Home | History | Annotate | Download | only in common
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 #include <sys/types.h>
     27 #include <sys/utsname.h>
     28 #include <sys/sysmacros.h>
     29 
     30 #include <alloca.h>
     31 #include <rtld_db.h>
     32 #include <libgen.h>
     33 #include <limits.h>
     34 #include <string.h>
     35 #include <stdlib.h>
     36 #include <unistd.h>
     37 #include <errno.h>
     38 #include <gelf.h>
     39 #include <stddef.h>
     40 
     41 #include "libproc.h"
     42 #include "Pcontrol.h"
     43 #include "P32ton.h"
     44 #include "Putil.h"
     45 
     46 /*
     47  * Pcore.c - Code to initialize a ps_prochandle from a core dump.  We
     48  * allocate an additional structure to hold information from the core
     49  * file, and attach this to the standard ps_prochandle in place of the
     50  * ability to examine /proc/<pid>/ files.
     51  */
     52 
     53 /*
     54  * Basic i/o function for reading and writing from the process address space
     55  * stored in the core file and associated shared libraries.  We compute the
     56  * appropriate fd and offsets, and let the provided prw function do the rest.
     57  */
     58 static ssize_t
     59 core_rw(struct ps_prochandle *P, void *buf, size_t n, uintptr_t addr,
     60     ssize_t (*prw)(int, void *, size_t, off64_t))
     61 {
     62 	ssize_t resid = n;
     63 
     64 	while (resid != 0) {
     65 		map_info_t *mp = Paddr2mptr(P, addr);
     66 
     67 		uintptr_t mapoff;
     68 		ssize_t len;
     69 		off64_t off;
     70 		int fd;
     71 
     72 		if (mp == NULL)
     73 			break;	/* No mapping for this address */
     74 
     75 		if (mp->map_pmap.pr_mflags & MA_RESERVED1) {
     76 			if (mp->map_file == NULL || mp->map_file->file_fd < 0)
     77 				break;	/* No file or file not open */
     78 
     79 			fd = mp->map_file->file_fd;
     80 		} else
     81 			fd = P->asfd;
     82 
     83 		mapoff = addr - mp->map_pmap.pr_vaddr;
     84 		len = MIN(resid, mp->map_pmap.pr_size - mapoff);
     85 		off = mp->map_offset + mapoff;
     86 
     87 		if ((len = prw(fd, buf, len, off)) <= 0)
     88 			break;
     89 
     90 		resid -= len;
     91 		addr += len;
     92 		buf = (char *)buf + len;
     93 	}
     94 
     95 	/*
     96 	 * Important: Be consistent with the behavior of i/o on the as file:
     97 	 * writing to an invalid address yields EIO; reading from an invalid
     98 	 * address falls through to returning success and zero bytes.
     99 	 */
    100 	if (resid == n && n != 0 && prw != pread64) {
    101 		errno = EIO;
    102 		return (-1);
    103 	}
    104 
    105 	return (n - resid);
    106 }
    107 
    108 static ssize_t
    109 Pread_core(struct ps_prochandle *P, void *buf, size_t n, uintptr_t addr)
    110 {
    111 	return (core_rw(P, buf, n, addr, pread64));
    112 }
    113 
    114 static ssize_t
    115 Pwrite_core(struct ps_prochandle *P, const void *buf, size_t n, uintptr_t addr)
    116 {
    117 	return (core_rw(P, (void *)buf, n, addr,
    118 	    (ssize_t (*)(int, void *, size_t, off64_t)) pwrite64));
    119 }
    120 
    121 static const ps_rwops_t P_core_ops = { Pread_core, Pwrite_core };
    122 
    123 /*
    124  * Return the lwp_info_t for the given lwpid.  If no such lwpid has been
    125  * encountered yet, allocate a new structure and return a pointer to it.
    126  * Create a list of lwp_info_t structures sorted in decreasing lwp_id order.
    127  */
    128 static lwp_info_t *
    129 lwpid2info(struct ps_prochandle *P, lwpid_t id)
    130 {
    131 	lwp_info_t *lwp = list_next(&P->core->core_lwp_head);
    132 	lwp_info_t *next;
    133 	uint_t i;
    134 
    135 	for (i = 0; i < P->core->core_nlwp; i++, lwp = list_next(lwp)) {
    136 		if (lwp->lwp_id == id) {
    137 			P->core->core_lwp = lwp;
    138 			return (lwp);
    139 		}
    140 		if (lwp->lwp_id < id) {
    141 			break;
    142 		}
    143 	}
    144 
    145 	next = lwp;
    146 	if ((lwp = calloc(1, sizeof (lwp_info_t))) == NULL)
    147 		return (NULL);
    148 
    149 	list_link(lwp, next);
    150 	lwp->lwp_id = id;
    151 
    152 	P->core->core_lwp = lwp;
    153 	P->core->core_nlwp++;
    154 
    155 	return (lwp);
    156 }
    157 
    158 /*
    159  * The core file itself contains a series of NOTE segments containing saved
    160  * structures from /proc at the time the process died.  For each note we
    161  * comprehend, we define a function to read it in from the core file,
    162  * convert it to our native data model if necessary, and store it inside
    163  * the ps_prochandle.  Each function is invoked by Pfgrab_core() with the
    164  * seek pointer on P->asfd positioned appropriately.  We populate a table
    165  * of pointers to these note functions below.
    166  */
    167 
    168 static int
    169 note_pstatus(struct ps_prochandle *P, size_t nbytes)
    170 {
    171 #ifdef _LP64
    172 	if (P->core->core_dmodel == PR_MODEL_ILP32) {
    173 		pstatus32_t ps32;
    174 
    175 		if (nbytes < sizeof (pstatus32_t) ||
    176 		    read(P->asfd, &ps32, sizeof (ps32)) != sizeof (ps32))
    177 			goto err;
    178 
    179 		pstatus_32_to_n(&ps32, &P->status);
    180 
    181 	} else
    182 #endif
    183 	if (nbytes < sizeof (pstatus_t) ||
    184 	    read(P->asfd, &P->status, sizeof (pstatus_t)) != sizeof (pstatus_t))
    185 		goto err;
    186 
    187 	P->orig_status = P->status;
    188 	P->pid = P->status.pr_pid;
    189 
    190 	return (0);
    191 
    192 err:
    193 	dprintf("Pgrab_core: failed to read NT_PSTATUS\n");
    194 	return (-1);
    195 }
    196 
    197 static int
    198 note_lwpstatus(struct ps_prochandle *P, size_t nbytes)
    199 {
    200 	lwp_info_t *lwp;
    201 	lwpstatus_t lps;
    202 
    203 #ifdef _LP64
    204 	if (P->core->core_dmodel == PR_MODEL_ILP32) {
    205 		lwpstatus32_t l32;
    206 
    207 		if (nbytes < sizeof (lwpstatus32_t) ||
    208 		    read(P->asfd, &l32, sizeof (l32)) != sizeof (l32))
    209 			goto err;
    210 
    211 		lwpstatus_32_to_n(&l32, &lps);
    212 	} else
    213 #endif
    214 	if (nbytes < sizeof (lwpstatus_t) ||
    215 	    read(P->asfd, &lps, sizeof (lps)) != sizeof (lps))
    216 		goto err;
    217 
    218 	if ((lwp = lwpid2info(P, lps.pr_lwpid)) == NULL) {
    219 		dprintf("Pgrab_core: failed to add NT_LWPSTATUS\n");
    220 		return (-1);
    221 	}
    222 
    223 	/*
    224 	 * Erase a useless and confusing artifact of the kernel implementation:
    225 	 * the lwps which did *not* create the core will show SIGKILL.  We can
    226 	 * be assured this is bogus because SIGKILL can't produce core files.
    227 	 */
    228 	if (lps.pr_cursig == SIGKILL)
    229 		lps.pr_cursig = 0;
    230 
    231 	(void) memcpy(&lwp->lwp_status, &lps, sizeof (lps));
    232 	return (0);
    233 
    234 err:
    235 	dprintf("Pgrab_core: failed to read NT_LWPSTATUS\n");
    236 	return (-1);
    237 }
    238 
    239 static int
    240 note_psinfo(struct ps_prochandle *P, size_t nbytes)
    241 {
    242 #ifdef _LP64
    243 	if (P->core->core_dmodel == PR_MODEL_ILP32) {
    244 		psinfo32_t ps32;
    245 
    246 		if (nbytes < sizeof (psinfo32_t) ||
    247 		    read(P->asfd, &ps32, sizeof (ps32)) != sizeof (ps32))
    248 			goto err;
    249 
    250 		psinfo_32_to_n(&ps32, &P->psinfo);
    251 	} else
    252 #endif
    253 	if (nbytes < sizeof (psinfo_t) ||
    254 	    read(P->asfd, &P->psinfo, sizeof (psinfo_t)) != sizeof (psinfo_t))
    255 		goto err;
    256 
    257 	dprintf("pr_fname = <%s>\n", P->psinfo.pr_fname);
    258 	dprintf("pr_psargs = <%s>\n", P->psinfo.pr_psargs);
    259 	dprintf("pr_wstat = 0x%x\n", P->psinfo.pr_wstat);
    260 
    261 	return (0);
    262 
    263 err:
    264 	dprintf("Pgrab_core: failed to read NT_PSINFO\n");
    265 	return (-1);
    266 }
    267 
    268 static int
    269 note_lwpsinfo(struct ps_prochandle *P, size_t nbytes)
    270 {
    271 	lwp_info_t *lwp;
    272 	lwpsinfo_t lps;
    273 
    274 #ifdef _LP64
    275 	if (P->core->core_dmodel == PR_MODEL_ILP32) {
    276 		lwpsinfo32_t l32;
    277 
    278 		if (nbytes < sizeof (lwpsinfo32_t) ||
    279 		    read(P->asfd, &l32, sizeof (l32)) != sizeof (l32))
    280 			goto err;
    281 
    282 		lwpsinfo_32_to_n(&l32, &lps);
    283 	} else
    284 #endif
    285 	if (nbytes < sizeof (lwpsinfo_t) ||
    286 	    read(P->asfd, &lps, sizeof (lps)) != sizeof (lps))
    287 		goto err;
    288 
    289 	if ((lwp = lwpid2info(P, lps.pr_lwpid)) == NULL) {
    290 		dprintf("Pgrab_core: failed to add NT_LWPSINFO\n");
    291 		return (-1);
    292 	}
    293 
    294 	(void) memcpy(&lwp->lwp_psinfo, &lps, sizeof (lps));
    295 	return (0);
    296 
    297 err:
    298 	dprintf("Pgrab_core: failed to read NT_LWPSINFO\n");
    299 	return (-1);
    300 }
    301 
    302 static int
    303 note_platform(struct ps_prochandle *P, size_t nbytes)
    304 {
    305 	char *plat;
    306 
    307 	if (P->core->core_platform != NULL)
    308 		return (0);	/* Already seen */
    309 
    310 	if (nbytes != 0 && ((plat = malloc(nbytes + 1)) != NULL)) {
    311 		if (read(P->asfd, plat, nbytes) != nbytes) {
    312 			dprintf("Pgrab_core: failed to read NT_PLATFORM\n");
    313 			free(plat);
    314 			return (-1);
    315 		}
    316 		plat[nbytes - 1] = '\0';
    317 		P->core->core_platform = plat;
    318 	}
    319 
    320 	return (0);
    321 }
    322 
    323 static int
    324 note_utsname(struct ps_prochandle *P, size_t nbytes)
    325 {
    326 	size_t ubytes = sizeof (struct utsname);
    327 	struct utsname *utsp;
    328 
    329 	if (P->core->core_uts != NULL || nbytes < ubytes)
    330 		return (0);	/* Already seen or bad size */
    331 
    332 	if ((utsp = malloc(ubytes)) == NULL)
    333 		return (-1);
    334 
    335 	if (read(P->asfd, utsp, ubytes) != ubytes) {
    336 		dprintf("Pgrab_core: failed to read NT_UTSNAME\n");
    337 		free(utsp);
    338 		return (-1);
    339 	}
    340 
    341 	if (_libproc_debug) {
    342 		dprintf("uts.sysname = \"%s\"\n", utsp->sysname);
    343 		dprintf("uts.nodename = \"%s\"\n", utsp->nodename);
    344 		dprintf("uts.release = \"%s\"\n", utsp->release);
    345 		dprintf("uts.version = \"%s\"\n", utsp->version);
    346 		dprintf("uts.machine = \"%s\"\n", utsp->machine);
    347 	}
    348 
    349 	P->core->core_uts = utsp;
    350 	return (0);
    351 }
    352 
    353 static int
    354 note_content(struct ps_prochandle *P, size_t nbytes)
    355 {
    356 	core_content_t content;
    357 
    358 	if (sizeof (P->core->core_content) != nbytes)
    359 		return (-1);
    360 
    361 	if (read(P->asfd, &content, sizeof (content)) != sizeof (content))
    362 		return (-1);
    363 
    364 	P->core->core_content = content;
    365 
    366 	dprintf("core content = %llx\n", content);
    367 
    368 	return (0);
    369 }
    370 
    371 static int
    372 note_cred(struct ps_prochandle *P, size_t nbytes)
    373 {
    374 	prcred_t *pcrp;
    375 	int ngroups;
    376 	const size_t min_size = sizeof (prcred_t) - sizeof (gid_t);
    377 
    378 	/*
    379 	 * We allow for prcred_t notes that are actually smaller than a
    380 	 * prcred_t since the last member isn't essential if there are
    381 	 * no group memberships. This allows for more flexibility when it
    382 	 * comes to slightly malformed -- but still valid -- notes.
    383 	 */
    384 	if (P->core->core_cred != NULL || nbytes < min_size)
    385 		return (0);	/* Already seen or bad size */
    386 
    387 	ngroups = (nbytes - min_size) / sizeof (gid_t);
    388 	nbytes = sizeof (prcred_t) + (ngroups - 1) * sizeof (gid_t);
    389 
    390 	if ((pcrp = malloc(nbytes)) == NULL)
    391 		return (-1);
    392 
    393 	if (read(P->asfd, pcrp, nbytes) != nbytes) {
    394 		dprintf("Pgrab_core: failed to read NT_PRCRED\n");
    395 		free(pcrp);
    396 		return (-1);
    397 	}
    398 
    399 	if (pcrp->pr_ngroups > ngroups) {
    400 		dprintf("pr_ngroups = %d; resetting to %d based on note size\n",
    401 		    pcrp->pr_ngroups, ngroups);
    402 		pcrp->pr_ngroups = ngroups;
    403 	}
    404 
    405 	P->core->core_cred = pcrp;
    406 	return (0);
    407 }
    408 
    409 #if defined(__i386) || defined(__amd64)
    410 static int
    411 note_ldt(struct ps_prochandle *P, size_t nbytes)
    412 {
    413 	struct ssd *pldt;
    414 	uint_t nldt;
    415 
    416 	if (P->core->core_ldt != NULL || nbytes < sizeof (struct ssd))
    417 		return (0);	/* Already seen or bad size */
    418 
    419 	nldt = nbytes / sizeof (struct ssd);
    420 	nbytes = nldt * sizeof (struct ssd);
    421 
    422 	if ((pldt = malloc(nbytes)) == NULL)
    423 		return (-1);
    424 
    425 	if (read(P->asfd, pldt, nbytes) != nbytes) {
    426 		dprintf("Pgrab_core: failed to read NT_LDT\n");
    427 		free(pldt);
    428 		return (-1);
    429 	}
    430 
    431 	P->core->core_ldt = pldt;
    432 	P->core->core_nldt = nldt;
    433 	return (0);
    434 }
    435 #endif	/* __i386 */
    436 
    437 static int
    438 note_priv(struct ps_prochandle *P, size_t nbytes)
    439 {
    440 	prpriv_t *pprvp;
    441 
    442 	if (P->core->core_priv != NULL || nbytes < sizeof (prpriv_t))
    443 		return (0);	/* Already seen or bad size */
    444 
    445 	if ((pprvp = malloc(nbytes)) == NULL)
    446 		return (-1);
    447 
    448 	if (read(P->asfd, pprvp, nbytes) != nbytes) {
    449 		dprintf("Pgrab_core: failed to read NT_PRPRIV\n");
    450 		free(pprvp);
    451 		return (-1);
    452 	}
    453 
    454 	P->core->core_priv = pprvp;
    455 	P->core->core_priv_size = nbytes;
    456 	return (0);
    457 }
    458 
    459 static int
    460 note_priv_info(struct ps_prochandle *P, size_t nbytes)
    461 {
    462 	extern void *__priv_parse_info();
    463 	priv_impl_info_t *ppii;
    464 
    465 	if (P->core->core_privinfo != NULL ||
    466 	    nbytes < sizeof (priv_impl_info_t))
    467 		return (0);	/* Already seen or bad size */
    468 
    469 	if ((ppii = malloc(nbytes)) == NULL)
    470 		return (-1);
    471 
    472 	if (read(P->asfd, ppii, nbytes) != nbytes ||
    473 	    PRIV_IMPL_INFO_SIZE(ppii) != nbytes) {
    474 		dprintf("Pgrab_core: failed to read NT_PRPRIVINFO\n");
    475 		free(ppii);
    476 		return (-1);
    477 	}
    478 
    479 	P->core->core_privinfo = __priv_parse_info(ppii);
    480 	P->core->core_ppii = ppii;
    481 	return (0);
    482 }
    483 
    484 static int
    485 note_zonename(struct ps_prochandle *P, size_t nbytes)
    486 {
    487 	char *zonename;
    488 
    489 	if (P->core->core_zonename != NULL)
    490 		return (0);	/* Already seen */
    491 
    492 	if (nbytes != 0) {
    493 		if ((zonename = malloc(nbytes)) == NULL)
    494 			return (-1);
    495 		if (read(P->asfd, zonename, nbytes) != nbytes) {
    496 			dprintf("Pgrab_core: failed to read NT_ZONENAME\n");
    497 			free(zonename);
    498 			return (-1);
    499 		}
    500 		zonename[nbytes - 1] = '\0';
    501 		P->core->core_zonename = zonename;
    502 	}
    503 
    504 	return (0);
    505 }
    506 
    507 static int
    508 note_auxv(struct ps_prochandle *P, size_t nbytes)
    509 {
    510 	size_t n, i;
    511 
    512 #ifdef _LP64
    513 	if (P->core->core_dmodel == PR_MODEL_ILP32) {
    514 		auxv32_t *a32;
    515 
    516 		n = nbytes / sizeof (auxv32_t);
    517 		nbytes = n * sizeof (auxv32_t);
    518 		a32 = alloca(nbytes);
    519 
    520 		if (read(P->asfd, a32, nbytes) != nbytes) {
    521 			dprintf("Pgrab_core: failed to read NT_AUXV\n");
    522 			return (-1);
    523 		}
    524 
    525 		if ((P->auxv = malloc(sizeof (auxv_t) * (n + 1))) == NULL)
    526 			return (-1);
    527 
    528 		for (i = 0; i < n; i++)
    529 			auxv_32_to_n(&a32[i], &P->auxv[i]);
    530 
    531 	} else {
    532 #endif
    533 		n = nbytes / sizeof (auxv_t);
    534 		nbytes = n * sizeof (auxv_t);
    535 
    536 		if ((P->auxv = malloc(nbytes + sizeof (auxv_t))) == NULL)
    537 			return (-1);
    538 
    539 		if (read(P->asfd, P->auxv, nbytes) != nbytes) {
    540 			free(P->auxv);
    541 			P->auxv = NULL;
    542 			return (-1);
    543 		}
    544 #ifdef _LP64
    545 	}
    546 #endif
    547 
    548 	if (_libproc_debug) {
    549 		for (i = 0; i < n; i++) {
    550 			dprintf("P->auxv[%lu] = ( %d, 0x%lx )\n", (ulong_t)i,
    551 			    P->auxv[i].a_type, P->auxv[i].a_un.a_val);
    552 		}
    553 	}
    554 
    555 	/*
    556 	 * Defensive coding for loops which depend upon the auxv array being
    557 	 * terminated by an AT_NULL element; in each case, we've allocated
    558 	 * P->auxv to have an additional element which we force to be AT_NULL.
    559 	 */
    560 	P->auxv[n].a_type = AT_NULL;
    561 	P->auxv[n].a_un.a_val = 0L;
    562 	P->nauxv = (int)n;
    563 
    564 	return (0);
    565 }
    566 
    567 #ifdef __sparc
    568 static int
    569 note_xreg(struct ps_prochandle *P, size_t nbytes)
    570 {
    571 	lwp_info_t *lwp = P->core->core_lwp;
    572 	size_t xbytes = sizeof (prxregset_t);
    573 	prxregset_t *xregs;
    574 
    575 	if (lwp == NULL || lwp->lwp_xregs != NULL || nbytes < xbytes)
    576 		return (0);	/* No lwp yet, already seen, or bad size */
    577 
    578 	if ((xregs = malloc(xbytes)) == NULL)
    579 		return (-1);
    580 
    581 	if (read(P->asfd, xregs, xbytes) != xbytes) {
    582 		dprintf("Pgrab_core: failed to read NT_PRXREG\n");
    583 		free(xregs);
    584 		return (-1);
    585 	}
    586 
    587 	lwp->lwp_xregs = xregs;
    588 	return (0);
    589 }
    590 
    591 static int
    592 note_gwindows(struct ps_prochandle *P, size_t nbytes)
    593 {
    594 	lwp_info_t *lwp = P->core->core_lwp;
    595 
    596 	if (lwp == NULL || lwp->lwp_gwins != NULL || nbytes == 0)
    597 		return (0);	/* No lwp yet or already seen or no data */
    598 
    599 	if ((lwp->lwp_gwins = malloc(sizeof (gwindows_t))) == NULL)
    600 		return (-1);
    601 
    602 	/*
    603 	 * Since the amount of gwindows data varies with how many windows were
    604 	 * actually saved, we just read up to the minimum of the note size
    605 	 * and the size of the gwindows_t type.  It doesn't matter if the read
    606 	 * fails since we have to zero out gwindows first anyway.
    607 	 */
    608 #ifdef _LP64
    609 	if (P->core->core_dmodel == PR_MODEL_ILP32) {
    610 		gwindows32_t g32;
    611 
    612 		(void) memset(&g32, 0, sizeof (g32));
    613 		(void) read(P->asfd, &g32, MIN(nbytes, sizeof (g32)));
    614 		gwindows_32_to_n(&g32, lwp->lwp_gwins);
    615 
    616 	} else {
    617 #endif
    618 		(void) memset(lwp->lwp_gwins, 0, sizeof (gwindows_t));
    619 		(void) read(P->asfd, lwp->lwp_gwins,
    620 		    MIN(nbytes, sizeof (gwindows_t)));
    621 #ifdef _LP64
    622 	}
    623 #endif
    624 	return (0);
    625 }
    626 
    627 #ifdef __sparcv9
    628 static int
    629 note_asrs(struct ps_prochandle *P, size_t nbytes)
    630 {
    631 	lwp_info_t *lwp = P->core->core_lwp;
    632 	int64_t *asrs;
    633 
    634 	if (lwp == NULL || lwp->lwp_asrs != NULL || nbytes < sizeof (asrset_t))
    635 		return (0);	/* No lwp yet, already seen, or bad size */
    636 
    637 	if ((asrs = malloc(sizeof (asrset_t))) == NULL)
    638 		return (-1);
    639 
    640 	if (read(P->asfd, asrs, sizeof (asrset_t)) != sizeof (asrset_t)) {
    641 		dprintf("Pgrab_core: failed to read NT_ASRS\n");
    642 		free(asrs);
    643 		return (-1);
    644 	}
    645 
    646 	lwp->lwp_asrs = asrs;
    647 	return (0);
    648 }
    649 #endif	/* __sparcv9 */
    650 #endif	/* __sparc */
    651 
    652 /*ARGSUSED*/
    653 static int
    654 note_notsup(struct ps_prochandle *P, size_t nbytes)
    655 {
    656 	dprintf("skipping unsupported note type\n");
    657 	return (0);
    658 }
    659 
    660 /*
    661  * Populate a table of function pointers indexed by Note type with our
    662  * functions to process each type of core file note:
    663  */
    664 static int (*nhdlrs[])(struct ps_prochandle *, size_t) = {
    665 	note_notsup,		/*  0	unassigned		*/
    666 	note_notsup,		/*  1	NT_PRSTATUS (old)	*/
    667 	note_notsup,		/*  2	NT_PRFPREG (old)	*/
    668 	note_notsup,		/*  3	NT_PRPSINFO (old)	*/
    669 #ifdef __sparc
    670 	note_xreg,		/*  4	NT_PRXREG		*/
    671 #else
    672 	note_notsup,		/*  4	NT_PRXREG		*/
    673 #endif
    674 	note_platform,		/*  5	NT_PLATFORM		*/
    675 	note_auxv,		/*  6	NT_AUXV			*/
    676 #ifdef __sparc
    677 	note_gwindows,		/*  7	NT_GWINDOWS		*/
    678 #ifdef __sparcv9
    679 	note_asrs,		/*  8	NT_ASRS			*/
    680 #else
    681 	note_notsup,		/*  8	NT_ASRS			*/
    682 #endif
    683 #else
    684 	note_notsup,		/*  7	NT_GWINDOWS		*/
    685 	note_notsup,		/*  8	NT_ASRS			*/
    686 #endif
    687 #if defined(__i386) || defined(__amd64)
    688 	note_ldt,		/*  9	NT_LDT			*/
    689 #else
    690 	note_notsup,		/*  9	NT_LDT			*/
    691 #endif
    692 	note_pstatus,		/* 10	NT_PSTATUS		*/
    693 	note_notsup,		/* 11	unassigned		*/
    694 	note_notsup,		/* 12	unassigned		*/
    695 	note_psinfo,		/* 13	NT_PSINFO		*/
    696 	note_cred,		/* 14	NT_PRCRED		*/
    697 	note_utsname,		/* 15	NT_UTSNAME		*/
    698 	note_lwpstatus,		/* 16	NT_LWPSTATUS		*/
    699 	note_lwpsinfo,		/* 17	NT_LWPSINFO		*/
    700 	note_priv,		/* 18	NT_PRPRIV		*/
    701 	note_priv_info,		/* 19	NT_PRPRIVINFO		*/
    702 	note_content,		/* 20	NT_CONTENT		*/
    703 	note_zonename,		/* 21	NT_ZONENAME		*/
    704 };
    705 
    706 /*
    707  * Add information on the address space mapping described by the given
    708  * PT_LOAD program header.  We fill in more information on the mapping later.
    709  */
    710 static int
    711 core_add_mapping(struct ps_prochandle *P, GElf_Phdr *php)
    712 {
    713 	int err = 0;
    714 	prmap_t pmap;
    715 
    716 	dprintf("mapping base %llx filesz %llu memsz %llu offset %llu\n",
    717 	    (u_longlong_t)php->p_vaddr, (u_longlong_t)php->p_filesz,
    718 	    (u_longlong_t)php->p_memsz, (u_longlong_t)php->p_offset);
    719 
    720 	pmap.pr_vaddr = (uintptr_t)php->p_vaddr;
    721 	pmap.pr_size = php->p_memsz;
    722 
    723 	/*
    724 	 * If Pgcore() or elfcore() fail to write a mapping, they will set
    725 	 * PF_SUNW_FAILURE in the Phdr and try to stash away the errno for us.
    726 	 */
    727 	if (php->p_flags & PF_SUNW_FAILURE) {
    728 		(void) pread64(P->asfd, &err,
    729 		    sizeof (err), (off64_t)php->p_offset);
    730 
    731 		Perror_printf(P, "core file data for mapping at %p not saved: "
    732 		    "%s\n", (void *)(uintptr_t)php->p_vaddr, strerror(err));
    733 		dprintf("core file data for mapping at %p not saved: %s\n",
    734 		    (void *)(uintptr_t)php->p_vaddr, strerror(err));
    735 
    736 	} else if (php->p_filesz != 0 && php->p_offset >= P->core->core_size) {
    737 		Perror_printf(P, "core file may be corrupt -- data for mapping "
    738 		    "at %p is missing\n", (void *)(uintptr_t)php->p_vaddr);
    739 		dprintf("core file may be corrupt -- data for mapping "
    740 		    "at %p is missing\n", (void *)(uintptr_t)php->p_vaddr);
    741 	}
    742 
    743 	/*
    744 	 * The mapping name and offset will hopefully be filled in
    745 	 * by the librtld_db agent.  Unfortunately, if it isn't a
    746 	 * shared library mapping, this information is gone forever.
    747 	 */
    748 	pmap.pr_mapname[0] = '\0';
    749 	pmap.pr_offset = 0;
    750 
    751 	pmap.pr_mflags = 0;
    752 	if (php->p_flags & PF_R)
    753 		pmap.pr_mflags |= MA_READ;
    754 	if (php->p_flags & PF_W)
    755 		pmap.pr_mflags |= MA_WRITE;
    756 	if (php->p_flags & PF_X)
    757 		pmap.pr_mflags |= MA_EXEC;
    758 
    759 	if (php->p_filesz == 0)
    760 		pmap.pr_mflags |= MA_RESERVED1;
    761 
    762 	/*
    763 	 * At the time of adding this mapping, we just zero the pagesize.
    764 	 * Once we've processed more of the core file, we'll have the
    765 	 * pagesize from the auxv's AT_PAGESZ element and we can fill this in.
    766 	 */
    767 	pmap.pr_pagesize = 0;
    768 
    769 	/*
    770 	 * Unfortunately whether or not the mapping was a System V
    771 	 * shared memory segment is lost.  We use -1 to mark it as not shm.
    772 	 */
    773 	pmap.pr_shmid = -1;
    774 
    775 	return (Padd_mapping(P, php->p_offset, NULL, &pmap));
    776 }
    777 
    778 /*
    779  * Given a virtual address, name the mapping at that address using the
    780  * specified name, and return the map_info_t pointer.
    781  */
    782 static map_info_t *
    783 core_name_mapping(struct ps_prochandle *P, uintptr_t addr, const char *name)
    784 {
    785 	map_info_t *mp = Paddr2mptr(P, addr);
    786 
    787 	if (mp != NULL) {
    788 		(void) strncpy(mp->map_pmap.pr_mapname, name, PRMAPSZ);
    789 		mp->map_pmap.pr_mapname[PRMAPSZ - 1] = '\0';
    790 	}
    791 
    792 	return (mp);
    793 }
    794 
    795 /*
    796  * libproc uses libelf for all of its symbol table manipulation. This function
    797  * takes a symbol table and string table from a core file and places them
    798  * in a memory backed elf file.
    799  */
    800 static void
    801 fake_up_symtab(struct ps_prochandle *P, const elf_file_header_t *ehdr,
    802     GElf_Shdr *symtab, GElf_Shdr *strtab)
    803 {
    804 	size_t size;
    805 	off64_t off, base;
    806 	map_info_t *mp;
    807 	file_info_t *fp;
    808 	Elf_Scn *scn;
    809 	Elf_Data *data;
    810 
    811 	if (symtab->sh_addr == 0 ||
    812 	    (mp = Paddr2mptr(P, symtab->sh_addr)) == NULL ||
    813 	    (fp = mp->map_file) == NULL) {
    814 		dprintf("fake_up_symtab: invalid section\n");
    815 		return;
    816 	}
    817 
    818 	if (fp->file_symtab.sym_data_pri != NULL) {
    819 		dprintf("Symbol table already loaded (sh_addr 0x%lx)\n",
    820 		    (long)symtab->sh_addr);
    821 		return;
    822 	}
    823 
    824 	if (P->status.pr_dmodel == PR_MODEL_ILP32) {
    825 		struct {
    826 			Elf32_Ehdr ehdr;
    827 			Elf32_Shdr shdr[3];
    828 			char data[1];
    829 		} *b;
    830 
    831 		base = sizeof (b->ehdr) + sizeof (b->shdr);
    832 		size = base + symtab->sh_size + strtab->sh_size;
    833 
    834 		if ((b = calloc(1, size)) == NULL)
    835 			return;
    836 
    837 		(void) memcpy(b->ehdr.e_ident, ehdr->e_ident,
    838 		    sizeof (ehdr->e_ident));
    839 		b->ehdr.e_type = ehdr->e_type;
    840 		b->ehdr.e_machine = ehdr->e_machine;
    841 		b->ehdr.e_version = ehdr->e_version;
    842 		b->ehdr.e_flags = ehdr->e_flags;
    843 		b->ehdr.e_ehsize = sizeof (b->ehdr);
    844 		b->ehdr.e_shoff = sizeof (b->ehdr);
    845 		b->ehdr.e_shentsize = sizeof (b->shdr[0]);
    846 		b->ehdr.e_shnum = 3;
    847 		off = 0;
    848 
    849 		b->shdr[1].sh_size = symtab->sh_size;
    850 		b->shdr[1].sh_type = SHT_SYMTAB;
    851 		b->shdr[1].sh_offset = off + base;
    852 		b->shdr[1].sh_entsize = sizeof (Elf32_Sym);
    853 		b->shdr[1].sh_link = 2;
    854 		b->shdr[1].sh_info =  symtab->sh_info;
    855 		b->shdr[1].sh_addralign = symtab->sh_addralign;
    856 
    857 		if (pread64(P->asfd, &b->data[off], b->shdr[1].sh_size,
    858 		    symtab->sh_offset) != b->shdr[1].sh_size) {
    859 			dprintf("fake_up_symtab: pread of symtab[1] failed\n");
    860 			free(b);
    861 			return;
    862 		}
    863 
    864 		off += b->shdr[1].sh_size;
    865 
    866 		b->shdr[2].sh_flags = SHF_STRINGS;
    867 		b->shdr[2].sh_size = strtab->sh_size;
    868 		b->shdr[2].sh_type = SHT_STRTAB;
    869 		b->shdr[2].sh_offset = off + base;
    870 		b->shdr[2].sh_info =  strtab->sh_info;
    871 		b->shdr[2].sh_addralign = 1;
    872 
    873 		if (pread64(P->asfd, &b->data[off], b->shdr[2].sh_size,
    874 		    strtab->sh_offset) != b->shdr[2].sh_size) {
    875 			dprintf("fake_up_symtab: pread of symtab[2] failed\n");
    876 			free(b);
    877 			return;
    878 		}
    879 
    880 		off += b->shdr[2].sh_size;
    881 
    882 		fp->file_symtab.sym_elf = elf_memory((char *)b, size);
    883 		if (fp->file_symtab.sym_elf == NULL) {
    884 			free(b);
    885 			return;
    886 		}
    887 
    888 		fp->file_symtab.sym_elfmem = b;
    889 #ifdef _LP64
    890 	} else {
    891 		struct {
    892 			Elf64_Ehdr ehdr;
    893 			Elf64_Shdr shdr[3];
    894 			char data[1];
    895 		} *b;
    896 
    897 		base = sizeof (b->ehdr) + sizeof (b->shdr);
    898 		size = base + symtab->sh_size + strtab->sh_size;
    899 
    900 		if ((b = calloc(1, size)) == NULL)
    901 			return;
    902 
    903 		(void) memcpy(b->ehdr.e_ident, ehdr->e_ident,
    904 		    sizeof (ehdr->e_ident));
    905 		b->ehdr.e_type = ehdr->e_type;
    906 		b->ehdr.e_machine = ehdr->e_machine;
    907 		b->ehdr.e_version = ehdr->e_version;
    908 		b->ehdr.e_flags = ehdr->e_flags;
    909 		b->ehdr.e_ehsize = sizeof (b->ehdr);
    910 		b->ehdr.e_shoff = sizeof (b->ehdr);
    911 		b->ehdr.e_shentsize = sizeof (b->shdr[0]);
    912 		b->ehdr.e_shnum = 3;
    913 		off = 0;
    914 
    915 		b->shdr[1].sh_size = symtab->sh_size;
    916 		b->shdr[1].sh_type = SHT_SYMTAB;
    917 		b->shdr[1].sh_offset = off + base;
    918 		b->shdr[1].sh_entsize = sizeof (Elf64_Sym);
    919 		b->shdr[1].sh_link = 2;
    920 		b->shdr[1].sh_info =  symtab->sh_info;
    921 		b->shdr[1].sh_addralign = symtab->sh_addralign;
    922 
    923 		if (pread64(P->asfd, &b->data[off], b->shdr[1].sh_size,
    924 		    symtab->sh_offset) != b->shdr[1].sh_size) {
    925 			free(b);
    926 			return;
    927 		}
    928 
    929 		off += b->shdr[1].sh_size;
    930 
    931 		b->shdr[2].sh_flags = SHF_STRINGS;
    932 		b->shdr[2].sh_size = strtab->sh_size;
    933 		b->shdr[2].sh_type = SHT_STRTAB;
    934 		b->shdr[2].sh_offset = off + base;
    935 		b->shdr[2].sh_info =  strtab->sh_info;
    936 		b->shdr[2].sh_addralign = 1;
    937 
    938 		if (pread64(P->asfd, &b->data[off], b->shdr[2].sh_size,
    939 		    strtab->sh_offset) != b->shdr[2].sh_size) {
    940 			free(b);
    941 			return;
    942 		}
    943 
    944 		off += b->shdr[2].sh_size;
    945 
    946 		fp->file_symtab.sym_elf = elf_memory((char *)b, size);
    947 		if (fp->file_symtab.sym_elf == NULL) {
    948 			free(b);
    949 			return;
    950 		}
    951 
    952 		fp->file_symtab.sym_elfmem = b;
    953 #endif
    954 	}
    955 
    956 	if ((scn = elf_getscn(fp->file_symtab.sym_elf, 1)) == NULL ||
    957 	    (fp->file_symtab.sym_data_pri = elf_getdata(scn, NULL)) == NULL ||
    958 	    (scn = elf_getscn(fp->file_symtab.sym_elf, 2)) == NULL ||
    959 	    (data = elf_getdata(scn, NULL)) == NULL) {
    960 		dprintf("fake_up_symtab: failed to get section data at %p\n",
    961 		    (void *)scn);
    962 		goto err;
    963 	}
    964 
    965 	fp->file_symtab.sym_strs = data->d_buf;
    966 	fp->file_symtab.sym_strsz = data->d_size;
    967 	fp->file_symtab.sym_symn = symtab->sh_size / symtab->sh_entsize;
    968 	fp->file_symtab.sym_hdr_pri = *symtab;
    969 	fp->file_symtab.sym_strhdr = *strtab;
    970 
    971 	optimize_symtab(&fp->file_symtab);
    972 
    973 	return;
    974 err:
    975 	(void) elf_end(fp->file_symtab.sym_elf);
    976 	free(fp->file_symtab.sym_elfmem);
    977 	fp->file_symtab.sym_elf = NULL;
    978 	fp->file_symtab.sym_elfmem = NULL;
    979 }
    980 
    981 static void
    982 core_phdr_to_gelf(const Elf32_Phdr *src, GElf_Phdr *dst)
    983 {
    984 	dst->p_type = src->p_type;
    985 	dst->p_flags = src->p_flags;
    986 	dst->p_offset = (Elf64_Off)src->p_offset;
    987 	dst->p_vaddr = (Elf64_Addr)src->p_vaddr;
    988 	dst->p_paddr = (Elf64_Addr)src->p_paddr;
    989 	dst->p_filesz = (Elf64_Xword)src->p_filesz;
    990 	dst->p_memsz = (Elf64_Xword)src->p_memsz;
    991 	dst->p_align = (Elf64_Xword)src->p_align;
    992 }
    993 
    994 static void
    995 core_shdr_to_gelf(const Elf32_Shdr *src, GElf_Shdr *dst)
    996 {
    997 	dst->sh_name = src->sh_name;
    998 	dst->sh_type = src->sh_type;
    999 	dst->sh_flags = (Elf64_Xword)src->sh_flags;
   1000 	dst->sh_addr = (Elf64_Addr)src->sh_addr;
   1001 	dst->sh_offset = (Elf64_Off)src->sh_offset;
   1002 	dst->sh_size = (Elf64_Xword)src->sh_size;
   1003 	dst->sh_link = src->sh_link;
   1004 	dst->sh_info = src->sh_info;
   1005 	dst->sh_addralign = (Elf64_Xword)src->sh_addralign;
   1006 	dst->sh_entsize = (Elf64_Xword)src->sh_entsize;
   1007 }
   1008 
   1009 /*
   1010  * Perform elf_begin on efp->e_fd and verify the ELF file's type and class.
   1011  */
   1012 static int
   1013 core_elf_fdopen(elf_file_t *efp, GElf_Half type, int *perr)
   1014 {
   1015 #ifdef _BIG_ENDIAN
   1016 	uchar_t order = ELFDATA2MSB;
   1017 #else
   1018 	uchar_t order = ELFDATA2LSB;
   1019 #endif
   1020 	Elf32_Ehdr e32;
   1021 	int is_noelf = -1;
   1022 	int isa_err = 0;
   1023 
   1024 	/*
   1025 	 * Because 32-bit libelf cannot deal with large files, we need to read,
   1026 	 * check, and convert the file header manually in case type == ET_CORE.
   1027 	 */
   1028 	if (pread64(efp->e_fd, &e32, sizeof (e32), 0) != sizeof (e32)) {
   1029 		if (perr != NULL)
   1030 			*perr = G_FORMAT;
   1031 		goto err;
   1032 	}
   1033 	if ((is_noelf = memcmp(&e32.e_ident[EI_MAG0], ELFMAG, SELFMAG)) != 0 ||
   1034 	    e32.e_type != type || (isa_err = (e32.e_ident[EI_DATA] != order)) ||
   1035 	    e32.e_version != EV_CURRENT) {
   1036 		if (perr != NULL) {
   1037 			if (is_noelf == 0 && isa_err) {
   1038 				*perr = G_ISAINVAL;
   1039 			} else {
   1040 				*perr = G_FORMAT;
   1041 			}
   1042 		}
   1043 		goto err;
   1044 	}
   1045 
   1046 	/*
   1047 	 * If the file is 64-bit and we are 32-bit, fail with G_LP64.  If the
   1048 	 * file is 64-bit and we are 64-bit, re-read the header as a Elf64_Ehdr,
   1049 	 * and convert it to a elf_file_header_t.  Otherwise, the file is
   1050 	 * 32-bit, so convert e32 to a elf_file_header_t.
   1051 	 */
   1052 	if (e32.e_ident[EI_CLASS] == ELFCLASS64) {
   1053 #ifdef _LP64
   1054 		Elf64_Ehdr e64;
   1055 
   1056 		if (pread64(efp->e_fd, &e64, sizeof (e64), 0) != sizeof (e64)) {
   1057 			if (perr != NULL)
   1058 				*perr = G_FORMAT;
   1059 			goto err;
   1060 		}
   1061 
   1062 		(void) memcpy(efp->e_hdr.e_ident, e64.e_ident, EI_NIDENT);
   1063 		efp->e_hdr.e_type = e64.e_type;
   1064 		efp->e_hdr.e_machine = e64.e_machine;
   1065 		efp->e_hdr.e_version = e64.e_version;
   1066 		efp->e_hdr.e_entry = e64.e_entry;
   1067 		efp->e_hdr.e_phoff = e64.e_phoff;
   1068 		efp->e_hdr.e_shoff = e64.e_shoff;
   1069 		efp->e_hdr.e_flags = e64.e_flags;
   1070 		efp->e_hdr.e_ehsize = e64.e_ehsize;
   1071 		efp->e_hdr.e_phentsize = e64.e_phentsize;
   1072 		efp->e_hdr.e_phnum = (Elf64_Word)e64.e_phnum;
   1073 		efp->e_hdr.e_shentsize = e64.e_shentsize;
   1074 		efp->e_hdr.e_shnum = (Elf64_Word)e64.e_shnum;
   1075 		efp->e_hdr.e_shstrndx = (Elf64_Word)e64.e_shstrndx;
   1076 #else	/* _LP64 */
   1077 		if (perr != NULL)
   1078 			*perr = G_LP64;
   1079 		goto err;
   1080 #endif	/* _LP64 */
   1081 	} else {
   1082 		(void) memcpy(efp->e_hdr.e_ident, e32.e_ident, EI_NIDENT);
   1083 		efp->e_hdr.e_type = e32.e_type;
   1084 		efp->e_hdr.e_machine = e32.e_machine;
   1085 		efp->e_hdr.e_version = e32.e_version;
   1086 		efp->e_hdr.e_entry = (Elf64_Addr)e32.e_entry;
   1087 		efp->e_hdr.e_phoff = (Elf64_Off)e32.e_phoff;
   1088 		efp->e_hdr.e_shoff = (Elf64_Off)e32.e_shoff;
   1089 		efp->e_hdr.e_flags = e32.e_flags;
   1090 		efp->e_hdr.e_ehsize = e32.e_ehsize;
   1091 		efp->e_hdr.e_phentsize = e32.e_phentsize;
   1092 		efp->e_hdr.e_phnum = (Elf64_Word)e32.e_phnum;
   1093 		efp->e_hdr.e_shentsize = e32.e_shentsize;
   1094 		efp->e_hdr.e_shnum = (Elf64_Word)e32.e_shnum;
   1095 		efp->e_hdr.e_shstrndx = (Elf64_Word)e32.e_shstrndx;
   1096 	}
   1097 
   1098 	/*
   1099 	 * If the number of section headers or program headers or the section
   1100 	 * header string table index would overflow their respective fields
   1101 	 * in the ELF header, they're stored in the section header at index
   1102 	 * zero. To simplify use elsewhere, we look for those sentinel values
   1103 	 * here.
   1104 	 */
   1105 	if ((efp->e_hdr.e_shnum == 0 && efp->e_hdr.e_shoff != 0) ||
   1106 	    efp->e_hdr.e_shstrndx == SHN_XINDEX ||
   1107 	    efp->e_hdr.e_phnum == PN_XNUM) {
   1108 		GElf_Shdr shdr;
   1109 
   1110 		dprintf("extended ELF header\n");
   1111 
   1112 		if (efp->e_hdr.e_shoff == 0) {
   1113 			if (perr != NULL)
   1114 				*perr = G_FORMAT;
   1115 			goto err;
   1116 		}
   1117 
   1118 		if (efp->e_hdr.e_ident[EI_CLASS] == ELFCLASS32) {
   1119 			Elf32_Shdr shdr32;
   1120 
   1121 			if (pread64(efp->e_fd, &shdr32, sizeof (shdr32),
   1122 			    efp->e_hdr.e_shoff) != sizeof (shdr32)) {
   1123 				if (perr != NULL)
   1124 					*perr = G_FORMAT;
   1125 				goto err;
   1126 			}
   1127 
   1128 			core_shdr_to_gelf(&shdr32, &shdr);
   1129 		} else {
   1130 			if (pread64(efp->e_fd, &shdr, sizeof (shdr),
   1131 			    efp->e_hdr.e_shoff) != sizeof (shdr)) {
   1132 				if (perr != NULL)
   1133 					*perr = G_FORMAT;
   1134 				goto err;
   1135 			}
   1136 		}
   1137 
   1138 		if (efp->e_hdr.e_shnum == 0) {
   1139 			efp->e_hdr.e_shnum = shdr.sh_size;
   1140 			dprintf("section header count %lu\n",
   1141 			    (ulong_t)shdr.sh_size);
   1142 		}
   1143 
   1144 		if (efp->e_hdr.e_shstrndx == SHN_XINDEX) {
   1145 			efp->e_hdr.e_shstrndx = shdr.sh_link;
   1146 			dprintf("section string index %u\n", shdr.sh_link);
   1147 		}
   1148 
   1149 		if (efp->e_hdr.e_phnum == PN_XNUM && shdr.sh_info != 0) {
   1150 			efp->e_hdr.e_phnum = shdr.sh_info;
   1151 			dprintf("program header count %u\n", shdr.sh_info);
   1152 		}
   1153 
   1154 	} else if (efp->e_hdr.e_phoff != 0) {
   1155 		GElf_Phdr phdr;
   1156 		uint64_t phnum;
   1157 
   1158 		/*
   1159 		 * It's possible this core file came from a system that
   1160 		 * accidentally truncated the e_phnum field without correctly
   1161 		 * using the extended format in the section header at index
   1162 		 * zero. We try to detect and correct that specific type of
   1163 		 * corruption by using the knowledge that the core dump
   1164 		 * routines usually place the data referenced by the first
   1165 		 * program header immediately after the last header element.
   1166 		 */
   1167 		if (efp->e_hdr.e_ident[EI_CLASS] == ELFCLASS32) {
   1168 			Elf32_Phdr phdr32;
   1169 
   1170 			if (pread64(efp->e_fd, &phdr32, sizeof (phdr32),
   1171 			    efp->e_hdr.e_phoff) != sizeof (phdr32)) {
   1172 				if (perr != NULL)
   1173 					*perr = G_FORMAT;
   1174 				goto err;
   1175 			}
   1176 
   1177 			core_phdr_to_gelf(&phdr32, &phdr);
   1178 		} else {
   1179 			if (pread64(efp->e_fd, &phdr, sizeof (phdr),
   1180 			    efp->e_hdr.e_phoff) != sizeof (phdr)) {
   1181 				if (perr != NULL)
   1182 					*perr = G_FORMAT;
   1183 				goto err;
   1184 			}
   1185 		}
   1186 
   1187 		phnum = phdr.p_offset - efp->e_hdr.e_ehsize -
   1188 		    (uint64_t)efp->e_hdr.e_shnum * efp->e_hdr.e_shentsize;
   1189 		phnum /= efp->e_hdr.e_phentsize;
   1190 
   1191 		if (phdr.p_offset != 0 && phnum != efp->e_hdr.e_phnum) {
   1192 			dprintf("suspicious program header count %u %u\n",
   1193 			    (uint_t)phnum, efp->e_hdr.e_phnum);
   1194 
   1195 			/*
   1196 			 * If the new program header count we computed doesn't
   1197 			 * jive with count in the ELF header, we'll use the
   1198 			 * data that's there and hope for the best.
   1199 			 *
   1200 			 * If it does, it's also possible that the section
   1201 			 * header offset is incorrect; we'll check that and
   1202 			 * possibly try to fix it.
   1203 			 */
   1204 			if (phnum <= INT_MAX &&
   1205 			    (uint16_t)phnum == efp->e_hdr.e_phnum) {
   1206 
   1207 				if (efp->e_hdr.e_shoff == efp->e_hdr.e_phoff +
   1208 				    efp->e_hdr.e_phentsize *
   1209 				    (uint_t)efp->e_hdr.e_phnum) {
   1210 					efp->e_hdr.e_shoff =
   1211 					    efp->e_hdr.e_phoff +
   1212 					    efp->e_hdr.e_phentsize * phnum;
   1213 				}
   1214 
   1215 				efp->e_hdr.e_phnum = (Elf64_Word)phnum;
   1216 				dprintf("using new program header count\n");
   1217 			} else {
   1218 				dprintf("inconsistent program header count\n");
   1219 			}
   1220 		}
   1221 	}
   1222 
   1223 	/*
   1224 	 * The libelf implementation was never ported to be large-file aware.
   1225 	 * This is typically not a problem for your average executable or
   1226 	 * shared library, but a large 32-bit core file can exceed 2GB in size.
   1227 	 * So if type is ET_CORE, we don't bother doing elf_begin; the code
   1228 	 * in Pfgrab_core() below will do its own i/o and struct conversion.
   1229 	 */
   1230 
   1231 	if (type == ET_CORE) {
   1232 		efp->e_elf = NULL;
   1233 		return (0);
   1234 	}
   1235 
   1236 	if ((efp->e_elf = elf_begin(efp->e_fd, ELF_C_READ, NULL)) == NULL) {
   1237 		if (perr != NULL)
   1238 			*perr = G_ELF;
   1239 		goto err;
   1240 	}
   1241 
   1242 	return (0);
   1243 
   1244 err:
   1245 	efp->e_elf = NULL;
   1246 	return (-1);
   1247 }
   1248 
   1249 /*
   1250  * Open the specified file and then do a core_elf_fdopen on it.
   1251  */
   1252 static int
   1253 core_elf_open(elf_file_t *efp, const char *path, GElf_Half type, int *perr)
   1254 {
   1255 	(void) memset(efp, 0, sizeof (elf_file_t));
   1256 
   1257 	if ((efp->e_fd = open64(path, O_RDONLY)) >= 0) {
   1258 		if (core_elf_fdopen(efp, type, perr) == 0)
   1259 			return (0);
   1260 
   1261 		(void) close(efp->e_fd);
   1262 		efp->e_fd = -1;
   1263 	}
   1264 
   1265 	return (-1);
   1266 }
   1267 
   1268 /*
   1269  * Close the ELF handle and file descriptor.
   1270  */
   1271 static void
   1272 core_elf_close(elf_file_t *efp)
   1273 {
   1274 	if (efp->e_elf != NULL) {
   1275 		(void) elf_end(efp->e_elf);
   1276 		efp->e_elf = NULL;
   1277 	}
   1278 
   1279 	if (efp->e_fd != -1) {
   1280 		(void) close(efp->e_fd);
   1281 		efp->e_fd = -1;
   1282 	}
   1283 }
   1284 
   1285 /*
   1286  * Given an ELF file for a statically linked executable, locate the likely
   1287  * primary text section and fill in rl_base with its virtual address.
   1288  */
   1289 static map_info_t *
   1290 core_find_text(struct ps_prochandle *P, Elf *elf, rd_loadobj_t *rlp)
   1291 {
   1292 	GElf_Phdr phdr;
   1293 	uint_t i;
   1294 	size_t nphdrs;
   1295 
   1296 	if (elf_getphdrnum(elf, &nphdrs) == -1)
   1297 		return (NULL);
   1298 
   1299 	for (i = 0; i < nphdrs; i++) {
   1300 		if (gelf_getphdr(elf, i, &phdr) != NULL &&
   1301 		    phdr.p_type == PT_LOAD && (phdr.p_flags & PF_X)) {
   1302 			rlp->rl_base = phdr.p_vaddr;
   1303 			return (Paddr2mptr(P, rlp->rl_base));
   1304 		}
   1305 	}
   1306 
   1307 	return (NULL);
   1308 }
   1309 
   1310 /*
   1311  * Given an ELF file and the librtld_db structure corresponding to its primary
   1312  * text mapping, deduce where its data segment was loaded and fill in
   1313  * rl_data_base and prmap_t.pr_offset accordingly.
   1314  */
   1315 static map_info_t *
   1316 core_find_data(struct ps_prochandle *P, Elf *elf, rd_loadobj_t *rlp)
   1317 {
   1318 	GElf_Ehdr ehdr;
   1319 	GElf_Phdr phdr;
   1320 	map_info_t *mp;
   1321 	uint_t i, pagemask;
   1322 	size_t nphdrs;
   1323 
   1324 	rlp->rl_data_base = NULL;
   1325 
   1326 	/*
   1327 	 * Find the first loadable, writeable Phdr and compute rl_data_base
   1328 	 * as the virtual address at which is was loaded.
   1329 	 */
   1330 	if (gelf_getehdr(elf, &ehdr) == NULL ||
   1331 	    elf_getphdrnum(elf, &nphdrs) == -1)
   1332 		return (NULL);
   1333 
   1334 	for (i = 0; i < nphdrs; i++) {
   1335 		if (gelf_getphdr(elf, i, &phdr) != NULL &&
   1336 		    phdr.p_type == PT_LOAD && (phdr.p_flags & PF_W)) {
   1337 			rlp->rl_data_base = phdr.p_vaddr;
   1338 			if (ehdr.e_type == ET_DYN)
   1339 				rlp->rl_data_base += rlp->rl_base;
   1340 			break;
   1341 		}
   1342 	}
   1343 
   1344 	/*
   1345 	 * If we didn't find an appropriate phdr or if the address we
   1346 	 * computed has no mapping, return NULL.
   1347 	 */
   1348 	if (rlp->rl_data_base == NULL ||
   1349 	    (mp = Paddr2mptr(P, rlp->rl_data_base)) == NULL)
   1350 		return (NULL);
   1351 
   1352 	/*
   1353 	 * It wouldn't be procfs-related code if we didn't make use of
   1354 	 * unclean knowledge of segvn, even in userland ... the prmap_t's
   1355 	 * pr_offset field will be the segvn offset from mmap(2)ing the
   1356 	 * data section, which will be the file offset & PAGEMASK.
   1357 	 */
   1358 	pagemask = ~(mp->map_pmap.pr_pagesize - 1);
   1359 	mp->map_pmap.pr_offset = phdr.p_offset & pagemask;
   1360 
   1361 	return (mp);
   1362 }
   1363 
   1364 /*
   1365  * Librtld_db agent callback for iterating over load object mappings.
   1366  * For each load object, we allocate a new file_info_t, perform naming,
   1367  * and attempt to construct a symbol table for the load object.
   1368  */
   1369 static int
   1370 core_iter_mapping(const rd_loadobj_t *rlp, struct ps_prochandle *P)
   1371 {
   1372 	char lname[PATH_MAX], buf[PATH_MAX];
   1373 	file_info_t *fp;
   1374 	map_info_t *mp;
   1375 
   1376 	if (Pread_string(P, lname, PATH_MAX, (off_t)rlp->rl_nameaddr) <= 0) {
   1377 		dprintf("failed to read name %p\n", (void *)rlp->rl_nameaddr);
   1378 		return (1); /* Keep going; forget this if we can't get a name */
   1379 	}
   1380 
   1381 	dprintf("rd_loadobj name = \"%s\" rl_base = %p\n",
   1382 	    lname, (void *)rlp->rl_base);
   1383 
   1384 	if ((mp = Paddr2mptr(P, rlp->rl_base)) == NULL) {
   1385 		dprintf("no mapping for %p\n", (void *)rlp->rl_base);
   1386 		return (1); /* No mapping; advance to next mapping */
   1387 	}
   1388 
   1389 	/*
   1390 	 * Create a new file_info_t for this mapping, and therefore for
   1391 	 * this load object.
   1392 	 *
   1393 	 * If there's an ELF header at the beginning of this mapping,
   1394 	 * file_info_new() will try to use its section headers to
   1395 	 * identify any other mappings that belong to this load object.
   1396 	 */
   1397 	if ((fp = mp->map_file) == NULL &&
   1398 	    (fp = file_info_new(P, mp)) == NULL) {
   1399 		P->core->core_errno = errno;
   1400 		dprintf("failed to malloc mapping data\n");
   1401 		return (0); /* Abort */
   1402 	}
   1403 	fp->file_map = mp;
   1404 
   1405 	/* Create a local copy of the load object representation */
   1406 	if ((fp->file_lo = calloc(1, sizeof (rd_loadobj_t))) == NULL) {
   1407 		P->core->core_errno = errno;
   1408 		dprintf("failed to malloc mapping data\n");
   1409 		return (0); /* Abort */
   1410 	}
   1411 	*fp->file_lo = *rlp;
   1412 
   1413 	if (lname[0] != '\0') {
   1414 		/*
   1415 		 * Naming dance part 1: if we got a name from librtld_db, then
   1416 		 * copy this name to the prmap_t if it is unnamed.  If the
   1417 		 * file_info_t is unnamed, name it after the lname.
   1418 		 */
   1419 		if (mp->map_pmap.pr_mapname[0] == '\0') {
   1420 			(void) strncpy(mp->map_pmap.pr_mapname, lname, PRMAPSZ);
   1421 			mp->map_pmap.pr_mapname[PRMAPSZ - 1] = '\0';
   1422 		}
   1423 
   1424 		if (fp->file_lname == NULL)
   1425 			fp->file_lname = strdup(lname);
   1426 
   1427 	} else if (fp->file_lname == NULL &&
   1428 	    mp->map_pmap.pr_mapname[0] != '\0') {
   1429 		/*
   1430 		 * Naming dance part 2: if the mapping is named and the
   1431 		 * file_info_t is not, name the file after the mapping.
   1432 		 */
   1433 		fp->file_lname = strdup(mp->map_pmap.pr_mapname);
   1434 	}
   1435 
   1436 	if ((fp->file_rname == NULL) &&
   1437 	    (Pfindmap(P, mp, buf, sizeof (buf)) != NULL))
   1438 		fp->file_rname = strdup(buf);
   1439 
   1440 	if (fp->file_lname != NULL)
   1441 		fp->file_lbase = basename(fp->file_lname);
   1442 	if (fp->file_rname != NULL)
   1443 		fp->file_rbase = basename(fp->file_rname);
   1444 
   1445 	/* Associate the file and the mapping. */
   1446 	(void) strncpy(fp->file_pname, mp->map_pmap.pr_mapname, PRMAPSZ);
   1447 	fp->file_pname[PRMAPSZ - 1] = '\0';
   1448 
   1449 	/*
   1450 	 * If no section headers were available then we'll have to
   1451 	 * identify this load object's other mappings with what we've
   1452 	 * got: the start and end of the object's corresponding
   1453 	 * address space.
   1454 	 */
   1455 	if (fp->file_saddrs == NULL) {
   1456 		for (mp = fp->file_map + 1; mp < P->mappings + P->map_count &&
   1457 		    mp->map_pmap.pr_vaddr < rlp->rl_bend; mp++) {
   1458 
   1459 			if (mp->map_file == NULL) {
   1460 				dprintf("core_iter_mapping %s: associating "
   1461 				    "segment at %p\n",
   1462 				    fp->file_pname,
   1463 				    (void *)mp->map_pmap.pr_vaddr);
   1464 				mp->map_file = fp;
   1465 				fp->file_ref++;
   1466 			} else {
   1467 				dprintf("core_iter_mapping %s: segment at "
   1468 				    "%p already associated with %s\n",
   1469 				    fp->file_pname,
   1470 				    (void *)mp->map_pmap.pr_vaddr,
   1471 				    (mp == fp->file_map ? "this file" :
   1472 				    mp->map_file->file_pname));
   1473 			}
   1474 		}
   1475 	}
   1476 
   1477 	/* Ensure that all this file's mappings are named. */
   1478 	for (mp = fp->file_map; mp < P->mappings + P->map_count &&
   1479 	    mp->map_file == fp; mp++) {
   1480 		if (mp->map_pmap.pr_mapname[0] == '\0' &&
   1481 		    !(mp->map_pmap.pr_mflags & MA_BREAK)) {
   1482 			(void) strncpy(mp->map_pmap.pr_mapname, fp->file_pname,
   1483 			    PRMAPSZ);
   1484 			mp->map_pmap.pr_mapname[PRMAPSZ - 1] = '\0';
   1485 		}
   1486 	}
   1487 
   1488 	/* Attempt to build a symbol table for this file. */
   1489 	Pbuild_file_symtab(P, fp);
   1490 	if (fp->file_elf == NULL)
   1491 		dprintf("core_iter_mapping: no symtab for %s\n",
   1492 		    fp->file_pname);
   1493 
   1494 	/* Locate the start of a data segment associated with this file. */
   1495 	if ((mp = core_find_data(P, fp->file_elf, fp->file_lo)) != NULL) {
   1496 		dprintf("found data for %s at %p (pr_offset 0x%llx)\n",
   1497 		    fp->file_pname, (void *)fp->file_lo->rl_data_base,
   1498 		    mp->map_pmap.pr_offset);
   1499 	} else {
   1500 		dprintf("core_iter_mapping: no data found for %s\n",
   1501 		    fp->file_pname);
   1502 	}
   1503 
   1504 	return (1); /* Advance to next mapping */
   1505 }
   1506 
   1507 /*
   1508  * Callback function for Pfindexec().  In order to confirm a given pathname,
   1509  * we verify that we can open it as an ELF file of type ET_EXEC or ET_DYN.
   1510  */
   1511 static int
   1512 core_exec_open(const char *path, void *efp)
   1513 {
   1514 	if (core_elf_open(efp, path, ET_EXEC, NULL) == 0)
   1515 		return (1);
   1516 	if (core_elf_open(efp, path, ET_DYN, NULL) == 0)
   1517 		return (1);
   1518 	return (0);
   1519 }
   1520 
   1521 /*
   1522  * Attempt to load any section headers found in the core file.  If present,
   1523  * this will refer to non-loadable data added to the core file by the kernel
   1524  * based on coreadm(1M) settings, including CTF data and the symbol table.
   1525  */
   1526 static void
   1527 core_load_shdrs(struct ps_prochandle *P, elf_file_t *efp)
   1528 {
   1529 	GElf_Shdr *shp, *shdrs = NULL;
   1530 	char *shstrtab = NULL;
   1531 	ulong_t shstrtabsz;
   1532 	const char *name;
   1533 	map_info_t *mp;
   1534 
   1535 	size_t nbytes;
   1536 	void *buf;
   1537 	int i;
   1538 
   1539 	if (efp->e_hdr.e_shstrndx >= efp->e_hdr.e_shnum) {
   1540 		dprintf("corrupt shstrndx (%u) exceeds shnum (%u)\n",
   1541 		    efp->e_hdr.e_shstrndx, efp->e_hdr.e_shnum);
   1542 		return;
   1543 	}
   1544 
   1545 	/*
   1546 	 * Read the section header table from the core file and then iterate
   1547 	 * over the section headers, converting each to a GElf_Shdr.
   1548 	 */
   1549 	if ((shdrs = malloc(efp->e_hdr.e_shnum * sizeof (GElf_Shdr))) == NULL) {
   1550 		dprintf("failed to malloc %u section headers: %s\n",
   1551 		    (uint_t)efp->e_hdr.e_shnum, strerror(errno));
   1552 		return;
   1553 	}
   1554 
   1555 	nbytes = efp->e_hdr.e_shnum * efp->e_hdr.e_shentsize;
   1556 	if ((buf = malloc(nbytes)) == NULL) {
   1557 		dprintf("failed to malloc %d bytes: %s\n", (int)nbytes,
   1558 		    strerror(errno));
   1559 		free(shdrs);
   1560 		goto out;
   1561 	}
   1562 
   1563 	if (pread64(efp->e_fd, buf, nbytes, efp->e_hdr.e_shoff) != nbytes) {
   1564 		dprintf("failed to read section headers at off %lld: %s\n",
   1565 		    (longlong_t)efp->e_hdr.e_shoff, strerror(errno));
   1566 		free(buf);
   1567 		goto out;
   1568 	}
   1569 
   1570 	for (i = 0; i < efp->e_hdr.e_shnum; i++) {
   1571 		void *p = (uchar_t *)buf + efp->e_hdr.e_shentsize * i;
   1572 
   1573 		if (efp->e_hdr.e_ident[EI_CLASS] == ELFCLASS32)
   1574 			core_shdr_to_gelf(p, &shdrs[i]);
   1575 		else
   1576 			(void) memcpy(&shdrs[i], p, sizeof (GElf_Shdr));
   1577 	}
   1578 
   1579 	free(buf);
   1580 	buf = NULL;
   1581 
   1582 	/*
   1583 	 * Read the .shstrtab section from the core file, terminating it with
   1584 	 * an extra \0 so that a corrupt section will not cause us to die.
   1585 	 */
   1586 	shp = &shdrs[efp->e_hdr.e_shstrndx];
   1587 	shstrtabsz = shp->sh_size;
   1588 
   1589 	if ((shstrtab = malloc(shstrtabsz + 1)) == NULL) {
   1590 		dprintf("failed to allocate %lu bytes for shstrtab\n",
   1591 		    (ulong_t)shstrtabsz);
   1592 		goto out;
   1593 	}
   1594 
   1595 	if (pread64(efp->e_fd, shstrtab, shstrtabsz,
   1596 	    shp->sh_offset) != shstrtabsz) {
   1597 		dprintf("failed to read %lu bytes of shstrs at off %lld: %s\n",
   1598 		    shstrtabsz, (longlong_t)shp->sh_offset, strerror(errno));
   1599 		goto out;
   1600 	}
   1601 
   1602 	shstrtab[shstrtabsz] = '\0';
   1603 
   1604 	/*
   1605 	 * Now iterate over each section in the section header table, locating
   1606 	 * sections of interest and initializing more of the ps_prochandle.
   1607 	 */
   1608 	for (i = 0; i < efp->e_hdr.e_shnum; i++) {
   1609 		shp = &shdrs[i];
   1610 		name = shstrtab + shp->sh_name;
   1611 
   1612 		if (shp->sh_name >= shstrtabsz) {
   1613 			dprintf("skipping section [%d]: corrupt sh_name\n", i);
   1614 			continue;
   1615 		}
   1616 
   1617 		if (shp->sh_link >= efp->e_hdr.e_shnum) {
   1618 			dprintf("skipping section [%d]: corrupt sh_link\n", i);
   1619 			continue;
   1620 		}
   1621 
   1622 		dprintf("found section header %s (sh_addr 0x%llx)\n",
   1623 		    name, (u_longlong_t)shp->sh_addr);
   1624 
   1625 		if (strcmp(name, ".SUNW_ctf") == 0) {
   1626 			if ((mp = Paddr2mptr(P, shp->sh_addr)) == NULL) {
   1627 				dprintf("no map at addr 0x%llx for %s [%d]\n",
   1628 				    (u_longlong_t)shp->sh_addr, name, i);
   1629 				continue;
   1630 			}
   1631 
   1632 			if (mp->map_file == NULL ||
   1633 			    mp->map_file->file_ctf_buf != NULL) {
   1634 				dprintf("no mapping file or duplicate buffer "
   1635 				    "for %s [%d]\n", name, i);
   1636 				continue;
   1637 			}
   1638 
   1639 			if ((buf = malloc(shp->sh_size)) == NULL ||
   1640 			    pread64(efp->e_fd, buf, shp->sh_size,
   1641 			    shp->sh_offset) != shp->sh_size) {
   1642 				dprintf("skipping section %s [%d]: %s\n",
   1643 				    name, i, strerror(errno));
   1644 				free(buf);
   1645 				continue;
   1646 			}
   1647 
   1648 			mp->map_file->file_ctf_size = shp->sh_size;
   1649 			mp->map_file->file_ctf_buf = buf;
   1650 
   1651 			if (shdrs[shp->sh_link].sh_type == SHT_DYNSYM)
   1652 				mp->map_file->file_ctf_dyn = 1;
   1653 
   1654 		} else if (strcmp(name, ".symtab") == 0) {
   1655 			fake_up_symtab(P, &efp->e_hdr,
   1656 			    shp, &shdrs[shp->sh_link]);
   1657 		}
   1658 	}
   1659 out:
   1660 	free(shstrtab);
   1661 	free(shdrs);
   1662 }
   1663 
   1664 /*
   1665  * Main engine for core file initialization: given an fd for the core file
   1666  * and an optional pathname, construct the ps_prochandle.  The aout_path can
   1667  * either be a suggested executable pathname, or a suggested directory to
   1668  * use as a possible current working directory.
   1669  */
   1670 struct ps_prochandle *
   1671 Pfgrab_core(int core_fd, const char *aout_path, int *perr)
   1672 {
   1673 	struct ps_prochandle *P;
   1674 	map_info_t *stk_mp, *brk_mp;
   1675 	const char *execname;
   1676 	char *interp;
   1677 	int i, notes, pagesize;
   1678 	uintptr_t addr, base_addr;
   1679 	struct stat64 stbuf;
   1680 	void *phbuf, *php;
   1681 	size_t nbytes;
   1682 
   1683 	elf_file_t aout;
   1684 	elf_file_t core;
   1685 
   1686 	Elf_Scn *scn, *intp_scn = NULL;
   1687 	Elf_Data *dp;
   1688 
   1689 	GElf_Phdr phdr, note_phdr;
   1690 	GElf_Shdr shdr;
   1691 	GElf_Xword nleft;
   1692 
   1693 	if (elf_version(EV_CURRENT) == EV_NONE) {
   1694 		dprintf("libproc ELF version is more recent than libelf\n");
   1695 		*perr = G_ELF;
   1696 		return (NULL);
   1697 	}
   1698 
   1699 	aout.e_elf = NULL;
   1700 	aout.e_fd = -1;
   1701 
   1702 	core.e_elf = NULL;
   1703 	core.e_fd = core_fd;
   1704 
   1705 	/*
   1706 	 * Allocate and initialize a ps_prochandle structure for the core.
   1707 	 * There are several key pieces of initialization here:
   1708 	 *
   1709 	 * 1. The PS_DEAD state flag marks this prochandle as a core file.
   1710 	 *    PS_DEAD also thus prevents all operations which require state
   1711 	 *    to be PS_STOP from operating on this handle.
   1712 	 *
   1713 	 * 2. We keep the core file fd in P->asfd since the core file contains
   1714 	 *    the remnants of the process address space.
   1715 	 *
   1716 	 * 3. We set the P->info_valid bit because all information about the
   1717 	 *    core is determined by the end of this function; there is no need
   1718 	 *    for proc_update_maps() to reload mappings at any later point.
   1719 	 *
   1720 	 * 4. The read/write ops vector uses our core_rw() function defined
   1721 	 *    above to handle i/o requests.
   1722 	 */
   1723 	if ((P = malloc(sizeof (struct ps_prochandle))) == NULL) {
   1724 		*perr = G_STRANGE;
   1725 		return (NULL);
   1726 	}
   1727 
   1728 	(void) memset(P, 0, sizeof (struct ps_prochandle));
   1729 	(void) mutex_init(&P->proc_lock, USYNC_THREAD, NULL);
   1730 	P->state = PS_DEAD;
   1731 	P->pid = (pid_t)-1;
   1732 	P->asfd = core.e_fd;
   1733 	P->ctlfd = -1;
   1734 	P->statfd = -1;
   1735 	P->agentctlfd = -1;
   1736 	P->agentstatfd = -1;
   1737 	P->zoneroot = NULL;
   1738 	P->info_valid = 1;
   1739 	P->ops = &P_core_ops;
   1740 
   1741 	Pinitsym(P);
   1742 
   1743 	/*
   1744 	 * Fstat and open the core file and make sure it is a valid ELF core.
   1745 	 */
   1746 	if (fstat64(P->asfd, &stbuf) == -1) {
   1747 		*perr = G_STRANGE;
   1748 		goto err;
   1749 	}
   1750 
   1751 	if (core_elf_fdopen(&core, ET_CORE, perr) == -1)
   1752 		goto err;
   1753 
   1754 	/*
   1755 	 * Allocate and initialize a core_info_t to hang off the ps_prochandle
   1756 	 * structure.  We keep all core-specific information in this structure.
   1757 	 */
   1758 	if ((P->core = calloc(1, sizeof (core_info_t))) == NULL) {
   1759 		*perr = G_STRANGE;
   1760 		goto err;
   1761 	}
   1762 
   1763 	list_link(&P->core->core_lwp_head, NULL);
   1764 	P->core->core_size = stbuf.st_size;
   1765 	/*
   1766 	 * In the days before adjustable core file content, this was the
   1767 	 * default core file content. For new core files, this value will
   1768 	 * be overwritten by the NT_CONTENT note section.
   1769 	 */
   1770 	P->core->core_content = CC_CONTENT_STACK | CC_CONTENT_HEAP |
   1771 	    CC_CONTENT_DATA | CC_CONTENT_RODATA | CC_CONTENT_ANON |
   1772 	    CC_CONTENT_SHANON;
   1773 
   1774 	switch (core.e_hdr.e_ident[EI_CLASS]) {
   1775 	case ELFCLASS32:
   1776 		P->core->core_dmodel = PR_MODEL_ILP32;
   1777 		break;
   1778 	case ELFCLASS64:
   1779 		P->core->core_dmodel = PR_MODEL_LP64;
   1780 		break;
   1781 	default:
   1782 		*perr = G_FORMAT;
   1783 		goto err;
   1784 	}
   1785 
   1786 	/*
   1787 	 * Because the core file may be a large file, we can't use libelf to
   1788 	 * read the Phdrs.  We use e_phnum and e_phentsize to simplify things.
   1789 	 */
   1790 	nbytes = core.e_hdr.e_phnum * core.e_hdr.e_phentsize;
   1791 
   1792 	if ((phbuf = malloc(nbytes)) == NULL) {
   1793 		*perr = G_STRANGE;
   1794 		goto err;
   1795 	}
   1796 
   1797 	if (pread64(core_fd, phbuf, nbytes, core.e_hdr.e_phoff) != nbytes) {
   1798 		*perr = G_STRANGE;
   1799 		free(phbuf);
   1800 		goto err;
   1801 	}
   1802 
   1803 	/*
   1804 	 * Iterate through the program headers in the core file.
   1805 	 * We're interested in two types of Phdrs: PT_NOTE (which
   1806 	 * contains a set of saved /proc structures), and PT_LOAD (which
   1807 	 * represents a memory mapping from the process's address space).
   1808 	 * In the case of PT_NOTE, we're interested in the last PT_NOTE
   1809 	 * in the core file; currently the first PT_NOTE (if present)
   1810 	 * contains /proc structs in the pre-2.6 unstructured /proc format.
   1811 	 */
   1812 	for (php = phbuf, notes = 0, i = 0; i < core.e_hdr.e_phnum; i++) {
   1813 		if (core.e_hdr.e_ident[EI_CLASS] == ELFCLASS64)
   1814 			(void) memcpy(&phdr, php, sizeof (GElf_Phdr));
   1815 		else
   1816 			core_phdr_to_gelf(php, &phdr);
   1817 
   1818 		switch (phdr.p_type) {
   1819 		case PT_NOTE:
   1820 			note_phdr = phdr;
   1821 			notes++;
   1822 			break;
   1823 
   1824 		case PT_LOAD:
   1825 			if (core_add_mapping(P, &phdr) == -1) {
   1826 				*perr = G_STRANGE;
   1827 				free(phbuf);
   1828 				goto err;
   1829 			}
   1830 			break;
   1831 		}
   1832 
   1833 		php = (char *)php + core.e_hdr.e_phentsize;
   1834 	}
   1835 
   1836 	free(phbuf);
   1837 
   1838 	Psort_mappings(P);
   1839 
   1840 	/*
   1841 	 * If we couldn't find anything of type PT_NOTE, or only one PT_NOTE
   1842 	 * was present, abort.  The core file is either corrupt or too old.
   1843 	 */
   1844 	if (notes == 0 || notes == 1) {
   1845 		*perr = G_NOTE;
   1846 		goto err;
   1847 	}
   1848 
   1849 	/*
   1850 	 * Advance the seek pointer to the start of the PT_NOTE data
   1851 	 */
   1852 	if (lseek64(P->asfd, note_phdr.p_offset, SEEK_SET) == (off64_t)-1) {
   1853 		dprintf("Pgrab_core: failed to lseek to PT_NOTE data\n");
   1854 		*perr = G_STRANGE;
   1855 		goto err;
   1856 	}
   1857 
   1858 	/*
   1859 	 * Now process the PT_NOTE structures.  Each one is preceded by
   1860 	 * an Elf{32/64}_Nhdr structure describing its type and size.
   1861 	 *
   1862 	 *  +--------+
   1863 	 *  | header |
   1864 	 *  +--------+
   1865 	 *  | name   |
   1866 	 *  | ...    |
   1867 	 *  +--------+
   1868 	 *  | desc   |
   1869 	 *  | ...    |
   1870 	 *  +--------+
   1871 	 */
   1872 	for (nleft = note_phdr.p_filesz; nleft > 0; ) {
   1873 		Elf64_Nhdr nhdr;
   1874 		off64_t off, namesz;
   1875 
   1876 		/*
   1877 		 * Although <sys/elf.h> defines both Elf32_Nhdr and Elf64_Nhdr
   1878 		 * as different types, they are both of the same content and
   1879 		 * size, so we don't need to worry about 32/64 conversion here.
   1880 		 */
   1881 		if (read(P->asfd, &nhdr, sizeof (nhdr)) != sizeof (nhdr)) {
   1882 			dprintf("Pgrab_core: failed to read ELF note header\n");
   1883 			*perr = G_NOTE;
   1884 			goto err;
   1885 		}
   1886 
   1887 		/*
   1888 		 * According to the System V ABI, the amount of padding
   1889 		 * following the name field should align the description
   1890 		 * field on a 4 byte boundary for 32-bit binaries or on an 8
   1891 		 * byte boundary for 64-bit binaries. However, this change
   1892 		 * was not made correctly during the 64-bit port so all
   1893 		 * descriptions can assume only 4-byte alignment. We ignore
   1894 		 * the name field and the padding to 4-byte alignment.
   1895 		 */
   1896 		namesz = P2ROUNDUP((off64_t)nhdr.n_namesz, (off64_t)4);
   1897 		if (lseek64(P->asfd, namesz, SEEK_CUR) == (off64_t)-1) {
   1898 			dprintf("failed to seek past name and padding\n");
   1899 			*perr = G_STRANGE;
   1900 			goto err;
   1901 		}
   1902 
   1903 		dprintf("Note hdr n_type=%u n_namesz=%u n_descsz=%u\n",
   1904 		    nhdr.n_type, nhdr.n_namesz, nhdr.n_descsz);
   1905 
   1906 		off = lseek64(P->asfd, (off64_t)0L, SEEK_CUR);
   1907 
   1908 		/*
   1909 		 * Invoke the note handler function from our table
   1910 		 */
   1911 		if (nhdr.n_type < sizeof (nhdlrs) / sizeof (nhdlrs[0])) {
   1912 			if (nhdlrs[nhdr.n_type](P, nhdr.n_descsz) < 0) {
   1913 				*perr = G_NOTE;
   1914 				goto err;
   1915 			}
   1916 		} else
   1917 			(void) note_notsup(P, nhdr.n_descsz);
   1918 
   1919 		/*
   1920 		 * Seek past the current note data to the next Elf_Nhdr
   1921 		 */
   1922 		if (lseek64(P->asfd, off + nhdr.n_descsz,
   1923 		    SEEK_SET) == (off64_t)-1) {
   1924 			dprintf("Pgrab_core: failed to seek to next nhdr\n");
   1925 			*perr = G_STRANGE;
   1926 			goto err;
   1927 		}
   1928 
   1929 		/*
   1930 		 * Subtract the size of the header and its data from what
   1931 		 * we have left to process.
   1932 		 */
   1933 		nleft -= sizeof (nhdr) + namesz + nhdr.n_descsz;
   1934 	}
   1935 
   1936 	if (nleft != 0) {
   1937 		dprintf("Pgrab_core: note section malformed\n");
   1938 		*perr = G_STRANGE;
   1939 		goto err;
   1940 	}
   1941 
   1942 	if ((pagesize = Pgetauxval(P, AT_PAGESZ)) == -1) {
   1943 		pagesize = getpagesize();
   1944 		dprintf("AT_PAGESZ missing; defaulting to %d\n", pagesize);
   1945 	}
   1946 
   1947 	/*
   1948 	 * Locate and label the mappings corresponding to the end of the
   1949 	 * heap (MA_BREAK) and the base of the stack (MA_STACK).
   1950 	 */
   1951 	if ((P->status.pr_brkbase != 0 || P->status.pr_brksize != 0) &&
   1952 	    (brk_mp = Paddr2mptr(P, P->status.pr_brkbase +
   1953 	    P->status.pr_brksize - 1)) != NULL)
   1954 		brk_mp->map_pmap.pr_mflags |= MA_BREAK;
   1955 	else
   1956 		brk_mp = NULL;
   1957 
   1958 	if ((stk_mp = Paddr2mptr(P, P->status.pr_stkbase)) != NULL)
   1959 		stk_mp->map_pmap.pr_mflags |= MA_STACK;
   1960 
   1961 	/*
   1962 	 * At this point, we have enough information to look for the
   1963 	 * executable and open it: we have access to the auxv, a psinfo_t,
   1964 	 * and the ability to read from mappings provided by the core file.
   1965 	 */
   1966 	(void) Pfindexec(P, aout_path, core_exec_open, &aout);
   1967 	dprintf("P->execname = \"%s\"\n", P->execname ? P->execname : "NULL");
   1968 	execname = P->execname ? P->execname : "a.out";
   1969 
   1970 	/*
   1971 	 * Iterate through the sections, looking for the .dynamic and .interp
   1972 	 * sections.  If we encounter them, remember their section pointers.
   1973 	 */
   1974 	for (scn = NULL; (scn = elf_nextscn(aout.e_elf, scn)) != NULL; ) {
   1975 		char *sname;
   1976 
   1977 		if ((gelf_getshdr(scn, &shdr) == NULL) ||
   1978 		    (sname = elf_strptr(aout.e_elf, aout.e_hdr.e_shstrndx,
   1979 		    (size_t)shdr.sh_name)) == NULL)
   1980 			continue;
   1981 
   1982 		if (strcmp(sname, ".interp") == 0)
   1983 			intp_scn = scn;
   1984 	}
   1985 
   1986 	/*
   1987 	 * Get the AT_BASE auxv element.  If this is missing (-1), then
   1988 	 * we assume this is a statically-linked executable.
   1989 	 */
   1990 	base_addr = Pgetauxval(P, AT_BASE);
   1991 
   1992 	/*
   1993 	 * In order to get librtld_db initialized, we'll need to identify
   1994 	 * and name the mapping corresponding to the run-time linker.  The
   1995 	 * AT_BASE auxv element tells us the address where it was mapped,
   1996 	 * and the .interp section of the executable tells us its path.
   1997 	 * If for some reason that doesn't pan out, just use ld.so.1.
   1998 	 */
   1999 	if (intp_scn != NULL && (dp = elf_getdata(intp_scn, NULL)) != NULL &&
   2000 	    dp->d_size != 0) {
   2001 		dprintf(".interp = <%s>\n", (char *)dp->d_buf);
   2002 		interp = dp->d_buf;
   2003 
   2004 	} else if (base_addr != (uintptr_t)-1L) {
   2005 		if (P->core->core_dmodel == PR_MODEL_LP64)
   2006 			interp = "/usr/lib/64/ld.so.1";
   2007 		else
   2008 			interp = "/usr/lib/ld.so.1";
   2009 
   2010 		dprintf(".interp section is missing or could not be read; "
   2011 		    "defaulting to %s\n", interp);
   2012 	} else
   2013 		dprintf("detected statically linked executable\n");
   2014 
   2015 	/*
   2016 	 * If we have an AT_BASE element, name the mapping at that address
   2017 	 * using the interpreter pathname.  Name the corresponding data
   2018 	 * mapping after the interpreter as well.
   2019 	 */
   2020 	if (base_addr != (uintptr_t)-1L) {
   2021 		elf_file_t intf;
   2022 
   2023 		P->map_ldso = core_name_mapping(P, base_addr, interp);
   2024 
   2025 		if (core_elf_open(&intf, interp, ET_DYN, NULL) == 0) {
   2026 			rd_loadobj_t rl;
   2027 			map_info_t *dmp;
   2028 
   2029 			rl.rl_base = base_addr;
   2030 			dmp = core_find_data(P, intf.e_elf, &rl);
   2031 
   2032 			if (dmp != NULL) {
   2033 				dprintf("renamed data at %p to %s\n",
   2034 				    (void *)rl.rl_data_base, interp);
   2035 				(void) strncpy(dmp->map_pmap.pr_mapname,
   2036 				    interp, PRMAPSZ);
   2037 				dmp->map_pmap.pr_mapname[PRMAPSZ - 1] = '\0';
   2038 			}
   2039 		}
   2040 
   2041 		core_elf_close(&intf);
   2042 	}
   2043 
   2044 	/*
   2045 	 * If we have an AT_ENTRY element, name the mapping at that address
   2046 	 * using the special name "a.out" just like /proc does.
   2047 	 */
   2048 	if ((addr = Pgetauxval(P, AT_ENTRY)) != (uintptr_t)-1L)
   2049 		P->map_exec = core_name_mapping(P, addr, "a.out");
   2050 
   2051 	/*
   2052 	 * If we're a statically linked executable, then just locate the
   2053 	 * executable's text and data and name them after the executable.
   2054 	 */
   2055 	if (base_addr == (uintptr_t)-1L) {
   2056 		map_info_t *tmp, *dmp;
   2057 		file_info_t *fp;
   2058 		rd_loadobj_t rl;
   2059 
   2060 		if ((tmp = core_find_text(P, aout.e_elf, &rl)) != NULL &&
   2061 		    (dmp = core_find_data(P, aout.e_elf, &rl)) != NULL) {
   2062 			(void) strncpy(tmp->map_pmap.pr_mapname,
   2063 			    execname, PRMAPSZ);
   2064 			tmp->map_pmap.pr_mapname[PRMAPSZ - 1] = '\0';
   2065 			(void) strncpy(dmp->map_pmap.pr_mapname,
   2066 			    execname, PRMAPSZ);
   2067 			dmp->map_pmap.pr_mapname[PRMAPSZ - 1] = '\0';
   2068 		}
   2069 
   2070 		if ((P->map_exec = tmp) != NULL &&
   2071 		    (fp = malloc(sizeof (file_info_t))) != NULL) {
   2072 
   2073 			(void) memset(fp, 0, sizeof (file_info_t));
   2074 
   2075 			list_link(fp, &P->file_head);
   2076 			tmp->map_file = fp;
   2077 			P->num_files++;
   2078 
   2079 			fp->file_ref = 1;
   2080 			fp->file_fd = -1;
   2081 
   2082 			fp->file_lo = malloc(sizeof (rd_loadobj_t));
   2083 			fp->file_lname = strdup(execname);
   2084 
   2085 			if (fp->file_lo)
   2086 				*fp->file_lo = rl;
   2087 			if (fp->file_lname)
   2088 				fp->file_lbase = basename(fp->file_lname);
   2089 			if (fp->file_rname)
   2090 				fp->file_rbase = basename(fp->file_rname);
   2091 
   2092 			(void) strcpy(fp->file_pname,
   2093 			    P->mappings[0].map_pmap.pr_mapname);
   2094 			fp->file_map = tmp;
   2095 
   2096 			Pbuild_file_symtab(P, fp);
   2097 
   2098 			if (dmp != NULL) {
   2099 				dmp->map_file = fp;
   2100 				fp->file_ref++;
   2101 			}
   2102 		}
   2103 	}
   2104 
   2105 	core_elf_close(&aout);
   2106 
   2107 	/*
   2108 	 * We now have enough information to initialize librtld_db.
   2109 	 * After it warms up, we can iterate through the load object chain
   2110 	 * in the core, which will allow us to construct the file info
   2111 	 * we need to provide symbol information for the other shared
   2112 	 * libraries, and also to fill in the missing mapping names.
   2113 	 */
   2114 	rd_log(_libproc_debug);
   2115 
   2116 	if ((P->rap = rd_new(P)) != NULL) {
   2117 		(void) rd_loadobj_iter(P->rap, (rl_iter_f *)
   2118 		    core_iter_mapping, P);
   2119 
   2120 		if (P->core->core_errno != 0) {
   2121 			errno = P->core->core_errno;
   2122 			*perr = G_STRANGE;
   2123 			goto err;
   2124 		}
   2125 	} else
   2126 		dprintf("failed to initialize rtld_db agent\n");
   2127 
   2128 	/*
   2129 	 * If there are sections, load them and process the data from any
   2130 	 * sections that we can use to annotate the file_info_t's.
   2131 	 */
   2132 	core_load_shdrs(P, &core);
   2133 
   2134 	/*
   2135 	 * If we previously located a stack or break mapping, and they are
   2136 	 * still anonymous, we now assume that they were MAP_ANON mappings.
   2137 	 * If brk_mp turns out to now have a name, then the heap is still
   2138 	 * sitting at the end of the executable's data+bss mapping: remove
   2139 	 * the previous MA_BREAK setting to be consistent with /proc.
   2140 	 */
   2141 	if (stk_mp != NULL && stk_mp->map_pmap.pr_mapname[0] == '\0')
   2142 		stk_mp->map_pmap.pr_mflags |= MA_ANON;
   2143 	if (brk_mp != NULL && brk_mp->map_pmap.pr_mapname[0] == '\0')
   2144 		brk_mp->map_pmap.pr_mflags |= MA_ANON;
   2145 	else if (brk_mp != NULL)
   2146 		brk_mp->map_pmap.pr_mflags &= ~MA_BREAK;
   2147 
   2148 	*perr = 0;
   2149 	return (P);
   2150 
   2151 err:
   2152 	Pfree(P);
   2153 	core_elf_close(&aout);
   2154 	return (NULL);
   2155 }
   2156 
   2157 /*
   2158  * Grab a core file using a pathname.  We just open it and call Pfgrab_core().
   2159  */
   2160 struct ps_prochandle *
   2161 Pgrab_core(const char *core, const char *aout, int gflag, int *perr)
   2162 {
   2163 	int fd, oflag = (gflag & PGRAB_RDONLY) ? O_RDONLY : O_RDWR;
   2164 
   2165 	if ((fd = open64(core, oflag)) >= 0)
   2166 		return (Pfgrab_core(fd, aout, perr));
   2167 
   2168 	if (errno != ENOENT)
   2169 		*perr = G_STRANGE;
   2170 	else
   2171 		*perr = G_NOCORE;
   2172 
   2173 	return (NULL);
   2174 }
   2175