xref: /illumos-gate/usr/src/cmd/sgs/elfdump/common/elfdump.c (revision a194faf8907a6722dcf10ad16c6ca72c9b7bd0ba)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 /*
29  * Dump an elf file.
30  */
31 #include	<machdep.h>
32 #include	<sys/elf_386.h>
33 #include	<sys/elf_amd64.h>
34 #include	<sys/elf_SPARC.h>
35 #include	<dwarf.h>
36 #include	<stdio.h>
37 #include	<unistd.h>
38 #include	<errno.h>
39 #include	<strings.h>
40 #include	<debug.h>
41 #include	<conv.h>
42 #include	<msg.h>
43 #include	<_elfdump.h>
44 
45 
46 /*
47  * VERSYM_STATE is used to maintain information about the VERSYM section
48  * in the object being analyzed. It is filled in by versions(), and used
49  * by init_symtbl_state() when displaying symbol information.
50  *
51  * max_verndx contains the largest version index that can appear
52  * in a Versym entry. This can never be less than 1: In the case where
53  * there is no verdef/verneed sections, the [0] index is reserved
54  * for local symbols, and the [1] index for globals. If Solaris versioning
55  * rules are in effect and there is a verdef section, then the number
56  * of defined versions provides this number. If GNU versioning is in effect,
57  * then:
58  *	- If there is no verneed section, it is the same as for
59  *		Solaris versioning.
60  *	- If there is a verneed section, the vna_other field of the
61  *		Vernaux structs contain versions, and max_verndx is the
62  *		largest such index.
63  *
64  * The value of the gnu field is based on the presence of
65  * a DT_VERSYM entry in the dynamic section: GNU ld produces these, and
66  * Solaris ld does not.
67  */
68 typedef struct {
69 	Cache	*cache;		/* Pointer to cache entry for VERSYM */
70 	Versym	*data;		/* Pointer to versym array */
71 	int	gnu;		/* True if object uses GNU versioning rules */
72 	int	max_verndx;	/* largest versym index value */
73 } VERSYM_STATE;
74 
75 /*
76  * SYMTBL_STATE is used to maintain information about a single symbol
77  * table section, for use by the routines that display symbol information.
78  */
79 typedef struct {
80 	const char	*file;		/* Name of file */
81 	Ehdr		*ehdr;		/* ELF header for file */
82 	Cache		*cache;		/* Cache of all section headers */
83 	Word		shnum;		/* # of sections in cache */
84 	Cache		*seccache;	/* Cache of symbol table section hdr */
85 	Word		secndx;		/* Index of symbol table section hdr */
86 	const char	*secname;	/* Name of section */
87 	uint_t		flags;		/* Command line option flags */
88 	struct {			/* Extended section index data */
89 		int	checked;	/* TRUE if already checked for shxndx */
90 		Word	*data;		/* NULL, or extended section index */
91 					/*	used for symbol table entries */
92 		uint_t	n;		/* # items in shxndx.data */
93 	} shxndx;
94 	VERSYM_STATE	*versym;	/* NULL, or associated VERSYM section */
95 	Sym 		*sym;		/* Array of symbols */
96 	Word		symn;		/* # of symbols */
97 } SYMTBL_STATE;
98 
99 
100 
101 /*
102  * Focal point for verifying symbol names.
103  */
104 static const char *
105 string(Cache *refsec, Word ndx, Cache *strsec, const char *file, Word name)
106 {
107 	/*
108 	 * If an error in this routine is due to a property of the string
109 	 * section, as opposed to a bad offset into the section (a property of
110 	 * the referencing section), then we will detect the same error on
111 	 * every call involving those sections. We use these static variables
112 	 * to retain the information needed to only issue each such error once.
113 	 */
114 	static Cache	*last_refsec;	/* Last referencing section seen */
115 	static int	strsec_err;	/* True if error issued */
116 
117 	const char	*strs;
118 	Word		strn;
119 
120 	if (strsec->c_data == NULL)
121 		return (NULL);
122 
123 	strs = (char *)strsec->c_data->d_buf;
124 	strn = strsec->c_data->d_size;
125 
126 	/*
127 	 * We only print a diagnostic regarding a bad string table once per
128 	 * input section being processed. If the refsec has changed, reset
129 	 * our retained error state.
130 	 */
131 	if (last_refsec != refsec) {
132 		last_refsec = refsec;
133 		strsec_err = 0;
134 	}
135 
136 	/* Verify that strsec really is a string table */
137 	if (strsec->c_shdr->sh_type != SHT_STRTAB) {
138 		if (!strsec_err) {
139 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOTSTRTAB),
140 			    file, strsec->c_ndx, refsec->c_ndx);
141 			strsec_err = 1;
142 		}
143 		return (MSG_INTL(MSG_STR_UNKNOWN));
144 	}
145 
146 	/*
147 	 * Is the string table offset within range of the available strings?
148 	 */
149 	if (name >= strn) {
150 		/*
151 		 * Do we have a empty string table?
152 		 */
153 		if (strs == 0) {
154 			if (!strsec_err) {
155 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
156 				    file, strsec->c_name);
157 				strsec_err = 1;
158 			}
159 		} else {
160 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSTOFF),
161 			    file, refsec->c_name, EC_WORD(ndx), strsec->c_name,
162 			    EC_WORD(name), EC_WORD(strn - 1));
163 		}
164 
165 		/*
166 		 * Return the empty string so that the calling function can
167 		 * continue it's output diagnostics.
168 		 */
169 		return (MSG_INTL(MSG_STR_UNKNOWN));
170 	}
171 	return (strs + name);
172 }
173 
174 /*
175  * Relocations can reference section symbols and standard symbols.  If the
176  * former, establish the section name.
177  */
178 static const char *
179 relsymname(Cache *cache, Cache *csec, Cache *strsec, Word symndx, Word symnum,
180     Word relndx, Sym *syms, char *secstr, size_t secsz, const char *file,
181     uint_t flags)
182 {
183 	Sym	*sym;
184 
185 	if (symndx >= symnum) {
186 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_RELBADSYMNDX),
187 		    file, EC_WORD(symndx), EC_WORD(relndx));
188 		return (MSG_INTL(MSG_STR_UNKNOWN));
189 	}
190 
191 	sym = (Sym *)(syms + symndx);
192 
193 	/*
194 	 * If the symbol represents a section offset construct an appropriate
195 	 * string.
196 	 */
197 	if ((ELF_ST_TYPE(sym->st_info) == STT_SECTION) && (sym->st_name == 0)) {
198 		if (flags & FLG_CTL_LONGNAME)
199 			(void) snprintf(secstr, secsz,
200 			    MSG_INTL(MSG_STR_L_SECTION),
201 			    cache[sym->st_shndx].c_name);
202 		else
203 			(void) snprintf(secstr, secsz,
204 			    MSG_INTL(MSG_STR_SECTION),
205 			    cache[sym->st_shndx].c_name);
206 		return ((const char *)secstr);
207 	}
208 
209 	return (string(csec, symndx, strsec, file, sym->st_name));
210 }
211 
212 /*
213  * Focal point for establishing a string table section.  Data such as the
214  * dynamic information simply points to a string table.  Data such as
215  * relocations, reference a symbol table, which in turn is associated with a
216  * string table.
217  */
218 static int
219 stringtbl(Cache *cache, int symtab, Word ndx, Word shnum, const char *file,
220     Word *symnum, Cache **symsec, Cache **strsec)
221 {
222 	Shdr	*shdr = cache[ndx].c_shdr;
223 
224 	if (symtab) {
225 		/*
226 		 * Validate the symbol table section.
227 		 */
228 		if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
229 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
230 			    file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
231 			return (0);
232 		}
233 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
234 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
235 			    file, cache[ndx].c_name);
236 			return (0);
237 		}
238 
239 		/*
240 		 * Obtain, and verify the symbol table data.
241 		 */
242 		if ((cache[ndx].c_data == NULL) ||
243 		    (cache[ndx].c_data->d_buf == NULL)) {
244 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
245 			    file, cache[ndx].c_name);
246 			return (0);
247 		}
248 
249 		/*
250 		 * Establish the string table index.
251 		 */
252 		ndx = shdr->sh_link;
253 		shdr = cache[ndx].c_shdr;
254 
255 		/*
256 		 * Return symbol table information.
257 		 */
258 		if (symnum)
259 			*symnum = (shdr->sh_size / shdr->sh_entsize);
260 		if (symsec)
261 			*symsec = &cache[ndx];
262 	}
263 
264 	/*
265 	 * Validate the associated string table section.
266 	 */
267 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
268 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
269 		    file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
270 		return (0);
271 	}
272 
273 	if (strsec)
274 		*strsec = &cache[shdr->sh_link];
275 
276 	return (1);
277 }
278 
279 /*
280  * Lookup a symbol and set Sym accordingly.
281  */
282 static int
283 symlookup(const char *name, Cache *cache, Word shnum, Sym **sym,
284     Cache *symtab, const char *file)
285 {
286 	Shdr	*shdr;
287 	Word	symn, cnt;
288 	Sym	*syms;
289 
290 	if (symtab == 0)
291 		return (0);
292 
293 	shdr = symtab->c_shdr;
294 
295 	/*
296 	 * Determine the symbol data and number.
297 	 */
298 	if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
299 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
300 		    file, symtab->c_name);
301 		return (0);
302 	}
303 	if (symtab->c_data == NULL)
304 		return (0);
305 
306 	/* LINTED */
307 	symn = (Word)(shdr->sh_size / shdr->sh_entsize);
308 	syms = (Sym *)symtab->c_data->d_buf;
309 
310 	/*
311 	 * Get the associated string table section.
312 	 */
313 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
314 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
315 		    file, symtab->c_name, EC_WORD(shdr->sh_link));
316 		return (0);
317 	}
318 
319 	/*
320 	 * Loop through the symbol table to find a match.
321 	 */
322 	for (cnt = 0; cnt < symn; syms++, cnt++) {
323 		const char	*symname;
324 
325 		symname = string(symtab, cnt, &cache[shdr->sh_link], file,
326 		    syms->st_name);
327 
328 		if (symname && (strcmp(name, symname) == 0)) {
329 			*sym = syms;
330 			return (1);
331 		}
332 	}
333 	return (0);
334 }
335 
336 /*
337  * Print section headers.
338  */
339 static void
340 sections(const char *file, Cache *cache, Word shnum, Ehdr *ehdr)
341 {
342 	size_t	seccnt;
343 
344 	for (seccnt = 1; seccnt < shnum; seccnt++) {
345 		Cache		*_cache = &cache[seccnt];
346 		Shdr		*shdr = _cache->c_shdr;
347 		const char	*secname = _cache->c_name;
348 
349 		/*
350 		 * Although numerous section header entries can be zero, it's
351 		 * usually a sign of trouble if the type is zero.
352 		 */
353 		if (shdr->sh_type == 0) {
354 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHTYPE),
355 			    file, secname, EC_WORD(shdr->sh_type));
356 		}
357 
358 		if (!match(MATCH_F_ALL, secname, seccnt, shdr->sh_type))
359 			continue;
360 
361 		/*
362 		 * Identify any sections that are suspicious.  A .got section
363 		 * shouldn't exist in a relocatable object.
364 		 */
365 		if (ehdr->e_type == ET_REL) {
366 			if (strncmp(secname, MSG_ORIG(MSG_ELF_GOT),
367 			    MSG_ELF_GOT_SIZE) == 0) {
368 				(void) fprintf(stderr,
369 				    MSG_INTL(MSG_GOT_UNEXPECTED), file,
370 				    secname);
371 			}
372 		}
373 
374 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
375 		dbg_print(0, MSG_INTL(MSG_ELF_SHDR), EC_WORD(seccnt), secname);
376 		Elf_shdr(0, ehdr->e_machine, shdr);
377 	}
378 }
379 
380 /*
381  * A couple of instances of unwind data are printed as tables of 8 data items
382  * expressed as 0x?? integers.
383  */
384 #define	UNWINDTBLSZ	10 + (8 * 5) + 1
385 
386 static void
387 unwindtbl(uint64_t *ndx, uint_t len, uchar_t *data, uint64_t doff,
388     const char *msg, const char *pre, size_t plen)
389 {
390 	char	buffer[UNWINDTBLSZ];
391 	uint_t	boff = plen, cnt = 0;
392 
393 	dbg_print(0, msg);
394 	(void) strncpy(buffer, pre, UNWINDTBLSZ);
395 
396 	while (*ndx < (len + 4)) {
397 		if (cnt == 8) {
398 			dbg_print(0, buffer);
399 			boff = plen;
400 			cnt = 0;
401 		}
402 		(void) snprintf(&buffer[boff], UNWINDTBLSZ - boff,
403 		    MSG_ORIG(MSG_UNW_TBLENTRY), data[doff + (*ndx)++]);
404 		boff += 5;
405 		cnt++;
406 	}
407 	if (cnt)
408 		dbg_print(0, buffer);
409 }
410 
411 /*
412  * Obtain a specified Phdr entry.
413  */
414 static Phdr *
415 getphdr(Word phnum, Word type, const char *file, Elf *elf)
416 {
417 	Word	cnt;
418 	Phdr	*phdr;
419 
420 	if ((phdr = elf_getphdr(elf)) == NULL) {
421 		failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
422 		return (0);
423 	}
424 
425 	for (cnt = 0; cnt < phnum; phdr++, cnt++) {
426 		if (phdr->p_type == type)
427 			return (phdr);
428 	}
429 	return (0);
430 }
431 
432 static void
433 unwind(Cache *cache, Word shnum, Word phnum, Ehdr *ehdr, const char *file,
434     Elf *elf)
435 {
436 	Conv_dwarf_ehe_buf_t	dwarf_ehe_buf;
437 	Word	cnt;
438 	Phdr	*uphdr = 0;
439 
440 	/*
441 	 * For the moment - UNWIND is only relevant for a AMD64 object.
442 	 */
443 	if (ehdr->e_machine != EM_AMD64)
444 		return;
445 
446 	if (phnum)
447 		uphdr = getphdr(phnum, PT_SUNW_UNWIND, file, elf);
448 
449 	for (cnt = 1; cnt < shnum; cnt++) {
450 		Cache		*_cache = &cache[cnt];
451 		Shdr		*shdr = _cache->c_shdr;
452 		uchar_t		*data;
453 		size_t		datasize;
454 		uint64_t	off, ndx, frame_ptr, fde_cnt, tabndx;
455 		uint_t		vers, frame_ptr_enc, fde_cnt_enc, table_enc;
456 
457 		/*
458 		 * AMD64 - this is a strmcp() just to find the gcc produced
459 		 * sections.  Soon gcc should be setting the section type - and
460 		 * we'll not need this strcmp().
461 		 */
462 		if ((shdr->sh_type != SHT_AMD64_UNWIND) &&
463 		    (strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRM),
464 		    MSG_SCN_FRM_SIZE) != 0) &&
465 		    (strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRMHDR),
466 		    MSG_SCN_FRMHDR_SIZE) != 0))
467 			continue;
468 
469 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
470 			continue;
471 
472 		if (_cache->c_data == NULL)
473 			continue;
474 
475 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
476 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_UNWIND), _cache->c_name);
477 
478 		data = (uchar_t *)(_cache->c_data->d_buf);
479 		datasize = _cache->c_data->d_size;
480 		off = 0;
481 
482 		/*
483 		 * Is this a .eh_frame_hdr
484 		 */
485 		if ((uphdr && (shdr->sh_addr == uphdr->p_vaddr)) ||
486 		    (strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRMHDR),
487 		    MSG_SCN_FRMHDR_SIZE) == 0)) {
488 			dbg_print(0, MSG_ORIG(MSG_UNW_FRMHDR));
489 			ndx = 0;
490 
491 			vers = data[ndx++];
492 			frame_ptr_enc = data[ndx++];
493 			fde_cnt_enc = data[ndx++];
494 			table_enc = data[ndx++];
495 
496 			dbg_print(0, MSG_ORIG(MSG_UNW_FRMVERS), vers);
497 
498 			frame_ptr = dwarf_ehe_extract(data, &ndx, frame_ptr_enc,
499 			    ehdr->e_ident, shdr->sh_addr + ndx);
500 
501 			dbg_print(0, MSG_ORIG(MSG_UNW_FRPTRENC),
502 			    conv_dwarf_ehe(frame_ptr_enc, &dwarf_ehe_buf),
503 			    EC_XWORD(frame_ptr));
504 
505 			fde_cnt = dwarf_ehe_extract(data, &ndx, fde_cnt_enc,
506 			    ehdr->e_ident, shdr->sh_addr + ndx);
507 
508 			dbg_print(0, MSG_ORIG(MSG_UNW_FDCNENC),
509 			    conv_dwarf_ehe(fde_cnt_enc, &dwarf_ehe_buf),
510 			    EC_XWORD(fde_cnt));
511 			dbg_print(0, MSG_ORIG(MSG_UNW_TABENC),
512 			    conv_dwarf_ehe(table_enc, &dwarf_ehe_buf));
513 			dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTAB1));
514 			dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTAB2));
515 
516 			for (tabndx = 0; tabndx < fde_cnt; tabndx++) {
517 				dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTABENT),
518 				    EC_XWORD(dwarf_ehe_extract(data, &ndx,
519 				    table_enc, ehdr->e_ident, shdr->sh_addr)),
520 				    EC_XWORD(dwarf_ehe_extract(data, &ndx,
521 				    table_enc, ehdr->e_ident, shdr->sh_addr)));
522 			}
523 			continue;
524 		}
525 
526 		/*
527 		 * Walk the Eh_frame's
528 		 */
529 		while (off < datasize) {
530 			uint_t		cieid, cielength, cieversion;
531 			uint_t		cieretaddr;
532 			int		cieRflag, cieLflag, ciePflag, cieZflag;
533 			uint_t		cieaugndx, length, id;
534 			uint64_t	ciecalign, ciedalign;
535 			char		*cieaugstr;
536 
537 			ndx = 0;
538 			/*
539 			 * extract length in lsb format
540 			 */
541 			length = LSB32EXTRACT(data + off + ndx);
542 			ndx += 4;
543 
544 			/*
545 			 * extract CIE id in lsb format
546 			 */
547 			id = LSB32EXTRACT(data + off + ndx);
548 			ndx += 4;
549 
550 			/*
551 			 * A CIE record has a id of '0', otherwise this is a
552 			 * FDE entry and the 'id' is the CIE pointer.
553 			 */
554 			if (id == 0) {
555 				uint64_t    persVal;
556 
557 				cielength = length;
558 				cieid = id;
559 				cieLflag = ciePflag = cieRflag = cieZflag = 0;
560 
561 				dbg_print(0, MSG_ORIG(MSG_UNW_CIE),
562 				    EC_XWORD(shdr->sh_addr + off));
563 				dbg_print(0, MSG_ORIG(MSG_UNW_CIELNGTH),
564 				    cielength, cieid);
565 
566 				cieversion = data[off + ndx];
567 				ndx += 1;
568 				cieaugstr = (char *)(&data[off + ndx]);
569 				ndx += strlen(cieaugstr) + 1;
570 
571 				dbg_print(0, MSG_ORIG(MSG_UNW_CIEVERS),
572 				    cieversion, cieaugstr);
573 
574 				ciecalign = uleb_extract(&data[off], &ndx);
575 				ciedalign = sleb_extract(&data[off], &ndx);
576 				cieretaddr = data[off + ndx];
577 				ndx += 1;
578 
579 				dbg_print(0, MSG_ORIG(MSG_UNW_CIECALGN),
580 				    EC_XWORD(ciecalign), EC_XWORD(ciedalign),
581 				    cieretaddr);
582 
583 				if (cieaugstr[0])
584 					dbg_print(0,
585 					    MSG_ORIG(MSG_UNW_CIEAXVAL));
586 
587 				for (cieaugndx = 0; cieaugstr[cieaugndx];
588 				    cieaugndx++) {
589 					uint_t	val;
590 
591 					switch (cieaugstr[cieaugndx]) {
592 					case 'z':
593 						val = uleb_extract(&data[off],
594 						    &ndx);
595 						dbg_print(0,
596 						    MSG_ORIG(MSG_UNW_CIEAXSIZ),
597 						    val);
598 						cieZflag = 1;
599 						break;
600 					case 'P':
601 						ciePflag = data[off + ndx];
602 						ndx += 1;
603 
604 						persVal = dwarf_ehe_extract(
605 						    &data[off], &ndx, ciePflag,
606 						    ehdr->e_ident,
607 						    shdr->sh_addr + off + ndx);
608 						dbg_print(0,
609 						    MSG_ORIG(MSG_UNW_CIEAXPERS),
610 						    ciePflag,
611 						    conv_dwarf_ehe(ciePflag,
612 						    &dwarf_ehe_buf),
613 						    EC_XWORD(persVal));
614 						break;
615 					case 'R':
616 						val = data[off + ndx];
617 						ndx += 1;
618 						dbg_print(0,
619 						    MSG_ORIG(MSG_UNW_CIEAXCENC),
620 						    val, conv_dwarf_ehe(val,
621 						    &dwarf_ehe_buf));
622 						cieRflag = val;
623 						break;
624 					case 'L':
625 						val = data[off + ndx];
626 						ndx += 1;
627 						dbg_print(0,
628 						    MSG_ORIG(MSG_UNW_CIEAXLSDA),
629 						    val, conv_dwarf_ehe(val,
630 						    &dwarf_ehe_buf));
631 						cieLflag = val;
632 						break;
633 					default:
634 						dbg_print(0,
635 						    MSG_ORIG(MSG_UNW_CIEAXUNEC),
636 						    cieaugstr[cieaugndx]);
637 						break;
638 					}
639 				}
640 				if ((cielength + 4) > ndx)
641 					unwindtbl(&ndx, cielength, data, off,
642 					    MSG_ORIG(MSG_UNW_CIECFI),
643 					    MSG_ORIG(MSG_UNW_CIEPRE),
644 					    MSG_UNW_CIEPRE_SIZE);
645 				off += cielength + 4;
646 
647 			} else {
648 				uint_t	    fdelength = length;
649 				int	    fdecieptr = id;
650 				uint64_t    fdeinitloc, fdeaddrrange;
651 
652 				dbg_print(0, MSG_ORIG(MSG_UNW_FDE),
653 				    EC_XWORD(shdr->sh_addr + off));
654 				dbg_print(0, MSG_ORIG(MSG_UNW_FDELNGTH),
655 				    fdelength, fdecieptr);
656 
657 				fdeinitloc = dwarf_ehe_extract(&data[off],
658 				    &ndx, cieRflag, ehdr->e_ident,
659 				    shdr->sh_addr + off + ndx);
660 				fdeaddrrange = dwarf_ehe_extract(&data[off],
661 				    &ndx, (cieRflag & ~DW_EH_PE_pcrel),
662 				    ehdr->e_ident,
663 				    shdr->sh_addr + off + ndx);
664 
665 				dbg_print(0, MSG_ORIG(MSG_UNW_FDEINITLOC),
666 				    EC_XWORD(fdeinitloc),
667 				    EC_XWORD(fdeaddrrange));
668 
669 				if (cieaugstr[0])
670 					dbg_print(0,
671 					    MSG_ORIG(MSG_UNW_FDEAXVAL));
672 				if (cieZflag) {
673 					uint64_t    val;
674 					val = uleb_extract(&data[off], &ndx);
675 					dbg_print(0,
676 					    MSG_ORIG(MSG_UNW_FDEAXSIZE),
677 					    EC_XWORD(val));
678 					if (val & cieLflag) {
679 						fdeinitloc = dwarf_ehe_extract(
680 						    &data[off], &ndx, cieLflag,
681 						    ehdr->e_ident,
682 						    shdr->sh_addr + off + ndx);
683 						dbg_print(0,
684 						    MSG_ORIG(MSG_UNW_FDEAXLSDA),
685 						    EC_XWORD(val));
686 					}
687 				}
688 				if ((fdelength + 4) > ndx)
689 					unwindtbl(&ndx, fdelength, data, off,
690 					    MSG_ORIG(MSG_UNW_FDECFI),
691 					    MSG_ORIG(MSG_UNW_FDEPRE),
692 					    MSG_UNW_FDEPRE_SIZE);
693 				off += fdelength + 4;
694 			}
695 		}
696 	}
697 }
698 
699 /*
700  * Print the hardware/software capabilities.  For executables and shared objects
701  * this should be accompanied with a program header.
702  */
703 static void
704 cap(const char *file, Cache *cache, Word shnum, Word phnum, Ehdr *ehdr,
705     Elf *elf)
706 {
707 	Word		cnt;
708 	Shdr		*cshdr = 0;
709 	Cache		*ccache;
710 	Off		cphdr_off = 0;
711 	Xword		cphdr_sz;
712 
713 	/*
714 	 * Determine if a hardware/software capabilities header exists.
715 	 */
716 	if (phnum) {
717 		Phdr	*phdr;
718 
719 		if ((phdr = elf_getphdr(elf)) == NULL) {
720 			failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
721 			return;
722 		}
723 
724 		for (cnt = 0; cnt < phnum; phdr++, cnt++) {
725 			if (phdr->p_type == PT_SUNWCAP) {
726 				cphdr_off = phdr->p_offset;
727 				cphdr_sz = phdr->p_filesz;
728 				break;
729 			}
730 		}
731 	}
732 
733 	/*
734 	 * Determine if a hardware/software capabilities section exists.
735 	 */
736 	for (cnt = 1; cnt < shnum; cnt++) {
737 		Cache	*_cache = &cache[cnt];
738 		Shdr	*shdr = _cache->c_shdr;
739 
740 		if (shdr->sh_type != SHT_SUNW_cap)
741 			continue;
742 
743 		if (cphdr_off && ((cphdr_off < shdr->sh_offset) ||
744 		    (cphdr_off + cphdr_sz) > (shdr->sh_offset + shdr->sh_size)))
745 			continue;
746 
747 		if (_cache->c_data == NULL)
748 			continue;
749 
750 		ccache = _cache;
751 		cshdr = shdr;
752 		break;
753 	}
754 
755 	if ((cshdr == 0) && (cphdr_off == 0))
756 		return;
757 
758 	/*
759 	 * Print the hardware/software capabilities section.
760 	 */
761 	if (cshdr) {
762 		Word	ndx, capn;
763 		Cap	*cap = (Cap *)ccache->c_data->d_buf;
764 
765 		if ((cshdr->sh_entsize == 0) || (cshdr->sh_size == 0)) {
766 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
767 			    file, ccache->c_name);
768 			return;
769 		}
770 
771 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
772 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_CAP), ccache->c_name);
773 
774 		Elf_cap_title(0);
775 
776 		capn = (Word)(cshdr->sh_size / cshdr->sh_entsize);
777 
778 		for (ndx = 0; ndx < capn; cap++, ndx++) {
779 			if (cap->c_tag != CA_SUNW_NULL)
780 				Elf_cap_entry(0, cap, ndx, ehdr->e_machine);
781 		}
782 	} else
783 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP1), file);
784 
785 	/*
786 	 * If this object is an executable or shared object, then the
787 	 * hardware/software capabilities section should have an accompanying
788 	 * program header.
789 	 */
790 	if (cshdr && ((ehdr->e_type == ET_EXEC) || (ehdr->e_type == ET_DYN))) {
791 		if (cphdr_off == 0)
792 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP2),
793 			    file, ccache->c_name);
794 		else if ((cphdr_off != cshdr->sh_offset) ||
795 		    (cphdr_sz != cshdr->sh_size))
796 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP3),
797 			    file, ccache->c_name);
798 	}
799 }
800 
801 /*
802  * Print the interpretor.
803  */
804 static void
805 interp(const char *file, Cache *cache, Word shnum, Word phnum, Elf *elf)
806 {
807 	Word	cnt;
808 	Shdr	*ishdr = 0;
809 	Cache	*icache;
810 	Off	iphdr_off = 0;
811 	Xword	iphdr_fsz;
812 
813 	/*
814 	 * Determine if an interp header exists.
815 	 */
816 	if (phnum) {
817 		Phdr	*phdr;
818 
819 		if ((phdr = getphdr(phnum, PT_INTERP, file, elf)) != 0) {
820 			iphdr_off = phdr->p_offset;
821 			iphdr_fsz = phdr->p_filesz;
822 		}
823 	}
824 
825 	if (iphdr_off == 0)
826 		return;
827 
828 	/*
829 	 * Determine if an interp section exists.
830 	 */
831 	for (cnt = 1; cnt < shnum; cnt++) {
832 		Cache	*_cache = &cache[cnt];
833 		Shdr	*shdr = _cache->c_shdr;
834 
835 		/*
836 		 * Scan sections to find a section which contains the PT_INTERP
837 		 * string.  The target section can't be in a NOBITS section.
838 		 */
839 		if ((shdr->sh_type == SHT_NOBITS) ||
840 		    (iphdr_off < shdr->sh_offset) ||
841 		    (iphdr_off + iphdr_fsz) > (shdr->sh_offset + shdr->sh_size))
842 			continue;
843 
844 		icache = _cache;
845 		ishdr = shdr;
846 		break;
847 	}
848 
849 	/*
850 	 * Print the interpreter string based on the offset defined in the
851 	 * program header, as this is the offset used by the kernel.
852 	 */
853 	if (ishdr && icache->c_data) {
854 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
855 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_INTERP), icache->c_name);
856 		dbg_print(0, MSG_ORIG(MSG_FMT_INDENT),
857 		    (char *)icache->c_data->d_buf +
858 		    (iphdr_off - ishdr->sh_offset));
859 	} else
860 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVINTERP1), file);
861 
862 	/*
863 	 * If there are any inconsistences between the program header and
864 	 * section information, flag them.
865 	 */
866 	if (ishdr && ((iphdr_off != ishdr->sh_offset) ||
867 	    (iphdr_fsz != ishdr->sh_size))) {
868 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVINTERP2), file,
869 		    icache->c_name);
870 	}
871 }
872 
873 /*
874  * Print the syminfo section.
875  */
876 static void
877 syminfo(Cache *cache, Word shnum, const char *file)
878 {
879 	Shdr		*infoshdr;
880 	Syminfo		*info;
881 	Sym		*syms;
882 	Dyn		*dyns;
883 	Word		infonum, cnt, ndx, symnum;
884 	Cache		*infocache = 0, *symsec, *strsec;
885 
886 	for (cnt = 1; cnt < shnum; cnt++) {
887 		if (cache[cnt].c_shdr->sh_type == SHT_SUNW_syminfo) {
888 			infocache = &cache[cnt];
889 			break;
890 		}
891 	}
892 	if (infocache == 0)
893 		return;
894 
895 	infoshdr = infocache->c_shdr;
896 	if ((infoshdr->sh_entsize == 0) || (infoshdr->sh_size == 0)) {
897 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
898 		    file, infocache->c_name);
899 		return;
900 	}
901 	if (infocache->c_data == NULL)
902 		return;
903 
904 	infonum = (Word)(infoshdr->sh_size / infoshdr->sh_entsize);
905 	info = (Syminfo *)infocache->c_data->d_buf;
906 
907 	/*
908 	 * Get the data buffer of the associated dynamic section.
909 	 */
910 	if ((infoshdr->sh_info == 0) || (infoshdr->sh_info >= shnum)) {
911 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHINFO),
912 		    file, infocache->c_name, EC_WORD(infoshdr->sh_info));
913 		return;
914 	}
915 	if (cache[infoshdr->sh_info].c_data == NULL)
916 		return;
917 
918 	dyns = cache[infoshdr->sh_info].c_data->d_buf;
919 	if (dyns == 0) {
920 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
921 		    file, cache[infoshdr->sh_info].c_name);
922 		return;
923 	}
924 
925 	/*
926 	 * Get the data buffer for the associated symbol table and string table.
927 	 */
928 	if (stringtbl(cache, 1, cnt, shnum, file,
929 	    &symnum, &symsec, &strsec) == 0)
930 		return;
931 
932 	syms = symsec->c_data->d_buf;
933 
934 	/*
935 	 * Loop through the syminfo entries.
936 	 */
937 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
938 	dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMINFO), infocache->c_name);
939 	Elf_syminfo_title(0);
940 
941 	for (ndx = 1, info++; ndx < infonum; ndx++, info++) {
942 		Sym 		*sym;
943 		const char	*needed = 0, *name;
944 
945 		if ((info->si_flags == 0) && (info->si_boundto == 0))
946 			continue;
947 
948 		sym = &syms[ndx];
949 		name = string(infocache, ndx, strsec, file, sym->st_name);
950 
951 		if (info->si_boundto < SYMINFO_BT_LOWRESERVE) {
952 			Dyn	*dyn = &dyns[info->si_boundto];
953 
954 			needed = string(infocache, info->si_boundto,
955 			    strsec, file, dyn->d_un.d_val);
956 		}
957 		Elf_syminfo_entry(0, ndx, info, name, needed);
958 	}
959 }
960 
961 /*
962  * Print version definition section entries.
963  */
964 static void
965 version_def(Verdef *vdf, Word vdf_num, Cache *vcache, Cache *scache,
966     const char *file)
967 {
968 	Word	cnt;
969 	char	index[MAXNDXSIZE];
970 
971 	Elf_ver_def_title(0);
972 
973 	for (cnt = 1; cnt <= vdf_num; cnt++,
974 	    vdf = (Verdef *)((uintptr_t)vdf + vdf->vd_next)) {
975 		const char	*name, *dep;
976 		Half		vcnt = vdf->vd_cnt - 1;
977 		Half		ndx = vdf->vd_ndx;
978 		Verdaux *vdap = (Verdaux *)((uintptr_t)vdf + vdf->vd_aux);
979 
980 		/*
981 		 * Obtain the name and first dependency (if any).
982 		 */
983 		name = string(vcache, cnt, scache, file, vdap->vda_name);
984 		vdap = (Verdaux *)((uintptr_t)vdap + vdap->vda_next);
985 		if (vcnt)
986 			dep = string(vcache, cnt, scache, file, vdap->vda_name);
987 		else
988 			dep = MSG_ORIG(MSG_STR_EMPTY);
989 
990 		(void) snprintf(index, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX),
991 		    EC_XWORD(ndx));
992 		Elf_ver_line_1(0, index, name, dep,
993 		    conv_ver_flags(vdf->vd_flags));
994 
995 		/*
996 		 * Print any additional dependencies.
997 		 */
998 		if (vcnt) {
999 			vdap = (Verdaux *)((uintptr_t)vdap + vdap->vda_next);
1000 			for (vcnt--; vcnt; vcnt--,
1001 			    vdap = (Verdaux *)((uintptr_t)vdap +
1002 			    vdap->vda_next)) {
1003 				dep = string(vcache, cnt, scache, file,
1004 				    vdap->vda_name);
1005 				Elf_ver_line_2(0, MSG_ORIG(MSG_STR_EMPTY), dep);
1006 			}
1007 		}
1008 	}
1009 }
1010 
1011 /*
1012  * Print version needed section entries.
1013  *
1014  * entry:
1015  *	vnd - Address of verneed data
1016  *	vnd_num - # of Verneed entries
1017  *	vcache - Cache of verneed section being processed
1018  *	scache - Cache of associated string table section
1019  *	file - Name of object being processed.
1020  *	versym - Information about versym section
1021  *
1022  * exit:
1023  *	The versions have been printed. If GNU style versioning
1024  *	is in effect, versym->max_verndx has been updated to
1025  *	contain the largest version index seen.
1026  */
1027 static void
1028 version_need(Verneed *vnd, Word vnd_num, Cache *vcache, Cache *scache,
1029     const char *file, VERSYM_STATE *versym)
1030 {
1031 	Word		cnt;
1032 	char		index[MAXNDXSIZE];
1033 	const char	*index_str;
1034 
1035 	Elf_ver_need_title(0, versym->gnu);
1036 
1037 	/*
1038 	 * The versym section in an object that follows Solaris versioning
1039 	 * rules contains indexes into the verdef section. Symbols defined
1040 	 * in other objects (UNDEF) are given a version of 0, indicating that
1041 	 * they are not defined by this file, and the Verneed entries do not
1042 	 * have associated version indexes. For these reasons, we do not
1043 	 * display a version index for Solaris Verneed sections.
1044 	 *
1045 	 * The GNU versioning rules are different: Symbols defined in other
1046 	 * objects receive a version index in the range above those defined
1047 	 * by the Verdef section, and the vna_other field of the Vernaux
1048 	 * structs inside the Verneed section contain the version index for
1049 	 * that item. We therefore  display the index when showing the
1050 	 * contents of a GNU Verneed section. You should not expect these
1051 	 * indexes to appear in sorted order --- it seems that the GNU ld
1052 	 * assigns the versions as symbols are encountered during linking,
1053 	 * and then the results are assembled into the Verneed section
1054 	 * afterwards.
1055 	 */
1056 	if (versym->gnu) {
1057 		index_str = index;
1058 	} else {
1059 		/* For Solaris versioning, display a NULL string */
1060 		index_str = MSG_ORIG(MSG_STR_EMPTY);
1061 	}
1062 
1063 	for (cnt = 1; cnt <= vnd_num; cnt++,
1064 	    vnd = (Verneed *)((uintptr_t)vnd + vnd->vn_next)) {
1065 		const char	*name, *dep;
1066 		Half		vcnt = vnd->vn_cnt;
1067 		Vernaux *vnap = (Vernaux *)((uintptr_t)vnd + vnd->vn_aux);
1068 
1069 		/*
1070 		 * Obtain the name of the needed file and the version name
1071 		 * within it that we're dependent on.  Note that the count
1072 		 * should be at least one, otherwise this is a pretty bogus
1073 		 * entry.
1074 		 */
1075 		name = string(vcache, cnt, scache, file, vnd->vn_file);
1076 		if (vcnt)
1077 			dep = string(vcache, cnt, scache, file, vnap->vna_name);
1078 		else
1079 			dep = MSG_INTL(MSG_STR_NULL);
1080 
1081 		if (versym->gnu) {
1082 			/* Format the version index value */
1083 			(void) snprintf(index, MAXNDXSIZE,
1084 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(vnap->vna_other));
1085 			if (vnap->vna_other > versym->max_verndx)
1086 				versym->max_verndx = vnap->vna_other;
1087 		}
1088 		Elf_ver_line_1(0, index_str, name, dep,
1089 		    conv_ver_flags(vnap->vna_flags));
1090 
1091 		/*
1092 		 * Print any additional version dependencies.
1093 		 */
1094 		if (vcnt) {
1095 			vnap = (Vernaux *)((uintptr_t)vnap + vnap->vna_next);
1096 			for (vcnt--; vcnt; vcnt--,
1097 			    vnap = (Vernaux *)((uintptr_t)vnap +
1098 			    vnap->vna_next)) {
1099 				dep = string(vcache, cnt, scache, file,
1100 				    vnap->vna_name);
1101 				if (versym->gnu) {
1102 					/* Format the next index value */
1103 					(void) snprintf(index, MAXNDXSIZE,
1104 					    MSG_ORIG(MSG_FMT_INDEX),
1105 					    EC_XWORD(vnap->vna_other));
1106 					Elf_ver_line_1(0, index_str,
1107 					    MSG_ORIG(MSG_STR_EMPTY), dep,
1108 					    conv_ver_flags(vnap->vna_flags));
1109 					if (vnap->vna_other >
1110 					    versym->max_verndx)
1111 						versym->max_verndx =
1112 						    vnap->vna_other;
1113 				} else {
1114 					Elf_ver_line_3(0,
1115 					    MSG_ORIG(MSG_STR_EMPTY), dep,
1116 					    conv_ver_flags(vnap->vna_flags));
1117 				}
1118 			}
1119 		}
1120 	}
1121 }
1122 
1123 /*
1124  * Compute the max_verndx value for a GNU style object with
1125  * a Verneed section. This is only needed if version_need() is not
1126  * called.
1127  *
1128  * entry:
1129  *	vnd - Address of verneed data
1130  *	vnd_num - # of Verneed entries
1131  *	versym - Information about versym section
1132  *
1133  * exit:
1134  *	versym->max_verndx has been updated to contain the largest
1135  *	version index seen.
1136  */
1137 static void
1138 update_gnu_max_verndx(Verneed *vnd, Word vnd_num, VERSYM_STATE *versym)
1139 {
1140 	Word		cnt;
1141 
1142 	for (cnt = 1; cnt <= vnd_num; cnt++,
1143 	    vnd = (Verneed *)((uintptr_t)vnd + vnd->vn_next)) {
1144 		Half	vcnt = vnd->vn_cnt;
1145 		Vernaux	*vnap = (Vernaux *)((uintptr_t)vnd + vnd->vn_aux);
1146 
1147 		if (vnap->vna_other > versym->max_verndx)
1148 			versym->max_verndx = vnap->vna_other;
1149 
1150 		/*
1151 		 * Check any additional version dependencies.
1152 		 */
1153 		if (vcnt) {
1154 			vnap = (Vernaux *)((uintptr_t)vnap + vnap->vna_next);
1155 			for (vcnt--; vcnt; vcnt--,
1156 			    vnap = (Vernaux *)((uintptr_t)vnap +
1157 			    vnap->vna_next)) {
1158 				if (vnap->vna_other > versym->max_verndx)
1159 					versym->max_verndx = vnap->vna_other;
1160 			}
1161 		}
1162 	}
1163 }
1164 
1165 /*
1166  * Display version section information if the flags require it.
1167  * Return version information needed by other output.
1168  *
1169  * entry:
1170  *	cache - Cache of all section headers
1171  *	shnum - # of sections in cache
1172  *	file - Name of file
1173  *	flags - Command line option flags
1174  *	versym - VERSYM_STATE block to be filled in.
1175  */
1176 static void
1177 versions(Cache *cache, Word shnum, const char *file, uint_t flags,
1178     VERSYM_STATE *versym)
1179 {
1180 	GElf_Word	cnt;
1181 	Cache		*verdef_cache = NULL, *verneed_cache = NULL;
1182 
1183 
1184 	/* Gather information about the version sections */
1185 	bzero(versym, sizeof (*versym));
1186 	versym->max_verndx = 1;
1187 	for (cnt = 1; cnt < shnum; cnt++) {
1188 		Cache		*_cache = &cache[cnt];
1189 		Shdr		*shdr = _cache->c_shdr;
1190 		Dyn		*dyn;
1191 		ulong_t		numdyn;
1192 
1193 		switch (shdr->sh_type) {
1194 		case SHT_DYNAMIC:
1195 			/*
1196 			 * The GNU ld puts a DT_VERSYM entry in the dynamic
1197 			 * section so that the runtime linker can use it to
1198 			 * implement their versioning rules. They allow multiple
1199 			 * incompatible functions with the same name to exist
1200 			 * in different versions. The Solaris ld does not
1201 			 * support this mechanism, and as such, does not
1202 			 * produce DT_VERSYM. We use this fact to determine
1203 			 * which ld produced this object, and how to interpret
1204 			 * the version values.
1205 			 */
1206 			if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0) ||
1207 			    (_cache->c_data == NULL))
1208 				continue;
1209 			numdyn = shdr->sh_size / shdr->sh_entsize;
1210 			dyn = (Dyn *)_cache->c_data->d_buf;
1211 			for (; numdyn-- > 0; dyn++)
1212 				if (dyn->d_tag == DT_VERSYM) {
1213 					versym->gnu = 1;
1214 					break;
1215 				}
1216 			break;
1217 
1218 		case SHT_SUNW_versym:
1219 			/* Record data address for later symbol processing */
1220 			if (_cache->c_data != NULL) {
1221 				versym->cache = _cache;
1222 				versym->data = _cache->c_data->d_buf;
1223 				continue;
1224 			}
1225 			break;
1226 
1227 		case SHT_SUNW_verdef:
1228 		case SHT_SUNW_verneed:
1229 			/*
1230 			 * Ensure the data is non-NULL and the number
1231 			 * of items is non-zero. Otherwise, we don't
1232 			 * understand the section, and will not use it.
1233 			 */
1234 			if ((_cache->c_data == NULL) ||
1235 			    (_cache->c_data->d_buf == NULL)) {
1236 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1237 				    file, _cache->c_name);
1238 				continue;
1239 			}
1240 			if (shdr->sh_info == 0) {
1241 				(void) fprintf(stderr,
1242 				    MSG_INTL(MSG_ERR_BADSHINFO),
1243 				    file, _cache->c_name,
1244 				    EC_WORD(shdr->sh_info));
1245 				continue;
1246 			}
1247 
1248 			/* Make sure the string table index is in range */
1249 			if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
1250 				(void) fprintf(stderr,
1251 				    MSG_INTL(MSG_ERR_BADSHLINK), file,
1252 				    _cache->c_name, EC_WORD(shdr->sh_link));
1253 				continue;
1254 			}
1255 
1256 			/*
1257 			 * The section is usable. Save the cache entry.
1258 			 */
1259 			if (shdr->sh_type == SHT_SUNW_verdef) {
1260 				verdef_cache = _cache;
1261 				/*
1262 				 * Under Solaris rules, if there is a verdef
1263 				 * section, the max versym index is number
1264 				 * of version definitions it supplies.
1265 				 */
1266 				versym->max_verndx = shdr->sh_info;
1267 			} else {
1268 				verneed_cache = _cache;
1269 			}
1270 			break;
1271 		}
1272 	}
1273 
1274 	if ((flags & FLG_SHOW_VERSIONS) == 0) {
1275 		/*
1276 		 * If GNU versioning applies to this object, and there
1277 		 * is a Verneed section, then examine it to determine
1278 		 * the maximum Versym version index for this file.
1279 		 */
1280 		if ((versym->gnu) && (verneed_cache != NULL))
1281 			update_gnu_max_verndx(
1282 			    (Verneed *)verneed_cache->c_data->d_buf,
1283 			    verneed_cache->c_shdr->sh_info, versym);
1284 		return;
1285 	}
1286 
1287 	/*
1288 	 * Now that all the information is available, display the
1289 	 * Verdef and Verneed section contents.
1290 	 */
1291 	if (verdef_cache != NULL) {
1292 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1293 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_VERDEF),
1294 		    verdef_cache->c_name);
1295 		version_def((Verdef *)verdef_cache->c_data->d_buf,
1296 		    verdef_cache->c_shdr->sh_info, verdef_cache,
1297 		    &cache[verdef_cache->c_shdr->sh_link], file);
1298 	}
1299 	if (verneed_cache != NULL) {
1300 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1301 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_VERNEED),
1302 		    verneed_cache->c_name);
1303 		/*
1304 		 * If GNU versioning applies to this object, version_need()
1305 		 * will update versym->max_verndx, and it is not
1306 		 * necessary to call update_gnu_max_verndx().
1307 		 */
1308 		version_need((Verneed *)verneed_cache->c_data->d_buf,
1309 		    verneed_cache->c_shdr->sh_info, verneed_cache,
1310 		    &cache[verneed_cache->c_shdr->sh_link], file, versym);
1311 	}
1312 }
1313 
1314 /*
1315  * Initialize a symbol table state structure
1316  *
1317  * entry:
1318  *	state - State structure to be initialized
1319  *	cache - Cache of all section headers
1320  *	shnum - # of sections in cache
1321  *	secndx - Index of symbol table section
1322  *	ehdr - ELF header for file
1323  *	versym - Information about versym section
1324  *	file - Name of file
1325  *	flags - Command line option flags
1326  */
1327 static int
1328 init_symtbl_state(SYMTBL_STATE *state, Cache *cache, Word shnum, Word secndx,
1329     Ehdr *ehdr, VERSYM_STATE *versym, const char *file, uint_t flags)
1330 {
1331 	Shdr *shdr;
1332 
1333 	state->file = file;
1334 	state->ehdr = ehdr;
1335 	state->cache = cache;
1336 	state->shnum = shnum;
1337 	state->seccache = &cache[secndx];
1338 	state->secndx = secndx;
1339 	state->secname = state->seccache->c_name;
1340 	state->flags = flags;
1341 	state->shxndx.checked = 0;
1342 	state->shxndx.data = NULL;
1343 	state->shxndx.n = 0;
1344 
1345 	shdr = state->seccache->c_shdr;
1346 
1347 	/*
1348 	 * Check the symbol data and per-item size.
1349 	 */
1350 	if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
1351 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1352 		    file, state->secname);
1353 		return (0);
1354 	}
1355 	if (state->seccache->c_data == NULL)
1356 		return (0);
1357 
1358 	/* LINTED */
1359 	state->symn = (Word)(shdr->sh_size / shdr->sh_entsize);
1360 	state->sym = (Sym *)state->seccache->c_data->d_buf;
1361 
1362 	/*
1363 	 * Check associated string table section.
1364 	 */
1365 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
1366 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1367 		    file, state->secname, EC_WORD(shdr->sh_link));
1368 		return (0);
1369 	}
1370 
1371 	/*
1372 	 * Determine if there is a associated Versym section
1373 	 * with this Symbol Table.
1374 	 */
1375 	if (versym->cache &&
1376 	    (versym->cache->c_shdr->sh_link == state->secndx))
1377 		state->versym = versym;
1378 	else
1379 		state->versym = NULL;
1380 
1381 
1382 	return (1);
1383 }
1384 
1385 /*
1386  * Determine the extended section index used for symbol tables entries.
1387  */
1388 static void
1389 symbols_getxindex(SYMTBL_STATE * state)
1390 {
1391 	uint_t	symn;
1392 	Word	symcnt;
1393 
1394 	state->shxndx.checked = 1;   /* Note that we've been called */
1395 	for (symcnt = 1; symcnt < state->shnum; symcnt++) {
1396 		Cache	*_cache = &state->cache[symcnt];
1397 		Shdr	*shdr = _cache->c_shdr;
1398 
1399 		if ((shdr->sh_type != SHT_SYMTAB_SHNDX) ||
1400 		    (shdr->sh_link != state->secndx))
1401 			continue;
1402 
1403 		if ((shdr->sh_entsize) &&
1404 		    /* LINTED */
1405 		    ((symn = (uint_t)(shdr->sh_size / shdr->sh_entsize)) == 0))
1406 			continue;
1407 
1408 		if (_cache->c_data == NULL)
1409 			continue;
1410 
1411 		state->shxndx.data = _cache->c_data->d_buf;
1412 		state->shxndx.n = symn;
1413 		return;
1414 	}
1415 }
1416 
1417 /*
1418  * Produce a line of output for the given symbol
1419  *
1420  * entry:
1421  *	state - Symbol table state
1422  *	symndx - Index of symbol within the table
1423  *	info - Value of st_info (indicates local/global range)
1424  *	symndx_disp - Index to display. This may not be the same
1425  *		as symndx if the display is relative to the logical
1426  *		combination of the SUNW_ldynsym/dynsym tables.
1427  *	sym - Symbol to display
1428  */
1429 static void
1430 output_symbol(SYMTBL_STATE *state, Word symndx, Word info, Word disp_symndx,
1431     Sym *sym)
1432 {
1433 	/*
1434 	 * Symbol types for which we check that the specified
1435 	 * address/size land inside the target section.
1436 	 */
1437 	static const int addr_symtype[STT_NUM] = {
1438 		0,			/* STT_NOTYPE */
1439 		1,			/* STT_OBJECT */
1440 		1,			/* STT_FUNC */
1441 		0,			/* STT_SECTION */
1442 		0,			/* STT_FILE */
1443 		1,			/* STT_COMMON */
1444 		0,			/* STT_TLS */
1445 	};
1446 #if STT_NUM != (STT_TLS + 1)
1447 #error "STT_NUM has grown. Update addr_symtype[]"
1448 #endif
1449 
1450 	char		index[MAXNDXSIZE];
1451 	const char	*symname, *sec;
1452 	Versym		verndx;
1453 	int		gnuver;
1454 	uchar_t		type;
1455 	Shdr		*tshdr;
1456 	Word		shndx;
1457 	Conv_inv_buf_t	inv_buf;
1458 
1459 	/* Ensure symbol index is in range */
1460 	if (symndx >= state->symn) {
1461 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSORTNDX),
1462 		    state->file, state->secname, EC_WORD(symndx));
1463 		return;
1464 	}
1465 
1466 	/*
1467 	 * If we are using extended symbol indexes, find the
1468 	 * corresponding SHN_SYMTAB_SHNDX table.
1469 	 */
1470 	if ((sym->st_shndx == SHN_XINDEX) && (state->shxndx.checked == 0))
1471 		symbols_getxindex(state);
1472 
1473 	/* LINTED */
1474 	symname = string(state->seccache, symndx,
1475 	    &state->cache[state->seccache->c_shdr->sh_link], state->file,
1476 	    sym->st_name);
1477 
1478 	tshdr = 0;
1479 	sec = NULL;
1480 
1481 	if (state->ehdr->e_type == ET_CORE) {
1482 		sec = (char *)MSG_INTL(MSG_STR_UNKNOWN);
1483 	} else if (state->flags & FLG_CTL_FAKESHDR) {
1484 		/*
1485 		 * If we are using fake section headers derived from
1486 		 * the program headers, then the section indexes
1487 		 * in the symbols do not correspond to these headers.
1488 		 * The section names are not available, so all we can
1489 		 * do is to display them in numeric form.
1490 		 */
1491 		sec = conv_sym_shndx(sym->st_shndx, &inv_buf);
1492 	} else if ((sym->st_shndx < SHN_LORESERVE) &&
1493 	    (sym->st_shndx < state->shnum)) {
1494 		shndx = sym->st_shndx;
1495 		tshdr = state->cache[shndx].c_shdr;
1496 		sec = state->cache[shndx].c_name;
1497 	} else if (sym->st_shndx == SHN_XINDEX) {
1498 		if (state->shxndx.data) {
1499 			Word	_shxndx;
1500 
1501 			if (symndx > state->shxndx.n) {
1502 				(void) fprintf(stderr,
1503 				    MSG_INTL(MSG_ERR_BADSYMXINDEX1),
1504 				    state->file, state->secname,
1505 				    EC_WORD(symndx));
1506 			} else if ((_shxndx =
1507 			    state->shxndx.data[symndx]) > state->shnum) {
1508 				(void) fprintf(stderr,
1509 				    MSG_INTL(MSG_ERR_BADSYMXINDEX2),
1510 				    state->file, state->secname,
1511 				    EC_WORD(symndx), EC_WORD(_shxndx));
1512 			} else {
1513 				shndx = _shxndx;
1514 				tshdr = state->cache[shndx].c_shdr;
1515 				sec = state->cache[shndx].c_name;
1516 			}
1517 		} else {
1518 			(void) fprintf(stderr,
1519 			    MSG_INTL(MSG_ERR_BADSYMXINDEX3),
1520 			    state->file, state->secname, EC_WORD(symndx));
1521 		}
1522 	} else if ((sym->st_shndx < SHN_LORESERVE) &&
1523 	    (sym->st_shndx >= state->shnum)) {
1524 		(void) fprintf(stderr,
1525 		    MSG_INTL(MSG_ERR_BADSYM5), state->file,
1526 		    state->secname, demangle(symname, state->flags),
1527 		    sym->st_shndx);
1528 	}
1529 
1530 	/*
1531 	 * If versioning is available display the
1532 	 * version index. If not, then use 0.
1533 	 */
1534 	if (state->versym) {
1535 		Versym test_verndx;
1536 
1537 		verndx = test_verndx = state->versym->data[symndx];
1538 		gnuver = state->versym->gnu;
1539 
1540 		/*
1541 		 * Check to see if this is a defined symbol with a
1542 		 * version index that is outside the valid range for
1543 		 * the file. The interpretation of this depends on
1544 		 * the style of versioning used by the object.
1545 		 *
1546 		 * Versions >= VER_NDX_LORESERVE have special meanings,
1547 		 * and are exempt from this checking.
1548 		 *
1549 		 * GNU style version indexes use the top bit of the
1550 		 * 16-bit index value (0x8000) as the "hidden bit".
1551 		 * We must mask off this bit in order to compare
1552 		 * the version against the maximum value.
1553 		 */
1554 		if (gnuver)
1555 			test_verndx &= ~0x8000;
1556 
1557 		if ((test_verndx > state->versym->max_verndx) &&
1558 		    (verndx < VER_NDX_LORESERVE))
1559 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADVER),
1560 			    state->file, state->secname, EC_WORD(symndx),
1561 			    EC_HALF(test_verndx), state->versym->max_verndx);
1562 	} else {
1563 		verndx = 0;
1564 		gnuver = 0;
1565 	}
1566 
1567 	/*
1568 	 * Error checking for TLS.
1569 	 */
1570 	type = ELF_ST_TYPE(sym->st_info);
1571 	if (type == STT_TLS) {
1572 		if (tshdr &&
1573 		    (sym->st_shndx != SHN_UNDEF) &&
1574 		    ((tshdr->sh_flags & SHF_TLS) == 0)) {
1575 			(void) fprintf(stderr,
1576 			    MSG_INTL(MSG_ERR_BADSYM3), state->file,
1577 			    state->secname, demangle(symname, state->flags));
1578 		}
1579 	} else if ((type != STT_SECTION) && sym->st_size &&
1580 	    tshdr && (tshdr->sh_flags & SHF_TLS)) {
1581 		(void) fprintf(stderr,
1582 		    MSG_INTL(MSG_ERR_BADSYM4), state->file,
1583 		    state->secname, demangle(symname, state->flags));
1584 	}
1585 
1586 	/*
1587 	 * If a symbol with non-zero size has a type that
1588 	 * specifies an address, then make sure the location
1589 	 * it references is actually contained within the
1590 	 * section.  UNDEF symbols don't count in this case,
1591 	 * so we ignore them.
1592 	 *
1593 	 * The meaning of the st_value field in a symbol
1594 	 * depends on the type of object. For a relocatable
1595 	 * object, it is the offset within the section.
1596 	 * For sharable objects, it is the offset relative to
1597 	 * the base of the object, and for other types, it is
1598 	 * the virtual address. To get an offset within the
1599 	 * section for non-ET_REL files, we subtract the
1600 	 * base address of the section.
1601 	 */
1602 	if (addr_symtype[type] && (sym->st_size > 0) &&
1603 	    (sym->st_shndx != SHN_UNDEF) && ((sym->st_shndx < SHN_LORESERVE) ||
1604 	    (sym->st_shndx == SHN_XINDEX)) && (tshdr != NULL)) {
1605 		Word v = sym->st_value;
1606 			if (state->ehdr->e_type != ET_REL)
1607 				v -= tshdr->sh_addr;
1608 		if (((v + sym->st_size) > tshdr->sh_size)) {
1609 			(void) fprintf(stderr,
1610 			    MSG_INTL(MSG_ERR_BADSYM6), state->file,
1611 			    state->secname, demangle(symname, state->flags),
1612 			    EC_WORD(shndx), EC_XWORD(tshdr->sh_size),
1613 			    EC_XWORD(sym->st_value), EC_XWORD(sym->st_size));
1614 		}
1615 	}
1616 
1617 	/*
1618 	 * A typical symbol table uses the sh_info field to indicate one greater
1619 	 * than the symbol table index of the last local symbol, STB_LOCAL.
1620 	 * Therefore, symbol indexes less than sh_info should have local
1621 	 * binding.  Symbol indexes greater than, or equal to sh_info, should
1622 	 * have global binding.  Note, we exclude UNDEF/NOTY symbols with zero
1623 	 * value and size, as these symbols may be the result of an mcs(1)
1624 	 * section deletion.
1625 	 */
1626 	if (info) {
1627 		uchar_t	bind = ELF_ST_BIND(sym->st_info);
1628 
1629 		if ((symndx < info) && (bind != STB_LOCAL)) {
1630 			(void) fprintf(stderr,
1631 			    MSG_INTL(MSG_ERR_BADSYM7), state->file,
1632 			    state->secname, demangle(symname, state->flags),
1633 			    EC_XWORD(info));
1634 
1635 		} else if ((symndx >= info) && (bind == STB_LOCAL) &&
1636 		    ((sym->st_shndx != SHN_UNDEF) ||
1637 		    (ELF_ST_TYPE(sym->st_info) != STT_NOTYPE) ||
1638 		    (sym->st_size != 0) || (sym->st_value != 0))) {
1639 			(void) fprintf(stderr,
1640 			    MSG_INTL(MSG_ERR_BADSYM8), state->file,
1641 			    state->secname, demangle(symname, state->flags),
1642 			    EC_XWORD(info));
1643 		}
1644 	}
1645 
1646 	(void) snprintf(index, MAXNDXSIZE,
1647 	    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(disp_symndx));
1648 	Elf_syms_table_entry(0, ELF_DBG_ELFDUMP, index,
1649 	    state->ehdr->e_machine, sym, verndx, gnuver, sec, symname);
1650 }
1651 
1652 /*
1653  * Search for and process any symbol tables.
1654  */
1655 void
1656 symbols(Cache *cache, Word shnum, Ehdr *ehdr, VERSYM_STATE *versym,
1657     const char *file, uint_t flags)
1658 {
1659 	SYMTBL_STATE state;
1660 	Cache *_cache;
1661 	Word secndx;
1662 
1663 	for (secndx = 1; secndx < shnum; secndx++) {
1664 		Word		symcnt;
1665 		Shdr		*shdr;
1666 
1667 		_cache = &cache[secndx];
1668 		shdr = _cache->c_shdr;
1669 
1670 		if ((shdr->sh_type != SHT_SYMTAB) &&
1671 		    (shdr->sh_type != SHT_DYNSYM) &&
1672 		    (shdr->sh_type != SHT_SUNW_LDYNSYM))
1673 			continue;
1674 		if (!match(MATCH_F_ALL, _cache->c_name, secndx, shdr->sh_type))
1675 			continue;
1676 
1677 		if (!init_symtbl_state(&state, cache, shnum, secndx, ehdr,
1678 		    versym, file, flags))
1679 			continue;
1680 		/*
1681 		 * Loop through the symbol tables entries.
1682 		 */
1683 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1684 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMTAB), state.secname);
1685 		Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
1686 
1687 		for (symcnt = 0; symcnt < state.symn; symcnt++)
1688 			output_symbol(&state, symcnt, shdr->sh_info, symcnt,
1689 			    state.sym + symcnt);
1690 	}
1691 }
1692 
1693 /*
1694  * Search for and process any SHT_SUNW_symsort or SHT_SUNW_tlssort sections.
1695  * These sections are always associated with the .SUNW_ldynsym./.dynsym pair.
1696  */
1697 static void
1698 sunw_sort(Cache *cache, Word shnum, Ehdr *ehdr, VERSYM_STATE *versym,
1699     const char *file, uint_t flags)
1700 {
1701 	SYMTBL_STATE	ldynsym_state,	dynsym_state;
1702 	Cache		*sortcache,	*symcache;
1703 	Shdr		*sortshdr,	*symshdr;
1704 	Word		sortsecndx,	symsecndx;
1705 	Word		ldynsym_cnt;
1706 	Word		*ndx;
1707 	Word		ndxn;
1708 	int		output_cnt = 0;
1709 	Conv_inv_buf_t	inv_buf;
1710 
1711 	for (sortsecndx = 1; sortsecndx < shnum; sortsecndx++) {
1712 
1713 		sortcache = &cache[sortsecndx];
1714 		sortshdr = sortcache->c_shdr;
1715 
1716 		if ((sortshdr->sh_type != SHT_SUNW_symsort) &&
1717 		    (sortshdr->sh_type != SHT_SUNW_tlssort))
1718 			continue;
1719 		if (!match(MATCH_F_ALL, sortcache->c_name, sortsecndx,
1720 		    sortshdr->sh_type))
1721 			continue;
1722 
1723 		/*
1724 		 * If the section references a SUNW_ldynsym, then we
1725 		 * expect to see the associated .dynsym immediately
1726 		 * following. If it references a .dynsym, there is no
1727 		 * SUNW_ldynsym. If it is any other type, then we don't
1728 		 * know what to do with it.
1729 		 */
1730 		if ((sortshdr->sh_link == 0) || (sortshdr->sh_link >= shnum)) {
1731 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1732 			    file, sortcache->c_name,
1733 			    EC_WORD(sortshdr->sh_link));
1734 			continue;
1735 		}
1736 		symcache = &cache[sortshdr->sh_link];
1737 		symshdr = symcache->c_shdr;
1738 		symsecndx = sortshdr->sh_link;
1739 		ldynsym_cnt = 0;
1740 		switch (symshdr->sh_type) {
1741 		case SHT_SUNW_LDYNSYM:
1742 			if (!init_symtbl_state(&ldynsym_state, cache, shnum,
1743 			    symsecndx, ehdr, versym, file, flags))
1744 				continue;
1745 			ldynsym_cnt = ldynsym_state.symn;
1746 			/*
1747 			 * We know that the dynsym follows immediately
1748 			 * after the SUNW_ldynsym, and so, should be at
1749 			 * (sortshdr->sh_link + 1). However, elfdump is a
1750 			 * diagnostic tool, so we do the full paranoid
1751 			 * search instead.
1752 			 */
1753 			for (symsecndx = 1; symsecndx < shnum; symsecndx++) {
1754 				symcache = &cache[symsecndx];
1755 				symshdr = symcache->c_shdr;
1756 				if (symshdr->sh_type == SHT_DYNSYM)
1757 					break;
1758 			}
1759 			if (symsecndx >= shnum) {	/* Dynsym not found! */
1760 				(void) fprintf(stderr,
1761 				    MSG_INTL(MSG_ERR_NODYNSYM),
1762 				    file, sortcache->c_name);
1763 				continue;
1764 			}
1765 			/* Fallthrough to process associated dynsym */
1766 			/*FALLTHROUGH*/
1767 		case SHT_DYNSYM:
1768 			if (!init_symtbl_state(&dynsym_state, cache, shnum,
1769 			    symsecndx, ehdr, versym, file, flags))
1770 				continue;
1771 			break;
1772 		default:
1773 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADNDXSEC),
1774 			    file, sortcache->c_name, conv_sec_type(
1775 			    ehdr->e_machine, symshdr->sh_type, 0, &inv_buf));
1776 			continue;
1777 		}
1778 
1779 		/*
1780 		 * Output header
1781 		 */
1782 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1783 		if (ldynsym_cnt > 0) {
1784 			dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMSORT2),
1785 			    sortcache->c_name, ldynsym_state.secname,
1786 			    dynsym_state.secname);
1787 			/*
1788 			 * The data for .SUNW_ldynsym and dynsym sections
1789 			 * is supposed to be adjacent with SUNW_ldynsym coming
1790 			 * first. Check, and issue a warning if it isn't so.
1791 			 */
1792 			if (((ldynsym_state.sym + ldynsym_state.symn)
1793 			    != dynsym_state.sym) &&
1794 			    ((flags & FLG_CTL_FAKESHDR) == 0))
1795 				(void) fprintf(stderr,
1796 				    MSG_INTL(MSG_ERR_LDYNNOTADJ), file,
1797 				    ldynsym_state.secname,
1798 				    dynsym_state.secname);
1799 		} else {
1800 			dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMSORT1),
1801 			    sortcache->c_name, dynsym_state.secname);
1802 		}
1803 		Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
1804 
1805 		/* If not first one, insert a line of whitespace */
1806 		if (output_cnt++ > 0)
1807 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1808 
1809 		/*
1810 		 * SUNW_dynsymsort and SUNW_dyntlssort are arrays of
1811 		 * symbol indices. Iterate over the array entries,
1812 		 * dispaying the referenced symbols.
1813 		 */
1814 		ndxn = sortshdr->sh_size / sortshdr->sh_entsize;
1815 		ndx = (Word *)sortcache->c_data->d_buf;
1816 		for (; ndxn-- > 0; ndx++) {
1817 			if (*ndx >= ldynsym_cnt) {
1818 				Word sec_ndx = *ndx - ldynsym_cnt;
1819 
1820 				output_symbol(&dynsym_state, sec_ndx, 0,
1821 				    *ndx, dynsym_state.sym + sec_ndx);
1822 			} else {
1823 				output_symbol(&ldynsym_state, *ndx, 0,
1824 				    *ndx, ldynsym_state.sym + *ndx);
1825 			}
1826 		}
1827 	}
1828 }
1829 
1830 /*
1831  * Search for and process any relocation sections.
1832  */
1833 static void
1834 reloc(Cache *cache, Word shnum, Ehdr *ehdr, const char *file,
1835     uint_t flags)
1836 {
1837 	Word	cnt;
1838 
1839 	for (cnt = 1; cnt < shnum; cnt++) {
1840 		Word		type, symnum;
1841 		Xword		relndx, relnum, relsize;
1842 		void		*rels;
1843 		Sym		*syms;
1844 		Cache		*symsec, *strsec;
1845 		Cache		*_cache = &cache[cnt];
1846 		Shdr		*shdr = _cache->c_shdr;
1847 		char		*relname = _cache->c_name;
1848 		Conv_inv_buf_t	inv_buf;
1849 
1850 		if (((type = shdr->sh_type) != SHT_RELA) &&
1851 		    (type != SHT_REL))
1852 			continue;
1853 		if (!match(MATCH_F_ALL, relname, cnt, type))
1854 			continue;
1855 
1856 		/*
1857 		 * Decide entry size.
1858 		 */
1859 		if (((relsize = shdr->sh_entsize) == 0) ||
1860 		    (relsize > shdr->sh_size)) {
1861 			if (type == SHT_RELA)
1862 				relsize = sizeof (Rela);
1863 			else
1864 				relsize = sizeof (Rel);
1865 		}
1866 
1867 		/*
1868 		 * Determine the number of relocations available.
1869 		 */
1870 		if (shdr->sh_size == 0) {
1871 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1872 			    file, relname);
1873 			continue;
1874 		}
1875 		if (_cache->c_data == NULL)
1876 			continue;
1877 
1878 		rels = _cache->c_data->d_buf;
1879 		relnum = shdr->sh_size / relsize;
1880 
1881 		/*
1882 		 * Get the data buffer for the associated symbol table and
1883 		 * string table.
1884 		 */
1885 		if (stringtbl(cache, 1, cnt, shnum, file,
1886 		    &symnum, &symsec, &strsec) == 0)
1887 			continue;
1888 
1889 		syms = symsec->c_data->d_buf;
1890 
1891 		/*
1892 		 * Loop through the relocation entries.
1893 		 */
1894 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1895 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_RELOC), _cache->c_name);
1896 		Elf_reloc_title(0, ELF_DBG_ELFDUMP, type);
1897 
1898 		for (relndx = 0; relndx < relnum; relndx++,
1899 		    rels = (void *)((char *)rels + relsize)) {
1900 			char		section[BUFSIZ];
1901 			const char	*symname;
1902 			Word		symndx, reltype;
1903 			Rela		*rela;
1904 			Rel		*rel;
1905 
1906 			/*
1907 			 * Unravel the relocation and determine the symbol with
1908 			 * which this relocation is associated.
1909 			 */
1910 			if (type == SHT_RELA) {
1911 				rela = (Rela *)rels;
1912 				symndx = ELF_R_SYM(rela->r_info);
1913 				reltype = ELF_R_TYPE(rela->r_info);
1914 			} else {
1915 				rel = (Rel *)rels;
1916 				symndx = ELF_R_SYM(rel->r_info);
1917 				reltype = ELF_R_TYPE(rel->r_info);
1918 			}
1919 
1920 			symname = relsymname(cache, _cache, strsec, symndx,
1921 			    symnum, relndx, syms, section, BUFSIZ, file,
1922 			    flags);
1923 
1924 			/*
1925 			 * A zero symbol index is only valid for a few
1926 			 * relocations.
1927 			 */
1928 			if (symndx == 0) {
1929 				Half	mach = ehdr->e_machine;
1930 				int	badrel = 0;
1931 
1932 				if ((mach == EM_SPARC) ||
1933 				    (mach == EM_SPARC32PLUS) ||
1934 				    (mach == EM_SPARCV9)) {
1935 					if ((reltype != R_SPARC_NONE) &&
1936 					    (reltype != R_SPARC_REGISTER) &&
1937 					    (reltype != R_SPARC_RELATIVE))
1938 						badrel++;
1939 				} else if (mach == EM_386) {
1940 					if ((reltype != R_386_NONE) &&
1941 					    (reltype != R_386_RELATIVE))
1942 						badrel++;
1943 				} else if (mach == EM_AMD64) {
1944 					if ((reltype != R_AMD64_NONE) &&
1945 					    (reltype != R_AMD64_RELATIVE))
1946 						badrel++;
1947 				}
1948 
1949 				if (badrel) {
1950 					(void) fprintf(stderr,
1951 					    MSG_INTL(MSG_ERR_BADREL1), file,
1952 					    conv_reloc_type(mach, reltype,
1953 					    0, &inv_buf));
1954 				}
1955 			}
1956 
1957 			Elf_reloc_entry_1(0, ELF_DBG_ELFDUMP,
1958 			    MSG_ORIG(MSG_STR_EMPTY), ehdr->e_machine, type,
1959 			    rels, relname, symname, 0);
1960 		}
1961 	}
1962 }
1963 
1964 
1965 /*
1966  * This value controls which test dyn_test() performs.
1967  */
1968 typedef enum { DYN_TEST_ADDR, DYN_TEST_SIZE, DYN_TEST_ENTSIZE } dyn_test_t;
1969 
1970 /*
1971  * Used by dynamic() to compare the value of a dynamic element against
1972  * the starting address of the section it references.
1973  *
1974  * entry:
1975  *	test_type - Specify which dyn item is being tested.
1976  *	sh_type - SHT_* type value for required section.
1977  *	sec_cache - Cache entry for section, or NULL if the object lacks
1978  *		a section of this type.
1979  *	dyn - Dyn entry to be tested
1980  *	dynsec_cnt - # of dynamic section being examined. The first
1981  *		dynamic section is 1, the next is 2, and so on...
1982  *	ehdr - ELF header for file
1983  *	file - Name of file
1984  */
1985 static void
1986 dyn_test(dyn_test_t test_type, Word sh_type, Cache *sec_cache, Dyn *dyn,
1987     Word dynsec_cnt, Ehdr *ehdr, const char *file)
1988 {
1989 	Conv_inv_buf_t	buf1, buf2;
1990 
1991 	/*
1992 	 * These tests are based around the implicit assumption that
1993 	 * there is only one dynamic section in an object, and also only
1994 	 * one of the sections it references. We have therefore gathered
1995 	 * all of the necessary information to test this in a single pass
1996 	 * over the section headers, which is very efficient. We are not
1997 	 * aware of any case where more than one dynamic section would
1998 	 * be meaningful in an ELF object, so this is a reasonable solution.
1999 	 *
2000 	 * To test multiple dynamic sections correctly would be more
2001 	 * expensive in code and time. We would have to build a data structure
2002 	 * containing all the dynamic elements. Then, we would use the address
2003 	 * to locate the section it references and ensure the section is of
2004 	 * the right type and that the address in the dynamic element is
2005 	 * to the start of the section. Then, we could check the size and
2006 	 * entsize values against those same sections. This is O(n^2), and
2007 	 * also complicated.
2008 	 *
2009 	 * In the highly unlikely case that there is more than one dynamic
2010 	 * section, we only test the first one, and simply allow the values
2011 	 * of the subsequent one to be displayed unchallenged.
2012 	 */
2013 	if (dynsec_cnt != 1)
2014 		return;
2015 
2016 	/*
2017 	 * A DT_ item that references a section address should always find
2018 	 * the section in the file.
2019 	 */
2020 	if (sec_cache == NULL) {
2021 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_DYNNOBCKSEC), file,
2022 		    conv_sec_type(ehdr->e_machine, sh_type, 0, &buf1),
2023 		    conv_dyn_tag(dyn->d_tag, ehdr->e_machine, 0, &buf2));
2024 		return;
2025 	}
2026 
2027 
2028 	switch (test_type) {
2029 	case DYN_TEST_ADDR:
2030 		/* The section address should match the DT_ item value */
2031 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_addr)
2032 			(void) fprintf(stderr,
2033 			    MSG_INTL(MSG_ERR_DYNBADADDR), file,
2034 			    conv_dyn_tag(dyn->d_tag, ehdr->e_machine, 0, &buf1),
2035 			    EC_ADDR(dyn->d_un.d_val), sec_cache->c_ndx,
2036 			    sec_cache->c_name,
2037 			    EC_ADDR(sec_cache->c_shdr->sh_addr));
2038 		break;
2039 
2040 	case DYN_TEST_SIZE:
2041 		/* The section size should match the DT_ item value */
2042 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_size)
2043 			(void) fprintf(stderr,
2044 			    MSG_INTL(MSG_ERR_DYNBADSIZE), file,
2045 			    conv_dyn_tag(dyn->d_tag, ehdr->e_machine, 0, &buf1),
2046 			    EC_XWORD(dyn->d_un.d_val),
2047 			    sec_cache->c_ndx, sec_cache->c_name,
2048 			    EC_XWORD(sec_cache->c_shdr->sh_size));
2049 		break;
2050 
2051 	case DYN_TEST_ENTSIZE:
2052 		/* The sh_entsize value should match the DT_ item value */
2053 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_entsize)
2054 			(void) fprintf(stderr,
2055 			    MSG_INTL(MSG_ERR_DYNBADENTSIZE), file,
2056 			    conv_dyn_tag(dyn->d_tag, ehdr->e_machine, 0, &buf1),
2057 			    EC_XWORD(dyn->d_un.d_val),
2058 			    sec_cache->c_ndx, sec_cache->c_name,
2059 			    EC_XWORD(sec_cache->c_shdr->sh_entsize));
2060 		break;
2061 	}
2062 }
2063 
2064 
2065 /*
2066  * Search for and process a .dynamic section.
2067  */
2068 static void
2069 dynamic(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
2070 {
2071 	struct {
2072 		Cache	*dynstr;
2073 		Cache	*dynsym;
2074 		Cache	*hash;
2075 		Cache	*fini;
2076 		Cache	*fini_array;
2077 		Cache	*init;
2078 		Cache	*init_array;
2079 		Cache	*preinit_array;
2080 		Cache	*rel;
2081 		Cache	*rela;
2082 		Cache	*sunw_cap;
2083 		Cache	*sunw_ldynsym;
2084 		Cache	*sunw_move;
2085 		Cache	*sunw_syminfo;
2086 		Cache	*sunw_symsort;
2087 		Cache	*sunw_tlssort;
2088 		Cache	*sunw_verdef;
2089 		Cache	*sunw_verneed;
2090 		Cache	*sunw_versym;
2091 	} sec;
2092 	Word	dynsec_ndx;
2093 	Word	dynsec_num;
2094 	int	dynsec_cnt;
2095 	Word	cnt;
2096 
2097 	/*
2098 	 * Make a pass over all the sections, gathering section information
2099 	 * we'll need below.
2100 	 */
2101 	dynsec_num = 0;
2102 	bzero(&sec, sizeof (sec));
2103 	for (cnt = 1; cnt < shnum; cnt++) {
2104 		Cache	*_cache = &cache[cnt];
2105 
2106 		switch (_cache->c_shdr->sh_type) {
2107 		case SHT_DYNAMIC:
2108 			if (dynsec_num == 0) {
2109 				dynsec_ndx = cnt;
2110 
2111 				/* Does it have a valid string table? */
2112 				(void) stringtbl(cache, 0, cnt, shnum, file,
2113 				    0, 0, &sec.dynstr);
2114 			}
2115 			dynsec_num++;
2116 			break;
2117 
2118 
2119 		case SHT_PROGBITS:
2120 			/*
2121 			 * We want to detect the .init and .fini sections,
2122 			 * if present. These are SHT_PROGBITS, so all we
2123 			 * have to go on is the section name. Normally comparing
2124 			 * names is a bad idea, but there are some special
2125 			 * names (i.e. .init/.fini/.interp) that are very
2126 			 * difficult to use in any other context, and for
2127 			 * these symbols, we do the heuristic match.
2128 			 */
2129 			if (strcmp(_cache->c_name,
2130 			    MSG_ORIG(MSG_ELF_INIT)) == 0) {
2131 				if (sec.init == NULL)
2132 					sec.init = _cache;
2133 			} else if (strcmp(_cache->c_name,
2134 			    MSG_ORIG(MSG_ELF_FINI)) == 0) {
2135 				if (sec.fini == NULL)
2136 					sec.fini = _cache;
2137 			}
2138 			break;
2139 
2140 		case SHT_REL:
2141 			/*
2142 			 * We want the SHT_REL section with the lowest
2143 			 * offset. The linker gathers them together,
2144 			 * and puts the address of the first one
2145 			 * into the DT_REL dynamic element.
2146 			 */
2147 			if ((sec.rel == NULL) ||
2148 			    (_cache->c_shdr->sh_offset <
2149 			    sec.rel->c_shdr->sh_offset))
2150 				sec.rel = _cache;
2151 			break;
2152 
2153 		case SHT_RELA:
2154 			/* RELA is handled just like RELA above */
2155 			if ((sec.rela == NULL) ||
2156 			    (_cache->c_shdr->sh_offset <
2157 			    sec.rela->c_shdr->sh_offset))
2158 				sec.rela = _cache;
2159 			break;
2160 
2161 		/*
2162 		 * The GRAB macro is used for the simple case in which
2163 		 * we simply grab the first section of the desired type.
2164 		 */
2165 #define	GRAB(_sec_type, _sec_field) \
2166 		case _sec_type: \
2167 			if (sec._sec_field == NULL) \
2168 				sec._sec_field = _cache; \
2169 				break
2170 		GRAB(SHT_DYNSYM,	dynsym);
2171 		GRAB(SHT_FINI_ARRAY,	fini_array);
2172 		GRAB(SHT_HASH,		hash);
2173 		GRAB(SHT_INIT_ARRAY,	init_array);
2174 		GRAB(SHT_SUNW_move,	sunw_move);
2175 		GRAB(SHT_PREINIT_ARRAY,	preinit_array);
2176 		GRAB(SHT_SUNW_cap,	sunw_cap);
2177 		GRAB(SHT_SUNW_LDYNSYM,	sunw_ldynsym);
2178 		GRAB(SHT_SUNW_syminfo,	sunw_syminfo);
2179 		GRAB(SHT_SUNW_symsort,	sunw_symsort);
2180 		GRAB(SHT_SUNW_tlssort,	sunw_tlssort);
2181 		GRAB(SHT_SUNW_verdef,	sunw_verdef);
2182 		GRAB(SHT_SUNW_verneed,	sunw_verneed);
2183 		GRAB(SHT_SUNW_versym,	sunw_versym);
2184 #undef GRAB
2185 		}
2186 	}
2187 
2188 	/*
2189 	 * If no dynamic section, return immediately. If more than one
2190 	 * dynamic section, then something odd is going on and an error
2191 	 * is in order, but then continue on and display them all.
2192 	 */
2193 	if (dynsec_num == 0)
2194 		return;
2195 	if (dynsec_num > 1)
2196 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MULTDYN),
2197 		    file, EC_WORD(dynsec_num));
2198 
2199 
2200 	dynsec_cnt = 0;
2201 	for (cnt = dynsec_ndx; (cnt < shnum) && (dynsec_cnt < dynsec_num);
2202 	    cnt++) {
2203 		Dyn	*dyn;
2204 		ulong_t	numdyn;
2205 		int	ndx, end_ndx;
2206 		Cache	*_cache = &cache[cnt], *strsec;
2207 		Shdr	*shdr = _cache->c_shdr;
2208 		int	dumped = 0;
2209 
2210 		if (shdr->sh_type != SHT_DYNAMIC)
2211 			continue;
2212 		dynsec_cnt++;
2213 
2214 		/*
2215 		 * Verify the associated string table section.
2216 		 */
2217 		if (stringtbl(cache, 0, cnt, shnum, file, 0, 0, &strsec) == 0)
2218 			continue;
2219 
2220 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
2221 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2222 			    file, _cache->c_name);
2223 			continue;
2224 		}
2225 		if (_cache->c_data == NULL)
2226 			continue;
2227 
2228 		numdyn = shdr->sh_size / shdr->sh_entsize;
2229 		dyn = (Dyn *)_cache->c_data->d_buf;
2230 
2231 		/*
2232 		 * We expect the REL/RELA entries to reference the reloc
2233 		 * section with the lowest address. However, this is
2234 		 * not true for dumped objects. Detect if this object has
2235 		 * been dumped so that we can skip the reloc address test
2236 		 * in that case.
2237 		 */
2238 		for (ndx = 0; ndx < numdyn; dyn++, ndx++) {
2239 			if (dyn->d_tag == DT_FLAGS_1) {
2240 				dumped = (dyn->d_un.d_val & DF_1_CONFALT) != 0;
2241 				break;
2242 			}
2243 		}
2244 		dyn = (Dyn *)_cache->c_data->d_buf;
2245 
2246 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2247 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_DYNAMIC), _cache->c_name);
2248 
2249 		Elf_dyn_title(0);
2250 
2251 		for (ndx = 0; ndx < numdyn; dyn++, ndx++) {
2252 			union {
2253 				Conv_dyn_flag_buf_t	flag;
2254 				Conv_dyn_flag1_buf_t	flag1;
2255 				Conv_dyn_posflag1_buf_t	posflag1;
2256 				Conv_dyn_feature1_buf_t	feature1;
2257 			} c_buf;
2258 			const char	*name = NULL;
2259 
2260 			/*
2261 			 * Print the information numerically, and if possible
2262 			 * as a string. If a string is available, name is
2263 			 * set to reference it.
2264 			 *
2265 			 * Also, take this opportunity to sanity check
2266 			 * the values of DT elements. In the code above,
2267 			 * we gathered information on sections that are
2268 			 * referenced by the dynamic section. Here, we
2269 			 * compare the attributes of those sections to
2270 			 * the DT_ items that reference them and report
2271 			 * on inconsistencies.
2272 			 *
2273 			 * Things not currently tested that could be improved
2274 			 * in later revisions include:
2275 			 *	- We don't check PLT or GOT related items
2276 			 *	- We don't handle computing the lengths of
2277 			 *		relocation arrays. To handle this
2278 			 *		requires examining data that spans
2279 			 *		across sections, in a contiguous span
2280 			 *		within a single segment.
2281 			 *	- DT_VERDEFNUM and DT_VERNEEDNUM can't be
2282 			 *		verified without parsing the sections.
2283 			 *	- We don't handle DT_SUNW_SYMSZ, which would
2284 			 *		be the sum of the lengths of .dynsym and
2285 			 *		.SUNW_ldynsym
2286 			 *	- DT_SUNW_STRPAD can't be verified other than
2287 			 *		to check that it's not larger than
2288 			 *		the string table.
2289 			 *	- Some items come in "all or none" clusters
2290 			 *		that give an address, element size,
2291 			 *		and data length in bytes. We don't
2292 			 *		verify that there are no missing items
2293 			 *		in such groups.
2294 			 */
2295 			switch (dyn->d_tag) {
2296 			case DT_NULL:
2297 				/*
2298 				 * Special case: DT_NULLs can come in groups
2299 				 * that we prefer to reduce to a single line.
2300 				 */
2301 				end_ndx = ndx;
2302 				while ((end_ndx < (numdyn - 1)) &&
2303 				    ((dyn + 1)->d_tag == DT_NULL)) {
2304 					dyn++;
2305 					end_ndx++;
2306 				}
2307 				Elf_dyn_null_entry(0, dyn, ndx, end_ndx);
2308 				ndx = end_ndx;
2309 				continue;
2310 
2311 			/*
2312 			 * String items all reference the dynstr. The string()
2313 			 * function does the necessary sanity checking.
2314 			 */
2315 			case DT_NEEDED:
2316 			case DT_SONAME:
2317 			case DT_FILTER:
2318 			case DT_AUXILIARY:
2319 			case DT_CONFIG:
2320 			case DT_RPATH:
2321 			case DT_RUNPATH:
2322 			case DT_USED:
2323 			case DT_DEPAUDIT:
2324 			case DT_AUDIT:
2325 			case DT_SUNW_AUXILIARY:
2326 			case DT_SUNW_FILTER:
2327 				name = string(_cache, ndx, strsec,
2328 				    file, dyn->d_un.d_ptr);
2329 				break;
2330 
2331 			case DT_FLAGS:
2332 				name = conv_dyn_flag(dyn->d_un.d_val,
2333 				    0, &c_buf.flag);
2334 				break;
2335 			case DT_FLAGS_1:
2336 				name = conv_dyn_flag1(dyn->d_un.d_val, 0,
2337 				    &c_buf.flag1);
2338 				break;
2339 			case DT_POSFLAG_1:
2340 				name = conv_dyn_posflag1(dyn->d_un.d_val, 0,
2341 				    &c_buf.posflag1);
2342 				break;
2343 			case DT_FEATURE_1:
2344 				name = conv_dyn_feature1(dyn->d_un.d_val, 0,
2345 				    &c_buf.feature1);
2346 				break;
2347 			case DT_DEPRECATED_SPARC_REGISTER:
2348 				name = MSG_INTL(MSG_STR_DEPRECATED);
2349 				break;
2350 
2351 			/*
2352 			 * Cases below this point are strictly sanity checking,
2353 			 * and do not generate a name string. The TEST_ macros
2354 			 * are used to hide the boilerplate arguments neeeded
2355 			 * by dyn_test().
2356 			 */
2357 #define	TEST_ADDR(_sh_type, _sec_field) \
2358 				dyn_test(DYN_TEST_ADDR, _sh_type, \
2359 				    sec._sec_field, dyn, dynsec_cnt, ehdr, file)
2360 #define	TEST_SIZE(_sh_type, _sec_field) \
2361 				dyn_test(DYN_TEST_SIZE, _sh_type, \
2362 				    sec._sec_field, dyn, dynsec_cnt, ehdr, file)
2363 #define	TEST_ENTSIZE(_sh_type, _sec_field) \
2364 				dyn_test(DYN_TEST_ENTSIZE, _sh_type, \
2365 				    sec._sec_field, dyn, dynsec_cnt, ehdr, file)
2366 
2367 			case DT_FINI:
2368 				TEST_ADDR(SHT_PROGBITS, fini);
2369 				break;
2370 
2371 			case DT_FINI_ARRAY:
2372 				TEST_ADDR(SHT_FINI_ARRAY, fini_array);
2373 				break;
2374 
2375 			case DT_FINI_ARRAYSZ:
2376 				TEST_SIZE(SHT_FINI_ARRAY, fini_array);
2377 				break;
2378 
2379 			case DT_HASH:
2380 				TEST_ADDR(SHT_HASH, hash);
2381 				break;
2382 
2383 			case DT_INIT:
2384 				TEST_ADDR(SHT_PROGBITS, init);
2385 				break;
2386 
2387 			case DT_INIT_ARRAY:
2388 				TEST_ADDR(SHT_INIT_ARRAY, init_array);
2389 				break;
2390 
2391 			case DT_INIT_ARRAYSZ:
2392 				TEST_SIZE(SHT_INIT_ARRAY, init_array);
2393 				break;
2394 
2395 			case DT_MOVEENT:
2396 				TEST_ENTSIZE(SHT_SUNW_move, sunw_move);
2397 				break;
2398 
2399 			case DT_MOVESZ:
2400 				TEST_SIZE(SHT_SUNW_move, sunw_move);
2401 				break;
2402 
2403 			case DT_MOVETAB:
2404 				TEST_ADDR(SHT_SUNW_move, sunw_move);
2405 				break;
2406 
2407 			case DT_PREINIT_ARRAY:
2408 				TEST_ADDR(SHT_PREINIT_ARRAY, preinit_array);
2409 				break;
2410 
2411 			case DT_PREINIT_ARRAYSZ:
2412 				TEST_SIZE(SHT_PREINIT_ARRAY, preinit_array);
2413 				break;
2414 
2415 			case DT_REL:
2416 				if (!dumped)
2417 					TEST_ADDR(SHT_REL, rel);
2418 				break;
2419 
2420 			case DT_RELENT:
2421 				TEST_ENTSIZE(SHT_REL, rel);
2422 				break;
2423 
2424 			case DT_RELA:
2425 				if (!dumped)
2426 					TEST_ADDR(SHT_RELA, rela);
2427 				break;
2428 
2429 			case DT_RELAENT:
2430 				TEST_ENTSIZE(SHT_RELA, rela);
2431 				break;
2432 
2433 			case DT_STRTAB:
2434 				TEST_ADDR(SHT_STRTAB, dynstr);
2435 				break;
2436 
2437 			case DT_STRSZ:
2438 				TEST_SIZE(SHT_STRTAB, dynstr);
2439 				break;
2440 
2441 			case DT_SUNW_CAP:
2442 				TEST_ADDR(SHT_SUNW_cap, sunw_cap);
2443 				break;
2444 
2445 			case DT_SUNW_SYMTAB:
2446 				TEST_ADDR(SHT_SUNW_LDYNSYM, sunw_ldynsym);
2447 				break;
2448 
2449 			case DT_SYMENT:
2450 				TEST_ENTSIZE(SHT_DYNSYM, dynsym);
2451 				break;
2452 
2453 			case DT_SYMINENT:
2454 				TEST_ENTSIZE(SHT_SUNW_syminfo, sunw_syminfo);
2455 				break;
2456 
2457 			case DT_SYMINFO:
2458 				TEST_ADDR(SHT_SUNW_syminfo, sunw_syminfo);
2459 				break;
2460 
2461 			case DT_SYMINSZ:
2462 				TEST_SIZE(SHT_SUNW_syminfo, sunw_syminfo);
2463 				break;
2464 
2465 			case DT_SYMTAB:
2466 				TEST_ADDR(SHT_DYNSYM, dynsym);
2467 				break;
2468 
2469 			case DT_SUNW_SORTENT:
2470 				/*
2471 				 * This entry is related to both the symsort and
2472 				 * tlssort sections.
2473 				 */
2474 				{
2475 					int test_tls =
2476 					    (sec.sunw_tlssort != NULL);
2477 					int test_sym =
2478 					    (sec.sunw_symsort != NULL) ||
2479 					    !test_tls;
2480 					if (test_sym)
2481 						TEST_ENTSIZE(SHT_SUNW_symsort,
2482 						    sunw_symsort);
2483 					if (test_tls)
2484 						TEST_ENTSIZE(SHT_SUNW_tlssort,
2485 						    sunw_tlssort);
2486 				}
2487 				break;
2488 
2489 
2490 			case DT_SUNW_SYMSORT:
2491 				TEST_ADDR(SHT_SUNW_symsort, sunw_symsort);
2492 				break;
2493 
2494 			case DT_SUNW_SYMSORTSZ:
2495 				TEST_SIZE(SHT_SUNW_symsort, sunw_symsort);
2496 				break;
2497 
2498 			case DT_SUNW_TLSSORT:
2499 				TEST_ADDR(SHT_SUNW_tlssort, sunw_tlssort);
2500 				break;
2501 
2502 			case DT_SUNW_TLSSORTSZ:
2503 				TEST_SIZE(SHT_SUNW_tlssort, sunw_tlssort);
2504 				break;
2505 
2506 			case DT_VERDEF:
2507 				TEST_ADDR(SHT_SUNW_verdef, sunw_verdef);
2508 				break;
2509 
2510 			case DT_VERNEED:
2511 				TEST_ADDR(SHT_SUNW_verneed, sunw_verneed);
2512 				break;
2513 
2514 			case DT_VERSYM:
2515 				TEST_ADDR(SHT_SUNW_versym, sunw_versym);
2516 				break;
2517 #undef TEST_ADDR
2518 #undef TEST_SIZE
2519 #undef TEST_ENTSIZE
2520 			}
2521 
2522 			if (name == NULL)
2523 				name = MSG_ORIG(MSG_STR_EMPTY);
2524 			Elf_dyn_entry(0, dyn, ndx, name, ehdr->e_machine);
2525 		}
2526 	}
2527 }
2528 
2529 /*
2530  * Search for and process a MOVE section.
2531  */
2532 static void
2533 move(Cache *cache, Word shnum, const char *file, uint_t flags)
2534 {
2535 	Word		cnt;
2536 	const char	*fmt = 0;
2537 
2538 	for (cnt = 1; cnt < shnum; cnt++) {
2539 		Word	movenum, symnum, ndx;
2540 		Sym	*syms;
2541 		Cache	*_cache = &cache[cnt];
2542 		Shdr	*shdr = _cache->c_shdr;
2543 		Cache	*symsec, *strsec;
2544 		Move	*move;
2545 
2546 		if (shdr->sh_type != SHT_SUNW_move)
2547 			continue;
2548 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
2549 			continue;
2550 
2551 		/*
2552 		 * Determine the move data and number.
2553 		 */
2554 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
2555 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2556 			    file, _cache->c_name);
2557 			continue;
2558 		}
2559 		if (_cache->c_data == NULL)
2560 			continue;
2561 
2562 		move = (Move *)_cache->c_data->d_buf;
2563 		movenum = shdr->sh_size / shdr->sh_entsize;
2564 
2565 		/*
2566 		 * Get the data buffer for the associated symbol table and
2567 		 * string table.
2568 		 */
2569 		if (stringtbl(cache, 1, cnt, shnum, file,
2570 		    &symnum, &symsec, &strsec) == 0)
2571 			return;
2572 
2573 		syms = (Sym *)symsec->c_data->d_buf;
2574 
2575 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2576 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_MOVE), _cache->c_name);
2577 		dbg_print(0, MSG_INTL(MSG_MOVE_TITLE));
2578 
2579 		if (fmt == 0)
2580 			fmt = MSG_INTL(MSG_MOVE_ENTRY);
2581 
2582 		for (ndx = 0; ndx < movenum; move++, ndx++) {
2583 			const char	*symname;
2584 			char		index[MAXNDXSIZE], section[BUFSIZ];
2585 			Word		symndx, shndx;
2586 			Sym		*sym;
2587 
2588 			/*
2589 			 * Check for null entries
2590 			 */
2591 			if ((move->m_info == 0) && (move->m_value == 0) &&
2592 			    (move->m_poffset == 0) && (move->m_repeat == 0) &&
2593 			    (move->m_stride == 0)) {
2594 				dbg_print(0, fmt, MSG_ORIG(MSG_STR_EMPTY),
2595 				    EC_XWORD(move->m_poffset), 0, 0, 0,
2596 				    EC_LWORD(0), MSG_ORIG(MSG_STR_EMPTY));
2597 				continue;
2598 			}
2599 			if (((symndx = ELF_M_SYM(move->m_info)) == 0) ||
2600 			    (symndx >= symnum)) {
2601 				(void) fprintf(stderr,
2602 				    MSG_INTL(MSG_ERR_BADMINFO), file,
2603 				    _cache->c_name, EC_XWORD(move->m_info));
2604 
2605 				(void) snprintf(index, MAXNDXSIZE,
2606 				    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(symndx));
2607 				dbg_print(0, fmt, index,
2608 				    EC_XWORD(move->m_poffset),
2609 				    ELF_M_SIZE(move->m_info), move->m_repeat,
2610 				    move->m_stride, move->m_value,
2611 				    MSG_INTL(MSG_STR_UNKNOWN));
2612 				continue;
2613 			}
2614 
2615 			symname = relsymname(cache, _cache, strsec,
2616 			    symndx, symnum, ndx, syms, section, BUFSIZ, file,
2617 			    flags);
2618 			sym = (Sym *)(syms + symndx);
2619 
2620 			/*
2621 			 * Additional sanity check.
2622 			 */
2623 			shndx = sym->st_shndx;
2624 			if (!((shndx == SHN_COMMON) ||
2625 			    (((shndx >= 1) && (shndx <= shnum)) &&
2626 			    (cache[shndx].c_shdr)->sh_type == SHT_NOBITS))) {
2627 				(void) fprintf(stderr,
2628 				    MSG_INTL(MSG_ERR_BADSYM2), file,
2629 				    _cache->c_name, demangle(symname, flags));
2630 			}
2631 
2632 			(void) snprintf(index, MAXNDXSIZE,
2633 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(symndx));
2634 			dbg_print(0, fmt, index, EC_XWORD(move->m_poffset),
2635 			    ELF_M_SIZE(move->m_info), move->m_repeat,
2636 			    move->m_stride, move->m_value,
2637 			    demangle(symname, flags));
2638 		}
2639 	}
2640 }
2641 
2642 /*
2643  * Traverse a note section analyzing each note information block.
2644  * The data buffers size is used to validate references before they are made,
2645  * and is decremented as each element is processed.
2646  */
2647 void
2648 note_entry(Cache *cache, Word *data, size_t size, const char *file)
2649 {
2650 	size_t	bsize = size;
2651 
2652 	/*
2653 	 * Print out a single `note' information block.
2654 	 */
2655 	while (size > 0) {
2656 		size_t	namesz, descsz, type, pad, noteoff;
2657 
2658 		noteoff = bsize - size;
2659 		/*
2660 		 * Make sure we can at least reference the 3 initial entries
2661 		 * (4-byte words) of the note information block.
2662 		 */
2663 		if (size >= (sizeof (Word) * 3))
2664 			size -= (sizeof (Word) * 3);
2665 		else {
2666 			(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADDATASZ),
2667 			    file, cache->c_name, EC_WORD(noteoff));
2668 			return;
2669 		}
2670 
2671 		/*
2672 		 * Make sure any specified name string can be referenced.
2673 		 */
2674 		if ((namesz = *data++) != 0) {
2675 			if (size >= namesz)
2676 				size -= namesz;
2677 			else {
2678 				(void) fprintf(stderr,
2679 				    MSG_INTL(MSG_NOTE_BADNMSZ), file,
2680 				    cache->c_name, EC_WORD(noteoff),
2681 				    EC_WORD(namesz));
2682 				return;
2683 			}
2684 		}
2685 
2686 		/*
2687 		 * Make sure any specified descriptor can be referenced.
2688 		 */
2689 		if ((descsz = *data++) != 0) {
2690 			/*
2691 			 * If namesz isn't a 4-byte multiple, account for any
2692 			 * padding that must exist before the descriptor.
2693 			 */
2694 			if ((pad = (namesz & (sizeof (Word) - 1))) != 0) {
2695 				pad = sizeof (Word) - pad;
2696 				size -= pad;
2697 			}
2698 			if (size >= descsz)
2699 				size -= descsz;
2700 			else {
2701 				(void) fprintf(stderr,
2702 				    MSG_INTL(MSG_NOTE_BADDESZ), file,
2703 				    cache->c_name, EC_WORD(noteoff),
2704 				    EC_WORD(namesz));
2705 				return;
2706 			}
2707 		}
2708 
2709 		type = *data++;
2710 
2711 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2712 		dbg_print(0, MSG_ORIG(MSG_NOTE_TYPE), EC_WORD(type));
2713 
2714 		dbg_print(0, MSG_ORIG(MSG_NOTE_NAMESZ), EC_WORD(namesz));
2715 		if (namesz) {
2716 			char	*name = (char *)data;
2717 
2718 			/*
2719 			 * Since the name string may have 'null' bytes
2720 			 * in it (ia32 .string) - we just write the
2721 			 * whole stream in a single fwrite.
2722 			 */
2723 			(void) fwrite(name, namesz, 1, stdout);
2724 			name = name + ((namesz + (sizeof (Word) - 1)) &
2725 			    ~(sizeof (Word) - 1));
2726 			/* LINTED */
2727 			data = (Word *)name;
2728 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2729 		}
2730 
2731 		/*
2732 		 * If multiple information blocks exist within a .note section
2733 		 * account for any padding that must exist before the next
2734 		 * information block.
2735 		 */
2736 		if ((pad = (descsz & (sizeof (Word) - 1))) != 0) {
2737 			pad = sizeof (Word) - pad;
2738 			if (size > pad)
2739 				size -= pad;
2740 		}
2741 
2742 		dbg_print(0, MSG_ORIG(MSG_NOTE_DESCSZ), EC_WORD(descsz));
2743 		if (descsz) {
2744 			int		ndx, byte, word;
2745 			char		string[58], *str = string;
2746 			uchar_t		*desc = (uchar_t *)data;
2747 
2748 			/*
2749 			 * Dump descriptor bytes.
2750 			 */
2751 			for (ndx = byte = word = 0; descsz; descsz--, desc++) {
2752 				int	tok = *desc;
2753 
2754 				(void) snprintf(str, 58, MSG_ORIG(MSG_NOTE_TOK),
2755 				    tok);
2756 				str += 3;
2757 
2758 				if (++byte == 4) {
2759 					*str++ = ' ', *str++ = ' ';
2760 					word++;
2761 					byte = 0;
2762 				}
2763 				if (word == 4) {
2764 					*str = '\0';
2765 					dbg_print(0, MSG_ORIG(MSG_NOTE_DESC),
2766 					    ndx, string);
2767 					word = 0;
2768 					ndx += 16;
2769 					str = string;
2770 				}
2771 			}
2772 			if (byte || word) {
2773 				*str = '\0';
2774 				dbg_print(0, MSG_ORIG(MSG_NOTE_DESC),
2775 				    ndx, string);
2776 			}
2777 
2778 			desc += pad;
2779 			/* LINTED */
2780 			data = (Word *)desc;
2781 		}
2782 	}
2783 }
2784 
2785 /*
2786  * Search for and process a .note section.
2787  */
2788 static void
2789 note(Cache *cache, Word shnum, const char *file)
2790 {
2791 	Word	cnt;
2792 
2793 	/*
2794 	 * Otherwise look for any .note sections.
2795 	 */
2796 	for (cnt = 1; cnt < shnum; cnt++) {
2797 		Cache	*_cache = &cache[cnt];
2798 		Shdr	*shdr = _cache->c_shdr;
2799 
2800 		if (shdr->sh_type != SHT_NOTE)
2801 			continue;
2802 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
2803 			continue;
2804 
2805 		/*
2806 		 * As these sections are often hand rolled, make sure they're
2807 		 * properly aligned before proceeding, and issue an error
2808 		 * as necessary.
2809 		 *
2810 		 * Note that we will continue on to display the note even
2811 		 * if it has bad alignment. We can do this safely, because
2812 		 * libelf knows the alignment required for SHT_NOTE, and
2813 		 * takes steps to deliver a properly aligned buffer to us
2814 		 * even if the actual file is misaligned.
2815 		 */
2816 		if (shdr->sh_offset & (sizeof (Word) - 1))
2817 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADALIGN),
2818 			    file, _cache->c_name);
2819 
2820 		if (_cache->c_data == NULL)
2821 			continue;
2822 
2823 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2824 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_NOTE), _cache->c_name);
2825 		note_entry(_cache, (Word *)_cache->c_data->d_buf,
2826 		/* LINTED */
2827 		    (Word)_cache->c_data->d_size, file);
2828 	}
2829 }
2830 
2831 /*
2832  * Determine an individual hash entry.  This may be the initial hash entry,
2833  * or an associated chain entry.
2834  */
2835 static void
2836 hash_entry(Cache *refsec, Cache *strsec, const char *hsecname, Word hashndx,
2837     Word symndx, Word symn, Sym *syms, const char *file, ulong_t bkts,
2838     uint_t flags, int chain)
2839 {
2840 	Sym		*sym;
2841 	const char	*symname, *str;
2842 	char		_bucket[MAXNDXSIZE], _symndx[MAXNDXSIZE];
2843 	ulong_t		nbkt, nhash;
2844 
2845 	if (symndx > symn) {
2846 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_HSBADSYMNDX), file,
2847 		    EC_WORD(symndx), EC_WORD(hashndx));
2848 		symname = MSG_INTL(MSG_STR_UNKNOWN);
2849 	} else {
2850 		sym = (Sym *)(syms + symndx);
2851 		symname = string(refsec, symndx, strsec, file, sym->st_name);
2852 	}
2853 
2854 	if (chain == 0) {
2855 		(void) snprintf(_bucket, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INTEGER),
2856 		    hashndx);
2857 		str = (const char *)_bucket;
2858 	} else
2859 		str = MSG_ORIG(MSG_STR_EMPTY);
2860 
2861 	(void) snprintf(_symndx, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX2),
2862 	    EC_WORD(symndx));
2863 	dbg_print(0, MSG_ORIG(MSG_FMT_HASH_INFO), str, _symndx,
2864 	    demangle(symname, flags));
2865 
2866 	/*
2867 	 * Determine if this string is in the correct bucket.
2868 	 */
2869 	nhash = elf_hash(symname);
2870 	nbkt = nhash % bkts;
2871 
2872 	if (nbkt != hashndx) {
2873 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADHASH), file,
2874 		    hsecname, symname, EC_WORD(hashndx), nbkt);
2875 	}
2876 }
2877 
2878 #define	MAXCOUNT	500
2879 
2880 static void
2881 hash(Cache *cache, Word shnum, const char *file, uint_t flags)
2882 {
2883 	static int	count[MAXCOUNT];
2884 	Word		cnt;
2885 	ulong_t		ndx, bkts;
2886 	char		number[MAXNDXSIZE];
2887 
2888 	for (cnt = 1; cnt < shnum; cnt++) {
2889 		uint_t		*hash, *chain;
2890 		Cache		*_cache = &cache[cnt];
2891 		Shdr		*sshdr, *hshdr = _cache->c_shdr;
2892 		char		*ssecname, *hsecname = _cache->c_name;
2893 		Sym		*syms;
2894 		Word		symn;
2895 
2896 		if (hshdr->sh_type != SHT_HASH)
2897 			continue;
2898 
2899 		/*
2900 		 * Determine the hash table data and size.
2901 		 */
2902 		if ((hshdr->sh_entsize == 0) || (hshdr->sh_size == 0)) {
2903 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2904 			    file, hsecname);
2905 			continue;
2906 		}
2907 		if (_cache->c_data == NULL)
2908 			continue;
2909 
2910 		hash = (uint_t *)_cache->c_data->d_buf;
2911 		bkts = *hash;
2912 		chain = hash + 2 + bkts;
2913 		hash += 2;
2914 
2915 		/*
2916 		 * Get the data buffer for the associated symbol table.
2917 		 */
2918 		if ((hshdr->sh_link == 0) || (hshdr->sh_link >= shnum)) {
2919 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
2920 			    file, hsecname, EC_WORD(hshdr->sh_link));
2921 			continue;
2922 		}
2923 
2924 		_cache = &cache[hshdr->sh_link];
2925 		ssecname = _cache->c_name;
2926 
2927 		if (_cache->c_data == NULL)
2928 			continue;
2929 
2930 		if ((syms = (Sym *)_cache->c_data->d_buf) == NULL) {
2931 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2932 			    file, ssecname);
2933 			continue;
2934 		}
2935 
2936 		sshdr = _cache->c_shdr;
2937 		/* LINTED */
2938 		symn = (Word)(sshdr->sh_size / sshdr->sh_entsize);
2939 
2940 		/*
2941 		 * Get the associated string table section.
2942 		 */
2943 		if ((sshdr->sh_link == 0) || (sshdr->sh_link >= shnum)) {
2944 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
2945 			    file, ssecname, EC_WORD(sshdr->sh_link));
2946 			continue;
2947 		}
2948 
2949 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2950 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_HASH), hsecname);
2951 		dbg_print(0, MSG_INTL(MSG_ELF_HASH_INFO));
2952 
2953 		/*
2954 		 * Loop through the hash buckets, printing the appropriate
2955 		 * symbols.
2956 		 */
2957 		for (ndx = 0; ndx < bkts; ndx++, hash++) {
2958 			Word	_ndx, _cnt;
2959 
2960 			if (*hash == 0) {
2961 				count[0]++;
2962 				continue;
2963 			}
2964 
2965 			hash_entry(_cache, &cache[sshdr->sh_link], hsecname,
2966 			    ndx, *hash, symn, syms, file, bkts, flags, 0);
2967 
2968 			/*
2969 			 * Determine if any other symbols are chained to this
2970 			 * bucket.
2971 			 */
2972 			_ndx = chain[*hash];
2973 			_cnt = 1;
2974 			while (_ndx) {
2975 				hash_entry(_cache, &cache[sshdr->sh_link],
2976 				    hsecname, ndx, _ndx, symn, syms, file,
2977 				    bkts, flags, 1);
2978 				_ndx = chain[_ndx];
2979 				_cnt++;
2980 			}
2981 
2982 			if (_cnt >= MAXCOUNT) {
2983 				(void) fprintf(stderr,
2984 				    MSG_INTL(MSG_HASH_OVERFLW), file,
2985 				    _cache->c_name, EC_WORD(ndx),
2986 				    EC_WORD(_cnt));
2987 			} else
2988 				count[_cnt]++;
2989 		}
2990 		break;
2991 	}
2992 
2993 	/*
2994 	 * Print out the count information.
2995 	 */
2996 	bkts = cnt = 0;
2997 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2998 
2999 	for (ndx = 0; ndx < MAXCOUNT; ndx++) {
3000 		Word	_cnt;
3001 
3002 		if ((_cnt = count[ndx]) == 0)
3003 			continue;
3004 
3005 		(void) snprintf(number, MAXNDXSIZE,
3006 		    MSG_ORIG(MSG_FMT_INTEGER), _cnt);
3007 		dbg_print(0, MSG_INTL(MSG_ELF_HASH_BKTS1), number,
3008 		    EC_WORD(ndx));
3009 		bkts += _cnt;
3010 		cnt += (Word)(ndx * _cnt);
3011 	}
3012 	if (cnt) {
3013 		(void) snprintf(number, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INTEGER),
3014 		    bkts);
3015 		dbg_print(0, MSG_INTL(MSG_ELF_HASH_BKTS2), number,
3016 		    EC_WORD(cnt));
3017 	}
3018 }
3019 
3020 static void
3021 group(Cache *cache, Word shnum, const char *file, uint_t flags)
3022 {
3023 	Word	scnt;
3024 
3025 	for (scnt = 1; scnt < shnum; scnt++) {
3026 		Cache	*_cache = &cache[scnt];
3027 		Shdr	*shdr = _cache->c_shdr;
3028 		Word	*grpdata, gcnt, grpcnt, symnum, unknown;
3029 		Cache	*symsec, *strsec;
3030 		Sym	*syms, *sym;
3031 		char	flgstrbuf[MSG_GRP_COMDAT_SIZE + 10];
3032 
3033 		if (shdr->sh_type != SHT_GROUP)
3034 			continue;
3035 		if (!match(MATCH_F_ALL, _cache->c_name, scnt, shdr->sh_type))
3036 			continue;
3037 		if ((_cache->c_data == NULL) ||
3038 		    ((grpdata = (Word *)_cache->c_data->d_buf) == NULL))
3039 			continue;
3040 		grpcnt = shdr->sh_size / sizeof (Word);
3041 
3042 		/*
3043 		 * Get the data buffer for the associated symbol table and
3044 		 * string table.
3045 		 */
3046 		if (stringtbl(cache, 1, scnt, shnum, file,
3047 		    &symnum, &symsec, &strsec) == 0)
3048 			return;
3049 
3050 		syms = symsec->c_data->d_buf;
3051 
3052 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3053 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_GRP), _cache->c_name);
3054 		dbg_print(0, MSG_INTL(MSG_GRP_TITLE));
3055 
3056 		/*
3057 		 * The first element of the group defines the group.  The
3058 		 * associated symbol is defined by the sh_link field.
3059 		 */
3060 		if ((shdr->sh_info == SHN_UNDEF) || (shdr->sh_info > symnum)) {
3061 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHINFO),
3062 			    file, _cache->c_name, EC_WORD(shdr->sh_info));
3063 			return;
3064 		}
3065 
3066 		(void) strcpy(flgstrbuf, MSG_ORIG(MSG_STR_OSQBRKT));
3067 		if (grpdata[0] & GRP_COMDAT) {
3068 			(void) strcat(flgstrbuf, MSG_ORIG(MSG_GRP_COMDAT));
3069 		}
3070 		if ((unknown = (grpdata[0] & ~GRP_COMDAT)) != 0) {
3071 			size_t	len = strlen(flgstrbuf);
3072 
3073 			(void) snprintf(&flgstrbuf[len],
3074 			    (MSG_GRP_COMDAT_SIZE + 10 - len),
3075 			    MSG_ORIG(MSG_GRP_UNKNOWN), unknown);
3076 		}
3077 		(void) strcat(flgstrbuf, MSG_ORIG(MSG_STR_CSQBRKT));
3078 		sym = (Sym *)(syms + shdr->sh_info);
3079 
3080 		dbg_print(0, MSG_INTL(MSG_GRP_SIGNATURE), flgstrbuf,
3081 		    demangle(string(_cache, 0, strsec, file, sym->st_name),
3082 		    flags));
3083 
3084 		for (gcnt = 1; gcnt < grpcnt; gcnt++) {
3085 			char		index[MAXNDXSIZE];
3086 			const char	*name;
3087 
3088 			(void) snprintf(index, MAXNDXSIZE,
3089 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(gcnt));
3090 
3091 			if (grpdata[gcnt] >= shnum)
3092 				name = MSG_INTL(MSG_GRP_INVALSCN);
3093 			else
3094 				name = cache[grpdata[gcnt]].c_name;
3095 
3096 			(void) printf(MSG_ORIG(MSG_GRP_ENTRY), index, name,
3097 			    EC_XWORD(grpdata[gcnt]));
3098 		}
3099 	}
3100 }
3101 
3102 static void
3103 got(Cache *cache, Word shnum, Ehdr *ehdr, const char *file, uint_t flags)
3104 {
3105 	Cache		*gotcache = NULL, *symtab = NULL;
3106 	Addr		gotbgn, gotend;
3107 	Shdr		*gotshdr;
3108 	Word		cnt, gotents, gotndx;
3109 	size_t		gentsize;
3110 	Got_info	*gottable;
3111 	char		*gotdata;
3112 	Sym		*gotsym;
3113 	Xword		gotsymaddr;
3114 
3115 	/*
3116 	 * First, find the got.
3117 	 */
3118 	for (cnt = 1; cnt < shnum; cnt++) {
3119 		if (strncmp(cache[cnt].c_name, MSG_ORIG(MSG_ELF_GOT),
3120 		    MSG_ELF_GOT_SIZE) == 0) {
3121 			gotcache = &cache[cnt];
3122 			break;
3123 		}
3124 	}
3125 	if (gotcache == NULL)
3126 		return;
3127 
3128 	/*
3129 	 * A got section within a relocatable object is suspicious.
3130 	 */
3131 	if (ehdr->e_type == ET_REL) {
3132 		(void) fprintf(stderr, MSG_INTL(MSG_GOT_UNEXPECTED), file,
3133 		    gotcache->c_name);
3134 	}
3135 
3136 	gotshdr = gotcache->c_shdr;
3137 	if (gotshdr->sh_size == 0) {
3138 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3139 		    file, gotcache->c_name);
3140 		return;
3141 	}
3142 
3143 	gotbgn = gotshdr->sh_addr;
3144 	gotend = gotbgn + gotshdr->sh_size;
3145 
3146 	/*
3147 	 * Some architectures don't properly set the sh_entsize for the GOT
3148 	 * table.  If it's not set, default to a size of a pointer.
3149 	 */
3150 	if ((gentsize = gotshdr->sh_entsize) == 0)
3151 		gentsize = sizeof (Xword);
3152 
3153 	if (gotcache->c_data == NULL)
3154 		return;
3155 
3156 	/* LINTED */
3157 	gotents = (Word)(gotshdr->sh_size / gentsize);
3158 	gotdata = gotcache->c_data->d_buf;
3159 
3160 	if ((gottable = calloc(gotents, sizeof (Got_info))) == 0) {
3161 		int err = errno;
3162 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC), file,
3163 		    strerror(err));
3164 		return;
3165 	}
3166 
3167 	/*
3168 	 * Now we scan through all the sections looking for any relocations
3169 	 * that may be against the GOT.  Since these may not be isolated to a
3170 	 * .rel[a].got section we check them all.
3171 	 * While scanning sections save the symbol table entry (a symtab
3172 	 * overriding a dynsym) so that we can lookup _GLOBAL_OFFSET_TABLE_.
3173 	 */
3174 	for (cnt = 1; cnt < shnum; cnt++) {
3175 		Word		type, symnum;
3176 		Xword		relndx, relnum, relsize;
3177 		void		*rels;
3178 		Sym		*syms;
3179 		Cache		*symsec, *strsec;
3180 		Cache		*_cache = &cache[cnt];
3181 		Shdr		*shdr;
3182 
3183 		shdr = _cache->c_shdr;
3184 		type = shdr->sh_type;
3185 
3186 		if ((symtab == 0) && (type == SHT_DYNSYM)) {
3187 			symtab = _cache;
3188 			continue;
3189 		}
3190 		if (type == SHT_SYMTAB) {
3191 			symtab = _cache;
3192 			continue;
3193 		}
3194 		if ((type != SHT_RELA) && (type != SHT_REL))
3195 			continue;
3196 
3197 		/*
3198 		 * Decide entry size.
3199 		 */
3200 		if (((relsize = shdr->sh_entsize) == 0) ||
3201 		    (relsize > shdr->sh_size)) {
3202 			if (type == SHT_RELA)
3203 				relsize = sizeof (Rela);
3204 			else
3205 				relsize = sizeof (Rel);
3206 		}
3207 
3208 		/*
3209 		 * Determine the number of relocations available.
3210 		 */
3211 		if (shdr->sh_size == 0) {
3212 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3213 			    file, _cache->c_name);
3214 			continue;
3215 		}
3216 		if (_cache->c_data == NULL)
3217 			continue;
3218 
3219 		rels = _cache->c_data->d_buf;
3220 		relnum = shdr->sh_size / relsize;
3221 
3222 		/*
3223 		 * Get the data buffer for the associated symbol table and
3224 		 * string table.
3225 		 */
3226 		if (stringtbl(cache, 1, cnt, shnum, file,
3227 		    &symnum, &symsec, &strsec) == 0)
3228 			continue;
3229 
3230 		syms = symsec->c_data->d_buf;
3231 
3232 		/*
3233 		 * Loop through the relocation entries.
3234 		 */
3235 		for (relndx = 0; relndx < relnum; relndx++,
3236 		    rels = (void *)((char *)rels + relsize)) {
3237 			char		section[BUFSIZ];
3238 			Addr		offset;
3239 			Got_info	*gip;
3240 			Word		symndx, reltype;
3241 			Rela		*rela;
3242 			Rel		*rel;
3243 
3244 			/*
3245 			 * Unravel the relocation.
3246 			 */
3247 			if (type == SHT_RELA) {
3248 				rela = (Rela *)rels;
3249 				symndx = ELF_R_SYM(rela->r_info);
3250 				reltype = ELF_R_TYPE(rela->r_info);
3251 				offset = rela->r_offset;
3252 			} else {
3253 				rel = (Rel *)rels;
3254 				symndx = ELF_R_SYM(rel->r_info);
3255 				reltype = ELF_R_TYPE(rel->r_info);
3256 				offset = rel->r_offset;
3257 			}
3258 
3259 			/*
3260 			 * Only pay attention to relocations against the GOT.
3261 			 */
3262 			if ((offset < gotbgn) || (offset >= gotend))
3263 				continue;
3264 
3265 			/* LINTED */
3266 			gotndx = (Word)((offset - gotbgn) /
3267 			    gotshdr->sh_entsize);
3268 			gip = &gottable[gotndx];
3269 
3270 			if (gip->g_reltype != 0) {
3271 				(void) fprintf(stderr,
3272 				    MSG_INTL(MSG_GOT_MULTIPLE), file,
3273 				    EC_WORD(gotndx), EC_ADDR(offset));
3274 				continue;
3275 			}
3276 
3277 			if (symndx)
3278 				gip->g_symname = relsymname(cache, _cache,
3279 				    strsec, symndx, symnum, relndx, syms,
3280 				    section, BUFSIZ, file, flags);
3281 			gip->g_reltype = reltype;
3282 			gip->g_rel = rels;
3283 		}
3284 	}
3285 
3286 	if (symlookup(MSG_ORIG(MSG_GOT_SYM), cache, shnum, &gotsym, symtab,
3287 	    file))
3288 		gotsymaddr = gotsym->st_value;
3289 	else
3290 		gotsymaddr = gotbgn;
3291 
3292 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3293 	dbg_print(0, MSG_INTL(MSG_ELF_SCN_GOT), gotcache->c_name);
3294 	Elf_got_title(0);
3295 
3296 	for (gotndx = 0; gotndx < gotents; gotndx++) {
3297 		Got_info	*gip;
3298 		Sword		gindex;
3299 		Addr		gaddr;
3300 		Xword		gotentry;
3301 
3302 		gip = &gottable[gotndx];
3303 
3304 		gaddr = gotbgn + (gotndx * gentsize);
3305 		gindex = (Sword)(gaddr - gotsymaddr) / (Sword)gentsize;
3306 
3307 		if (gentsize == sizeof (Word))
3308 			/* LINTED */
3309 			gotentry = (Xword)(*((Word *)(gotdata) + gotndx));
3310 		else
3311 			/* LINTED */
3312 			gotentry = *((Xword *)(gotdata) + gotndx);
3313 
3314 		Elf_got_entry(0, gindex, gaddr, gotentry, ehdr->e_machine,
3315 		    gip->g_reltype, gip->g_rel, gip->g_symname);
3316 	}
3317 	free(gottable);
3318 }
3319 
3320 void
3321 checksum(Elf *elf)
3322 {
3323 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3324 	dbg_print(0, MSG_INTL(MSG_STR_CHECKSUM), elf_checksum(elf));
3325 }
3326 
3327 /*
3328  * This variable is used by regular() to communicate the address of
3329  * the section header cache to sort_shdr_ndx_arr(). Unfortunately,
3330  * the qsort() interface does not include a userdata argument by which
3331  * such arbitrary data can be passed, so we are stuck using global data.
3332  */
3333 static Cache *sort_shdr_ndx_arr_cache;
3334 
3335 
3336 /*
3337  * Used with qsort() to sort the section indices so that they can be
3338  * used to access the section headers in order of increasing data offset.
3339  *
3340  * entry:
3341  *	sort_shdr_ndx_arr_cache - Contains address of
3342  *		section header cache.
3343  *	v1, v2 - Point at elements of sort_shdr_bits array to be compared.
3344  *
3345  * exit:
3346  *	Returns -1 (less than), 0 (equal) or 1 (greater than).
3347  */
3348 static int
3349 sort_shdr_ndx_arr(const void *v1, const void *v2)
3350 {
3351 	Cache	*cache1 = sort_shdr_ndx_arr_cache + *((size_t *)v1);
3352 	Cache	*cache2 = sort_shdr_ndx_arr_cache + *((size_t *)v2);
3353 
3354 	if (cache1->c_shdr->sh_offset < cache2->c_shdr->sh_offset)
3355 		return (-1);
3356 
3357 	if (cache1->c_shdr->sh_offset > cache2->c_shdr->sh_offset)
3358 		return (1);
3359 
3360 	return (0);
3361 }
3362 
3363 
3364 static int
3365 shdr_cache(const char *file, Elf *elf, Ehdr *ehdr, size_t shstrndx,
3366     size_t shnum, Cache **cache_ret)
3367 {
3368 	Elf_Scn		*scn;
3369 	Elf_Data	*data;
3370 	size_t		ndx;
3371 	Shdr		*nameshdr;
3372 	char		*names = 0;
3373 	Cache		*cache, *_cache;
3374 	size_t		*shdr_ndx_arr, shdr_ndx_arr_cnt;
3375 
3376 
3377 	/*
3378 	 * Obtain the .shstrtab data buffer to provide the required section
3379 	 * name strings.
3380 	 */
3381 	if (shstrndx == SHN_UNDEF) {
3382 		/*
3383 		 * It is rare, but legal, for an object to lack a
3384 		 * header string table section.
3385 		 */
3386 		names = NULL;
3387 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOSHSTRSEC), file);
3388 	} else if ((scn = elf_getscn(elf, shstrndx)) == NULL) {
3389 		failure(file, MSG_ORIG(MSG_ELF_GETSCN));
3390 		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SHDR),
3391 		    EC_XWORD(shstrndx));
3392 
3393 	} else if ((data = elf_getdata(scn, NULL)) == NULL) {
3394 		failure(file, MSG_ORIG(MSG_ELF_GETDATA));
3395 		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_DATA),
3396 		    EC_XWORD(shstrndx));
3397 
3398 	} else if ((nameshdr = elf_getshdr(scn)) == NULL) {
3399 		failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
3400 		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN),
3401 		    EC_WORD(elf_ndxscn(scn)));
3402 
3403 	} else if ((names = data->d_buf) == 0)
3404 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_SHSTRNULL), file);
3405 
3406 	/*
3407 	 * Allocate a cache to maintain a descriptor for each section.
3408 	 */
3409 	if ((*cache_ret = cache = malloc(shnum * sizeof (Cache))) == NULL) {
3410 		int err = errno;
3411 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
3412 		    file, strerror(err));
3413 		return (0);
3414 	}
3415 
3416 	*cache = cache_init;
3417 	_cache = cache;
3418 	_cache++;
3419 
3420 	/*
3421 	 * Allocate an array that will hold the section index for
3422 	 * each section that has data in the ELF file:
3423 	 *
3424 	 *	- Is not a NOBITS section
3425 	 *	- Data has non-zero length
3426 	 *
3427 	 * Note that shnum is an upper bound on the size required. It
3428 	 * is likely that we won't use a few of these array elements.
3429 	 * Allocating a modest amount of extra memory in this case means
3430 	 * that we can avoid an extra loop to count the number of needed
3431 	 * items, and can fill this array immediately in the first loop
3432 	 * below.
3433 	 */
3434 	if ((shdr_ndx_arr = malloc(shnum * sizeof (*shdr_ndx_arr))) == NULL) {
3435 		int err = errno;
3436 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
3437 		    file, strerror(err));
3438 		return (0);
3439 	}
3440 	shdr_ndx_arr_cnt = 0;
3441 
3442 	/*
3443 	 * Traverse the sections of the file.  This gathering of data is
3444 	 * carried out in two passes.  First, the section headers are captured
3445 	 * and the section header names are evaluated.  A verification pass is
3446 	 * then carried out over the section information.  Files have been
3447 	 * known to exhibit overlapping (and hence erroneous) section header
3448 	 * information.
3449 	 *
3450 	 * Finally, the data for each section is obtained.  This processing is
3451 	 * carried out after section verification because should any section
3452 	 * header overlap occur, and a file needs translating (ie. xlate'ing
3453 	 * information from a non-native architecture file), then the process
3454 	 * of translation can corrupt the section header information.  Of
3455 	 * course, if there is any section overlap, the data related to the
3456 	 * sections is going to be compromised.  However, it is the translation
3457 	 * of this data that has caused problems with elfdump()'s ability to
3458 	 * extract the data.
3459 	 */
3460 	for (ndx = 1, scn = NULL; scn = elf_nextscn(elf, scn);
3461 	    ndx++, _cache++) {
3462 		char	scnndxnm[100];
3463 
3464 		_cache->c_ndx = ndx;
3465 		_cache->c_scn = scn;
3466 
3467 		if ((_cache->c_shdr = elf_getshdr(scn)) == NULL) {
3468 			failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
3469 			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN),
3470 			    EC_WORD(elf_ndxscn(scn)));
3471 		}
3472 
3473 		/*
3474 		 * If this section has data in the file, include it in
3475 		 * the array of sections to check for address overlap.
3476 		 */
3477 		if ((_cache->c_shdr->sh_size != 0) &&
3478 		    (_cache->c_shdr->sh_type != SHT_NOBITS))
3479 			shdr_ndx_arr[shdr_ndx_arr_cnt++] = ndx;
3480 
3481 		/*
3482 		 * If a shstrtab exists, assign the section name.
3483 		 */
3484 		if (names && _cache->c_shdr) {
3485 			if (_cache->c_shdr->sh_name &&
3486 			    /* LINTED */
3487 			    (nameshdr->sh_size > _cache->c_shdr->sh_name)) {
3488 				_cache->c_name =
3489 				    names + _cache->c_shdr->sh_name;
3490 				continue;
3491 			}
3492 
3493 			/*
3494 			 * Generate an error if the section name index is zero
3495 			 * or exceeds the shstrtab data.  Fall through to
3496 			 * fabricate a section name.
3497 			 */
3498 			if ((_cache->c_shdr->sh_name == 0) ||
3499 			    /* LINTED */
3500 			    (nameshdr->sh_size <= _cache->c_shdr->sh_name)) {
3501 				(void) fprintf(stderr,
3502 				    MSG_INTL(MSG_ERR_BADSHNAME), file,
3503 				    EC_WORD(ndx),
3504 				    EC_XWORD(_cache->c_shdr->sh_name));
3505 			}
3506 		}
3507 
3508 		/*
3509 		 * If there exists no shstrtab data, or a section header has no
3510 		 * name (an invalid index of 0), then compose a name for the
3511 		 * section.
3512 		 */
3513 		(void) snprintf(scnndxnm, sizeof (scnndxnm),
3514 		    MSG_INTL(MSG_FMT_SCNNDX), ndx);
3515 
3516 		if ((_cache->c_name = malloc(strlen(scnndxnm) + 1)) == NULL) {
3517 			int err = errno;
3518 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
3519 			    file, strerror(err));
3520 			return (0);
3521 		}
3522 		(void) strcpy(_cache->c_name, scnndxnm);
3523 	}
3524 
3525 	/*
3526 	 * Having collected all the sections, validate their address range.
3527 	 * Cases have existed where the section information has been invalid.
3528 	 * This can lead to all sorts of other, hard to diagnose errors, as
3529 	 * each section is processed individually (ie. with elf_getdata()).
3530 	 * Here, we carry out some address comparisons to catch a family of
3531 	 * overlapping memory issues we have observed (likely, there are others
3532 	 * that we have yet to discover).
3533 	 *
3534 	 * Note, should any memory overlap occur, obtaining any additional
3535 	 * data from the file is questionable.  However, it might still be
3536 	 * possible to inspect the ELF header, Programs headers, or individual
3537 	 * sections, so rather than bailing on an error condition, continue
3538 	 * processing to see if any data can be salvaged.
3539 	 */
3540 	if (shdr_ndx_arr_cnt > 1) {
3541 		sort_shdr_ndx_arr_cache = cache;
3542 		qsort(shdr_ndx_arr, shdr_ndx_arr_cnt,
3543 		    sizeof (*shdr_ndx_arr), sort_shdr_ndx_arr);
3544 	}
3545 	for (ndx = 0; ndx < shdr_ndx_arr_cnt; ndx++) {
3546 		Cache	*_cache = cache + shdr_ndx_arr[ndx];
3547 		Shdr	*shdr = _cache->c_shdr;
3548 		Off	bgn1, bgn = shdr->sh_offset;
3549 		Off	end1, end = shdr->sh_offset + shdr->sh_size;
3550 		size_t	ndx1;
3551 
3552 		/*
3553 		 * Check the section against all following ones, reporting
3554 		 * any overlaps. Since we've sorted the sections by offset,
3555 		 * we can stop after the first comparison that fails. There
3556 		 * are no overlaps in a properly formed ELF file, in which
3557 		 * case this algorithm runs in O(n) time. This will degenerate
3558 		 * to O(n^2) for a completely broken file. Such a file is
3559 		 * (1) highly unlikely, and (2) unusable, so it is reasonable
3560 		 * for the analysis to take longer.
3561 		 */
3562 		for (ndx1 = ndx + 1; ndx1 < shdr_ndx_arr_cnt; ndx1++) {
3563 			Cache	*_cache1 = cache + shdr_ndx_arr[ndx1];
3564 			Shdr	*shdr1 = _cache1->c_shdr;
3565 
3566 			bgn1 = shdr1->sh_offset;
3567 			end1 = shdr1->sh_offset + shdr1->sh_size;
3568 
3569 			if (((bgn1 <= bgn) && (end1 > bgn)) ||
3570 			    ((bgn1 < end) && (end1 >= end))) {
3571 				(void) fprintf(stderr,
3572 				    MSG_INTL(MSG_ERR_SECMEMOVER), file,
3573 				    EC_WORD(elf_ndxscn(_cache->c_scn)),
3574 				    _cache->c_name, EC_OFF(bgn), EC_OFF(end),
3575 				    EC_WORD(elf_ndxscn(_cache1->c_scn)),
3576 				    _cache1->c_name, EC_OFF(bgn1),
3577 				    EC_OFF(end1));
3578 			} else {	/* No overlap, so can stop */
3579 				break;
3580 			}
3581 		}
3582 
3583 		/*
3584 		 * In addition to checking for sections overlapping
3585 		 * each other (done above), we should also make sure
3586 		 * the section doesn't overlap the section header array.
3587 		 */
3588 		bgn1 = ehdr->e_shoff;
3589 		end1 = ehdr->e_shoff + (ehdr->e_shentsize * ehdr->e_shnum);
3590 
3591 		if (((bgn1 <= bgn) && (end1 > bgn)) ||
3592 		    ((bgn1 < end) && (end1 >= end))) {
3593 			(void) fprintf(stderr,
3594 			    MSG_INTL(MSG_ERR_SHDRMEMOVER), file, EC_OFF(bgn1),
3595 			    EC_OFF(end1),
3596 			    EC_WORD(elf_ndxscn(_cache->c_scn)),
3597 			    _cache->c_name, EC_OFF(bgn), EC_OFF(end));
3598 		}
3599 	}
3600 
3601 	/*
3602 	 * Obtain the data for each section.
3603 	 */
3604 	for (ndx = 1; ndx < shnum; ndx++) {
3605 		Cache	*_cache = &cache[ndx];
3606 		Elf_Scn	*scn = _cache->c_scn;
3607 
3608 		if ((_cache->c_data = elf_getdata(scn, NULL)) == NULL) {
3609 			failure(file, MSG_ORIG(MSG_ELF_GETDATA));
3610 			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCNDATA),
3611 			    EC_WORD(elf_ndxscn(scn)));
3612 		}
3613 	}
3614 
3615 	return (1);
3616 }
3617 
3618 
3619 
3620 int
3621 regular(const char *file, int fd, Elf *elf, uint_t flags,
3622     const char *wname, int wfd)
3623 {
3624 	Elf_Scn		*scn;
3625 	Ehdr		*ehdr;
3626 	size_t		ndx, shstrndx, shnum, phnum;
3627 	Shdr		*shdr;
3628 	Cache		*cache;
3629 	VERSYM_STATE	versym;
3630 	int		ret = 0;
3631 	int		addr_align;
3632 
3633 	if ((ehdr = elf_getehdr(elf)) == NULL) {
3634 		failure(file, MSG_ORIG(MSG_ELF_GETEHDR));
3635 		return (ret);
3636 	}
3637 
3638 	if (elf_getshnum(elf, &shnum) == 0) {
3639 		failure(file, MSG_ORIG(MSG_ELF_GETSHNUM));
3640 		return (ret);
3641 	}
3642 
3643 	if (elf_getshstrndx(elf, &shstrndx) == 0) {
3644 		failure(file, MSG_ORIG(MSG_ELF_GETSHSTRNDX));
3645 		return (ret);
3646 	}
3647 
3648 	if (elf_getphnum(elf, &phnum) == 0) {
3649 		failure(file, MSG_ORIG(MSG_ELF_GETPHNUM));
3650 		return (ret);
3651 	}
3652 	/*
3653 	 * If the user requested section headers derived from the
3654 	 * program headers (-P option) and this file doesn't have
3655 	 * any program headers (i.e. ET_REL), then we can't do it.
3656 	 */
3657 	if ((phnum == 0) && (flags & FLG_CTL_FAKESHDR)) {
3658 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_PNEEDSPH), file);
3659 		return (ret);
3660 	}
3661 
3662 
3663 	if ((scn = elf_getscn(elf, 0)) != NULL) {
3664 		if ((shdr = elf_getshdr(scn)) == NULL) {
3665 			failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
3666 			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN), 0);
3667 			return (ret);
3668 		}
3669 	} else
3670 		shdr = 0;
3671 
3672 	/*
3673 	 * Print the elf header.
3674 	 */
3675 	if (flags & FLG_SHOW_EHDR)
3676 		Elf_ehdr(0, ehdr, shdr);
3677 
3678 	/*
3679 	 * If the section headers or program headers have inadequate
3680 	 * alignment for the class of object, print a warning. libelf
3681 	 * can handle such files, but programs that use them can crash
3682 	 * when they dereference unaligned items.
3683 	 *
3684 	 * Note that the AMD64 ABI, although it is a 64-bit architecture,
3685 	 * allows access to data types smaller than 128-bits to be on
3686 	 * word alignment.
3687 	 */
3688 	if (ehdr->e_machine == EM_AMD64)
3689 		addr_align = sizeof (Word);
3690 	else
3691 		addr_align = sizeof (Addr);
3692 
3693 	if (ehdr->e_phoff & (addr_align - 1))
3694 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADPHDRALIGN), file);
3695 	if (ehdr->e_shoff & (addr_align - 1))
3696 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHDRALIGN), file);
3697 
3698 	/*
3699 	 * Print the program headers.
3700 	 */
3701 	if ((flags & FLG_SHOW_PHDR) && (phnum != 0)) {
3702 		Phdr	*phdr;
3703 
3704 		if ((phdr = elf_getphdr(elf)) == NULL) {
3705 			failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
3706 			return (ret);
3707 		}
3708 
3709 		for (ndx = 0; ndx < phnum; phdr++, ndx++) {
3710 			if (!match(MATCH_F_PHDR| MATCH_F_NDX | MATCH_F_TYPE,
3711 			    NULL, ndx, phdr->p_type))
3712 				continue;
3713 
3714 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3715 			dbg_print(0, MSG_INTL(MSG_ELF_PHDR), EC_WORD(ndx));
3716 			Elf_phdr(0, ehdr->e_machine, phdr);
3717 		}
3718 	}
3719 
3720 	/*
3721 	 * If we have flag bits set that explicitly require a show or calc
3722 	 * operation, but none of them require the section headers, then
3723 	 * we are done and can return now.
3724 	 */
3725 	if (((flags & (FLG_MASK_SHOW | FLG_MASK_CALC)) != 0) &&
3726 	    ((flags & (FLG_MASK_SHOW_SHDR | FLG_MASK_CALC_SHDR)) == 0))
3727 		return (ret);
3728 
3729 	/*
3730 	 * If there are no section headers, then resort to synthesizing
3731 	 * section headers from the program headers. This is normally
3732 	 * only done by explicit request, but in this case there's no
3733 	 * reason not to go ahead, since the alternative is simply to quit.
3734 	 */
3735 	if ((shnum <= 1) && ((flags & FLG_CTL_FAKESHDR) == 0)) {
3736 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOSHDR), file);
3737 		flags |= FLG_CTL_FAKESHDR;
3738 	}
3739 
3740 	/*
3741 	 * Generate a cache of section headers and related information
3742 	 * for use by the rest of elfdump. If requested (or the file
3743 	 * contains no section headers), we generate a fake set of
3744 	 * headers from the information accessible from the program headers.
3745 	 * Otherwise, we use the real section headers contained in the file.
3746 	 */
3747 
3748 	if (flags & FLG_CTL_FAKESHDR) {
3749 		if (fake_shdr_cache(file, fd, elf, ehdr, &cache, &shnum) == 0)
3750 			return (ret);
3751 	} else {
3752 		if (shdr_cache(file, elf, ehdr, shstrndx, shnum, &cache) == 0)
3753 			return (ret);
3754 	}
3755 
3756 	/*
3757 	 * Everything from this point on requires section headers.
3758 	 * If we have no section headers, there is no reason to continue.
3759 	 */
3760 	if (shnum <= 1)
3761 		goto done;
3762 
3763 	/*
3764 	 * If -w was specified, find and write out the section(s) data.
3765 	 */
3766 	if (wfd) {
3767 		for (ndx = 1; ndx < shnum; ndx++) {
3768 			Cache	*_cache = &cache[ndx];
3769 
3770 			if (match(MATCH_F_STRICT | MATCH_F_ALL, _cache->c_name,
3771 			    ndx, _cache->c_shdr->sh_type) &&
3772 			    _cache->c_data && _cache->c_data->d_buf) {
3773 				if (write(wfd, _cache->c_data->d_buf,
3774 				    _cache->c_data->d_size) !=
3775 				    _cache->c_data->d_size) {
3776 					int err = errno;
3777 					(void) fprintf(stderr,
3778 					    MSG_INTL(MSG_ERR_WRITE), wname,
3779 					    strerror(err));
3780 					/*
3781 					 * Return an exit status of 1, because
3782 					 * the failure is not related to the
3783 					 * ELF file, but by system resources.
3784 					 */
3785 					ret = 1;
3786 					goto done;
3787 				}
3788 			}
3789 		}
3790 	}
3791 
3792 	/*
3793 	 * If we have no flag bits set that explicitly require a show or calc
3794 	 * operation, but match options (-I, -N, -T) were used, then run
3795 	 * through the section headers and see if we can't deduce show flags
3796 	 * from the match options given.
3797 	 *
3798 	 * We don't do this if -w was specified, because (-I, -N, -T) used
3799 	 * with -w in lieu of some other option is supposed to be quiet.
3800 	 */
3801 	if ((wfd == 0) && (flags & FLG_CTL_MATCH) &&
3802 	    ((flags & (FLG_MASK_SHOW | FLG_MASK_CALC)) == 0)) {
3803 		for (ndx = 1; ndx < shnum; ndx++) {
3804 			Cache	*_cache = &cache[ndx];
3805 
3806 			if (!match(MATCH_F_STRICT | MATCH_F_ALL, _cache->c_name,
3807 			    ndx, _cache->c_shdr->sh_type))
3808 				continue;
3809 
3810 			switch (_cache->c_shdr->sh_type) {
3811 			case SHT_PROGBITS:
3812 				/*
3813 				 * Heuristic time: It is usually bad form
3814 				 * to assume that specific section names
3815 				 * have a given meaning. However, the
3816 				 * ELF ABI does specify a few such names. Try
3817 				 * to match them:
3818 				 */
3819 				if (strcmp(_cache->c_name,
3820 				    MSG_ORIG(MSG_ELF_INTERP)) == 0)
3821 					flags |= FLG_SHOW_INTERP;
3822 				else if (strcmp(_cache->c_name,
3823 				    MSG_ORIG(MSG_ELF_GOT)) == 0)
3824 					flags |= FLG_SHOW_GOT;
3825 				break;
3826 
3827 			case SHT_SYMTAB:
3828 			case SHT_DYNSYM:
3829 			case SHT_SUNW_LDYNSYM:
3830 			case SHT_SUNW_versym:
3831 			case SHT_SYMTAB_SHNDX:
3832 				flags |= FLG_SHOW_SYMBOLS;
3833 				break;
3834 
3835 			case SHT_RELA:
3836 			case SHT_REL:
3837 				flags |= FLG_SHOW_RELOC;
3838 				break;
3839 
3840 			case SHT_HASH:
3841 				flags |= FLG_SHOW_HASH;
3842 				break;
3843 
3844 			case SHT_DYNAMIC:
3845 				flags |= FLG_SHOW_DYNAMIC;
3846 				break;
3847 
3848 			case SHT_NOTE:
3849 				flags |= FLG_SHOW_NOTE;
3850 				break;
3851 
3852 			case SHT_GROUP:
3853 				flags |= FLG_SHOW_GROUP;
3854 				break;
3855 
3856 			case SHT_SUNW_symsort:
3857 			case SHT_SUNW_tlssort:
3858 				flags |= FLG_SHOW_SORT;
3859 				break;
3860 
3861 			case SHT_SUNW_cap:
3862 				flags |= FLG_SHOW_CAP;
3863 				break;
3864 
3865 			case SHT_SUNW_move:
3866 				flags |= FLG_SHOW_MOVE;
3867 				break;
3868 
3869 			case SHT_SUNW_syminfo:
3870 				flags |= FLG_SHOW_SYMINFO;
3871 				break;
3872 
3873 			case SHT_SUNW_verdef:
3874 			case SHT_SUNW_verneed:
3875 				flags |= FLG_SHOW_VERSIONS;
3876 				break;
3877 
3878 			case SHT_AMD64_UNWIND:
3879 				flags |= FLG_SHOW_UNWIND;
3880 				break;
3881 			}
3882 		}
3883 	}
3884 
3885 
3886 	if (flags & FLG_SHOW_SHDR)
3887 		sections(file, cache, shnum, ehdr);
3888 
3889 	if (flags & FLG_SHOW_INTERP)
3890 		interp(file, cache, shnum, phnum, elf);
3891 
3892 	versions(cache, shnum, file, flags, &versym);
3893 
3894 	if (flags & FLG_SHOW_SYMBOLS)
3895 		symbols(cache, shnum, ehdr, &versym, file, flags);
3896 
3897 	if (flags & FLG_SHOW_SORT)
3898 		sunw_sort(cache, shnum, ehdr, &versym, file, flags);
3899 
3900 	if (flags & FLG_SHOW_HASH)
3901 		hash(cache, shnum, file, flags);
3902 
3903 	if (flags & FLG_SHOW_GOT)
3904 		got(cache, shnum, ehdr, file, flags);
3905 
3906 	if (flags & FLG_SHOW_GROUP)
3907 		group(cache, shnum, file, flags);
3908 
3909 	if (flags & FLG_SHOW_SYMINFO)
3910 		syminfo(cache, shnum, file);
3911 
3912 	if (flags & FLG_SHOW_RELOC)
3913 		reloc(cache, shnum, ehdr, file, flags);
3914 
3915 	if (flags & FLG_SHOW_DYNAMIC)
3916 		dynamic(cache, shnum, ehdr, file);
3917 
3918 	if (flags & FLG_SHOW_NOTE)
3919 		note(cache, shnum, file);
3920 
3921 	if (flags & FLG_SHOW_MOVE)
3922 		move(cache, shnum, file, flags);
3923 
3924 	if (flags & FLG_CALC_CHECKSUM)
3925 		checksum(elf);
3926 
3927 	if (flags & FLG_SHOW_CAP)
3928 		cap(file, cache, shnum, phnum, ehdr, elf);
3929 
3930 	if (flags & FLG_SHOW_UNWIND)
3931 		unwind(cache, shnum, phnum, ehdr, file, elf);
3932 
3933 
3934 	/* Release the memory used to cache section headers */
3935 done:
3936 	if (flags & FLG_CTL_FAKESHDR)
3937 		fake_shdr_cache_free(cache, shnum);
3938 	else
3939 		free(cache);
3940 
3941 	return (ret);
3942 }
3943