_ndxscn(_cache1->c_scn)),
4715 				    _cache1->c_name, EC_OFF(bgn1),
4716 				    EC_OFF(end1));
4717 			} else {	/* No overlap, so can stop */
4718 				break;
4719 			}
4720 		}
4721 
4722 		/*
4723 		 * In addition to checking for sections overlapping
4724 		 * each other (done above), we should also make sure
4725 		 * the section doesn't overlap the section header array.
4726 		 */
4727 		bgn1 = ehdr->e_shoff;
4728 		end1 = ehdr->e_shoff + (ehdr->e_shentsize * ehdr->e_shnum);
4729 
4730 		if (((bgn1 <= bgn) && (end1 > bgn)) ||
4731 		    ((bgn1 < end) && (end1 >= end))) {
4732 			(void) fprintf(stderr,
4733 			    MSG_INTL(MSG_ERR_SHDRMEMOVER), file, EC_OFF(bgn1),
4734 			    EC_OFF(end1),
4735 			    EC_WORD(elf_ndxscn(_cache->c_scn)),
4736 			    _cache->c_name, EC_OFF(bgn), EC_OFF(end));
4737 		}
4738 	}
4739 
4740 	/*
4741 	 * Obtain the data for each section.
4742 	 */
4743 	for (ndx = 1; ndx < shnum; ndx++) {
4744 		Cache	*_cache = &cache[ndx];
4745 		Elf_Scn	*scn = _cache->c_scn;
4746 
4747 		if ((_cache->c_data = elf_getdata(scn, NULL)) == NULL) {
4748 			failure(file, MSG_ORIG(MSG_ELF_GETDATA));
4749 			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCNDATA),
4750 			    EC_WORD(elf_ndxscn(scn)));
4751 		}
4752 
4753 		/*
4754 		 * If a string table, verify that it has NULL first and
4755 		 * final bytes.
4756 		 */
4757 		if ((_cache->c_shdr->sh_type == SHT_STRTAB) &&
4758 		    (_cache->c_data != NULL) &&
4759 		    (_cache->c_data->d_buf != NULL) &&
4760 		    (_cache->c_data->d_size > 0)) {
4761 			const char *s = _cache->c_data->d_buf;
4762 
4763 			if ((*s != '\0') ||
4764 			    (*(s + _cache->c_data->d_size - 1) != '\0'))
4765 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALSTR),
4766 				    file, _cache->c_name);
4767 		}
4768 	}
4769 
4770 	return (1);
4771 }
4772 
4773 
4774 
4775 /*
4776  * Generate a cache of section headers and related information
4777  * for use by the rest of elfdump. If requested (or the file
4778  * contains no section headers), we generate a fake set of
4779  * headers from the information accessible from the program headers.
4780  * Otherwise, we use the real section headers contained in the file.
4781  */
4782 static int
4783 create_cache(const char *file, int fd, Elf *elf, Ehdr *ehdr, Cache **cache,
4784     size_t shstrndx, size_t *shnum, uint_t *flags)
4785 {
4786 	/*
4787 	 * If there are no section headers, then resort to synthesizing
4788 	 * section headers from the program headers. This is normally
4789 	 * only done by explicit request, but in this case there's no
4790 	 * reason not to go ahead, since the alternative is simply to quit.
4791 	 */
4792 	if ((*shnum <= 1) && ((*flags & FLG_CTL_FAKESHDR) == 0)) {
4793 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOSHDR), file);
4794 		*flags |= FLG_CTL_FAKESHDR;
4795 	}
4796 
4797 	if (*flags & FLG_CTL_FAKESHDR) {
4798 		if (fake_shdr_cache(file, fd, elf, ehdr, cache, shnum) == 0)
4799 			return (0);
4800 	} else {
4801 		if (shdr_cache(file, elf, ehdr, shstrndx, *shnum,
4802 		    cache, *flags) == 0)
4803 			return (0);
4804 	}
4805 
4806 	return (1);
4807 }
4808 
4809 int
4810 regular(const char *file, int fd, Elf *elf, uint_t flags,
4811     const char *wname, int wfd, uchar_t osabi)
4812 {
4813 	enum { CACHE_NEEDED, CACHE_OK, CACHE_FAIL} cache_state = CACHE_NEEDED;
4814 	Elf_Scn		*scn;
4815 	Ehdr		*ehdr;
4816 	size_t		ndx, shstrndx, shnum, phnum;
4817 	Shdr		*shdr;
4818 	Cache		*cache;
4819 	VERSYM_STATE	versym = { 0 };
4820 	int		ret = 0;
4821 	int		addr_align;
4822 
4823 	if ((ehdr = elf_getehdr(elf)) == NULL) {
4824 		failure(file, MSG_ORIG(MSG_ELF_GETEHDR));
4825 		return (ret);
4826 	}
4827 
4828 	if (elf_getshdrnum(elf, &shnum) == -1) {
4829 		failure(file, MSG_ORIG(MSG_ELF_GETSHDRNUM));
4830 		return (ret);
4831 	}
4832 
4833 	if (elf_getshdrstrndx(elf, &shstrndx) == -1) {
4834 		failure(file, MSG_ORIG(MSG_ELF_GETSHDRSTRNDX));
4835 		return (ret);
4836 	}
4837 
4838 	if (elf_getphdrnum(elf, &phnum) == -1) {
4839 		failure(file, MSG_ORIG(MSG_ELF_GETPHDRNUM));
4840 		return (ret);
4841 	}
4842 	/*
4843 	 * If the user requested section headers derived from the
4844 	 * program headers (-P option) and this file doesn't have
4845 	 * any program headers (i.e. ET_REL), then we can't do it.
4846 	 */
4847 	if ((phnum == 0) && (flags & FLG_CTL_FAKESHDR)) {
4848 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_PNEEDSPH), file);
4849 		return (ret);
4850 	}
4851 
4852 
4853 	if ((scn = elf_getscn(elf, 0)) != NULL) {
4854 		if ((shdr = elf_getshdr(scn)) == NULL) {
4855 			failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
4856 			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN), 0);
4857 			return (ret);
4858 		}
4859 	} else
4860 		shdr = NULL;
4861 
4862 	/*
4863 	 * Print the elf header.
4864 	 */
4865 	if (flags & FLG_SHOW_EHDR)
4866 		Elf_ehdr(0, ehdr, shdr);
4867 
4868 	/*
4869 	 * If the section headers or program headers have inadequate
4870 	 * alignment for the class of object, print a warning. libelf
4871 	 * can handle such files, but programs that use them can crash
4872 	 * when they dereference unaligned items.
4873 	 *
4874 	 * Note that the AMD64 ABI, although it is a 64-bit architecture,
4875 	 * allows access to data types smaller than 128-bits to be on
4876 	 * word alignment.
4877 	 */
4878 	if (ehdr->e_machine == EM_AMD64)
4879 		addr_align = sizeof (Word);
4880 	else
4881 		addr_align = sizeof (Addr);
4882 
4883 	if (ehdr->e_phoff & (addr_align - 1))
4884 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADPHDRALIGN), file);
4885 	if (ehdr->e_shoff & (addr_align - 1))
4886 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHDRALIGN), file);
4887 
4888 
4889 	/*
4890 	 * Determine the Operating System ABI (osabi) we will use to
4891 	 * interpret the object.
4892 	 */
4893 	if (flags & FLG_CTL_OSABI) {
4894 		/*
4895 		 * If the user explicitly specifies '-O none', we need
4896 		 * to display a completely generic view of the file.
4897 		 * However, libconv is written to assume that ELFOSABI_NONE
4898 		 * is equivalent to ELFOSABI_SOLARIS. To get the desired
4899 		 * effect, we use an osabi that libconv has no knowledge of.
4900 		 */
4901 		if (osabi == ELFOSABI_NONE)
4902 			osabi = ELFOSABI_UNKNOWN4;
4903 	} else {
4904 		/* Determine osabi from file */
4905 		osabi = ehdr->e_ident[EI_OSABI];
4906 		if (osabi == ELFOSABI_NONE) {
4907 			/*
4908 			 * Chicken/Egg scenario:
4909 			 *
4910 			 * Ideally, we wait to create the section header cache
4911 			 * until after the program headers are printed. If we
4912 			 * only output program headers, we can skip building
4913 			 * the cache entirely.
4914 			 *
4915 			 * Proper interpretation of program headers requires
4916 			 * the osabi, which is supposed to be in the ELF header.
4917 			 * However, many systems (Solaris and Linux included)
4918 			 * have a history of setting the osabi to the generic
4919 			 * SysV ABI (ELFOSABI_NONE). We assume ELFOSABI_SOLARIS
4920 			 * in such cases, but would like to check the object
4921 			 * to see if it has a Linux .note.ABI-tag section,
4922 			 * which implies ELFOSABI_LINUX. This requires a
4923 			 * section header cache.
4924 			 *
4925 			 * To break the cycle, we create section headers now
4926 			 * if osabi is ELFOSABI_NONE, and later otherwise.
4927 			 * If it succeeds, we use them, if not, we defer
4928 			 * exiting until after the program headers are out.
4929 			 */
4930 			if (create_cache(file, fd, elf, ehdr, &cache,
4931 			    shstrndx, &shnum, &flags) == 0) {
4932 				cache_state = CACHE_FAIL;
4933 			} else {
4934 				cache_state = CACHE_OK;
4935 				if (has_linux_abi_note(cache, shnum, file)) {
4936 					Conv_inv_buf_t	ibuf1, ibuf2;
4937 
4938 					(void) fprintf(stderr,
4939 					    MSG_INTL(MSG_INFO_LINUXOSABI), file,
4940 					    conv_ehdr_osabi(osabi, 0, &ibuf1),
4941 					    conv_ehdr_osabi(ELFOSABI_LINUX,
4942 					    0, &ibuf2));
4943 					osabi = ELFOSABI_LINUX;
4944 				}
4945 			}
4946 		}
4947 		/*
4948 		 * We treat ELFOSABI_NONE identically to ELFOSABI_SOLARIS.
4949 		 * Mapping NONE to SOLARIS simplifies the required test.
4950 		 */
4951 		if (osabi == ELFOSABI_NONE)
4952 			osabi = ELFOSABI_SOLARIS;
4953 	}
4954 
4955 	/*
4956 	 * Print the program headers.
4957 	 */
4958 	if ((flags & FLG_SHOW_PHDR) && (phnum != 0)) {
4959 		Phdr	*phdr;
4960 
4961 		if ((phdr = elf_getphdr(elf)) == NULL) {
4962 			failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
4963 			return (ret);
4964 		}
4965 
4966 		for (ndx = 0; ndx < phnum; phdr++, ndx++) {
4967 			if (!match(MATCH_F_PHDR| MATCH_F_NDX | MATCH_F_TYPE,
4968 			    NULL, ndx, phdr->p_type))
4969 				continue;
4970 
4971 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4972 			dbg_print(0, MSG_INTL(MSG_ELF_PHDR), EC_WORD(ndx));
4973 			Elf_phdr(0, osabi, ehdr->e_machine, phdr);
4974 		}
4975 	}
4976 
4977 	/*
4978 	 * If we have flag bits set that explicitly require a show or calc
4979 	 * operation, but none of them require the section headers, then
4980 	 * we are done and can return now.
4981 	 */
4982 	if (((flags & (FLG_MASK_SHOW | FLG_MASK_CALC)) != 0) &&
4983 	    ((flags & (FLG_MASK_SHOW_SHDR | FLG_MASK_CALC_SHDR)) == 0))
4984 		return (ret);
4985 
4986 	/*
4987 	 * Everything from this point on requires section headers.
4988 	 * If we have no section headers, there is no reason to continue.
4989 	 *
4990 	 * If we tried above to create the section header cache and failed,
4991 	 * it is time to exit. Otherwise, create it if needed.
4992 	 */
4993 	switch (cache_state) {
4994 	case CACHE_NEEDED:
4995 		if (create_cache(file, fd, elf, ehdr, &cache, shstrndx,
4996 		    &shnum, &flags) == 0)
4997 			return (ret);
4998 		break;
4999 	case CACHE_OK:
5000 		break;
5001 	case CACHE_FAIL:
5002 		return (ret);
5003 	}
5004 	if (shnum <= 1)
5005 		goto done;
5006 
5007 	/*
5008 	 * If -w was specified, find and write out the section(s) data.
5009 	 */
5010 	if (wfd) {
5011 		for (ndx = 1; ndx < shnum; ndx++) {
5012 			Cache	*_cache = &cache[ndx];
5013 
5014 			if (match(MATCH_F_STRICT | MATCH_F_ALL, _cache->c_name,
5015 			    ndx, _cache->c_shdr->sh_type) &&
5016 			    _cache->c_data && _cache->c_data->d_buf) {
5017 				if (write(wfd, _cache->c_data->d_buf,
5018 				    _cache->c_data->d_size) !=
5019 				    _cache->c_data->d_size) {
5020 					int err = errno;
5021 					(void) fprintf(stderr,
5022 					    MSG_INTL(MSG_ERR_WRITE), wname,
5023 					    strerror(err));
5024 					/*
5025 					 * Return an exit status of 1, because
5026 					 * the failure is not related to the
5027 					 * ELF file, but by system resources.
5028 					 */
5029 					ret = 1;
5030 					goto done;
5031 				}
5032 			}
5033 		}
5034 	}
5035 
5036 	/*
5037 	 * If we have no flag bits set that explicitly require a show or calc
5038 	 * operation, but match options (-I, -N, -T) were used, then run
5039 	 * through the section headers and see if we can't deduce show flags
5040 	 * from the match options given.
5041 	 *
5042 	 * We don't do this if -w was specified, because (-I, -N, -T) used
5043 	 * with -w in lieu of some other option is supposed to be quiet.
5044 	 */
5045 	if ((wfd == 0) && (flags & FLG_CTL_MATCH) &&
5046 	    ((flags & (FLG_MASK_SHOW | FLG_MASK_CALC)) == 0)) {
5047 		for (ndx = 1; ndx < shnum; ndx++) {
5048 			Cache	*_cache = &cache[ndx];
5049 
5050 			if (!match(MATCH_F_STRICT | MATCH_F_ALL, _cache->c_name,
5051 			    ndx, _cache->c_shdr->sh_type))
5052 				continue;
5053 
5054 			switch (_cache->c_shdr->sh_type) {
5055 			case SHT_PROGBITS:
5056 				/*
5057 				 * Heuristic time: It is usually bad form
5058 				 * to assume the meaning/format of a PROGBITS
5059 				 * section based on its name. However, there
5060 				 * are ABI mandated exceptions. Check for
5061 				 * these special names.
5062 				 */
5063 
5064 				/* The ELF ABI specifies .interp and .got */
5065 				if (strcmp(_cache->c_name,
5066 				    MSG_ORIG(MSG_ELF_INTERP)) == 0) {
5067 					flags |= FLG_SHOW_INTERP;
5068 					break;
5069 				}
5070 				if (strcmp(_cache->c_name,
5071 				    MSG_ORIG(MSG_ELF_GOT)) == 0) {
5072 					flags |= FLG_SHOW_GOT;
5073 					break;
5074 				}
5075 				/*
5076 				 * The GNU compilers, and amd64 ABI, define
5077 				 * .eh_frame and .eh_frame_hdr. The Sun
5078 				 * C++ ABI defines .exception_ranges.
5079 				 */
5080 				if ((strncmp(_cache->c_name,
5081 				    MSG_ORIG(MSG_SCN_FRM),
5082 				    MSG_SCN_FRM_SIZE) == 0) ||
5083 				    (strncmp(_cache->c_name,
5084 				    MSG_ORIG(MSG_SCN_EXRANGE),
5085 				    MSG_SCN_EXRANGE_SIZE) == 0)) {
5086 					flags |= FLG_SHOW_UNWIND;
5087 					break;
5088 				}
5089 				break;
5090 
5091 			case SHT_SYMTAB:
5092 			case SHT_DYNSYM:
5093 			case SHT_SUNW_LDYNSYM:
5094 			case SHT_SUNW_versym:
5095 			case SHT_SYMTAB_SHNDX:
5096 				flags |= FLG_SHOW_SYMBOLS;
5097 				break;
5098 
5099 			case SHT_RELA:
5100 			case SHT_REL:
5101 				flags |= FLG_SHOW_RELOC;
5102 				break;
5103 
5104 			case SHT_HASH:
5105 				flags |= FLG_SHOW_HASH;
5106 				break;
5107 
5108 			case SHT_DYNAMIC:
5109 				flags |= FLG_SHOW_DYNAMIC;
5110 				break;
5111 
5112 			case SHT_NOTE:
5113 				flags |= FLG_SHOW_NOTE;
5114 				break;
5115 
5116 			case SHT_GROUP:
5117 				flags |= FLG_SHOW_GROUP;
5118 				break;
5119 
5120 			case SHT_SUNW_symsort:
5121 			case SHT_SUNW_tlssort:
5122 				flags |= FLG_SHOW_SORT;
5123 				break;
5124 
5125 			case SHT_SUNW_cap:
5126 				flags |= FLG_SHOW_CAP;
5127 				break;
5128 
5129 			case SHT_SUNW_move:
5130 				flags |= FLG_SHOW_MOVE;
5131 				break;
5132 
5133 			case SHT_SUNW_syminfo:
5134 				flags |= FLG_SHOW_SYMINFO;
5135 				break;
5136 
5137 			case SHT_SUNW_verdef:
5138 			case SHT_SUNW_verneed:
5139 				flags |= FLG_SHOW_VERSIONS;
5140 				break;
5141 
5142 			case SHT_AMD64_UNWIND:
5143 				flags |= FLG_SHOW_UNWIND;
5144 				break;
5145 			}
5146 		}
5147 	}
5148 
5149 
5150 	if (flags & FLG_SHOW_SHDR)
5151 		sections(file, cache, shnum, ehdr, osabi);
5152 
5153 	if (flags & FLG_SHOW_INTERP)
5154 		interp(file, cache, shnum, phnum, elf);
5155 
5156 	if ((osabi == ELFOSABI_SOLARIS) || (osabi == ELFOSABI_LINUX))
5157 		versions(cache, shnum, file, flags, &versym);
5158 
5159 	if (flags & FLG_SHOW_SYMBOLS)
5160 		symbols(cache, shnum, ehdr, osabi, &versym, file, flags);
5161 
5162 	if ((flags & FLG_SHOW_SORT) && (osabi == ELFOSABI_SOLARIS))
5163 		sunw_sort(cache, shnum, ehdr, osabi, &versym, file, flags);
5164 
5165 	if (flags & FLG_SHOW_HASH)
5166 		hash(cache, shnum, file, flags);
5167 
5168 	if (flags & FLG_SHOW_GOT)
5169 		got(cache, shnum, ehdr, file);
5170 
5171 	if (flags & FLG_SHOW_GROUP)
5172 		group(cache, shnum, file, flags);
5173 
5174 	if (flags & FLG_SHOW_SYMINFO)
5175 		syminfo(cache, shnum, ehdr, osabi, file);
5176 
5177 	if (flags & FLG_SHOW_RELOC)
5178 		reloc(cache, shnum, ehdr, file);
5179 
5180 	if (flags & FLG_SHOW_DYNAMIC)
5181 		dynamic(cache, shnum, ehdr, osabi, file);
5182 
5183 	if (flags & FLG_SHOW_NOTE) {
5184 		Word	note_cnt;
5185 		size_t	note_shnum;
5186 		Cache	*note_cache;
5187 
5188 		note_cnt = note(cache, shnum, ehdr, file);
5189 
5190 		/*
5191 		 * Solaris core files have section headers, but these
5192 		 * headers do not include SHT_NOTE sections that reference
5193 		 * the core note sections. This means that note() won't
5194 		 * find the core notes. Fake section headers (-P option)
5195 		 * recover these sections, but it is inconvenient to require
5196 		 * users to specify -P in this situation. If the following
5197 		 * are all true:
5198 		 *
5199 		 *	- No note sections were found
5200 		 *	- This is a core file
5201 		 *	- We are not already using fake section headers
5202 		 *
5203 		 * then we will automatically generate fake section headers
5204 		 * and then process them in a second call to note().
5205 		 */
5206 		if ((note_cnt == 0) && (ehdr->e_type == ET_CORE) &&
5207 		    !(flags & FLG_CTL_FAKESHDR) &&
5208 		    (fake_shdr_cache(file, fd, elf, ehdr,
5209 		    &note_cache, &note_shnum) != 0)) {
5210 			(void) note(note_cache, note_shnum, ehdr, file);
5211 			fake_shdr_cache_free(note_cache, note_shnum);
5212 		}
5213 	}
5214 
5215 	if ((flags & FLG_SHOW_MOVE) && (osabi == ELFOSABI_SOLARIS))
5216 		move(cache, shnum, file, flags);
5217 
5218 	if (flags & FLG_CALC_CHECKSUM)
5219 		checksum(elf);
5220 
5221 	if ((flags & FLG_SHOW_CAP) && (osabi == ELFOSABI_SOLARIS))
5222 		cap(file, cache, shnum, phnum, ehdr, osabi, elf, flags);
5223 
5224 	if ((flags & FLG_SHOW_UNWIND) &&
5225 	    ((osabi == ELFOSABI_SOLARIS) || (osabi == ELFOSABI_LINUX)))
5226 		unwind(cache, shnum, phnum, ehdr, osabi, file, elf, flags);
5227 
5228 
5229 	/* Release the memory used to cache section headers */
5230 done:
5231 	if (flags & FLG_CTL_FAKESHDR)
5232 		fake_shdr_cache_free(cache, shnum);
5233 	else
5234 		free(cache);
5235 
5236 	return (ret);
5237 }
5238