1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25 /*
  26  * Copyright 2012 DEY Storage Systems, Inc.  All rights reserved.
  27  * Copyright (c) 2014, Joyent, Inc. All rights reserved.
  28  * Copyright (c) 2013 by Delphix. All rights reserved.
  29  * Copyright 2015 Gary Mills
  30  */
  31 
  32 #include <sys/types.h>
  33 #include <sys/utsname.h>
  34 #include <sys/sysmacros.h>
  35 #include <sys/proc.h>
  36 
  37 #include <alloca.h>
  38 #include <rtld_db.h>
  39 #include <libgen.h>
  40 #include <limits.h>
  41 #include <string.h>
  42 #include <stdlib.h>
  43 #include <unistd.h>
  44 #include <errno.h>
  45 #include <gelf.h>
  46 #include <stddef.h>
  47 #include <signal.h>
  48 
  49 #include "libproc.h"
  50 #include "Pcontrol.h"
  51 #include "P32ton.h"
  52 #include "Putil.h"
  53 #ifdef __x86
  54 #include "Pcore_linux.h"
  55 #endif
  56 
  57 /*
  58  * Pcore.c - Code to initialize a ps_prochandle from a core dump.  We
  59  * allocate an additional structure to hold information from the core
  60  * file, and attach this to the standard ps_prochandle in place of the
  61  * ability to examine /proc/<pid>/ files.
  62  */
  63 
  64 /*
  65  * Basic i/o function for reading and writing from the process address space
  66  * stored in the core file and associated shared libraries.  We compute the
  67  * appropriate fd and offsets, and let the provided prw function do the rest.
  68  */
  69 static ssize_t
  70 core_rw(struct ps_prochandle *P, void *buf, size_t n, uintptr_t addr,
  71     ssize_t (*prw)(int, void *, size_t, off64_t))
  72 {
  73         ssize_t resid = n;
  74 
  75         while (resid != 0) {
  76                 map_info_t *mp = Paddr2mptr(P, addr);
  77 
  78                 uintptr_t mapoff;
  79                 ssize_t len;
  80                 off64_t off;
  81                 int fd;
  82 
  83                 if (mp == NULL)
  84                         break;  /* No mapping for this address */
  85 
  86                 if (mp->map_pmap.pr_mflags & MA_RESERVED1) {
  87                         if (mp->map_file == NULL || mp->map_file->file_fd < 0)
  88                                 break;  /* No file or file not open */
  89 
  90                         fd = mp->map_file->file_fd;
  91                 } else
  92                         fd = P->asfd;
  93 
  94                 mapoff = addr - mp->map_pmap.pr_vaddr;
  95                 len = MIN(resid, mp->map_pmap.pr_size - mapoff);
  96                 off = mp->map_offset + mapoff;
  97 
  98                 if ((len = prw(fd, buf, len, off)) <= 0)
  99                         break;
 100 
 101                 resid -= len;
 102                 addr += len;
 103                 buf = (char *)buf + len;
 104         }
 105 
 106         /*
 107          * Important: Be consistent with the behavior of i/o on the as file:
 108          * writing to an invalid address yields EIO; reading from an invalid
 109          * address falls through to returning success and zero bytes.
 110          */
 111         if (resid == n && n != 0 && prw != pread64) {
 112                 errno = EIO;
 113                 return (-1);
 114         }
 115 
 116         return (n - resid);
 117 }
 118 
 119 /*ARGSUSED*/
 120 static ssize_t
 121 Pread_core(struct ps_prochandle *P, void *buf, size_t n, uintptr_t addr,
 122     void *data)
 123 {
 124         return (core_rw(P, buf, n, addr, pread64));
 125 }
 126 
 127 /*ARGSUSED*/
 128 static ssize_t
 129 Pwrite_core(struct ps_prochandle *P, const void *buf, size_t n, uintptr_t addr,
 130     void *data)
 131 {
 132         return (core_rw(P, (void *)buf, n, addr,
 133             (ssize_t (*)(int, void *, size_t, off64_t)) pwrite64));
 134 }
 135 
 136 /*ARGSUSED*/
 137 static int
 138 Pcred_core(struct ps_prochandle *P, prcred_t *pcrp, int ngroups, void *data)
 139 {
 140         core_info_t *core = data;
 141 
 142         if (core->core_cred != NULL) {
 143                 /*
 144                  * Avoid returning more supplementary group data than the
 145                  * caller has allocated in their buffer.  We expect them to
 146                  * check pr_ngroups afterward and potentially call us again.
 147                  */
 148                 ngroups = MIN(ngroups, core->core_cred->pr_ngroups);
 149 
 150                 (void) memcpy(pcrp, core->core_cred,
 151                     sizeof (prcred_t) + (ngroups - 1) * sizeof (gid_t));
 152 
 153                 return (0);
 154         }
 155 
 156         errno = ENODATA;
 157         return (-1);
 158 }
 159 
 160 /*ARGSUSED*/
 161 static int
 162 Psecflags_core(struct ps_prochandle *P, prsecflags_t **psf, void *data)
 163 {
 164         core_info_t *core = data;
 165 
 166         if (core->core_secflags == NULL) {
 167                 errno = ENODATA;
 168                 return (-1);
 169         }
 170 
 171         if ((*psf = calloc(1, sizeof (prsecflags_t))) == NULL)
 172                 return (-1);
 173 
 174         (void) memcpy(*psf, core->core_secflags, sizeof (prsecflags_t));
 175 
 176         return (0);
 177 }
 178 
 179 /*ARGSUSED*/
 180 static int
 181 Ppriv_core(struct ps_prochandle *P, prpriv_t **pprv, void *data)
 182 {
 183         core_info_t *core = data;
 184 
 185         if (core->core_priv == NULL) {
 186                 errno = ENODATA;
 187                 return (-1);
 188         }
 189 
 190         *pprv = malloc(core->core_priv_size);
 191         if (*pprv == NULL) {
 192                 return (-1);
 193         }
 194 
 195         (void) memcpy(*pprv, core->core_priv, core->core_priv_size);
 196         return (0);
 197 }
 198 
 199 /*ARGSUSED*/
 200 static const psinfo_t *
 201 Ppsinfo_core(struct ps_prochandle *P, psinfo_t *psinfo, void *data)
 202 {
 203         return (&P->psinfo);
 204 }
 205 
 206 /*ARGSUSED*/
 207 static void
 208 Pfini_core(struct ps_prochandle *P, void *data)
 209 {
 210         core_info_t *core = data;
 211 
 212         if (core != NULL) {
 213                 extern void __priv_free_info(void *);
 214                 lwp_info_t *nlwp, *lwp = list_next(&core->core_lwp_head);
 215                 int i;
 216 
 217                 for (i = 0; i < core->core_nlwp; i++, lwp = nlwp) {
 218                         nlwp = list_next(lwp);
 219 #ifdef __sparc
 220                         if (lwp->lwp_gwins != NULL)
 221                                 free(lwp->lwp_gwins);
 222                         if (lwp->lwp_xregs != NULL)
 223                                 free(lwp->lwp_xregs);
 224                         if (lwp->lwp_asrs != NULL)
 225                                 free(lwp->lwp_asrs);
 226 #endif
 227                         free(lwp);
 228                 }
 229 
 230                 if (core->core_platform != NULL)
 231                         free(core->core_platform);
 232                 if (core->core_uts != NULL)
 233                         free(core->core_uts);
 234                 if (core->core_cred != NULL)
 235                         free(core->core_cred);
 236                 if (core->core_priv != NULL)
 237                         free(core->core_priv);
 238                 if (core->core_privinfo != NULL)
 239                         __priv_free_info(core->core_privinfo);
 240                 if (core->core_ppii != NULL)
 241                         free(core->core_ppii);
 242                 if (core->core_zonename != NULL)
 243                         free(core->core_zonename);
 244                 if (core->core_secflags != NULL)
 245                         free(core->core_secflags);
 246 #ifdef __x86
 247                 if (core->core_ldt != NULL)
 248                         free(core->core_ldt);
 249 #endif
 250 
 251                 free(core);
 252         }
 253 }
 254 
 255 /*ARGSUSED*/
 256 static char *
 257 Pplatform_core(struct ps_prochandle *P, char *s, size_t n, void *data)
 258 {
 259         core_info_t *core = data;
 260 
 261         if (core->core_platform == NULL) {
 262                 errno = ENODATA;
 263                 return (NULL);
 264         }
 265         (void) strncpy(s, core->core_platform, n - 1);
 266         s[n - 1] = '\0';
 267         return (s);
 268 }
 269 
 270 /*ARGSUSED*/
 271 static int
 272 Puname_core(struct ps_prochandle *P, struct utsname *u, void *data)
 273 {
 274         core_info_t *core = data;
 275 
 276         if (core->core_uts == NULL) {
 277                 errno = ENODATA;
 278                 return (-1);
 279         }
 280         (void) memcpy(u, core->core_uts, sizeof (struct utsname));
 281         return (0);
 282 }
 283 
 284 /*ARGSUSED*/
 285 static char *
 286 Pzonename_core(struct ps_prochandle *P, char *s, size_t n, void *data)
 287 {
 288         core_info_t *core = data;
 289 
 290         if (core->core_zonename == NULL) {
 291                 errno = ENODATA;
 292                 return (NULL);
 293         }
 294         (void) strlcpy(s, core->core_zonename, n);
 295         return (s);
 296 }
 297 
 298 #ifdef __x86
 299 /*ARGSUSED*/
 300 static int
 301 Pldt_core(struct ps_prochandle *P, struct ssd *pldt, int nldt, void *data)
 302 {
 303         core_info_t *core = data;
 304 
 305         if (pldt == NULL || nldt == 0)
 306                 return (core->core_nldt);
 307 
 308         if (core->core_ldt != NULL) {
 309                 nldt = MIN(nldt, core->core_nldt);
 310 
 311                 (void) memcpy(pldt, core->core_ldt,
 312                     nldt * sizeof (struct ssd));
 313 
 314                 return (nldt);
 315         }
 316 
 317         errno = ENODATA;
 318         return (-1);
 319 }
 320 #endif
 321 
 322 static const ps_ops_t P_core_ops = {
 323         .pop_pread      = Pread_core,
 324         .pop_pwrite     = Pwrite_core,
 325         .pop_cred       = Pcred_core,
 326         .pop_priv       = Ppriv_core,
 327         .pop_psinfo     = Ppsinfo_core,
 328         .pop_fini       = Pfini_core,
 329         .pop_platform   = Pplatform_core,
 330         .pop_uname      = Puname_core,
 331         .pop_zonename   = Pzonename_core,
 332         .pop_secflags   = Psecflags_core,
 333 #ifdef __x86
 334         .pop_ldt        = Pldt_core
 335 #endif
 336 };
 337 
 338 /*
 339  * Return the lwp_info_t for the given lwpid.  If no such lwpid has been
 340  * encountered yet, allocate a new structure and return a pointer to it.
 341  * Create a list of lwp_info_t structures sorted in decreasing lwp_id order.
 342  */
 343 static lwp_info_t *
 344 lwpid2info(struct ps_prochandle *P, lwpid_t id)
 345 {
 346         core_info_t *core = P->data;
 347         lwp_info_t *lwp = list_next(&core->core_lwp_head);
 348         lwp_info_t *next;
 349         uint_t i;
 350 
 351         for (i = 0; i < core->core_nlwp; i++, lwp = list_next(lwp)) {
 352                 if (lwp->lwp_id == id) {
 353                         core->core_lwp = lwp;
 354                         return (lwp);
 355                 }
 356                 if (lwp->lwp_id < id) {
 357                         break;
 358                 }
 359         }
 360 
 361         next = lwp;
 362         if ((lwp = calloc(1, sizeof (lwp_info_t))) == NULL)
 363                 return (NULL);
 364 
 365         list_link(lwp, next);
 366         lwp->lwp_id = id;
 367 
 368         core->core_lwp = lwp;
 369         core->core_nlwp++;
 370 
 371         return (lwp);
 372 }
 373 
 374 /*
 375  * The core file itself contains a series of NOTE segments containing saved
 376  * structures from /proc at the time the process died.  For each note we
 377  * comprehend, we define a function to read it in from the core file,
 378  * convert it to our native data model if necessary, and store it inside
 379  * the ps_prochandle.  Each function is invoked by Pfgrab_core() with the
 380  * seek pointer on P->asfd positioned appropriately.  We populate a table
 381  * of pointers to these note functions below.
 382  */
 383 
 384 static int
 385 note_pstatus(struct ps_prochandle *P, size_t nbytes)
 386 {
 387 #ifdef _LP64
 388         core_info_t *core = P->data;
 389 
 390         if (core->core_dmodel == PR_MODEL_ILP32) {
 391                 pstatus32_t ps32;
 392 
 393                 if (nbytes < sizeof (pstatus32_t) ||
 394                     read(P->asfd, &ps32, sizeof (ps32)) != sizeof (ps32))
 395                         goto err;
 396 
 397                 pstatus_32_to_n(&ps32, &P->status);
 398 
 399         } else
 400 #endif
 401         if (nbytes < sizeof (pstatus_t) ||
 402             read(P->asfd, &P->status, sizeof (pstatus_t)) != sizeof (pstatus_t))
 403                 goto err;
 404 
 405         P->orig_status = P->status;
 406         P->pid = P->status.pr_pid;
 407 
 408         return (0);
 409 
 410 err:
 411         dprintf("Pgrab_core: failed to read NT_PSTATUS\n");
 412         return (-1);
 413 }
 414 
 415 static int
 416 note_lwpstatus(struct ps_prochandle *P, size_t nbytes)
 417 {
 418         lwp_info_t *lwp;
 419         lwpstatus_t lps;
 420 
 421 #ifdef _LP64
 422         core_info_t *core = P->data;
 423 
 424         if (core->core_dmodel == PR_MODEL_ILP32) {
 425                 lwpstatus32_t l32;
 426 
 427                 if (nbytes < sizeof (lwpstatus32_t) ||
 428                     read(P->asfd, &l32, sizeof (l32)) != sizeof (l32))
 429                         goto err;
 430 
 431                 lwpstatus_32_to_n(&l32, &lps);
 432         } else
 433 #endif
 434         if (nbytes < sizeof (lwpstatus_t) ||
 435             read(P->asfd, &lps, sizeof (lps)) != sizeof (lps))
 436                 goto err;
 437 
 438         if ((lwp = lwpid2info(P, lps.pr_lwpid)) == NULL) {
 439                 dprintf("Pgrab_core: failed to add NT_LWPSTATUS\n");
 440                 return (-1);
 441         }
 442 
 443         /*
 444          * Erase a useless and confusing artifact of the kernel implementation:
 445          * the lwps which did *not* create the core will show SIGKILL.  We can
 446          * be assured this is bogus because SIGKILL can't produce core files.
 447          */
 448         if (lps.pr_cursig == SIGKILL)
 449                 lps.pr_cursig = 0;
 450 
 451         (void) memcpy(&lwp->lwp_status, &lps, sizeof (lps));
 452         return (0);
 453 
 454 err:
 455         dprintf("Pgrab_core: failed to read NT_LWPSTATUS\n");
 456         return (-1);
 457 }
 458 
 459 #ifdef __x86
 460 
 461 static void
 462 lx_prpsinfo32_to_psinfo(lx_prpsinfo32_t *p32, psinfo_t *psinfo)
 463 {
 464         psinfo->pr_flag = p32->pr_flag;
 465         psinfo->pr_pid = p32->pr_pid;
 466         psinfo->pr_ppid = p32->pr_ppid;
 467         psinfo->pr_uid = p32->pr_uid;
 468         psinfo->pr_gid = p32->pr_gid;
 469         psinfo->pr_sid = p32->pr_sid;
 470         psinfo->pr_pgid = p32->pr_pgrp;
 471 
 472         (void) memcpy(psinfo->pr_fname, p32->pr_fname,
 473             sizeof (psinfo->pr_fname));
 474         (void) memcpy(psinfo->pr_psargs, p32->pr_psargs,
 475             sizeof (psinfo->pr_psargs));
 476 }
 477 
 478 static void
 479 lx_prpsinfo64_to_psinfo(lx_prpsinfo64_t *p64, psinfo_t *psinfo)
 480 {
 481         psinfo->pr_flag = p64->pr_flag;
 482         psinfo->pr_pid = p64->pr_pid;
 483         psinfo->pr_ppid = p64->pr_ppid;
 484         psinfo->pr_uid = p64->pr_uid;
 485         psinfo->pr_gid = p64->pr_gid;
 486         psinfo->pr_sid = p64->pr_sid;
 487         psinfo->pr_pgid = p64->pr_pgrp;
 488         psinfo->pr_pgid = p64->pr_pgrp;
 489 
 490         (void) memcpy(psinfo->pr_fname, p64->pr_fname,
 491             sizeof (psinfo->pr_fname));
 492         (void) memcpy(psinfo->pr_psargs, p64->pr_psargs,
 493             sizeof (psinfo->pr_psargs));
 494 }
 495 
 496 static int
 497 note_linux_psinfo(struct ps_prochandle *P, size_t nbytes)
 498 {
 499         core_info_t *core = P->data;
 500         lx_prpsinfo32_t p32;
 501         lx_prpsinfo64_t p64;
 502 
 503         if (core->core_dmodel == PR_MODEL_ILP32) {
 504                 if (nbytes < sizeof (p32) ||
 505                     read(P->asfd, &p32, sizeof (p32)) != sizeof (p32))
 506                         goto err;
 507 
 508                 lx_prpsinfo32_to_psinfo(&p32, &P->psinfo);
 509         } else {
 510                 if (nbytes < sizeof (p64) ||
 511                     read(P->asfd, &p64, sizeof (p64)) != sizeof (p64))
 512                         goto err;
 513 
 514                 lx_prpsinfo64_to_psinfo(&p64, &P->psinfo);
 515         }
 516 
 517 
 518         P->status.pr_pid = P->psinfo.pr_pid;
 519         P->status.pr_ppid = P->psinfo.pr_ppid;
 520         P->status.pr_pgid = P->psinfo.pr_pgid;
 521         P->status.pr_sid = P->psinfo.pr_sid;
 522 
 523         P->psinfo.pr_nlwp = 0;
 524         P->status.pr_nlwp = 0;
 525 
 526         return (0);
 527 err:
 528         dprintf("Pgrab_core: failed to read NT_PSINFO\n");
 529         return (-1);
 530 }
 531 
 532 static void
 533 lx_prstatus64_to_lwp(lx_prstatus64_t *prs64, lwp_info_t *lwp)
 534 {
 535         LTIME_TO_TIMESPEC(lwp->lwp_status.pr_utime, prs64->pr_utime);
 536         LTIME_TO_TIMESPEC(lwp->lwp_status.pr_stime, prs64->pr_stime);
 537 
 538         lwp->lwp_status.pr_reg[REG_R15] = prs64->pr_reg.lxr_r15;
 539         lwp->lwp_status.pr_reg[REG_R14] = prs64->pr_reg.lxr_r14;
 540         lwp->lwp_status.pr_reg[REG_R13] = prs64->pr_reg.lxr_r13;
 541         lwp->lwp_status.pr_reg[REG_R12] = prs64->pr_reg.lxr_r12;
 542         lwp->lwp_status.pr_reg[REG_R11] = prs64->pr_reg.lxr_r11;
 543         lwp->lwp_status.pr_reg[REG_R10] = prs64->pr_reg.lxr_r10;
 544         lwp->lwp_status.pr_reg[REG_R9] = prs64->pr_reg.lxr_r9;
 545         lwp->lwp_status.pr_reg[REG_R8] = prs64->pr_reg.lxr_r8;
 546 
 547         lwp->lwp_status.pr_reg[REG_RDI] = prs64->pr_reg.lxr_rdi;
 548         lwp->lwp_status.pr_reg[REG_RSI] = prs64->pr_reg.lxr_rsi;
 549         lwp->lwp_status.pr_reg[REG_RBP] = prs64->pr_reg.lxr_rbp;
 550         lwp->lwp_status.pr_reg[REG_RBX] = prs64->pr_reg.lxr_rbx;
 551         lwp->lwp_status.pr_reg[REG_RDX] = prs64->pr_reg.lxr_rdx;
 552         lwp->lwp_status.pr_reg[REG_RCX] = prs64->pr_reg.lxr_rcx;
 553         lwp->lwp_status.pr_reg[REG_RAX] = prs64->pr_reg.lxr_rax;
 554 
 555         lwp->lwp_status.pr_reg[REG_RIP] = prs64->pr_reg.lxr_rip;
 556         lwp->lwp_status.pr_reg[REG_CS] = prs64->pr_reg.lxr_cs;
 557         lwp->lwp_status.pr_reg[REG_RSP] = prs64->pr_reg.lxr_rsp;
 558         lwp->lwp_status.pr_reg[REG_FS] = prs64->pr_reg.lxr_fs;
 559         lwp->lwp_status.pr_reg[REG_SS] = prs64->pr_reg.lxr_ss;
 560         lwp->lwp_status.pr_reg[REG_GS] = prs64->pr_reg.lxr_gs;
 561         lwp->lwp_status.pr_reg[REG_ES] = prs64->pr_reg.lxr_es;
 562         lwp->lwp_status.pr_reg[REG_DS] = prs64->pr_reg.lxr_ds;
 563 
 564         lwp->lwp_status.pr_reg[REG_GSBASE] = prs64->pr_reg.lxr_gs_base;
 565         lwp->lwp_status.pr_reg[REG_FSBASE] = prs64->pr_reg.lxr_fs_base;
 566 }
 567 
 568 static void
 569 lx_prstatus32_to_lwp(lx_prstatus32_t *prs32, lwp_info_t *lwp)
 570 {
 571         LTIME_TO_TIMESPEC(lwp->lwp_status.pr_utime, prs32->pr_utime);
 572         LTIME_TO_TIMESPEC(lwp->lwp_status.pr_stime, prs32->pr_stime);
 573 
 574 #ifdef __amd64
 575         lwp->lwp_status.pr_reg[REG_GS] = prs32->pr_reg.lxr_gs;
 576         lwp->lwp_status.pr_reg[REG_FS] = prs32->pr_reg.lxr_fs;
 577         lwp->lwp_status.pr_reg[REG_DS] = prs32->pr_reg.lxr_ds;
 578         lwp->lwp_status.pr_reg[REG_ES] = prs32->pr_reg.lxr_es;
 579         lwp->lwp_status.pr_reg[REG_RDI] = prs32->pr_reg.lxr_di;
 580         lwp->lwp_status.pr_reg[REG_RSI] = prs32->pr_reg.lxr_si;
 581         lwp->lwp_status.pr_reg[REG_RBP] = prs32->pr_reg.lxr_bp;
 582         lwp->lwp_status.pr_reg[REG_RBX] = prs32->pr_reg.lxr_bx;
 583         lwp->lwp_status.pr_reg[REG_RDX] = prs32->pr_reg.lxr_dx;
 584         lwp->lwp_status.pr_reg[REG_RCX] = prs32->pr_reg.lxr_cx;
 585         lwp->lwp_status.pr_reg[REG_RAX] = prs32->pr_reg.lxr_ax;
 586         lwp->lwp_status.pr_reg[REG_RIP] = prs32->pr_reg.lxr_ip;
 587         lwp->lwp_status.pr_reg[REG_CS] = prs32->pr_reg.lxr_cs;
 588         lwp->lwp_status.pr_reg[REG_RFL] = prs32->pr_reg.lxr_flags;
 589         lwp->lwp_status.pr_reg[REG_RSP] = prs32->pr_reg.lxr_sp;
 590         lwp->lwp_status.pr_reg[REG_SS] = prs32->pr_reg.lxr_ss;
 591 #else /* __amd64 */
 592         lwp->lwp_status.pr_reg[EBX] = prs32->pr_reg.lxr_bx;
 593         lwp->lwp_status.pr_reg[ECX] = prs32->pr_reg.lxr_cx;
 594         lwp->lwp_status.pr_reg[EDX] = prs32->pr_reg.lxr_dx;
 595         lwp->lwp_status.pr_reg[ESI] = prs32->pr_reg.lxr_si;
 596         lwp->lwp_status.pr_reg[EDI] = prs32->pr_reg.lxr_di;
 597         lwp->lwp_status.pr_reg[EBP] = prs32->pr_reg.lxr_bp;
 598         lwp->lwp_status.pr_reg[EAX] = prs32->pr_reg.lxr_ax;
 599         lwp->lwp_status.pr_reg[EIP] = prs32->pr_reg.lxr_ip;
 600         lwp->lwp_status.pr_reg[UESP] = prs32->pr_reg.lxr_sp;
 601 
 602         lwp->lwp_status.pr_reg[DS] = prs32->pr_reg.lxr_ds;
 603         lwp->lwp_status.pr_reg[ES] = prs32->pr_reg.lxr_es;
 604         lwp->lwp_status.pr_reg[FS] = prs32->pr_reg.lxr_fs;
 605         lwp->lwp_status.pr_reg[GS] = prs32->pr_reg.lxr_gs;
 606         lwp->lwp_status.pr_reg[CS] = prs32->pr_reg.lxr_cs;
 607         lwp->lwp_status.pr_reg[SS] = prs32->pr_reg.lxr_ss;
 608 
 609         lwp->lwp_status.pr_reg[EFL] = prs32->pr_reg.lxr_flags;
 610 #endif  /* !__amd64 */
 611 }
 612 
 613 static int
 614 note_linux_prstatus(struct ps_prochandle *P, size_t nbytes)
 615 {
 616         core_info_t *core = P->data;
 617 
 618         lx_prstatus64_t prs64;
 619         lx_prstatus32_t prs32;
 620         lwp_info_t *lwp;
 621         lwpid_t tid;
 622 
 623         dprintf("looking for model %d, %ld/%ld\n", core->core_dmodel,
 624             (ulong_t)nbytes, (ulong_t)sizeof (prs32));
 625         if (core->core_dmodel == PR_MODEL_ILP32) {
 626                 if (nbytes < sizeof (prs32) ||
 627                     read(P->asfd, &prs32, sizeof (prs32)) != nbytes)
 628                         goto err;
 629                 tid = prs32.pr_pid;
 630         } else {
 631                 if (nbytes < sizeof (prs64) ||
 632                     read(P->asfd, &prs64, sizeof (prs64)) != nbytes)
 633                         goto err;
 634                 tid = prs64.pr_pid;
 635         }
 636 
 637         if ((lwp = lwpid2info(P, tid)) == NULL) {
 638                 dprintf("Pgrab_core: failed to add lwpid2info "
 639                     "linux_prstatus\n");
 640                 return (-1);
 641         }
 642 
 643         P->psinfo.pr_nlwp++;
 644         P->status.pr_nlwp++;
 645 
 646         lwp->lwp_status.pr_lwpid = tid;
 647 
 648         if (core->core_dmodel == PR_MODEL_ILP32)
 649                 lx_prstatus32_to_lwp(&prs32, lwp);
 650         else
 651                 lx_prstatus64_to_lwp(&prs64, lwp);
 652 
 653         return (0);
 654 err:
 655         dprintf("Pgrab_core: failed to read NT_PRSTATUS\n");
 656         return (-1);
 657 }
 658 
 659 #endif /* __x86 */
 660 
 661 static int
 662 note_psinfo(struct ps_prochandle *P, size_t nbytes)
 663 {
 664 #ifdef _LP64
 665         core_info_t *core = P->data;
 666 
 667         if (core->core_dmodel == PR_MODEL_ILP32) {
 668                 psinfo32_t ps32;
 669 
 670                 if (nbytes < sizeof (psinfo32_t) ||
 671                     read(P->asfd, &ps32, sizeof (ps32)) != sizeof (ps32))
 672                         goto err;
 673 
 674                 psinfo_32_to_n(&ps32, &P->psinfo);
 675         } else
 676 #endif
 677         if (nbytes < sizeof (psinfo_t) ||
 678             read(P->asfd, &P->psinfo, sizeof (psinfo_t)) != sizeof (psinfo_t))
 679                 goto err;
 680 
 681         dprintf("pr_fname = <%s>\n", P->psinfo.pr_fname);
 682         dprintf("pr_psargs = <%s>\n", P->psinfo.pr_psargs);
 683         dprintf("pr_wstat = 0x%x\n", P->psinfo.pr_wstat);
 684 
 685         return (0);
 686 
 687 err:
 688         dprintf("Pgrab_core: failed to read NT_PSINFO\n");
 689         return (-1);
 690 }
 691 
 692 static int
 693 note_lwpsinfo(struct ps_prochandle *P, size_t nbytes)
 694 {
 695         lwp_info_t *lwp;
 696         lwpsinfo_t lps;
 697 
 698 #ifdef _LP64
 699         core_info_t *core = P->data;
 700 
 701         if (core->core_dmodel == PR_MODEL_ILP32) {
 702                 lwpsinfo32_t l32;
 703 
 704                 if (nbytes < sizeof (lwpsinfo32_t) ||
 705                     read(P->asfd, &l32, sizeof (l32)) != sizeof (l32))
 706                         goto err;
 707 
 708                 lwpsinfo_32_to_n(&l32, &lps);
 709         } else
 710 #endif
 711         if (nbytes < sizeof (lwpsinfo_t) ||
 712             read(P->asfd, &lps, sizeof (lps)) != sizeof (lps))
 713                 goto err;
 714 
 715         if ((lwp = lwpid2info(P, lps.pr_lwpid)) == NULL) {
 716                 dprintf("Pgrab_core: failed to add NT_LWPSINFO\n");
 717                 return (-1);
 718         }
 719 
 720         (void) memcpy(&lwp->lwp_psinfo, &lps, sizeof (lps));
 721         return (0);
 722 
 723 err:
 724         dprintf("Pgrab_core: failed to read NT_LWPSINFO\n");
 725         return (-1);
 726 }
 727 
 728 static int
 729 note_fdinfo(struct ps_prochandle *P, size_t nbytes)
 730 {
 731         prfdinfo_t prfd;
 732         fd_info_t *fip;
 733 
 734         if ((nbytes < sizeof (prfd)) ||
 735             (read(P->asfd, &prfd, sizeof (prfd)) != sizeof (prfd))) {
 736                 dprintf("Pgrab_core: failed to read NT_FDINFO\n");
 737                 return (-1);
 738         }
 739 
 740         if ((fip = Pfd2info(P, prfd.pr_fd)) == NULL) {
 741                 dprintf("Pgrab_core: failed to add NT_FDINFO\n");
 742                 return (-1);
 743         }
 744         (void) memcpy(&fip->fd_info, &prfd, sizeof (prfd));
 745         return (0);
 746 }
 747 
 748 static int
 749 note_platform(struct ps_prochandle *P, size_t nbytes)
 750 {
 751         core_info_t *core = P->data;
 752         char *plat;
 753 
 754         if (core->core_platform != NULL)
 755                 return (0);     /* Already seen */
 756 
 757         if (nbytes != 0 && ((plat = malloc(nbytes + 1)) != NULL)) {
 758                 if (read(P->asfd, plat, nbytes) != nbytes) {
 759                         dprintf("Pgrab_core: failed to read NT_PLATFORM\n");
 760                         free(plat);
 761                         return (-1);
 762                 }
 763                 plat[nbytes - 1] = '\0';
 764                 core->core_platform = plat;
 765         }
 766 
 767         return (0);
 768 }
 769 
 770 static int
 771 note_secflags(struct ps_prochandle *P, size_t nbytes)
 772 {
 773         core_info_t *core = P->data;
 774         prsecflags_t *psf;
 775 
 776         if (core->core_secflags != NULL)
 777                 return (0);     /* Already seen */
 778 
 779         if (sizeof (*psf) != nbytes) {
 780                 dprintf("Pgrab_core: NT_SECFLAGS changed size."
 781                     "  Need to handle a version change?\n");
 782                 return (-1);
 783         }
 784 
 785         if (nbytes != 0 && ((psf = malloc(nbytes)) != NULL)) {
 786                 if (read(P->asfd, psf, nbytes) != nbytes) {
 787                         dprintf("Pgrab_core: failed to read NT_SECFLAGS\n");
 788                         free(psf);
 789                         return (-1);
 790                 }
 791 
 792                 core->core_secflags = psf;
 793         }
 794 
 795         return (0);
 796 }
 797 
 798 static int
 799 note_utsname(struct ps_prochandle *P, size_t nbytes)
 800 {
 801         core_info_t *core = P->data;
 802         size_t ubytes = sizeof (struct utsname);
 803         struct utsname *utsp;
 804 
 805         if (core->core_uts != NULL || nbytes < ubytes)
 806                 return (0);     /* Already seen or bad size */
 807 
 808         if ((utsp = malloc(ubytes)) == NULL)
 809                 return (-1);
 810 
 811         if (read(P->asfd, utsp, ubytes) != ubytes) {
 812                 dprintf("Pgrab_core: failed to read NT_UTSNAME\n");
 813                 free(utsp);
 814                 return (-1);
 815         }
 816 
 817         if (_libproc_debug) {
 818                 dprintf("uts.sysname = \"%s\"\n", utsp->sysname);
 819                 dprintf("uts.nodename = \"%s\"\n", utsp->nodename);
 820                 dprintf("uts.release = \"%s\"\n", utsp->release);
 821                 dprintf("uts.version = \"%s\"\n", utsp->version);
 822                 dprintf("uts.machine = \"%s\"\n", utsp->machine);
 823         }
 824 
 825         core->core_uts = utsp;
 826         return (0);
 827 }
 828 
 829 static int
 830 note_content(struct ps_prochandle *P, size_t nbytes)
 831 {
 832         core_info_t *core = P->data;
 833         core_content_t content;
 834 
 835         if (sizeof (core->core_content) != nbytes)
 836                 return (-1);
 837 
 838         if (read(P->asfd, &content, sizeof (content)) != sizeof (content))
 839                 return (-1);
 840 
 841         core->core_content = content;
 842 
 843         dprintf("core content = %llx\n", content);
 844 
 845         return (0);
 846 }
 847 
 848 static int
 849 note_cred(struct ps_prochandle *P, size_t nbytes)
 850 {
 851         core_info_t *core = P->data;
 852         prcred_t *pcrp;
 853         int ngroups;
 854         const size_t min_size = sizeof (prcred_t) - sizeof (gid_t);
 855 
 856         /*
 857          * We allow for prcred_t notes that are actually smaller than a
 858          * prcred_t since the last member isn't essential if there are
 859          * no group memberships. This allows for more flexibility when it
 860          * comes to slightly malformed -- but still valid -- notes.
 861          */
 862         if (core->core_cred != NULL || nbytes < min_size)
 863                 return (0);     /* Already seen or bad size */
 864 
 865         ngroups = (nbytes - min_size) / sizeof (gid_t);
 866         nbytes = sizeof (prcred_t) + (ngroups - 1) * sizeof (gid_t);
 867 
 868         if ((pcrp = malloc(nbytes)) == NULL)
 869                 return (-1);
 870 
 871         if (read(P->asfd, pcrp, nbytes) != nbytes) {
 872                 dprintf("Pgrab_core: failed to read NT_PRCRED\n");
 873                 free(pcrp);
 874                 return (-1);
 875         }
 876 
 877         if (pcrp->pr_ngroups > ngroups) {
 878                 dprintf("pr_ngroups = %d; resetting to %d based on note size\n",
 879                     pcrp->pr_ngroups, ngroups);
 880                 pcrp->pr_ngroups = ngroups;
 881         }
 882 
 883         core->core_cred = pcrp;
 884         return (0);
 885 }
 886 
 887 #ifdef __x86
 888 static int
 889 note_ldt(struct ps_prochandle *P, size_t nbytes)
 890 {
 891         core_info_t *core = P->data;
 892         struct ssd *pldt;
 893         uint_t nldt;
 894 
 895         if (core->core_ldt != NULL || nbytes < sizeof (struct ssd))
 896                 return (0);     /* Already seen or bad size */
 897 
 898         nldt = nbytes / sizeof (struct ssd);
 899         nbytes = nldt * sizeof (struct ssd);
 900 
 901         if ((pldt = malloc(nbytes)) == NULL)
 902                 return (-1);
 903 
 904         if (read(P->asfd, pldt, nbytes) != nbytes) {
 905                 dprintf("Pgrab_core: failed to read NT_LDT\n");
 906                 free(pldt);
 907                 return (-1);
 908         }
 909 
 910         core->core_ldt = pldt;
 911         core->core_nldt = nldt;
 912         return (0);
 913 }
 914 #endif  /* __i386 */
 915 
 916 static int
 917 note_priv(struct ps_prochandle *P, size_t nbytes)
 918 {
 919         core_info_t *core = P->data;
 920         prpriv_t *pprvp;
 921 
 922         if (core->core_priv != NULL || nbytes < sizeof (prpriv_t))
 923                 return (0);     /* Already seen or bad size */
 924 
 925         if ((pprvp = malloc(nbytes)) == NULL)
 926                 return (-1);
 927 
 928         if (read(P->asfd, pprvp, nbytes) != nbytes) {
 929                 dprintf("Pgrab_core: failed to read NT_PRPRIV\n");
 930                 free(pprvp);
 931                 return (-1);
 932         }
 933 
 934         core->core_priv = pprvp;
 935         core->core_priv_size = nbytes;
 936         return (0);
 937 }
 938 
 939 static int
 940 note_priv_info(struct ps_prochandle *P, size_t nbytes)
 941 {
 942         core_info_t *core = P->data;
 943         extern void *__priv_parse_info();
 944         priv_impl_info_t *ppii;
 945 
 946         if (core->core_privinfo != NULL ||
 947             nbytes < sizeof (priv_impl_info_t))
 948                 return (0);     /* Already seen or bad size */
 949 
 950         if ((ppii = malloc(nbytes)) == NULL)
 951                 return (-1);
 952 
 953         if (read(P->asfd, ppii, nbytes) != nbytes ||
 954             PRIV_IMPL_INFO_SIZE(ppii) != nbytes) {
 955                 dprintf("Pgrab_core: failed to read NT_PRPRIVINFO\n");
 956                 free(ppii);
 957                 return (-1);
 958         }
 959 
 960         core->core_privinfo = __priv_parse_info(ppii);
 961         core->core_ppii = ppii;
 962         return (0);
 963 }
 964 
 965 static int
 966 note_zonename(struct ps_prochandle *P, size_t nbytes)
 967 {
 968         core_info_t *core = P->data;
 969         char *zonename;
 970 
 971         if (core->core_zonename != NULL)
 972                 return (0);     /* Already seen */
 973 
 974         if (nbytes != 0) {
 975                 if ((zonename = malloc(nbytes)) == NULL)
 976                         return (-1);
 977                 if (read(P->asfd, zonename, nbytes) != nbytes) {
 978                         dprintf("Pgrab_core: failed to read NT_ZONENAME\n");
 979                         free(zonename);
 980                         return (-1);
 981                 }
 982                 zonename[nbytes - 1] = '\0';
 983                 core->core_zonename = zonename;
 984         }
 985 
 986         return (0);
 987 }
 988 
 989 static int
 990 note_auxv(struct ps_prochandle *P, size_t nbytes)
 991 {
 992         size_t n, i;
 993 
 994 #ifdef _LP64
 995         core_info_t *core = P->data;
 996 
 997         if (core->core_dmodel == PR_MODEL_ILP32) {
 998                 auxv32_t *a32;
 999 
1000                 n = nbytes / sizeof (auxv32_t);
1001                 nbytes = n * sizeof (auxv32_t);
1002                 a32 = alloca(nbytes);
1003 
1004                 if (read(P->asfd, a32, nbytes) != nbytes) {
1005                         dprintf("Pgrab_core: failed to read NT_AUXV\n");
1006                         return (-1);
1007                 }
1008 
1009                 if ((P->auxv = malloc(sizeof (auxv_t) * (n + 1))) == NULL)
1010                         return (-1);
1011 
1012                 for (i = 0; i < n; i++)
1013                         auxv_32_to_n(&a32[i], &P->auxv[i]);
1014 
1015         } else {
1016 #endif
1017                 n = nbytes / sizeof (auxv_t);
1018                 nbytes = n * sizeof (auxv_t);
1019 
1020                 if ((P->auxv = malloc(nbytes + sizeof (auxv_t))) == NULL)
1021                         return (-1);
1022 
1023                 if (read(P->asfd, P->auxv, nbytes) != nbytes) {
1024                         free(P->auxv);
1025                         P->auxv = NULL;
1026                         return (-1);
1027                 }
1028 #ifdef _LP64
1029         }
1030 #endif
1031 
1032         if (_libproc_debug) {
1033                 for (i = 0; i < n; i++) {
1034                         dprintf("P->auxv[%lu] = ( %d, 0x%lx )\n", (ulong_t)i,
1035                             P->auxv[i].a_type, P->auxv[i].a_un.a_val);
1036                 }
1037         }
1038 
1039         /*
1040          * Defensive coding for loops which depend upon the auxv array being
1041          * terminated by an AT_NULL element; in each case, we've allocated
1042          * P->auxv to have an additional element which we force to be AT_NULL.
1043          */
1044         P->auxv[n].a_type = AT_NULL;
1045         P->auxv[n].a_un.a_val = 0L;
1046         P->nauxv = (int)n;
1047 
1048         return (0);
1049 }
1050 
1051 #ifdef __sparc
1052 static int
1053 note_xreg(struct ps_prochandle *P, size_t nbytes)
1054 {
1055         core_info_t *core = P->data;
1056         lwp_info_t *lwp = core->core_lwp;
1057         size_t xbytes = sizeof (prxregset_t);
1058         prxregset_t *xregs;
1059 
1060         if (lwp == NULL || lwp->lwp_xregs != NULL || nbytes < xbytes)
1061                 return (0);     /* No lwp yet, already seen, or bad size */
1062 
1063         if ((xregs = malloc(xbytes)) == NULL)
1064                 return (-1);
1065 
1066         if (read(P->asfd, xregs, xbytes) != xbytes) {
1067                 dprintf("Pgrab_core: failed to read NT_PRXREG\n");
1068                 free(xregs);
1069                 return (-1);
1070         }
1071 
1072         lwp->lwp_xregs = xregs;
1073         return (0);
1074 }
1075 
1076 static int
1077 note_gwindows(struct ps_prochandle *P, size_t nbytes)
1078 {
1079         core_info_t *core = P->data;
1080         lwp_info_t *lwp = core->core_lwp;
1081 
1082         if (lwp == NULL || lwp->lwp_gwins != NULL || nbytes == 0)
1083                 return (0);     /* No lwp yet or already seen or no data */
1084 
1085         if ((lwp->lwp_gwins = malloc(sizeof (gwindows_t))) == NULL)
1086                 return (-1);
1087 
1088         /*
1089          * Since the amount of gwindows data varies with how many windows were
1090          * actually saved, we just read up to the minimum of the note size
1091          * and the size of the gwindows_t type.  It doesn't matter if the read
1092          * fails since we have to zero out gwindows first anyway.
1093          */
1094 #ifdef _LP64
1095         if (core->core_dmodel == PR_MODEL_ILP32) {
1096                 gwindows32_t g32;
1097 
1098                 (void) memset(&g32, 0, sizeof (g32));
1099                 (void) read(P->asfd, &g32, MIN(nbytes, sizeof (g32)));
1100                 gwindows_32_to_n(&g32, lwp->lwp_gwins);
1101 
1102         } else {
1103 #endif
1104                 (void) memset(lwp->lwp_gwins, 0, sizeof (gwindows_t));
1105                 (void) read(P->asfd, lwp->lwp_gwins,
1106                     MIN(nbytes, sizeof (gwindows_t)));
1107 #ifdef _LP64
1108         }
1109 #endif
1110         return (0);
1111 }
1112 
1113 #ifdef __sparcv9
1114 static int
1115 note_asrs(struct ps_prochandle *P, size_t nbytes)
1116 {
1117         core_info_t *core = P->data;
1118         lwp_info_t *lwp = core->core_lwp;
1119         int64_t *asrs;
1120 
1121         if (lwp == NULL || lwp->lwp_asrs != NULL || nbytes < sizeof (asrset_t))
1122                 return (0);     /* No lwp yet, already seen, or bad size */
1123 
1124         if ((asrs = malloc(sizeof (asrset_t))) == NULL)
1125                 return (-1);
1126 
1127         if (read(P->asfd, asrs, sizeof (asrset_t)) != sizeof (asrset_t)) {
1128                 dprintf("Pgrab_core: failed to read NT_ASRS\n");
1129                 free(asrs);
1130                 return (-1);
1131         }
1132 
1133         lwp->lwp_asrs = asrs;
1134         return (0);
1135 }
1136 #endif  /* __sparcv9 */
1137 #endif  /* __sparc */
1138 
1139 static int
1140 note_spymaster(struct ps_prochandle *P, size_t nbytes)
1141 {
1142 #ifdef _LP64
1143         core_info_t *core = P->data;
1144 
1145         if (core->core_dmodel == PR_MODEL_ILP32) {
1146                 psinfo32_t ps32;
1147 
1148                 if (nbytes < sizeof (psinfo32_t) ||
1149                     read(P->asfd, &ps32, sizeof (ps32)) != sizeof (ps32))
1150                         goto err;
1151 
1152                 psinfo_32_to_n(&ps32, &P->spymaster);
1153         } else
1154 #endif
1155         if (nbytes < sizeof (psinfo_t) || read(P->asfd,
1156             &P->spymaster, sizeof (psinfo_t)) != sizeof (psinfo_t))
1157                 goto err;
1158 
1159         dprintf("spymaster pr_fname = <%s>\n", P->psinfo.pr_fname);
1160         dprintf("spymaster pr_psargs = <%s>\n", P->psinfo.pr_psargs);
1161         dprintf("spymaster pr_wstat = 0x%x\n", P->psinfo.pr_wstat);
1162 
1163         return (0);
1164 
1165 err:
1166         dprintf("Pgrab_core: failed to read NT_SPYMASTER\n");
1167         return (-1);
1168 }
1169 
1170 /*ARGSUSED*/
1171 static int
1172 note_notsup(struct ps_prochandle *P, size_t nbytes)
1173 {
1174         dprintf("skipping unsupported note type of size %ld bytes\n",
1175             (ulong_t)nbytes);
1176         return (0);
1177 }
1178 
1179 /*
1180  * Populate a table of function pointers indexed by Note type with our
1181  * functions to process each type of core file note:
1182  */
1183 static int (*nhdlrs[])(struct ps_prochandle *, size_t) = {
1184         note_notsup,            /*  0   unassigned              */
1185 #ifdef __x86
1186         note_linux_prstatus,            /*  1   NT_PRSTATUS (old)       */
1187 #else
1188         note_notsup,            /*  1   NT_PRSTATUS (old)       */
1189 #endif
1190         note_notsup,            /*  2   NT_PRFPREG (old)        */
1191 #ifdef __x86
1192         note_linux_psinfo,              /*  3   NT_PRPSINFO (old)       */
1193 #else
1194         note_notsup,            /*  3   NT_PRPSINFO (old)       */
1195 #endif
1196 #ifdef __sparc
1197         note_xreg,              /*  4   NT_PRXREG               */
1198 #else
1199         note_notsup,            /*  4   NT_PRXREG               */
1200 #endif
1201         note_platform,          /*  5   NT_PLATFORM             */
1202         note_auxv,              /*  6   NT_AUXV                 */
1203 #ifdef __sparc
1204         note_gwindows,          /*  7   NT_GWINDOWS             */
1205 #ifdef __sparcv9
1206         note_asrs,              /*  8   NT_ASRS                 */
1207 #else
1208         note_notsup,            /*  8   NT_ASRS                 */
1209 #endif
1210 #else
1211         note_notsup,            /*  7   NT_GWINDOWS             */
1212         note_notsup,            /*  8   NT_ASRS                 */
1213 #endif
1214 #ifdef __x86
1215         note_ldt,               /*  9   NT_LDT                  */
1216 #else
1217         note_notsup,            /*  9   NT_LDT                  */
1218 #endif
1219         note_pstatus,           /* 10   NT_PSTATUS              */
1220         note_notsup,            /* 11   unassigned              */
1221         note_notsup,            /* 12   unassigned              */
1222         note_psinfo,            /* 13   NT_PSINFO               */
1223         note_cred,              /* 14   NT_PRCRED               */
1224         note_utsname,           /* 15   NT_UTSNAME              */
1225         note_lwpstatus,         /* 16   NT_LWPSTATUS            */
1226         note_lwpsinfo,          /* 17   NT_LWPSINFO             */
1227         note_priv,              /* 18   NT_PRPRIV               */
1228         note_priv_info,         /* 19   NT_PRPRIVINFO           */
1229         note_content,           /* 20   NT_CONTENT              */
1230         note_zonename,          /* 21   NT_ZONENAME             */
1231         note_fdinfo,            /* 22   NT_FDINFO               */
1232         note_spymaster,         /* 23   NT_SPYMASTER            */
1233         note_secflags,          /* 24   NT_SECFLAGS             */
1234 };
1235 
1236 static void
1237 core_report_mapping(struct ps_prochandle *P, GElf_Phdr *php)
1238 {
1239         prkillinfo_t killinfo;
1240         siginfo_t *si = &killinfo.prk_info;
1241         char signame[SIG2STR_MAX], sig[64], info[64];
1242         void *addr = (void *)(uintptr_t)php->p_vaddr;
1243 
1244         const char *errfmt = "core file data for mapping at %p not saved: %s\n";
1245         const char *incfmt = "core file incomplete due to %s%s\n";
1246         const char *msgfmt = "mappings at and above %p are missing\n";
1247 
1248         if (!(php->p_flags & PF_SUNW_KILLED)) {
1249                 int err = 0;
1250 
1251                 (void) pread64(P->asfd, &err,
1252                     sizeof (err), (off64_t)php->p_offset);
1253 
1254                 Perror_printf(P, errfmt, addr, strerror(err));
1255                 dprintf(errfmt, addr, strerror(err));
1256                 return;
1257         }
1258 
1259         if (!(php->p_flags & PF_SUNW_SIGINFO))
1260                 return;
1261 
1262         (void) memset(&killinfo, 0, sizeof (killinfo));
1263 
1264         (void) pread64(P->asfd, &killinfo,
1265             sizeof (killinfo), (off64_t)php->p_offset);
1266 
1267         /*
1268          * While there is (or at least should be) only one segment that has
1269          * PF_SUNW_SIGINFO set, the signal information there is globally
1270          * useful (even if only to those debugging libproc consumers); we hang
1271          * the signal information gleaned here off of the ps_prochandle.
1272          */
1273         P->map_missing = php->p_vaddr;
1274         P->killinfo = killinfo.prk_info;
1275 
1276         if (sig2str(si->si_signo, signame) == -1) {
1277                 (void) snprintf(sig, sizeof (sig),
1278                     "<Unknown signal: 0x%x>, ", si->si_signo);
1279         } else {
1280                 (void) snprintf(sig, sizeof (sig), "SIG%s, ", signame);
1281         }
1282 
1283         if (si->si_code == SI_USER || si->si_code == SI_QUEUE) {
1284                 (void) snprintf(info, sizeof (info),
1285                     "pid=%d uid=%d zone=%d ctid=%d",
1286                     si->si_pid, si->si_uid, si->si_zoneid, si->si_ctid);
1287         } else {
1288                 (void) snprintf(info, sizeof (info),
1289                     "code=%d", si->si_code);
1290         }
1291 
1292         Perror_printf(P, incfmt, sig, info);
1293         Perror_printf(P, msgfmt, addr);
1294 
1295         dprintf(incfmt, sig, info);
1296         dprintf(msgfmt, addr);
1297 }
1298 
1299 /*
1300  * Add information on the address space mapping described by the given
1301  * PT_LOAD program header.  We fill in more information on the mapping later.
1302  */
1303 static int
1304 core_add_mapping(struct ps_prochandle *P, GElf_Phdr *php)
1305 {
1306         core_info_t *core = P->data;
1307         prmap_t pmap;
1308 
1309         dprintf("mapping base %llx filesz %llx memsz %llx offset %llx\n",
1310             (u_longlong_t)php->p_vaddr, (u_longlong_t)php->p_filesz,
1311             (u_longlong_t)php->p_memsz, (u_longlong_t)php->p_offset);
1312 
1313         pmap.pr_vaddr = (uintptr_t)php->p_vaddr;
1314         pmap.pr_size = php->p_memsz;
1315 
1316         /*
1317          * If Pgcore() or elfcore() fail to write a mapping, they will set
1318          * PF_SUNW_FAILURE in the Phdr and try to stash away the errno for us.
1319          */
1320         if (php->p_flags & PF_SUNW_FAILURE) {
1321                 core_report_mapping(P, php);
1322         } else if (php->p_filesz != 0 && php->p_offset >= core->core_size) {
1323                 Perror_printf(P, "core file may be corrupt -- data for mapping "
1324                     "at %p is missing\n", (void *)(uintptr_t)php->p_vaddr);
1325                 dprintf("core file may be corrupt -- data for mapping "
1326                     "at %p is missing\n", (void *)(uintptr_t)php->p_vaddr);
1327         }
1328 
1329         /*
1330          * The mapping name and offset will hopefully be filled in
1331          * by the librtld_db agent.  Unfortunately, if it isn't a
1332          * shared library mapping, this information is gone forever.
1333          */
1334         pmap.pr_mapname[0] = '\0';
1335         pmap.pr_offset = 0;
1336 
1337         pmap.pr_mflags = 0;
1338         if (php->p_flags & PF_R)
1339                 pmap.pr_mflags |= MA_READ;
1340         if (php->p_flags & PF_W)
1341                 pmap.pr_mflags |= MA_WRITE;
1342         if (php->p_flags & PF_X)
1343                 pmap.pr_mflags |= MA_EXEC;
1344 
1345         if (php->p_filesz == 0)
1346                 pmap.pr_mflags |= MA_RESERVED1;
1347 
1348         /*
1349          * At the time of adding this mapping, we just zero the pagesize.
1350          * Once we've processed more of the core file, we'll have the
1351          * pagesize from the auxv's AT_PAGESZ element and we can fill this in.
1352          */
1353         pmap.pr_pagesize = 0;
1354 
1355         /*
1356          * Unfortunately whether or not the mapping was a System V
1357          * shared memory segment is lost.  We use -1 to mark it as not shm.
1358          */
1359         pmap.pr_shmid = -1;
1360 
1361         return (Padd_mapping(P, php->p_offset, NULL, &pmap));
1362 }
1363 
1364 /*
1365  * Given a virtual address, name the mapping at that address using the
1366  * specified name, and return the map_info_t pointer.
1367  */
1368 static map_info_t *
1369 core_name_mapping(struct ps_prochandle *P, uintptr_t addr, const char *name)
1370 {
1371         map_info_t *mp = Paddr2mptr(P, addr);
1372 
1373         if (mp != NULL) {
1374                 (void) strncpy(mp->map_pmap.pr_mapname, name, PRMAPSZ);
1375                 mp->map_pmap.pr_mapname[PRMAPSZ - 1] = '\0';
1376         }
1377 
1378         return (mp);
1379 }
1380 
1381 /*
1382  * libproc uses libelf for all of its symbol table manipulation. This function
1383  * takes a symbol table and string table from a core file and places them
1384  * in a memory backed elf file.
1385  */
1386 static void
1387 fake_up_symtab(struct ps_prochandle *P, const elf_file_header_t *ehdr,
1388     GElf_Shdr *symtab, GElf_Shdr *strtab)
1389 {
1390         size_t size;
1391         off64_t off, base;
1392         map_info_t *mp;
1393         file_info_t *fp;
1394         Elf_Scn *scn;
1395         Elf_Data *data;
1396 
1397         if (symtab->sh_addr == 0 ||
1398             (mp = Paddr2mptr(P, symtab->sh_addr)) == NULL ||
1399             (fp = mp->map_file) == NULL) {
1400                 dprintf("fake_up_symtab: invalid section\n");
1401                 return;
1402         }
1403 
1404         if (fp->file_symtab.sym_data_pri != NULL) {
1405                 dprintf("Symbol table already loaded (sh_addr 0x%lx)\n",
1406                     (long)symtab->sh_addr);
1407                 return;
1408         }
1409 
1410         if (P->status.pr_dmodel == PR_MODEL_ILP32) {
1411                 struct {
1412                         Elf32_Ehdr ehdr;
1413                         Elf32_Shdr shdr[3];
1414                         char data[1];
1415                 } *b;
1416 
1417                 base = sizeof (b->ehdr) + sizeof (b->shdr);
1418                 size = base + symtab->sh_size + strtab->sh_size;
1419 
1420                 if ((b = calloc(1, size)) == NULL)
1421                         return;
1422 
1423                 (void) memcpy(b->ehdr.e_ident, ehdr->e_ident,
1424                     sizeof (ehdr->e_ident));
1425                 b->ehdr.e_type = ehdr->e_type;
1426                 b->ehdr.e_machine = ehdr->e_machine;
1427                 b->ehdr.e_version = ehdr->e_version;
1428                 b->ehdr.e_flags = ehdr->e_flags;
1429                 b->ehdr.e_ehsize = sizeof (b->ehdr);
1430                 b->ehdr.e_shoff = sizeof (b->ehdr);
1431                 b->ehdr.e_shentsize = sizeof (b->shdr[0]);
1432                 b->ehdr.e_shnum = 3;
1433                 off = 0;
1434 
1435                 b->shdr[1].sh_size = symtab->sh_size;
1436                 b->shdr[1].sh_type = SHT_SYMTAB;
1437                 b->shdr[1].sh_offset = off + base;
1438                 b->shdr[1].sh_entsize = sizeof (Elf32_Sym);
1439                 b->shdr[1].sh_link = 2;
1440                 b->shdr[1].sh_info =  symtab->sh_info;
1441                 b->shdr[1].sh_addralign = symtab->sh_addralign;
1442 
1443                 if (pread64(P->asfd, &b->data[off], b->shdr[1].sh_size,
1444                     symtab->sh_offset) != b->shdr[1].sh_size) {
1445                         dprintf("fake_up_symtab: pread of symtab[1] failed\n");
1446                         free(b);
1447                         return;
1448                 }
1449 
1450                 off += b->shdr[1].sh_size;
1451 
1452                 b->shdr[2].sh_flags = SHF_STRINGS;
1453                 b->shdr[2].sh_size = strtab->sh_size;
1454                 b->shdr[2].sh_type = SHT_STRTAB;
1455                 b->shdr[2].sh_offset = off + base;
1456                 b->shdr[2].sh_info =  strtab->sh_info;
1457                 b->shdr[2].sh_addralign = 1;
1458 
1459                 if (pread64(P->asfd, &b->data[off], b->shdr[2].sh_size,
1460                     strtab->sh_offset) != b->shdr[2].sh_size) {
1461                         dprintf("fake_up_symtab: pread of symtab[2] failed\n");
1462                         free(b);
1463                         return;
1464                 }
1465 
1466                 off += b->shdr[2].sh_size;
1467 
1468                 fp->file_symtab.sym_elf = elf_memory((char *)b, size);
1469                 if (fp->file_symtab.sym_elf == NULL) {
1470                         free(b);
1471                         return;
1472                 }
1473 
1474                 fp->file_symtab.sym_elfmem = b;
1475 #ifdef _LP64
1476         } else {
1477                 struct {
1478                         Elf64_Ehdr ehdr;
1479                         Elf64_Shdr shdr[3];
1480                         char data[1];
1481                 } *b;
1482 
1483                 base = sizeof (b->ehdr) + sizeof (b->shdr);
1484                 size = base + symtab->sh_size + strtab->sh_size;
1485 
1486                 if ((b = calloc(1, size)) == NULL)
1487                         return;
1488 
1489                 (void) memcpy(b->ehdr.e_ident, ehdr->e_ident,
1490                     sizeof (ehdr->e_ident));
1491                 b->ehdr.e_type = ehdr->e_type;
1492                 b->ehdr.e_machine = ehdr->e_machine;
1493                 b->ehdr.e_version = ehdr->e_version;
1494                 b->ehdr.e_flags = ehdr->e_flags;
1495                 b->ehdr.e_ehsize = sizeof (b->ehdr);
1496                 b->ehdr.e_shoff = sizeof (b->ehdr);
1497                 b->ehdr.e_shentsize = sizeof (b->shdr[0]);
1498                 b->ehdr.e_shnum = 3;
1499                 off = 0;
1500 
1501                 b->shdr[1].sh_size = symtab->sh_size;
1502                 b->shdr[1].sh_type = SHT_SYMTAB;
1503                 b->shdr[1].sh_offset = off + base;
1504                 b->shdr[1].sh_entsize = sizeof (Elf64_Sym);
1505                 b->shdr[1].sh_link = 2;
1506                 b->shdr[1].sh_info =  symtab->sh_info;
1507                 b->shdr[1].sh_addralign = symtab->sh_addralign;
1508 
1509                 if (pread64(P->asfd, &b->data[off], b->shdr[1].sh_size,
1510                     symtab->sh_offset) != b->shdr[1].sh_size) {
1511                         free(b);
1512                         return;
1513                 }
1514 
1515                 off += b->shdr[1].sh_size;
1516 
1517                 b->shdr[2].sh_flags = SHF_STRINGS;
1518                 b->shdr[2].sh_size = strtab->sh_size;
1519                 b->shdr[2].sh_type = SHT_STRTAB;
1520                 b->shdr[2].sh_offset = off + base;
1521                 b->shdr[2].sh_info =  strtab->sh_info;
1522                 b->shdr[2].sh_addralign = 1;
1523 
1524                 if (pread64(P->asfd, &b->data[off], b->shdr[2].sh_size,
1525                     strtab->sh_offset) != b->shdr[2].sh_size) {
1526                         free(b);
1527                         return;
1528                 }
1529 
1530                 off += b->shdr[2].sh_size;
1531 
1532                 fp->file_symtab.sym_elf = elf_memory((char *)b, size);
1533                 if (fp->file_symtab.sym_elf == NULL) {
1534                         free(b);
1535                         return;
1536                 }
1537 
1538                 fp->file_symtab.sym_elfmem = b;
1539 #endif
1540         }
1541 
1542         if ((scn = elf_getscn(fp->file_symtab.sym_elf, 1)) == NULL ||
1543             (fp->file_symtab.sym_data_pri = elf_getdata(scn, NULL)) == NULL ||
1544             (scn = elf_getscn(fp->file_symtab.sym_elf, 2)) == NULL ||
1545             (data = elf_getdata(scn, NULL)) == NULL) {
1546                 dprintf("fake_up_symtab: failed to get section data at %p\n",
1547                     (void *)scn);
1548                 goto err;
1549         }
1550 
1551         fp->file_symtab.sym_strs = data->d_buf;
1552         fp->file_symtab.sym_strsz = data->d_size;
1553         fp->file_symtab.sym_symn = symtab->sh_size / symtab->sh_entsize;
1554         fp->file_symtab.sym_hdr_pri = *symtab;
1555         fp->file_symtab.sym_strhdr = *strtab;
1556 
1557         optimize_symtab(&fp->file_symtab);
1558 
1559         return;
1560 err:
1561         (void) elf_end(fp->file_symtab.sym_elf);
1562         free(fp->file_symtab.sym_elfmem);
1563         fp->file_symtab.sym_elf = NULL;
1564         fp->file_symtab.sym_elfmem = NULL;
1565 }
1566 
1567 static void
1568 core_phdr_to_gelf(const Elf32_Phdr *src, GElf_Phdr *dst)
1569 {
1570         dst->p_type = src->p_type;
1571         dst->p_flags = src->p_flags;
1572         dst->p_offset = (Elf64_Off)src->p_offset;
1573         dst->p_vaddr = (Elf64_Addr)src->p_vaddr;
1574         dst->p_paddr = (Elf64_Addr)src->p_paddr;
1575         dst->p_filesz = (Elf64_Xword)src->p_filesz;
1576         dst->p_memsz = (Elf64_Xword)src->p_memsz;
1577         dst->p_align = (Elf64_Xword)src->p_align;
1578 }
1579 
1580 static void
1581 core_shdr_to_gelf(const Elf32_Shdr *src, GElf_Shdr *dst)
1582 {
1583         dst->sh_name = src->sh_name;
1584         dst->sh_type = src->sh_type;
1585         dst->sh_flags = (Elf64_Xword)src->sh_flags;
1586         dst->sh_addr = (Elf64_Addr)src->sh_addr;
1587         dst->sh_offset = (Elf64_Off)src->sh_offset;
1588         dst->sh_size = (Elf64_Xword)src->sh_size;
1589         dst->sh_link = src->sh_link;
1590         dst->sh_info = src->sh_info;
1591         dst->sh_addralign = (Elf64_Xword)src->sh_addralign;
1592         dst->sh_entsize = (Elf64_Xword)src->sh_entsize;
1593 }
1594 
1595 /*
1596  * Perform elf_begin on efp->e_fd and verify the ELF file's type and class.
1597  */
1598 static int
1599 core_elf_fdopen(elf_file_t *efp, GElf_Half type, int *perr)
1600 {
1601 #ifdef _BIG_ENDIAN
1602         uchar_t order = ELFDATA2MSB;
1603 #else
1604         uchar_t order = ELFDATA2LSB;
1605 #endif
1606         Elf32_Ehdr e32;
1607         int is_noelf = -1;
1608         int isa_err = 0;
1609 
1610         /*
1611          * Because 32-bit libelf cannot deal with large files, we need to read,
1612          * check, and convert the file header manually in case type == ET_CORE.
1613          */
1614         if (pread64(efp->e_fd, &e32, sizeof (e32), 0) != sizeof (e32)) {
1615                 if (perr != NULL)
1616                         *perr = G_FORMAT;
1617                 goto err;
1618         }
1619         if ((is_noelf = memcmp(&e32.e_ident[EI_MAG0], ELFMAG, SELFMAG)) != 0 ||
1620             e32.e_type != type || (isa_err = (e32.e_ident[EI_DATA] != order)) ||
1621             e32.e_version != EV_CURRENT) {
1622                 if (perr != NULL) {
1623                         if (is_noelf == 0 && isa_err) {
1624                                 *perr = G_ISAINVAL;
1625                         } else {
1626                                 *perr = G_FORMAT;
1627                         }
1628                 }
1629                 goto err;
1630         }
1631 
1632         /*
1633          * If the file is 64-bit and we are 32-bit, fail with G_LP64.  If the
1634          * file is 64-bit and we are 64-bit, re-read the header as a Elf64_Ehdr,
1635          * and convert it to a elf_file_header_t.  Otherwise, the file is
1636          * 32-bit, so convert e32 to a elf_file_header_t.
1637          */
1638         if (e32.e_ident[EI_CLASS] == ELFCLASS64) {
1639 #ifdef _LP64
1640                 Elf64_Ehdr e64;
1641 
1642                 if (pread64(efp->e_fd, &e64, sizeof (e64), 0) != sizeof (e64)) {
1643                         if (perr != NULL)
1644                                 *perr = G_FORMAT;
1645                         goto err;
1646                 }
1647 
1648                 (void) memcpy(efp->e_hdr.e_ident, e64.e_ident, EI_NIDENT);
1649                 efp->e_hdr.e_type = e64.e_type;
1650                 efp->e_hdr.e_machine = e64.e_machine;
1651                 efp->e_hdr.e_version = e64.e_version;
1652                 efp->e_hdr.e_entry = e64.e_entry;
1653                 efp->e_hdr.e_phoff = e64.e_phoff;
1654                 efp->e_hdr.e_shoff = e64.e_shoff;
1655                 efp->e_hdr.e_flags = e64.e_flags;
1656                 efp->e_hdr.e_ehsize = e64.e_ehsize;
1657                 efp->e_hdr.e_phentsize = e64.e_phentsize;
1658                 efp->e_hdr.e_phnum = (Elf64_Word)e64.e_phnum;
1659                 efp->e_hdr.e_shentsize = e64.e_shentsize;
1660                 efp->e_hdr.e_shnum = (Elf64_Word)e64.e_shnum;
1661                 efp->e_hdr.e_shstrndx = (Elf64_Word)e64.e_shstrndx;
1662 #else   /* _LP64 */
1663                 if (perr != NULL)
1664                         *perr = G_LP64;
1665                 goto err;
1666 #endif  /* _LP64 */
1667         } else {
1668                 (void) memcpy(efp->e_hdr.e_ident, e32.e_ident, EI_NIDENT);
1669                 efp->e_hdr.e_type = e32.e_type;
1670                 efp->e_hdr.e_machine = e32.e_machine;
1671                 efp->e_hdr.e_version = e32.e_version;
1672                 efp->e_hdr.e_entry = (Elf64_Addr)e32.e_entry;
1673                 efp->e_hdr.e_phoff = (Elf64_Off)e32.e_phoff;
1674                 efp->e_hdr.e_shoff = (Elf64_Off)e32.e_shoff;
1675                 efp->e_hdr.e_flags = e32.e_flags;
1676                 efp->e_hdr.e_ehsize = e32.e_ehsize;
1677                 efp->e_hdr.e_phentsize = e32.e_phentsize;
1678                 efp->e_hdr.e_phnum = (Elf64_Word)e32.e_phnum;
1679                 efp->e_hdr.e_shentsize = e32.e_shentsize;
1680                 efp->e_hdr.e_shnum = (Elf64_Word)e32.e_shnum;
1681                 efp->e_hdr.e_shstrndx = (Elf64_Word)e32.e_shstrndx;
1682         }
1683 
1684         /*
1685          * If the number of section headers or program headers or the section
1686          * header string table index would overflow their respective fields
1687          * in the ELF header, they're stored in the section header at index
1688          * zero. To simplify use elsewhere, we look for those sentinel values
1689          * here.
1690          */
1691         if ((efp->e_hdr.e_shnum == 0 && efp->e_hdr.e_shoff != 0) ||
1692             efp->e_hdr.e_shstrndx == SHN_XINDEX ||
1693             efp->e_hdr.e_phnum == PN_XNUM) {
1694                 GElf_Shdr shdr;
1695 
1696                 dprintf("extended ELF header\n");
1697 
1698                 if (efp->e_hdr.e_shoff == 0) {
1699                         if (perr != NULL)
1700                                 *perr = G_FORMAT;
1701                         goto err;
1702                 }
1703 
1704                 if (efp->e_hdr.e_ident[EI_CLASS] == ELFCLASS32) {
1705                         Elf32_Shdr shdr32;
1706 
1707                         if (pread64(efp->e_fd, &shdr32, sizeof (shdr32),
1708                             efp->e_hdr.e_shoff) != sizeof (shdr32)) {
1709                                 if (perr != NULL)
1710                                         *perr = G_FORMAT;
1711                                 goto err;
1712                         }
1713 
1714                         core_shdr_to_gelf(&shdr32, &shdr);
1715                 } else {
1716                         if (pread64(efp->e_fd, &shdr, sizeof (shdr),
1717                             efp->e_hdr.e_shoff) != sizeof (shdr)) {
1718                                 if (perr != NULL)
1719                                         *perr = G_FORMAT;
1720                                 goto err;
1721                         }
1722                 }
1723 
1724                 if (efp->e_hdr.e_shnum == 0) {
1725                         efp->e_hdr.e_shnum = shdr.sh_size;
1726                         dprintf("section header count %lu\n",
1727                             (ulong_t)shdr.sh_size);
1728                 }
1729 
1730                 if (efp->e_hdr.e_shstrndx == SHN_XINDEX) {
1731                         efp->e_hdr.e_shstrndx = shdr.sh_link;
1732                         dprintf("section string index %u\n", shdr.sh_link);
1733                 }
1734 
1735                 if (efp->e_hdr.e_phnum == PN_XNUM && shdr.sh_info != 0) {
1736                         efp->e_hdr.e_phnum = shdr.sh_info;
1737                         dprintf("program header count %u\n", shdr.sh_info);
1738                 }
1739 
1740         } else if (efp->e_hdr.e_phoff != 0) {
1741                 GElf_Phdr phdr;
1742                 uint64_t phnum;
1743 
1744                 /*
1745                  * It's possible this core file came from a system that
1746                  * accidentally truncated the e_phnum field without correctly
1747                  * using the extended format in the section header at index
1748                  * zero. We try to detect and correct that specific type of
1749                  * corruption by using the knowledge that the core dump
1750                  * routines usually place the data referenced by the first
1751                  * program header immediately after the last header element.
1752                  */
1753                 if (efp->e_hdr.e_ident[EI_CLASS] == ELFCLASS32) {
1754                         Elf32_Phdr phdr32;
1755 
1756                         if (pread64(efp->e_fd, &phdr32, sizeof (phdr32),
1757                             efp->e_hdr.e_phoff) != sizeof (phdr32)) {
1758                                 if (perr != NULL)
1759                                         *perr = G_FORMAT;
1760                                 goto err;
1761                         }
1762 
1763                         core_phdr_to_gelf(&phdr32, &phdr);
1764                 } else {
1765                         if (pread64(efp->e_fd, &phdr, sizeof (phdr),
1766                             efp->e_hdr.e_phoff) != sizeof (phdr)) {
1767                                 if (perr != NULL)
1768                                         *perr = G_FORMAT;
1769                                 goto err;
1770                         }
1771                 }
1772 
1773                 phnum = phdr.p_offset - efp->e_hdr.e_ehsize -
1774                     (uint64_t)efp->e_hdr.e_shnum * efp->e_hdr.e_shentsize;
1775                 phnum /= efp->e_hdr.e_phentsize;
1776 
1777                 if (phdr.p_offset != 0 && phnum != efp->e_hdr.e_phnum) {
1778                         dprintf("suspicious program header count %u %u\n",
1779                             (uint_t)phnum, efp->e_hdr.e_phnum);
1780 
1781                         /*
1782                          * If the new program header count we computed doesn't
1783                          * jive with count in the ELF header, we'll use the
1784                          * data that's there and hope for the best.
1785                          *
1786                          * If it does, it's also possible that the section
1787                          * header offset is incorrect; we'll check that and
1788                          * possibly try to fix it.
1789                          */
1790                         if (phnum <= INT_MAX &&
1791                             (uint16_t)phnum == efp->e_hdr.e_phnum) {
1792 
1793                                 if (efp->e_hdr.e_shoff == efp->e_hdr.e_phoff +
1794                                     efp->e_hdr.e_phentsize *
1795                                     (uint_t)efp->e_hdr.e_phnum) {
1796                                         efp->e_hdr.e_shoff =
1797                                             efp->e_hdr.e_phoff +
1798                                             efp->e_hdr.e_phentsize * phnum;
1799                                 }
1800 
1801                                 efp->e_hdr.e_phnum = (Elf64_Word)phnum;
1802                                 dprintf("using new program header count\n");
1803                         } else {
1804                                 dprintf("inconsistent program header count\n");
1805                         }
1806                 }
1807         }
1808 
1809         /*
1810          * The libelf implementation was never ported to be large-file aware.
1811          * This is typically not a problem for your average executable or
1812          * shared library, but a large 32-bit core file can exceed 2GB in size.
1813          * So if type is ET_CORE, we don't bother doing elf_begin; the code
1814          * in Pfgrab_core() below will do its own i/o and struct conversion.
1815          */
1816 
1817         if (type == ET_CORE) {
1818                 efp->e_elf = NULL;
1819                 return (0);
1820         }
1821 
1822         if ((efp->e_elf = elf_begin(efp->e_fd, ELF_C_READ, NULL)) == NULL) {
1823                 if (perr != NULL)
1824                         *perr = G_ELF;
1825                 goto err;
1826         }
1827 
1828         return (0);
1829 
1830 err:
1831         efp->e_elf = NULL;
1832         return (-1);
1833 }
1834 
1835 /*
1836  * Open the specified file and then do a core_elf_fdopen on it.
1837  */
1838 static int
1839 core_elf_open(elf_file_t *efp, const char *path, GElf_Half type, int *perr)
1840 {
1841         (void) memset(efp, 0, sizeof (elf_file_t));
1842 
1843         if ((efp->e_fd = open64(path, O_RDONLY)) >= 0) {
1844                 if (core_elf_fdopen(efp, type, perr) == 0)
1845                         return (0);
1846 
1847                 (void) close(efp->e_fd);
1848                 efp->e_fd = -1;
1849         }
1850 
1851         return (-1);
1852 }
1853 
1854 /*
1855  * Close the ELF handle and file descriptor.
1856  */
1857 static void
1858 core_elf_close(elf_file_t *efp)
1859 {
1860         if (efp->e_elf != NULL) {
1861                 (void) elf_end(efp->e_elf);
1862                 efp->e_elf = NULL;
1863         }
1864 
1865         if (efp->e_fd != -1) {
1866                 (void) close(efp->e_fd);
1867                 efp->e_fd = -1;
1868         }
1869 }
1870 
1871 /*
1872  * Given an ELF file for a statically linked executable, locate the likely
1873  * primary text section and fill in rl_base with its virtual address.
1874  */
1875 static map_info_t *
1876 core_find_text(struct ps_prochandle *P, Elf *elf, rd_loadobj_t *rlp)
1877 {
1878         GElf_Phdr phdr;
1879         uint_t i;
1880         size_t nphdrs;
1881 
1882         if (elf_getphdrnum(elf, &nphdrs) == -1)
1883                 return (NULL);
1884 
1885         for (i = 0; i < nphdrs; i++) {
1886                 if (gelf_getphdr(elf, i, &phdr) != NULL &&
1887                     phdr.p_type == PT_LOAD && (phdr.p_flags & PF_X)) {
1888                         rlp->rl_base = phdr.p_vaddr;
1889                         return (Paddr2mptr(P, rlp->rl_base));
1890                 }
1891         }
1892 
1893         return (NULL);
1894 }
1895 
1896 /*
1897  * Given an ELF file and the librtld_db structure corresponding to its primary
1898  * text mapping, deduce where its data segment was loaded and fill in
1899  * rl_data_base and prmap_t.pr_offset accordingly.
1900  */
1901 static map_info_t *
1902 core_find_data(struct ps_prochandle *P, Elf *elf, rd_loadobj_t *rlp)
1903 {
1904         GElf_Ehdr ehdr;
1905         GElf_Phdr phdr;
1906         map_info_t *mp;
1907         uint_t i, pagemask;
1908         size_t nphdrs;
1909 
1910         rlp->rl_data_base = NULL;
1911 
1912         /*
1913          * Find the first loadable, writeable Phdr and compute rl_data_base
1914          * as the virtual address at which is was loaded.
1915          */
1916         if (gelf_getehdr(elf, &ehdr) == NULL ||
1917             elf_getphdrnum(elf, &nphdrs) == -1)
1918                 return (NULL);
1919 
1920         for (i = 0; i < nphdrs; i++) {
1921                 if (gelf_getphdr(elf, i, &phdr) != NULL &&
1922                     phdr.p_type == PT_LOAD && (phdr.p_flags & PF_W)) {
1923                         rlp->rl_data_base = phdr.p_vaddr;
1924                         if (ehdr.e_type == ET_DYN)
1925                                 rlp->rl_data_base += rlp->rl_base;
1926                         break;
1927                 }
1928         }
1929 
1930         /*
1931          * If we didn't find an appropriate phdr or if the address we
1932          * computed has no mapping, return NULL.
1933          */
1934         if (rlp->rl_data_base == NULL ||
1935             (mp = Paddr2mptr(P, rlp->rl_data_base)) == NULL)
1936                 return (NULL);
1937 
1938         /*
1939          * It wouldn't be procfs-related code if we didn't make use of
1940          * unclean knowledge of segvn, even in userland ... the prmap_t's
1941          * pr_offset field will be the segvn offset from mmap(2)ing the
1942          * data section, which will be the file offset & PAGEMASK.
1943          */
1944         pagemask = ~(mp->map_pmap.pr_pagesize - 1);
1945         mp->map_pmap.pr_offset = phdr.p_offset & pagemask;
1946 
1947         return (mp);
1948 }
1949 
1950 /*
1951  * Librtld_db agent callback for iterating over load object mappings.
1952  * For each load object, we allocate a new file_info_t, perform naming,
1953  * and attempt to construct a symbol table for the load object.
1954  */
1955 static int
1956 core_iter_mapping(const rd_loadobj_t *rlp, struct ps_prochandle *P)
1957 {
1958         core_info_t *core = P->data;
1959         char lname[PATH_MAX], buf[PATH_MAX];
1960         file_info_t *fp;
1961         map_info_t *mp;
1962 
1963         if (Pread_string(P, lname, PATH_MAX, (off_t)rlp->rl_nameaddr) <= 0) {
1964                 dprintf("failed to read name %p\n", (void *)rlp->rl_nameaddr);
1965                 return (1); /* Keep going; forget this if we can't get a name */
1966         }
1967 
1968         dprintf("rd_loadobj name = \"%s\" rl_base = %p\n",
1969             lname, (void *)rlp->rl_base);
1970 
1971         if ((mp = Paddr2mptr(P, rlp->rl_base)) == NULL) {
1972                 dprintf("no mapping for %p\n", (void *)rlp->rl_base);
1973                 return (1); /* No mapping; advance to next mapping */
1974         }
1975 
1976         /*
1977          * Create a new file_info_t for this mapping, and therefore for
1978          * this load object.
1979          *
1980          * If there's an ELF header at the beginning of this mapping,
1981          * file_info_new() will try to use its section headers to
1982          * identify any other mappings that belong to this load object.
1983          */
1984         if ((fp = mp->map_file) == NULL &&
1985             (fp = file_info_new(P, mp)) == NULL) {
1986                 core->core_errno = errno;
1987                 dprintf("failed to malloc mapping data\n");
1988                 return (0); /* Abort */
1989         }
1990         fp->file_map = mp;
1991 
1992         /* Create a local copy of the load object representation */
1993         if ((fp->file_lo = calloc(1, sizeof (rd_loadobj_t))) == NULL) {
1994                 core->core_errno = errno;
1995                 dprintf("failed to malloc mapping data\n");
1996                 return (0); /* Abort */
1997         }
1998         *fp->file_lo = *rlp;
1999 
2000         if (lname[0] != '\0') {
2001                 /*
2002                  * Naming dance part 1: if we got a name from librtld_db, then
2003                  * copy this name to the prmap_t if it is unnamed.  If the
2004                  * file_info_t is unnamed, name it after the lname.
2005                  */
2006                 if (mp->map_pmap.pr_mapname[0] == '\0') {
2007                         (void) strncpy(mp->map_pmap.pr_mapname, lname, PRMAPSZ);
2008                         mp->map_pmap.pr_mapname[PRMAPSZ - 1] = '\0';
2009                 }
2010 
2011                 if (fp->file_lname == NULL)
2012                         fp->file_lname = strdup(lname);
2013 
2014         } else if (fp->file_lname == NULL &&
2015             mp->map_pmap.pr_mapname[0] != '\0') {
2016                 /*
2017                  * Naming dance part 2: if the mapping is named and the
2018                  * file_info_t is not, name the file after the mapping.
2019                  */
2020                 fp->file_lname = strdup(mp->map_pmap.pr_mapname);
2021         }
2022 
2023         if ((fp->file_rname == NULL) &&
2024             (Pfindmap(P, mp, buf, sizeof (buf)) != NULL))
2025                 fp->file_rname = strdup(buf);
2026 
2027         if (fp->file_lname != NULL)
2028                 fp->file_lbase = basename(fp->file_lname);
2029         if (fp->file_rname != NULL)
2030                 fp->file_rbase = basename(fp->file_rname);
2031 
2032         /* Associate the file and the mapping. */
2033         (void) strncpy(fp->file_pname, mp->map_pmap.pr_mapname, PRMAPSZ);
2034         fp->file_pname[PRMAPSZ - 1] = '\0';
2035 
2036         /*
2037          * If no section headers were available then we'll have to
2038          * identify this load object's other mappings with what we've
2039          * got: the start and end of the object's corresponding
2040          * address space.
2041          */
2042         if (fp->file_saddrs == NULL) {
2043                 for (mp = fp->file_map + 1; mp < P->mappings + P->map_count &&
2044                     mp->map_pmap.pr_vaddr < rlp->rl_bend; mp++) {
2045 
2046                         if (mp->map_file == NULL) {
2047                                 dprintf("core_iter_mapping %s: associating "
2048                                     "segment at %p\n",
2049                                     fp->file_pname,
2050                                     (void *)mp->map_pmap.pr_vaddr);
2051                                 mp->map_file = fp;
2052                                 fp->file_ref++;
2053                         } else {
2054                                 dprintf("core_iter_mapping %s: segment at "
2055                                     "%p already associated with %s\n",
2056                                     fp->file_pname,
2057                                     (void *)mp->map_pmap.pr_vaddr,
2058                                     (mp == fp->file_map ? "this file" :
2059                                     mp->map_file->file_pname));
2060                         }
2061                 }
2062         }
2063 
2064         /* Ensure that all this file's mappings are named. */
2065         for (mp = fp->file_map; mp < P->mappings + P->map_count &&
2066             mp->map_file == fp; mp++) {
2067                 if (mp->map_pmap.pr_mapname[0] == '\0' &&
2068                     !(mp->map_pmap.pr_mflags & MA_BREAK)) {
2069                         (void) strncpy(mp->map_pmap.pr_mapname, fp->file_pname,
2070                             PRMAPSZ);
2071                         mp->map_pmap.pr_mapname[PRMAPSZ - 1] = '\0';
2072                 }
2073         }
2074 
2075         /* Attempt to build a symbol table for this file. */
2076         Pbuild_file_symtab(P, fp);
2077         if (fp->file_elf == NULL)
2078                 dprintf("core_iter_mapping: no symtab for %s\n",
2079                     fp->file_pname);
2080 
2081         /* Locate the start of a data segment associated with this file. */
2082         if ((mp = core_find_data(P, fp->file_elf, fp->file_lo)) != NULL) {
2083                 dprintf("found data for %s at %p (pr_offset 0x%llx)\n",
2084                     fp->file_pname, (void *)fp->file_lo->rl_data_base,
2085                     mp->map_pmap.pr_offset);
2086         } else {
2087                 dprintf("core_iter_mapping: no data found for %s\n",
2088                     fp->file_pname);
2089         }
2090 
2091         return (1); /* Advance to next mapping */
2092 }
2093 
2094 /*
2095  * Callback function for Pfindexec().  In order to confirm a given pathname,
2096  * we verify that we can open it as an ELF file of type ET_EXEC or ET_DYN.
2097  */
2098 static int
2099 core_exec_open(const char *path, void *efp)
2100 {
2101         if (core_elf_open(efp, path, ET_EXEC, NULL) == 0)
2102                 return (1);
2103         if (core_elf_open(efp, path, ET_DYN, NULL) == 0)
2104                 return (1);
2105         return (0);
2106 }
2107 
2108 /*
2109  * Attempt to load any section headers found in the core file.  If present,
2110  * this will refer to non-loadable data added to the core file by the kernel
2111  * based on coreadm(1M) settings, including CTF data and the symbol table.
2112  */
2113 static void
2114 core_load_shdrs(struct ps_prochandle *P, elf_file_t *efp)
2115 {
2116         GElf_Shdr *shp, *shdrs = NULL;
2117         char *shstrtab = NULL;
2118         ulong_t shstrtabsz;
2119         const char *name;
2120         map_info_t *mp;
2121 
2122         size_t nbytes;
2123         void *buf;
2124         int i;
2125 
2126         if (efp->e_hdr.e_shstrndx >= efp->e_hdr.e_shnum) {
2127                 dprintf("corrupt shstrndx (%u) exceeds shnum (%u)\n",
2128                     efp->e_hdr.e_shstrndx, efp->e_hdr.e_shnum);
2129                 return;
2130         }
2131 
2132         /*
2133          * Read the section header table from the core file and then iterate
2134          * over the section headers, converting each to a GElf_Shdr.
2135          */
2136         if ((shdrs = malloc(efp->e_hdr.e_shnum * sizeof (GElf_Shdr))) == NULL) {
2137                 dprintf("failed to malloc %u section headers: %s\n",
2138                     (uint_t)efp->e_hdr.e_shnum, strerror(errno));
2139                 return;
2140         }
2141 
2142         nbytes = efp->e_hdr.e_shnum * efp->e_hdr.e_shentsize;
2143         if ((buf = malloc(nbytes)) == NULL) {
2144                 dprintf("failed to malloc %d bytes: %s\n", (int)nbytes,
2145                     strerror(errno));
2146                 free(shdrs);
2147                 goto out;
2148         }
2149 
2150         if (pread64(efp->e_fd, buf, nbytes, efp->e_hdr.e_shoff) != nbytes) {
2151                 dprintf("failed to read section headers at off %lld: %s\n",
2152                     (longlong_t)efp->e_hdr.e_shoff, strerror(errno));
2153                 free(buf);
2154                 goto out;
2155         }
2156 
2157         for (i = 0; i < efp->e_hdr.e_shnum; i++) {
2158                 void *p = (uchar_t *)buf + efp->e_hdr.e_shentsize * i;
2159 
2160                 if (efp->e_hdr.e_ident[EI_CLASS] == ELFCLASS32)
2161                         core_shdr_to_gelf(p, &shdrs[i]);
2162                 else
2163                         (void) memcpy(&shdrs[i], p, sizeof (GElf_Shdr));
2164         }
2165 
2166         free(buf);
2167         buf = NULL;
2168 
2169         /*
2170          * Read the .shstrtab section from the core file, terminating it with
2171          * an extra \0 so that a corrupt section will not cause us to die.
2172          */
2173         shp = &shdrs[efp->e_hdr.e_shstrndx];
2174         shstrtabsz = shp->sh_size;
2175 
2176         if ((shstrtab = malloc(shstrtabsz + 1)) == NULL) {
2177                 dprintf("failed to allocate %lu bytes for shstrtab\n",
2178                     (ulong_t)shstrtabsz);
2179                 goto out;
2180         }
2181 
2182         if (pread64(efp->e_fd, shstrtab, shstrtabsz,
2183             shp->sh_offset) != shstrtabsz) {
2184                 dprintf("failed to read %lu bytes of shstrs at off %lld: %s\n",
2185                     shstrtabsz, (longlong_t)shp->sh_offset, strerror(errno));
2186                 goto out;
2187         }
2188 
2189         shstrtab[shstrtabsz] = '\0';
2190 
2191         /*
2192          * Now iterate over each section in the section header table, locating
2193          * sections of interest and initializing more of the ps_prochandle.
2194          */
2195         for (i = 0; i < efp->e_hdr.e_shnum; i++) {
2196                 shp = &shdrs[i];
2197                 name = shstrtab + shp->sh_name;
2198 
2199                 if (shp->sh_name >= shstrtabsz) {
2200                         dprintf("skipping section [%d]: corrupt sh_name\n", i);
2201                         continue;
2202                 }
2203 
2204                 if (shp->sh_link >= efp->e_hdr.e_shnum) {
2205                         dprintf("skipping section [%d]: corrupt sh_link\n", i);
2206                         continue;
2207                 }
2208 
2209                 dprintf("found section header %s (sh_addr 0x%llx)\n",
2210                     name, (u_longlong_t)shp->sh_addr);
2211 
2212                 if (strcmp(name, ".SUNW_ctf") == 0) {
2213                         if ((mp = Paddr2mptr(P, shp->sh_addr)) == NULL) {
2214                                 dprintf("no map at addr 0x%llx for %s [%d]\n",
2215                                     (u_longlong_t)shp->sh_addr, name, i);
2216                                 continue;
2217                         }
2218 
2219                         if (mp->map_file == NULL ||
2220                             mp->map_file->file_ctf_buf != NULL) {
2221                                 dprintf("no mapping file or duplicate buffer "
2222                                     "for %s [%d]\n", name, i);
2223                                 continue;
2224                         }
2225 
2226                         if ((buf = malloc(shp->sh_size)) == NULL ||
2227                             pread64(efp->e_fd, buf, shp->sh_size,
2228                             shp->sh_offset) != shp->sh_size) {
2229                                 dprintf("skipping section %s [%d]: %s\n",
2230                                     name, i, strerror(errno));
2231                                 free(buf);
2232                                 continue;
2233                         }
2234 
2235                         mp->map_file->file_ctf_size = shp->sh_size;
2236                         mp->map_file->file_ctf_buf = buf;
2237 
2238                         if (shdrs[shp->sh_link].sh_type == SHT_DYNSYM)
2239                                 mp->map_file->file_ctf_dyn = 1;
2240 
2241                 } else if (strcmp(name, ".symtab") == 0) {
2242                         fake_up_symtab(P, &efp->e_hdr,
2243                             shp, &shdrs[shp->sh_link]);
2244                 }
2245         }
2246 out:
2247         free(shstrtab);
2248         free(shdrs);
2249 }
2250 
2251 /*
2252  * Main engine for core file initialization: given an fd for the core file
2253  * and an optional pathname, construct the ps_prochandle.  The aout_path can
2254  * either be a suggested executable pathname, or a suggested directory to
2255  * use as a possible current working directory.
2256  */
2257 struct ps_prochandle *
2258 Pfgrab_core(int core_fd, const char *aout_path, int *perr)
2259 {
2260         struct ps_prochandle *P;
2261         core_info_t *core_info;
2262         map_info_t *stk_mp, *brk_mp;
2263         const char *execname;
2264         char *interp;
2265         int i, notes, pagesize;
2266         uintptr_t addr, base_addr;
2267         struct stat64 stbuf;
2268         void *phbuf, *php;
2269         size_t nbytes;
2270 #ifdef __x86
2271         boolean_t from_linux = B_FALSE;
2272 #endif
2273 
2274         elf_file_t aout;
2275         elf_file_t core;
2276 
2277         Elf_Scn *scn, *intp_scn = NULL;
2278         Elf_Data *dp;
2279 
2280         GElf_Phdr phdr, note_phdr;
2281         GElf_Shdr shdr;
2282         GElf_Xword nleft;
2283 
2284         if (elf_version(EV_CURRENT) == EV_NONE) {
2285                 dprintf("libproc ELF version is more recent than libelf\n");
2286                 *perr = G_ELF;
2287                 return (NULL);
2288         }
2289 
2290         aout.e_elf = NULL;
2291         aout.e_fd = -1;
2292 
2293         core.e_elf = NULL;
2294         core.e_fd = core_fd;
2295 
2296         /*
2297          * Allocate and initialize a ps_prochandle structure for the core.
2298          * There are several key pieces of initialization here:
2299          *
2300          * 1. The PS_DEAD state flag marks this prochandle as a core file.
2301          *    PS_DEAD also thus prevents all operations which require state
2302          *    to be PS_STOP from operating on this handle.
2303          *
2304          * 2. We keep the core file fd in P->asfd since the core file contains
2305          *    the remnants of the process address space.
2306          *
2307          * 3. We set the P->info_valid bit because all information about the
2308          *    core is determined by the end of this function; there is no need
2309          *    for proc_update_maps() to reload mappings at any later point.
2310          *
2311          * 4. The read/write ops vector uses our core_rw() function defined
2312          *    above to handle i/o requests.
2313          */
2314         if ((P = malloc(sizeof (struct ps_prochandle))) == NULL) {
2315                 *perr = G_STRANGE;
2316                 return (NULL);
2317         }
2318 
2319         (void) memset(P, 0, sizeof (struct ps_prochandle));
2320         (void) mutex_init(&P->proc_lock, USYNC_THREAD, NULL);
2321         P->state = PS_DEAD;
2322         P->pid = (pid_t)-1;
2323         P->asfd = core.e_fd;
2324         P->ctlfd = -1;
2325         P->statfd = -1;
2326         P->agentctlfd = -1;
2327         P->agentstatfd = -1;
2328         P->zoneroot = NULL;
2329         P->info_valid = 1;
2330         Pinit_ops(&P->ops, &P_core_ops);
2331 
2332         Pinitsym(P);
2333 
2334         /*
2335          * Fstat and open the core file and make sure it is a valid ELF core.
2336          */
2337         if (fstat64(P->asfd, &stbuf) == -1) {
2338                 *perr = G_STRANGE;
2339                 goto err;
2340         }
2341 
2342         if (core_elf_fdopen(&core, ET_CORE, perr) == -1)
2343                 goto err;
2344 
2345         /*
2346          * Allocate and initialize a core_info_t to hang off the ps_prochandle
2347          * structure.  We keep all core-specific information in this structure.
2348          */
2349         if ((core_info = calloc(1, sizeof (core_info_t))) == NULL) {
2350                 *perr = G_STRANGE;
2351                 goto err;
2352         }
2353 
2354         P->data = core_info;
2355         list_link(&core_info->core_lwp_head, NULL);
2356         core_info->core_size = stbuf.st_size;
2357         /*
2358          * In the days before adjustable core file content, this was the
2359          * default core file content. For new core files, this value will
2360          * be overwritten by the NT_CONTENT note section.
2361          */
2362         core_info->core_content = CC_CONTENT_STACK | CC_CONTENT_HEAP |
2363             CC_CONTENT_DATA | CC_CONTENT_RODATA | CC_CONTENT_ANON |
2364             CC_CONTENT_SHANON;
2365 
2366         switch (core.e_hdr.e_ident[EI_CLASS]) {
2367         case ELFCLASS32:
2368                 core_info->core_dmodel = PR_MODEL_ILP32;
2369                 break;
2370         case ELFCLASS64:
2371                 core_info->core_dmodel = PR_MODEL_LP64;
2372                 break;
2373         default:
2374                 *perr = G_FORMAT;
2375                 goto err;
2376         }
2377         core_info->core_osabi = core.e_hdr.e_ident[EI_OSABI];
2378 
2379         /*
2380          * Because the core file may be a large file, we can't use libelf to
2381          * read the Phdrs.  We use e_phnum and e_phentsize to simplify things.
2382          */
2383         nbytes = core.e_hdr.e_phnum * core.e_hdr.e_phentsize;
2384 
2385         if ((phbuf = malloc(nbytes)) == NULL) {
2386                 *perr = G_STRANGE;
2387                 goto err;
2388         }
2389 
2390         if (pread64(core_fd, phbuf, nbytes, core.e_hdr.e_phoff) != nbytes) {
2391                 *perr = G_STRANGE;
2392                 free(phbuf);
2393                 goto err;
2394         }
2395 
2396         /*
2397          * Iterate through the program headers in the core file.
2398          * We're interested in two types of Phdrs: PT_NOTE (which
2399          * contains a set of saved /proc structures), and PT_LOAD (which
2400          * represents a memory mapping from the process's address space).
2401          * In the case of PT_NOTE, we're interested in the last PT_NOTE
2402          * in the core file; currently the first PT_NOTE (if present)
2403          * contains /proc structs in the pre-2.6 unstructured /proc format.
2404          */
2405         for (php = phbuf, notes = 0, i = 0; i < core.e_hdr.e_phnum; i++) {
2406                 if (core.e_hdr.e_ident[EI_CLASS] == ELFCLASS64)
2407                         (void) memcpy(&phdr, php, sizeof (GElf_Phdr));
2408                 else
2409                         core_phdr_to_gelf(php, &phdr);
2410 
2411                 switch (phdr.p_type) {
2412                 case PT_NOTE:
2413                         note_phdr = phdr;
2414                         notes++;
2415                         break;
2416 
2417                 case PT_LOAD:
2418                         if (core_add_mapping(P, &phdr) == -1) {
2419                                 *perr = G_STRANGE;
2420                                 free(phbuf);
2421                                 goto err;
2422                         }
2423                         break;
2424                 default:
2425                         dprintf("Pgrab_core: unknown phdr %d\n", phdr.p_type);
2426                         break;
2427                 }
2428 
2429                 php = (char *)php + core.e_hdr.e_phentsize;
2430         }
2431 
2432         free(phbuf);
2433 
2434         Psort_mappings(P);
2435 
2436         /*
2437          * If we couldn't find anything of type PT_NOTE, or only one PT_NOTE
2438          * was present, abort.  The core file is either corrupt or too old.
2439          */
2440         if (notes == 0 || (notes == 1 && core_info->core_osabi ==
2441             ELFOSABI_SOLARIS)) {
2442                 *perr = G_NOTE;
2443                 goto err;
2444         }
2445 
2446         /*
2447          * Advance the seek pointer to the start of the PT_NOTE data
2448          */
2449         if (lseek64(P->asfd, note_phdr.p_offset, SEEK_SET) == (off64_t)-1) {
2450                 dprintf("Pgrab_core: failed to lseek to PT_NOTE data\n");
2451                 *perr = G_STRANGE;
2452                 goto err;
2453         }
2454 
2455         /*
2456          * Now process the PT_NOTE structures.  Each one is preceded by
2457          * an Elf{32/64}_Nhdr structure describing its type and size.
2458          *
2459          *  +--------+
2460          *  | header |
2461          *  +--------+
2462          *  | name   |
2463          *  | ...    |
2464          *  +--------+
2465          *  | desc   |
2466          *  | ...    |
2467          *  +--------+
2468          */
2469         for (nleft = note_phdr.p_filesz; nleft > 0; ) {
2470                 Elf64_Nhdr nhdr;
2471                 off64_t off, namesz, descsz;
2472 
2473                 /*
2474                  * Although <sys/elf.h> defines both Elf32_Nhdr and Elf64_Nhdr
2475                  * as different types, they are both of the same content and
2476                  * size, so we don't need to worry about 32/64 conversion here.
2477                  */
2478                 if (read(P->asfd, &nhdr, sizeof (nhdr)) != sizeof (nhdr)) {
2479                         dprintf("Pgrab_core: failed to read ELF note header\n");
2480                         *perr = G_NOTE;
2481                         goto err;
2482                 }
2483 
2484                 /*
2485                  * According to the System V ABI, the amount of padding
2486                  * following the name field should align the description
2487                  * field on a 4 byte boundary for 32-bit binaries or on an 8
2488                  * byte boundary for 64-bit binaries. However, this change
2489                  * was not made correctly during the 64-bit port so all
2490                  * descriptions can assume only 4-byte alignment. We ignore
2491                  * the name field and the padding to 4-byte alignment.
2492                  */
2493                 namesz = P2ROUNDUP((off64_t)nhdr.n_namesz, (off64_t)4);
2494 
2495                 if (lseek64(P->asfd, namesz, SEEK_CUR) == (off64_t)-1) {
2496                         dprintf("failed to seek past name and padding\n");
2497                         *perr = G_STRANGE;
2498                         goto err;
2499                 }
2500 
2501                 dprintf("Note hdr n_type=%u n_namesz=%u n_descsz=%u\n",
2502                     nhdr.n_type, nhdr.n_namesz, nhdr.n_descsz);
2503 
2504                 off = lseek64(P->asfd, (off64_t)0L, SEEK_CUR);
2505 
2506                 /*
2507                  * Invoke the note handler function from our table
2508                  */
2509                 if (nhdr.n_type < sizeof (nhdlrs) / sizeof (nhdlrs[0])) {
2510                         if (nhdlrs[nhdr.n_type](P, nhdr.n_descsz) < 0) {
2511                                 dprintf("handler for type %d returned < 0",
2512                                     nhdr.n_type);
2513                                 *perr = G_NOTE;
2514                                 goto err;
2515                         }
2516                         /*
2517                          * The presence of either of these notes indicates that
2518                          * the dump was generated on Linux.
2519                          */
2520 #ifdef __x86
2521                         if (nhdr.n_type == NT_PRSTATUS ||
2522                             nhdr.n_type == NT_PRPSINFO)
2523                                 from_linux = B_TRUE;
2524 #endif
2525                 } else {
2526                         (void) note_notsup(P, nhdr.n_descsz);
2527                 }
2528 
2529                 /*
2530                  * Seek past the current note data to the next Elf_Nhdr
2531                  */
2532                 descsz = P2ROUNDUP((off64_t)nhdr.n_descsz, (off64_t)4);
2533                 if (lseek64(P->asfd, off + descsz, SEEK_SET) == (off64_t)-1) {
2534                         dprintf("Pgrab_core: failed to seek to next nhdr\n");
2535                         *perr = G_STRANGE;
2536                         goto err;
2537                 }
2538 
2539                 /*
2540                  * Subtract the size of the header and its data from what
2541                  * we have left to process.
2542                  */
2543                 nleft -= sizeof (nhdr) + namesz + descsz;
2544         }
2545 
2546 #ifdef __x86
2547         if (from_linux) {
2548                 size_t tcount, pid;
2549                 lwp_info_t *lwp;
2550 
2551                 P->status.pr_dmodel = core_info->core_dmodel;
2552 
2553                 lwp = list_next(&core_info->core_lwp_head);
2554 
2555                 pid = P->status.pr_pid;
2556 
2557                 for (tcount = 0; tcount < core_info->core_nlwp;
2558                     tcount++, lwp = list_next(lwp)) {
2559                         dprintf("Linux thread with id %d\n", lwp->lwp_id);
2560 
2561                         /*
2562                          * In the case we don't have a valid psinfo (i.e. pid is
2563                          * 0, probably because of gdb creating the core) assume
2564                          * lowest pid count is the first thread (what if the
2565                          * next thread wraps the pid around?)
2566                          */
2567                         if (P->status.pr_pid == 0 &&
2568                             ((pid == 0 && lwp->lwp_id > 0) ||
2569                             (lwp->lwp_id < pid))) {
2570                                 pid = lwp->lwp_id;
2571                         }
2572                 }
2573 
2574                 if (P->status.pr_pid != pid) {
2575                         dprintf("No valid pid, setting to %ld\n", (ulong_t)pid);
2576                         P->status.pr_pid = pid;
2577                         P->psinfo.pr_pid = pid;
2578                 }
2579 
2580                 /*
2581                  * Consumers like mdb expect the first thread to actually have
2582                  * an id of 1, on linux that is actually the pid. Find the the
2583                  * thread with our process id, and set the id to 1
2584                  */
2585                 if ((lwp = lwpid2info(P, pid)) == NULL) {
2586                         dprintf("Couldn't find first thread\n");
2587                         *perr = G_STRANGE;
2588                         goto err;
2589                 }
2590 
2591                 dprintf("setting representative thread: %d\n", lwp->lwp_id);
2592 
2593                 lwp->lwp_id = 1;
2594                 lwp->lwp_status.pr_lwpid = 1;
2595 
2596                 /* set representative thread */
2597                 (void) memcpy(&P->status.pr_lwp, &lwp->lwp_status,
2598                     sizeof (P->status.pr_lwp));
2599         }
2600 #endif /* __x86 */
2601 
2602         if (nleft != 0) {
2603                 dprintf("Pgrab_core: note section malformed\n");
2604                 *perr = G_STRANGE;
2605                 goto err;
2606         }
2607 
2608         if ((pagesize = Pgetauxval(P, AT_PAGESZ)) == -1) {
2609                 pagesize = getpagesize();
2610                 dprintf("AT_PAGESZ missing; defaulting to %d\n", pagesize);
2611         }
2612 
2613         /*
2614          * Locate and label the mappings corresponding to the end of the
2615          * heap (MA_BREAK) and the base of the stack (MA_STACK).
2616          */
2617         if ((P->status.pr_brkbase != 0 || P->status.pr_brksize != 0) &&
2618             (brk_mp = Paddr2mptr(P, P->status.pr_brkbase +
2619             P->status.pr_brksize - 1)) != NULL)
2620                 brk_mp->map_pmap.pr_mflags |= MA_BREAK;
2621         else
2622                 brk_mp = NULL;
2623 
2624         if ((stk_mp = Paddr2mptr(P, P->status.pr_stkbase)) != NULL)
2625                 stk_mp->map_pmap.pr_mflags |= MA_STACK;
2626 
2627         /*
2628          * At this point, we have enough information to look for the
2629          * executable and open it: we have access to the auxv, a psinfo_t,
2630          * and the ability to read from mappings provided by the core file.
2631          */
2632         (void) Pfindexec(P, aout_path, core_exec_open, &aout);
2633         dprintf("P->execname = \"%s\"\n", P->execname ? P->execname : "NULL");
2634         execname = P->execname ? P->execname : "a.out";
2635 
2636         /*
2637          * Iterate through the sections, looking for the .dynamic and .interp
2638          * sections.  If we encounter them, remember their section pointers.
2639          */
2640         for (scn = NULL; (scn = elf_nextscn(aout.e_elf, scn)) != NULL; ) {
2641                 char *sname;
2642 
2643                 if ((gelf_getshdr(scn, &shdr) == NULL) ||
2644                     (sname = elf_strptr(aout.e_elf, aout.e_hdr.e_shstrndx,
2645                     (size_t)shdr.sh_name)) == NULL)
2646                         continue;
2647 
2648                 if (strcmp(sname, ".interp") == 0)
2649                         intp_scn = scn;
2650         }
2651 
2652         /*
2653          * Get the AT_BASE auxv element.  If this is missing (-1), then
2654          * we assume this is a statically-linked executable.
2655          */
2656         base_addr = Pgetauxval(P, AT_BASE);
2657 
2658         /*
2659          * In order to get librtld_db initialized, we'll need to identify
2660          * and name the mapping corresponding to the run-time linker.  The
2661          * AT_BASE auxv element tells us the address where it was mapped,
2662          * and the .interp section of the executable tells us its path.
2663          * If for some reason that doesn't pan out, just use ld.so.1.
2664          */
2665         if (intp_scn != NULL && (dp = elf_getdata(intp_scn, NULL)) != NULL &&
2666             dp->d_size != 0) {
2667                 dprintf(".interp = <%s>\n", (char *)dp->d_buf);
2668                 interp = dp->d_buf;
2669 
2670         } else if (base_addr != (uintptr_t)-1L) {
2671                 if (core_info->core_dmodel == PR_MODEL_LP64)
2672                         interp = "/usr/lib/64/ld.so.1";
2673                 else
2674                         interp = "/usr/lib/ld.so.1";
2675 
2676                 dprintf(".interp section is missing or could not be read; "
2677                     "defaulting to %s\n", interp);
2678         } else
2679                 dprintf("detected statically linked executable\n");
2680 
2681         /*
2682          * If we have an AT_BASE element, name the mapping at that address
2683          * using the interpreter pathname.  Name the corresponding data
2684          * mapping after the interpreter as well.
2685          */
2686         if (base_addr != (uintptr_t)-1L) {
2687                 elf_file_t intf;
2688 
2689                 P->map_ldso = core_name_mapping(P, base_addr, interp);
2690 
2691                 if (core_elf_open(&intf, interp, ET_DYN, NULL) == 0) {
2692                         rd_loadobj_t rl;
2693                         map_info_t *dmp;
2694 
2695                         rl.rl_base = base_addr;
2696                         dmp = core_find_data(P, intf.e_elf, &rl);
2697 
2698                         if (dmp != NULL) {
2699                                 dprintf("renamed data at %p to %s\n",
2700                                     (void *)rl.rl_data_base, interp);
2701                                 (void) strncpy(dmp->map_pmap.pr_mapname,
2702                                     interp, PRMAPSZ);
2703                                 dmp->map_pmap.pr_mapname[PRMAPSZ - 1] = '\0';
2704                         }
2705                 }
2706 
2707                 core_elf_close(&intf);
2708         }
2709 
2710         /*
2711          * If we have an AT_ENTRY element, name the mapping at that address
2712          * using the special name "a.out" just like /proc does.
2713          */
2714         if ((addr = Pgetauxval(P, AT_ENTRY)) != (uintptr_t)-1L)
2715                 P->map_exec = core_name_mapping(P, addr, "a.out");
2716 
2717         /*
2718          * If we're a statically linked executable (or we're on x86 and looking
2719          * at a Linux core dump), then just locate the executable's text and
2720          * data and name them after the executable.
2721          */
2722 #ifndef __x86
2723         if (base_addr == (uintptr_t)-1L) {
2724 #else
2725         if (base_addr == (uintptr_t)-1L || from_linux) {
2726 #endif
2727                 dprintf("looking for text and data: %s\n", execname);
2728                 map_info_t *tmp, *dmp;
2729                 file_info_t *fp;
2730                 rd_loadobj_t rl;
2731 
2732                 if ((tmp = core_find_text(P, aout.e_elf, &rl)) != NULL &&
2733                     (dmp = core_find_data(P, aout.e_elf, &rl)) != NULL) {
2734                         (void) strncpy(tmp->map_pmap.pr_mapname,
2735                             execname, PRMAPSZ);
2736                         tmp->map_pmap.pr_mapname[PRMAPSZ - 1] = '\0';
2737                         (void) strncpy(dmp->map_pmap.pr_mapname,
2738                             execname, PRMAPSZ);
2739                         dmp->map_pmap.pr_mapname[PRMAPSZ - 1] = '\0';
2740                 }
2741 
2742                 if ((P->map_exec = tmp) != NULL &&
2743                     (fp = malloc(sizeof (file_info_t))) != NULL) {
2744 
2745                         (void) memset(fp, 0, sizeof (file_info_t));
2746 
2747                         list_link(fp, &P->file_head);
2748                         tmp->map_file = fp;
2749                         P->num_files++;
2750 
2751                         fp->file_ref = 1;
2752                         fp->file_fd = -1;
2753 
2754                         fp->file_lo = malloc(sizeof (rd_loadobj_t));
2755                         fp->file_lname = strdup(execname);
2756 
2757                         if (fp->file_lo)
2758                                 *fp->file_lo = rl;
2759                         if (fp->file_lname)
2760                                 fp->file_lbase = basename(fp->file_lname);
2761                         if (fp->file_rname)
2762                                 fp->file_rbase = basename(fp->file_rname);
2763 
2764                         (void) strcpy(fp->file_pname,
2765                             P->mappings[0].map_pmap.pr_mapname);
2766                         fp->file_map = tmp;
2767 
2768                         Pbuild_file_symtab(P, fp);
2769 
2770                         if (dmp != NULL) {
2771                                 dmp->map_file = fp;
2772                                 fp->file_ref++;
2773                         }
2774                 }
2775         }
2776 
2777         core_elf_close(&aout);
2778 
2779         /*
2780          * We now have enough information to initialize librtld_db.
2781          * After it warms up, we can iterate through the load object chain
2782          * in the core, which will allow us to construct the file info
2783          * we need to provide symbol information for the other shared
2784          * libraries, and also to fill in the missing mapping names.
2785          */
2786         rd_log(_libproc_debug);
2787 
2788         if ((P->rap = rd_new(P)) != NULL) {
2789                 (void) rd_loadobj_iter(P->rap, (rl_iter_f *)
2790                     core_iter_mapping, P);
2791 
2792                 if (core_info->core_errno != 0) {
2793                         errno = core_info->core_errno;
2794                         *perr = G_STRANGE;
2795                         goto err;
2796                 }
2797         } else
2798                 dprintf("failed to initialize rtld_db agent\n");
2799 
2800         /*
2801          * If there are sections, load them and process the data from any
2802          * sections that we can use to annotate the file_info_t's.
2803          */
2804         core_load_shdrs(P, &core);
2805 
2806         /*
2807          * If we previously located a stack or break mapping, and they are
2808          * still anonymous, we now assume that they were MAP_ANON mappings.
2809          * If brk_mp turns out to now have a name, then the heap is still
2810          * sitting at the end of the executable's data+bss mapping: remove
2811          * the previous MA_BREAK setting to be consistent with /proc.
2812          */
2813         if (stk_mp != NULL && stk_mp->map_pmap.pr_mapname[0] == '\0')
2814                 stk_mp->map_pmap.pr_mflags |= MA_ANON;
2815         if (brk_mp != NULL && brk_mp->map_pmap.pr_mapname[0] == '\0')
2816                 brk_mp->map_pmap.pr_mflags |= MA_ANON;
2817         else if (brk_mp != NULL)
2818                 brk_mp->map_pmap.pr_mflags &= ~MA_BREAK;
2819 
2820         *perr = 0;
2821         return (P);
2822 
2823 err:
2824         Pfree(P);
2825         core_elf_close(&aout);
2826         return (NULL);
2827 }
2828 
2829 /*
2830  * Grab a core file using a pathname.  We just open it and call Pfgrab_core().
2831  */
2832 struct ps_prochandle *
2833 Pgrab_core(const char *core, const char *aout, int gflag, int *perr)
2834 {
2835         int fd, oflag = (gflag & PGRAB_RDONLY) ? O_RDONLY : O_RDWR;
2836 
2837         if ((fd = open64(core, oflag)) >= 0)
2838                 return (Pfgrab_core(fd, aout, perr));
2839 
2840         if (errno != ENOENT)
2841                 *perr = G_STRANGE;
2842         else
2843                 *perr = G_NOCORE;
2844 
2845         return (NULL);
2846 }