xref: /titanic_44/usr/src/cmd/sgs/elfdump/common/elfdump.c (revision a4aeef46cda1835da2b19f8f62b4526de6521e6c)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  * Dump an elf file.
29  */
30 #include	<stddef.h>
31 #include	<sys/elf_386.h>
32 #include	<sys/elf_amd64.h>
33 #include	<sys/elf_SPARC.h>
34 #include	<_libelf.h>
35 #include	<dwarf.h>
36 #include	<stdio.h>
37 #include	<unistd.h>
38 #include	<errno.h>
39 #include	<strings.h>
40 #include	<debug.h>
41 #include	<conv.h>
42 #include	<msg.h>
43 #include	<_elfdump.h>
44 
45 
46 /*
47  * VERSYM_STATE is used to maintain information about the VERSYM section
48  * in the object being analyzed. It is filled in by versions(), and used
49  * by init_symtbl_state() when displaying symbol information.
50  *
51  * There are three forms of symbol versioning known to us:
52  *
53  * 1) The original form, introduced with Solaris 2.5, in which
54  *	the Versym contains indexes to Verdef records, and the
55  *	Versym values for UNDEF symbols resolved by other objects
56  *	are all set to 0.
57  * 2) The GNU form, which is backward compatible with the original
58  *	Solaris form, but which adds several extensions:
59  *	- The Versym also contains indexes to Verneed records, recording
60  *		which object/version contributed the external symbol at
61  *		link time. These indexes start with the next value following
62  *		the final Verdef index. The index is written to the previously
63  *		reserved vna_other field of the ELF Vernaux structure.
64  *	- The top bit of the Versym value is no longer part of the index,
65  *		but is used as a "hidden bit" to prevent binding to the symbol.
66  *	- Multiple implementations of a given symbol, contained in varying
67  *		versions are allowed, using special assembler pseudo ops,
68  *		and encoded in the symbol name using '@' characters.
69  * 3) Modified Solaris form, in which we adopt the first GNU extension
70  *	(Versym indexes to Verneed records), but not the others.
71  *
72  * elfdump can handle any of these cases. The presence of a DT_VERSYM
73  * dynamic element indicates a full GNU object. An object that lacks
74  * a DT_VERSYM entry, but which has non-zero vna_other fields in the Vernaux
75  * structures is a modified Solaris object. An object that has neither of
76  * these uses the original form.
77  *
78  * max_verndx contains the largest version index that can appear
79  * in a Versym entry. This can never be less than 1: In the case where
80  * there is no verdef/verneed sections, the [0] index is reserved
81  * for local symbols, and the [1] index for globals. If the original
82  * Solaris versioning rules are in effect and there is a verdef section,
83  * then max_verndex is the number of defined versions. If one of the
84  * other versioning forms is in effect, then:
85  *	1) If there is no verneed section, it is the same as for
86  *		original Solaris versioning.
87  *	2) If there is a verneed section, the vna_other field of the
88  *		Vernaux structs contain versions, and max_verndx is the
89  *		largest such index.
90  *
91  * If gnu_full is True, the object uses the full GNU form of versioning.
92  * The value of the gnu_full field is based on the presence of
93  * a DT_VERSYM entry in the dynamic section: GNU ld produces these, and
94  * Solaris ld does not.
95  *
96  * The gnu_needed field is True if the Versym contains indexes to
97  * Verneed records, as indicated by non-zero vna_other fields in the Verneed
98  * section. If gnu_full is True, then gnu_needed will always be true.
99  * However, gnu_needed can be true without gnu_full. This is the modified
100  * Solaris form.
101  */
102 typedef struct {
103 	Cache	*cache;		/* Pointer to cache entry for VERSYM */
104 	Versym	*data;		/* Pointer to versym array */
105 	int	gnu_full;	/* True if object uses GNU versioning rules */
106 	int	gnu_needed;	/* True if object uses VERSYM indexes for */
107 				/*	VERNEED (subset of gnu_full) */
108 	int	max_verndx;	/* largest versym index value */
109 } VERSYM_STATE;
110 
111 /*
112  * SYMTBL_STATE is used to maintain information about a single symbol
113  * table section, for use by the routines that display symbol information.
114  */
115 typedef struct {
116 	const char	*file;		/* Name of file */
117 	Ehdr		*ehdr;		/* ELF header for file */
118 	Cache		*cache;		/* Cache of all section headers */
119 	uchar_t		osabi;		/* OSABI to use */
120 	Word		shnum;		/* # of sections in cache */
121 	Cache		*seccache;	/* Cache of symbol table section hdr */
122 	Word		secndx;		/* Index of symbol table section hdr */
123 	const char	*secname;	/* Name of section */
124 	uint_t		flags;		/* Command line option flags */
125 	struct {			/* Extended section index data */
126 		int	checked;	/* TRUE if already checked for shxndx */
127 		Word	*data;		/* NULL, or extended section index */
128 					/*	used for symbol table entries */
129 		uint_t	n;		/* # items in shxndx.data */
130 	} shxndx;
131 	VERSYM_STATE	*versym;	/* NULL, or associated VERSYM section */
132 	Sym 		*sym;		/* Array of symbols */
133 	Word		symn;		/* # of symbols */
134 } SYMTBL_STATE;
135 
136 /*
137  * A variable of this type is used to track information related to
138  * .eh_frame and .eh_frame_hdr sections across calls to unwind_eh_frame().
139  */
140 typedef struct {
141 	Word		frame_cnt;	/* # .eh_frame sections seen */
142 	Word		frame_ndx;	/* Section index of 1st .eh_frame */
143 	Word		hdr_cnt;	/* # .eh_frame_hdr sections seen */
144 	Word		hdr_ndx;	/* Section index of 1st .eh_frame_hdr */
145 	uint64_t	frame_ptr;	/* Value of FramePtr field from first */
146 					/*	.eh_frame_hdr section */
147 	uint64_t	frame_base;	/* Data addr of 1st .eh_frame  */
148 } gnu_eh_state_t;
149 
150 /*
151  * C++ .exception_ranges entries make use of the signed ptrdiff_t
152  * type to record self-relative pointer values. We need a type
153  * for this that is matched to the ELFCLASS being processed.
154  */
155 #if	defined(_ELF64)
156 	typedef int64_t PTRDIFF_T;
157 #else
158 	typedef int32_t PTRDIFF_T;
159 #endif
160 
161 /*
162  * The Sun C++ ABI uses this struct to define each .exception_ranges
163  * entry. From the ABI:
164  *
165  * The field ret_addr is a self relative pointer to the start of the address
166  * range. The name was chosen because in the current implementation the range
167  * typically starts at the return address for a call site.
168  *
169  * The field length is the difference, in bytes, between the pc of the last
170  * instruction covered by the exception range and the first. When only a
171  * single call site is represented without optimization, this will equal zero.
172  *
173  * The field handler_addr is a relative pointer which stores the difference
174  * between the start of the exception range and the address of all code to
175  * catch exceptions and perform the cleanup for stack unwinding.
176  *
177  * The field type_block is a relative pointer which stores the difference
178  * between the start of the exception range and the address of an array used
179  * for storing a list of the types of exceptions which can be caught within
180  * the exception range.
181  */
182 typedef struct {
183 	PTRDIFF_T	ret_addr;
184 	Xword		length;
185 	PTRDIFF_T	handler_addr;
186 	PTRDIFF_T	type_block;
187 	Xword		reserved;
188 } exception_range_entry;
189 
190 /*
191  * Focal point for verifying symbol names.
192  */
193 static const char *
194 string(Cache *refsec, Word ndx, Cache *strsec, const char *file, Word name)
195 {
196 	/*
197 	 * If an error in this routine is due to a property of the string
198 	 * section, as opposed to a bad offset into the section (a property of
199 	 * the referencing section), then we will detect the same error on
200 	 * every call involving those sections. We use these static variables
201 	 * to retain the information needed to only issue each such error once.
202 	 */
203 	static Cache	*last_refsec;	/* Last referencing section seen */
204 	static int	strsec_err;	/* True if error issued */
205 
206 	const char	*strs;
207 	Word		strn;
208 
209 	if (strsec->c_data == NULL)
210 		return (NULL);
211 
212 	strs = (char *)strsec->c_data->d_buf;
213 	strn = strsec->c_data->d_size;
214 
215 	/*
216 	 * We only print a diagnostic regarding a bad string table once per
217 	 * input section being processed. If the refsec has changed, reset
218 	 * our retained error state.
219 	 */
220 	if (last_refsec != refsec) {
221 		last_refsec = refsec;
222 		strsec_err = 0;
223 	}
224 
225 	/* Verify that strsec really is a string table */
226 	if (strsec->c_shdr->sh_type != SHT_STRTAB) {
227 		if (!strsec_err) {
228 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOTSTRTAB),
229 			    file, strsec->c_ndx, refsec->c_ndx);
230 			strsec_err = 1;
231 		}
232 		return (MSG_INTL(MSG_STR_UNKNOWN));
233 	}
234 
235 	/*
236 	 * Is the string table offset within range of the available strings?
237 	 */
238 	if (name >= strn) {
239 		/*
240 		 * Do we have a empty string table?
241 		 */
242 		if (strs == NULL) {
243 			if (!strsec_err) {
244 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
245 				    file, strsec->c_name);
246 				strsec_err = 1;
247 			}
248 		} else {
249 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSTOFF),
250 			    file, refsec->c_name, EC_WORD(ndx), strsec->c_name,
251 			    EC_WORD(name), EC_WORD(strn - 1));
252 		}
253 
254 		/*
255 		 * Return the empty string so that the calling function can
256 		 * continue it's output diagnostics.
257 		 */
258 		return (MSG_INTL(MSG_STR_UNKNOWN));
259 	}
260 	return (strs + name);
261 }
262 
263 /*
264  * Relocations can reference section symbols and standard symbols.  If the
265  * former, establish the section name.
266  */
267 static const char *
268 relsymname(Cache *cache, Cache *csec, Cache *strsec, Word symndx, Word symnum,
269     Word relndx, Sym *syms, char *secstr, size_t secsz, const char *file)
270 {
271 	Sym		*sym;
272 	const char	*name;
273 
274 	if (symndx >= symnum) {
275 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_RELBADSYMNDX),
276 		    file, EC_WORD(symndx), EC_WORD(relndx));
277 		return (MSG_INTL(MSG_STR_UNKNOWN));
278 	}
279 
280 	sym = (Sym *)(syms + symndx);
281 	name = string(csec, symndx, strsec, file, sym->st_name);
282 
283 	/*
284 	 * If the symbol represents a section offset construct an appropriate
285 	 * string.  Note, although section symbol table entries typically have
286 	 * a NULL name pointer, entries do exist that point into the string
287 	 * table to their own NULL strings.
288 	 */
289 	if ((ELF_ST_TYPE(sym->st_info) == STT_SECTION) &&
290 	    ((sym->st_name == 0) || (*name == '\0'))) {
291 		(void) snprintf(secstr, secsz, MSG_INTL(MSG_STR_SECTION),
292 		    cache[sym->st_shndx].c_name);
293 		return ((const char *)secstr);
294 	}
295 
296 	return (name);
297 }
298 
299 /*
300  * Focal point for establishing a string table section.  Data such as the
301  * dynamic information simply points to a string table.  Data such as
302  * relocations, reference a symbol table, which in turn is associated with a
303  * string table.
304  */
305 static int
306 stringtbl(Cache *cache, int symtab, Word ndx, Word shnum, const char *file,
307     Word *symnum, Cache **symsec, Cache **strsec)
308 {
309 	Shdr	*shdr = cache[ndx].c_shdr;
310 
311 	if (symtab) {
312 		/*
313 		 * Validate the symbol table section.
314 		 */
315 		if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
316 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
317 			    file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
318 			return (0);
319 		}
320 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
321 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
322 			    file, cache[ndx].c_name);
323 			return (0);
324 		}
325 
326 		/*
327 		 * Obtain, and verify the symbol table data.
328 		 */
329 		if ((cache[ndx].c_data == NULL) ||
330 		    (cache[ndx].c_data->d_buf == NULL)) {
331 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
332 			    file, cache[ndx].c_name);
333 			return (0);
334 		}
335 
336 		/*
337 		 * Establish the string table index.
338 		 */
339 		ndx = shdr->sh_link;
340 		shdr = cache[ndx].c_shdr;
341 
342 		/*
343 		 * Return symbol table information.
344 		 */
345 		if (symnum)
346 			*symnum = (shdr->sh_size / shdr->sh_entsize);
347 		if (symsec)
348 			*symsec = &cache[ndx];
349 	}
350 
351 	/*
352 	 * Validate the associated string table section.
353 	 */
354 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
355 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
356 		    file, cache[ndx].c_name, EC_WORD(shdr->sh_link));
357 		return (0);
358 	}
359 
360 	if (strsec)
361 		*strsec = &cache[shdr->sh_link];
362 
363 	return (1);
364 }
365 
366 /*
367  * Lookup a symbol and set Sym accordingly.
368  *
369  * entry:
370  *	name - Name of symbol to lookup
371  *	cache - Cache of all section headers
372  *	shnum - # of sections in cache
373  *	sym - Address of pointer to receive symbol
374  *	target - NULL, or section to which the symbol must be associated.
375  *	symtab - Symbol table to search for symbol
376  *	file - Name of file
377  *
378  * exit:
379  *	If the symbol is found, *sym is set to reference it, and True is
380  *	returned. If target is non-NULL, the symbol must reference the given
381  *	section --- otherwise the section is not checked.
382  *
383  *	If no symbol is found, False is returned.
384  */
385 static int
386 symlookup(const char *name, Cache *cache, Word shnum, Sym **sym,
387     Cache *target, Cache *symtab, const char *file)
388 {
389 	Shdr	*shdr;
390 	Word	symn, cnt;
391 	Sym	*syms;
392 
393 	if (symtab == 0)
394 		return (0);
395 
396 	shdr = symtab->c_shdr;
397 
398 	/*
399 	 * Determine the symbol data and number.
400 	 */
401 	if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
402 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
403 		    file, symtab->c_name);
404 		return (0);
405 	}
406 	if (symtab->c_data == NULL)
407 		return (0);
408 
409 	/* LINTED */
410 	symn = (Word)(shdr->sh_size / shdr->sh_entsize);
411 	syms = (Sym *)symtab->c_data->d_buf;
412 
413 	/*
414 	 * Get the associated string table section.
415 	 */
416 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
417 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
418 		    file, symtab->c_name, EC_WORD(shdr->sh_link));
419 		return (0);
420 	}
421 
422 	/*
423 	 * Loop through the symbol table to find a match.
424 	 */
425 	*sym = NULL;
426 	for (cnt = 0; cnt < symn; syms++, cnt++) {
427 		const char	*symname;
428 
429 		symname = string(symtab, cnt, &cache[shdr->sh_link], file,
430 		    syms->st_name);
431 
432 		if (symname && (strcmp(name, symname) == 0) &&
433 		    ((target == NULL) || (target->c_ndx == syms->st_shndx))) {
434 			/*
435 			 * It is possible, though rare, for a local and
436 			 * global symbol of the same name to exist, each
437 			 * contributed by a different input object. If the
438 			 * symbol just found is local, remember it, but
439 			 * continue looking.
440 			 */
441 			*sym = syms;
442 			if (ELF_ST_BIND(syms->st_info) != STB_LOCAL)
443 				break;
444 		}
445 	}
446 
447 	return (*sym != NULL);
448 }
449 
450 /*
451  * Print section headers.
452  */
453 static void
454 sections(const char *file, Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi)
455 {
456 	size_t	seccnt;
457 
458 	for (seccnt = 1; seccnt < shnum; seccnt++) {
459 		Cache		*_cache = &cache[seccnt];
460 		Shdr		*shdr = _cache->c_shdr;
461 		const char	*secname = _cache->c_name;
462 
463 		/*
464 		 * Although numerous section header entries can be zero, it's
465 		 * usually a sign of trouble if the type is zero.
466 		 */
467 		if (shdr->sh_type == 0) {
468 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHTYPE),
469 			    file, secname, EC_WORD(shdr->sh_type));
470 		}
471 
472 		if (!match(MATCH_F_ALL, secname, seccnt, shdr->sh_type))
473 			continue;
474 
475 		/*
476 		 * Identify any sections that are suspicious.  A .got section
477 		 * shouldn't exist in a relocatable object.
478 		 */
479 		if (ehdr->e_type == ET_REL) {
480 			if (strncmp(secname, MSG_ORIG(MSG_ELF_GOT),
481 			    MSG_ELF_GOT_SIZE) == 0) {
482 				(void) fprintf(stderr,
483 				    MSG_INTL(MSG_GOT_UNEXPECTED), file,
484 				    secname);
485 			}
486 		}
487 
488 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
489 		dbg_print(0, MSG_INTL(MSG_ELF_SHDR), EC_WORD(seccnt), secname);
490 		Elf_shdr(0, osabi, ehdr->e_machine, shdr);
491 	}
492 }
493 
494 /*
495  * Obtain a specified Phdr entry.
496  */
497 static Phdr *
498 getphdr(Word phnum, Word *type_arr, Word type_cnt, const char *file, Elf *elf)
499 {
500 	Word	cnt, tcnt;
501 	Phdr	*phdr;
502 
503 	if ((phdr = elf_getphdr(elf)) == NULL) {
504 		failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
505 		return (NULL);
506 	}
507 
508 	for (cnt = 0; cnt < phnum; phdr++, cnt++) {
509 		for (tcnt = 0; tcnt < type_cnt; tcnt++) {
510 			if (phdr->p_type == type_arr[tcnt])
511 				return (phdr);
512 		}
513 	}
514 	return (NULL);
515 }
516 
517 /*
518  * Display the contents of GNU/amd64 .eh_frame and .eh_frame_hdr
519  * sections.
520  *
521  * entry:
522  *	cache - Cache of all section headers
523  *	shndx - Index of .eh_frame or .eh_frame_hdr section to be displayed
524  *	uphdr - NULL, or unwind program header associated with
525  *		the .eh_frame_hdr section.
526  *	ehdr - ELF header for file
527  *	eh_state - Data used across calls to this routine. The
528  *		caller should zero it before the first call, and
529  *		pass it on every call.
530  *	osabi - OSABI to use in displaying information
531  *	file - Name of file
532  *	flags - Command line option flags
533  */
534 static void
535 unwind_eh_frame(Cache *cache, Word shndx, Phdr *uphdr, Ehdr *ehdr,
536     gnu_eh_state_t *eh_state, uchar_t osabi, const char *file, uint_t flags)
537 {
538 #if	defined(_ELF64)
539 #define	MSG_UNW_BINSRTAB2	MSG_UNW_BINSRTAB2_64
540 #define	MSG_UNW_BINSRTABENT	MSG_UNW_BINSRTABENT_64
541 #else
542 #define	MSG_UNW_BINSRTAB2	MSG_UNW_BINSRTAB2_32
543 #define	MSG_UNW_BINSRTABENT	MSG_UNW_BINSRTABENT_32
544 #endif
545 
546 	Cache			*_cache = &cache[shndx];
547 	Shdr			*shdr = _cache->c_shdr;
548 	uchar_t			*data = (uchar_t *)(_cache->c_data->d_buf);
549 	size_t			datasize = _cache->c_data->d_size;
550 	Conv_dwarf_ehe_buf_t	dwarf_ehe_buf;
551 	uint64_t		ndx, frame_ptr, fde_cnt, tabndx;
552 	uint_t			vers, frame_ptr_enc, fde_cnt_enc, table_enc;
553 	uint64_t		initloc, initloc0;
554 
555 
556 	/*
557 	 * Is this a .eh_frame_hdr?
558 	 */
559 	if ((uphdr && (shdr->sh_addr == uphdr->p_vaddr)) ||
560 	    (strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRMHDR),
561 	    MSG_SCN_FRMHDR_SIZE) == 0)) {
562 		/*
563 		 * There can only be a single .eh_frame_hdr.
564 		 * Flag duplicates.
565 		 */
566 		if (++eh_state->hdr_cnt > 1)
567 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_MULTEHFRMHDR),
568 			    file, EC_WORD(shndx), _cache->c_name);
569 
570 		dbg_print(0, MSG_ORIG(MSG_UNW_FRMHDR));
571 		ndx = 0;
572 
573 		vers = data[ndx++];
574 		frame_ptr_enc = data[ndx++];
575 		fde_cnt_enc = data[ndx++];
576 		table_enc = data[ndx++];
577 
578 		dbg_print(0, MSG_ORIG(MSG_UNW_FRMVERS), vers);
579 
580 		frame_ptr = dwarf_ehe_extract(data, &ndx, frame_ptr_enc,
581 		    ehdr->e_ident, shdr->sh_addr, ndx);
582 		if (eh_state->hdr_cnt == 1) {
583 			eh_state->hdr_ndx = shndx;
584 			eh_state->frame_ptr = frame_ptr;
585 		}
586 
587 		dbg_print(0, MSG_ORIG(MSG_UNW_FRPTRENC),
588 		    conv_dwarf_ehe(frame_ptr_enc, &dwarf_ehe_buf),
589 		    EC_XWORD(frame_ptr));
590 
591 		fde_cnt = dwarf_ehe_extract(data, &ndx, fde_cnt_enc,
592 		    ehdr->e_ident, shdr->sh_addr, ndx);
593 
594 		dbg_print(0, MSG_ORIG(MSG_UNW_FDCNENC),
595 		    conv_dwarf_ehe(fde_cnt_enc, &dwarf_ehe_buf),
596 		    EC_XWORD(fde_cnt));
597 		dbg_print(0, MSG_ORIG(MSG_UNW_TABENC),
598 		    conv_dwarf_ehe(table_enc, &dwarf_ehe_buf));
599 		dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTAB1));
600 		dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTAB2));
601 
602 		for (tabndx = 0; tabndx < fde_cnt; tabndx++) {
603 			initloc = dwarf_ehe_extract(data, &ndx, table_enc,
604 			    ehdr->e_ident, shdr->sh_addr, ndx);
605 			/*LINTED:E_VAR_USED_BEFORE_SET*/
606 			if ((tabndx != 0) && (initloc0 > initloc))
607 				(void) fprintf(stderr,
608 				    MSG_INTL(MSG_ERR_BADSORT), file,
609 				    _cache->c_name, EC_WORD(tabndx));
610 			dbg_print(0, MSG_ORIG(MSG_UNW_BINSRTABENT),
611 			    EC_XWORD(initloc),
612 			    EC_XWORD(dwarf_ehe_extract(data, &ndx,
613 			    table_enc, ehdr->e_ident, shdr->sh_addr,
614 			    ndx)));
615 			initloc0 = initloc;
616 		}
617 	} else {		/* Display the .eh_frame section */
618 		eh_state->frame_cnt++;
619 		if (eh_state->frame_cnt == 1) {
620 			eh_state->frame_ndx = shndx;
621 			eh_state->frame_base = shdr->sh_addr;
622 		} else if ((eh_state->frame_cnt >  1) &&
623 		    (ehdr->e_type != ET_REL)) {
624 			Conv_inv_buf_t	inv_buf;
625 
626 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_MULTEHFRM),
627 			    file, EC_WORD(shndx), _cache->c_name,
628 			    conv_ehdr_type(osabi, ehdr->e_type, 0, &inv_buf));
629 		}
630 		dump_eh_frame(data, datasize, shdr->sh_addr,
631 		    ehdr->e_machine, ehdr->e_ident);
632 	}
633 
634 	/*
635 	 * If we've seen the .eh_frame_hdr and the first .eh_frame section,
636 	 * compare the header frame_ptr to the address of the actual frame
637 	 * section to ensure the link-editor got this right.  Note, this
638 	 * diagnostic is only produced when unwind information is explicitly
639 	 * asked for, as shared objects built with an older ld(1) may reveal
640 	 * this inconsistency.  Although an inconsistency, it doesn't seem to
641 	 * have any adverse effect on existing tools.
642 	 */
643 	if (((flags & FLG_MASK_SHOW) != FLG_MASK_SHOW) &&
644 	    (eh_state->hdr_cnt > 0) && (eh_state->frame_cnt > 0) &&
645 	    (eh_state->frame_ptr != eh_state->frame_base))
646 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADEHFRMPTR),
647 		    file, EC_WORD(eh_state->hdr_ndx),
648 		    cache[eh_state->hdr_ndx].c_name,
649 		    EC_XWORD(eh_state->frame_ptr),
650 		    EC_WORD(eh_state->frame_ndx),
651 		    cache[eh_state->frame_ndx].c_name,
652 		    EC_XWORD(eh_state->frame_base));
653 #undef MSG_UNW_BINSRTAB2
654 #undef MSG_UNW_BINSRTABENT
655 }
656 
657 /*
658  * Convert a self relative pointer into an address. A self relative
659  * pointer adds the address where the pointer resides to the offset
660  * contained in the pointer. The benefit is that the value of the
661  * pointer does not require relocation.
662  *
663  * entry:
664  *	base_addr - Address of the pointer.
665  *	delta - Offset relative to base_addr giving desired address
666  *
667  * exit:
668  *	The computed address is returned.
669  *
670  * note:
671  *	base_addr is an unsigned value, while ret_addr is signed. This routine
672  *	used explicit testing and casting to explicitly control type
673  *	conversion, and ensure that we handle the maximum possible range.
674  */
675 static Addr
676 srelptr(Addr base_addr, PTRDIFF_T delta)
677 {
678 	if (delta < 0)
679 		return (base_addr - (Addr) (-delta));
680 
681 	return (base_addr + (Addr) delta);
682 }
683 
684 /*
685  * Byte swap a PTRDIFF_T value.
686  */
687 static PTRDIFF_T
688 swap_ptrdiff(PTRDIFF_T value)
689 {
690 	PTRDIFF_T r;
691 	uchar_t	*dst = (uchar_t *)&r;
692 	uchar_t	*src = (uchar_t *)&value;
693 
694 	UL_ASSIGN_BSWAP_XWORD(dst, src);
695 	return (r);
696 }
697 
698 /*
699  * Display exception_range_entry items from the .exception_ranges section
700  * of a Sun C++ object.
701  */
702 static void
703 unwind_exception_ranges(Cache *_cache, const char *file, int do_swap)
704 {
705 	/*
706 	 * Translate a PTRDIFF_T self-relative address field of
707 	 * an exception_range_entry struct into an address.
708 	 *
709 	 * entry:
710 	 *	exc_addr - Address of base of exception_range_entry struct
711 	 *	cur_ent - Pointer to data in the struct to be translated
712 	 *
713 	 *	_f - Field of struct to be translated
714 	 */
715 #define	SRELPTR(_f) \
716 	srelptr(exc_addr + offsetof(exception_range_entry, _f), cur_ent->_f)
717 
718 #if	defined(_ELF64)
719 #define	MSG_EXR_TITLE	MSG_EXR_TITLE_64
720 #define	MSG_EXR_ENTRY	MSG_EXR_ENTRY_64
721 #else
722 #define	MSG_EXR_TITLE	MSG_EXR_TITLE_32
723 #define	MSG_EXR_ENTRY	MSG_EXR_ENTRY_32
724 #endif
725 
726 	exception_range_entry	scratch, *ent, *cur_ent = &scratch;
727 	char			index[MAXNDXSIZE];
728 	Word			i, nelts;
729 	Addr			addr, addr0, offset = 0;
730 	Addr			exc_addr = _cache->c_shdr->sh_addr;
731 
732 	dbg_print(0, MSG_INTL(MSG_EXR_TITLE));
733 	ent = (exception_range_entry *)(_cache->c_data->d_buf);
734 	nelts = _cache->c_data->d_size / sizeof (exception_range_entry);
735 
736 	for (i = 0; i < nelts; i++, ent++) {
737 		if (do_swap) {
738 			/*
739 			 * Copy byte swapped values into the scratch buffer.
740 			 * The reserved field is not used, so we skip it.
741 			 */
742 			scratch.ret_addr = swap_ptrdiff(ent->ret_addr);
743 			scratch.length = BSWAP_XWORD(ent->length);
744 			scratch.handler_addr = swap_ptrdiff(ent->handler_addr);
745 			scratch.type_block = swap_ptrdiff(ent->type_block);
746 		} else {
747 			cur_ent = ent;
748 		}
749 
750 		/*
751 		 * The table is required to be sorted by the address
752 		 * derived from ret_addr, to allow binary searching. Ensure
753 		 * that addresses grow monotonically.
754 		 */
755 		addr = SRELPTR(ret_addr);
756 		/*LINTED:E_VAR_USED_BEFORE_SET*/
757 		if ((i != 0) && (addr0 > addr))
758 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSORT),
759 			    file, _cache->c_name, EC_WORD(i));
760 
761 		(void) snprintf(index, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX),
762 		    EC_XWORD(i));
763 		dbg_print(0, MSG_INTL(MSG_EXR_ENTRY), index, EC_ADDR(offset),
764 		    EC_ADDR(addr), EC_ADDR(cur_ent->length),
765 		    EC_ADDR(SRELPTR(handler_addr)),
766 		    EC_ADDR(SRELPTR(type_block)));
767 
768 		addr0 = addr;
769 		exc_addr += sizeof (exception_range_entry);
770 		offset += sizeof (exception_range_entry);
771 	}
772 
773 #undef SRELPTR
774 #undef MSG_EXR_TITLE
775 #undef MSG_EXR_ENTRY
776 }
777 
778 /*
779  * Display information from unwind/exception sections:
780  *
781  * -	GNU/amd64 .eh_frame and .eh_frame_hdr
782  * -	Sun C++ .exception_ranges
783  *
784  */
785 static void
786 unwind(Cache *cache, Word shnum, Word phnum, Ehdr *ehdr, uchar_t osabi,
787     const char *file, Elf *elf, uint_t flags)
788 {
789 	static Word phdr_types[] = { PT_SUNW_UNWIND, PT_SUNW_EH_FRAME };
790 
791 	Word			cnt;
792 	Phdr			*uphdr = NULL;
793 	gnu_eh_state_t		eh_state;
794 
795 	/*
796 	 * Historical background: .eh_frame and .eh_frame_hdr sections
797 	 * come from the GNU compilers (particularly C++), and are used
798 	 * under all architectures. Their format is based on DWARF. When
799 	 * the amd64 ABI was defined, these sections were adopted wholesale
800 	 * from the existing practice.
801 	 *
802 	 * When amd64 support was added to Solaris, support for these
803 	 * sections was added, using the SHT_AMD64_UNWIND section type
804 	 * to identify them. At first, we ignored them in objects for
805 	 * non-amd64 targets, but later broadened our support to include
806 	 * other architectures in order to better support gcc-generated
807 	 * objects.
808 	 *
809 	 * .exception_ranges implement the same basic concepts, but
810 	 * were invented at Sun for the Sun C++ compiler.
811 	 *
812 	 * We match these sections by name, rather than section type,
813 	 * because they can come in as either SHT_AMD64_UNWIND, or as
814 	 * SHT_PROGBITS, and because the type isn't enough to determine
815 	 * how they should be interprteted.
816 	 */
817 
818 	/* Find the program header for .eh_frame_hdr if present */
819 	if (phnum)
820 		uphdr = getphdr(phnum, phdr_types,
821 		    sizeof (phdr_types) / sizeof (*phdr_types), file, elf);
822 
823 	/*
824 	 * eh_state is used to retain data used by unwind_eh_frame()
825 	 * accross calls.
826 	 */
827 	bzero(&eh_state, sizeof (eh_state));
828 
829 	for (cnt = 1; cnt < shnum; cnt++) {
830 		Cache		*_cache = &cache[cnt];
831 		Shdr		*shdr = _cache->c_shdr;
832 		int		is_exrange;
833 
834 		/*
835 		 * Skip sections of the wrong type. On amd64, they
836 		 * can be SHT_AMD64_UNWIND. On all platforms, they
837 		 * can be SHT_PROGBITS (including amd64, if using
838 		 * the GNU compilers).
839 		 *
840 		 * Skip anything other than these two types. The name
841 		 * test below will thin out the SHT_PROGBITS that don't apply.
842 		 */
843 		if ((shdr->sh_type != SHT_PROGBITS) &&
844 		    (shdr->sh_type != SHT_AMD64_UNWIND))
845 			continue;
846 
847 		/*
848 		 * Only sections with certain well known names are of interest.
849 		 * These are:
850 		 *
851 		 *	.eh_frame - amd64/GNU-compiler unwind sections
852 		 *	.eh_frame_hdr - Sorted table referencing .eh_frame
853 		 *	.exception_ranges - Sun C++ unwind sections
854 		 *
855 		 * We do a prefix comparison, allowing for naming conventions
856 		 * like .eh_frame.foo, hence the use of strncmp() rather than
857 		 * strcmp(). This means that we only really need to test for
858 		 * .eh_frame, as it's a prefix of .eh_frame_hdr.
859 		 */
860 		is_exrange =  strncmp(_cache->c_name,
861 		    MSG_ORIG(MSG_SCN_EXRANGE), MSG_SCN_EXRANGE_SIZE) == 0;
862 		if ((strncmp(_cache->c_name, MSG_ORIG(MSG_SCN_FRM),
863 		    MSG_SCN_FRM_SIZE) != 0) && !is_exrange)
864 			continue;
865 
866 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
867 			continue;
868 
869 		if (_cache->c_data == NULL)
870 			continue;
871 
872 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
873 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_UNWIND), _cache->c_name);
874 
875 		if (is_exrange)
876 			unwind_exception_ranges(_cache, file,
877 			    _elf_sys_encoding() != ehdr->e_ident[EI_DATA]);
878 		else
879 			unwind_eh_frame(cache, cnt, uphdr, ehdr, &eh_state,
880 			    osabi, file, flags);
881 	}
882 }
883 
884 /*
885  * Print the hardware/software capabilities.  For executables and shared objects
886  * this should be accompanied with a program header.
887  */
888 static void
889 cap(const char *file, Cache *cache, Word shnum, Word phnum, Ehdr *ehdr,
890     Elf *elf)
891 {
892 	Word		cnt;
893 	Shdr		*cshdr = NULL;
894 	Cache		*ccache;
895 	Off		cphdr_off = 0;
896 	Xword		cphdr_sz;
897 
898 	/*
899 	 * Determine if a hardware/software capabilities header exists.
900 	 */
901 	if (phnum) {
902 		Phdr	*phdr;
903 
904 		if ((phdr = elf_getphdr(elf)) == NULL) {
905 			failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
906 			return;
907 		}
908 
909 		for (cnt = 0; cnt < phnum; phdr++, cnt++) {
910 			if (phdr->p_type == PT_SUNWCAP) {
911 				cphdr_off = phdr->p_offset;
912 				cphdr_sz = phdr->p_filesz;
913 				break;
914 			}
915 		}
916 	}
917 
918 	/*
919 	 * Determine if a hardware/software capabilities section exists.
920 	 */
921 	for (cnt = 1; cnt < shnum; cnt++) {
922 		Cache	*_cache = &cache[cnt];
923 		Shdr	*shdr = _cache->c_shdr;
924 
925 		if (shdr->sh_type != SHT_SUNW_cap)
926 			continue;
927 
928 		if (cphdr_off && ((cphdr_off < shdr->sh_offset) ||
929 		    (cphdr_off + cphdr_sz) > (shdr->sh_offset + shdr->sh_size)))
930 			continue;
931 
932 		if (_cache->c_data == NULL)
933 			continue;
934 
935 		ccache = _cache;
936 		cshdr = shdr;
937 		break;
938 	}
939 
940 	if ((cshdr == NULL) && (cphdr_off == 0))
941 		return;
942 
943 	/*
944 	 * Print the hardware/software capabilities section.
945 	 */
946 	if (cshdr) {
947 		Word	ndx, capn;
948 		Cap	*cap = (Cap *)ccache->c_data->d_buf;
949 
950 		if ((cshdr->sh_entsize == 0) || (cshdr->sh_size == 0)) {
951 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
952 			    file, ccache->c_name);
953 			return;
954 		}
955 
956 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
957 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_CAP), ccache->c_name);
958 
959 		Elf_cap_title(0);
960 
961 		capn = (Word)(cshdr->sh_size / cshdr->sh_entsize);
962 
963 		for (ndx = 0; ndx < capn; cap++, ndx++) {
964 			if (cap->c_tag == CA_SUNW_NULL)
965 				continue;
966 
967 			Elf_cap_entry(0, cap, ndx, ehdr->e_machine);
968 
969 			/*
970 			 * An SF1_SUNW_ADDR32 software capability in a 32-bit
971 			 * object is suspicious as it has no effect.
972 			 */
973 			if ((cap->c_tag == CA_SUNW_SF_1) &&
974 			    (ehdr->e_ident[EI_CLASS] == ELFCLASS32) &&
975 			    (cap->c_un.c_val & SF1_SUNW_ADDR32)) {
976 				(void) fprintf(stderr,
977 				    MSG_INTL(MSG_WARN_INADDR32SF1),
978 				    file, ccache->c_name);
979 			}
980 		}
981 	} else
982 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP1), file);
983 
984 	/*
985 	 * If this object is an executable or shared object, then the
986 	 * hardware/software capabilities section should have an accompanying
987 	 * program header.
988 	 */
989 	if (cshdr && ((ehdr->e_type == ET_EXEC) || (ehdr->e_type == ET_DYN))) {
990 		if (cphdr_off == 0)
991 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP2),
992 			    file, ccache->c_name);
993 		else if ((cphdr_off != cshdr->sh_offset) ||
994 		    (cphdr_sz != cshdr->sh_size))
995 			(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVCAP3),
996 			    file, ccache->c_name);
997 	}
998 }
999 
1000 /*
1001  * Print the interpretor.
1002  */
1003 static void
1004 interp(const char *file, Cache *cache, Word shnum, Word phnum, Elf *elf)
1005 {
1006 	static Word phdr_types[] = { PT_INTERP };
1007 
1008 
1009 	Word	cnt;
1010 	Shdr	*ishdr = NULL;
1011 	Cache	*icache;
1012 	Off	iphdr_off = 0;
1013 	Xword	iphdr_fsz;
1014 
1015 	/*
1016 	 * Determine if an interp header exists.
1017 	 */
1018 	if (phnum) {
1019 		Phdr	*phdr;
1020 
1021 		phdr = getphdr(phnum, phdr_types,
1022 		    sizeof (phdr_types) / sizeof (*phdr_types), file, elf);
1023 		if (phdr != NULL) {
1024 			iphdr_off = phdr->p_offset;
1025 			iphdr_fsz = phdr->p_filesz;
1026 		}
1027 	}
1028 
1029 	if (iphdr_off == 0)
1030 		return;
1031 
1032 	/*
1033 	 * Determine if an interp section exists.
1034 	 */
1035 	for (cnt = 1; cnt < shnum; cnt++) {
1036 		Cache	*_cache = &cache[cnt];
1037 		Shdr	*shdr = _cache->c_shdr;
1038 
1039 		/*
1040 		 * Scan sections to find a section which contains the PT_INTERP
1041 		 * string.  The target section can't be in a NOBITS section.
1042 		 */
1043 		if ((shdr->sh_type == SHT_NOBITS) ||
1044 		    (iphdr_off < shdr->sh_offset) ||
1045 		    (iphdr_off + iphdr_fsz) > (shdr->sh_offset + shdr->sh_size))
1046 			continue;
1047 
1048 		icache = _cache;
1049 		ishdr = shdr;
1050 		break;
1051 	}
1052 
1053 	/*
1054 	 * Print the interpreter string based on the offset defined in the
1055 	 * program header, as this is the offset used by the kernel.
1056 	 */
1057 	if (ishdr && icache->c_data) {
1058 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1059 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_INTERP), icache->c_name);
1060 		dbg_print(0, MSG_ORIG(MSG_FMT_INDENT),
1061 		    (char *)icache->c_data->d_buf +
1062 		    (iphdr_off - ishdr->sh_offset));
1063 	} else
1064 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVINTERP1), file);
1065 
1066 	/*
1067 	 * If there are any inconsistences between the program header and
1068 	 * section information, flag them.
1069 	 */
1070 	if (ishdr && ((iphdr_off != ishdr->sh_offset) ||
1071 	    (iphdr_fsz != ishdr->sh_size))) {
1072 		(void) fprintf(stderr, MSG_INTL(MSG_WARN_INVINTERP2), file,
1073 		    icache->c_name);
1074 	}
1075 }
1076 
1077 /*
1078  * Print the syminfo section.
1079  */
1080 static void
1081 syminfo(Cache *cache, Word shnum, const char *file)
1082 {
1083 	Shdr		*infoshdr;
1084 	Syminfo		*info;
1085 	Sym		*syms;
1086 	Dyn		*dyns;
1087 	Word		infonum, cnt, ndx, symnum;
1088 	Cache		*infocache = NULL, *symsec, *strsec;
1089 
1090 	for (cnt = 1; cnt < shnum; cnt++) {
1091 		if (cache[cnt].c_shdr->sh_type == SHT_SUNW_syminfo) {
1092 			infocache = &cache[cnt];
1093 			break;
1094 		}
1095 	}
1096 	if (infocache == NULL)
1097 		return;
1098 
1099 	infoshdr = infocache->c_shdr;
1100 	if ((infoshdr->sh_entsize == 0) || (infoshdr->sh_size == 0)) {
1101 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1102 		    file, infocache->c_name);
1103 		return;
1104 	}
1105 	if (infocache->c_data == NULL)
1106 		return;
1107 
1108 	infonum = (Word)(infoshdr->sh_size / infoshdr->sh_entsize);
1109 	info = (Syminfo *)infocache->c_data->d_buf;
1110 
1111 	/*
1112 	 * Get the data buffer of the associated dynamic section.
1113 	 */
1114 	if ((infoshdr->sh_info == 0) || (infoshdr->sh_info >= shnum)) {
1115 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHINFO),
1116 		    file, infocache->c_name, EC_WORD(infoshdr->sh_info));
1117 		return;
1118 	}
1119 	if (cache[infoshdr->sh_info].c_data == NULL)
1120 		return;
1121 
1122 	dyns = cache[infoshdr->sh_info].c_data->d_buf;
1123 	if (dyns == NULL) {
1124 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1125 		    file, cache[infoshdr->sh_info].c_name);
1126 		return;
1127 	}
1128 
1129 	/*
1130 	 * Get the data buffer for the associated symbol table and string table.
1131 	 */
1132 	if (stringtbl(cache, 1, cnt, shnum, file,
1133 	    &symnum, &symsec, &strsec) == 0)
1134 		return;
1135 
1136 	syms = symsec->c_data->d_buf;
1137 
1138 	/*
1139 	 * Loop through the syminfo entries.
1140 	 */
1141 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1142 	dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMINFO), infocache->c_name);
1143 	Elf_syminfo_title(0);
1144 
1145 	for (ndx = 1, info++; ndx < infonum; ndx++, info++) {
1146 		Sym 		*sym;
1147 		const char	*needed = NULL, *name;
1148 
1149 		if ((info->si_flags == 0) && (info->si_boundto == 0))
1150 			continue;
1151 
1152 		sym = &syms[ndx];
1153 		name = string(infocache, ndx, strsec, file, sym->st_name);
1154 
1155 		if (info->si_boundto < SYMINFO_BT_LOWRESERVE) {
1156 			Dyn	*dyn = &dyns[info->si_boundto];
1157 
1158 			needed = string(infocache, info->si_boundto,
1159 			    strsec, file, dyn->d_un.d_val);
1160 		}
1161 		Elf_syminfo_entry(0, ndx, info, name, needed);
1162 	}
1163 }
1164 
1165 /*
1166  * Print version definition section entries.
1167  */
1168 static void
1169 version_def(Verdef *vdf, Word vdf_num, Cache *vcache, Cache *scache,
1170     const char *file)
1171 {
1172 	Word	cnt;
1173 	char	index[MAXNDXSIZE];
1174 
1175 	Elf_ver_def_title(0);
1176 
1177 	for (cnt = 1; cnt <= vdf_num; cnt++,
1178 	    vdf = (Verdef *)((uintptr_t)vdf + vdf->vd_next)) {
1179 		Conv_ver_flags_buf_t	ver_flags_buf;
1180 		const char		*name, *dep;
1181 		Half			vcnt = vdf->vd_cnt - 1;
1182 		Half			ndx = vdf->vd_ndx;
1183 		Verdaux	*vdap = (Verdaux *)((uintptr_t)vdf + vdf->vd_aux);
1184 
1185 		/*
1186 		 * Obtain the name and first dependency (if any).
1187 		 */
1188 		name = string(vcache, cnt, scache, file, vdap->vda_name);
1189 		vdap = (Verdaux *)((uintptr_t)vdap + vdap->vda_next);
1190 		if (vcnt)
1191 			dep = string(vcache, cnt, scache, file, vdap->vda_name);
1192 		else
1193 			dep = MSG_ORIG(MSG_STR_EMPTY);
1194 
1195 		(void) snprintf(index, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX),
1196 		    EC_XWORD(ndx));
1197 		Elf_ver_line_1(0, index, name, dep,
1198 		    conv_ver_flags(vdf->vd_flags, 0, &ver_flags_buf));
1199 
1200 		/*
1201 		 * Print any additional dependencies.
1202 		 */
1203 		if (vcnt) {
1204 			vdap = (Verdaux *)((uintptr_t)vdap + vdap->vda_next);
1205 			for (vcnt--; vcnt; vcnt--,
1206 			    vdap = (Verdaux *)((uintptr_t)vdap +
1207 			    vdap->vda_next)) {
1208 				dep = string(vcache, cnt, scache, file,
1209 				    vdap->vda_name);
1210 				Elf_ver_line_2(0, MSG_ORIG(MSG_STR_EMPTY), dep);
1211 			}
1212 		}
1213 	}
1214 }
1215 
1216 /*
1217  * Print version needed section entries.
1218  *
1219  * entry:
1220  *	vnd - Address of verneed data
1221  *	vnd_num - # of Verneed entries
1222  *	vcache - Cache of verneed section being processed
1223  *	scache - Cache of associated string table section
1224  *	file - Name of object being processed.
1225  *	versym - Information about versym section
1226  *
1227  * exit:
1228  *	The versions have been printed. If GNU style versioning
1229  *	is in effect, versym->max_verndx has been updated to
1230  *	contain the largest version index seen.
1231  *
1232  * note:
1233  * 	The versym section of an object that follows the original
1234  *	Solaris versioning rules only contains indexes into the verdef
1235  *	section. Symbols defined in other objects (UNDEF) are given
1236  *	a version of 0, indicating that they are not defined by
1237  *	this file, and the Verneed entries do not have associated version
1238  *	indexes. For these reasons, we do not display a version index
1239  *	for original-style Verneed sections.
1240  *
1241  *	The GNU versioning extensions alter this: Symbols defined in other
1242  *	objects receive a version index in the range above those defined
1243  *	by the Verdef section, and the vna_other field of the Vernaux
1244  *	structs inside the Verneed section contain the version index for
1245  *	that item. We therefore  display the index when showing the
1246  *	contents of a GNU style Verneed section. You should not
1247  *	necessarily expect these indexes to appear in sorted
1248  *	order --- it seems that the GNU ld assigns the versions as
1249  *	symbols are encountered during linking, and then the results
1250  *	are assembled into the Verneed section afterwards.
1251  */
1252 static void
1253 version_need(Verneed *vnd, Word vnd_num, Cache *vcache, Cache *scache,
1254     const char *file, VERSYM_STATE *versym)
1255 {
1256 	Word		cnt;
1257 	char		index[MAXNDXSIZE];
1258 	const char	*index_str;
1259 
1260 	Elf_ver_need_title(0, versym->gnu_needed);
1261 
1262 	for (cnt = 1; cnt <= vnd_num; cnt++,
1263 	    vnd = (Verneed *)((uintptr_t)vnd + vnd->vn_next)) {
1264 		Conv_ver_flags_buf_t	ver_flags_buf;
1265 		const char		*name, *dep;
1266 		Half			vcnt = vnd->vn_cnt;
1267 		Vernaux *vnap = (Vernaux *)((uintptr_t)vnd + vnd->vn_aux);
1268 
1269 		/*
1270 		 * Obtain the name of the needed file and the version name
1271 		 * within it that we're dependent on.  Note that the count
1272 		 * should be at least one, otherwise this is a pretty bogus
1273 		 * entry.
1274 		 */
1275 		name = string(vcache, cnt, scache, file, vnd->vn_file);
1276 		if (vcnt)
1277 			dep = string(vcache, cnt, scache, file, vnap->vna_name);
1278 		else
1279 			dep = MSG_INTL(MSG_STR_NULL);
1280 
1281 		if (vnap->vna_other == 0) {	/* Traditional form */
1282 			index_str = MSG_ORIG(MSG_STR_EMPTY);
1283 		} else {			/* GNU form */
1284 			index_str = index;
1285 			/* Format the version index value */
1286 			(void) snprintf(index, MAXNDXSIZE,
1287 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(vnap->vna_other));
1288 			if (vnap->vna_other > versym->max_verndx)
1289 				versym->max_verndx = vnap->vna_other;
1290 		}
1291 		Elf_ver_line_1(0, index_str, name, dep,
1292 		    conv_ver_flags(vnap->vna_flags, 0, &ver_flags_buf));
1293 
1294 		/*
1295 		 * Print any additional version dependencies.
1296 		 */
1297 		if (vcnt) {
1298 			vnap = (Vernaux *)((uintptr_t)vnap + vnap->vna_next);
1299 			for (vcnt--; vcnt; vcnt--,
1300 			    vnap = (Vernaux *)((uintptr_t)vnap +
1301 			    vnap->vna_next)) {
1302 				dep = string(vcache, cnt, scache, file,
1303 				    vnap->vna_name);
1304 				if (vnap->vna_other > 0) {
1305 					/* Format the next index value */
1306 					(void) snprintf(index, MAXNDXSIZE,
1307 					    MSG_ORIG(MSG_FMT_INDEX),
1308 					    EC_XWORD(vnap->vna_other));
1309 					Elf_ver_line_1(0, index,
1310 					    MSG_ORIG(MSG_STR_EMPTY), dep,
1311 					    conv_ver_flags(vnap->vna_flags,
1312 					    0, &ver_flags_buf));
1313 					if (vnap->vna_other >
1314 					    versym->max_verndx)
1315 						versym->max_verndx =
1316 						    vnap->vna_other;
1317 				} else {
1318 					Elf_ver_line_3(0,
1319 					    MSG_ORIG(MSG_STR_EMPTY), dep,
1320 					    conv_ver_flags(vnap->vna_flags,
1321 					    0, &ver_flags_buf));
1322 				}
1323 			}
1324 		}
1325 	}
1326 }
1327 
1328 /*
1329  * Examine the Verneed section for information related to GNU
1330  * style Versym indexing:
1331  *	- A non-zero vna_other field indicates that Versym indexes can
1332  *		reference Verneed records.
1333  *	- If the object uses GNU style Versym indexing, the
1334  *	  maximum index value is needed to detect bad Versym entries.
1335  *
1336  * entry:
1337  *	vnd - Address of verneed data
1338  *	vnd_num - # of Verneed entries
1339  *	versym - Information about versym section
1340  *
1341  * exit:
1342  *	If a non-zero vna_other field is seen, versym->gnu_needed is set.
1343  *
1344  *	versym->max_verndx has been updated to contain the largest
1345  *	version index seen.
1346  */
1347 static void
1348 update_gnu_verndx(Verneed *vnd, Word vnd_num, VERSYM_STATE *versym)
1349 {
1350 	Word		cnt;
1351 
1352 	for (cnt = 1; cnt <= vnd_num; cnt++,
1353 	    vnd = (Verneed *)((uintptr_t)vnd + vnd->vn_next)) {
1354 		Half	vcnt = vnd->vn_cnt;
1355 		Vernaux	*vnap = (Vernaux *)((uintptr_t)vnd + vnd->vn_aux);
1356 
1357 		/*
1358 		 * A non-zero value of vna_other indicates that this
1359 		 * object references VERNEED items from the VERSYM
1360 		 * array.
1361 		 */
1362 		if (vnap->vna_other != 0) {
1363 			versym->gnu_needed = 1;
1364 			if (vnap->vna_other > versym->max_verndx)
1365 				versym->max_verndx = vnap->vna_other;
1366 		}
1367 
1368 		/*
1369 		 * Check any additional version dependencies.
1370 		 */
1371 		if (vcnt) {
1372 			vnap = (Vernaux *)((uintptr_t)vnap + vnap->vna_next);
1373 			for (vcnt--; vcnt; vcnt--,
1374 			    vnap = (Vernaux *)((uintptr_t)vnap +
1375 			    vnap->vna_next)) {
1376 				if (vnap->vna_other == 0)
1377 					continue;
1378 
1379 				versym->gnu_needed = 1;
1380 				if (vnap->vna_other > versym->max_verndx)
1381 					versym->max_verndx = vnap->vna_other;
1382 			}
1383 		}
1384 	}
1385 }
1386 
1387 /*
1388  * Display version section information if the flags require it.
1389  * Return version information needed by other output.
1390  *
1391  * entry:
1392  *	cache - Cache of all section headers
1393  *	shnum - # of sections in cache
1394  *	file - Name of file
1395  *	flags - Command line option flags
1396  *	versym - VERSYM_STATE block to be filled in.
1397  */
1398 static void
1399 versions(Cache *cache, Word shnum, const char *file, uint_t flags,
1400     VERSYM_STATE *versym)
1401 {
1402 	GElf_Word	cnt;
1403 	Cache		*verdef_cache = NULL, *verneed_cache = NULL;
1404 
1405 
1406 	/* Gather information about the version sections */
1407 	bzero(versym, sizeof (*versym));
1408 	versym->max_verndx = 1;
1409 	for (cnt = 1; cnt < shnum; cnt++) {
1410 		Cache		*_cache = &cache[cnt];
1411 		Shdr		*shdr = _cache->c_shdr;
1412 		Dyn		*dyn;
1413 		ulong_t		numdyn;
1414 
1415 		switch (shdr->sh_type) {
1416 		case SHT_DYNAMIC:
1417 			/*
1418 			 * The GNU ld puts a DT_VERSYM entry in the dynamic
1419 			 * section so that the runtime linker can use it to
1420 			 * implement their versioning rules. They allow multiple
1421 			 * incompatible functions with the same name to exist
1422 			 * in different versions. The Solaris ld does not
1423 			 * support this mechanism, and as such, does not
1424 			 * produce DT_VERSYM. We use this fact to determine
1425 			 * which ld produced this object, and how to interpret
1426 			 * the version values.
1427 			 */
1428 			if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0) ||
1429 			    (_cache->c_data == NULL))
1430 				continue;
1431 			numdyn = shdr->sh_size / shdr->sh_entsize;
1432 			dyn = (Dyn *)_cache->c_data->d_buf;
1433 			for (; numdyn-- > 0; dyn++)
1434 				if (dyn->d_tag == DT_VERSYM) {
1435 					versym->gnu_full =
1436 					    versym->gnu_needed = 1;
1437 					break;
1438 				}
1439 			break;
1440 
1441 		case SHT_SUNW_versym:
1442 			/* Record data address for later symbol processing */
1443 			if (_cache->c_data != NULL) {
1444 				versym->cache = _cache;
1445 				versym->data = _cache->c_data->d_buf;
1446 				continue;
1447 			}
1448 			break;
1449 
1450 		case SHT_SUNW_verdef:
1451 		case SHT_SUNW_verneed:
1452 			/*
1453 			 * Ensure the data is non-NULL and the number
1454 			 * of items is non-zero. Otherwise, we don't
1455 			 * understand the section, and will not use it.
1456 			 */
1457 			if ((_cache->c_data == NULL) ||
1458 			    (_cache->c_data->d_buf == NULL)) {
1459 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1460 				    file, _cache->c_name);
1461 				continue;
1462 			}
1463 			if (shdr->sh_info == 0) {
1464 				(void) fprintf(stderr,
1465 				    MSG_INTL(MSG_ERR_BADSHINFO),
1466 				    file, _cache->c_name,
1467 				    EC_WORD(shdr->sh_info));
1468 				continue;
1469 			}
1470 
1471 			/* Make sure the string table index is in range */
1472 			if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
1473 				(void) fprintf(stderr,
1474 				    MSG_INTL(MSG_ERR_BADSHLINK), file,
1475 				    _cache->c_name, EC_WORD(shdr->sh_link));
1476 				continue;
1477 			}
1478 
1479 			/*
1480 			 * The section is usable. Save the cache entry.
1481 			 */
1482 			if (shdr->sh_type == SHT_SUNW_verdef) {
1483 				verdef_cache = _cache;
1484 				/*
1485 				 * Under Solaris rules, if there is a verdef
1486 				 * section, the max versym index is number
1487 				 * of version definitions it supplies.
1488 				 */
1489 				versym->max_verndx = shdr->sh_info;
1490 			} else {
1491 				verneed_cache = _cache;
1492 			}
1493 			break;
1494 		}
1495 	}
1496 
1497 	/*
1498 	 * If there is a Verneed section, examine it for information
1499 	 * related to GNU style versioning.
1500 	 */
1501 	if (verneed_cache != NULL)
1502 		update_gnu_verndx((Verneed *)verneed_cache->c_data->d_buf,
1503 		    verneed_cache->c_shdr->sh_info, versym);
1504 
1505 	/*
1506 	 * Now that all the information is available, display the
1507 	 * Verdef and Verneed section contents, if requested.
1508 	 */
1509 	if ((flags & FLG_SHOW_VERSIONS) == 0)
1510 		return;
1511 	if (verdef_cache != NULL) {
1512 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1513 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_VERDEF),
1514 		    verdef_cache->c_name);
1515 		version_def((Verdef *)verdef_cache->c_data->d_buf,
1516 		    verdef_cache->c_shdr->sh_info, verdef_cache,
1517 		    &cache[verdef_cache->c_shdr->sh_link], file);
1518 	}
1519 	if (verneed_cache != NULL) {
1520 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1521 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_VERNEED),
1522 		    verneed_cache->c_name);
1523 		/*
1524 		 * If GNU versioning applies to this object, version_need()
1525 		 * will update versym->max_verndx, and it is not
1526 		 * necessary to call update_gnu_verndx().
1527 		 */
1528 		version_need((Verneed *)verneed_cache->c_data->d_buf,
1529 		    verneed_cache->c_shdr->sh_info, verneed_cache,
1530 		    &cache[verneed_cache->c_shdr->sh_link], file, versym);
1531 	}
1532 }
1533 
1534 /*
1535  * Initialize a symbol table state structure
1536  *
1537  * entry:
1538  *	state - State structure to be initialized
1539  *	cache - Cache of all section headers
1540  *	shnum - # of sections in cache
1541  *	secndx - Index of symbol table section
1542  *	ehdr - ELF header for file
1543  *	versym - Information about versym section
1544  *	file - Name of file
1545  *	flags - Command line option flags
1546  */
1547 static int
1548 init_symtbl_state(SYMTBL_STATE *state, Cache *cache, Word shnum, Word secndx,
1549     Ehdr *ehdr, uchar_t osabi, VERSYM_STATE *versym, const char *file,
1550     uint_t flags)
1551 {
1552 	Shdr *shdr;
1553 
1554 	state->file = file;
1555 	state->ehdr = ehdr;
1556 	state->cache = cache;
1557 	state->osabi = osabi;
1558 	state->shnum = shnum;
1559 	state->seccache = &cache[secndx];
1560 	state->secndx = secndx;
1561 	state->secname = state->seccache->c_name;
1562 	state->flags = flags;
1563 	state->shxndx.checked = 0;
1564 	state->shxndx.data = NULL;
1565 	state->shxndx.n = 0;
1566 
1567 	shdr = state->seccache->c_shdr;
1568 
1569 	/*
1570 	 * Check the symbol data and per-item size.
1571 	 */
1572 	if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
1573 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
1574 		    file, state->secname);
1575 		return (0);
1576 	}
1577 	if (state->seccache->c_data == NULL)
1578 		return (0);
1579 
1580 	/* LINTED */
1581 	state->symn = (Word)(shdr->sh_size / shdr->sh_entsize);
1582 	state->sym = (Sym *)state->seccache->c_data->d_buf;
1583 
1584 	/*
1585 	 * Check associated string table section.
1586 	 */
1587 	if ((shdr->sh_link == 0) || (shdr->sh_link >= shnum)) {
1588 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1589 		    file, state->secname, EC_WORD(shdr->sh_link));
1590 		return (0);
1591 	}
1592 
1593 	/*
1594 	 * Determine if there is a associated Versym section
1595 	 * with this Symbol Table.
1596 	 */
1597 	if (versym->cache &&
1598 	    (versym->cache->c_shdr->sh_link == state->secndx))
1599 		state->versym = versym;
1600 	else
1601 		state->versym = NULL;
1602 
1603 
1604 	return (1);
1605 }
1606 
1607 /*
1608  * Determine the extended section index used for symbol tables entries.
1609  */
1610 static void
1611 symbols_getxindex(SYMTBL_STATE *state)
1612 {
1613 	uint_t	symn;
1614 	Word	symcnt;
1615 
1616 	state->shxndx.checked = 1;   /* Note that we've been called */
1617 	for (symcnt = 1; symcnt < state->shnum; symcnt++) {
1618 		Cache	*_cache = &state->cache[symcnt];
1619 		Shdr	*shdr = _cache->c_shdr;
1620 
1621 		if ((shdr->sh_type != SHT_SYMTAB_SHNDX) ||
1622 		    (shdr->sh_link != state->secndx))
1623 			continue;
1624 
1625 		if ((shdr->sh_entsize) &&
1626 		    /* LINTED */
1627 		    ((symn = (uint_t)(shdr->sh_size / shdr->sh_entsize)) == 0))
1628 			continue;
1629 
1630 		if (_cache->c_data == NULL)
1631 			continue;
1632 
1633 		state->shxndx.data = _cache->c_data->d_buf;
1634 		state->shxndx.n = symn;
1635 		return;
1636 	}
1637 }
1638 
1639 /*
1640  * Produce a line of output for the given symbol
1641  *
1642  * entry:
1643  *	state - Symbol table state
1644  *	symndx - Index of symbol within the table
1645  *	info - Value of st_info (indicates local/global range)
1646  *	symndx_disp - Index to display. This may not be the same
1647  *		as symndx if the display is relative to the logical
1648  *		combination of the SUNW_ldynsym/dynsym tables.
1649  *	sym - Symbol to display
1650  */
1651 static void
1652 output_symbol(SYMTBL_STATE *state, Word symndx, Word info, Word disp_symndx,
1653     Sym *sym)
1654 {
1655 	/*
1656 	 * Symbol types for which we check that the specified
1657 	 * address/size land inside the target section.
1658 	 */
1659 	static const int addr_symtype[] = {
1660 		0,			/* STT_NOTYPE */
1661 		1,			/* STT_OBJECT */
1662 		1,			/* STT_FUNC */
1663 		0,			/* STT_SECTION */
1664 		0,			/* STT_FILE */
1665 		1,			/* STT_COMMON */
1666 		0,			/* STT_TLS */
1667 		0,			/* 7 */
1668 		0,			/* 8 */
1669 		0,			/* 9 */
1670 		0,			/* 10 */
1671 		0,			/* 11 */
1672 		0,			/* 12 */
1673 		0,			/* STT_SPARC_REGISTER */
1674 		0,			/* 14 */
1675 		0,			/* 15 */
1676 	};
1677 #if STT_NUM != (STT_TLS + 1)
1678 #error "STT_NUM has grown. Update addr_symtype[]"
1679 #endif
1680 
1681 	char		index[MAXNDXSIZE];
1682 	const char	*symname, *sec;
1683 	Versym		verndx;
1684 	int		gnuver;
1685 	uchar_t		type;
1686 	Shdr		*tshdr;
1687 	Word		shndx;
1688 	Conv_inv_buf_t	inv_buf;
1689 
1690 	/* Ensure symbol index is in range */
1691 	if (symndx >= state->symn) {
1692 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSORTNDX),
1693 		    state->file, state->secname, EC_WORD(symndx));
1694 		return;
1695 	}
1696 
1697 	/*
1698 	 * If we are using extended symbol indexes, find the
1699 	 * corresponding SHN_SYMTAB_SHNDX table.
1700 	 */
1701 	if ((sym->st_shndx == SHN_XINDEX) && (state->shxndx.checked == 0))
1702 		symbols_getxindex(state);
1703 
1704 	/* LINTED */
1705 	symname = string(state->seccache, symndx,
1706 	    &state->cache[state->seccache->c_shdr->sh_link], state->file,
1707 	    sym->st_name);
1708 
1709 	tshdr = NULL;
1710 	sec = NULL;
1711 
1712 	if (state->ehdr->e_type == ET_CORE) {
1713 		sec = (char *)MSG_INTL(MSG_STR_UNKNOWN);
1714 	} else if (state->flags & FLG_CTL_FAKESHDR) {
1715 		/*
1716 		 * If we are using fake section headers derived from
1717 		 * the program headers, then the section indexes
1718 		 * in the symbols do not correspond to these headers.
1719 		 * The section names are not available, so all we can
1720 		 * do is to display them in numeric form.
1721 		 */
1722 		sec = conv_sym_shndx(state->osabi, state->ehdr->e_machine,
1723 		    sym->st_shndx, CONV_FMT_DECIMAL, &inv_buf);
1724 	} else if ((sym->st_shndx < SHN_LORESERVE) &&
1725 	    (sym->st_shndx < state->shnum)) {
1726 		shndx = sym->st_shndx;
1727 		tshdr = state->cache[shndx].c_shdr;
1728 		sec = state->cache[shndx].c_name;
1729 	} else if (sym->st_shndx == SHN_XINDEX) {
1730 		if (state->shxndx.data) {
1731 			Word	_shxndx;
1732 
1733 			if (symndx > state->shxndx.n) {
1734 				(void) fprintf(stderr,
1735 				    MSG_INTL(MSG_ERR_BADSYMXINDEX1),
1736 				    state->file, state->secname,
1737 				    EC_WORD(symndx));
1738 			} else if ((_shxndx =
1739 			    state->shxndx.data[symndx]) > state->shnum) {
1740 				(void) fprintf(stderr,
1741 				    MSG_INTL(MSG_ERR_BADSYMXINDEX2),
1742 				    state->file, state->secname,
1743 				    EC_WORD(symndx), EC_WORD(_shxndx));
1744 			} else {
1745 				shndx = _shxndx;
1746 				tshdr = state->cache[shndx].c_shdr;
1747 				sec = state->cache[shndx].c_name;
1748 			}
1749 		} else {
1750 			(void) fprintf(stderr,
1751 			    MSG_INTL(MSG_ERR_BADSYMXINDEX3),
1752 			    state->file, state->secname, EC_WORD(symndx));
1753 		}
1754 	} else if ((sym->st_shndx < SHN_LORESERVE) &&
1755 	    (sym->st_shndx >= state->shnum)) {
1756 		(void) fprintf(stderr,
1757 		    MSG_INTL(MSG_ERR_BADSYM5), state->file,
1758 		    state->secname, EC_WORD(symndx),
1759 		    demangle(symname, state->flags), sym->st_shndx);
1760 	}
1761 
1762 	/*
1763 	 * If versioning is available display the
1764 	 * version index. If not, then use 0.
1765 	 */
1766 	if (state->versym) {
1767 		Versym test_verndx;
1768 
1769 		verndx = test_verndx = state->versym->data[symndx];
1770 		gnuver = state->versym->gnu_full;
1771 
1772 		/*
1773 		 * Check to see if this is a defined symbol with a
1774 		 * version index that is outside the valid range for
1775 		 * the file. The interpretation of this depends on
1776 		 * the style of versioning used by the object.
1777 		 *
1778 		 * Versions >= VER_NDX_LORESERVE have special meanings,
1779 		 * and are exempt from this checking.
1780 		 *
1781 		 * GNU style version indexes use the top bit of the
1782 		 * 16-bit index value (0x8000) as the "hidden bit".
1783 		 * We must mask off this bit in order to compare
1784 		 * the version against the maximum value.
1785 		 */
1786 		if (gnuver)
1787 			test_verndx &= ~0x8000;
1788 
1789 		if ((test_verndx > state->versym->max_verndx) &&
1790 		    (verndx < VER_NDX_LORESERVE))
1791 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADVER),
1792 			    state->file, state->secname, EC_WORD(symndx),
1793 			    EC_HALF(test_verndx), state->versym->max_verndx);
1794 	} else {
1795 		verndx = 0;
1796 		gnuver = 0;
1797 	}
1798 
1799 	/*
1800 	 * Error checking for TLS.
1801 	 */
1802 	type = ELF_ST_TYPE(sym->st_info);
1803 	if (type == STT_TLS) {
1804 		if (tshdr &&
1805 		    (sym->st_shndx != SHN_UNDEF) &&
1806 		    ((tshdr->sh_flags & SHF_TLS) == 0)) {
1807 			(void) fprintf(stderr,
1808 			    MSG_INTL(MSG_ERR_BADSYM3), state->file,
1809 			    state->secname, EC_WORD(symndx),
1810 			    demangle(symname, state->flags));
1811 		}
1812 	} else if ((type != STT_SECTION) && sym->st_size &&
1813 	    tshdr && (tshdr->sh_flags & SHF_TLS)) {
1814 		(void) fprintf(stderr,
1815 		    MSG_INTL(MSG_ERR_BADSYM4), state->file,
1816 		    state->secname, EC_WORD(symndx),
1817 		    demangle(symname, state->flags));
1818 	}
1819 
1820 	/*
1821 	 * If a symbol with non-zero size has a type that
1822 	 * specifies an address, then make sure the location
1823 	 * it references is actually contained within the
1824 	 * section.  UNDEF symbols don't count in this case,
1825 	 * so we ignore them.
1826 	 *
1827 	 * The meaning of the st_value field in a symbol
1828 	 * depends on the type of object. For a relocatable
1829 	 * object, it is the offset within the section.
1830 	 * For sharable objects, it is the offset relative to
1831 	 * the base of the object, and for other types, it is
1832 	 * the virtual address. To get an offset within the
1833 	 * section for non-ET_REL files, we subtract the
1834 	 * base address of the section.
1835 	 */
1836 	if (addr_symtype[type] && (sym->st_size > 0) &&
1837 	    (sym->st_shndx != SHN_UNDEF) && ((sym->st_shndx < SHN_LORESERVE) ||
1838 	    (sym->st_shndx == SHN_XINDEX)) && (tshdr != NULL)) {
1839 		Word v = sym->st_value;
1840 			if (state->ehdr->e_type != ET_REL)
1841 				v -= tshdr->sh_addr;
1842 		if (((v + sym->st_size) > tshdr->sh_size)) {
1843 			(void) fprintf(stderr,
1844 			    MSG_INTL(MSG_ERR_BADSYM6), state->file,
1845 			    state->secname, EC_WORD(symndx),
1846 			    demangle(symname, state->flags),
1847 			    EC_WORD(shndx), EC_XWORD(tshdr->sh_size),
1848 			    EC_XWORD(sym->st_value), EC_XWORD(sym->st_size));
1849 		}
1850 	}
1851 
1852 	/*
1853 	 * A typical symbol table uses the sh_info field to indicate one greater
1854 	 * than the symbol table index of the last local symbol, STB_LOCAL.
1855 	 * Therefore, symbol indexes less than sh_info should have local
1856 	 * binding.  Symbol indexes greater than, or equal to sh_info, should
1857 	 * have global binding.  Note, we exclude UNDEF/NOTY symbols with zero
1858 	 * value and size, as these symbols may be the result of an mcs(1)
1859 	 * section deletion.
1860 	 */
1861 	if (info) {
1862 		uchar_t	bind = ELF_ST_BIND(sym->st_info);
1863 
1864 		if ((symndx < info) && (bind != STB_LOCAL)) {
1865 			(void) fprintf(stderr,
1866 			    MSG_INTL(MSG_ERR_BADSYM7), state->file,
1867 			    state->secname, EC_WORD(symndx),
1868 			    demangle(symname, state->flags), EC_XWORD(info));
1869 
1870 		} else if ((symndx >= info) && (bind == STB_LOCAL) &&
1871 		    ((sym->st_shndx != SHN_UNDEF) ||
1872 		    (ELF_ST_TYPE(sym->st_info) != STT_NOTYPE) ||
1873 		    (sym->st_size != 0) || (sym->st_value != 0))) {
1874 			(void) fprintf(stderr,
1875 			    MSG_INTL(MSG_ERR_BADSYM8), state->file,
1876 			    state->secname, EC_WORD(symndx),
1877 			    demangle(symname, state->flags), EC_XWORD(info));
1878 		}
1879 	}
1880 
1881 	(void) snprintf(index, MAXNDXSIZE,
1882 	    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(disp_symndx));
1883 	Elf_syms_table_entry(0, ELF_DBG_ELFDUMP, index, state->osabi,
1884 	    state->ehdr->e_machine, sym, verndx, gnuver, sec, symname);
1885 }
1886 
1887 /*
1888  * Search for and process any symbol tables.
1889  */
1890 void
1891 symbols(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi,
1892     VERSYM_STATE *versym, const char *file, uint_t flags)
1893 {
1894 	SYMTBL_STATE state;
1895 	Cache *_cache;
1896 	Word secndx;
1897 
1898 	for (secndx = 1; secndx < shnum; secndx++) {
1899 		Word		symcnt;
1900 		Shdr		*shdr;
1901 
1902 		_cache = &cache[secndx];
1903 		shdr = _cache->c_shdr;
1904 
1905 		if ((shdr->sh_type != SHT_SYMTAB) &&
1906 		    (shdr->sh_type != SHT_DYNSYM) &&
1907 		    ((shdr->sh_type != SHT_SUNW_LDYNSYM) ||
1908 		    (osabi != ELFOSABI_SOLARIS)))
1909 			continue;
1910 		if (!match(MATCH_F_ALL, _cache->c_name, secndx, shdr->sh_type))
1911 			continue;
1912 
1913 		if (!init_symtbl_state(&state, cache, shnum, secndx, ehdr,
1914 		    osabi, versym, file, flags))
1915 			continue;
1916 		/*
1917 		 * Loop through the symbol tables entries.
1918 		 */
1919 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
1920 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMTAB), state.secname);
1921 		Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
1922 
1923 		for (symcnt = 0; symcnt < state.symn; symcnt++)
1924 			output_symbol(&state, symcnt, shdr->sh_info, symcnt,
1925 			    state.sym + symcnt);
1926 	}
1927 }
1928 
1929 /*
1930  * Search for and process any SHT_SUNW_symsort or SHT_SUNW_tlssort sections.
1931  * These sections are always associated with the .SUNW_ldynsym./.dynsym pair.
1932  */
1933 static void
1934 sunw_sort(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi,
1935     VERSYM_STATE *versym, const char *file, uint_t flags)
1936 {
1937 	SYMTBL_STATE	ldynsym_state,	dynsym_state;
1938 	Cache		*sortcache,	*symcache;
1939 	Shdr		*sortshdr,	*symshdr;
1940 	Word		sortsecndx,	symsecndx;
1941 	Word		ldynsym_cnt;
1942 	Word		*ndx;
1943 	Word		ndxn;
1944 	int		output_cnt = 0;
1945 	Conv_inv_buf_t	inv_buf;
1946 
1947 	for (sortsecndx = 1; sortsecndx < shnum; sortsecndx++) {
1948 
1949 		sortcache = &cache[sortsecndx];
1950 		sortshdr = sortcache->c_shdr;
1951 
1952 		if ((sortshdr->sh_type != SHT_SUNW_symsort) &&
1953 		    (sortshdr->sh_type != SHT_SUNW_tlssort))
1954 			continue;
1955 		if (!match(MATCH_F_ALL, sortcache->c_name, sortsecndx,
1956 		    sortshdr->sh_type))
1957 			continue;
1958 
1959 		/*
1960 		 * If the section references a SUNW_ldynsym, then we
1961 		 * expect to see the associated .dynsym immediately
1962 		 * following. If it references a .dynsym, there is no
1963 		 * SUNW_ldynsym. If it is any other type, then we don't
1964 		 * know what to do with it.
1965 		 */
1966 		if ((sortshdr->sh_link == 0) || (sortshdr->sh_link >= shnum)) {
1967 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
1968 			    file, sortcache->c_name,
1969 			    EC_WORD(sortshdr->sh_link));
1970 			continue;
1971 		}
1972 		symcache = &cache[sortshdr->sh_link];
1973 		symshdr = symcache->c_shdr;
1974 		symsecndx = sortshdr->sh_link;
1975 		ldynsym_cnt = 0;
1976 		switch (symshdr->sh_type) {
1977 		case SHT_SUNW_LDYNSYM:
1978 			if (!init_symtbl_state(&ldynsym_state, cache, shnum,
1979 			    symsecndx, ehdr, osabi, versym, file, flags))
1980 				continue;
1981 			ldynsym_cnt = ldynsym_state.symn;
1982 			/*
1983 			 * We know that the dynsym follows immediately
1984 			 * after the SUNW_ldynsym, and so, should be at
1985 			 * (sortshdr->sh_link + 1). However, elfdump is a
1986 			 * diagnostic tool, so we do the full paranoid
1987 			 * search instead.
1988 			 */
1989 			for (symsecndx = 1; symsecndx < shnum; symsecndx++) {
1990 				symcache = &cache[symsecndx];
1991 				symshdr = symcache->c_shdr;
1992 				if (symshdr->sh_type == SHT_DYNSYM)
1993 					break;
1994 			}
1995 			if (symsecndx >= shnum) {	/* Dynsym not found! */
1996 				(void) fprintf(stderr,
1997 				    MSG_INTL(MSG_ERR_NODYNSYM),
1998 				    file, sortcache->c_name);
1999 				continue;
2000 			}
2001 			/* Fallthrough to process associated dynsym */
2002 			/* FALLTHROUGH */
2003 		case SHT_DYNSYM:
2004 			if (!init_symtbl_state(&dynsym_state, cache, shnum,
2005 			    symsecndx, ehdr, osabi, versym, file, flags))
2006 				continue;
2007 			break;
2008 		default:
2009 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADNDXSEC),
2010 			    file, sortcache->c_name,
2011 			    conv_sec_type(osabi, ehdr->e_machine,
2012 			    symshdr->sh_type, 0, &inv_buf));
2013 			continue;
2014 		}
2015 
2016 		/*
2017 		 * Output header
2018 		 */
2019 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2020 		if (ldynsym_cnt > 0) {
2021 			dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMSORT2),
2022 			    sortcache->c_name, ldynsym_state.secname,
2023 			    dynsym_state.secname);
2024 			/*
2025 			 * The data for .SUNW_ldynsym and dynsym sections
2026 			 * is supposed to be adjacent with SUNW_ldynsym coming
2027 			 * first. Check, and issue a warning if it isn't so.
2028 			 */
2029 			if (((ldynsym_state.sym + ldynsym_state.symn)
2030 			    != dynsym_state.sym) &&
2031 			    ((flags & FLG_CTL_FAKESHDR) == 0))
2032 				(void) fprintf(stderr,
2033 				    MSG_INTL(MSG_ERR_LDYNNOTADJ), file,
2034 				    ldynsym_state.secname,
2035 				    dynsym_state.secname);
2036 		} else {
2037 			dbg_print(0, MSG_INTL(MSG_ELF_SCN_SYMSORT1),
2038 			    sortcache->c_name, dynsym_state.secname);
2039 		}
2040 		Elf_syms_table_title(0, ELF_DBG_ELFDUMP);
2041 
2042 		/* If not first one, insert a line of whitespace */
2043 		if (output_cnt++ > 0)
2044 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2045 
2046 		/*
2047 		 * SUNW_dynsymsort and SUNW_dyntlssort are arrays of
2048 		 * symbol indices. Iterate over the array entries,
2049 		 * dispaying the referenced symbols.
2050 		 */
2051 		ndxn = sortshdr->sh_size / sortshdr->sh_entsize;
2052 		ndx = (Word *)sortcache->c_data->d_buf;
2053 		for (; ndxn-- > 0; ndx++) {
2054 			if (*ndx >= ldynsym_cnt) {
2055 				Word sec_ndx = *ndx - ldynsym_cnt;
2056 
2057 				output_symbol(&dynsym_state, sec_ndx, 0,
2058 				    *ndx, dynsym_state.sym + sec_ndx);
2059 			} else {
2060 				output_symbol(&ldynsym_state, *ndx, 0,
2061 				    *ndx, ldynsym_state.sym + *ndx);
2062 			}
2063 		}
2064 	}
2065 }
2066 
2067 /*
2068  * Search for and process any relocation sections.
2069  */
2070 static void
2071 reloc(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
2072 {
2073 	Word	cnt;
2074 
2075 	for (cnt = 1; cnt < shnum; cnt++) {
2076 		Word		type, symnum;
2077 		Xword		relndx, relnum, relsize;
2078 		void		*rels;
2079 		Sym		*syms;
2080 		Cache		*symsec, *strsec;
2081 		Cache		*_cache = &cache[cnt];
2082 		Shdr		*shdr = _cache->c_shdr;
2083 		char		*relname = _cache->c_name;
2084 		Conv_inv_buf_t	inv_buf;
2085 
2086 		if (((type = shdr->sh_type) != SHT_RELA) &&
2087 		    (type != SHT_REL))
2088 			continue;
2089 		if (!match(MATCH_F_ALL, relname, cnt, type))
2090 			continue;
2091 
2092 		/*
2093 		 * Decide entry size.
2094 		 */
2095 		if (((relsize = shdr->sh_entsize) == 0) ||
2096 		    (relsize > shdr->sh_size)) {
2097 			if (type == SHT_RELA)
2098 				relsize = sizeof (Rela);
2099 			else
2100 				relsize = sizeof (Rel);
2101 		}
2102 
2103 		/*
2104 		 * Determine the number of relocations available.
2105 		 */
2106 		if (shdr->sh_size == 0) {
2107 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2108 			    file, relname);
2109 			continue;
2110 		}
2111 		if (_cache->c_data == NULL)
2112 			continue;
2113 
2114 		rels = _cache->c_data->d_buf;
2115 		relnum = shdr->sh_size / relsize;
2116 
2117 		/*
2118 		 * Get the data buffer for the associated symbol table and
2119 		 * string table.
2120 		 */
2121 		if (stringtbl(cache, 1, cnt, shnum, file,
2122 		    &symnum, &symsec, &strsec) == 0)
2123 			continue;
2124 
2125 		syms = symsec->c_data->d_buf;
2126 
2127 		/*
2128 		 * Loop through the relocation entries.
2129 		 */
2130 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2131 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_RELOC), _cache->c_name);
2132 		Elf_reloc_title(0, ELF_DBG_ELFDUMP, type);
2133 
2134 		for (relndx = 0; relndx < relnum; relndx++,
2135 		    rels = (void *)((char *)rels + relsize)) {
2136 			Half		mach = ehdr->e_machine;
2137 			char		section[BUFSIZ];
2138 			const char	*symname;
2139 			Word		symndx, reltype;
2140 			Rela		*rela;
2141 			Rel		*rel;
2142 
2143 			/*
2144 			 * Unravel the relocation and determine the symbol with
2145 			 * which this relocation is associated.
2146 			 */
2147 			if (type == SHT_RELA) {
2148 				rela = (Rela *)rels;
2149 				symndx = ELF_R_SYM(rela->r_info);
2150 				reltype = ELF_R_TYPE(rela->r_info, mach);
2151 			} else {
2152 				rel = (Rel *)rels;
2153 				symndx = ELF_R_SYM(rel->r_info);
2154 				reltype = ELF_R_TYPE(rel->r_info, mach);
2155 			}
2156 
2157 			symname = relsymname(cache, _cache, strsec, symndx,
2158 			    symnum, relndx, syms, section, BUFSIZ, file);
2159 
2160 			/*
2161 			 * A zero symbol index is only valid for a few
2162 			 * relocations.
2163 			 */
2164 			if (symndx == 0) {
2165 				int	badrel = 0;
2166 
2167 				if ((mach == EM_SPARC) ||
2168 				    (mach == EM_SPARC32PLUS) ||
2169 				    (mach == EM_SPARCV9)) {
2170 					if ((reltype != R_SPARC_NONE) &&
2171 					    (reltype != R_SPARC_REGISTER) &&
2172 					    (reltype != R_SPARC_RELATIVE))
2173 						badrel++;
2174 				} else if (mach == EM_386) {
2175 					if ((reltype != R_386_NONE) &&
2176 					    (reltype != R_386_RELATIVE))
2177 						badrel++;
2178 				} else if (mach == EM_AMD64) {
2179 					if ((reltype != R_AMD64_NONE) &&
2180 					    (reltype != R_AMD64_RELATIVE))
2181 						badrel++;
2182 				}
2183 
2184 				if (badrel) {
2185 					(void) fprintf(stderr,
2186 					    MSG_INTL(MSG_ERR_BADREL1), file,
2187 					    conv_reloc_type(mach, reltype,
2188 					    0, &inv_buf));
2189 				}
2190 			}
2191 
2192 			Elf_reloc_entry_1(0, ELF_DBG_ELFDUMP,
2193 			    MSG_ORIG(MSG_STR_EMPTY), ehdr->e_machine, type,
2194 			    rels, relname, symname, 0);
2195 		}
2196 	}
2197 }
2198 
2199 
2200 /*
2201  * This value controls which test dyn_test() performs.
2202  */
2203 typedef enum { DYN_TEST_ADDR, DYN_TEST_SIZE, DYN_TEST_ENTSIZE } dyn_test_t;
2204 
2205 /*
2206  * Used by dynamic() to compare the value of a dynamic element against
2207  * the starting address of the section it references.
2208  *
2209  * entry:
2210  *	test_type - Specify which dyn item is being tested.
2211  *	sh_type - SHT_* type value for required section.
2212  *	sec_cache - Cache entry for section, or NULL if the object lacks
2213  *		a section of this type.
2214  *	dyn - Dyn entry to be tested
2215  *	dynsec_cnt - # of dynamic section being examined. The first
2216  *		dynamic section is 1, the next is 2, and so on...
2217  *	ehdr - ELF header for file
2218  *	file - Name of file
2219  */
2220 static void
2221 dyn_test(dyn_test_t test_type, Word sh_type, Cache *sec_cache, Dyn *dyn,
2222     Word dynsec_cnt, Ehdr *ehdr, uchar_t osabi, const char *file)
2223 {
2224 	Conv_inv_buf_t	buf1, buf2;
2225 
2226 	/*
2227 	 * These tests are based around the implicit assumption that
2228 	 * there is only one dynamic section in an object, and also only
2229 	 * one of the sections it references. We have therefore gathered
2230 	 * all of the necessary information to test this in a single pass
2231 	 * over the section headers, which is very efficient. We are not
2232 	 * aware of any case where more than one dynamic section would
2233 	 * be meaningful in an ELF object, so this is a reasonable solution.
2234 	 *
2235 	 * To test multiple dynamic sections correctly would be more
2236 	 * expensive in code and time. We would have to build a data structure
2237 	 * containing all the dynamic elements. Then, we would use the address
2238 	 * to locate the section it references and ensure the section is of
2239 	 * the right type and that the address in the dynamic element is
2240 	 * to the start of the section. Then, we could check the size and
2241 	 * entsize values against those same sections. This is O(n^2), and
2242 	 * also complicated.
2243 	 *
2244 	 * In the highly unlikely case that there is more than one dynamic
2245 	 * section, we only test the first one, and simply allow the values
2246 	 * of the subsequent one to be displayed unchallenged.
2247 	 */
2248 	if (dynsec_cnt != 1)
2249 		return;
2250 
2251 	/*
2252 	 * A DT_ item that references a section address should always find
2253 	 * the section in the file.
2254 	 */
2255 	if (sec_cache == NULL) {
2256 		const char *name;
2257 
2258 		/*
2259 		 * Supply section names instead of section types for
2260 		 * things that reference progbits so that the error
2261 		 * message will make more sense.
2262 		 */
2263 		switch (dyn->d_tag) {
2264 		case DT_INIT:
2265 			name = MSG_ORIG(MSG_ELF_INIT);
2266 			break;
2267 		case DT_FINI:
2268 			name = MSG_ORIG(MSG_ELF_FINI);
2269 			break;
2270 		default:
2271 			name = conv_sec_type(osabi, ehdr->e_machine,
2272 			    sh_type, 0, &buf1);
2273 			break;
2274 		}
2275 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_DYNNOBCKSEC), file,
2276 		    name, conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2277 		    0, &buf2));
2278 		return;
2279 	}
2280 
2281 
2282 	switch (test_type) {
2283 	case DYN_TEST_ADDR:
2284 		/* The section address should match the DT_ item value */
2285 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_addr)
2286 			(void) fprintf(stderr,
2287 			    MSG_INTL(MSG_ERR_DYNBADADDR), file,
2288 			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2289 			    0, &buf1), EC_ADDR(dyn->d_un.d_val),
2290 			    sec_cache->c_ndx, sec_cache->c_name,
2291 			    EC_ADDR(sec_cache->c_shdr->sh_addr));
2292 		break;
2293 
2294 	case DYN_TEST_SIZE:
2295 		/* The section size should match the DT_ item value */
2296 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_size)
2297 			(void) fprintf(stderr,
2298 			    MSG_INTL(MSG_ERR_DYNBADSIZE), file,
2299 			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2300 			    0, &buf1), EC_XWORD(dyn->d_un.d_val),
2301 			    sec_cache->c_ndx, sec_cache->c_name,
2302 			    EC_XWORD(sec_cache->c_shdr->sh_size));
2303 		break;
2304 
2305 	case DYN_TEST_ENTSIZE:
2306 		/* The sh_entsize value should match the DT_ item value */
2307 		if (dyn->d_un.d_val != sec_cache->c_shdr->sh_entsize)
2308 			(void) fprintf(stderr,
2309 			    MSG_INTL(MSG_ERR_DYNBADENTSIZE), file,
2310 			    conv_dyn_tag(dyn->d_tag, osabi, ehdr->e_machine,
2311 			    0, &buf1), EC_XWORD(dyn->d_un.d_val),
2312 			    sec_cache->c_ndx, sec_cache->c_name,
2313 			    EC_XWORD(sec_cache->c_shdr->sh_entsize));
2314 		break;
2315 	}
2316 }
2317 
2318 
2319 /*
2320  * There are some DT_ entries that have corresponding symbols
2321  * (e.g. DT_INIT and _init). It is expected that these items will
2322  * both have the same value if both are present. This routine
2323  * examines the well known symbol tables for such symbols and
2324  * issues warnings for any that don't match.
2325  *
2326  * entry:
2327  *	dyn - Dyn entry to be tested
2328  *	symname - Name of symbol that corresponds to dyn
2329  *	symtab_cache, dynsym_cache, ldynsym_cache - Symbol tables to check
2330  *	target_cache - Section the symname section is expected to be
2331  *		associated with.
2332  *	cache - Cache of all section headers
2333  *	shnum - # of sections in cache
2334  *	ehdr - ELF header for file
2335  *	osabi - OSABI to apply when interpreting object
2336  *	file - Name of file
2337  */
2338 static void
2339 dyn_symtest(Dyn *dyn, const char *symname, Cache *symtab_cache,
2340     Cache *dynsym_cache, Cache *ldynsym_cache, Cache *target_cache,
2341     Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
2342 {
2343 	Conv_inv_buf_t	buf;
2344 	int		i;
2345 	Sym		*sym;
2346 	Cache		*_cache;
2347 
2348 	for (i = 0; i < 3; i++) {
2349 		switch (i) {
2350 		case 0:
2351 			_cache = symtab_cache;
2352 			break;
2353 		case 1:
2354 			_cache = dynsym_cache;
2355 			break;
2356 		case 2:
2357 			_cache = ldynsym_cache;
2358 			break;
2359 		}
2360 
2361 		if ((_cache != NULL) &&
2362 		    symlookup(symname, cache, shnum, &sym, target_cache,
2363 		    _cache, file) && (sym->st_value != dyn->d_un.d_val))
2364 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_DYNSYMVAL),
2365 			    file, _cache->c_name, conv_dyn_tag(dyn->d_tag,
2366 			    osabi, ehdr->e_machine, 0, &buf),
2367 			    symname, EC_ADDR(sym->st_value));
2368 	}
2369 }
2370 
2371 
2372 /*
2373  * Search for and process a .dynamic section.
2374  */
2375 static void
2376 dynamic(Cache *cache, Word shnum, Ehdr *ehdr, uchar_t osabi, const char *file)
2377 {
2378 	struct {
2379 		Cache	*symtab;
2380 		Cache	*dynstr;
2381 		Cache	*dynsym;
2382 		Cache	*hash;
2383 		Cache	*fini;
2384 		Cache	*fini_array;
2385 		Cache	*init;
2386 		Cache	*init_array;
2387 		Cache	*preinit_array;
2388 		Cache	*rel;
2389 		Cache	*rela;
2390 		Cache	*sunw_cap;
2391 		Cache	*sunw_ldynsym;
2392 		Cache	*sunw_move;
2393 		Cache	*sunw_syminfo;
2394 		Cache	*sunw_symsort;
2395 		Cache	*sunw_tlssort;
2396 		Cache	*sunw_verdef;
2397 		Cache	*sunw_verneed;
2398 		Cache	*sunw_versym;
2399 	} sec;
2400 	Word	dynsec_ndx;
2401 	Word	dynsec_num;
2402 	int	dynsec_cnt;
2403 	Word	cnt;
2404 	int	osabi_solaris = osabi == ELFOSABI_SOLARIS;
2405 
2406 	/*
2407 	 * Make a pass over all the sections, gathering section information
2408 	 * we'll need below.
2409 	 */
2410 	dynsec_num = 0;
2411 	bzero(&sec, sizeof (sec));
2412 	for (cnt = 1; cnt < shnum; cnt++) {
2413 		Cache	*_cache = &cache[cnt];
2414 
2415 		switch (_cache->c_shdr->sh_type) {
2416 		case SHT_DYNAMIC:
2417 			if (dynsec_num == 0) {
2418 				dynsec_ndx = cnt;
2419 
2420 				/* Does it have a valid string table? */
2421 				(void) stringtbl(cache, 0, cnt, shnum, file,
2422 				    0, 0, &sec.dynstr);
2423 			}
2424 			dynsec_num++;
2425 			break;
2426 
2427 
2428 		case SHT_PROGBITS:
2429 			/*
2430 			 * We want to detect the .init and .fini sections,
2431 			 * if present. These are SHT_PROGBITS, so all we
2432 			 * have to go on is the section name. Normally comparing
2433 			 * names is a bad idea, but there are some special
2434 			 * names (i.e. .init/.fini/.interp) that are very
2435 			 * difficult to use in any other context, and for
2436 			 * these symbols, we do the heuristic match.
2437 			 */
2438 			if (strcmp(_cache->c_name,
2439 			    MSG_ORIG(MSG_ELF_INIT)) == 0) {
2440 				if (sec.init == NULL)
2441 					sec.init = _cache;
2442 			} else if (strcmp(_cache->c_name,
2443 			    MSG_ORIG(MSG_ELF_FINI)) == 0) {
2444 				if (sec.fini == NULL)
2445 					sec.fini = _cache;
2446 			}
2447 			break;
2448 
2449 		case SHT_REL:
2450 			/*
2451 			 * We want the SHT_REL section with the lowest
2452 			 * offset. The linker gathers them together,
2453 			 * and puts the address of the first one
2454 			 * into the DT_REL dynamic element.
2455 			 */
2456 			if ((sec.rel == NULL) ||
2457 			    (_cache->c_shdr->sh_offset <
2458 			    sec.rel->c_shdr->sh_offset))
2459 				sec.rel = _cache;
2460 			break;
2461 
2462 		case SHT_RELA:
2463 			/* RELA is handled just like RELA above */
2464 			if ((sec.rela == NULL) ||
2465 			    (_cache->c_shdr->sh_offset <
2466 			    sec.rela->c_shdr->sh_offset))
2467 				sec.rela = _cache;
2468 			break;
2469 
2470 		/*
2471 		 * The GRAB macro is used for the simple case in which
2472 		 * we simply grab the first section of the desired type.
2473 		 */
2474 #define	GRAB(_sec_type, _sec_field) \
2475 		case _sec_type: \
2476 			if (sec._sec_field == NULL) \
2477 				sec._sec_field = _cache; \
2478 				break
2479 		GRAB(SHT_SYMTAB,	symtab);
2480 		GRAB(SHT_DYNSYM,	dynsym);
2481 		GRAB(SHT_FINI_ARRAY,	fini_array);
2482 		GRAB(SHT_HASH,		hash);
2483 		GRAB(SHT_INIT_ARRAY,	init_array);
2484 		GRAB(SHT_SUNW_move,	sunw_move);
2485 		GRAB(SHT_PREINIT_ARRAY,	preinit_array);
2486 		GRAB(SHT_SUNW_cap,	sunw_cap);
2487 		GRAB(SHT_SUNW_LDYNSYM,	sunw_ldynsym);
2488 		GRAB(SHT_SUNW_syminfo,	sunw_syminfo);
2489 		GRAB(SHT_SUNW_symsort,	sunw_symsort);
2490 		GRAB(SHT_SUNW_tlssort,	sunw_tlssort);
2491 		GRAB(SHT_SUNW_verdef,	sunw_verdef);
2492 		GRAB(SHT_SUNW_verneed,	sunw_verneed);
2493 		GRAB(SHT_SUNW_versym,	sunw_versym);
2494 #undef GRAB
2495 		}
2496 	}
2497 
2498 	/*
2499 	 * If no dynamic section, return immediately. If more than one
2500 	 * dynamic section, then something odd is going on and an error
2501 	 * is in order, but then continue on and display them all.
2502 	 */
2503 	if (dynsec_num == 0)
2504 		return;
2505 	if (dynsec_num > 1)
2506 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MULTDYN),
2507 		    file, EC_WORD(dynsec_num));
2508 
2509 
2510 	dynsec_cnt = 0;
2511 	for (cnt = dynsec_ndx; (cnt < shnum) && (dynsec_cnt < dynsec_num);
2512 	    cnt++) {
2513 		Dyn	*dyn;
2514 		ulong_t	numdyn;
2515 		int	ndx, end_ndx;
2516 		Cache	*_cache = &cache[cnt], *strsec;
2517 		Shdr	*shdr = _cache->c_shdr;
2518 		int	dumped = 0;
2519 
2520 		if (shdr->sh_type != SHT_DYNAMIC)
2521 			continue;
2522 		dynsec_cnt++;
2523 
2524 		/*
2525 		 * Verify the associated string table section.
2526 		 */
2527 		if (stringtbl(cache, 0, cnt, shnum, file, 0, 0, &strsec) == 0)
2528 			continue;
2529 
2530 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
2531 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2532 			    file, _cache->c_name);
2533 			continue;
2534 		}
2535 		if (_cache->c_data == NULL)
2536 			continue;
2537 
2538 		numdyn = shdr->sh_size / shdr->sh_entsize;
2539 		dyn = (Dyn *)_cache->c_data->d_buf;
2540 
2541 		/*
2542 		 * We expect the REL/RELA entries to reference the reloc
2543 		 * section with the lowest address. However, this is
2544 		 * not true for dumped objects. Detect if this object has
2545 		 * been dumped so that we can skip the reloc address test
2546 		 * in that case.
2547 		 */
2548 		for (ndx = 0; ndx < numdyn; dyn++, ndx++) {
2549 			if (dyn->d_tag == DT_FLAGS_1) {
2550 				dumped = (dyn->d_un.d_val & DF_1_CONFALT) != 0;
2551 				break;
2552 			}
2553 		}
2554 		dyn = (Dyn *)_cache->c_data->d_buf;
2555 
2556 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2557 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_DYNAMIC), _cache->c_name);
2558 
2559 		Elf_dyn_title(0);
2560 
2561 		for (ndx = 0; ndx < numdyn; dyn++, ndx++) {
2562 			union {
2563 				Conv_inv_buf_t		inv;
2564 				Conv_dyn_flag_buf_t	flag;
2565 				Conv_dyn_flag1_buf_t	flag1;
2566 				Conv_dyn_posflag1_buf_t	posflag1;
2567 				Conv_dyn_feature1_buf_t	feature1;
2568 			} c_buf;
2569 			const char	*name = NULL;
2570 
2571 			/*
2572 			 * Print the information numerically, and if possible
2573 			 * as a string. If a string is available, name is
2574 			 * set to reference it.
2575 			 *
2576 			 * Also, take this opportunity to sanity check
2577 			 * the values of DT elements. In the code above,
2578 			 * we gathered information on sections that are
2579 			 * referenced by the dynamic section. Here, we
2580 			 * compare the attributes of those sections to
2581 			 * the DT_ items that reference them and report
2582 			 * on inconsistencies.
2583 			 *
2584 			 * Things not currently tested that could be improved
2585 			 * in later revisions include:
2586 			 *	- We don't check PLT or GOT related items
2587 			 *	- We don't handle computing the lengths of
2588 			 *		relocation arrays. To handle this
2589 			 *		requires examining data that spans
2590 			 *		across sections, in a contiguous span
2591 			 *		within a single segment.
2592 			 *	- DT_VERDEFNUM and DT_VERNEEDNUM can't be
2593 			 *		verified without parsing the sections.
2594 			 *	- We don't handle DT_SUNW_SYMSZ, which would
2595 			 *		be the sum of the lengths of .dynsym and
2596 			 *		.SUNW_ldynsym
2597 			 *	- DT_SUNW_STRPAD can't be verified other than
2598 			 *		to check that it's not larger than
2599 			 *		the string table.
2600 			 *	- Some items come in "all or none" clusters
2601 			 *		that give an address, element size,
2602 			 *		and data length in bytes. We don't
2603 			 *		verify that there are no missing items
2604 			 *		in such groups.
2605 			 */
2606 			switch (dyn->d_tag) {
2607 			case DT_NULL:
2608 				/*
2609 				 * Special case: DT_NULLs can come in groups
2610 				 * that we prefer to reduce to a single line.
2611 				 */
2612 				end_ndx = ndx;
2613 				while ((end_ndx < (numdyn - 1)) &&
2614 				    ((dyn + 1)->d_tag == DT_NULL)) {
2615 					dyn++;
2616 					end_ndx++;
2617 				}
2618 				Elf_dyn_null_entry(0, dyn, ndx, end_ndx);
2619 				ndx = end_ndx;
2620 				continue;
2621 
2622 			/*
2623 			 * String items all reference the dynstr. The string()
2624 			 * function does the necessary sanity checking.
2625 			 */
2626 			case DT_NEEDED:
2627 			case DT_SONAME:
2628 			case DT_FILTER:
2629 			case DT_AUXILIARY:
2630 			case DT_CONFIG:
2631 			case DT_RPATH:
2632 			case DT_RUNPATH:
2633 			case DT_USED:
2634 			case DT_DEPAUDIT:
2635 			case DT_AUDIT:
2636 				name = string(_cache, ndx, strsec,
2637 				    file, dyn->d_un.d_ptr);
2638 				break;
2639 
2640 			case DT_SUNW_AUXILIARY:
2641 			case DT_SUNW_FILTER:
2642 				if (osabi_solaris)
2643 					name = string(_cache, ndx, strsec,
2644 					    file, dyn->d_un.d_ptr);
2645 				break;
2646 
2647 			case DT_FLAGS:
2648 				name = conv_dyn_flag(dyn->d_un.d_val,
2649 				    0, &c_buf.flag);
2650 				break;
2651 			case DT_FLAGS_1:
2652 				name = conv_dyn_flag1(dyn->d_un.d_val, 0,
2653 				    &c_buf.flag1);
2654 				break;
2655 			case DT_POSFLAG_1:
2656 				name = conv_dyn_posflag1(dyn->d_un.d_val, 0,
2657 				    &c_buf.posflag1);
2658 				break;
2659 			case DT_FEATURE_1:
2660 				name = conv_dyn_feature1(dyn->d_un.d_val, 0,
2661 				    &c_buf.feature1);
2662 				break;
2663 			case DT_DEPRECATED_SPARC_REGISTER:
2664 				name = MSG_INTL(MSG_STR_DEPRECATED);
2665 				break;
2666 
2667 			case DT_SUNW_LDMACH:
2668 				if (!osabi_solaris)
2669 					break;
2670 				name = conv_ehdr_mach((Half)dyn->d_un.d_val,
2671 				    0, &c_buf.inv);
2672 				break;
2673 
2674 			/*
2675 			 * Cases below this point are strictly sanity checking,
2676 			 * and do not generate a name string. The TEST_ macros
2677 			 * are used to hide the boilerplate arguments neeeded
2678 			 * by dyn_test().
2679 			 */
2680 #define	TEST_ADDR(_sh_type, _sec_field) \
2681 				dyn_test(DYN_TEST_ADDR, _sh_type, \
2682 				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
2683 				    osabi, file)
2684 #define	TEST_SIZE(_sh_type, _sec_field) \
2685 				dyn_test(DYN_TEST_SIZE, _sh_type, \
2686 				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
2687 				    osabi, file)
2688 #define	TEST_ENTSIZE(_sh_type, _sec_field) \
2689 				dyn_test(DYN_TEST_ENTSIZE, _sh_type, \
2690 				    sec._sec_field, dyn, dynsec_cnt, ehdr, \
2691 				    osabi, file)
2692 
2693 			case DT_FINI:
2694 				dyn_symtest(dyn, MSG_ORIG(MSG_SYM_FINI),
2695 				    sec.symtab, sec.dynsym, sec.sunw_ldynsym,
2696 				    sec.fini, cache, shnum, ehdr, osabi, file);
2697 				TEST_ADDR(SHT_PROGBITS, fini);
2698 				break;
2699 
2700 			case DT_FINI_ARRAY:
2701 				TEST_ADDR(SHT_FINI_ARRAY, fini_array);
2702 				break;
2703 
2704 			case DT_FINI_ARRAYSZ:
2705 				TEST_SIZE(SHT_FINI_ARRAY, fini_array);
2706 				break;
2707 
2708 			case DT_HASH:
2709 				TEST_ADDR(SHT_HASH, hash);
2710 				break;
2711 
2712 			case DT_INIT:
2713 				dyn_symtest(dyn, MSG_ORIG(MSG_SYM_INIT),
2714 				    sec.symtab, sec.dynsym, sec.sunw_ldynsym,
2715 				    sec.init, cache, shnum, ehdr, osabi, file);
2716 				TEST_ADDR(SHT_PROGBITS, init);
2717 				break;
2718 
2719 			case DT_INIT_ARRAY:
2720 				TEST_ADDR(SHT_INIT_ARRAY, init_array);
2721 				break;
2722 
2723 			case DT_INIT_ARRAYSZ:
2724 				TEST_SIZE(SHT_INIT_ARRAY, init_array);
2725 				break;
2726 
2727 			case DT_MOVEENT:
2728 				TEST_ENTSIZE(SHT_SUNW_move, sunw_move);
2729 				break;
2730 
2731 			case DT_MOVESZ:
2732 				TEST_SIZE(SHT_SUNW_move, sunw_move);
2733 				break;
2734 
2735 			case DT_MOVETAB:
2736 				TEST_ADDR(SHT_SUNW_move, sunw_move);
2737 				break;
2738 
2739 			case DT_PREINIT_ARRAY:
2740 				TEST_ADDR(SHT_PREINIT_ARRAY, preinit_array);
2741 				break;
2742 
2743 			case DT_PREINIT_ARRAYSZ:
2744 				TEST_SIZE(SHT_PREINIT_ARRAY, preinit_array);
2745 				break;
2746 
2747 			case DT_REL:
2748 				if (!dumped)
2749 					TEST_ADDR(SHT_REL, rel);
2750 				break;
2751 
2752 			case DT_RELENT:
2753 				TEST_ENTSIZE(SHT_REL, rel);
2754 				break;
2755 
2756 			case DT_RELA:
2757 				if (!dumped)
2758 					TEST_ADDR(SHT_RELA, rela);
2759 				break;
2760 
2761 			case DT_RELAENT:
2762 				TEST_ENTSIZE(SHT_RELA, rela);
2763 				break;
2764 
2765 			case DT_STRTAB:
2766 				TEST_ADDR(SHT_STRTAB, dynstr);
2767 				break;
2768 
2769 			case DT_STRSZ:
2770 				TEST_SIZE(SHT_STRTAB, dynstr);
2771 				break;
2772 
2773 			case DT_SUNW_CAP:
2774 				TEST_ADDR(SHT_SUNW_cap, sunw_cap);
2775 				break;
2776 
2777 			case DT_SUNW_SYMTAB:
2778 				TEST_ADDR(SHT_SUNW_LDYNSYM, sunw_ldynsym);
2779 				break;
2780 
2781 			case DT_SYMENT:
2782 				TEST_ENTSIZE(SHT_DYNSYM, dynsym);
2783 				break;
2784 
2785 			case DT_SYMINENT:
2786 				TEST_ENTSIZE(SHT_SUNW_syminfo, sunw_syminfo);
2787 				break;
2788 
2789 			case DT_SYMINFO:
2790 				TEST_ADDR(SHT_SUNW_syminfo, sunw_syminfo);
2791 				break;
2792 
2793 			case DT_SYMINSZ:
2794 				TEST_SIZE(SHT_SUNW_syminfo, sunw_syminfo);
2795 				break;
2796 
2797 			case DT_SYMTAB:
2798 				TEST_ADDR(SHT_DYNSYM, dynsym);
2799 				break;
2800 
2801 			case DT_SUNW_SORTENT:
2802 				/*
2803 				 * This entry is related to both the symsort and
2804 				 * tlssort sections.
2805 				 */
2806 				if (osabi_solaris) {
2807 					int test_tls =
2808 					    (sec.sunw_tlssort != NULL);
2809 					int test_sym =
2810 					    (sec.sunw_symsort != NULL) ||
2811 					    !test_tls;
2812 					if (test_sym)
2813 						TEST_ENTSIZE(SHT_SUNW_symsort,
2814 						    sunw_symsort);
2815 					if (test_tls)
2816 						TEST_ENTSIZE(SHT_SUNW_tlssort,
2817 						    sunw_tlssort);
2818 				}
2819 				break;
2820 
2821 
2822 			case DT_SUNW_SYMSORT:
2823 				if (osabi_solaris)
2824 					TEST_ADDR(SHT_SUNW_symsort,
2825 					    sunw_symsort);
2826 				break;
2827 
2828 			case DT_SUNW_SYMSORTSZ:
2829 				if (osabi_solaris)
2830 					TEST_SIZE(SHT_SUNW_symsort,
2831 					    sunw_symsort);
2832 				break;
2833 
2834 			case DT_SUNW_TLSSORT:
2835 				if (osabi_solaris)
2836 					TEST_ADDR(SHT_SUNW_tlssort,
2837 					    sunw_tlssort);
2838 				break;
2839 
2840 			case DT_SUNW_TLSSORTSZ:
2841 				if (osabi_solaris)
2842 					TEST_SIZE(SHT_SUNW_tlssort,
2843 					    sunw_tlssort);
2844 				break;
2845 
2846 			case DT_VERDEF:
2847 				TEST_ADDR(SHT_SUNW_verdef, sunw_verdef);
2848 				break;
2849 
2850 			case DT_VERNEED:
2851 				TEST_ADDR(SHT_SUNW_verneed, sunw_verneed);
2852 				break;
2853 
2854 			case DT_VERSYM:
2855 				TEST_ADDR(SHT_SUNW_versym, sunw_versym);
2856 				break;
2857 #undef TEST_ADDR
2858 #undef TEST_SIZE
2859 #undef TEST_ENTSIZE
2860 			}
2861 
2862 			if (name == NULL)
2863 				name = MSG_ORIG(MSG_STR_EMPTY);
2864 			Elf_dyn_entry(0, dyn, ndx, name,
2865 			    osabi, ehdr->e_machine);
2866 		}
2867 	}
2868 }
2869 
2870 /*
2871  * Search for and process a MOVE section.
2872  */
2873 static void
2874 move(Cache *cache, Word shnum, const char *file, uint_t flags)
2875 {
2876 	Word		cnt;
2877 	const char	*fmt = NULL;
2878 
2879 	for (cnt = 1; cnt < shnum; cnt++) {
2880 		Word	movenum, symnum, ndx;
2881 		Sym	*syms;
2882 		Cache	*_cache = &cache[cnt];
2883 		Shdr	*shdr = _cache->c_shdr;
2884 		Cache	*symsec, *strsec;
2885 		Move	*move;
2886 
2887 		if (shdr->sh_type != SHT_SUNW_move)
2888 			continue;
2889 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
2890 			continue;
2891 
2892 		/*
2893 		 * Determine the move data and number.
2894 		 */
2895 		if ((shdr->sh_entsize == 0) || (shdr->sh_size == 0)) {
2896 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
2897 			    file, _cache->c_name);
2898 			continue;
2899 		}
2900 		if (_cache->c_data == NULL)
2901 			continue;
2902 
2903 		move = (Move *)_cache->c_data->d_buf;
2904 		movenum = shdr->sh_size / shdr->sh_entsize;
2905 
2906 		/*
2907 		 * Get the data buffer for the associated symbol table and
2908 		 * string table.
2909 		 */
2910 		if (stringtbl(cache, 1, cnt, shnum, file,
2911 		    &symnum, &symsec, &strsec) == 0)
2912 			return;
2913 
2914 		syms = (Sym *)symsec->c_data->d_buf;
2915 
2916 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
2917 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_MOVE), _cache->c_name);
2918 		dbg_print(0, MSG_INTL(MSG_MOVE_TITLE));
2919 
2920 		if (fmt == NULL)
2921 			fmt = MSG_INTL(MSG_MOVE_ENTRY);
2922 
2923 		for (ndx = 0; ndx < movenum; move++, ndx++) {
2924 			const char	*symname;
2925 			char		index[MAXNDXSIZE], section[BUFSIZ];
2926 			Word		symndx, shndx;
2927 			Sym		*sym;
2928 
2929 			/*
2930 			 * Check for null entries
2931 			 */
2932 			if ((move->m_info == 0) && (move->m_value == 0) &&
2933 			    (move->m_poffset == 0) && (move->m_repeat == 0) &&
2934 			    (move->m_stride == 0)) {
2935 				dbg_print(0, fmt, MSG_ORIG(MSG_STR_EMPTY),
2936 				    EC_XWORD(move->m_poffset), 0, 0, 0,
2937 				    EC_LWORD(0), MSG_ORIG(MSG_STR_EMPTY));
2938 				continue;
2939 			}
2940 			if (((symndx = ELF_M_SYM(move->m_info)) == 0) ||
2941 			    (symndx >= symnum)) {
2942 				(void) fprintf(stderr,
2943 				    MSG_INTL(MSG_ERR_BADMINFO), file,
2944 				    _cache->c_name, EC_XWORD(move->m_info));
2945 
2946 				(void) snprintf(index, MAXNDXSIZE,
2947 				    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(symndx));
2948 				dbg_print(0, fmt, index,
2949 				    EC_XWORD(move->m_poffset),
2950 				    ELF_M_SIZE(move->m_info), move->m_repeat,
2951 				    move->m_stride, move->m_value,
2952 				    MSG_INTL(MSG_STR_UNKNOWN));
2953 				continue;
2954 			}
2955 
2956 			symname = relsymname(cache, _cache, strsec,
2957 			    symndx, symnum, ndx, syms, section, BUFSIZ, file);
2958 			sym = (Sym *)(syms + symndx);
2959 
2960 			/*
2961 			 * Additional sanity check.
2962 			 */
2963 			shndx = sym->st_shndx;
2964 			if (!((shndx == SHN_COMMON) ||
2965 			    (((shndx >= 1) && (shndx <= shnum)) &&
2966 			    (cache[shndx].c_shdr)->sh_type == SHT_NOBITS))) {
2967 				(void) fprintf(stderr,
2968 				    MSG_INTL(MSG_ERR_BADSYM2), file,
2969 				    _cache->c_name, EC_WORD(symndx),
2970 				    demangle(symname, flags));
2971 			}
2972 
2973 			(void) snprintf(index, MAXNDXSIZE,
2974 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(symndx));
2975 			dbg_print(0, fmt, index, EC_XWORD(move->m_poffset),
2976 			    ELF_M_SIZE(move->m_info), move->m_repeat,
2977 			    move->m_stride, move->m_value,
2978 			    demangle(symname, flags));
2979 		}
2980 	}
2981 }
2982 
2983 /*
2984  * parse_note_t is used to track the state used by parse_note_entry()
2985  * between calls, and also to return the results of each call.
2986  */
2987 typedef struct {
2988 	/* pns_ fields track progress through the data */
2989 	const char	*pns_file;	/* File name */
2990 	Cache		*pns_cache;	/* Note section cache entry */
2991 	size_t		pns_size;	/* # unprocessed data bytes */
2992 	Word		*pns_data;	/* # to next unused data byte */
2993 
2994 	/* pn_ fields return the results for a single call */
2995 	Word		pn_namesz;	/* Value of note namesz field */
2996 	Word		pn_descsz;	/* Value of note descsz field */
2997 	Word		pn_type;	/* Value of note type field */
2998 	const char	*pn_name;	/* if (namesz > 0) ptr to name bytes */
2999 	const char	*pn_desc;	/* if (descsx > 0) ptr to data bytes */
3000 } parse_note_t;
3001 
3002 /*
3003  * Extract the various sub-parts of a note entry, and advance the
3004  * data pointer past it.
3005  *
3006  * entry:
3007  *	The state pns_ fields contain current values for the Note section
3008  *
3009  * exit:
3010  *	On success, True (1) is returned, the state pns_ fields have been
3011  *	advanced to point at the start of the next entry, and the information
3012  *	for the recovered note entry is found in the state pn_ fields.
3013  *
3014  *	On failure, False (0) is returned. The values contained in state
3015  *	are undefined.
3016  */
3017 static int
3018 parse_note_entry(parse_note_t *state)
3019 {
3020 	size_t	pad, noteoff;
3021 
3022 	noteoff = (Word)state->pns_cache->c_data->d_size - state->pns_size;
3023 	/*
3024 	 * Make sure we can at least reference the 3 initial entries
3025 	 * (4-byte words) of the note information block.
3026 	 */
3027 	if (state->pns_size >= (sizeof (Word) * 3)) {
3028 		state->pns_size -= (sizeof (Word) * 3);
3029 	} else {
3030 		(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADDATASZ),
3031 		    state->pns_file, state->pns_cache->c_name,
3032 		    EC_WORD(noteoff));
3033 		return (0);
3034 	}
3035 
3036 	/*
3037 	 * Make sure any specified name string can be referenced.
3038 	 */
3039 	if ((state->pn_namesz = *state->pns_data++) != 0) {
3040 		if (state->pns_size >= state->pn_namesz) {
3041 			state->pns_size -= state->pn_namesz;
3042 		} else {
3043 			(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADNMSZ),
3044 			    state->pns_file, state->pns_cache->c_name,
3045 			    EC_WORD(noteoff), EC_WORD(state->pn_namesz));
3046 			return (0);
3047 		}
3048 	}
3049 
3050 	/*
3051 	 * Make sure any specified descriptor can be referenced.
3052 	 */
3053 	if ((state->pn_descsz = *state->pns_data++) != 0) {
3054 		/*
3055 		 * If namesz isn't a 4-byte multiple, account for any
3056 		 * padding that must exist before the descriptor.
3057 		 */
3058 		if ((pad = (state->pn_namesz & (sizeof (Word) - 1))) != 0) {
3059 			pad = sizeof (Word) - pad;
3060 			state->pns_size -= pad;
3061 		}
3062 		if (state->pns_size >= state->pn_descsz) {
3063 			state->pns_size -= state->pn_descsz;
3064 		} else {
3065 			(void) fprintf(stderr, MSG_INTL(MSG_NOTE_BADDESZ),
3066 			    state->pns_file, state->pns_cache->c_name,
3067 			    EC_WORD(noteoff), EC_WORD(state->pn_namesz));
3068 			return (0);
3069 		}
3070 	}
3071 
3072 	state->pn_type = *state->pns_data++;
3073 
3074 	/* Name */
3075 	if (state->pn_namesz) {
3076 		state->pn_name = (char *)state->pns_data;
3077 		pad = (state->pn_namesz +
3078 		    (sizeof (Word) - 1)) & ~(sizeof (Word) - 1);
3079 		/* LINTED */
3080 		state->pns_data = (Word *)(state->pn_name + pad);
3081 	}
3082 
3083 	/*
3084 	 * If multiple information blocks exist within a .note section
3085 	 * account for any padding that must exist before the next
3086 	 * information block.
3087 	 */
3088 	if ((pad = (state->pn_descsz & (sizeof (Word) - 1))) != 0) {
3089 		pad = sizeof (Word) - pad;
3090 		if (state->pns_size > pad)
3091 			state->pns_size -= pad;
3092 	}
3093 
3094 	/* Data */
3095 	if (state->pn_descsz) {
3096 		state->pn_desc = (const char *)state->pns_data;
3097 		/* LINTED */
3098 		state->pns_data = (Word *)(state->pn_desc +
3099 		    state->pn_descsz + pad);
3100 	}
3101 
3102 	return (1);
3103 }
3104 
3105 /*
3106  * Callback function for use with conv_str_to_c_literal() below.
3107  */
3108 /*ARGSUSED2*/
3109 static void
3110 c_literal_cb(const void *ptr, size_t size, void *uvalue)
3111 {
3112 	(void) fwrite(ptr, size, 1, stdout);
3113 }
3114 
3115 /*
3116  * Traverse a note section analyzing each note information block.
3117  * The data buffers size is used to validate references before they are made,
3118  * and is decremented as each element is processed.
3119  */
3120 void
3121 note_entry(Cache *cache, Word *data, size_t size, Ehdr *ehdr, const char *file)
3122 {
3123 	int		cnt = 0;
3124 	int		is_corenote;
3125 	int		do_swap;
3126 	Conv_inv_buf_t	inv_buf;
3127 	parse_note_t	pnstate;
3128 
3129 	pnstate.pns_file = file;
3130 	pnstate.pns_cache = cache;
3131 	pnstate.pns_size = size;
3132 	pnstate.pns_data = data;
3133 	do_swap = _elf_sys_encoding() != ehdr->e_ident[EI_DATA];
3134 
3135 	/*
3136 	 * Print out a single `note' information block.
3137 	 */
3138 	while (pnstate.pns_size > 0) {
3139 
3140 		if (parse_note_entry(&pnstate) == 0)
3141 			return;
3142 
3143 		/*
3144 		 * Is this a Solaris core note? Such notes all have
3145 		 * the name "CORE".
3146 		 */
3147 		is_corenote = (ehdr->e_type == ET_CORE) &&
3148 		    (pnstate.pn_namesz == (MSG_STR_CORE_SIZE + 1)) &&
3149 		    (strncmp(MSG_ORIG(MSG_STR_CORE), pnstate.pn_name,
3150 		    MSG_STR_CORE_SIZE + 1) == 0);
3151 
3152 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3153 		dbg_print(0, MSG_INTL(MSG_FMT_NOTEENTNDX), EC_WORD(cnt));
3154 		cnt++;
3155 		dbg_print(0, MSG_ORIG(MSG_NOTE_NAMESZ),
3156 		    EC_WORD(pnstate.pn_namesz));
3157 		dbg_print(0, MSG_ORIG(MSG_NOTE_DESCSZ),
3158 		    EC_WORD(pnstate.pn_descsz));
3159 
3160 		if (is_corenote)
3161 			dbg_print(0, MSG_ORIG(MSG_NOTE_TYPE_STR),
3162 			    conv_cnote_type(pnstate.pn_type, 0, &inv_buf));
3163 		else
3164 			dbg_print(0, MSG_ORIG(MSG_NOTE_TYPE),
3165 			    EC_WORD(pnstate.pn_type));
3166 		if (pnstate.pn_namesz) {
3167 			dbg_print(0, MSG_ORIG(MSG_NOTE_NAME));
3168 			/*
3169 			 * The name string can contain embedded 'null'
3170 			 * bytes and/or unprintable characters. Also,
3171 			 * the final NULL is documented in the ELF ABI
3172 			 * as being included in the namesz. So, display
3173 			 * the name using C literal string notation, and
3174 			 * include the terminating NULL in the output.
3175 			 * We don't show surrounding double quotes, as
3176 			 * that implies the termination that we are showing
3177 			 * explicitly.
3178 			 */
3179 			(void) fwrite(MSG_ORIG(MSG_STR_8SP),
3180 			    MSG_STR_8SP_SIZE, 1, stdout);
3181 			conv_str_to_c_literal(pnstate.pn_name,
3182 			    pnstate.pn_namesz, c_literal_cb, NULL);
3183 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3184 		}
3185 
3186 		if (pnstate.pn_descsz) {
3187 			int		hexdump = 1;
3188 
3189 			/*
3190 			 * If this is a core note, let the corenote()
3191 			 * function handle it.
3192 			 */
3193 			if (is_corenote) {
3194 				/* We only issue the bad arch error once */
3195 				static int	badnote_done = 0;
3196 				corenote_ret_t	corenote_ret;
3197 
3198 				corenote_ret = corenote(ehdr->e_machine,
3199 				    do_swap, pnstate.pn_type, pnstate.pn_desc,
3200 				    pnstate.pn_descsz);
3201 				switch (corenote_ret) {
3202 				case CORENOTE_R_OK:
3203 					hexdump = 0;
3204 					break;
3205 				case CORENOTE_R_BADDATA:
3206 					(void) fprintf(stderr,
3207 					    MSG_INTL(MSG_NOTE_BADCOREDATA),
3208 					    file);
3209 					break;
3210 				case CORENOTE_R_BADARCH:
3211 					if (badnote_done)
3212 						break;
3213 					(void) fprintf(stderr,
3214 					    MSG_INTL(MSG_NOTE_BADCOREARCH),
3215 					    file,
3216 					    conv_ehdr_mach(ehdr->e_machine,
3217 					    0, &inv_buf));
3218 					break;
3219 				}
3220 			}
3221 
3222 			/*
3223 			 * The default thing when we don't understand
3224 			 * the note data is to display it as hex bytes.
3225 			 */
3226 			if (hexdump) {
3227 				dbg_print(0, MSG_ORIG(MSG_NOTE_DESC));
3228 				dump_hex_bytes(pnstate.pn_desc,
3229 				    pnstate.pn_descsz, 8, 4, 4);
3230 			}
3231 		}
3232 	}
3233 }
3234 
3235 /*
3236  * Search for and process .note sections.
3237  *
3238  * Returns the number of note sections seen.
3239  */
3240 static Word
3241 note(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
3242 {
3243 	Word	cnt, note_cnt = 0;
3244 
3245 	/*
3246 	 * Otherwise look for any .note sections.
3247 	 */
3248 	for (cnt = 1; cnt < shnum; cnt++) {
3249 		Cache	*_cache = &cache[cnt];
3250 		Shdr	*shdr = _cache->c_shdr;
3251 
3252 		if (shdr->sh_type != SHT_NOTE)
3253 			continue;
3254 		note_cnt++;
3255 		if (!match(MATCH_F_ALL, _cache->c_name, cnt, shdr->sh_type))
3256 			continue;
3257 
3258 		/*
3259 		 * As these sections are often hand rolled, make sure they're
3260 		 * properly aligned before proceeding, and issue an error
3261 		 * as necessary.
3262 		 *
3263 		 * Note that we will continue on to display the note even
3264 		 * if it has bad alignment. We can do this safely, because
3265 		 * libelf knows the alignment required for SHT_NOTE, and
3266 		 * takes steps to deliver a properly aligned buffer to us
3267 		 * even if the actual file is misaligned.
3268 		 */
3269 		if (shdr->sh_offset & (sizeof (Word) - 1))
3270 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADALIGN),
3271 			    file, _cache->c_name);
3272 
3273 		if (_cache->c_data == NULL)
3274 			continue;
3275 
3276 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3277 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_NOTE), _cache->c_name);
3278 		note_entry(_cache, (Word *)_cache->c_data->d_buf,
3279 		/* LINTED */
3280 		    (Word)_cache->c_data->d_size, ehdr, file);
3281 	}
3282 
3283 	return (note_cnt);
3284 }
3285 
3286 /*
3287  * The Linux Standard Base defines a special note named .note.ABI-tag
3288  * that is used to maintain Linux ABI information. Presence of this section
3289  * is a strong indication that the object should be considered to be
3290  * ELFOSABI_LINUX.
3291  *
3292  * This function returns True (1) if such a note is seen, and False (0)
3293  * otherwise.
3294  */
3295 static int
3296 has_linux_abi_note(Cache *cache, Word shnum, const char *file)
3297 {
3298 	Word	cnt;
3299 
3300 	for (cnt = 1; cnt < shnum; cnt++) {
3301 		parse_note_t	pnstate;
3302 		Cache		*_cache = &cache[cnt];
3303 		Shdr		*shdr = _cache->c_shdr;
3304 
3305 		/*
3306 		 * Section must be SHT_NOTE, must have the name
3307 		 * .note.ABI-tag, and must have data.
3308 		 */
3309 		if ((shdr->sh_type != SHT_NOTE) ||
3310 		    (strcmp(MSG_ORIG(MSG_STR_NOTEABITAG),
3311 		    _cache->c_name) != 0) || (_cache->c_data == NULL))
3312 			continue;
3313 
3314 		pnstate.pns_file = file;
3315 		pnstate.pns_cache = _cache;
3316 		pnstate.pns_size = _cache->c_data->d_size;
3317 		pnstate.pns_data = (Word *)_cache->c_data->d_buf;
3318 
3319 		while (pnstate.pns_size > 0) {
3320 			Word *w;
3321 
3322 			if (parse_note_entry(&pnstate) == 0)
3323 				break;
3324 
3325 			/*
3326 			 * The type must be 1, and the name must be "GNU".
3327 			 * The descsz must be at least 16 bytes.
3328 			 */
3329 			if ((pnstate.pn_type != 1) ||
3330 			    (pnstate.pn_namesz != (MSG_STR_GNU_SIZE + 1)) ||
3331 			    (strncmp(MSG_ORIG(MSG_STR_GNU), pnstate.pn_name,
3332 			    MSG_STR_CORE_SIZE + 1) != 0) ||
3333 			    (pnstate.pn_descsz < 16))
3334 				continue;
3335 
3336 			/*
3337 			 * desc contains 4 32-bit fields. Field 0 must be 0,
3338 			 * indicating Linux. The second, third, and fourth
3339 			 * fields represent the earliest Linux kernel
3340 			 * version compatible with this object.
3341 			 */
3342 			/*LINTED*/
3343 			w = (Word *) pnstate.pn_desc;
3344 			if (*w == 0)
3345 				return (1);
3346 		}
3347 	}
3348 
3349 	return (0);
3350 }
3351 
3352 /*
3353  * Determine an individual hash entry.  This may be the initial hash entry,
3354  * or an associated chain entry.
3355  */
3356 static void
3357 hash_entry(Cache *refsec, Cache *strsec, const char *hsecname, Word hashndx,
3358     Word symndx, Word symn, Sym *syms, const char *file, ulong_t bkts,
3359     uint_t flags, int chain)
3360 {
3361 	Sym		*sym;
3362 	const char	*symname, *str;
3363 	char		_bucket[MAXNDXSIZE], _symndx[MAXNDXSIZE];
3364 	ulong_t		nbkt, nhash;
3365 
3366 	if (symndx > symn) {
3367 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_HSBADSYMNDX), file,
3368 		    EC_WORD(symndx), EC_WORD(hashndx));
3369 		symname = MSG_INTL(MSG_STR_UNKNOWN);
3370 	} else {
3371 		sym = (Sym *)(syms + symndx);
3372 		symname = string(refsec, symndx, strsec, file, sym->st_name);
3373 	}
3374 
3375 	if (chain == 0) {
3376 		(void) snprintf(_bucket, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INTEGER),
3377 		    hashndx);
3378 		str = (const char *)_bucket;
3379 	} else
3380 		str = MSG_ORIG(MSG_STR_EMPTY);
3381 
3382 	(void) snprintf(_symndx, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INDEX2),
3383 	    EC_WORD(symndx));
3384 	dbg_print(0, MSG_ORIG(MSG_FMT_HASH_INFO), str, _symndx,
3385 	    demangle(symname, flags));
3386 
3387 	/*
3388 	 * Determine if this string is in the correct bucket.
3389 	 */
3390 	nhash = elf_hash(symname);
3391 	nbkt = nhash % bkts;
3392 
3393 	if (nbkt != hashndx) {
3394 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADHASH), file,
3395 		    hsecname, symname, EC_WORD(hashndx), nbkt);
3396 	}
3397 }
3398 
3399 #define	MAXCOUNT	500
3400 
3401 static void
3402 hash(Cache *cache, Word shnum, const char *file, uint_t flags)
3403 {
3404 	static int	count[MAXCOUNT];
3405 	Word		cnt;
3406 	ulong_t		ndx, bkts;
3407 	char		number[MAXNDXSIZE];
3408 
3409 	for (cnt = 1; cnt < shnum; cnt++) {
3410 		uint_t		*hash, *chain;
3411 		Cache		*_cache = &cache[cnt];
3412 		Shdr		*sshdr, *hshdr = _cache->c_shdr;
3413 		char		*ssecname, *hsecname = _cache->c_name;
3414 		Sym		*syms;
3415 		Word		symn;
3416 
3417 		if (hshdr->sh_type != SHT_HASH)
3418 			continue;
3419 
3420 		/*
3421 		 * Determine the hash table data and size.
3422 		 */
3423 		if ((hshdr->sh_entsize == 0) || (hshdr->sh_size == 0)) {
3424 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3425 			    file, hsecname);
3426 			continue;
3427 		}
3428 		if (_cache->c_data == NULL)
3429 			continue;
3430 
3431 		hash = (uint_t *)_cache->c_data->d_buf;
3432 		bkts = *hash;
3433 		chain = hash + 2 + bkts;
3434 		hash += 2;
3435 
3436 		/*
3437 		 * Get the data buffer for the associated symbol table.
3438 		 */
3439 		if ((hshdr->sh_link == 0) || (hshdr->sh_link >= shnum)) {
3440 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
3441 			    file, hsecname, EC_WORD(hshdr->sh_link));
3442 			continue;
3443 		}
3444 
3445 		_cache = &cache[hshdr->sh_link];
3446 		ssecname = _cache->c_name;
3447 
3448 		if (_cache->c_data == NULL)
3449 			continue;
3450 
3451 		if ((syms = (Sym *)_cache->c_data->d_buf) == NULL) {
3452 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3453 			    file, ssecname);
3454 			continue;
3455 		}
3456 
3457 		sshdr = _cache->c_shdr;
3458 		/* LINTED */
3459 		symn = (Word)(sshdr->sh_size / sshdr->sh_entsize);
3460 
3461 		/*
3462 		 * Get the associated string table section.
3463 		 */
3464 		if ((sshdr->sh_link == 0) || (sshdr->sh_link >= shnum)) {
3465 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHLINK),
3466 			    file, ssecname, EC_WORD(sshdr->sh_link));
3467 			continue;
3468 		}
3469 
3470 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3471 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_HASH), hsecname);
3472 		dbg_print(0, MSG_INTL(MSG_ELF_HASH_INFO));
3473 
3474 		/*
3475 		 * Loop through the hash buckets, printing the appropriate
3476 		 * symbols.
3477 		 */
3478 		for (ndx = 0; ndx < bkts; ndx++, hash++) {
3479 			Word	_ndx, _cnt;
3480 
3481 			if (*hash == 0) {
3482 				count[0]++;
3483 				continue;
3484 			}
3485 
3486 			hash_entry(_cache, &cache[sshdr->sh_link], hsecname,
3487 			    ndx, *hash, symn, syms, file, bkts, flags, 0);
3488 
3489 			/*
3490 			 * Determine if any other symbols are chained to this
3491 			 * bucket.
3492 			 */
3493 			_ndx = chain[*hash];
3494 			_cnt = 1;
3495 			while (_ndx) {
3496 				hash_entry(_cache, &cache[sshdr->sh_link],
3497 				    hsecname, ndx, _ndx, symn, syms, file,
3498 				    bkts, flags, 1);
3499 				_ndx = chain[_ndx];
3500 				_cnt++;
3501 			}
3502 
3503 			if (_cnt >= MAXCOUNT) {
3504 				(void) fprintf(stderr,
3505 				    MSG_INTL(MSG_HASH_OVERFLW), file,
3506 				    _cache->c_name, EC_WORD(ndx),
3507 				    EC_WORD(_cnt));
3508 			} else
3509 				count[_cnt]++;
3510 		}
3511 		break;
3512 	}
3513 
3514 	/*
3515 	 * Print out the count information.
3516 	 */
3517 	bkts = cnt = 0;
3518 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3519 
3520 	for (ndx = 0; ndx < MAXCOUNT; ndx++) {
3521 		Word	_cnt;
3522 
3523 		if ((_cnt = count[ndx]) == 0)
3524 			continue;
3525 
3526 		(void) snprintf(number, MAXNDXSIZE,
3527 		    MSG_ORIG(MSG_FMT_INTEGER), _cnt);
3528 		dbg_print(0, MSG_INTL(MSG_ELF_HASH_BKTS1), number,
3529 		    EC_WORD(ndx));
3530 		bkts += _cnt;
3531 		cnt += (Word)(ndx * _cnt);
3532 	}
3533 	if (cnt) {
3534 		(void) snprintf(number, MAXNDXSIZE, MSG_ORIG(MSG_FMT_INTEGER),
3535 		    bkts);
3536 		dbg_print(0, MSG_INTL(MSG_ELF_HASH_BKTS2), number,
3537 		    EC_WORD(cnt));
3538 	}
3539 }
3540 
3541 static void
3542 group(Cache *cache, Word shnum, const char *file, uint_t flags)
3543 {
3544 	Word	scnt;
3545 
3546 	for (scnt = 1; scnt < shnum; scnt++) {
3547 		Cache		*_cache = &cache[scnt];
3548 		Shdr		*shdr = _cache->c_shdr;
3549 		Word		*grpdata, gcnt, grpcnt, symnum, unknown;
3550 		Cache		*symsec, *strsec;
3551 		Sym		*syms, *sym;
3552 		char		flgstrbuf[MSG_GRP_COMDAT_SIZE + 10];
3553 		const char	*grpnam;
3554 
3555 		if (shdr->sh_type != SHT_GROUP)
3556 			continue;
3557 		if (!match(MATCH_F_ALL, _cache->c_name, scnt, shdr->sh_type))
3558 			continue;
3559 		if ((_cache->c_data == NULL) ||
3560 		    ((grpdata = (Word *)_cache->c_data->d_buf) == NULL))
3561 			continue;
3562 		grpcnt = shdr->sh_size / sizeof (Word);
3563 
3564 		/*
3565 		 * Get the data buffer for the associated symbol table and
3566 		 * string table.
3567 		 */
3568 		if (stringtbl(cache, 1, scnt, shnum, file,
3569 		    &symnum, &symsec, &strsec) == 0)
3570 			return;
3571 
3572 		syms = symsec->c_data->d_buf;
3573 
3574 		dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3575 		dbg_print(0, MSG_INTL(MSG_ELF_SCN_GRP), _cache->c_name);
3576 		dbg_print(0, MSG_INTL(MSG_GRP_TITLE));
3577 
3578 		/*
3579 		 * The first element of the group defines the group.  The
3580 		 * associated symbol is defined by the sh_link field.
3581 		 */
3582 		if ((shdr->sh_info == SHN_UNDEF) || (shdr->sh_info > symnum)) {
3583 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHINFO),
3584 			    file, _cache->c_name, EC_WORD(shdr->sh_info));
3585 			return;
3586 		}
3587 
3588 		(void) strcpy(flgstrbuf, MSG_ORIG(MSG_STR_OSQBRKT));
3589 		if (grpdata[0] & GRP_COMDAT) {
3590 			(void) strcat(flgstrbuf, MSG_ORIG(MSG_GRP_COMDAT));
3591 		}
3592 		if ((unknown = (grpdata[0] & ~GRP_COMDAT)) != 0) {
3593 			size_t	len = strlen(flgstrbuf);
3594 
3595 			(void) snprintf(&flgstrbuf[len],
3596 			    (MSG_GRP_COMDAT_SIZE + 10 - len),
3597 			    MSG_ORIG(MSG_GRP_UNKNOWN), unknown);
3598 		}
3599 		(void) strcat(flgstrbuf, MSG_ORIG(MSG_STR_CSQBRKT));
3600 		sym = (Sym *)(syms + shdr->sh_info);
3601 
3602 		/*
3603 		 * The GNU assembler can use section symbols as the signature
3604 		 * symbol as described by this comment in the gold linker
3605 		 * (found via google):
3606 		 *
3607 		 *	It seems that some versions of gas will create a
3608 		 *	section group associated with a section symbol, and
3609 		 *	then fail to give a name to the section symbol.  In
3610 		 *	such a case, use the name of the section.
3611 		 *
3612 		 * In order to support such objects, we do the same.
3613 		 */
3614 		grpnam = string(_cache, 0, strsec, file, sym->st_name);
3615 		if (((sym->st_name == 0) || (*grpnam == '\0')) &&
3616 		    (ELF_ST_TYPE(sym->st_info) == STT_SECTION))
3617 			grpnam = cache[sym->st_shndx].c_name;
3618 
3619 		dbg_print(0, MSG_INTL(MSG_GRP_SIGNATURE), flgstrbuf,
3620 		    demangle(grpnam, flags));
3621 
3622 		for (gcnt = 1; gcnt < grpcnt; gcnt++) {
3623 			char		index[MAXNDXSIZE];
3624 			const char	*name;
3625 
3626 			(void) snprintf(index, MAXNDXSIZE,
3627 			    MSG_ORIG(MSG_FMT_INDEX), EC_XWORD(gcnt));
3628 
3629 			if (grpdata[gcnt] >= shnum)
3630 				name = MSG_INTL(MSG_GRP_INVALSCN);
3631 			else
3632 				name = cache[grpdata[gcnt]].c_name;
3633 
3634 			(void) printf(MSG_ORIG(MSG_GRP_ENTRY), index, name,
3635 			    EC_XWORD(grpdata[gcnt]));
3636 		}
3637 	}
3638 }
3639 
3640 static void
3641 got(Cache *cache, Word shnum, Ehdr *ehdr, const char *file)
3642 {
3643 	Cache		*gotcache = NULL, *symtab = NULL;
3644 	Addr		gotbgn, gotend;
3645 	Shdr		*gotshdr;
3646 	Word		cnt, gotents, gotndx;
3647 	size_t		gentsize;
3648 	Got_info	*gottable;
3649 	char		*gotdata;
3650 	Sym		*gotsym;
3651 	Xword		gotsymaddr;
3652 	uint_t		sys_encoding;
3653 
3654 	/*
3655 	 * First, find the got.
3656 	 */
3657 	for (cnt = 1; cnt < shnum; cnt++) {
3658 		if (strncmp(cache[cnt].c_name, MSG_ORIG(MSG_ELF_GOT),
3659 		    MSG_ELF_GOT_SIZE) == 0) {
3660 			gotcache = &cache[cnt];
3661 			break;
3662 		}
3663 	}
3664 	if (gotcache == NULL)
3665 		return;
3666 
3667 	/*
3668 	 * A got section within a relocatable object is suspicious.
3669 	 */
3670 	if (ehdr->e_type == ET_REL) {
3671 		(void) fprintf(stderr, MSG_INTL(MSG_GOT_UNEXPECTED), file,
3672 		    gotcache->c_name);
3673 	}
3674 
3675 	gotshdr = gotcache->c_shdr;
3676 	if (gotshdr->sh_size == 0) {
3677 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3678 		    file, gotcache->c_name);
3679 		return;
3680 	}
3681 
3682 	gotbgn = gotshdr->sh_addr;
3683 	gotend = gotbgn + gotshdr->sh_size;
3684 
3685 	/*
3686 	 * Some architectures don't properly set the sh_entsize for the GOT
3687 	 * table.  If it's not set, default to a size of a pointer.
3688 	 */
3689 	if ((gentsize = gotshdr->sh_entsize) == 0)
3690 		gentsize = sizeof (Xword);
3691 
3692 	if (gotcache->c_data == NULL)
3693 		return;
3694 
3695 	/* LINTED */
3696 	gotents = (Word)(gotshdr->sh_size / gentsize);
3697 	gotdata = gotcache->c_data->d_buf;
3698 
3699 	if ((gottable = calloc(gotents, sizeof (Got_info))) == 0) {
3700 		int err = errno;
3701 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC), file,
3702 		    strerror(err));
3703 		return;
3704 	}
3705 
3706 	/*
3707 	 * Now we scan through all the sections looking for any relocations
3708 	 * that may be against the GOT.  Since these may not be isolated to a
3709 	 * .rel[a].got section we check them all.
3710 	 * While scanning sections save the symbol table entry (a symtab
3711 	 * overriding a dynsym) so that we can lookup _GLOBAL_OFFSET_TABLE_.
3712 	 */
3713 	for (cnt = 1; cnt < shnum; cnt++) {
3714 		Word		type, symnum;
3715 		Xword		relndx, relnum, relsize;
3716 		void		*rels;
3717 		Sym		*syms;
3718 		Cache		*symsec, *strsec;
3719 		Cache		*_cache = &cache[cnt];
3720 		Shdr		*shdr;
3721 
3722 		shdr = _cache->c_shdr;
3723 		type = shdr->sh_type;
3724 
3725 		if ((symtab == 0) && (type == SHT_DYNSYM)) {
3726 			symtab = _cache;
3727 			continue;
3728 		}
3729 		if (type == SHT_SYMTAB) {
3730 			symtab = _cache;
3731 			continue;
3732 		}
3733 		if ((type != SHT_RELA) && (type != SHT_REL))
3734 			continue;
3735 
3736 		/*
3737 		 * Decide entry size.
3738 		 */
3739 		if (((relsize = shdr->sh_entsize) == 0) ||
3740 		    (relsize > shdr->sh_size)) {
3741 			if (type == SHT_RELA)
3742 				relsize = sizeof (Rela);
3743 			else
3744 				relsize = sizeof (Rel);
3745 		}
3746 
3747 		/*
3748 		 * Determine the number of relocations available.
3749 		 */
3750 		if (shdr->sh_size == 0) {
3751 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSZ),
3752 			    file, _cache->c_name);
3753 			continue;
3754 		}
3755 		if (_cache->c_data == NULL)
3756 			continue;
3757 
3758 		rels = _cache->c_data->d_buf;
3759 		relnum = shdr->sh_size / relsize;
3760 
3761 		/*
3762 		 * Get the data buffer for the associated symbol table and
3763 		 * string table.
3764 		 */
3765 		if (stringtbl(cache, 1, cnt, shnum, file,
3766 		    &symnum, &symsec, &strsec) == 0)
3767 			continue;
3768 
3769 		syms = symsec->c_data->d_buf;
3770 
3771 		/*
3772 		 * Loop through the relocation entries.
3773 		 */
3774 		for (relndx = 0; relndx < relnum; relndx++,
3775 		    rels = (void *)((char *)rels + relsize)) {
3776 			char		section[BUFSIZ];
3777 			Addr		offset;
3778 			Got_info	*gip;
3779 			Word		symndx, reltype;
3780 			Rela		*rela;
3781 			Rel		*rel;
3782 
3783 			/*
3784 			 * Unravel the relocation.
3785 			 */
3786 			if (type == SHT_RELA) {
3787 				rela = (Rela *)rels;
3788 				symndx = ELF_R_SYM(rela->r_info);
3789 				reltype = ELF_R_TYPE(rela->r_info,
3790 				    ehdr->e_machine);
3791 				offset = rela->r_offset;
3792 			} else {
3793 				rel = (Rel *)rels;
3794 				symndx = ELF_R_SYM(rel->r_info);
3795 				reltype = ELF_R_TYPE(rel->r_info,
3796 				    ehdr->e_machine);
3797 				offset = rel->r_offset;
3798 			}
3799 
3800 			/*
3801 			 * Only pay attention to relocations against the GOT.
3802 			 */
3803 			if ((offset < gotbgn) || (offset >= gotend))
3804 				continue;
3805 
3806 			/* LINTED */
3807 			gotndx = (Word)((offset - gotbgn) /
3808 			    gotshdr->sh_entsize);
3809 			gip = &gottable[gotndx];
3810 
3811 			if (gip->g_reltype != 0) {
3812 				(void) fprintf(stderr,
3813 				    MSG_INTL(MSG_GOT_MULTIPLE), file,
3814 				    EC_WORD(gotndx), EC_ADDR(offset));
3815 				continue;
3816 			}
3817 
3818 			if (symndx)
3819 				gip->g_symname = relsymname(cache, _cache,
3820 				    strsec, symndx, symnum, relndx, syms,
3821 				    section, BUFSIZ, file);
3822 			gip->g_reltype = reltype;
3823 			gip->g_rel = rels;
3824 		}
3825 	}
3826 
3827 	if (symlookup(MSG_ORIG(MSG_SYM_GOT), cache, shnum, &gotsym, NULL,
3828 	    symtab, file))
3829 		gotsymaddr = gotsym->st_value;
3830 	else
3831 		gotsymaddr = gotbgn;
3832 
3833 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3834 	dbg_print(0, MSG_INTL(MSG_ELF_SCN_GOT), gotcache->c_name);
3835 	Elf_got_title(0);
3836 
3837 	sys_encoding = _elf_sys_encoding();
3838 	for (gotndx = 0; gotndx < gotents; gotndx++) {
3839 		Got_info	*gip;
3840 		Sword		gindex;
3841 		Addr		gaddr;
3842 		Xword		gotentry;
3843 
3844 		gip = &gottable[gotndx];
3845 
3846 		gaddr = gotbgn + (gotndx * gentsize);
3847 		gindex = (Sword)(gaddr - gotsymaddr) / (Sword)gentsize;
3848 
3849 		if (gentsize == sizeof (Word))
3850 			/* LINTED */
3851 			gotentry = (Xword)(*((Word *)(gotdata) + gotndx));
3852 		else
3853 			/* LINTED */
3854 			gotentry = *((Xword *)(gotdata) + gotndx);
3855 
3856 		Elf_got_entry(0, gindex, gaddr, gotentry, ehdr->e_machine,
3857 		    ehdr->e_ident[EI_DATA], sys_encoding,
3858 		    gip->g_reltype, gip->g_rel, gip->g_symname);
3859 	}
3860 	free(gottable);
3861 }
3862 
3863 void
3864 checksum(Elf *elf)
3865 {
3866 	dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
3867 	dbg_print(0, MSG_INTL(MSG_STR_CHECKSUM), elf_checksum(elf));
3868 }
3869 
3870 /*
3871  * This variable is used by regular() to communicate the address of
3872  * the section header cache to sort_shdr_ndx_arr(). Unfortunately,
3873  * the qsort() interface does not include a userdata argument by which
3874  * such arbitrary data can be passed, so we are stuck using global data.
3875  */
3876 static Cache *sort_shdr_ndx_arr_cache;
3877 
3878 
3879 /*
3880  * Used with qsort() to sort the section indices so that they can be
3881  * used to access the section headers in order of increasing data offset.
3882  *
3883  * entry:
3884  *	sort_shdr_ndx_arr_cache - Contains address of
3885  *		section header cache.
3886  *	v1, v2 - Point at elements of sort_shdr_bits array to be compared.
3887  *
3888  * exit:
3889  *	Returns -1 (less than), 0 (equal) or 1 (greater than).
3890  */
3891 static int
3892 sort_shdr_ndx_arr(const void *v1, const void *v2)
3893 {
3894 	Cache	*cache1 = sort_shdr_ndx_arr_cache + *((size_t *)v1);
3895 	Cache	*cache2 = sort_shdr_ndx_arr_cache + *((size_t *)v2);
3896 
3897 	if (cache1->c_shdr->sh_offset < cache2->c_shdr->sh_offset)
3898 		return (-1);
3899 
3900 	if (cache1->c_shdr->sh_offset > cache2->c_shdr->sh_offset)
3901 		return (1);
3902 
3903 	return (0);
3904 }
3905 
3906 
3907 static int
3908 shdr_cache(const char *file, Elf *elf, Ehdr *ehdr, size_t shstrndx,
3909     size_t shnum, Cache **cache_ret, Word flags)
3910 {
3911 	Elf_Scn		*scn;
3912 	Elf_Data	*data;
3913 	size_t		ndx;
3914 	Shdr		*nameshdr;
3915 	char		*names = NULL;
3916 	Cache		*cache, *_cache;
3917 	size_t		*shdr_ndx_arr, shdr_ndx_arr_cnt;
3918 
3919 
3920 	/*
3921 	 * Obtain the .shstrtab data buffer to provide the required section
3922 	 * name strings.
3923 	 */
3924 	if (shstrndx == SHN_UNDEF) {
3925 		/*
3926 		 * It is rare, but legal, for an object to lack a
3927 		 * header string table section.
3928 		 */
3929 		names = NULL;
3930 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOSHSTRSEC), file);
3931 	} else if ((scn = elf_getscn(elf, shstrndx)) == NULL) {
3932 		failure(file, MSG_ORIG(MSG_ELF_GETSCN));
3933 		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SHDR),
3934 		    EC_XWORD(shstrndx));
3935 
3936 	} else if ((data = elf_getdata(scn, NULL)) == NULL) {
3937 		failure(file, MSG_ORIG(MSG_ELF_GETDATA));
3938 		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_DATA),
3939 		    EC_XWORD(shstrndx));
3940 
3941 	} else if ((nameshdr = elf_getshdr(scn)) == NULL) {
3942 		failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
3943 		(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN),
3944 		    EC_WORD(elf_ndxscn(scn)));
3945 
3946 	} else if ((names = data->d_buf) == NULL)
3947 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_SHSTRNULL), file);
3948 
3949 	/*
3950 	 * Allocate a cache to maintain a descriptor for each section.
3951 	 */
3952 	if ((*cache_ret = cache = malloc(shnum * sizeof (Cache))) == NULL) {
3953 		int err = errno;
3954 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
3955 		    file, strerror(err));
3956 		return (0);
3957 	}
3958 
3959 	*cache = cache_init;
3960 	_cache = cache;
3961 	_cache++;
3962 
3963 	/*
3964 	 * Allocate an array that will hold the section index for
3965 	 * each section that has data in the ELF file:
3966 	 *
3967 	 *	- Is not a NOBITS section
3968 	 *	- Data has non-zero length
3969 	 *
3970 	 * Note that shnum is an upper bound on the size required. It
3971 	 * is likely that we won't use a few of these array elements.
3972 	 * Allocating a modest amount of extra memory in this case means
3973 	 * that we can avoid an extra loop to count the number of needed
3974 	 * items, and can fill this array immediately in the first loop
3975 	 * below.
3976 	 */
3977 	if ((shdr_ndx_arr = malloc(shnum * sizeof (*shdr_ndx_arr))) == NULL) {
3978 		int err = errno;
3979 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
3980 		    file, strerror(err));
3981 		return (0);
3982 	}
3983 	shdr_ndx_arr_cnt = 0;
3984 
3985 	/*
3986 	 * Traverse the sections of the file.  This gathering of data is
3987 	 * carried out in two passes.  First, the section headers are captured
3988 	 * and the section header names are evaluated.  A verification pass is
3989 	 * then carried out over the section information.  Files have been
3990 	 * known to exhibit overlapping (and hence erroneous) section header
3991 	 * information.
3992 	 *
3993 	 * Finally, the data for each section is obtained.  This processing is
3994 	 * carried out after section verification because should any section
3995 	 * header overlap occur, and a file needs translating (ie. xlate'ing
3996 	 * information from a non-native architecture file), then the process
3997 	 * of translation can corrupt the section header information.  Of
3998 	 * course, if there is any section overlap, the data related to the
3999 	 * sections is going to be compromised.  However, it is the translation
4000 	 * of this data that has caused problems with elfdump()'s ability to
4001 	 * extract the data.
4002 	 */
4003 	for (ndx = 1, scn = NULL; scn = elf_nextscn(elf, scn);
4004 	    ndx++, _cache++) {
4005 		char	scnndxnm[100];
4006 
4007 		_cache->c_ndx = ndx;
4008 		_cache->c_scn = scn;
4009 
4010 		if ((_cache->c_shdr = elf_getshdr(scn)) == NULL) {
4011 			failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
4012 			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN),
4013 			    EC_WORD(elf_ndxscn(scn)));
4014 		}
4015 
4016 		/*
4017 		 * If this section has data in the file, include it in
4018 		 * the array of sections to check for address overlap.
4019 		 */
4020 		if ((_cache->c_shdr->sh_size != 0) &&
4021 		    (_cache->c_shdr->sh_type != SHT_NOBITS))
4022 			shdr_ndx_arr[shdr_ndx_arr_cnt++] = ndx;
4023 
4024 		/*
4025 		 * If a shstrtab exists, assign the section name.
4026 		 */
4027 		if (names && _cache->c_shdr) {
4028 			if (_cache->c_shdr->sh_name &&
4029 			    /* LINTED */
4030 			    (nameshdr->sh_size > _cache->c_shdr->sh_name)) {
4031 				const char	*symname;
4032 				char		*secname;
4033 
4034 				secname = names + _cache->c_shdr->sh_name;
4035 
4036 				/*
4037 				 * A SUN naming convention employs a "%" within
4038 				 * a section name to indicate a section/symbol
4039 				 * name.  This originated from the compilers
4040 				 * -xF option, that places functions into their
4041 				 * own sections.  This convention (which has no
4042 				 * formal standard) has also been followed for
4043 				 * COMDAT sections.  To demangle the symbol
4044 				 * name, the name must be separated from the
4045 				 * section name.
4046 				 */
4047 				if (((flags & FLG_CTL_DEMANGLE) == 0) ||
4048 				    ((symname = strchr(secname, '%')) == NULL))
4049 					_cache->c_name = secname;
4050 				else {
4051 					size_t	secsz = ++symname - secname;
4052 					size_t	strsz;
4053 
4054 					symname = demangle(symname, flags);
4055 					strsz = secsz + strlen(symname) + 1;
4056 
4057 					if ((_cache->c_name =
4058 					    malloc(strsz)) == NULL) {
4059 						int err = errno;
4060 						(void) fprintf(stderr,
4061 						    MSG_INTL(MSG_ERR_MALLOC),
4062 						    file, strerror(err));
4063 						return (0);
4064 					}
4065 					(void) snprintf(_cache->c_name, strsz,
4066 					    MSG_ORIG(MSG_FMT_SECSYM),
4067 					    EC_WORD(secsz), secname, symname);
4068 				}
4069 
4070 				continue;
4071 			}
4072 
4073 			/*
4074 			 * Generate an error if the section name index is zero
4075 			 * or exceeds the shstrtab data.  Fall through to
4076 			 * fabricate a section name.
4077 			 */
4078 			if ((_cache->c_shdr->sh_name == 0) ||
4079 			    /* LINTED */
4080 			    (nameshdr->sh_size <= _cache->c_shdr->sh_name)) {
4081 				(void) fprintf(stderr,
4082 				    MSG_INTL(MSG_ERR_BADSHNAME), file,
4083 				    EC_WORD(ndx),
4084 				    EC_XWORD(_cache->c_shdr->sh_name));
4085 			}
4086 		}
4087 
4088 		/*
4089 		 * If there exists no shstrtab data, or a section header has no
4090 		 * name (an invalid index of 0), then compose a name for the
4091 		 * section.
4092 		 */
4093 		(void) snprintf(scnndxnm, sizeof (scnndxnm),
4094 		    MSG_INTL(MSG_FMT_SCNNDX), ndx);
4095 
4096 		if ((_cache->c_name = malloc(strlen(scnndxnm) + 1)) == NULL) {
4097 			int err = errno;
4098 			(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
4099 			    file, strerror(err));
4100 			return (0);
4101 		}
4102 		(void) strcpy(_cache->c_name, scnndxnm);
4103 	}
4104 
4105 	/*
4106 	 * Having collected all the sections, validate their address range.
4107 	 * Cases have existed where the section information has been invalid.
4108 	 * This can lead to all sorts of other, hard to diagnose errors, as
4109 	 * each section is processed individually (ie. with elf_getdata()).
4110 	 * Here, we carry out some address comparisons to catch a family of
4111 	 * overlapping memory issues we have observed (likely, there are others
4112 	 * that we have yet to discover).
4113 	 *
4114 	 * Note, should any memory overlap occur, obtaining any additional
4115 	 * data from the file is questionable.  However, it might still be
4116 	 * possible to inspect the ELF header, Programs headers, or individual
4117 	 * sections, so rather than bailing on an error condition, continue
4118 	 * processing to see if any data can be salvaged.
4119 	 */
4120 	if (shdr_ndx_arr_cnt > 1) {
4121 		sort_shdr_ndx_arr_cache = cache;
4122 		qsort(shdr_ndx_arr, shdr_ndx_arr_cnt,
4123 		    sizeof (*shdr_ndx_arr), sort_shdr_ndx_arr);
4124 	}
4125 	for (ndx = 0; ndx < shdr_ndx_arr_cnt; ndx++) {
4126 		Cache	*_cache = cache + shdr_ndx_arr[ndx];
4127 		Shdr	*shdr = _cache->c_shdr;
4128 		Off	bgn1, bgn = shdr->sh_offset;
4129 		Off	end1, end = shdr->sh_offset + shdr->sh_size;
4130 		size_t	ndx1;
4131 
4132 		/*
4133 		 * Check the section against all following ones, reporting
4134 		 * any overlaps. Since we've sorted the sections by offset,
4135 		 * we can stop after the first comparison that fails. There
4136 		 * are no overlaps in a properly formed ELF file, in which
4137 		 * case this algorithm runs in O(n) time. This will degenerate
4138 		 * to O(n^2) for a completely broken file. Such a file is
4139 		 * (1) highly unlikely, and (2) unusable, so it is reasonable
4140 		 * for the analysis to take longer.
4141 		 */
4142 		for (ndx1 = ndx + 1; ndx1 < shdr_ndx_arr_cnt; ndx1++) {
4143 			Cache	*_cache1 = cache + shdr_ndx_arr[ndx1];
4144 			Shdr	*shdr1 = _cache1->c_shdr;
4145 
4146 			bgn1 = shdr1->sh_offset;
4147 			end1 = shdr1->sh_offset + shdr1->sh_size;
4148 
4149 			if (((bgn1 <= bgn) && (end1 > bgn)) ||
4150 			    ((bgn1 < end) && (end1 >= end))) {
4151 				(void) fprintf(stderr,
4152 				    MSG_INTL(MSG_ERR_SECMEMOVER), file,
4153 				    EC_WORD(elf_ndxscn(_cache->c_scn)),
4154 				    _cache->c_name, EC_OFF(bgn), EC_OFF(end),
4155 				    EC_WORD(elf_ndxscn(_cache1->c_scn)),
4156 				    _cache1->c_name, EC_OFF(bgn1),
4157 				    EC_OFF(end1));
4158 			} else {	/* No overlap, so can stop */
4159 				break;
4160 			}
4161 		}
4162 
4163 		/*
4164 		 * In addition to checking for sections overlapping
4165 		 * each other (done above), we should also make sure
4166 		 * the section doesn't overlap the section header array.
4167 		 */
4168 		bgn1 = ehdr->e_shoff;
4169 		end1 = ehdr->e_shoff + (ehdr->e_shentsize * ehdr->e_shnum);
4170 
4171 		if (((bgn1 <= bgn) && (end1 > bgn)) ||
4172 		    ((bgn1 < end) && (end1 >= end))) {
4173 			(void) fprintf(stderr,
4174 			    MSG_INTL(MSG_ERR_SHDRMEMOVER), file, EC_OFF(bgn1),
4175 			    EC_OFF(end1),
4176 			    EC_WORD(elf_ndxscn(_cache->c_scn)),
4177 			    _cache->c_name, EC_OFF(bgn), EC_OFF(end));
4178 		}
4179 	}
4180 
4181 	/*
4182 	 * Obtain the data for each section.
4183 	 */
4184 	for (ndx = 1; ndx < shnum; ndx++) {
4185 		Cache	*_cache = &cache[ndx];
4186 		Elf_Scn	*scn = _cache->c_scn;
4187 
4188 		if ((_cache->c_data = elf_getdata(scn, NULL)) == NULL) {
4189 			failure(file, MSG_ORIG(MSG_ELF_GETDATA));
4190 			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCNDATA),
4191 			    EC_WORD(elf_ndxscn(scn)));
4192 		}
4193 
4194 		/*
4195 		 * If a string table, verify that it has NULL first and
4196 		 * final bytes.
4197 		 */
4198 		if ((_cache->c_shdr->sh_type == SHT_STRTAB) &&
4199 		    (_cache->c_data->d_buf != NULL) &&
4200 		    (_cache->c_data->d_size > 0)) {
4201 			const char *s = _cache->c_data->d_buf;
4202 
4203 			if ((*s != '\0') ||
4204 			    (*(s + _cache->c_data->d_size - 1) != '\0'))
4205 				(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALSTR),
4206 				    file, _cache->c_name);
4207 		}
4208 	}
4209 
4210 	return (1);
4211 }
4212 
4213 
4214 
4215 /*
4216  * Generate a cache of section headers and related information
4217  * for use by the rest of elfdump. If requested (or the file
4218  * contains no section headers), we generate a fake set of
4219  * headers from the information accessible from the program headers.
4220  * Otherwise, we use the real section headers contained in the file.
4221  */
4222 static int
4223 create_cache(const char *file, int fd, Elf *elf, Ehdr *ehdr, Cache **cache,
4224     size_t shstrndx, size_t *shnum, uint_t *flags)
4225 {
4226 	/*
4227 	 * If there are no section headers, then resort to synthesizing
4228 	 * section headers from the program headers. This is normally
4229 	 * only done by explicit request, but in this case there's no
4230 	 * reason not to go ahead, since the alternative is simply to quit.
4231 	 */
4232 	if ((*shnum <= 1) && ((*flags & FLG_CTL_FAKESHDR) == 0)) {
4233 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_NOSHDR), file);
4234 		*flags |= FLG_CTL_FAKESHDR;
4235 	}
4236 
4237 	if (*flags & FLG_CTL_FAKESHDR) {
4238 		if (fake_shdr_cache(file, fd, elf, ehdr, cache, shnum) == 0)
4239 			return (0);
4240 	} else {
4241 		if (shdr_cache(file, elf, ehdr, shstrndx, *shnum,
4242 		    cache, *flags) == 0)
4243 			return (0);
4244 	}
4245 
4246 	return (1);
4247 }
4248 
4249 int
4250 regular(const char *file, int fd, Elf *elf, uint_t flags,
4251     const char *wname, int wfd, uchar_t osabi)
4252 {
4253 	enum { CACHE_NEEDED, CACHE_OK, CACHE_FAIL} cache_state = CACHE_NEEDED;
4254 	Elf_Scn		*scn;
4255 	Ehdr		*ehdr;
4256 	size_t		ndx, shstrndx, shnum, phnum;
4257 	Shdr		*shdr;
4258 	Cache		*cache;
4259 	VERSYM_STATE	versym;
4260 	int		ret = 0;
4261 	int		addr_align;
4262 
4263 	if ((ehdr = elf_getehdr(elf)) == NULL) {
4264 		failure(file, MSG_ORIG(MSG_ELF_GETEHDR));
4265 		return (ret);
4266 	}
4267 
4268 	if (elf_getshdrnum(elf, &shnum) == -1) {
4269 		failure(file, MSG_ORIG(MSG_ELF_GETSHDRNUM));
4270 		return (ret);
4271 	}
4272 
4273 	if (elf_getshdrstrndx(elf, &shstrndx) == -1) {
4274 		failure(file, MSG_ORIG(MSG_ELF_GETSHDRSTRNDX));
4275 		return (ret);
4276 	}
4277 
4278 	if (elf_getphdrnum(elf, &phnum) == -1) {
4279 		failure(file, MSG_ORIG(MSG_ELF_GETPHDRNUM));
4280 		return (ret);
4281 	}
4282 	/*
4283 	 * If the user requested section headers derived from the
4284 	 * program headers (-P option) and this file doesn't have
4285 	 * any program headers (i.e. ET_REL), then we can't do it.
4286 	 */
4287 	if ((phnum == 0) && (flags & FLG_CTL_FAKESHDR)) {
4288 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_PNEEDSPH), file);
4289 		return (ret);
4290 	}
4291 
4292 
4293 	if ((scn = elf_getscn(elf, 0)) != NULL) {
4294 		if ((shdr = elf_getshdr(scn)) == NULL) {
4295 			failure(file, MSG_ORIG(MSG_ELF_GETSHDR));
4296 			(void) fprintf(stderr, MSG_INTL(MSG_ELF_ERR_SCN), 0);
4297 			return (ret);
4298 		}
4299 	} else
4300 		shdr = NULL;
4301 
4302 	/*
4303 	 * Print the elf header.
4304 	 */
4305 	if (flags & FLG_SHOW_EHDR)
4306 		Elf_ehdr(0, ehdr, shdr);
4307 
4308 	/*
4309 	 * If the section headers or program headers have inadequate
4310 	 * alignment for the class of object, print a warning. libelf
4311 	 * can handle such files, but programs that use them can crash
4312 	 * when they dereference unaligned items.
4313 	 *
4314 	 * Note that the AMD64 ABI, although it is a 64-bit architecture,
4315 	 * allows access to data types smaller than 128-bits to be on
4316 	 * word alignment.
4317 	 */
4318 	if (ehdr->e_machine == EM_AMD64)
4319 		addr_align = sizeof (Word);
4320 	else
4321 		addr_align = sizeof (Addr);
4322 
4323 	if (ehdr->e_phoff & (addr_align - 1))
4324 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADPHDRALIGN), file);
4325 	if (ehdr->e_shoff & (addr_align - 1))
4326 		(void) fprintf(stderr, MSG_INTL(MSG_ERR_BADSHDRALIGN), file);
4327 
4328 
4329 	/*
4330 	 * Determine the Operating System ABI (osabi) we will use to
4331 	 * interpret the object.
4332 	 */
4333 	if (flags & FLG_CTL_OSABI) {
4334 		/*
4335 		 * If the user explicitly specifies '-O none', we need
4336 		 * to display a completely generic view of the file.
4337 		 * However, libconv is written to assume that ELFOSABI_NONE
4338 		 * is equivalent to ELFOSABI_SOLARIS. To get the desired
4339 		 * effect, we use an osabi that libconv has no knowledge of.
4340 		 */
4341 		if (osabi == ELFOSABI_NONE)
4342 			osabi = ELFOSABI_UNKNOWN4;
4343 	} else {
4344 		/* Determine osabi from file */
4345 		osabi = ehdr->e_ident[EI_OSABI];
4346 		if (osabi == ELFOSABI_NONE) {
4347 			/*
4348 			 * Chicken/Egg scenario:
4349 			 *
4350 			 * Ideally, we wait to create the section header cache
4351 			 * until after the program headers are printed. If we
4352 			 * only output program headers, we can skip building
4353 			 * the cache entirely.
4354 			 *
4355 			 * Proper interpretation of program headers requires
4356 			 * the osabi, which is supposed to be in the ELF header.
4357 			 * However, many systems (Solaris and Linux included)
4358 			 * have a history of setting the osabi to the generic
4359 			 * SysV ABI (ELFOSABI_NONE). We assume ELFOSABI_SOLARIS
4360 			 * in such cases, but would like to check the object
4361 			 * to see if it has a Linux .note.ABI-tag section,
4362 			 * which implies ELFOSABI_LINUX. This requires a
4363 			 * section header cache.
4364 			 *
4365 			 * To break the cycle, we create section headers now
4366 			 * if osabi is ELFOSABI_NONE, and later otherwise.
4367 			 * If it succeeds, we use them, if not, we defer
4368 			 * exiting until after the program headers are out.
4369 			 */
4370 			if (create_cache(file, fd, elf, ehdr, &cache,
4371 			    shstrndx, &shnum, &flags) == 0) {
4372 				cache_state = CACHE_FAIL;
4373 			} else {
4374 				cache_state = CACHE_OK;
4375 				if (has_linux_abi_note(cache, shnum, file)) {
4376 					Conv_inv_buf_t	ibuf1, ibuf2;
4377 
4378 					(void) fprintf(stderr,
4379 					    MSG_INTL(MSG_INFO_LINUXOSABI), file,
4380 					    conv_ehdr_osabi(osabi, 0, &ibuf1),
4381 					    conv_ehdr_osabi(ELFOSABI_LINUX,
4382 					    0, &ibuf2));
4383 					osabi = ELFOSABI_LINUX;
4384 				}
4385 			}
4386 		}
4387 		/*
4388 		 * We treat ELFOSABI_NONE identically to ELFOSABI_SOLARIS.
4389 		 * Mapping NONE to SOLARIS simplifies the required test.
4390 		 */
4391 		if (osabi == ELFOSABI_NONE)
4392 			osabi = ELFOSABI_SOLARIS;
4393 	}
4394 
4395 	/*
4396 	 * Print the program headers.
4397 	 */
4398 	if ((flags & FLG_SHOW_PHDR) && (phnum != 0)) {
4399 		Phdr	*phdr;
4400 
4401 		if ((phdr = elf_getphdr(elf)) == NULL) {
4402 			failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
4403 			return (ret);
4404 		}
4405 
4406 		for (ndx = 0; ndx < phnum; phdr++, ndx++) {
4407 			if (!match(MATCH_F_PHDR| MATCH_F_NDX | MATCH_F_TYPE,
4408 			    NULL, ndx, phdr->p_type))
4409 				continue;
4410 
4411 			dbg_print(0, MSG_ORIG(MSG_STR_EMPTY));
4412 			dbg_print(0, MSG_INTL(MSG_ELF_PHDR), EC_WORD(ndx));
4413 			Elf_phdr(0, osabi, ehdr->e_machine, phdr);
4414 		}
4415 	}
4416 
4417 	/*
4418 	 * If we have flag bits set that explicitly require a show or calc
4419 	 * operation, but none of them require the section headers, then
4420 	 * we are done and can return now.
4421 	 */
4422 	if (((flags & (FLG_MASK_SHOW | FLG_MASK_CALC)) != 0) &&
4423 	    ((flags & (FLG_MASK_SHOW_SHDR | FLG_MASK_CALC_SHDR)) == 0))
4424 		return (ret);
4425 
4426 	/*
4427 	 * Everything from this point on requires section headers.
4428 	 * If we have no section headers, there is no reason to continue.
4429 	 *
4430 	 * If we tried above to create the section header cache and failed,
4431 	 * it is time to exit. Otherwise, create it if needed.
4432 	 */
4433 	switch (cache_state) {
4434 	case CACHE_NEEDED:
4435 		if (create_cache(file, fd, elf, ehdr, &cache, shstrndx,
4436 		    &shnum, &flags) == 0)
4437 			return (ret);
4438 		break;
4439 	case CACHE_FAIL:
4440 		return (ret);
4441 	}
4442 	if (shnum <= 1)
4443 		goto done;
4444 
4445 	/*
4446 	 * If -w was specified, find and write out the section(s) data.
4447 	 */
4448 	if (wfd) {
4449 		for (ndx = 1; ndx < shnum; ndx++) {
4450 			Cache	*_cache = &cache[ndx];
4451 
4452 			if (match(MATCH_F_STRICT | MATCH_F_ALL, _cache->c_name,
4453 			    ndx, _cache->c_shdr->sh_type) &&
4454 			    _cache->c_data && _cache->c_data->d_buf) {
4455 				if (write(wfd, _cache->c_data->d_buf,
4456 				    _cache->c_data->d_size) !=
4457 				    _cache->c_data->d_size) {
4458 					int err = errno;
4459 					(void) fprintf(stderr,
4460 					    MSG_INTL(MSG_ERR_WRITE), wname,
4461 					    strerror(err));
4462 					/*
4463 					 * Return an exit status of 1, because
4464 					 * the failure is not related to the
4465 					 * ELF file, but by system resources.
4466 					 */
4467 					ret = 1;
4468 					goto done;
4469 				}
4470 			}
4471 		}
4472 	}
4473 
4474 	/*
4475 	 * If we have no flag bits set that explicitly require a show or calc
4476 	 * operation, but match options (-I, -N, -T) were used, then run
4477 	 * through the section headers and see if we can't deduce show flags
4478 	 * from the match options given.
4479 	 *
4480 	 * We don't do this if -w was specified, because (-I, -N, -T) used
4481 	 * with -w in lieu of some other option is supposed to be quiet.
4482 	 */
4483 	if ((wfd == 0) && (flags & FLG_CTL_MATCH) &&
4484 	    ((flags & (FLG_MASK_SHOW | FLG_MASK_CALC)) == 0)) {
4485 		for (ndx = 1; ndx < shnum; ndx++) {
4486 			Cache	*_cache = &cache[ndx];
4487 
4488 			if (!match(MATCH_F_STRICT | MATCH_F_ALL, _cache->c_name,
4489 			    ndx, _cache->c_shdr->sh_type))
4490 				continue;
4491 
4492 			switch (_cache->c_shdr->sh_type) {
4493 			case SHT_PROGBITS:
4494 				/*
4495 				 * Heuristic time: It is usually bad form
4496 				 * to assume the meaning/format of a PROGBITS
4497 				 * section based on its name. However, there
4498 				 * are ABI mandated exceptions. Check for
4499 				 * these special names.
4500 				 */
4501 
4502 				/* The ELF ABI specifies .interp and .got */
4503 				if (strcmp(_cache->c_name,
4504 				    MSG_ORIG(MSG_ELF_INTERP)) == 0) {
4505 					flags |= FLG_SHOW_INTERP;
4506 					break;
4507 				}
4508 				if (strcmp(_cache->c_name,
4509 				    MSG_ORIG(MSG_ELF_GOT)) == 0) {
4510 					flags |= FLG_SHOW_GOT;
4511 					break;
4512 				}
4513 				/*
4514 				 * The GNU compilers, and amd64 ABI, define
4515 				 * .eh_frame and .eh_frame_hdr. The Sun
4516 				 * C++ ABI defines .exception_ranges.
4517 				 */
4518 				if ((strncmp(_cache->c_name,
4519 				    MSG_ORIG(MSG_SCN_FRM),
4520 				    MSG_SCN_FRM_SIZE) == 0) ||
4521 				    (strncmp(_cache->c_name,
4522 				    MSG_ORIG(MSG_SCN_EXRANGE),
4523 				    MSG_SCN_EXRANGE_SIZE) == 0)) {
4524 					flags |= FLG_SHOW_UNWIND;
4525 					break;
4526 				}
4527 				break;
4528 
4529 			case SHT_SYMTAB:
4530 			case SHT_DYNSYM:
4531 			case SHT_SUNW_LDYNSYM:
4532 			case SHT_SUNW_versym:
4533 			case SHT_SYMTAB_SHNDX:
4534 				flags |= FLG_SHOW_SYMBOLS;
4535 				break;
4536 
4537 			case SHT_RELA:
4538 			case SHT_REL:
4539 				flags |= FLG_SHOW_RELOC;
4540 				break;
4541 
4542 			case SHT_HASH:
4543 				flags |= FLG_SHOW_HASH;
4544 				break;
4545 
4546 			case SHT_DYNAMIC:
4547 				flags |= FLG_SHOW_DYNAMIC;
4548 				break;
4549 
4550 			case SHT_NOTE:
4551 				flags |= FLG_SHOW_NOTE;
4552 				break;
4553 
4554 			case SHT_GROUP:
4555 				flags |= FLG_SHOW_GROUP;
4556 				break;
4557 
4558 			case SHT_SUNW_symsort:
4559 			case SHT_SUNW_tlssort:
4560 				flags |= FLG_SHOW_SORT;
4561 				break;
4562 
4563 			case SHT_SUNW_cap:
4564 				flags |= FLG_SHOW_CAP;
4565 				break;
4566 
4567 			case SHT_SUNW_move:
4568 				flags |= FLG_SHOW_MOVE;
4569 				break;
4570 
4571 			case SHT_SUNW_syminfo:
4572 				flags |= FLG_SHOW_SYMINFO;
4573 				break;
4574 
4575 			case SHT_SUNW_verdef:
4576 			case SHT_SUNW_verneed:
4577 				flags |= FLG_SHOW_VERSIONS;
4578 				break;
4579 
4580 			case SHT_AMD64_UNWIND:
4581 				flags |= FLG_SHOW_UNWIND;
4582 				break;
4583 			}
4584 		}
4585 	}
4586 
4587 
4588 	if (flags & FLG_SHOW_SHDR)
4589 		sections(file, cache, shnum, ehdr, osabi);
4590 
4591 	if (flags & FLG_SHOW_INTERP)
4592 		interp(file, cache, shnum, phnum, elf);
4593 
4594 	if ((osabi == ELFOSABI_SOLARIS) || (osabi == ELFOSABI_LINUX))
4595 		versions(cache, shnum, file, flags, &versym);
4596 
4597 	if (flags & FLG_SHOW_SYMBOLS)
4598 		symbols(cache, shnum, ehdr, osabi, &versym, file, flags);
4599 
4600 	if ((flags & FLG_SHOW_SORT) && (osabi == ELFOSABI_SOLARIS))
4601 		sunw_sort(cache, shnum, ehdr, osabi, &versym, file, flags);
4602 
4603 	if (flags & FLG_SHOW_HASH)
4604 		hash(cache, shnum, file, flags);
4605 
4606 	if (flags & FLG_SHOW_GOT)
4607 		got(cache, shnum, ehdr, file);
4608 
4609 	if (flags & FLG_SHOW_GROUP)
4610 		group(cache, shnum, file, flags);
4611 
4612 	if (flags & FLG_SHOW_SYMINFO)
4613 		syminfo(cache, shnum, file);
4614 
4615 	if (flags & FLG_SHOW_RELOC)
4616 		reloc(cache, shnum, ehdr, file);
4617 
4618 	if (flags & FLG_SHOW_DYNAMIC)
4619 		dynamic(cache, shnum, ehdr, osabi, file);
4620 
4621 	if (flags & FLG_SHOW_NOTE) {
4622 		Word	note_cnt;
4623 		size_t	note_shnum;
4624 		Cache	*note_cache;
4625 
4626 		note_cnt = note(cache, shnum, ehdr, file);
4627 
4628 		/*
4629 		 * Solaris core files have section headers, but these
4630 		 * headers do not include SHT_NOTE sections that reference
4631 		 * the core note sections. This means that note() won't
4632 		 * find the core notes. Fake section headers (-P option)
4633 		 * recover these sections, but it is inconvenient to require
4634 		 * users to specify -P in this situation. If the following
4635 		 * are all true:
4636 		 *
4637 		 *	- No note sections were found
4638 		 *	- This is a core file
4639 		 *	- We are not already using fake section headers
4640 		 *
4641 		 * then we will automatically generate fake section headers
4642 		 * and then process them in a second call to note().
4643 		 */
4644 		if ((note_cnt == 0) && (ehdr->e_type == ET_CORE) &&
4645 		    !(flags & FLG_CTL_FAKESHDR) &&
4646 		    (fake_shdr_cache(file, fd, elf, ehdr,
4647 		    &note_cache, &note_shnum) != 0)) {
4648 			(void) note(note_cache, note_shnum, ehdr, file);
4649 			fake_shdr_cache_free(note_cache, note_shnum);
4650 		}
4651 	}
4652 
4653 	if ((flags & FLG_SHOW_MOVE) && (osabi == ELFOSABI_SOLARIS))
4654 		move(cache, shnum, file, flags);
4655 
4656 	if (flags & FLG_CALC_CHECKSUM)
4657 		checksum(elf);
4658 
4659 	if ((flags & FLG_SHOW_CAP) && (osabi == ELFOSABI_SOLARIS))
4660 		cap(file, cache, shnum, phnum, ehdr, elf);
4661 
4662 	if ((flags & FLG_SHOW_UNWIND) &&
4663 	    ((osabi == ELFOSABI_SOLARIS) || (osabi == ELFOSABI_LINUX)))
4664 		unwind(cache, shnum, phnum, ehdr, osabi, file, elf, flags);
4665 
4666 
4667 	/* Release the memory used to cache section headers */
4668 done:
4669 	if (flags & FLG_CTL_FAKESHDR)
4670 		fake_shdr_cache_free(cache, shnum);
4671 	else
4672 		free(cache);
4673 
4674 	return (ret);
4675 }
4676