+Copyright (C) 1985-1987, 1993-1995, 1997-1999, 2001-2022 Free Software

+#include <sys/stat.h>

+#include <filename.h> /* for IS_ABSOLUTE_FILE_NAME */

+#if defined HAVE_LINUX_SECCOMP_H && defined HAVE_LINUX_FILTER_H \

+ && HAVE_DECL_SECCOMP_SET_MODE_FILTER \

+ && HAVE_DECL_SECCOMP_FILTER_FLAG_TSYNC

+# define SECCOMP_USABLE 1

+#else

+# define SECCOMP_USABLE 0

+#endif

+

+#if SECCOMP_USABLE

+# include <linux/seccomp.h>

+# include <linux/filter.h>

+# include <sys/prctl.h>

+# include <sys/syscall.h>

+#endif

+

+#include "bignum.h"

+#include "regex-emacs.h"

+#ifdef HAVE_HAIKU

+#include <kernel/OS.h>

+#endif

+

+#ifdef PROFILING

+# ifdef __MINGW32__

+extern unsigned char etext asm ("etext");

+# else

+extern char etext;

+# endif

+#include "pdumper.h"

+#include "fingerprint.h"

+#include "epaths.h"

+

+/* Include these only because of INLINE. */

+#include "comp.h"

+#include "thread.h"

+

+/* Put version info into the executable in the form that 'ident' uses. */

+char const EXTERNALLY_VISIBLE RCS_Id[]

+ = "$Id" ": GNU Emacs " PACKAGE_VERSION

+ " (" EMACS_CONFIGURATION " " EMACS_CONFIG_FEATURES ") $";

+

+/* Original command line string as received from the OS. */

+static char *initial_cmdline;

+/* Original working directory when invoked. */

+static const char *initial_wd;

+struct gflags gflags;

+#if defined GNU_LINUX && defined HAVE_UNEXEC

+static uintmax_t heap_bss_diff;

+ On Cocoa, CoreFoundation lib fails in forked process, see Mac OS X

+ Leopard Developer Release Notes for CoreFoundation Framework:

+

+ https://web.archive.org/web/20090225231934/http://developer.apple.com/ReleaseNotes/CoreFoundation/CoreFoundation.html

+ NAME is the original daemon name, if any.

+

+ On Haiku, the table of semaphores used for looper locks doesn't

+ persist across forked processes. */

+#if defined NS_IMPL_COCOA || defined CYGWIN || defined HAVE_HAIKU

+/* 0 not a daemon, 1 new-style (foreground), 2 old-style (background).

+ A negative value means the daemon initialization was already done. */

+static char *initial_emacs_executable = NULL;

+

+/* The name of the working directory, or NULL if this info is unavailable. */

+char const *emacs_wd;

+#ifdef HAVE_PDUMPER

+ "\

+--dump-file FILE read dumped state from FILE\n\

+--fingerprint output fingerprint and exit\n\

+",

+#endif

+#if SECCOMP_USABLE

+ "\

+--seccomp=FILE read Seccomp BPF filter from FILE\n\

+"

+#endif

+-x to be used in #!/usr/bin/emacs -x\n\

+ and has approximately the same meaning\n\

+ as -Q --script\n\

+/* NS autorelease pool, for memory management. */

+ /* We don't want to compile in mbrtowc on WINDOWSNT because that

+ will prevent Emacs from starting on older Windows systems, while

+ the result is known in advance anyway... */

+#if defined HAVE_WCHAR_H && !defined WINDOWSNT

+AVOID

+ {

+ /* Avoid abort in shut_down_emacs if we were interrupted

+ by SIGINT in noninteractive usage, as in that case we

+ don't care about the message stack. */

+ if (sig == SIGINT && noninteractive)

+ clear_message_stack ();

+ Fkill_emacs (make_fixnum (sig), Qnil);

+ }

+

+init_cmdargs (int argc, char **argv, int skip_args, char const *original_pwd)

+ specpdl_ref count = SPECPDL_INDEX ();

+ int yes = openp (Vexec_path, Vinvocation_name, Vexec_suffixes,

+ &found, make_fixnum (X_OK), false, false);

+ {

+ if (NILP (Vpurify_flag))

+ {

+ Lisp_Object file_truename = intern ("file-truename");

+ if (!NILP (Ffboundp (file_truename)))

+ dir = call1 (file_truename, dir);

+ }

+ dir = Fexpand_file_name (build_string ("../.."), dir);

+ }

+ Vinstallation_directory = Ffile_name_as_directory (dir);

+ Vinstallation_directory = Ffile_name_as_directory (tem);

+ if (!lstr)

+ return 0;

+ if (arglen < minlen || strncmp (arg, lstr, arglen) != 0)

+/* Find a name (absolute or relative) of the Emacs executable whose

+ name (as passed into this program) is ARGV0. Called early in

+ initialization by portable dumper loading code, so avoid Lisp and

+ associated machinery. Return a heap-allocated string giving a name

+ of the Emacs executable, or an empty heap-allocated string or NULL

+ if not found. Store into *CANDIDATE_SIZE a lower bound on the size

+ of any heap allocation. */

+static char *

+find_emacs_executable (char const *argv0, ptrdiff_t *candidate_size)

+ *candidate_size = 0;

+

+ /* Use xstrdup etc. to allocate storage, so as to call our private

+ implementation of malloc, since the caller calls our free. */

+#ifdef WINDOWSNT

+ char *prog_fname = w32_my_exename ();

+ if (prog_fname)

+ *candidate_size = strlen (prog_fname) + 1;

+ return prog_fname ? xstrdup (prog_fname) : NULL;

+#else /* !WINDOWSNT */

+ char *candidate = NULL;

+

+ /* If the executable name contains a slash, we have some kind of

+ path already, so just resolve symlinks and return the result. */

+ eassert (argv0);

+ if (strchr (argv0, DIRECTORY_SEP))

+ char *real_name = realpath (argv0, NULL);

+

+ if (real_name)

+ {

+ *candidate_size = strlen (real_name) + 1;

+ return real_name;

+ }

+

+ char *val = xstrdup (argv0);

+ *candidate_size = strlen (val) + 1;

+ return val;

+ }

+ ptrdiff_t argv0_length = strlen (argv0);

+

+ const char *path = getenv ("PATH");

+ if (!path)

+ {

+ /* Default PATH is implementation-defined, so we don't know how

+ to conduct the search. */

+ return NULL;

+ }

+

+ /* Actually try each concatenation of a path element and the

+ executable basename. */

+ do

+ {

+ static char const path_sep[] = { SEPCHAR, '\0' };

+ ptrdiff_t path_part_length = strcspn (path, path_sep);

+ const char *path_part = path;

+ path += path_part_length;

+ if (path_part_length == 0)

+ {

+ path_part = ".";

+ path_part_length = 1;

+ }

+ ptrdiff_t needed = path_part_length + 1 + argv0_length + 1;

+ if (*candidate_size <= needed)

+ {

+ xfree (candidate);

+ candidate = xpalloc (NULL, candidate_size,

+ needed - *candidate_size + 1, -1, 1);

+ }

+ memcpy (candidate + 0, path_part, path_part_length);

+ candidate[path_part_length] = DIRECTORY_SEP;

+ memcpy (candidate + path_part_length + 1, argv0, argv0_length + 1);

+ struct stat st;

+ if (file_access_p (candidate, X_OK)

+ && stat (candidate, &st) == 0 && S_ISREG (st.st_mode))

+ {

+ /* People put on PATH a symlink to the real Emacs

+ executable, with all the auxiliary files where the real

+ executable lives. Support that. */

+ if (lstat (candidate, &st) == 0 && S_ISLNK (st.st_mode))

+ {

+ char *real_name = realpath (candidate, NULL);

+

+ if (real_name)

+ {

+ *candidate_size = strlen (real_name) + 1;

+ return real_name;

+ }

+ }

+ return candidate;

+ }

+ *candidate = '\0';

+ while (*path++ != '\0');

+

+ return candidate;

+#endif /* !WINDOWSNT */

+}

+#ifdef HAVE_PDUMPER

+

+static const char *

+dump_error_to_string (int result)

+{

+ switch (result)

+ {

+ case PDUMPER_LOAD_SUCCESS:

+ return "success";

+ case PDUMPER_LOAD_OOM:

+ return "out of memory";

+ case PDUMPER_NOT_LOADED:

+ return "not loaded";

+ case PDUMPER_LOAD_FILE_NOT_FOUND:

+ return "could not open file";

+ case PDUMPER_LOAD_BAD_FILE_TYPE:

+ return "not a dump file";

+ case PDUMPER_LOAD_FAILED_DUMP:

+ return "dump file is result of failed dump attempt";

+ case PDUMPER_LOAD_VERSION_MISMATCH:

+ return "not built for this Emacs executable";

+ default:

+ return (result <= PDUMPER_LOAD_ERROR

+ ? "generic error"

+ : strerror (result - PDUMPER_LOAD_ERROR));

+ }

+/* This function returns the Emacs executable. */

+static char *

+load_pdump (int argc, char **argv)

+{

+ const char *const suffix = ".pdmp";

+ int result;

+ char *emacs_executable = argv[0];

+ ptrdiff_t hexbuf_size;

+ char *hexbuf;

+ const char *strip_suffix =

+#if defined DOS_NT || defined CYGWIN

+ ".exe"

+#else

+ NULL

+#endif

+ ;

+ const char *argv0_base =

+#ifdef NS_SELF_CONTAINED

+ "Emacs"

+#else

+ "emacs"

+#endif

+ ;

+

+ /* TODO: maybe more thoroughly scrub process environment in order to

+ make this use case (loading a dump file in an unexeced emacs)

+ possible? Right now, we assume that things we don't touch are

+ zero-initialized, and in an unexeced Emacs, this assumption

+ doesn't hold. */

+ if (initialized)

+ fatal ("cannot load dump file in unexeced Emacs");

+

+ /* Look for an explicitly-specified dump file. */

+ const char *path_exec = PATH_EXEC;

+ char *dump_file = NULL;

+ int skip_args = 0;

+ while (skip_args < argc - 1)

+ {

+ if (argmatch (argv, argc, "-dump-file", "--dump-file", 6,

+ &dump_file, &skip_args)

+ || argmatch (argv, argc, "--", NULL, 2, NULL, &skip_args))

+ break;

+ skip_args++;

+ }

+

+ /* Where's our executable? */

+ ptrdiff_t bufsize;

+#ifndef NS_SELF_CONTAINED

+ ptrdiff_t exec_bufsize;

+#endif

+ emacs_executable = find_emacs_executable (argv[0], &bufsize);

+#ifndef NS_SELF_CONTAINED

+ exec_bufsize = bufsize;

+#endif

+

+ /* If we couldn't find our executable, go straight to looking for

+ the dump in the hardcoded location. */

+ if (!(emacs_executable && *emacs_executable))

+ goto hardcoded;

+

+ if (dump_file)

+ {

+ result = pdumper_load (dump_file, emacs_executable);

+

+ if (result != PDUMPER_LOAD_SUCCESS)

+ fatal ("could not load dump file \"%s\": %s",

+ dump_file, dump_error_to_string (result));

+ return emacs_executable;

+ }

+

+ /* Look for a dump file in the same directory as the executable; it

+ should have the same basename. Take care to search PATH to find

+ the executable if needed. We're too early in init to use Lisp,

+ so we can't use decode_env_path. We're working in whatever

+ encoding the system natively uses for filesystem access, so

+ there's no need for character set conversion. */

+ ptrdiff_t exenamelen = strlen (emacs_executable);

+ if (strip_suffix)

+ {

+ ptrdiff_t strip_suffix_length = strlen (strip_suffix);

+ ptrdiff_t prefix_length = exenamelen - strip_suffix_length;

+ if (0 <= prefix_length

+ && !memcmp (&emacs_executable[prefix_length], strip_suffix,

+ strip_suffix_length))

+ exenamelen = prefix_length;

+ }

+ ptrdiff_t needed = exenamelen + strlen (suffix) + 1;

+ dump_file = xpalloc (NULL, &bufsize, needed - bufsize, -1, 1);

+ memcpy (dump_file, emacs_executable, exenamelen);

+ strcpy (dump_file + exenamelen, suffix);

+ result = pdumper_load (dump_file, emacs_executable);

+ if (result == PDUMPER_LOAD_SUCCESS)

+ goto out;

+

+ if (result != PDUMPER_LOAD_FILE_NOT_FOUND)

+ fatal ("could not load dump file \"%s\": %s",

+ dump_file, dump_error_to_string (result));

+

+ hardcoded:

+

+#ifdef WINDOWSNT

+ /* On MS-Windows, PATH_EXEC normally starts with a literal

+ "%emacs_dir%", so it will never work without some tweaking. */

+ path_exec = w32_relocate (path_exec);

+#elif defined (HAVE_NS)

+ path_exec = ns_relocate (path_exec);

+#endif

+

+ /* Look for "emacs-FINGERPRINT.pdmp" in PATH_EXEC. We hardcode

+ "emacs" in "emacs-FINGERPRINT.pdmp" so that the Emacs binary

+ still works if the user copies and renames it. */

+ hexbuf_size = 2 * sizeof fingerprint;

+ hexbuf = xmalloc (hexbuf_size + 1);

+ hexbuf_digest (hexbuf, (char *) fingerprint, sizeof fingerprint);

+ hexbuf[hexbuf_size] = '\0';

+ needed = (strlen (path_exec)

+ + 1

+ + strlen (argv0_base)

+ + 1

+ + strlen (hexbuf)

+ + strlen (suffix)

+ + 1);

+ if (bufsize < needed)

+ {

+ xfree (dump_file);

+ dump_file = xpalloc (NULL, &bufsize, needed - bufsize, -1, 1);

+ }

+ sprintf (dump_file, "%s%c%s-%s%s",

+ path_exec, DIRECTORY_SEP, argv0_base, hexbuf, suffix);

+#if !defined (NS_SELF_CONTAINED)

+ if (!(emacs_executable && *emacs_executable))

+ {

+ /* If we didn't find the Emacs binary, assume that it lives in a

+ sibling directory as set up by the default installation

+ configuration. */

+ const char *go_up = "../../../../bin/";

+ needed += (strip_suffix ? strlen (strip_suffix) : 0)

+ - strlen (suffix) + strlen (go_up);

+ if (exec_bufsize < needed)

+ {

+ xfree (emacs_executable);

+ emacs_executable = xpalloc (NULL, &exec_bufsize,

+ needed - exec_bufsize, -1, 1);

+ }

+ sprintf (emacs_executable, "%s%c%s%s%s",

+ path_exec, DIRECTORY_SEP, go_up, argv0_base,

+ strip_suffix ? strip_suffix : "");

+ }

+#endif

+ result = pdumper_load (dump_file, emacs_executable);

+

+ if (result == PDUMPER_LOAD_FILE_NOT_FOUND)

+ {

+ /* Finally, look for basename(argv0)+".pdmp" in PATH_EXEC.

+ This way, they can rename both the executable and its pdump

+ file in PATH_EXEC, and have several Emacs configurations in

+ the same versioned libexec subdirectory. */

+ char *p, *last_sep = NULL;

+ for (p = argv[0]; *p; p++)

+ {

+ if (IS_DIRECTORY_SEP (*p))

+ last_sep = p;

+ }

+ argv0_base = last_sep ? last_sep + 1 : argv[0];

+ ptrdiff_t needed = (strlen (path_exec)

+ + 1

+ + strlen (argv0_base)

+ + strlen (suffix)

+ + 1);

+ if (bufsize < needed)

+ {

+ xfree (dump_file);

+ dump_file = xmalloc (needed);

+ }

+#ifdef DOS_NT

+ ptrdiff_t argv0_len = strlen (argv0_base);

+ if (argv0_len >= 4

+ && c_strcasecmp (argv0_base + argv0_len - 4, ".exe") == 0)

+ sprintf (dump_file, "%s%c%.*s%s", path_exec, DIRECTORY_SEP,

+ (int)(argv0_len - 4), argv0_base, suffix);

+ else

+#endif

+ sprintf (dump_file, "%s%c%s%s",

+ path_exec, DIRECTORY_SEP, argv0_base, suffix);

+ result = pdumper_load (dump_file, emacs_executable);

+ }

+

+ if (result != PDUMPER_LOAD_SUCCESS)

+ {

+ if (result != PDUMPER_LOAD_FILE_NOT_FOUND)

+ fatal ("could not load dump file \"%s\": %s",

+ dump_file, dump_error_to_string (result));

+ }

+

+ out:

+ xfree (dump_file);

+

+ return emacs_executable;

+}

+#endif /* HAVE_PDUMPER */

+

+#if SECCOMP_USABLE

+

+/* Wrapper function for the `seccomp' system call on GNU/Linux. This

+ system call usually doesn't have a wrapper function. See the

+ manual page of `seccomp' for the signature. */

+

+static int

+emacs_seccomp (unsigned int operation, unsigned int flags, void *args)

+{

+#ifdef SYS_seccomp

+ return syscall (SYS_seccomp, operation, flags, args);

+#else

+ errno = ENOSYS;

+ return -1;

+#endif

+}

+

+/* Read SIZE bytes into BUFFER. Return the number of bytes read, or

+ -1 if reading failed altogether. */

+

+static ptrdiff_t

+read_full (int fd, void *buffer, ptrdiff_t size)

+{

+ eassert (0 <= fd);

+ eassert (buffer != NULL);

+ eassert (0 <= size);

+ enum

+ {

+ /* See MAX_RW_COUNT in sysdep.c. */

+#ifdef MAX_RW_COUNT

+ max_size = MAX_RW_COUNT

+#else

+ max_size = INT_MAX >> 18 << 18

+#endif

+ };

+ if (PTRDIFF_MAX < size || max_size < size)

+ {

+ errno = EFBIG;

+ return -1;

+ }

+ char *ptr = buffer;

+ ptrdiff_t read = 0;

+ while (size != 0)

+ {

+ ptrdiff_t n = emacs_read (fd, ptr, size);

+ if (n < 0)

+ return -1;

+ if (n == 0)

+ break; /* Avoid infinite loop on encountering EOF. */

+ eassert (n <= size);

+ size -= n;

+ ptr += n;

+ read += n;

+ }

+ return read;

+}

+

+/* Attempt to load Secure Computing filters from FILE. Return false

+ if that doesn't work for some reason. */

+

+static bool

+load_seccomp (const char *file)

+{

+ bool success = false;

+ void *buffer = NULL;

+ int fd

+ = emacs_open_noquit (file, O_RDONLY | O_CLOEXEC | O_BINARY, 0);

+ if (fd < 0)

+ {

+ emacs_perror ("open");

+ goto out;

+ }

+ struct stat stat;

+ if (fstat (fd, &stat) != 0)

+ {

+ emacs_perror ("fstat");

+ goto out;

+ }

+ if (! S_ISREG (stat.st_mode))

+ {

+ fprintf (stderr, "seccomp file %s is not regular\n", file);

+ goto out;

+ }

+ struct sock_fprog program;

+ if (stat.st_size <= 0 || SIZE_MAX <= stat.st_size

+ || PTRDIFF_MAX <= stat.st_size

+ || stat.st_size % sizeof *program.filter != 0)

+ {

+ fprintf (stderr, "seccomp filter %s has invalid size %ld\n",

+ file, (long) stat.st_size);

+ goto out;

+ }

+ size_t size = stat.st_size;

+ size_t count = size / sizeof *program.filter;

+ eassert (0 < count && count < SIZE_MAX);

+ if (USHRT_MAX < count)

+ {

+ fprintf (stderr, "seccomp filter %s is too big\n", file);

+ goto out;

+ }

+ /* Try reading one more byte to detect file size changes. */

+ buffer = malloc (size + 1);

+ if (buffer == NULL)

+ {

+ emacs_perror ("malloc");

+ goto out;

+ }

+ ptrdiff_t read = read_full (fd, buffer, size + 1);

+ if (read < 0)

+ {

+ emacs_perror ("read");

+ goto out;

+ }

+ eassert (read <= SIZE_MAX);

+ if (read != size)

+ {

+ fprintf (stderr,

+ "seccomp filter %s changed size while reading\n",

+ file);

+ goto out;

+ }

+ if (emacs_close (fd) != 0)

+ emacs_perror ("close"); /* not a fatal error */

+ fd = -1;

+ program.len = count;

+ program.filter = buffer;

+

+ /* See man page of `seccomp' why this is necessary. Note that we

+ intentionally don't check the return value: a parent process

+ might have made this call before, in which case it would fail;

+ or, if enabling privilege-restricting mode fails, the `seccomp'

+ syscall will fail anyway. */

+ prctl (PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);

+ /* Install the filter. Make sure that potential other threads can't

+ escape it. */

+ if (emacs_seccomp (SECCOMP_SET_MODE_FILTER,

+ SECCOMP_FILTER_FLAG_TSYNC, &program)

+ != 0)

+ {

+ emacs_perror ("seccomp");

+ goto out;

+ }

+ success = true;

+

+ out:

+ if (0 <= fd)

+ emacs_close (fd);

+ free (buffer);

+ return success;

+}

+

+/* Load Secure Computing filter from file specified with the --seccomp

+ option. Exit if that fails. */

+

+static void

+maybe_load_seccomp (int argc, char **argv)

+{

+ int skip_args = 0;

+ char *file = NULL;

+ while (skip_args < argc - 1)

+ {

+ if (argmatch (argv, argc, "-seccomp", "--seccomp", 9, &file,

+ &skip_args)

+ || argmatch (argv, argc, "--", NULL, 2, NULL, &skip_args))

+ break;

+ ++skip_args;

+ }

+ if (file == NULL)

+ return;

+ if (! load_seccomp (file))

+ fatal ("cannot enable seccomp filter from %s", file);

+}

+

+#endif /* SECCOMP_USABLE */

+

+ /* First, check whether we should apply a seccomp filter. This

+ should come at the very beginning to allow the filter to protect

+ the initialization phase. */

+#if SECCOMP_USABLE

+ maybe_load_seccomp (argc, argv);

+#endif

+

+ char const *original_pwd = 0;

+ const char *dump_mode = NULL;

+ int skip_args = 0;

+ char *temacs = NULL;

+ while (skip_args < argc - 1)

+ {

+ if (argmatch (argv, argc, "-temacs", "--temacs", 8, &temacs, &skip_args)

+ || argmatch (argv, argc, "--", NULL, 2, NULL, &skip_args))

+ break;

+ skip_args++;

+ }

+#ifdef HAVE_PDUMPER

+ bool attempt_load_pdump = false;

+ /* Look for this argument first, before any heap allocation, so we

+ can set heap flags properly if we're going to unexec. */

+ if (!initialized && temacs)

+#ifdef HAVE_UNEXEC

+ if (strcmp (temacs, "dump") == 0 ||

+ strcmp (temacs, "bootstrap") == 0)

+ gflags.will_dump_with_unexec_ = true;

+#endif

+#ifdef HAVE_PDUMPER

+ if (strcmp (temacs, "pdump") == 0 ||

+ strcmp (temacs, "pbootstrap") == 0)

+ gflags.will_dump_with_pdumper_ = true;

+#endif

+#if defined HAVE_PDUMPER || defined HAVE_UNEXEC

+ if (strcmp (temacs, "bootstrap") == 0 ||

+ strcmp (temacs, "pbootstrap") == 0)

+ gflags.will_bootstrap_ = true;

+ gflags.will_dump_ =

+ will_dump_with_pdumper_p () ||

+ will_dump_with_unexec_p ();

+ if (will_dump_p ())

+ dump_mode = temacs;

+#endif

+ if (!dump_mode)

+ fatal ("Invalid temacs mode '%s'", temacs);

+ }

+ else if (temacs)

+ {

+ fatal ("--temacs not supported for unexeced emacs");

+ }

+ else

+ {

+ eassert (!temacs);

+#ifndef HAVE_UNEXEC

+ eassert (!initialized);

+#endif

+#ifdef HAVE_PDUMPER

+ if (!initialized)

+ attempt_load_pdump = true;

+#endif

+#ifdef HAVE_UNEXEC

+ if (!will_dump_with_unexec_p ())

+ gflags.will_not_unexec_ = true;

+#endif

+#ifdef WINDOWSNT

+ /* Grab our malloc arena space now, before anything important

+ happens. This relies on the static heap being needed only in

+ temacs and only if we are going to dump with unexec. */

+ bool use_dynamic_heap = true;

+ if (temacs)

+ char *temacs_str = NULL, *p;

+ for (p = argv[0]; (p = strstr (p, "temacs")) != NULL; p++)

+ temacs_str = p;

+ if (temacs_str != NULL

+ && (temacs_str == argv[0] || IS_DIRECTORY_SEP (temacs_str[-1])))

+ {

+ /* Note that gflags are set at this point only if we have been

+ called with the --temacs=METHOD option. We assume here that

+ temacs is always called that way, otherwise the functions

+ that rely on gflags, like will_dump_with_pdumper_p below,

+ will not do their job. */

+ use_dynamic_heap = will_dump_with_pdumper_p ();

+ }

+ init_heap (use_dynamic_heap);

+ initial_cmdline = GetCommandLine ();

+ early as possible. (w32proc.c calls this function as well, but

+ /* Initialize the startup directory, needed for emacs_wd below. */

+ w32_init_current_directory ();

+#ifdef HAVE_PDUMPER

+ if (attempt_load_pdump)

+ initial_emacs_executable = load_pdump (argc, argv);

+#else

+ ptrdiff_t bufsize;

+ initial_emacs_executable = find_emacs_executable (argv[0], &bufsize);

+#endif

+

+ argc = maybe_disable_address_randomization (argc, argv);

+

+#if defined GNU_LINUX && defined HAVE_UNEXEC

+ if (!initialized)

+ {

+ char *heap_start = my_heap_start ();

+ heap_bss_diff = heap_start - max (my_endbss, my_endbss_static);

+ }

+#endif

+

+#if defined DARWIN_OS && defined HAVE_UNEXEC

+ /* Command-line argument processing.

+

+ The arguments in the argv[] array are sorted in the descending

+ order of their priority as defined in the standard_args[] array

+ below. Then the sorted arguments are processed from the highest

+ to the lowest priority. Each command-line argument that is

+ recognized by 'main', if found in argv[], causes skip_args to be

+ incremented, effectively removing the processed argument from the

+ command line.

+

+ Then init_cmdargs is called, and conses a list of the unprocessed

+ command-line arguments, as strings, in 'command-line-args'. It

+ ignores all the arguments up to the one indexed by skip_args, as

+ those were already processed.

+

+ The arguments in 'command-line-args' are further processed by

+ startup.el, functions 'command-line' and 'command-line-1'. The

+ first of them handles the arguments which need to be processed

+ before loading the user init file and initializing the

+ window-system. The second one processes the arguments that are

+ related to the GUI system, like -font, -geometry, and -title, and

+ then processes the rest of arguments whose priority is below

+ those that are related to the GUI system. The arguments

+ processed by 'command-line' are removed from 'command-line-args';

+ the arguments processed by 'command-line-1' aren't, they are only

+ removed from 'command-line-args-left'.

+

+ 'command-line-1' emits an error message for any argument it

+ doesn't recognize, so any command-line arguments processed in C

+ below whose priority is below the GUI system related switches

+ should be explicitly recognized, ignored, and removed from

+ 'command-line-args-left' in 'command-line-1'. */

+

+ bool only_version = false;

+ skip_args = 0;

+ only_version = true;

+

+#ifdef HAVE_PDUMPER

+ if (argmatch (argv, argc, "-fingerprint", "--fingerprint", 4,

+ NULL, &skip_args)

+ && !only_version)

+ {

+ dump_fingerprint (stdout, "",

+ (unsigned char *) fingerprint);

+ exit (0);

+ }

+ {

+ fputs ("Not initialized\n", stderr);

+ exit (1);

+ }

+#endif

+ emacs_wd = emacs_get_current_dir_name ();

+#ifdef WINDOWSNT

+ initial_wd = emacs_wd;

+#endif

+#ifdef HAVE_PDUMPER

+ if (dumped_with_pdumper_p ())

+ pdumper_record_wd (emacs_wd);

+#endif

+

+ if (argmatch (argv, argc, "-chdir", "--chdir", 4, &ch_to_dir, &skip_args)

+ && !only_version)

+ original_pwd = emacs_wd;

+#ifdef WINDOWSNT

+ /* Reinitialize Emacs's notion of the startup directory. */

+ w32_init_current_directory ();

+#endif

+ emacs_wd = emacs_get_current_dir_name ();

+ /* Approximate the amount regex-emacs.c needs per unit of

+ smaller stacks that regex-emacs.c successively allocates and

+ bool try_to_grow_stack = !noninteractive || initialized;

+ if (newlim > lim /* in case rlim_t is an unsigned type */

+ && pagesize <= newlim - lim)

+ /* If the stack is big enough, let regex-emacs.c use more of it

+ before falling back to heap allocation. */

+ if (lim < extra)

+ lim = extra; /* avoid wrap-around in unsigned subtraction */

+ ptrdiff_t max_failures

+ = min (lim - extra, min (PTRDIFF_MAX, SIZE_MAX)) / ratio;

+ emacs_re_safe_alloca = max (max_failures * min_ratio, MAX_ALLOCA);

+ clearerr (stdin);

+ /* Set locale, so that initial error messages are localized properly.

+ However, skip this if LC_ALL is "C", as it's not needed in that case.

+ Skipping helps if dumping with unexec, to ensure that the dumped

+ Emacs does not have its system locale tables initialized, as that

+ might cause screwups when the dumped Emacs starts up. */

+ char *lc_all = getenv ("LC_ALL");

+ if (! (lc_all && strcmp (lc_all, "C") == 0))

+ {

+ #ifdef HAVE_NS

+ ns_pool = ns_alloc_autorelease_pool ();

+ ns_init_locale ();

+ #endif

+ setlocale (LC_ALL, "");

+ fixup_locale ();

+ }

+ while (!only_version)

+ int result = emacs_open_noquit (term, O_RDWR, 0);

+ const char *errstring = strerror (errno);

+ if (argmatch (argv, argc, "-batch", "--batch", 5, NULL, &skip_args)

+ || only_version)

+ if (argmatch (argv, argc, "-help", "--help", 3, NULL, &skip_args)

+ && !only_version)

+ fputs (usage_message[i], stdout);

+ if (!only_version)

+ if (argmatch (argv, argc, "-fg-daemon", "--fg-daemon", 10, NULL,

+ &skip_args)

+ || argmatch (argv, argc, "-fg-daemon", "--fg-daemon", 10, &dname_arg,

+ &skip_args))

+ {

+ daemon_type = 1; /* foreground */

+ }

+ else if (argmatch (argv, argc, "-daemon", "--daemon", 5, NULL, &skip_args)

+ || argmatch (argv, argc, "-daemon", "--daemon", 5, &dname_arg,

+ &skip_args)

+ || argmatch (argv, argc, "-bg-daemon", "--bg-daemon", 10, NULL,

+ &skip_args)

+ || argmatch (argv, argc, "-bg-daemon", "--bg-daemon", 10,

+ &dname_arg, &skip_args))

+ {

+ daemon_type = 2; /* background */

+ }

+ fputs ("Cannot pipe!\n", stderr);

+ fputs (("\n"

+ "Warning: systemd passed more than one socket to Emacs.\n"

+ "Try 'Accept=false' in the Emacs socket unit file.\n"),

+ stderr);

+ /* On X, the bug happens because we call abort to avoid GLib

+ crashes upon a longjmp in our X error handler.

+

+ On PGTK, GTK calls exit in its own error handlers for either

+ X or Wayland. Display different messages depending on the

+ window system to avoid referring users to the wrong GTK bug

+ report. */

+#ifdef HAVE_PGTK

+ fputs ("Due to a limitation in GTK 3, Emacs built with PGTK will simply exit when a\n"

+ "display connection is closed. The problem is especially difficult to fix,\n"

+ "such that Emacs on Wayland with multiple displays is unlikely ever to be able\n"

+ "to survive disconnects.\n",

+ stderr);

+#elif defined USE_GTK

+ fputs ("\nWarning: due to a long standing Gtk+ bug\nhttps://gitlab.gnome.org/GNOME/gtk/issues/221\n\

+Using an Emacs configured with --with-x-toolkit=lucid does not have this problem.\n",

+ stderr);

+#endif

+ fputs ("Error reading status from child\n", stderr);

+ fputs ("Error: server did not start correctly\n", stderr);

+ fputs ("daemon: child name too long\n", stderr);

+ if (!dname_arg || !*dname_arg || strnlen (dname_arg, 71) == 71

+ || !strchr (dname_arg, '\n'))

+ {

+ fputs ("emacs daemon: daemon name absent or too long\n",

+ stderr);

+ exit (EXIT_CANNOT_INVOKE);

+ }

+ fputs ("This platform does not support daemon mode.\n", stderr);

+ if (!noninteractive || !will_dump_p ())

+ init_signals ();

+ init_pdumper_once ();

+ init_obarray_once ();

+ Emacs starts up from scratch (e.g., temacs). */

+ init_frame_once (); /* Before init_window_once. */

+ init_bignum ();

+ init_xfaces ();

+

+#if defined HAVE_JSON && !defined WINDOWSNT

+ init_json ();

+#endif

+

+ if (!initialized)

+ syms_of_comp ();

+

+ /* Do less garbage collection in batch mode (since these tend to be

+ more short-lived, and the memory is returned to the OS on exit

+ anyway). */

+ Vgc_cons_percentage = make_float (noninteractive? 1.0: 0.1);

+ if (will_dump_p () && module_assertions && !only_version)

+ bool go_home = (!ch_to_dir && !inhibit_window_system

+ && !isatty (STDIN_FILENO));

+ go_home |= !ch_to_dir;

+ go_home |= !ch_to_dir;

+ if (go_home)

+ {

+ char const *home = get_homedir ();

+ if (*home && chdir (home) == 0)

+ emacs_wd = emacs_get_current_dir_name ();

+ }

+ while (!only_version)

+ if (argmatch (argv, argc, "-x", 0, 1, &junk, &skip_args))

+ {

+ noninteractive = 1;

+ no_site_lisp = 1;

+ /* This is picked up in startup.el. */

+ argv[skip_args - 1] = (char *) "-scripteval";

+ skip_args -= 1;

+ sort_args (argc, argv);

+ }

+

+ if (!will_dump_p ())

+ /* Has to run after the environment is set up. */

+ init_atimer ();

+

+ init_ntproc (will_dump_p ()); /* must precede init_editfns. */

+ init_buffer ();

+ /* Must precede init_cmdargs and init_sys_modes. */

+ init_callproc_1 ();

+

+ /* If "-version" was specified, produce version information and

+ exit. We do it here because the code below needs to call Lisp

+ primitives, which cannot be done safely before we call all the

+ init_FOO initialization functions above. */

+ if (only_version)

+ {

+ const char *version, *copyright;

+

+ if (initialized)

+ {

+ Lisp_Object tem = Fsymbol_value (intern_c_string ("emacs-version"));

+ Lisp_Object tem2 = Fsymbol_value (intern_c_string ("emacs-copyright"));

+ if (!STRINGP (tem))

+ {

+ fputs ("Invalid value of 'emacs-version'\n", stderr);

+ exit (1);

+ }

+ if (!STRINGP (tem2))

+ {

+ fputs ("Invalid value of 'emacs-copyright'\n", stderr);

+ exit (1);

+ }

+ else

+ {

+ version = SSDATA (tem);

+ copyright = SSDATA (tem2);

+ }

+ }

+ else

+ {

+ version = emacs_version;

+ copyright = emacs_copyright;

+ }

+ printf ("%s %s\n", PACKAGE_NAME, version);

+

+ if (initialized)

+ {

+ Lisp_Object rversion, rbranch, rtime;

+

+ rversion

+ = Fsymbol_value (intern_c_string ("emacs-repository-version"));

+ rbranch

+ = Fsymbol_value (intern_c_string ("emacs-repository-branch"));

+ rtime

+ = Fsymbol_value (intern_c_string ("emacs-build-time"));

+

+ if (!NILP (rversion) && !NILP (rbranch) && !NILP (rtime))

+ printf ("Development version %s on %s branch; build date %s.\n",

+ SSDATA (Fsubstring (rversion, make_fixnum (0),

+ make_fixnum (12))),

+ SSDATA (rbranch),

+ SSDATA (Fformat_time_string (build_string ("%Y-%m-%d"),

+ rtime, Qnil)));

+ }

+

+ printf (("%s\n"

+ "%s comes with ABSOLUTELY NO WARRANTY.\n"

+ "You may redistribute copies of %s\n"

+ "under the terms of the GNU General Public License.\n"

+ "For more information about these matters, "

+ "see the file named COPYING.\n"),

+ copyright, PACKAGE_NAME, PACKAGE_NAME);

+ exit (0);

+ }

+

+ syms_of_sysdep ();

+ syms_of_timefns ();

+ syms_of_sqlite ();

+#if defined HAVE_NTGUI || defined CYGWIN

+ syms_of_w32cygwinx ();

+#endif

+

+#ifdef HAVE_PGTK

+ syms_of_pgtkterm ();

+ syms_of_pgtkfns ();

+ syms_of_pgtkselect ();

+ syms_of_pgtkmenu ();

+ syms_of_pgtkim ();

+ syms_of_fontset ();

+ syms_of_xsettings ();

+#endif /* HAVE_PGTK */

+#ifdef HAVE_HAIKU

+ syms_of_haikuterm ();

+ syms_of_haikufns ();

+ syms_of_haikumenu ();

+ syms_of_haikufont ();

+ syms_of_haikuselect ();

+#ifdef HAVE_NATIVE_IMAGE_API

+ syms_of_haikuimage ();

+#endif

+ syms_of_fontset ();

+#endif /* HAVE_HAIKU */

+

+ syms_of_xwidget ();

+ syms_of_pdumper ();

+

+#ifdef HAVE_JSON

+ syms_of_json ();

+#endif

+

+#ifdef HAVE_NATIVE_COMP

+ /* Must be after the last defsubr has run. */

+ hash_native_abi ();

+#endif

+#ifdef HAVE_HAIKU

+ init_haiku_select ();

+#endif

+

+ /* This calls putenv and so must precede init_process_emacs. */

+ init_timefns ();

+

+ init_editfns ();

+#if defined(USE_GTK) && !defined(HAVE_PGTK)

+ init_display (); /* Determine terminal type. Calls init_sys_modes. */

+ if (noninteractive)

+

+#ifdef HAVE_NATIVE_COMP

+ /* If we are going to load stuff in a non-initialized Emacs,

+ update the value of native-comp-eln-load-path, so that the

+ *.eln files will be found if they are there. */

+ if (!NILP (Vtop_level) && !temacs)

+ Vnative_comp_eln_load_path =

+ Fcons (Fexpand_file_name (XCAR (Vnative_comp_eln_load_path),

+ Vinvocation_directory),

+ Qnil);

+#endif

+ initialized = true;

+

+ if (dump_mode)

+ Vdump_mode = build_string (dump_mode);

+

+#ifdef HAVE_PDUMPER

+ /* Allow code to be run (mostly useful after redumping). */

+ safe_run_hooks (Qafter_pdump_load_hook);

+#endif

+ set_initial_minibuffer_mode ();

+ eassume (false);

+#ifdef HAVE_PDUMPER

+ { "-fingerprint", "--fingerprint", 140, 0 },

+#endif

+ { "-x", 0, 55, 0 },

+ { "-init-directory", "--init-directory", 30, 1 },

+ /* The following three must be just above the file-name args, to get

+ them out of our way, but without mixing them with file names. */

+ { "-temacs", "--temacs", 1, 1 },

+#ifdef HAVE_PDUMPER

+ { "-dump-file", "--dump-file", 1, 1 },

+#endif

+#if SECCOMP_USABLE

+ { "-seccomp", "--seccomp", 1, 1 },

+#endif

+DEFUN ("kill-emacs", Fkill_emacs, Skill_emacs, 0, 2, "P",

+Any other value of ARG, or ARG omitted, means return an

+exit code that indicates successful program termination.

+

+If RESTART is non-nil, instead of just exiting at the end, start a new

+Emacs process, using the same command line arguments as the currently

+running Emacs process.

+The value of `kill-emacs-hook', if not void, is a list of functions

+(of no args), all of which are called before Emacs is actually

+killed. */

+ (Lisp_Object arg, Lisp_Object restart)

+#ifndef WINDOWSNT

+ /* Do some checking before shutting down Emacs, because errors

+ can't be meaningfully reported afterwards. */

+ if (!NILP (restart))

+ {

+ /* This is very unlikely, but it's possible to execute a binary

+ (on some systems) with no argv. */

+ if (initial_argc < 1)

+ error ("No command line arguments known; unable to re-execute Emacs");

+

+ /* Check that the binary hasn't gone away. */

+ if (!initial_emacs_executable)

+ error ("Unknown Emacs executable");

+

+ if (!file_access_p (initial_emacs_executable, F_OK))

+ error ("Emacs executable \"%s\" can't be found", initial_argv[0]);

+ }

+#endif

+

+#ifdef HAVE_LIBSYSTEMD

+ /* Notify systemd we are shutting down, but only if we have notified

+ it about startup. */

+ if (daemon_type == -1)

+ sd_notify(0, "STOPPING=1");

+#endif /* HAVE_LIBSYSTEMD */

+

+ if (!NILP (find_symbol_value (Qkill_emacs_hook)))

+ {

+ if (noninteractive)

+ safe_run_hooks (Qkill_emacs_hook);

+ else

+ call1 (Qrun_hook_query_error_with_timeout, Qkill_emacs_hook);

+ }

+#ifdef HAVE_NATIVE_COMP

+ eln_load_path_final_clean_up ();

+#endif

+

+ if (!NILP (restart))

+ {

+#ifdef WINDOWSNT

+ if (w32_reexec_emacs (initial_cmdline, initial_wd) < 0)

+#else

+ initial_argv[0] = initial_emacs_executable;

+ if (execvp (*initial_argv, initial_argv) < 1)

+#endif

+ emacs_perror ("Unable to re-execute Emacs");

+ }

+

+ if (FIXNUMP (arg))

+ exit_code = (XFIXNUM (arg) < 0

+ ? XFIXNUM (arg) | INT_MIN

+ : XFIXNUM (arg) & INT_MAX);

+ pid_t tpgrp = tcgetpgrp (STDIN_FILENO);

+ if (tpgrp != -1 && tpgrp == getpgrp ())

+ {

+ reset_all_sys_modes ();

+ if (sig && sig != SIGTERM)

+ {

+ static char const fmt[] = "Fatal error %d: %n%s\n";

+#ifdef HAVE_HAIKU

+ if (haiku_debug_on_fatal_error)

+ debugger ("Fatal error in Emacs");

+#endif

+ char buf[max ((sizeof fmt - sizeof "%d%n%s\n"

+ + INT_STRLEN_BOUND (int) + 1),

+ min (PIPE_BUF, MAX_ALLOCA))];

+ char const *sig_desc = safe_strsignal (sig);

+ int nlen;

+ int buflen = snprintf (buf, sizeof buf, fmt, sig, &nlen, sig_desc);

+ if (0 <= buflen && buflen < sizeof buf)

+ else

+ {

+ emacs_write (STDERR_FILENO, buf, nlen);

+ emacs_write (STDERR_FILENO, sig_desc, strlen (sig_desc));

+ emacs_write (STDERR_FILENO, fmt + sizeof fmt - 2, 1);

+ }

+ }

+ }

+#ifdef HAVE_NATIVE_COMP

+ eln_load_path_final_clean_up ();

+#endif

+

+#ifdef HAVE_UNEXEC

+ specpdl_ref count = SPECPDL_INDEX ();

+ if (dumped_with_unexec_p ())

+ error ("Emacs can be dumped using unexec only once");

+

+ if (definitely_will_not_unexec_p ())

+ error ("This Emacs instance was not started in temacs mode");

+# if defined GNU_LINUX && defined HAVE_UNEXEC

+# define MAX_HEAP_BSS_DIFF (1024 * 1024)

+ fprintf (stderr,

+ ("**************************************************\n"

+ "Warning: Your system has a gap between BSS and the\n"

+ "heap (%"PRIuMAX" bytes). This usually means that exec-shield\n"

+ "or something similar is in effect. The dump may\n"

+ "fail because of this. See the section about\n"

+ "exec-shield in etc/PROBLEMS for more information.\n"

+ "**************************************************\n"),

+ heap_bss_diff);

+# endif

+# ifdef HYBRID_MALLOC

+# endif

+ fflush (stdout);

+# if !defined SYSTEM_MALLOC && !defined HYBRID_MALLOC && !defined WINDOWSNT

+# endif

+

+ struct gflags old_gflags = gflags;

+ gflags.will_dump_ = false;

+ gflags.will_dump_with_unexec_ = false;

+ gflags.dumped_with_unexec_ = true;

+ gflags = old_gflags;

+

+# ifdef WINDOWSNT

+# endif

+#endif

+

+ char const *locale_string

+ = STRINGP (desired_locale) ? SSDATA (desired_locale) : "";

+# ifdef WINDOWSNT

+ setlocale (LC_ALL, locale_string);

+# else /* !WINDOWSNT */

+ setlocale (category, locale_string);

+# endif /* !WINDOWSNT */

+static Lisp_Object Vprevious_system_time_locale;

+

+# ifdef LC_MESSAGES

+static Lisp_Object Vprevious_system_messages_locale;

+# endif

+

+# ifdef LC_MESSAGES

+# endif

+#ifdef NS_SELF_CONTAINED

+ void *autorelease = NULL;

+#endif

+#ifdef NS_SELF_CONTAINED

+ /* ns_relocate needs a valid autorelease pool around it. */

+ autorelease = ns_alloc_autorelease_pool ();

+ path = ns_relocate (defalt);

+#else

+#endif

+ make_fixnum (emacs_dir_len),

+

+#ifdef NS_SELF_CONTAINED

+ if (autorelease)

+ ns_release_autorelease_pool (autorelease);

+#endif

+ if (daemon_type == 1)

+ {

+#ifdef HAVE_LIBSYSTEMD

+ sd_notify(0, "READY=1");

+#endif /* HAVE_LIBSYSTEMD */

+ }

+

+ nfd = emacs_open_noquit ("/dev/null", O_RDWR, 0);

+ daemon_type = -daemon_type;

+ DEFSYM (Qrun_hook_query_error_with_timeout,

+ "run-hook-query-error-with-timeout");

+#ifdef HAVE_UNEXEC

+ `haiku' compiled for a Haiku system.

+ doc: /* Non-nil means Emacs is running without interactive terminal. */);

+#ifdef LC_MESSAGES

+ staticpro (&Vprevious_system_messages_locale);

+#endif

+ staticpro (&Vprevious_system_time_locale);

+ DEFVAR_LISP ("dump-mode", Vdump_mode,

+ doc: /* Non-nil when Emacs is dumping itself. */);

+

+#ifdef WINDOWSNT

+ /* FIXME: We may need to load libgccjit when dumping before

+ term/w32-win.el defines `dynamic-library-alist`. This will fail

+ if that variable is empty, so add libgccjit-0.dll to it. */

+ if (will_dump_p ())

+ Vdynamic_library_alist = list1 (list2 (Qgccjit,

+ build_string ("libgccjit-0.dll")));

+ else

+ Vdynamic_library_alist = Qnil;

+#else

+#endif