Home | History | Annotate | Download | only in m_initimg
      1 
      2 /*--------------------------------------------------------------------*/
      3 /*--- Startup: create initial process image on Linux               ---*/
      4 /*---                                              initimg-linux.c ---*/
      5 /*--------------------------------------------------------------------*/
      6 
      7 /*
      8    This file is part of Valgrind, a dynamic binary instrumentation
      9    framework.
     10 
     11    Copyright (C) 2000-2013 Julian Seward
     12       jseward (at) acm.org
     13 
     14    This program is free software; you can redistribute it and/or
     15    modify it under the terms of the GNU General Public License as
     16    published by the Free Software Foundation; either version 2 of the
     17    License, or (at your option) any later version.
     18 
     19    This program is distributed in the hope that it will be useful, but
     20    WITHOUT ANY WARRANTY; without even the implied warranty of
     21    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     22    General Public License for more details.
     23 
     24    You should have received a copy of the GNU General Public License
     25    along with this program; if not, write to the Free Software
     26    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
     27    02111-1307, USA.
     28 
     29    The GNU General Public License is contained in the file COPYING.
     30 */
     31 
     32 #if defined(VGO_linux)
     33 
     34 #include "pub_core_basics.h"
     35 #include "pub_core_vki.h"
     36 #include "pub_core_debuglog.h"
     37 #include "pub_core_libcbase.h"
     38 #include "pub_core_libcassert.h"
     39 #include "pub_core_libcfile.h"
     40 #include "pub_core_libcproc.h"
     41 #include "pub_core_libcprint.h"
     42 #include "pub_core_xarray.h"
     43 #include "pub_core_clientstate.h"
     44 #include "pub_core_aspacemgr.h"
     45 #include "pub_core_mallocfree.h"
     46 #include "pub_core_machine.h"
     47 #include "pub_core_ume.h"
     48 #include "pub_core_options.h"
     49 #include "pub_core_syscall.h"
     50 #include "pub_core_tooliface.h"       /* VG_TRACK */
     51 #include "pub_core_libcsetjmp.h"      // to keep _threadstate.h happy
     52 #include "pub_core_threadstate.h"     /* ThreadArchState */
     53 #include "priv_initimg_pathscan.h"
     54 #include "pub_core_initimg.h"         /* self */
     55 
     56 /* --- !!! --- EXTERNAL HEADERS start --- !!! --- */
     57 #define _GNU_SOURCE
     58 #define _FILE_OFFSET_BITS 64
     59 /* This is for ELF types etc, and also the AT_ constants. */
     60 #include <elf.h>
     61 /* --- !!! --- EXTERNAL HEADERS end --- !!! --- */
     62 
     63 
     64 /*====================================================================*/
     65 /*=== Loading the client                                           ===*/
     66 /*====================================================================*/
     67 
     68 /* Load the client whose name is VG_(argv_the_exename). */
     69 
     70 static void load_client ( /*OUT*/ExeInfo* info,
     71                           /*OUT*/Addr*    client_ip,
     72 			  /*OUT*/Addr*    client_toc)
     73 {
     74    const HChar* exe_name;
     75    Int    ret;
     76    SysRes res;
     77 
     78    vg_assert( VG_(args_the_exename) != NULL);
     79    exe_name = ML_(find_executable)( VG_(args_the_exename) );
     80 
     81    if (!exe_name) {
     82       VG_(printf)("valgrind: %s: command not found\n", VG_(args_the_exename));
     83       VG_(exit)(127);      // 127 is Posix NOTFOUND
     84    }
     85 
     86    VG_(memset)(info, 0, sizeof(*info));
     87    ret = VG_(do_exec)(exe_name, info);
     88    if (ret < 0) {
     89       VG_(printf)("valgrind: could not execute '%s'\n", exe_name);
     90       VG_(exit)(1);
     91    }
     92 
     93    // The client was successfully loaded!  Continue.
     94 
     95    /* Get hold of a file descriptor which refers to the client
     96       executable.  This is needed for attaching to GDB. */
     97    res = VG_(open)(exe_name, VKI_O_RDONLY, VKI_S_IRUSR);
     98    if (!sr_isError(res))
     99       VG_(cl_exec_fd) = sr_Res(res);
    100 
    101    /* Copy necessary bits of 'info' that were filled in */
    102    *client_ip  = info->init_ip;
    103    *client_toc = info->init_toc;
    104    VG_(brk_base) = VG_(brk_limit) = VG_PGROUNDUP(info->brkbase);
    105 }
    106 
    107 
    108 /*====================================================================*/
    109 /*=== Setting up the client's environment                          ===*/
    110 /*====================================================================*/
    111 
    112 /* Prepare the client's environment.  This is basically a copy of our
    113    environment, except:
    114 
    115      LD_PRELOAD=$VALGRIND_LIB/vgpreload_core-PLATFORM.so:
    116                 ($VALGRIND_LIB/vgpreload_TOOL-PLATFORM.so:)?
    117                 $LD_PRELOAD
    118 
    119    If this is missing, then it is added.
    120 
    121    Also, remove any binding for VALGRIND_LAUNCHER=.  The client should
    122    not be able to see this.
    123 
    124    If this needs to handle any more variables it should be hacked
    125    into something table driven.  The copy is VG_(malloc)'d space.
    126 */
    127 static HChar** setup_client_env ( HChar** origenv, const HChar* toolname)
    128 {
    129    const HChar* preload_core    = "vgpreload_core";
    130    const HChar* ld_preload      = "LD_PRELOAD=";
    131    const HChar* v_launcher      = VALGRIND_LAUNCHER "=";
    132    Int    ld_preload_len  = VG_(strlen)( ld_preload );
    133    Int    v_launcher_len  = VG_(strlen)( v_launcher );
    134    Bool   ld_preload_done = False;
    135    Int    vglib_len       = VG_(strlen)(VG_(libdir));
    136    Bool   debug           = False;
    137 
    138    HChar** cpp;
    139    HChar** ret;
    140    HChar*  preload_tool_path;
    141    Int     envc, i;
    142 
    143    /* Alloc space for the vgpreload_core.so path and vgpreload_<tool>.so
    144       paths.  We might not need the space for vgpreload_<tool>.so, but it
    145       doesn't hurt to over-allocate briefly.  The 16s are just cautious
    146       slop. */
    147    Int preload_core_path_len = vglib_len + sizeof(preload_core)
    148                                          + sizeof(VG_PLATFORM) + 16;
    149    Int preload_tool_path_len = vglib_len + VG_(strlen)(toolname)
    150                                          + sizeof(VG_PLATFORM) + 16;
    151    Int preload_string_len    = preload_core_path_len + preload_tool_path_len;
    152    HChar* preload_string     = VG_(malloc)("initimg-linux.sce.1",
    153                                            preload_string_len);
    154    vg_assert(origenv);
    155    vg_assert(toolname);
    156    vg_assert(preload_string);
    157 
    158    /* Determine if there's a vgpreload_<tool>_<platform>.so file, and setup
    159       preload_string. */
    160    preload_tool_path = VG_(malloc)("initimg-linux.sce.2", preload_tool_path_len);
    161    vg_assert(preload_tool_path);
    162    VG_(snprintf)(preload_tool_path, preload_tool_path_len,
    163                  "%s/vgpreload_%s-%s.so", VG_(libdir), toolname, VG_PLATFORM);
    164    if (VG_(access)(preload_tool_path, True/*r*/, False/*w*/, False/*x*/) == 0) {
    165       VG_(snprintf)(preload_string, preload_string_len, "%s/%s-%s.so:%s",
    166                     VG_(libdir), preload_core, VG_PLATFORM, preload_tool_path);
    167    } else {
    168       VG_(snprintf)(preload_string, preload_string_len, "%s/%s-%s.so",
    169                     VG_(libdir), preload_core, VG_PLATFORM);
    170    }
    171    VG_(free)(preload_tool_path);
    172 
    173    VG_(debugLog)(2, "initimg", "preload_string:\n");
    174    VG_(debugLog)(2, "initimg", "  \"%s\"\n", preload_string);
    175 
    176    /* Count the original size of the env */
    177    if (debug) VG_(printf)("\n\n");
    178    envc = 0;
    179    for (cpp = origenv; cpp && *cpp; cpp++) {
    180       envc++;
    181       if (debug) VG_(printf)("XXXXXXXXX: BEFORE %s\n", *cpp);
    182    }
    183 
    184    /* Allocate a new space */
    185    ret = VG_(malloc) ("initimg-linux.sce.3",
    186                       sizeof(HChar *) * (envc+1+1)); /* 1 new entry + NULL */
    187    vg_assert(ret);
    188 
    189    /* copy it over */
    190    for (cpp = ret; *origenv; ) {
    191       if (debug) VG_(printf)("XXXXXXXXX: COPY   %s\n", *origenv);
    192       *cpp++ = *origenv++;
    193    }
    194    *cpp = NULL;
    195 
    196    vg_assert(envc == (cpp - ret));
    197 
    198    /* Walk over the new environment, mashing as we go */
    199    for (cpp = ret; cpp && *cpp; cpp++) {
    200       if (VG_(memcmp)(*cpp, ld_preload, ld_preload_len) == 0) {
    201          Int len = VG_(strlen)(*cpp) + preload_string_len;
    202          HChar *cp = VG_(malloc)("initimg-linux.sce.4", len);
    203          vg_assert(cp);
    204 
    205          VG_(snprintf)(cp, len, "%s%s:%s",
    206                        ld_preload, preload_string, (*cpp)+ld_preload_len);
    207 
    208          *cpp = cp;
    209 
    210          ld_preload_done = True;
    211       }
    212       if (debug) VG_(printf)("XXXXXXXXX: MASH   %s\n", *cpp);
    213    }
    214 
    215    /* Add the missing bits */
    216    if (!ld_preload_done) {
    217       Int len = ld_preload_len + preload_string_len;
    218       HChar *cp = VG_(malloc) ("initimg-linux.sce.5", len);
    219       vg_assert(cp);
    220 
    221       VG_(snprintf)(cp, len, "%s%s", ld_preload, preload_string);
    222 
    223       ret[envc++] = cp;
    224       if (debug) VG_(printf)("XXXXXXXXX: ADD    %s\n", cp);
    225    }
    226 
    227    /* ret[0 .. envc-1] is live now. */
    228    /* Find and remove a binding for VALGRIND_LAUNCHER. */
    229    for (i = 0; i < envc; i++)
    230       if (0 == VG_(memcmp(ret[i], v_launcher, v_launcher_len)))
    231          break;
    232 
    233    if (i < envc) {
    234       for (; i < envc-1; i++)
    235          ret[i] = ret[i+1];
    236       envc--;
    237    }
    238 
    239    VG_(free)(preload_string);
    240    ret[envc] = NULL;
    241 
    242    for (i = 0; i < envc; i++) {
    243       if (debug) VG_(printf)("XXXXXXXXX: FINAL  %s\n", ret[i]);
    244    }
    245 
    246    return ret;
    247 }
    248 
    249 
    250 /*====================================================================*/
    251 /*=== Setting up the client's stack                                ===*/
    252 /*====================================================================*/
    253 
    254 #ifndef AT_ICACHEBSIZE
    255 #define AT_ICACHEBSIZE		20
    256 #endif /* AT_ICACHEBSIZE */
    257 
    258 #ifndef AT_UCACHEBSIZE
    259 #define AT_UCACHEBSIZE		21
    260 #endif /* AT_UCACHEBSIZE */
    261 
    262 #ifndef AT_BASE_PLATFORM
    263 #define AT_BASE_PLATFORM	24
    264 #endif /* AT_BASE_PLATFORM */
    265 
    266 #ifndef AT_RANDOM
    267 #define AT_RANDOM		25
    268 #endif /* AT_RANDOM */
    269 
    270 #ifndef AT_EXECFN
    271 #define AT_EXECFN		31
    272 #endif /* AT_EXECFN */
    273 
    274 #ifndef AT_SYSINFO
    275 #define AT_SYSINFO		32
    276 #endif /* AT_SYSINFO */
    277 
    278 #ifndef AT_SYSINFO_EHDR
    279 #define AT_SYSINFO_EHDR		33
    280 #endif /* AT_SYSINFO_EHDR */
    281 
    282 #ifndef AT_SECURE
    283 #define AT_SECURE 23   /* secure mode boolean */
    284 #endif	/* AT_SECURE */
    285 
    286 /* Add a string onto the string table, and return its address */
    287 static HChar *copy_str(HChar **tab, const HChar *str)
    288 {
    289    HChar *cp = *tab;
    290    HChar *orig = cp;
    291 
    292    while(*str)
    293       *cp++ = *str++;
    294    *cp++ = '\0';
    295 
    296    if (0)
    297       VG_(printf)("copied %p \"%s\" len %lld\n", orig, orig, (Long)(cp-orig));
    298 
    299    *tab = cp;
    300 
    301    return orig;
    302 }
    303 
    304 
    305 /* ----------------------------------------------------------------
    306 
    307    This sets up the client's initial stack, containing the args,
    308    environment and aux vector.
    309 
    310    The format of the stack is:
    311 
    312    higher address +-----------------+ <- clstack_end
    313                   |                 |
    314 		  : string table    :
    315 		  |                 |
    316 		  +-----------------+
    317 		  | AT_NULL         |
    318 		  -                 -
    319 		  | auxv            |
    320 		  +-----------------+
    321 		  | NULL            |
    322 		  -                 -
    323 		  | envp            |
    324 		  +-----------------+
    325 		  | NULL            |
    326 		  -                 -
    327 		  | argv            |
    328 		  +-----------------+
    329 		  | argc            |
    330    lower address  +-----------------+ <- sp
    331                   | undefined       |
    332 		  :                 :
    333 
    334    Allocate and create the initial client stack.  It is allocated down
    335    from clstack_end, which was previously determined by the address
    336    space manager.  The returned value is the SP value for the client.
    337 
    338    The client's auxv is created by copying and modifying our own one.
    339    As a side effect of scanning our own auxv, some important bits of
    340    info are collected:
    341 
    342       VG_(cache_line_size_ppc32) // ppc32 only -- cache line size
    343       VG_(have_altivec_ppc32)    // ppc32 only -- is Altivec supported?
    344 
    345    ---------------------------------------------------------------- */
    346 
    347 struct auxv
    348 {
    349    Word a_type;
    350    union {
    351       void *a_ptr;
    352       Word a_val;
    353    } u;
    354 };
    355 
    356 static
    357 struct auxv *find_auxv(UWord* sp)
    358 {
    359    sp++;                // skip argc (Nb: is word-sized, not int-sized!)
    360 
    361    while (*sp != 0)     // skip argv
    362       sp++;
    363    sp++;
    364 
    365    while (*sp != 0)     // skip env
    366       sp++;
    367    sp++;
    368 
    369 #if defined(VGA_ppc32) || defined(VGA_ppc64)
    370 # if defined AT_IGNOREPPC
    371    while (*sp == AT_IGNOREPPC)        // skip AT_IGNOREPPC entries
    372       sp += 2;
    373 # endif
    374 #endif
    375 
    376    return (struct auxv *)sp;
    377 }
    378 
    379 static
    380 Addr setup_client_stack( void*  init_sp,
    381                          HChar** orig_envp,
    382                          const ExeInfo* info,
    383                          UInt** client_auxv,
    384                          Addr   clstack_end,
    385                          SizeT  clstack_max_size )
    386 {
    387    SysRes res;
    388    HChar **cpp;
    389    HChar *strtab;		/* string table */
    390    HChar *stringbase;
    391    Addr *ptr;
    392    struct auxv *auxv;
    393    const struct auxv *orig_auxv;
    394    const struct auxv *cauxv;
    395    unsigned stringsize;		/* total size of strings in bytes */
    396    unsigned auxsize;		/* total size of auxv in bytes */
    397    Int argc;			/* total argc */
    398    Int envc;			/* total number of env vars */
    399    unsigned stacksize;		/* total client stack size */
    400    Addr client_SP;	        /* client stack base (initial SP) */
    401    Addr clstack_start;
    402    Int i;
    403    Bool have_exename;
    404 
    405    vg_assert(VG_IS_PAGE_ALIGNED(clstack_end+1));
    406    vg_assert( VG_(args_for_client) );
    407 
    408    /* use our own auxv as a prototype */
    409    orig_auxv = find_auxv(init_sp);
    410 
    411    /* ==================== compute sizes ==================== */
    412 
    413    /* first of all, work out how big the client stack will be */
    414    stringsize   = 0;
    415    have_exename = VG_(args_the_exename) != NULL;
    416 
    417    /* paste on the extra args if the loader needs them (ie, the #!
    418       interpreter and its argument) */
    419    argc = 0;
    420    if (info->interp_name != NULL) {
    421       argc++;
    422       stringsize += VG_(strlen)(info->interp_name) + 1;
    423    }
    424    if (info->interp_args != NULL) {
    425       argc++;
    426       stringsize += VG_(strlen)(info->interp_args) + 1;
    427    }
    428 
    429    /* now scan the args we're given... */
    430    if (have_exename)
    431       stringsize += VG_(strlen)( VG_(args_the_exename) ) + 1;
    432 
    433    for (i = 0; i < VG_(sizeXA)( VG_(args_for_client) ); i++) {
    434       argc++;
    435       stringsize += VG_(strlen)( * (HChar**)
    436                                    VG_(indexXA)( VG_(args_for_client), i ))
    437                     + 1;
    438    }
    439 
    440    /* ...and the environment */
    441    envc = 0;
    442    for (cpp = orig_envp; cpp && *cpp; cpp++) {
    443       envc++;
    444       stringsize += VG_(strlen)(*cpp) + 1;
    445    }
    446 
    447    /* now, how big is the auxv? */
    448    auxsize = sizeof(*auxv);	/* there's always at least one entry: AT_NULL */
    449    for (cauxv = orig_auxv; cauxv->a_type != AT_NULL; cauxv++) {
    450       if (cauxv->a_type == AT_PLATFORM ||
    451           cauxv->a_type == AT_BASE_PLATFORM)
    452 	 stringsize += VG_(strlen)(cauxv->u.a_ptr) + 1;
    453       else if (cauxv->a_type == AT_RANDOM)
    454 	 stringsize += 16;
    455       else if (cauxv->a_type == AT_EXECFN && have_exename)
    456 	 stringsize += VG_(strlen)(VG_(args_the_exename)) + 1;
    457       auxsize += sizeof(*cauxv);
    458    }
    459 
    460 #  if defined(VGP_ppc32_linux) || defined(VGP_ppc64_linux)
    461    auxsize += 2 * sizeof(*cauxv);
    462 #  endif
    463 
    464    /* OK, now we know how big the client stack is */
    465    stacksize =
    466       sizeof(Word) +                          /* argc */
    467       (have_exename ? sizeof(HChar **) : 0) + /* argc[0] == exename */
    468       sizeof(HChar **)*argc +                 /* argv */
    469       sizeof(HChar **) +                      /* terminal NULL */
    470       sizeof(HChar **)*envc +                 /* envp */
    471       sizeof(HChar **) +                      /* terminal NULL */
    472       auxsize +                               /* auxv */
    473       VG_ROUNDUP(stringsize, sizeof(Word));   /* strings (aligned) */
    474 
    475    if (0) VG_(printf)("stacksize = %d\n", stacksize);
    476 
    477    /* client_SP is the client's stack pointer */
    478    client_SP = clstack_end - stacksize;
    479    client_SP = VG_ROUNDDN(client_SP, 16); /* make stack 16 byte aligned */
    480 
    481    /* base of the string table (aligned) */
    482    stringbase = strtab = (HChar *)clstack_end
    483                          - VG_ROUNDUP(stringsize, sizeof(int));
    484 
    485    clstack_start = VG_PGROUNDDN(client_SP);
    486 
    487    /* The max stack size */
    488    clstack_max_size = VG_PGROUNDUP(clstack_max_size);
    489 
    490    if (0)
    491       VG_(printf)("stringsize=%d auxsize=%d stacksize=%d maxsize=0x%x\n"
    492                   "clstack_start %p\n"
    493                   "clstack_end   %p\n",
    494 	          stringsize, auxsize, stacksize, (Int)clstack_max_size,
    495                   (void*)clstack_start, (void*)clstack_end);
    496 
    497    /* ==================== allocate space ==================== */
    498 
    499    { SizeT anon_size   = clstack_end - clstack_start + 1;
    500      SizeT resvn_size  = clstack_max_size - anon_size;
    501      Addr  anon_start  = clstack_start;
    502      Addr  resvn_start = anon_start - resvn_size;
    503      SizeT inner_HACK  = 0;
    504      Bool  ok;
    505 
    506      /* So far we've only accounted for space requirements down to the
    507         stack pointer.  If this target's ABI requires a redzone below
    508         the stack pointer, we need to allocate an extra page, to
    509         handle the worst case in which the stack pointer is almost at
    510         the bottom of a page, and so there is insufficient room left
    511         over to put the redzone in.  In this case the simple thing to
    512         do is allocate an extra page, by shrinking the reservation by
    513         one page and growing the anonymous area by a corresponding
    514         page. */
    515      vg_assert(VG_STACK_REDZONE_SZB >= 0);
    516      vg_assert(VG_STACK_REDZONE_SZB < VKI_PAGE_SIZE);
    517      if (VG_STACK_REDZONE_SZB > 0) {
    518         vg_assert(resvn_size > VKI_PAGE_SIZE);
    519         resvn_size -= VKI_PAGE_SIZE;
    520         anon_start -= VKI_PAGE_SIZE;
    521         anon_size += VKI_PAGE_SIZE;
    522      }
    523 
    524      vg_assert(VG_IS_PAGE_ALIGNED(anon_size));
    525      vg_assert(VG_IS_PAGE_ALIGNED(resvn_size));
    526      vg_assert(VG_IS_PAGE_ALIGNED(anon_start));
    527      vg_assert(VG_IS_PAGE_ALIGNED(resvn_start));
    528      vg_assert(resvn_start == clstack_end + 1 - clstack_max_size);
    529 
    530 #    ifdef ENABLE_INNER
    531      inner_HACK = 1024*1024; // create 1M non-fault-extending stack
    532 #    endif
    533 
    534      if (0)
    535         VG_(printf)("%#lx 0x%lx  %#lx 0x%lx\n",
    536                     resvn_start, resvn_size, anon_start, anon_size);
    537 
    538      /* Create a shrinkable reservation followed by an anonymous
    539         segment.  Together these constitute a growdown stack. */
    540      res = VG_(mk_SysRes_Error)(0);
    541      ok = VG_(am_create_reservation)(
    542              resvn_start,
    543              resvn_size -inner_HACK,
    544              SmUpper,
    545              anon_size +inner_HACK
    546           );
    547      if (ok) {
    548         /* allocate a stack - mmap enough space for the stack */
    549         res = VG_(am_mmap_anon_fixed_client)(
    550                  anon_start -inner_HACK,
    551                  anon_size +inner_HACK,
    552 	         info->stack_prot
    553 	      );
    554      }
    555      if ((!ok) || sr_isError(res)) {
    556         /* Allocation of the stack failed.  We have to stop. */
    557         VG_(printf)("valgrind: "
    558                     "I failed to allocate space for the application's stack.\n");
    559         VG_(printf)("valgrind: "
    560                     "This may be the result of a very large --main-stacksize=\n");
    561         VG_(printf)("valgrind: setting.  Cannot continue.  Sorry.\n\n");
    562         VG_(exit)(0);
    563      }
    564 
    565      vg_assert(ok);
    566      vg_assert(!sr_isError(res));
    567 
    568      /* Record stack extent -- needed for stack-change code. */
    569      VG_(clstk_base) = anon_start -inner_HACK;
    570      VG_(clstk_end)  = VG_(clstk_base) + anon_size +inner_HACK -1;
    571 
    572    }
    573 
    574    /* ==================== create client stack ==================== */
    575 
    576    ptr = (Addr*)client_SP;
    577 
    578    /* --- client argc --- */
    579    *ptr++ = argc + (have_exename ? 1 : 0);
    580 
    581    /* --- client argv --- */
    582    if (info->interp_name) {
    583       *ptr++ = (Addr)copy_str(&strtab, info->interp_name);
    584       VG_(free)(info->interp_name);
    585    }
    586    if (info->interp_args) {
    587       *ptr++ = (Addr)copy_str(&strtab, info->interp_args);
    588       VG_(free)(info->interp_args);
    589    }
    590 
    591    if (have_exename)
    592       *ptr++ = (Addr)copy_str(&strtab, VG_(args_the_exename));
    593 
    594    for (i = 0; i < VG_(sizeXA)( VG_(args_for_client) ); i++) {
    595       *ptr++ = (Addr)copy_str(
    596                        &strtab,
    597                        * (HChar**) VG_(indexXA)( VG_(args_for_client), i )
    598                      );
    599    }
    600    *ptr++ = 0;
    601 
    602    /* --- envp --- */
    603    VG_(client_envp) = (HChar **)ptr;
    604    for (cpp = orig_envp; cpp && *cpp; ptr++, cpp++)
    605       *ptr = (Addr)copy_str(&strtab, *cpp);
    606    *ptr++ = 0;
    607 
    608    /* --- auxv --- */
    609    auxv = (struct auxv *)ptr;
    610    *client_auxv = (UInt *)auxv;
    611    VG_(client_auxv) = (UWord *)*client_auxv;
    612    // ??? According to 'man proc', auxv is a array of unsigned long
    613    // terminated by two zeros. Why is valgrind working with UInt ?
    614    // We do not take ULong* (as ULong 8 bytes on a 32 bits),
    615    // => we take UWord*
    616 
    617 #  if defined(VGP_ppc32_linux) || defined(VGP_ppc64_linux)
    618    auxv[0].a_type  = AT_IGNOREPPC;
    619    auxv[0].u.a_val = AT_IGNOREPPC;
    620    auxv[1].a_type  = AT_IGNOREPPC;
    621    auxv[1].u.a_val = AT_IGNOREPPC;
    622    auxv += 2;
    623 #  endif
    624 
    625    for (; orig_auxv->a_type != AT_NULL; auxv++, orig_auxv++) {
    626 
    627       /* copy the entry... */
    628       *auxv = *orig_auxv;
    629 
    630       /* ...and fix up / examine the copy */
    631       switch(auxv->a_type) {
    632 
    633          case AT_IGNORE:
    634          case AT_PHENT:
    635          case AT_PAGESZ:
    636          case AT_FLAGS:
    637          case AT_NOTELF:
    638          case AT_UID:
    639          case AT_EUID:
    640          case AT_GID:
    641          case AT_EGID:
    642          case AT_CLKTCK:
    643 #        if !defined(VGPV_arm_linux_android) \
    644             && !defined(VGPV_x86_linux_android) \
    645             && !defined(VGPV_mips32_linux_android) \
    646             && !defined(VGPV_arm64_linux_android)
    647          case AT_FPUCW: /* missing on android */
    648 #        endif
    649             /* All these are pointerless, so we don't need to do
    650                anything about them. */
    651             break;
    652 
    653          case AT_PHDR:
    654             if (info->phdr == 0)
    655                auxv->a_type = AT_IGNORE;
    656             else
    657                auxv->u.a_val = info->phdr;
    658             break;
    659 
    660          case AT_PHNUM:
    661             if (info->phdr == 0)
    662                auxv->a_type = AT_IGNORE;
    663             else
    664                auxv->u.a_val = info->phnum;
    665             break;
    666 
    667          case AT_BASE:
    668             auxv->u.a_val = info->interp_offset;
    669             break;
    670 
    671          case AT_PLATFORM:
    672          case AT_BASE_PLATFORM:
    673             /* points to a platform description string */
    674             auxv->u.a_ptr = copy_str(&strtab, orig_auxv->u.a_ptr);
    675             break;
    676 
    677          case AT_ENTRY:
    678             auxv->u.a_val = info->entry;
    679             break;
    680 
    681          case AT_HWCAP:
    682 #           if defined(VGP_arm_linux)
    683             { Bool has_neon = (auxv->u.a_val & VKI_HWCAP_NEON) > 0;
    684               VG_(debugLog)(2, "initimg",
    685                                "ARM has-neon from-auxv: %s\n",
    686                                has_neon ? "YES" : "NO");
    687               VG_(machine_arm_set_has_NEON)( has_neon );
    688               #define VKI_HWCAP_TLS 32768
    689               Bool has_tls = (auxv->u.a_val & VKI_HWCAP_TLS) > 0;
    690               VG_(debugLog)(2, "initimg",
    691                                "ARM has-tls from-auxv: %s\n",
    692                                has_tls ? "YES" : "NO");
    693               /* If real hw sets properly HWCAP_TLS, we might
    694                  use this info to decide to really execute set_tls syscall
    695                  in syswrap-arm-linux.c rather than to base this on
    696                  conditional compilation. */
    697             }
    698 #           endif
    699             break;
    700 
    701          case AT_ICACHEBSIZE:
    702          case AT_UCACHEBSIZE:
    703 #           if defined(VGP_ppc32_linux)
    704             /* acquire cache info */
    705             if (auxv->u.a_val > 0) {
    706                VG_(machine_ppc32_set_clszB)( auxv->u.a_val );
    707                VG_(debugLog)(2, "initimg",
    708                                 "PPC32 icache line size %u (type %u)\n",
    709                                 (UInt)auxv->u.a_val, (UInt)auxv->a_type );
    710             }
    711 #           elif defined(VGP_ppc64_linux)
    712             /* acquire cache info */
    713             if (auxv->u.a_val > 0) {
    714                VG_(machine_ppc64_set_clszB)( auxv->u.a_val );
    715                VG_(debugLog)(2, "initimg",
    716                                 "PPC64 icache line size %u (type %u)\n",
    717                                 (UInt)auxv->u.a_val, (UInt)auxv->a_type );
    718             }
    719 #           endif
    720             break;
    721 
    722 #        if defined(VGP_ppc32_linux) || defined(VGP_ppc64_linux)
    723          case AT_IGNOREPPC:
    724             break;
    725 #        endif
    726 
    727          case AT_SECURE:
    728             /* If this is 1, then it means that this program is
    729                running suid, and therefore the dynamic linker should
    730                be careful about LD_PRELOAD, etc.  However, since
    731                stage1 (the thing the kernel actually execve's) should
    732                never be SUID, and we need LD_PRELOAD to work for the
    733                client, we set AT_SECURE to 0. */
    734             auxv->u.a_val = 0;
    735             break;
    736 
    737          case AT_SYSINFO:
    738             /* Trash this, because we don't reproduce it */
    739             auxv->a_type = AT_IGNORE;
    740             break;
    741 
    742 #        if !defined(VGP_ppc32_linux) && !defined(VGP_ppc64_linux)
    743          case AT_SYSINFO_EHDR: {
    744             /* Trash this, because we don't reproduce it */
    745             const NSegment* ehdrseg = VG_(am_find_nsegment)((Addr)auxv->u.a_ptr);
    746             vg_assert(ehdrseg);
    747             VG_(am_munmap_valgrind)(ehdrseg->start, ehdrseg->end - ehdrseg->start);
    748             auxv->a_type = AT_IGNORE;
    749             break;
    750          }
    751 #        endif
    752 
    753          case AT_RANDOM:
    754             /* points to 16 random bytes - we need to ensure this is
    755                propagated to the client as glibc will assume it is
    756                present if it is built for kernel 2.6.29 or later */
    757             auxv->u.a_ptr = strtab;
    758             VG_(memcpy)(strtab, orig_auxv->u.a_ptr, 16);
    759             strtab += 16;
    760             break;
    761 
    762          case AT_EXECFN:
    763             /* points to the executable filename */
    764             auxv->u.a_ptr = copy_str(&strtab, VG_(args_the_exename));
    765             break;
    766 
    767          default:
    768             /* stomp out anything we don't know about */
    769             VG_(debugLog)(2, "initimg",
    770                              "stomping auxv entry %lld\n",
    771                              (ULong)auxv->a_type);
    772             auxv->a_type = AT_IGNORE;
    773             break;
    774       }
    775    }
    776    *auxv = *orig_auxv;
    777    vg_assert(auxv->a_type == AT_NULL);
    778 
    779    vg_assert((strtab-stringbase) == stringsize);
    780 
    781    /* client_SP is pointing at client's argc/argv */
    782 
    783    if (0) VG_(printf)("startup SP = %#lx\n", client_SP);
    784    return client_SP;
    785 }
    786 
    787 
    788 /* Allocate the client data segment.  It is an expandable anonymous
    789    mapping abutting a shrinkable reservation of size max_dseg_size.
    790    The data segment starts at VG_(brk_base), which is page-aligned,
    791    and runs up to VG_(brk_limit), which isn't. */
    792 
    793 static void setup_client_dataseg ( SizeT max_size )
    794 {
    795    Bool   ok;
    796    SysRes sres;
    797    Addr   anon_start  = VG_(brk_base);
    798    SizeT  anon_size   = VKI_PAGE_SIZE;
    799    Addr   resvn_start = anon_start + anon_size;
    800    SizeT  resvn_size  = max_size - anon_size;
    801 
    802    vg_assert(VG_IS_PAGE_ALIGNED(anon_size));
    803    vg_assert(VG_IS_PAGE_ALIGNED(resvn_size));
    804    vg_assert(VG_IS_PAGE_ALIGNED(anon_start));
    805    vg_assert(VG_IS_PAGE_ALIGNED(resvn_start));
    806 
    807    /* Because there's been no brk activity yet: */
    808    vg_assert(VG_(brk_base) == VG_(brk_limit));
    809 
    810    /* Try to create the data seg and associated reservation where
    811       VG_(brk_base) says. */
    812    ok = VG_(am_create_reservation)(
    813            resvn_start,
    814            resvn_size,
    815            SmLower,
    816            anon_size
    817         );
    818 
    819    if (!ok) {
    820       /* Hmm, that didn't work.  Well, let aspacem suggest an address
    821          it likes better, and try again with that. */
    822       anon_start = VG_(am_get_advisory_client_simple)
    823                       ( 0/*floating*/, anon_size+resvn_size, &ok );
    824       if (ok) {
    825          resvn_start = anon_start + anon_size;
    826          ok = VG_(am_create_reservation)(
    827                  resvn_start,
    828                  resvn_size,
    829                  SmLower,
    830                  anon_size
    831               );
    832          if (ok)
    833             VG_(brk_base) = VG_(brk_limit) = anon_start;
    834       }
    835       /* that too might have failed, but if it has, we're hosed: there
    836          is no Plan C. */
    837    }
    838    vg_assert(ok);
    839 
    840    /* We make the data segment (heap) executable because LinuxThreads on
    841       ppc32 creates trampolines in this area.  Also, on x86/Linux the data
    842       segment is RWX natively, at least according to /proc/self/maps.
    843       Also, having a non-executable data seg would kill any program which
    844       tried to create code in the data seg and then run it. */
    845    sres = VG_(am_mmap_anon_fixed_client)(
    846              anon_start,
    847              anon_size,
    848              VKI_PROT_READ|VKI_PROT_WRITE|VKI_PROT_EXEC
    849           );
    850    vg_assert(!sr_isError(sres));
    851    vg_assert(sr_Res(sres) == anon_start);
    852 }
    853 
    854 
    855 /*====================================================================*/
    856 /*=== TOP-LEVEL: VG_(setup_client_initial_image)                   ===*/
    857 /*====================================================================*/
    858 
    859 /* Create the client's initial memory image. */
    860 IIFinaliseImageInfo VG_(ii_create_image)( IICreateImageInfo iicii )
    861 {
    862    ExeInfo info;
    863    HChar** env = NULL;
    864 
    865    IIFinaliseImageInfo iifii;
    866    VG_(memset)( &iifii, 0, sizeof(iifii) );
    867 
    868    //--------------------------------------------------------------
    869    // Load client executable, finding in $PATH if necessary
    870    //   p: get_helprequest_and_toolname()  [for 'exec', 'need_help']
    871    //   p: layout_remaining_space          [so there's space]
    872    //--------------------------------------------------------------
    873    VG_(debugLog)(1, "initimg", "Loading client\n");
    874 
    875    if (VG_(args_the_exename) == NULL)
    876       VG_(err_missing_prog)();
    877 
    878    load_client(&info, &iifii.initial_client_IP, &iifii.initial_client_TOC);
    879 
    880    //--------------------------------------------------------------
    881    // Set up client's environment
    882    //   p: set-libdir                   [for VG_(libdir)]
    883    //   p: get_helprequest_and_toolname [for toolname]
    884    //--------------------------------------------------------------
    885    VG_(debugLog)(1, "initimg", "Setup client env\n");
    886    env = setup_client_env(iicii.envp, iicii.toolname);
    887 
    888    //--------------------------------------------------------------
    889    // Setup client stack, eip, and VG_(client_arg[cv])
    890    //   p: load_client()     [for 'info']
    891    //   p: fix_environment() [for 'env']
    892    //--------------------------------------------------------------
    893    {
    894       /* When allocating space for the client stack on Linux, take
    895          notice of the --main-stacksize value.  This makes it possible
    896          to run programs with very large (primary) stack requirements
    897          simply by specifying --main-stacksize. */
    898       /* Logic is as follows:
    899          - by default, use the client's current stack rlimit
    900          - if that exceeds 16M, clamp to 16M
    901          - if a larger --main-stacksize value is specified, use that instead
    902          - in all situations, the minimum allowed stack size is 1M
    903       */
    904       void* init_sp = iicii.argv - 1;
    905       SizeT m1  = 1024 * 1024;
    906       SizeT m16 = 16 * m1;
    907       SizeT szB = (SizeT)VG_(client_rlimit_stack).rlim_cur;
    908       if (szB < m1) szB = m1;
    909       if (szB > m16) szB = m16;
    910       if (VG_(clo_main_stacksize) > 0) szB = VG_(clo_main_stacksize);
    911       if (szB < m1) szB = m1;
    912       szB = VG_PGROUNDUP(szB);
    913       VG_(debugLog)(1, "initimg",
    914                        "Setup client stack: size will be %ld\n", szB);
    915 
    916       iifii.clstack_max_size = szB;
    917 
    918       iifii.initial_client_SP
    919          = setup_client_stack( init_sp, env,
    920                                &info, &iifii.client_auxv,
    921                                iicii.clstack_top, iifii.clstack_max_size );
    922 
    923       VG_(free)(env);
    924 
    925       VG_(debugLog)(2, "initimg",
    926                        "Client info: "
    927                        "initial_IP=%p initial_TOC=%p brk_base=%p\n",
    928                        (void*)(iifii.initial_client_IP),
    929                        (void*)(iifii.initial_client_TOC),
    930                        (void*)VG_(brk_base) );
    931       VG_(debugLog)(2, "initimg",
    932                        "Client info: "
    933                        "initial_SP=%p max_stack_size=%ld\n",
    934                        (void*)(iifii.initial_client_SP),
    935                        (SizeT)iifii.clstack_max_size );
    936    }
    937 
    938    //--------------------------------------------------------------
    939    // Setup client data (brk) segment.  Initially a 1-page segment
    940    // which abuts a shrinkable reservation.
    941    //     p: load_client()     [for 'info' and hence VG_(brk_base)]
    942    //--------------------------------------------------------------
    943    {
    944       SizeT m1 = 1024 * 1024;
    945       SizeT m8 = 8 * m1;
    946       SizeT dseg_max_size = (SizeT)VG_(client_rlimit_data).rlim_cur;
    947       VG_(debugLog)(1, "initimg", "Setup client data (brk) segment\n");
    948       if (dseg_max_size < m1) dseg_max_size = m1;
    949       if (dseg_max_size > m8) dseg_max_size = m8;
    950       dseg_max_size = VG_PGROUNDUP(dseg_max_size);
    951 
    952       setup_client_dataseg( dseg_max_size );
    953    }
    954 
    955    return iifii;
    956 }
    957 
    958 
    959 /*====================================================================*/
    960 /*=== TOP-LEVEL: VG_(finalise_thread1state)                        ===*/
    961 /*====================================================================*/
    962 
    963 /* Just before starting the client, we may need to make final
    964    adjustments to its initial image.  Also we need to set up the VEX
    965    guest state for thread 1 (the root thread) and copy in essential
    966    starting values.  This is handed the IIFinaliseImageInfo created by
    967    VG_(ii_create_image).
    968 */
    969 void VG_(ii_finalise_image)( IIFinaliseImageInfo iifii )
    970 {
    971    ThreadArchState* arch = &VG_(threads)[1].arch;
    972 
    973    /* On Linux we get client_{ip/sp/toc}, and start the client with
    974       all other registers zeroed. */
    975 
    976 #  if defined(VGP_x86_linux)
    977    vg_assert(0 == sizeof(VexGuestX86State) % 16);
    978 
    979    /* Zero out the initial state, and set up the simulated FPU in a
    980       sane way. */
    981    LibVEX_GuestX86_initialise(&arch->vex);
    982 
    983    /* Zero out the shadow areas. */
    984    VG_(memset)(&arch->vex_shadow1, 0, sizeof(VexGuestX86State));
    985    VG_(memset)(&arch->vex_shadow2, 0, sizeof(VexGuestX86State));
    986 
    987    /* Put essential stuff into the new state. */
    988    arch->vex.guest_ESP = iifii.initial_client_SP;
    989    arch->vex.guest_EIP = iifii.initial_client_IP;
    990 
    991    /* initialise %cs, %ds and %ss to point at the operating systems
    992       default code, data and stack segments.  Also %es (see #291253). */
    993    asm volatile("movw %%cs, %0" : : "m" (arch->vex.guest_CS));
    994    asm volatile("movw %%ds, %0" : : "m" (arch->vex.guest_DS));
    995    asm volatile("movw %%ss, %0" : : "m" (arch->vex.guest_SS));
    996    asm volatile("movw %%es, %0" : : "m" (arch->vex.guest_ES));
    997 
    998 #  elif defined(VGP_amd64_linux)
    999    vg_assert(0 == sizeof(VexGuestAMD64State) % 16);
   1000 
   1001    /* Zero out the initial state, and set up the simulated FPU in a
   1002       sane way. */
   1003    LibVEX_GuestAMD64_initialise(&arch->vex);
   1004 
   1005    /* Zero out the shadow areas. */
   1006    VG_(memset)(&arch->vex_shadow1, 0, sizeof(VexGuestAMD64State));
   1007    VG_(memset)(&arch->vex_shadow2, 0, sizeof(VexGuestAMD64State));
   1008 
   1009    /* Put essential stuff into the new state. */
   1010    arch->vex.guest_RSP = iifii.initial_client_SP;
   1011    arch->vex.guest_RIP = iifii.initial_client_IP;
   1012 
   1013 #  elif defined(VGP_ppc32_linux)
   1014    vg_assert(0 == sizeof(VexGuestPPC32State) % 16);
   1015 
   1016    /* Zero out the initial state, and set up the simulated FPU in a
   1017       sane way. */
   1018    LibVEX_GuestPPC32_initialise(&arch->vex);
   1019 
   1020    /* Zero out the shadow areas. */
   1021    VG_(memset)(&arch->vex_shadow1, 0, sizeof(VexGuestPPC32State));
   1022    VG_(memset)(&arch->vex_shadow2, 0, sizeof(VexGuestPPC32State));
   1023 
   1024    /* Put essential stuff into the new state. */
   1025    arch->vex.guest_GPR1 = iifii.initial_client_SP;
   1026    arch->vex.guest_CIA  = iifii.initial_client_IP;
   1027 
   1028 #  elif defined(VGP_ppc64_linux)
   1029    vg_assert(0 == sizeof(VexGuestPPC64State) % 16);
   1030 
   1031    /* Zero out the initial state, and set up the simulated FPU in a
   1032       sane way. */
   1033    LibVEX_GuestPPC64_initialise(&arch->vex);
   1034 
   1035    /* Zero out the shadow areas. */
   1036    VG_(memset)(&arch->vex_shadow1, 0, sizeof(VexGuestPPC64State));
   1037    VG_(memset)(&arch->vex_shadow2, 0, sizeof(VexGuestPPC64State));
   1038 
   1039    /* Put essential stuff into the new state. */
   1040    arch->vex.guest_GPR1 = iifii.initial_client_SP;
   1041    arch->vex.guest_GPR2 = iifii.initial_client_TOC;
   1042    arch->vex.guest_CIA  = iifii.initial_client_IP;
   1043 
   1044 #  elif defined(VGP_arm_linux)
   1045    /* Zero out the initial state, and set up the simulated FPU in a
   1046       sane way. */
   1047    LibVEX_GuestARM_initialise(&arch->vex);
   1048 
   1049    /* Zero out the shadow areas. */
   1050    VG_(memset)(&arch->vex_shadow1, 0, sizeof(VexGuestARMState));
   1051    VG_(memset)(&arch->vex_shadow2, 0, sizeof(VexGuestARMState));
   1052 
   1053    arch->vex.guest_R13  = iifii.initial_client_SP;
   1054    arch->vex.guest_R15T = iifii.initial_client_IP;
   1055 
   1056    /* This is just EABI stuff. */
   1057    // FIXME jrs: what's this for?
   1058    arch->vex.guest_R1 =  iifii.initial_client_SP;
   1059 
   1060 #  elif defined(VGP_arm64_linux)
   1061    /* Zero out the initial state. */
   1062    LibVEX_GuestARM64_initialise(&arch->vex);
   1063 
   1064    /* Zero out the shadow areas. */
   1065    VG_(memset)(&arch->vex_shadow1, 0, sizeof(VexGuestARM64State));
   1066    VG_(memset)(&arch->vex_shadow2, 0, sizeof(VexGuestARM64State));
   1067 
   1068    arch->vex.guest_XSP = iifii.initial_client_SP;
   1069    arch->vex.guest_PC  = iifii.initial_client_IP;
   1070 
   1071 #  elif defined(VGP_s390x_linux)
   1072    vg_assert(0 == sizeof(VexGuestS390XState) % 16);
   1073 
   1074    /* Zero out the initial state. This also sets the guest_fpc to 0, which
   1075       is also done by the kernel for the fpc during execve. */
   1076    LibVEX_GuestS390X_initialise(&arch->vex);
   1077 
   1078    /* Mark all registers as undefined ... */
   1079    VG_(memset)(&arch->vex_shadow1, 0xFF, sizeof(VexGuestS390XState));
   1080    VG_(memset)(&arch->vex_shadow2, 0x00, sizeof(VexGuestS390XState));
   1081    /* ... except SP, FPC, and IA */
   1082    arch->vex_shadow1.guest_SP = 0;
   1083    arch->vex_shadow1.guest_fpc = 0;
   1084    arch->vex_shadow1.guest_IA = 0;
   1085 
   1086    /* Put essential stuff into the new state. */
   1087    arch->vex.guest_SP = iifii.initial_client_SP;
   1088    arch->vex.guest_IA = iifii.initial_client_IP;
   1089    /* See sys_execve in <linux>/arch/s390/kernel/process.c */
   1090    arch->vex.guest_fpc = 0;
   1091 
   1092    /* Tell the tool about the registers we just wrote */
   1093    VG_TRACK(post_reg_write, Vg_CoreStartup, /*tid*/1, VG_O_STACK_PTR, 8);
   1094    VG_TRACK(post_reg_write, Vg_CoreStartup, /*tid*/1, VG_O_FPC_REG,   4);
   1095    VG_TRACK(post_reg_write, Vg_CoreStartup, /*tid*/1, VG_O_INSTR_PTR, 8);
   1096    return;
   1097 
   1098 #  elif defined(VGP_mips32_linux)
   1099    vg_assert(0 == sizeof(VexGuestMIPS32State) % 16);
   1100    /* Zero out the initial state, and set up the simulated FPU in a
   1101       sane way. */
   1102    LibVEX_GuestMIPS32_initialise(&arch->vex);
   1103 
   1104    /* Zero out the shadow areas. */
   1105    VG_(memset)(&arch->vex_shadow1, 0, sizeof(VexGuestMIPS32State));
   1106    VG_(memset)(&arch->vex_shadow2, 0, sizeof(VexGuestMIPS32State));
   1107 
   1108    arch->vex.guest_r29 = iifii.initial_client_SP;
   1109    arch->vex.guest_PC = iifii.initial_client_IP;
   1110    arch->vex.guest_r31 = iifii.initial_client_SP;
   1111 
   1112 #   elif defined(VGP_mips64_linux)
   1113    vg_assert(0 == sizeof(VexGuestMIPS64State) % 16);
   1114    /* Zero out the initial state, and set up the simulated FPU in a
   1115       sane way. */
   1116    LibVEX_GuestMIPS64_initialise(&arch->vex);
   1117 
   1118    /* Zero out the shadow areas. */
   1119    VG_(memset)(&arch->vex_shadow1, 0, sizeof(VexGuestMIPS64State));
   1120    VG_(memset)(&arch->vex_shadow2, 0, sizeof(VexGuestMIPS64State));
   1121 
   1122    arch->vex.guest_r29 = iifii.initial_client_SP;
   1123    arch->vex.guest_PC = iifii.initial_client_IP;
   1124    arch->vex.guest_r31 = iifii.initial_client_SP;
   1125 
   1126 #  else
   1127 #    error Unknown platform
   1128 #  endif
   1129 
   1130    /* Tell the tool that we just wrote to the registers. */
   1131    VG_TRACK( post_reg_write, Vg_CoreStartup, /*tid*/1, /*offset*/0,
   1132              sizeof(VexGuestArchState));
   1133 }
   1134 
   1135 #endif // defined(VGO_linux)
   1136 
   1137 /*--------------------------------------------------------------------*/
   1138 /*---                                                              ---*/
   1139 /*--------------------------------------------------------------------*/
   1140